@revfleet/hscli 0.8.11 → 0.9.0

package/dist/commands/internal/index.js

@@ -0,0 +1,823 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { CliError, printResult, redactSensitive } from "../../core/output.js";
+import { addBrowserSessionOptions, resolveBrowserSession } from "../internal-session.js";
+export const INTERNAL_CAPTURE_GUARDRAILS = [
+    "Public API first; use internal capture only for HubSpot UI-only gaps.",
+    "No generic internal passthrough: every endpoint must be declared in the allowlist.",
+    "Capture is read-only: GET plus HubSpot read-only POST/RPC/search/preview calls only.",
+    "Missing IDs, request bodies, or permissions are skipped and written to the manifest.",
+    "Never store browser cookies or CSRF tokens in output files.",
+];
+export const INTERNAL_SURFACES = [
+    {
+        id: "business-units",
+        label: "Business units",
+        mode: "internal-browser-session",
+        description: "Business-unit IDs and default business-unit context.",
+        endpoints: [
+            {
+                id: "business-units",
+                method: "GET",
+                path: "/api/business-units/v1/business-units?portalId={portalId}",
+                purpose: "List business units and default business-unit context.",
+            },
+        ],
+    },
+    {
+        id: "branding",
+        label: "Brand kits and multi-brand identity",
+        mode: "internal-browser-session",
+        description: "Brand kits, brand metadata, and multi-brand settings.",
+        endpoints: [
+            {
+                id: "brand-kit",
+                method: "GET",
+                path: "/api/branding/v1/brand-kit?portalId={portalId}",
+                purpose: "Brand kit catalog and BU-linked brand metadata.",
+            },
+            {
+                id: "brand-kit-single",
+                method: "GET",
+                path: "/api/branding/v1/brand-kit/{brandKitId}",
+                purpose: "Single brand kit detail.",
+            },
+            {
+                id: "brand-kit-business-unit",
+                method: "GET",
+                path: "/api/branding/v1/brand-kit/business-unit/{businessUnitId}",
+                purpose: "Business-unit scoped brand kit detail.",
+            },
+            {
+                id: "multi-brand-settings",
+                method: "GET",
+                path: "/api/multi-brand/v1/brands?portalId={portalId}",
+                purpose: "Multi-brand UI inventory when enabled.",
+            },
+            {
+                id: "brand-kit-colors",
+                method: "GET",
+                path: "/api/branding/v1/colors/brand-kit?portalId={portalId}",
+                purpose: "Brand kit color palette metadata for backup and replay planning.",
+            },
+            {
+                id: "brand-kit-logos",
+                method: "GET",
+                path: "/api/branding/v1/logos/brand-kit?portalId={portalId}",
+                purpose: "Brand kit logos for asset backup and remapping.",
+            },
+            {
+                id: "brand-kit-favicons",
+                method: "GET",
+                path: "/api/branding/v1/favicons/brand-kit?portalId={portalId}",
+                purpose: "Brand kit favicons for CMS/email identity backup.",
+            },
+            {
+                id: "brand-kit-fonts",
+                method: "GET",
+                path: "/api/branding/v1/fonts-with-variants?portalId={portalId}",
+                purpose: "Brand kit font families and variants.",
+            },
+            {
+                id: "brand-kit-font-meta",
+                method: "GET",
+                path: "/api/branding/v1/font-meta?portalId={portalId}",
+                purpose: "Brand font metadata when enabled.",
+            },
+            {
+                id: "brand-voice",
+                method: "GET",
+                path: "/api/branding/v1/brand-voice/by-bu-id/{businessUnitId}",
+                purpose: "Business-unit brand voice metadata when the AI copy UI is enabled.",
+            },
+        ],
+    },
+    {
+        id: "permission-access",
+        label: "Users, teams, permission sets, roles, seats, and FLP",
+        mode: "internal-browser-session",
+        description: "Access model capture for permission migration, downgrade proof, and governance audits.",
+        endpoints: [
+            { id: "app-users", method: "GET", path: "/api/app-users/v1/users?portalId={portalId}&limit=200", purpose: "Full app-user payloads with roleNames and permission-set IDs." },
+            { id: "app-user", method: "GET", path: "/api/app-users/v1/users/{userId}?portalId={portalId}", purpose: "Single app-user payload with roleNames, permission-set IDs, teams, status, and seat state." },
+            { id: "integrator-users", method: "GET", path: "/api/integrators/v1/{portalId}/info/users", purpose: "Full user ID-to-name/email/deactivation map used by older settings UIs." },
+            { id: "teams", method: "GET", path: "/api/app-users/v1/teams?portalId={portalId}", purpose: "Internal team hierarchy and membership." },
+            { id: "team-hub-settings", method: "GET", path: "/api/teams/v1/team-hub-settings?portalId={portalId}", purpose: "Team hub-level settings such as default content assignment." },
+            { id: "permission-sets", method: "GET", path: "/api/app-users/v1/permission-sets?portalId={portalId}", purpose: "Permission-set definitions with roleNames." },
+            { id: "permission-set", method: "GET", path: "/api/app-users/v1/permission-sets/{permissionSetId}?portalId={portalId}", purpose: "Single permission-set definition with capability flags." },
+            { id: "permission-set-assignments", method: "GET", path: "/api/app-users/v1/permission-sets/permission-set-user-assignments?portalId={portalId}", purpose: "User-to-permission-set assignment map." },
+            { id: "roles", method: "GET", path: "/api/app-users/v1/roles?portalId={portalId}", purpose: "Atomic role catalog." },
+            { id: "role", method: "GET", path: "/api/app-users/v1/roles/{roleName}?portalId={portalId}", purpose: "Single atomic role, description, and dependency metadata." },
+            { id: "role-categories", method: "GET", path: "/api/app-users/v1/role-categories?portalId={portalId}", purpose: "Role category UI grouping." },
+            { id: "role-scopes", method: "GET", path: "/api/app-users/v1/scopes?portalId={portalId}", purpose: "Owned/team/all/unassigned scope buckets." },
+            { id: "seats", method: "GET", path: "/api/app-users/v1/seats?portalId={portalId}", purpose: "Seat type catalog." },
+            { id: "seat-assignments", method: "GET", path: "/api/app-users/v1/seat-assignments?portalId={portalId}", purpose: "Seat assignments by user." },
+            { id: "seat-assignment", method: "GET", path: "/api/app-users/v1/seat-assignments/{userId}?portalId={portalId}", purpose: "Single user's seat assignment state." },
+            { id: "permission-templates", method: "GET", path: "/api/permission-templates/v1/templates?portalId={portalId}", purpose: "HubSpot/custom permission templates." },
+            { id: "permission-template", method: "GET", path: "/api/permission-templates/v1/templates/{templateId}?portalId={portalId}", purpose: "Single permission template definition." },
+            { id: "permission-set-options", method: "GET", path: "/api/external-options/v3/fetch/PERMISSION_SET", purpose: "Permission-set typeahead options used by settings UI." },
+            { id: "team-options", method: "GET", path: "/api/external-options/v3/fetch/TEAM", purpose: "Team typeahead options used by settings UI." },
+            { id: "flp-allowlistings", method: "GET", path: "/api/crm-permissions/v1/field-level-permissions/allowlistings", purpose: "Field-level permission allowlist inventory." },
+            { id: "flp-allowlistings-object", method: "GET", path: "/api/crm-permissions/v1/field-level-permissions/allowlistings/{typeId}", purpose: "Field-level permission allowlist for one CRM object type." },
+            { id: "flp-allowlisting-property", method: "GET", path: "/api/crm-permissions/v1/field-level-permissions/allowlistings/{typeId}/{propertyName}", purpose: "Field-level permission allowlist for one property." },
+            { id: "flp-blocklist", method: "GET", path: "/api/crm-permissions/v1/field-level-permissions/blocklist/including-global", purpose: "Field-level permission blocklist." },
+            { id: "flp-bypass-users", method: "GET", path: "/api/permissions-skynet/v1/scopes/app/field-level-permissions-bypass/user-ids", purpose: "Users bypassing FLP." },
+            { id: "app-users-batch", method: "POST", path: "/api/app-users/v1/users/partial/batch?portalId={portalId}", purpose: "Read-only batch user hydration.", readOnlyKind: "batch-read", bodyRequired: true },
+            { id: "flp-access-state", method: "POST", path: "/api/crm-permissions/v1/field-level-permissions/allowlistings/access-state/multi-get?portalId={portalId}", purpose: "Read-only bulk field-level-permission access-state check.", readOnlyKind: "batch-read", bodyRequired: true },
+            { id: "permission-audit-user-access", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.app.user.audits.service.rpc.AppUserAuditsRpc/getUserAccessAudit", purpose: "Read-only user access audit RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "permission-set-assignment-history", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.app.user.audits.service.rpc.AppUserAuditsRpc/getPermissionSetAssignmentHistory", purpose: "Read-only permission-set assignment history RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "role-change-history", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.app.user.audits.service.rpc.AppUserAuditsRpc/getRoleChangeHistory", purpose: "Read-only role change history RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+        ],
+    },
+    {
+        id: "datasets-reporting",
+        label: "Datasets, reportable sources, and SQL reporting metadata",
+        mode: "internal-browser-session",
+        description: "Data Studio definitions, joins, reportable properties, and preview metadata.",
+        endpoints: [
+            { id: "datasets", method: "GET", path: "/sql-reporting/v1/datasets", purpose: "Dataset catalog." },
+            { id: "dataset", method: "GET", path: "/sql-reporting/v1/datasets/{datasetId}", purpose: "Dataset sources, joins, formulas, and filters." },
+            { id: "global-dataset", method: "GET", path: "/sql-reporting/v1/global-datasets/{datasetId}", purpose: "Global dataset definition." },
+            { id: "dataset-functions", method: "GET", path: "/sql-reporting/v1/datasets/functions", purpose: "Dataset formula/function catalog." },
+            { id: "dataset-resolve-result", method: "GET", path: "/api/reporting/v3/dataset/resolve/async/{requestId}", purpose: "Poll a read-only async dataset/report render result." },
+            { id: "reportable-sources", method: "GET", path: "/sql-reporting/v1/extended-reportable-options/data-sources", purpose: "Reportable data sources." },
+            { id: "reportable-joins", method: "GET", path: "/sql-reporting/v1/extended-reportable-options/data-sources/available-joins-with-metadata?withVariants=true", purpose: "Data Studio join graph." },
+            { id: "reportable-properties", method: "GET", path: "/sql-reporting/v1/extended-reportable-options/data-sources/properties/{objectTypeId}", purpose: "Reportable properties for one source." },
+            { id: "multi-currency-information", method: "GET", path: "/api/multi-currency/v2/currencies/information", purpose: "Currency metadata used by revenue reports." },
+            { id: "external-owner-options", method: "GET", path: "/api/external-options/v3/pagedFetch/OWNER", purpose: "Owner option metadata used by report filters." },
+            { id: "reporting-insights-abtest-options", method: "GET", path: "/api/reporting-insights/copilot/v1/abtest/options", purpose: "Reporting insights feature-gate metadata." },
+            { id: "dataset-preview", method: "POST", path: "/api/sql-reporting-query/v1/datasets/preview", purpose: "Read-only dataset preview.", readOnlyKind: "preview", bodyRequired: true },
+            { id: "dataset-resolve", method: "POST", path: "/api/reporting/v3/dataset/resolve/async", purpose: "Read-only report/dataset resolver.", readOnlyKind: "resolve", bodyRequired: true },
+        ],
+    },
+    {
+        id: "reports-dashboards",
+        label: "Reports, dashboards, widgets, permissions, and saved report views",
+        mode: "internal-browser-session",
+        description: "Report definitions and dashboard layouts that public endpoints often omit.",
+        endpoints: [
+            { id: "favorites", method: "GET", path: "/api/dashboard/v2/favorite/all", purpose: "Starred report/dashboard inventory." },
+            { id: "reports", method: "GET", path: "/api/dashboard/v2/reports", purpose: "Internal report catalog." },
+            { id: "reports-list", method: "GET", path: "/api/dashboard/v2/reports/list", purpose: "Alternate internal report catalog." },
+            { id: "reports-search", method: "GET", path: "/api/dashboard/v2/reports/search", purpose: "Report search endpoint used by the reports UI." },
+            { id: "report", method: "GET", path: "/api/dashboard/v2/reports/{reportId}", purpose: "Full report definition and chart config." },
+            { id: "report-record-view", method: "GET", path: "/api/dashboard/v2/reports/{reportId}/record-view", purpose: "Report view telemetry/read state captured by the report UI." },
+            { id: "report-history", method: "GET", path: "/api/dashboard/v2/reports/{reportId}/history", purpose: "Report version history." },
+            { id: "report-audit", method: "GET", path: "/api/dashboard/v2/reports/{reportId}/audit", purpose: "Per-report audit trail." },
+            { id: "report-permissions", method: "GET", path: "/api/dashboard/v2/reports/{reportId}/permissions", purpose: "Report sharing and grants." },
+            { id: "report-permissions-v1", method: "GET", path: "/api/reports-permissions/v1/permissions/report/{reportId}", purpose: "Report permission state fallback when dashboard v2 permissions omit grants." },
+            { id: "reports-permission-probe", method: "GET", path: "/api/dashboard/v2/reports/permission", purpose: "Report permission probe endpoint used by the reports UI." },
+            { id: "report-counts", method: "GET", path: "/api/dashboard/v2/reports/report-counts", purpose: "Report counts per list view." },
+            { id: "reporting-portal-reports", method: "GET", path: "/api/reporting-frontend/v1/reports/get-portal-reports", purpose: "Portal-wide report list from reporting frontend." },
+            { id: "report-template", method: "GET", path: "/api/reporting-discovery/v1/report-template", purpose: "Built-in report template catalog." },
+            { id: "report-template-paged", method: "GET", path: "/api/reporting-discovery/v1/report-template/paged", purpose: "Paged built-in report template catalog." },
+            { id: "report-template-key", method: "GET", path: "/api/reporting-discovery/v1/report-template/template-key/{templateKey}", purpose: "Single built-in report template definition." },
+            { id: "dashboards", method: "GET", path: "/api/dashboard/v2/dashboard", purpose: "Internal dashboard catalog." },
+            { id: "dashboards-list", method: "GET", path: "/api/dashboard/v2/dashboard/list", purpose: "Alternate internal dashboard catalog." },
+            { id: "dashboards-search", method: "GET", path: "/api/dashboard/v2/dashboard/search", purpose: "Dashboard search endpoint used by the dashboards UI." },
+            { id: "dashboards-total-count", method: "GET", path: "/api/dashboard/v2/dashboard/total-count", purpose: "Dashboard quick count." },
+            { id: "dashboards-all-shareable", method: "GET", path: "/api/dashboard/v2/dashboard/all-shareable", purpose: "Shareable dashboard inventory." },
+            { id: "dashboard-widget-counts", method: "GET", path: "/api/dashboard/v2/dashboard/widget-counts", purpose: "Widget counts per dashboard for dashboard completeness checks." },
+            { id: "dashboard", method: "GET", path: "/api/dashboard/v2/dashboard/{dashboardId}", purpose: "Full dashboard definition, layout, widgets, and share settings." },
+            { id: "dashboard-permission-single", method: "GET", path: "/api/dashboard/v2/dashboard/{dashboardId}/permission", purpose: "Single-user dashboard permission state." },
+            { id: "dashboard-permissions", method: "GET", path: "/api/dashboard/v2/dashboard/{dashboardId}/permissions", purpose: "Dashboard permission grants." },
+            { id: "dashboard-permission-config", method: "GET", path: "/api/dashboard/v2/dashboard/{dashboardId}/permission-config", purpose: "Dashboard permission configuration." },
+            { id: "dashboard-permission-grants", method: "GET", path: "/api/dashboard/v2/dashboard/{dashboardId}/permission-grants", purpose: "Explicit dashboard permission grants." },
+            { id: "dashboard-widget", method: "GET", path: "/api/dashboard/v2/widget/{widgetId}", purpose: "Single dashboard widget definition and report binding." },
+            { id: "dashboard-widgets", method: "GET", path: "/api/dashboard/v2/widget", purpose: "Dashboard widget access endpoint used by the dashboard UI." },
+            { id: "report-list-views", method: "GET", path: "/api/dashboard/v2/report-list-views", purpose: "Report-list saved views." },
+            { id: "report-list-views-pinned", method: "GET", path: "/api/dashboard/v2/report-list-views/pinned", purpose: "Pinned report/dashboard views." },
+            { id: "journey-report-resolve", method: "POST", path: "/api/reporting/v3/journey/{reportId}/resolve/async", purpose: "Read-only journey report resolver.", readOnlyKind: "resolve", bodyRequired: true },
+        ],
+    },
+    {
+        id: "workflows-hybrid",
+        label: "Workflow hybrid definitions and automation editor metadata",
+        mode: "internal-browser-session",
+        description: "Full workflow action graphs, validation, outputs, action catalog, and canvas insights.",
+        endpoints: [
+            { id: "flows", method: "GET", path: "/api/automation/v4/flows?limit=100", purpose: "Workflow list and UI metadata." },
+            { id: "legacy-workflows", method: "GET", path: "/api/automation/v3/workflows", purpose: "Legacy workflow list for cross-checking." },
+            { id: "workflow-hybrid", method: "GET", path: "/api/automationplatform/v1/hybrid/{flowId}", purpose: "Full workflow source of truth." },
+            { id: "workflow-validation", method: "GET", path: "/api/automationplatform/v1/validation/{flowId}", purpose: "Workflow validation errors and warnings." },
+            { id: "workflow-output-fields", method: "GET", path: "/api/automationplatform/v1/output-fields/flow/{flowId}/allOutputs", purpose: "Outputs available to downstream actions." },
+            { id: "workflow-object-access", method: "GET", path: "/api/automationplatform/v1/access/object-enrolled-type-access", purpose: "Object types available for workflow enrollment." },
+            { id: "workflow-permission-check", method: "GET", path: "/api/automationplatform/v1/access/permission-check/flow/{flowId}", purpose: "Per-flow access check." },
+            { id: "workflow-action-catalog", method: "GET", path: "/api/automation/v4/actions/internal/access/definitions/filter", purpose: "Internal action catalog and schemas." },
+            { id: "workflow-crm-objects", method: "GET", path: "/api/automationapps/v1/flow-crm-objects/{flowId}", purpose: "CRM object snapshots used in workflow editor." },
+            { id: "workflow-canvas-errors", method: "GET", path: "/api/automationapps/v1/insights/canvas/errors/{flowId}", purpose: "Canvas insight errors." },
+            { id: "workflow-bulk-processing", method: "GET", path: "/api/automation-platform-bulk-processing/v1/bulk-processing/flow/{flowId}", purpose: "Bulk-processing jobs attached to one workflow." },
+            { id: "workflow-permission-check-batch", method: "POST", path: "/api/automationplatform/v1/access/permission-check/flow/batch/read", purpose: "Read-only batch workflow permission check.", readOnlyKind: "batch-read", bodyRequired: true },
+            { id: "workflow-filter-descriptions", method: "POST", path: "/api/automationplatform/v1/filter-descriptions/generate", purpose: "Read-only human-readable workflow filter description preview.", readOnlyKind: "preview", bodyRequired: true },
+            { id: "workflow-card-positions", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.workflow.canvas.rpc.FlowCardPositionRpc/getCardPositions", purpose: "Read-only workflow canvas card positions RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "workflow-renderable-action-search", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.automation.actions.rpc.RenderableActionDefinitionService/search", purpose: "Read-only workflow action definition search RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "workflow-delay-counts", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.automationplatform.chirp.rpc.DelayedActionsService/getDelayActionEnrollmentCounts", purpose: "Read-only workflow delayed-action enrollment counts RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "workflow-billing-info", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.automationplatform.chirp.rpc.FlowBillingRpc/getFlowBillingInfo", purpose: "Read-only workflow billing/usage metadata RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "workflow-copilot-context", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.workflows.copilot.rpc.WorkflowsCopilot/fetchInteractiveModeContextForFlow", purpose: "Read-only workflow Copilot context metadata RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+        ],
+    },
+    {
+        id: "properties-metadata",
+        label: "Internal property metadata, groups, limits, fill rates, and validation",
+        mode: "internal-browser-session",
+        description: "Property settings UI metadata beyond public CRM schemas.",
+        endpoints: [
+            { id: "properties-v1-contacts", method: "GET", path: "/api/properties/v1/contacts/properties", purpose: "Legacy contact property metadata used by old portals." },
+            { id: "properties-v2-object", method: "GET", path: "/api/properties/v2/{objectType}/properties", purpose: "Legacy v2 property metadata; often preserves createdUserId for older properties." },
+            { id: "properties", method: "GET", path: "/api/properties/v4/{typeId}", purpose: "Property metadata by object type." },
+            { id: "property-named", method: "GET", path: "/api/properties/v4/{typeId}/named/{propertyName}", purpose: "Single property metadata by internal name." },
+            { id: "property-groups", method: "GET", path: "/api/properties/v4/groups/{typeId}", purpose: "Property groups for one object type." },
+            { id: "property-group-properties", method: "GET", path: "/api/properties/v4/groups/{typeId}/properties", purpose: "Properties nested under groups for one object type." },
+            { id: "recycled-properties", method: "GET", path: "/api/properties/v4/recycle/{typeId}", purpose: "Soft-deleted/recycled properties." },
+            { id: "combined-property-count", method: "GET", path: "/api/properties/v4/properties/combined-count", purpose: "Property counts across object types." },
+            { id: "custom-limits", method: "GET", path: "/api/properties/v4/properties/{typeId}/custom-limits-and-counts", purpose: "Custom property quota and count state." },
+            { id: "fill-rate", method: "GET", path: "/api/property-settings/v1/property-fill-rate/{typeId}/batch/read", purpose: "Property fill-rate telemetry." },
+            { id: "property-validation", method: "GET", path: "/api/property-validation/v1/properties/{objectTypeId}", purpose: "Property validation constraints." },
+            { id: "business-unit-property-validation", method: "GET", path: "/api/property-validation/v1/business-unit-property/{typeId}/property/{propertyName}", purpose: "Business-unit scoped property validation constraints." },
+            { id: "conditional-options", method: "GET", path: "/api/conditional-properties/v2/options/{typeId}/{propertyName}", purpose: "Conditional property options and dependencies." },
+            { id: "external-options-fetch", method: "GET", path: "/api/external-options/v3/fetch/{entity}", purpose: "Dynamic option fetch used by property/report/list UIs." },
+            { id: "external-options-paged-fetch", method: "GET", path: "/api/external-options/v3/pagedFetch/{entity}", purpose: "Paged dynamic option fetch used by property/report/list UIs." },
+        ],
+    },
+    {
+        id: "crm-search",
+        label: "CRM search, GraphQL, and object preview reads",
+        mode: "internal-browser-session",
+        description: "Generic CRM UI search/read helpers used by report builders, help desk, quotes, and object previews.",
+        endpoints: [
+            { id: "crm-search", method: "POST", path: "/api/crm-search/search?portalId={portalId}", purpose: "Read-only CRM object search with UI request shape.", readOnlyKind: "search", bodyRequired: true },
+            { id: "crm-search-ids", method: "POST", path: "/api/crm-search/search/ids?portalId={portalId}", purpose: "Read-only CRM ID search.", readOnlyKind: "search", bodyRequired: true },
+            { id: "crm-search-report", method: "POST", path: "/api/crm-search/report?portalId={portalId}", purpose: "Read-only CRM report search payload.", readOnlyKind: "search", bodyRequired: true },
+            { id: "graphql-crm", method: "POST", path: "/api/graphql/crm", purpose: "Read-only CRM GraphQL query used by help desk and index UIs.", readOnlyKind: "search", bodyRequired: true },
+            { id: "inbounddb-object-preview", method: "GET", path: "/inbounddb-objects/v1/preview", purpose: "InboundDB object preview metadata." },
+            { id: "inbounddb-object", method: "GET", path: "/inbounddb-objects/v1/crm-objects/{objectTypeId}/{objectId}", purpose: "Single CRM object UI payload by type and ID." },
+        ],
+    },
+    {
+        id: "object-metadata",
+        label: "Object metadata, schemas, framework builder, and portal-scoped types",
+        mode: "internal-browser-session",
+        description: "UI metadata for object types, schema resources, filters, imports, segments, and property settings.",
+        endpoints: [
+            { id: "schema-portal-metadata", method: "GET", path: "/api/schemas-metadata/v1/portal-metadata", purpose: "Portal-wide schema metadata resources." },
+            { id: "schema-portal-metadata-type", method: "GET", path: "/api/schemas-metadata/v1/portal-metadata/type/{type}", purpose: "Schema metadata for one UI metadata type." },
+            { id: "schema-portal-metadata-resource", method: "GET", path: "/api/schemas-metadata/v1/portal-metadata/resource/{resource}", purpose: "Schema metadata for one resource." },
+            { id: "schema-portal-metadata-resources", method: "GET", path: "/api/schemas-metadata/v1/portal-metadata/resources", purpose: "All schema metadata resources available to the UI." },
+            { id: "framework-metadata-all", method: "GET", path: "/framework-builder/v1/read/metadata/type/all/batch", purpose: "Framework-builder metadata across CRM property settings, filters, imports, and segments." },
+            { id: "framework-metadata-type", method: "GET", path: "/framework-builder/v1/read/metadata/types/{metadataType}", purpose: "Framework-builder metadata for one type family." },
+            { id: "framework-property", method: "GET", path: "/api/framework-builder/v1/read/metadata/property/{objectTypeId}/{propertyName}", purpose: "Framework-builder metadata for one property and its UI behavior." },
+            { id: "portal-scoped-objects", method: "GET", path: "/inbounddb-meta/v1/object-types/portal-scoped-objects/for-portal", purpose: "Portal-specific object type metadata and feature-gated object catalog." },
+            { id: "event-object-types", method: "GET", path: "/inbounddb-meta/v1/object-types/events/for-portal", purpose: "Event object types available in the portal." },
+            { id: "object-type", method: "GET", path: "/inbounddb-meta/v1/object-types/{objectTypeId}", purpose: "Single inbounddb object type metadata." },
+            { id: "object-types-batch", method: "POST", path: "/inbounddb-meta/v1/object-types/batch-get", purpose: "Read-only batch object-type metadata lookup.", readOnlyKind: "batch-read", bodyRequired: true },
+            { id: "object-types-batch-by-name", method: "POST", path: "/inbounddb-meta/v1/object-types/batch-get-by-names", purpose: "Read-only batch object-type metadata lookup by object names.", readOnlyKind: "batch-read", bodyRequired: true },
+        ],
+    },
+    {
+        id: "conditional-properties",
+        label: "Conditional properties and dependent field rules",
+        mode: "internal-browser-session",
+        description: "Conditional property rule reads used to back up dependent picklists and UI field logic.",
+        endpoints: [
+            { id: "conditional-options", method: "GET", path: "/api/conditional-properties/v2/options/{typeId}/{propertyName}", purpose: "Conditional property options and dependencies." },
+            { id: "conditional-rules", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.conditionalproperties.rpc.ConditionalPropertiesUnifiedRpc/getRules", purpose: "Read-only conditional property rules RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+        ],
+    },
+    {
+        id: "lists-segments",
+        label: "Lists, ILS segments, filters, and legacy list search",
+        mode: "internal-browser-session",
+        description: "Fragmented list/segment UI surfaces used when public list filters are incomplete.",
+        endpoints: [
+            { id: "lists-v3", method: "GET", path: "/api/lists/v3/lists", purpose: "Internal lists/segments catalog." },
+            { id: "lists-v3-portal", method: "GET", path: "/api/lists/v3/{portalId}/lists", purpose: "Portal-scoped internal lists/segments catalog." },
+            { id: "list-v3", method: "GET", path: "/api/lists/v3/lists/{listId}", purpose: "Single list/segment definition." },
+            { id: "list-v3-portal", method: "GET", path: "/api/lists/v3/{portalId}/lists/{listId}", purpose: "Portal-scoped single list/segment definition." },
+            { id: "list-v3-portal-segments", method: "GET", path: "/api/lists/v3/{portalId}/lists/{listId}/segments", purpose: "Segments nested inside a list." },
+            { id: "list-v2", method: "GET", path: "/api/lists/v2/lists/{listId}", purpose: "Legacy list definition fallback." },
+            { id: "contacts-lists", method: "GET", path: "/api/contacts/v1/lists", purpose: "Legacy contacts-list catalog." },
+            { id: "contacts-list", method: "GET", path: "/api/contacts/v1/lists/{listId}", purpose: "Legacy contacts-list definition." },
+            { id: "contact-list-management", method: "GET", path: "/api/contact-list-management/v1/{portalId}/lists/{listId}", purpose: "UI-facing contact-list management definition." },
+            { id: "ils-segment", method: "GET", path: "/api/ils-segments/v1/portals/{portalId}/segments/{segmentId}", purpose: "ILS segment filter branch details." },
+            { id: "ils-segment-short", method: "GET", path: "/api/ils-segments/v1/{portalId}/segments/{segmentId}", purpose: "Alternate ILS segment filter branch path." },
+            { id: "ils-segment-store", method: "GET", path: "/api/ils-segment-store/v1/segments", purpose: "Bulk ILS segment store query." },
+            { id: "segments-ui", method: "GET", path: "/api/segments-ui/v1/segments/{portalId}/{segmentId}", purpose: "Segments UI definition fallback." },
+            { id: "legacy-segment-search", method: "GET", path: "/api/lists-search/v1/segments/all/legacy/{portalId}", purpose: "Legacy segment search used by list UI." },
+            { id: "lists-search-v3", method: "POST", path: "/api/lists/v3/lists/search", purpose: "Read-only internal list search when body shape is known.", readOnlyKind: "search", bodyRequired: true },
+        ],
+    },
+    {
+        id: "sales-content",
+        label: "Sales templates, sequences, snippets, and playbooks",
+        mode: "internal-browser-session",
+        description: "Sales content definitions and Chirp RPC bodies for migration fidelity.",
+        endpoints: [
+            { id: "sales-content-search", method: "POST", path: "/api/salescontentsearch/v2/search?portalId={portalId}", purpose: "Read-only search for sequences/templates/playbooks.", readOnlyKind: "search", bodyRequired: true },
+            { id: "sales-content-templates", method: "GET", path: "/api/sales-content/v1/templates?portalId={portalId}", purpose: "Sales content template inventory fallback." },
+            { id: "sales-content-sequences", method: "GET", path: "/api/sales-content/v1/sequences?portalId={portalId}", purpose: "Sales content sequence inventory fallback." },
+            { id: "sequence", method: "GET", path: "/api/sequences/v3/sequences/{sequenceId}?portalId={portalId}", purpose: "Full sequence payload." },
+            { id: "sequence-usage", method: "GET", path: "/api/sequences/v2/sequences/usage?portalId={portalId}", purpose: "Sequence usage and quota metadata." },
+            { id: "sequence-enrollments-impacted", method: "GET", path: "/api/sequences/v2/enrollments/impacted?portalId={portalId}", purpose: "Impacted sequence enrollments metadata." },
+            { id: "sequence-enrollment-health", method: "GET", path: "/api/sequences/v2/enrollments/health-check?portalId={portalId}", purpose: "Sequence enrollment health-check metadata." },
+            { id: "sequence-folders-count", method: "GET", path: "/api/sequences/v3/folders/count?portalId={portalId}", purpose: "Sequence folder count metadata." },
+            { id: "templates", method: "GET", path: "/api/templates/v1/templates?portalId={portalId}", purpose: "Sales template inventory." },
+            { id: "sales-template-v2", method: "GET", path: "/api/sales-templates/v2/templates/{templateId}?portalId={portalId}", purpose: "Single sales template body and metadata." },
+            { id: "sales-template-search", method: "POST", path: "/api/sales-templates/v2/templates/search?portalId={portalId}", purpose: "Read-only sales template search.", readOnlyKind: "search", bodyRequired: true },
+            { id: "sales-template-usage", method: "GET", path: "/api/sales-templates/v2/templates/usage?portalId={portalId}", purpose: "Sales template usage and quota metadata." },
+            { id: "sales-content-libraries", method: "GET", path: "/api/sales-content-libraries/v2/libraries?portalId={portalId}", purpose: "Sales content libraries." },
+            { id: "snippets", method: "GET", path: "/api/snippets/v1/snippets", purpose: "Sales snippets with body/htmlBody and shortcuts." },
+            { id: "playbooks-list", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/listPlaybooks", purpose: "Read-only playbook list RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "playbooks-count", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/getPlaybookCount", purpose: "Read-only playbook count and limit RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "playbook-version", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/getLatestPlaybookVersion", purpose: "Read-only playbook body/version RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "playbook-version-summaries", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybooksRpc/getPlaybookVersionSummaries", purpose: "Read-only playbook version history RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "playbook-questions", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.playbooks.rpc.PlaybookQuestionsRpc/getLatestQuestionsByPlaybook", purpose: "Read-only playbook questions RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+        ],
+    },
+    {
+        id: "crm-views-record-layout",
+        label: "CRM views, record cards, and layout editor metadata",
+        mode: "internal-browser-session",
+        description: "Saved views, visual settings, and record card containers.",
+        endpoints: [
+            { id: "sales-views-legacy", method: "GET", path: "/sales-views/v2/views", purpose: "Legacy CRM custom views." },
+            { id: "sales-views-v4", method: "GET", path: "/api/sales/v4/views", purpose: "CRM index custom views." },
+            { id: "sales-view-v4", method: "GET", path: "/api/sales/v4/views/{viewId}", purpose: "Single CRM custom view definition." },
+            { id: "sales-views-v4-all", method: "GET", path: "/api/sales/v4/views/{typeId}/all", purpose: "All CRM object views for one type." },
+            { id: "sales-views-viz", method: "GET", path: "/api/sales/v4/views/{typeId}/all/with-visualization-settings", purpose: "CRM object views with column, sort, board, and visualization settings." },
+            { id: "sales-views-v4-list", method: "GET", path: "/api/sales/v4/views/{typeId}/list", purpose: "CRM saved list views for one object type." },
+            { id: "sales-views-v4-pinned", method: "GET", path: "/api/sales/v4/views/{typeId}/pinned/view", purpose: "Pinned CRM object views." },
+            { id: "sales-views-v4-search", method: "GET", path: "/api/sales/v4/views/{typeId}/search", purpose: "CRM object view search." },
+            { id: "default-sales-view-viz", method: "GET", path: "/api/sales/v4/views/default-view/{typeId}/with-visualization-settings", purpose: "Default CRM object view with visualization settings." },
+            { id: "sales-views-v3", method: "GET", path: "/api/sales-views/v3/sales-views/{typeId}", purpose: "Legacy v3 CRM views fallback." },
+            { id: "sales-views-v2-type", method: "GET", path: "/api/sales-views/v2/sales-views/{typeId}", purpose: "Legacy v2 CRM views fallback." },
+            { id: "views-meta", method: "GET", path: "/api/views-meta/v1/views/{typeId}", purpose: "CRM view metadata fallback." },
+            { id: "sales-view-limit-check", method: "GET", path: "/api/sales-views/v2/crm-search/limit-check/{typeId}", purpose: "CRM view limit check used by the index UI." },
+            { id: "record-cards", method: "GET", path: "/api/crm-record-cards/v4/container-views/{objectTypeId}", purpose: "Record card container views." },
+        ],
+    },
+    {
+        id: "marketing-internal",
+        label: "Marketing email fallbacks, subscription channels, CTAs, and forms",
+        mode: "internal-browser-session",
+        description: "Marketing UI-only fallbacks for email bodies, DnD metadata, subscription channels, and CTAs.",
+        endpoints: [
+            { id: "subscription-channels", method: "GET", path: "/api/email/public/v1/subscriptions", purpose: "All subscription channels including Email, Chat, Call, and Post." },
+            { id: "subscription-rules", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.subscriptions.settings.rpc.service.RulesRpc/getAllRules", purpose: "Read-only subscription visibility rules RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "subscription-definition-rules", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.subscriptions.settings.rpc.service.RulesRpc/getAllDefinitionRules", purpose: "Read-only subscription definition rules RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "privacy-settings", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.data.privacy.hub.settings.rpc.PrivacySettingsRpc/getPrivacySettings", purpose: "Read-only privacy/GDPR settings RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "business-unit-displays", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.business.units.rpc.BusinessUnitsDisplaysService/getBusinessUnitDisplaysForUser", purpose: "Read-only business-unit display map RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "can-spam-settings", method: "GET", path: "/api/content/api/v4/can-spam-settings?portalId={portalId}", purpose: "CAN-SPAM footer address settings." },
+            { id: "subscription-settings-multi-get", method: "POST", path: "/api/subscriptions-settings/v1/settings/multi-get", purpose: "Read-only subscription settings multi-get.", readOnlyKind: "batch-read", bodyRequired: true },
+            { id: "cosemail-list", method: "GET", path: "/api/cosemail/v1/emails?portalId={portalId}&limit=100&businessUnitId={businessUnitId}", purpose: "Internal marketing email catalog by BU." },
+            { id: "cosemail-email", method: "GET", path: "/api/cosemail/v1/emails/{emailId}", purpose: "Full internal marketing email definition." },
+            { id: "subscription-email-template", method: "GET", path: "/api/cosemail/v1/subscription-emails/{type}/get", purpose: "Subscription/resubscribe email templates." },
+            { id: "ctas-v3-placements", method: "GET", path: "/api/ctas/v3/placements", purpose: "New CTA builder placement inventory." },
+            { id: "forms-v2-batch", method: "GET", path: "/forms/v2/forms/batch", purpose: "Legacy forms batch surface." },
+        ],
+    },
+    {
+        id: "cms-design-manager",
+        label: "CMS Design Manager, templates, themes, modules, and layouts",
+        mode: "internal-browser-session",
+        description: "CMS/editor metadata and Design Manager assets that complement public CMS APIs.",
+        endpoints: [
+            { id: "templates", method: "GET", path: "/api/designmanager/v1/templates", purpose: "Design Manager templates." },
+            { id: "content-templates-v2", method: "GET", path: "/api/content/api/v2/templates?portalId={portalId}", purpose: "Content API v2 template catalog fallback." },
+            { id: "themes", method: "GET", path: "/api/designmanager/v1/themes", purpose: "Design Manager themes." },
+            { id: "modules", method: "GET", path: "/api/designmanager/v1/modules", purpose: "Design Manager modules." },
+            { id: "layouts", method: "GET", path: "/api/designmanager/v1/layouts", purpose: "Design Manager layouts." },
+            { id: "global-groups", method: "GET", path: "/api/designmanager/v1/layouts/global-groups/summaries", purpose: "Design Manager global group summaries." },
+            { id: "builtin-module-mapping", method: "GET", path: "/api/designmanager/v1/modules/builtin-mapping", purpose: "Built-in module mapping used by Design Manager." },
+            { id: "content-pages", method: "GET", path: "/api/content/api/v2/pages?portalId={portalId}", purpose: "CMS page catalog through the content UI API." },
+            { id: "site-settings", method: "GET", path: "/api/content-settings/v1/site-settings/by-portal-id/{portalId}", purpose: "Portal site settings used by CMS editors." },
+            { id: "content-portal-copy-status", method: "GET", path: "/api/content-portal-copy/v1/copy/status?portalId={portalId}", purpose: "HubSpot content-portal-copy job status inventory." },
+            { id: "membership-access-groups", method: "GET", path: "/api/membership-access-groups/v1/access-groups?portalId={portalId}", purpose: "Membership/gated content access groups when enabled." },
+        ],
+    },
+    {
+        id: "social-ads",
+        label: "Social publishing and ads RPC metadata",
+        mode: "internal-browser-session",
+        description: "Social broadcasts plus ads account metadata for marketing backup and migration planning.",
+        endpoints: [
+            { id: "social-broadcasts", method: "GET", path: "/api/broadcast/v2/broadcasts?portalId={portalId}&limit=100", purpose: "Social post/broadcast inventory." },
+            { id: "social-accounts", method: "GET", path: "/api/broadcast/v2/accounts/with-channels?portalId={portalId}", purpose: "Connected social accounts and channels." },
+            { id: "social-trusted-vetting", method: "GET", path: "/api/vetting/public/v1/user-verification/bannerinfo/scope/social-trusted", purpose: "Social trusted-scope verification banner state." },
+            { id: "ads-accounts-overview", method: "POST", path: "/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AdAccountRpc/getAdsAccountsOverviewForUser", purpose: "Read-only ads accounts overview RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "ads-portal-metadata", method: "POST", path: "/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AdAccountRpc/getPortalMetaData", purpose: "Read-only ads portal metadata RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "ads-user-summaries", method: "POST", path: "/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.AuthRpc/getUserSummaries", purpose: "Read-only ads user summaries RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "ads-table-columns", method: "POST", path: "/api/chirp-frontend-app-slow/v1/gateway/com.hubspot.ads.rpc.UiSettingsRpc/getTableColumnInfo", purpose: "Read-only ads UI table-column metadata RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+        ],
+    },
+    {
+        id: "governance-audit",
+        label: "Audit logs, security logs, installed apps, and sync bridge metadata",
+        mode: "internal-browser-session",
+        description: "Governance and app/integration inventory used for downgrade/migration evidence.",
+        endpoints: [
+            { id: "audit-entries-object", method: "GET", path: "/api/audit-log/v1/audit-entries?objectType={objectType}&objectId={objectId}", purpose: "Per-object audit entries for lists, dashboards, reports, and workflows." },
+            { id: "audit-log-portal", method: "GET", path: "/api/audit-log/v1/portal/{portalId}", purpose: "Portal-wide internal audit log." },
+            { id: "audit-log-v3", method: "GET", path: "/api/audit-log/v3/audit", purpose: "Newer internal audit surface." },
+            { id: "security-audit-logs", method: "GET", path: "/api/security-audit-logs/v1/audit-logs", purpose: "Security audit log entries." },
+            { id: "installed-apps-ui", method: "GET", path: "/appinstalls/v3/app-install/installed-apps-for-ui-new", purpose: "Connected app inventory as shown in settings." },
+            { id: "sync-bridge-accounts", method: "GET", path: "/sync-bridge/v3/accounts", purpose: "Data sync connected accounts and bridge metadata." },
+        ],
+    },
+    {
+        id: "commerce-forecast-quotes",
+        label: "Commerce, payments, quote, and forecast internal status",
+        mode: "internal-browser-session",
+        description: "Feature-gated commerce and sales setup metadata for downgrade and migration checks.",
+        endpoints: [
+            { id: "payment-eligibility", method: "GET", path: "/api/payments/v1/payment-accounts/eligibility?portalId={portalId}", purpose: "Payment account eligibility and readiness." },
+            { id: "payment-account-default", method: "GET", path: "/api/payments/v1/payment-accounts/connected-account/default?portalId={portalId}", purpose: "Default connected payment account." },
+            { id: "quotes-crm-search", method: "POST", path: "/api/crm-search/search?portalId={portalId}", purpose: "Read-only quote/commerce object search when body uses objectTypeId 0-14 or related commerce types.", readOnlyKind: "search", bodyRequired: true },
+            { id: "forecast-categories", method: "GET", path: "/api/forecasting/v1/categories?portalId={portalId}", purpose: "Forecast category setup when enabled." },
+            { id: "quote-esignature", method: "GET", path: "/api/quotes/v1/esignature/settings?portalId={portalId}", purpose: "Quote e-signature settings when enabled." },
+        ],
+    },
+    {
+        id: "conversations-chatflows",
+        label: "Conversations, help desk, and chatflows RPC metadata",
+        mode: "internal-browser-session",
+        description: "Help desk custom views and chatflow RPC fallbacks.",
+        endpoints: [
+            { id: "conversation-custom-views", method: "GET", path: "/api/conversations-custom-views/v1/views?portalId={portalId}", purpose: "Conversation/help desk custom views." },
+            { id: "conversation-view-settings-users", method: "GET", path: "/api/conversations-custom-views/v1/settings/users", purpose: "Help desk/conversations user view settings." },
+            { id: "conversation-spaces-and-views", method: "GET", path: "/api/conversations-custom-views/v1/spaces-and-views/workspace/{workspaceId}", purpose: "Help desk workspace spaces and views." },
+            { id: "conversation-view-settings", method: "GET", path: "/api/conversations-custom-views/v1/settings/views/{viewId}", purpose: "Single help desk custom view definition." },
+            { id: "conversation-email-accounts", method: "GET", path: "/api/conversations-email/v1/connected-accounts/inbox/{inboxId}", purpose: "Connected email accounts for one inbox." },
+            { id: "conversation-channel-instances", method: "GET", path: "/api/conversations-channels/v1/channel-instances/inbox/{inboxId}/paged", purpose: "Conversation channel instances for one inbox." },
+            { id: "chatflows-list", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.chatflows.rpc.ChatflowsRpc/listChatflows", purpose: "Read-only chatflows RPC list.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "chatflows-priority", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.chatflows.rpc.ChannelInstanceRpc/getUserChatflowsSortedByPriority", purpose: "Read-only chatflows priority RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "helpdesk-tickets", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.cv.custom.views.member.rpc.CvCustomViewsMemberRpc/getPagedHelpDeskTickets", purpose: "Read-only help desk tickets for a view RPC.", readOnlyKind: "rpc-read", bodyRequired: true },
+            { id: "helpdesk-notification-preferences", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.cv.tickets.notification.preferences.rpc.TicketNotificationPreferenceFrontendRpc/getUserNotificationPreferences", purpose: "Read-only help desk notification preferences RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+            { id: "helpdesk-migration-state", method: "POST", path: "/api/chirp-frontend-app/v1/gateway/com.hubspot.helpdesk.migration.rpc.HelpdeskMigrationRpc/getMigrationState", purpose: "Read-only help desk migration state RPC.", readOnlyKind: "rpc-read", defaultBody: {} },
+        ],
+    },
+    {
+        id: "account-security",
+        label: "Account, security health, and installed-app metadata",
+        mode: "internal-browser-session",
+        description: "Account-level setup and security metadata used by 360 backup and downgrade checks.",
+        endpoints: [
+            { id: "account-info", method: "GET", path: "/account-info/v3/details?portalId={portalId}", purpose: "Account identity, edition, and portal metadata." },
+            { id: "account-activity", method: "GET", path: "/account-info/v3/activity/{portalId}", purpose: "Account activity summary." },
+            { id: "private-apps", method: "GET", path: "/account-info/v3/private-apps", purpose: "Private apps and scopes inventory." },
+            { id: "security-health", method: "GET", path: "/api/security-health/v1/portal/{portalId}", purpose: "Security health state when available." },
+            { id: "security-settings", method: "GET", path: "/api/security-settings/v1/settings?portalId={portalId}", purpose: "Security settings surfaced by the account UI." },
+            { id: "security-center-events", method: "GET", path: "/api/security-center/v1/account-events", purpose: "Security center account events feed." },
+            { id: "security-monitoring", method: "GET", path: "/api/security-monitoring/v2/security-monitoring/account/{portalId}", purpose: "Security monitoring state." },
+            { id: "crm-usage", method: "GET", path: "/api/crm-usages/v2/usages/", purpose: "CRM usage telemetry surfaced by account settings." },
+            { id: "installed-apps", method: "GET", path: "/appinstalls/v3/app-install/installed-apps-for-ui-new", purpose: "Installed apps inventory as shown in HubSpot settings." },
+            { id: "sync-bridge-accounts", method: "GET", path: "/sync-bridge/v3/accounts", purpose: "Data sync connected accounts and bridge metadata." },
+        ],
+    },
+];
+export function validateInternalCaptureCatalogue(surfaces) {
+    const errors = [];
+    const surfaceIds = new Set();
+    for (const surface of surfaces) {
+        if (surfaceIds.has(surface.id))
+            errors.push(`duplicate surface id: ${surface.id}`);
+        surfaceIds.add(surface.id);
+        const endpointIds = new Set();
+        for (const endpoint of surface.endpoints) {
+            if (endpointIds.has(endpoint.id))
+                errors.push(`duplicate endpoint id in ${surface.id}: ${endpoint.id}`);
+            endpointIds.add(endpoint.id);
+            if (endpoint.method === "POST" && !endpoint.readOnlyKind) {
+                errors.push(`POST endpoint must declare readOnlyKind: ${surface.id}/${endpoint.id}`);
+            }
+            if (endpoint.method !== "GET" && endpoint.method !== "POST") {
+                errors.push(`unsupported method in ${surface.id}/${endpoint.id}: ${String(endpoint.method)}`);
+            }
+        }
+    }
+    return { errors };
+}
+export function registerInternal(program, getCtx) {
+    const internal = program.command("internal").description("Allowlisted HubSpot browser-session capture adapters");
+    internal
+        .command("surfaces")
+        .description("List allowlisted internal capture surfaces")
+        .action(() => {
+        const ctx = getCtx();
+        printResult(ctx, {
+            guardrails: INTERNAL_CAPTURE_GUARDRAILS,
+            surfaces: INTERNAL_SURFACES.map((surface) => ({
+                id: surface.id,
+                label: surface.label,
+                mode: surface.mode,
+                description: surface.description,
+                endpoints: surface.endpoints.length,
+            })),
+        });
+    });
+    internal
+        .command("coverage")
+        .description("Summarize internal endpoint docs and allowlisted capture coverage")
+        .action(() => {
+        const ctx = getCtx();
+        printResult(ctx, buildInternalCoverage(ctx));
+    });
+    addBrowserSessionOptions(internal
+        .command("capture")
+        .description("Capture allowlisted internal endpoints to local JSON files")
+        .option("--surface <id>", "Surface id to capture")
+        .option("--endpoint <id>", "Endpoint id inside the selected surface; repeat to capture several", collectValues, [])
+        .option("--all", "Capture every allowlisted surface endpoint that has enough inputs")
+        .option("--out-dir <path>", "Output directory for raw JSON and capture-manifest.json")
+        .option("--body-file <endpoint=path>", "JSON body file for an allowlisted read-only POST endpoint", collectValues, [])
+        .option("--var <key=value>", "Placeholder value such as flowId=123 or datasetId=abc", collectValues, [])).action(async (opts) => {
+        const ctx = getCtx();
+        const selected = selectEndpoints(selectSurfaces(opts.surface, Boolean(opts.all)), opts.endpoint ?? []);
+        const vars = parseVarFlags(opts.var ?? []);
+        const bodyFiles = parseBodyFileFlags(opts.bodyFile ?? []);
+        if (ctx.dryRun) {
+            const portalId = opts.portalId ?? process.env.HSCLI_PORTAL_ID ?? "";
+            printResult(ctx, {
+                mode: "dry-run",
+                guardrails: INTERNAL_CAPTURE_GUARDRAILS,
+                surfaces: selected.map((surface) => surface.id),
+                endpoints: selected.flatMap((surface) => (surface.endpoints.map((endpoint) => dryRunEndpoint(surface, endpoint, portalId, vars, bodyFiles)))),
+            });
+            return;
+        }
+        const session = resolveBrowserSession(ctx, opts, "Internal capture", true);
+        const portalId = session.portalId;
+        const outDir = opts.outDir?.trim() || `./hscli-internal-capture-${portalId}`;
+        const results = [];
+        mkdirSync(outDir, { recursive: true });
+        for (const surface of selected) {
+            const surfaceDir = join(outDir, safeFileName(surface.id));
+            mkdirSync(surfaceDir, { recursive: true });
+            for (const endpoint of surface.endpoints) {
+                const prepared = prepareEndpoint(endpoint, portalId, vars, bodyFiles);
+                if (!prepared.ready) {
+                    results.push({
+                        surface: surface.id,
+                        endpoint: endpoint.id,
+                        status: "skipped",
+                        reason: prepared.reason,
+                        missing: prepared.missing,
+                    });
+                    continue;
+                }
+                const responseFile = join(surfaceDir, `${safeFileName(endpoint.id)}.json`);
+                const requestBodyFile = prepared.body !== undefined
+                    ? join(surfaceDir, `${safeFileName(endpoint.id)}.request.json`)
+                    : undefined;
+                try {
+                    if (requestBodyFile) {
+                        writeFileSync(requestBodyFile, JSON.stringify(redactSensitive(prepared.body), null, 2), "utf8");
+                    }
+                    const response = await session.client.request(prepared.path, {
+                        method: endpoint.method,
+                        body: prepared.body,
+                        permissionMode: "read",
+                    });
+                    writeFileSync(responseFile, JSON.stringify(response, null, 2), "utf8");
+                    results.push({
+                        surface: surface.id,
+                        endpoint: endpoint.id,
+                        status: "captured",
+                        method: endpoint.method,
+                        path: prepared.path,
+                        responseFile,
+                        ...(requestBodyFile ? { requestBodyFile, requestBodySha256: sha256Json(prepared.body) } : {}),
+                    });
+                }
+                catch (error) {
+                    results.push({
+                        surface: surface.id,
+                        endpoint: endpoint.id,
+                        status: "failed",
+                        method: endpoint.method,
+                        path: prepared.path,
+                        responseFile,
+                        ...(requestBodyFile ? { requestBodyFile, requestBodySha256: sha256Json(prepared.body) } : {}),
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
+        const manifestPath = join(outDir, "capture-manifest.json");
+        const manifest = {
+            generatedAt: new Date().toISOString(),
+            portalId,
+            mode: "capture",
+            guardrails: INTERNAL_CAPTURE_GUARDRAILS,
+            surfaces: selected.map((surface) => surface.id),
+            totals: summarize(results),
+            results: redactSensitive(results),
+        };
+        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
+        const totals = summarize(results);
+        printResult(ctx, {
+            surface: opts.all ? "all" : selected[0]?.id,
+            ...totals,
+            manifest: manifestPath,
+            outDir,
+        });
+    });
+}
+function collectValues(value, previous) {
+    return [...previous, value];
+}
+function buildInternalCoverage(ctx) {
+    const endpoints = INTERNAL_SURFACES.flatMap((surface) => surface.endpoints);
+    const readLikePostEndpoints = endpoints.filter((endpoint) => endpoint.method === "POST");
+    const parameterizedEndpoints = endpoints.filter((endpoint) => endpointPlaceholders(endpoint).length > 0);
+    const bodyRequiredEndpoints = endpoints.filter((endpoint) => Boolean(endpoint.bodyRequired));
+    return {
+        guardrails: INTERNAL_CAPTURE_GUARDRAILS,
+        catalogue: {
+            posture: "allowlisted-capture-adapters",
+            allowlistSource: "src/commands/internal/catalog.ts",
+            fullCatalogue: "docs/INTERNAL-ENDPOINTS.md",
+            discoveryLog: "docs/INTERNAL-ENDPOINTS-DISCOVERY.md",
+            condensedDocs: "docs/INTERNAL_ENDPOINTS.md",
+            surfaces: INTERNAL_SURFACES.length,
+            endpoints: endpoints.length,
+            getEndpoints: endpoints.filter((endpoint) => endpoint.method === "GET").length,
+            readLikePostEndpoints: readLikePostEndpoints.length,
+            placeholderEndpoints: parameterizedEndpoints.length,
+            bodyRequiredEndpoints: bodyRequiredEndpoints.length,
+        },
+        surfaces: INTERNAL_SURFACES.map((surface) => {
+            const surfacePosts = surface.endpoints.filter((endpoint) => endpoint.method === "POST");
+            const surfaceParameterized = surface.endpoints.filter((endpoint) => (endpointPlaceholders(endpoint).length > 0 || endpoint.bodyRequired));
+            return {
+                id: surface.id,
+                label: surface.label,
+                description: surface.description,
+                mode: surface.mode,
+                endpoints: surface.endpoints.length,
+                getEndpoints: surface.endpoints.length - surfacePosts.length,
+                readLikePostEndpoints: surfacePosts.length,
+                parameterizedEndpoints: surfaceParameterized.map((endpoint) => endpoint.id),
+                captureCommand: internalCoverageCaptureCommand(ctx, surface),
+            };
+        }),
+        writeAdapterPolicy: [
+            "Public API first; internal adapters fill HubSpot UI-only gaps.",
+            "Internal write/replay endpoints stay documented until promoted into explicit guarded commands.",
+            "Promoted write adapters must keep dry-run, --force, policy/change-ticket checks, and trace/audit output.",
+            "No arbitrary internal URL passthrough is exposed.",
+        ],
+    };
+}
+function internalCoverageCaptureCommand(ctx, surface) {
+    return [
+        "hscli",
+        "--profile",
+        ctx.profile,
+        "--json",
+        "internal",
+        "capture",
+        "--surface",
+        surface.id,
+        "--portal-id",
+        "<portalId>",
+        "--cookie-file",
+        "<hubspot-cookie-file>",
+        "--out-dir",
+        "<backupDir>/internal-api/allowlisted-capture",
+    ].join(" ");
+}
+function endpointPlaceholders(endpoint) {
+    const placeholders = new Set();
+    for (const match of endpoint.path.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)) {
+        if (match[1] !== "portalId")
+            placeholders.add(match[1]);
+    }
+    return [...placeholders];
+}
+function selectSurfaces(surfaceId, all) {
+    if (all && surfaceId)
+        throw new CliError("INTERNAL_CAPTURE_SELECTION_INVALID", "Use --all or --surface, not both.");
+    if (all)
+        return INTERNAL_SURFACES;
+    const id = surfaceId?.trim();
+    if (!id)
+        throw new CliError("INTERNAL_CAPTURE_SURFACE_REQUIRED", "internal capture requires --surface <id> or --all.");
+    const surface = INTERNAL_SURFACES.find((item) => item.id === id);
+    if (!surface) {
+        throw new CliError("INTERNAL_CAPTURE_SURFACE_UNKNOWN", `Unknown internal surface "${id}". Run hscli internal surfaces.`);
+    }
+    return [surface];
+}
+function selectEndpoints(surfaces, endpointIds) {
+    const requested = endpointIds.map((id) => id.trim()).filter(Boolean);
+    if (requested.length === 0)
+        return surfaces;
+    const requestedSet = new Set(requested);
+    const selected = surfaces
+        .map((surface) => ({
+        ...surface,
+        endpoints: surface.endpoints.filter((endpoint) => requestedSet.has(endpoint.id)),
+    }))
+        .filter((surface) => surface.endpoints.length > 0);
+    const found = new Set(selected.flatMap((surface) => surface.endpoints.map((endpoint) => endpoint.id)));
+    const missing = requested.filter((id) => !found.has(id));
+    if (missing.length > 0) {
+        throw new CliError("INTERNAL_CAPTURE_ENDPOINT_UNKNOWN", `Unknown endpoint(s) for selected surface(s): ${missing.join(", ")}.`);
+    }
+    return selected;
+}
+function parseVarFlags(flags) {
+    const vars = {};
+    for (const flag of flags) {
+        const index = flag.indexOf("=");
+        if (index <= 0)
+            throw new CliError("INTERNAL_CAPTURE_VAR_INVALID", "--var must be key=value.");
+        const key = flag.slice(0, index).trim();
+        const value = flag.slice(index + 1).trim();
+        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(key))
+            throw new CliError("INTERNAL_CAPTURE_VAR_INVALID", `Invalid var name "${key}".`);
+        if (!value)
+            throw new CliError("INTERNAL_CAPTURE_VAR_INVALID", `--var ${key}=... requires a value.`);
+        vars[key] = value;
+    }
+    return vars;
+}
+function parseBodyFileFlags(flags) {
+    const bodies = {};
+    for (const flag of flags) {
+        const index = flag.indexOf("=");
+        if (index <= 0)
+            throw new CliError("INTERNAL_CAPTURE_BODY_FILE_INVALID", "--body-file must be endpoint=path.");
+        const endpointId = flag.slice(0, index).trim();
+        const path = flag.slice(index + 1).trim();
+        if (!endpointId || !path)
+            throw new CliError("INTERNAL_CAPTURE_BODY_FILE_INVALID", "--body-file must be endpoint=path.");
+        const raw = readFileSync(path, "utf8");
+        try {
+            bodies[endpointId] = { sourceFile: path, body: JSON.parse(raw) };
+        }
+        catch (error) {
+            throw new CliError("INTERNAL_CAPTURE_BODY_FILE_INVALID", `Body file for ${endpointId} must be valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return bodies;
+}
+function dryRunEndpoint(surface, endpoint, portalId, vars, bodyFiles) {
+    const prepared = prepareEndpoint(endpoint, portalId, vars, bodyFiles);
+    return {
+        surface: surface.id,
+        id: endpoint.id,
+        method: endpoint.method,
+        path: prepared.path,
+        status: prepared.ready ? "ready" : "needs-input",
+        missing: prepared.ready ? [] : prepared.missing,
+        bodySourceFile: prepared.ready && prepared.bodySourceFile ? prepared.bodySourceFile : undefined,
+        purpose: endpoint.purpose,
+    };
+}
+function prepareEndpoint(endpoint, portalId, vars, bodyFiles) {
+    const missing = [];
+    const path = endpoint.path.replace(/\{([A-Za-z][A-Za-z0-9_]*)\}/g, (_match, key) => {
+        if (key === "portalId")
+            return encodeURIComponent(portalId);
+        const value = vars[key];
+        if (!value) {
+            missing.push(key);
+            return `{${key}}`;
+        }
+        return encodeURIComponent(value);
+    });
+    if (missing.length > 0) {
+        return { ready: false, path, reason: "missing-placeholder", missing };
+    }
+    const explicitBody = bodyFiles[endpoint.id];
+    if (explicitBody && endpoint.method !== "POST") {
+        return { ready: false, path, reason: "body-file-for-non-post", missing: [] };
+    }
+    if (explicitBody) {
+        return { ready: true, path, body: explicitBody.body, bodySourceFile: explicitBody.sourceFile };
+    }
+    if (endpoint.bodyRequired && endpoint.defaultBody === undefined) {
+        return { ready: false, path, reason: "missing-read-body", missing: ["body"] };
+    }
+    return {
+        ready: true,
+        path,
+        ...(endpoint.defaultBody !== undefined ? { body: endpoint.defaultBody } : {}),
+    };
+}
+function sha256Json(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function summarize(results) {
+    return {
+        captured: results.filter((result) => result.status === "captured").length,
+        skipped: results.filter((result) => result.status === "skipped").length,
+        failed: results.filter((result) => result.status === "failed").length,
+    };
+}
+function safeFileName(raw) {
+    return raw.replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "capture";
+}
+//# sourceMappingURL=index.js.map