securewithtrace 0.12.0 → 0.14.0

package/dist/index.js

@@ -3352,1406 +3352,723 @@ var {
   Help
 } = import_index.default;
 
-// src/auth/device-flow.ts
-var WORKOS_DEVICE_AUTH_URL = "https://api.workos.com/user_management/authorize/device";
-var WORKOS_TOKEN_URL = "https://api.workos.com/user_management/authenticate";
-async function requestDeviceAuthorization(clientId) {
-  const response = await fetch(WORKOS_DEVICE_AUTH_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams({ client_id: clientId })
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Failed to request device authorization: ${response.status} ${text}`);
-  }
-  return await response.json();
-}
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function pollForToken(clientId, deviceCode, options = {}) {
-  const expiresIn = options.expiresIn ?? 300;
-  let interval = options.interval ?? 5;
-  const deadline = Date.now() + expiresIn * 1e3;
-  while (Date.now() < deadline) {
-    const response = await fetch(WORKOS_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: new URLSearchParams({
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: deviceCode,
-        client_id: clientId
-      })
-    });
-    if (response.ok) {
-      return await response.json();
-    }
-    const data = await response.json();
-    switch (data.error) {
-      case "authorization_pending":
-        await sleep(interval * 1e3);
-        break;
-      case "slow_down":
-        interval += 1;
-        await sleep(interval * 1e3);
-        break;
-      case "access_denied":
-        throw new Error("Authorization was denied by the user.");
-      case "expired_token":
-        throw new Error("Device code has expired. Please try again.");
-      default:
-        throw new Error(
-          `Authorization failed: ${data.error}${data.error_description ? ` - ${data.error_description}` : ""}`
-        );
-    }
-  }
-  throw new Error("Authorization timed out. Please try again.");
-}
-async function refreshAccessToken(clientId, refreshToken) {
-  const response = await fetch(WORKOS_TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: clientId,
-      refresh_token: refreshToken
-    })
-  });
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Failed to refresh token: ${response.status} ${text}`);
-  }
-  return await response.json();
-}
-
-// src/auth/token.ts
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var ACCESS_TOKEN_FILENAME = "token";
-var REFRESH_TOKEN_FILENAME = "refresh-token";
-function resolveTraceDir() {
-  const override = process.env["TRACE_CLI_AUTH_DIR"];
-  if (override && override.trim().length > 0) {
-    return override;
-  }
-  return join(homedir(), ".trace");
-}
-function ensureTraceDir() {
-  const traceDir = resolveTraceDir();
-  if (!existsSync(traceDir)) {
-    mkdirSync(traceDir, { recursive: true, mode: 448 });
+// ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
+var util;
+(function(util2) {
+  util2.assertEqual = (val) => val;
+  function assertIs2(_arg) {
   }
-}
-function getTokenPath() {
-  return join(resolveTraceDir(), ACCESS_TOKEN_FILENAME);
-}
-function getRefreshTokenPath() {
-  return join(resolveTraceDir(), REFRESH_TOKEN_FILENAME);
-}
-function readToken() {
-  const tokenPath = getTokenPath();
-  try {
-    if (!existsSync(tokenPath)) {
-      return null;
-    }
-    const token = readFileSync(tokenPath, "utf-8").trim();
-    return token || null;
-  } catch {
-    return null;
+  util2.assertIs = assertIs2;
+  function assertNever2(_x) {
+    throw new Error();
   }
-}
-function readRefreshToken() {
-  const refreshTokenPath = getRefreshTokenPath();
-  try {
-    if (!existsSync(refreshTokenPath)) {
-      return null;
+  util2.assertNever = assertNever2;
+  util2.arrayToEnum = (items) => {
+    const obj = {};
+    for (const item of items) {
+      obj[item] = item;
     }
-    const token = readFileSync(refreshTokenPath, "utf-8").trim();
-    return token || null;
-  } catch {
-    return null;
-  }
-}
-function writeToken(token) {
-  ensureTraceDir();
-  writeFileSync(getTokenPath(), token, { encoding: "utf-8", mode: 384 });
-}
-function writeRefreshToken(token) {
-  ensureTraceDir();
-  writeFileSync(getRefreshTokenPath(), token, { encoding: "utf-8", mode: 384 });
-}
-function writeTokens(accessToken, refreshToken) {
-  writeToken(accessToken);
-  if (refreshToken && refreshToken.trim().length > 0) {
-    writeRefreshToken(refreshToken);
-    return;
-  }
-  removeRefreshToken();
-}
-function removeRefreshToken() {
-  const refreshTokenPath = getRefreshTokenPath();
-  if (!existsSync(refreshTokenPath)) {
-    return false;
-  }
-  rmSync(refreshTokenPath);
-  return true;
-}
-function removeToken() {
-  let removed = false;
-  const tokenPath = getTokenPath();
-  if (existsSync(tokenPath)) {
-    rmSync(tokenPath);
-    removed = true;
-  }
-  if (removeRefreshToken()) {
-    removed = true;
-  }
-  return removed;
-}
-
-// src/auth/commands.ts
-function getClientId() {
-  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
-  if (clientId) {
-    return clientId;
-  }
-  throw new Error(
-    "TRACE_WORKOS_CLIENT_ID is not set. Build the CLI with TRACE_WORKOS_CLIENT_ID set, or provide it as an environment variable."
-  );
-}
-async function openBrowser(url2) {
-  try {
-    const parsed = new URL(url2);
-    if (parsed.protocol !== "https:") {
-      return false;
+    return obj;
+  };
+  util2.getValidEnumValues = (obj) => {
+    const validKeys = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
+    const filtered = {};
+    for (const k of validKeys) {
+      filtered[k] = obj[k];
     }
-    const proc = Bun.spawn(["open", url2], {
-      stdout: "ignore",
-      stderr: "ignore"
+    return util2.objectValues(filtered);
+  };
+  util2.objectValues = (obj) => {
+    return util2.objectKeys(obj).map(function(e) {
+      return obj[e];
     });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      const linuxProc = Bun.spawn(["xdg-open", url2], {
-        stdout: "ignore",
-        stderr: "ignore"
-      });
-      return await linuxProc.exited === 0;
+  };
+  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object2) => {
+    const keys = [];
+    for (const key in object2) {
+      if (Object.prototype.hasOwnProperty.call(object2, key)) {
+        keys.push(key);
+      }
     }
-    return true;
-  } catch {
-    return false;
+    return keys;
+  };
+  util2.find = (arr, checker) => {
+    for (const item of arr) {
+      if (checker(item))
+        return item;
+    }
+    return void 0;
+  };
+  util2.isInteger = typeof Number.isInteger === "function" ? (val) => Number.isInteger(val) : (val) => typeof val === "number" && isFinite(val) && Math.floor(val) === val;
+  function joinValues2(array2, separator = " | ") {
+    return array2.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
   }
-}
-function createLoginCommand() {
-  return new Command("login").description("Authenticate with Trace").action(async () => {
-    const existingToken = readToken();
-    if (existingToken) {
-      console.log("You are already logged in. Run `trace auth logout` first to re-authenticate.");
-      return;
+  util2.joinValues = joinValues2;
+  util2.jsonStringifyReplacer = (_, value) => {
+    if (typeof value === "bigint") {
+      return value.toString();
     }
-    const clientId = getClientId();
-    console.log("Initiating device authorization...\n");
-    const auth = await requestDeviceAuthorization(clientId);
-    console.log("Your one-time code is:\n");
-    console.log(`  ${auth.user_code}
-`);
-    console.log(`Open this URL in your browser: ${auth.verification_uri}`);
-    console.log("");
-    const opened = await openBrowser(auth.verification_uri_complete);
-    if (opened) {
-      console.log("A browser window has been opened for you.");
-    } else {
-      console.log(`Or visit: ${auth.verification_uri_complete}`);
-    }
-    console.log("\nWaiting for authorization...");
-    const tokenResponse = await pollForToken(clientId, auth.device_code, {
-      expiresIn: auth.expires_in,
-      interval: auth.interval
-    });
-    writeTokens(tokenResponse.access_token, tokenResponse.refresh_token);
-    const name = [tokenResponse.user.first_name, tokenResponse.user.last_name].filter(Boolean).join(" ");
-    const displayName = name || tokenResponse.user.email;
-    console.log(`
-Authenticated as ${displayName} (${tokenResponse.user.email})`);
-    console.log("Tokens saved to ~/.trace");
-  });
-}
-function createLogoutCommand() {
-  return new Command("logout").description("Log out of Trace").action(() => {
-    const removed = removeToken();
-    if (removed) {
-      console.log("Logged out successfully. Token removed from ~/.trace/token");
+    return value;
+  };
+})(util || (util = {}));
+var objectUtil;
+(function(objectUtil2) {
+  objectUtil2.mergeShapes = (first, second) => {
+    return {
+      ...first,
+      ...second
+      // second overwrites first
+    };
+  };
+})(objectUtil || (objectUtil = {}));
+var ZodParsedType = util.arrayToEnum([
+  "string",
+  "nan",
+  "number",
+  "integer",
+  "float",
+  "boolean",
+  "date",
+  "bigint",
+  "symbol",
+  "function",
+  "undefined",
+  "null",
+  "array",
+  "object",
+  "unknown",
+  "promise",
+  "void",
+  "never",
+  "map",
+  "set"
+]);
+var getParsedType = (data) => {
+  const t = typeof data;
+  switch (t) {
+    case "undefined":
+      return ZodParsedType.undefined;
+    case "string":
+      return ZodParsedType.string;
+    case "number":
+      return isNaN(data) ? ZodParsedType.nan : ZodParsedType.number;
+    case "boolean":
+      return ZodParsedType.boolean;
+    case "function":
+      return ZodParsedType.function;
+    case "bigint":
+      return ZodParsedType.bigint;
+    case "symbol":
+      return ZodParsedType.symbol;
+    case "object":
+      if (Array.isArray(data)) {
+        return ZodParsedType.array;
+      }
+      if (data === null) {
+        return ZodParsedType.null;
+      }
+      if (data.then && typeof data.then === "function" && data.catch && typeof data.catch === "function") {
+        return ZodParsedType.promise;
+      }
+      if (typeof Map !== "undefined" && data instanceof Map) {
+        return ZodParsedType.map;
+      }
+      if (typeof Set !== "undefined" && data instanceof Set) {
+        return ZodParsedType.set;
+      }
+      if (typeof Date !== "undefined" && data instanceof Date) {
+        return ZodParsedType.date;
+      }
+      return ZodParsedType.object;
+    default:
+      return ZodParsedType.unknown;
+  }
+};
+var ZodIssueCode = util.arrayToEnum([
+  "invalid_type",
+  "invalid_literal",
+  "custom",
+  "invalid_union",
+  "invalid_union_discriminator",
+  "invalid_enum_value",
+  "unrecognized_keys",
+  "invalid_arguments",
+  "invalid_return_type",
+  "invalid_date",
+  "invalid_string",
+  "too_small",
+  "too_big",
+  "invalid_intersection_types",
+  "not_multiple_of",
+  "not_finite"
+]);
+var quotelessJson = (obj) => {
+  const json2 = JSON.stringify(obj, null, 2);
+  return json2.replace(/"([^"]+)":/g, "$1:");
+};
+var ZodError = class extends Error {
+  constructor(issues) {
+    super();
+    this.issues = [];
+    this.addIssue = (sub) => {
+      this.issues = [...this.issues, sub];
+    };
+    this.addIssues = (subs = []) => {
+      this.issues = [...this.issues, ...subs];
+    };
+    const actualProto = new.target.prototype;
+    if (Object.setPrototypeOf) {
+      Object.setPrototypeOf(this, actualProto);
     } else {
-      console.log("No active session found.");
+      this.__proto__ = actualProto;
     }
-  });
-}
-function createStatusCommand() {
-  return new Command("status").description("Show current authentication status").action(() => {
-    const token = readToken();
-    const refreshToken = readRefreshToken();
-    if (token) {
-      try {
-        const parts = token.split(".");
-        const payload = parts[1];
-        if (payload) {
-          const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
-          const expiry = decoded.exp ? new Date(decoded.exp * 1e3) : null;
-          const isExpired = expiry ? expiry < /* @__PURE__ */ new Date() : false;
-          console.log("Logged in to Trace");
-          if (decoded.sub) {
-            console.log(`  User ID: ${decoded.sub}`);
-          }
-          if (decoded.org_id) {
-            console.log(`  Org ID:  ${decoded.org_id}`);
-          }
-          if (expiry) {
-            console.log(`  Expires: ${expiry.toISOString()}${isExpired ? " (EXPIRED)" : ""}`);
-          }
-          console.log(
-            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
-          );
-          if (isExpired) {
-            if (refreshToken) {
-              console.log(
-                "\nYour access token is expired, but a refresh token is available and will be used automatically."
-              );
+    this.name = "ZodError";
+    this.issues = issues;
+  }
+  get errors() {
+    return this.issues;
+  }
+  format(_mapper) {
+    const mapper = _mapper || function(issue2) {
+      return issue2.message;
+    };
+    const fieldErrors = { _errors: [] };
+    const processError = (error48) => {
+      for (const issue2 of error48.issues) {
+        if (issue2.code === "invalid_union") {
+          issue2.unionErrors.map(processError);
+        } else if (issue2.code === "invalid_return_type") {
+          processError(issue2.returnTypeError);
+        } else if (issue2.code === "invalid_arguments") {
+          processError(issue2.argumentsError);
+        } else if (issue2.path.length === 0) {
+          fieldErrors._errors.push(mapper(issue2));
+        } else {
+          let curr = fieldErrors;
+          let i = 0;
+          while (i < issue2.path.length) {
+            const el = issue2.path[i];
+            const terminal = i === issue2.path.length - 1;
+            if (!terminal) {
+              curr[el] = curr[el] || { _errors: [] };
             } else {
-              console.log(
-                "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
-              );
+              curr[el] = curr[el] || { _errors: [] };
+              curr[el]._errors.push(mapper(issue2));
             }
+            curr = curr[el];
+            i++;
           }
-        } else {
-          console.log("Logged in to Trace (access token stored at ~/.trace/token)");
-          console.log(
-            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
-          );
         }
-      } catch {
-        console.log("Logged in to Trace (access token stored at ~/.trace/token)");
-        console.log(
-          `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
-        );
       }
-    } else {
-      console.log("Not logged in. Run `trace auth login` to authenticate.");
+    };
+    processError(this);
+    return fieldErrors;
+  }
+  toString() {
+    return this.message;
+  }
+  get message() {
+    return JSON.stringify(this.issues, util.jsonStringifyReplacer, 2);
+  }
+  get isEmpty() {
+    return this.issues.length === 0;
+  }
+  flatten(mapper = (issue2) => issue2.message) {
+    const fieldErrors = {};
+    const formErrors = [];
+    for (const sub of this.issues) {
+      if (sub.path.length > 0) {
+        fieldErrors[sub.path[0]] = fieldErrors[sub.path[0]] || [];
+        fieldErrors[sub.path[0]].push(mapper(sub));
+      } else {
+        formErrors.push(mapper(sub));
+      }
     }
-  });
-}
-function createAuthCommand() {
-  const auth = new Command("auth").description("Manage authentication");
-  auth.addCommand(createLoginCommand());
-  auth.addCommand(createLogoutCommand());
-  auth.addCommand(createStatusCommand());
-  return auth;
-}
-
-// src/banner.ts
-var ESC = "\x1B";
-var RESET = `${ESC}[0m`;
-var CYAN_BOLD = `${ESC}[1;36m`;
-var DIM = `${ESC}[2m`;
-var BANNER = `
- \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
- \u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D
-    \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2557  
-    \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u255D  
-    \u2588\u2588\u2551   \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
-    \u255A\u2550\u255D   \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D
-`;
-function showBanner() {
-  console.log(`${CYAN_BOLD}${BANNER}${RESET}`);
-  console.log(`${DIM}  Continuous security vulnerability intelligence${RESET}
-`);
-}
-
-// src/completion/index.ts
-function extractCommandTree(cmd) {
-  const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
-  const options = cmd.options.filter((o) => !o.hidden).filter((o) => !BUILTIN_FLAGS.has(o.long ?? "") && !BUILTIN_FLAGS.has(o.short ?? "")).map((o) => ({
-    flags: o.flags,
-    long: o.long ?? "",
-    short: o.short ?? null,
-    description: o.description,
-    takesValue: o.required || o.optional
-  }));
-  const subcommands = cmd.commands.filter((c25) => !c25._hidden).map((c25) => extractCommandTree(c25));
-  return {
-    name: cmd.name(),
-    description: cmd.description(),
-    options,
-    subcommands
-  };
-}
-function escapeForShell(s) {
-  return s.replace(/'/g, "'\\''");
-}
-function generateBashCompletion(tree, binName) {
-  const lines = [];
-  lines.push("#!/usr/bin/env bash");
-  lines.push(`# Bash completion for ${binName}`);
-  lines.push(`# Generated by ${binName} completion --shell bash`);
-  lines.push("#");
-  lines.push("# To enable, add to your ~/.bashrc:");
-  lines.push(`#   eval "$(${binName} completion --shell bash)"`);
-  lines.push("");
-  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}_completions`;
-  lines.push(`${funcName}() {`);
-  lines.push("  local cur prev words cword");
-  lines.push("  _get_comp_words_by_ref -n : cur prev words cword 2>/dev/null || {");
-  lines.push(`    cur="\${COMP_WORDS[COMP_CWORD]}"`);
-  lines.push(`    prev="\${COMP_WORDS[COMP_CWORD-1]}"`);
-  lines.push(`    words=("\${COMP_WORDS[@]}")`);
-  lines.push(`    cword="\${COMP_CWORD}"`);
-  lines.push("  }");
-  lines.push("");
-  lines.push("  # Build the command chain (skip the binary name at index 0)");
-  lines.push(`  local cmd_chain=""`);
-  lines.push("  local i");
-  lines.push("  for (( i=1; i<cword; i++ )); do");
-  lines.push(`    case "\${words[i]}" in`);
-  lines.push("      -*) ;; # skip options");
-  lines.push(`      *) cmd_chain="\${cmd_chain} \${words[i]}" ;;`);
-  lines.push("    esac");
-  lines.push("  done");
-  lines.push(`  cmd_chain="\${cmd_chain## }" # trim leading space`);
-  lines.push("");
-  const cases = collectBashCases(tree, "");
-  lines.push(`  local completions=""`);
-  lines.push(`  case "\${cmd_chain}" in`);
-  for (const [path, { subcommands, options }] of cases) {
-    const pattern = path === "" ? `''` : `'${escapeForShell(path)}'`;
-    const all = [...subcommands, ...options];
-    lines.push(`    ${pattern})`);
-    lines.push(`      completions="${all.join(" ")}"`);
-    lines.push("      ;;");
+    return { formErrors, fieldErrors };
   }
-  lines.push("    *)");
-  lines.push(`      completions=""`);
-  lines.push("      ;;");
-  lines.push("  esac");
-  lines.push("");
-  lines.push(`  COMPREPLY=( $(compgen -W "\${completions}" -- "\${cur}") )`);
-  lines.push("  return 0");
-  lines.push("}");
-  lines.push("");
-  lines.push(`complete -o default -F ${funcName} ${binName}`);
-  lines.push("");
-  return lines.join("\n");
-}
-function collectBashCases(tree, prefix) {
-  const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c25) => c25.name);
-  const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
-  const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
-  const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
-  cases.set(prefix, { subcommands: subcommandNames, options: allOptions });
-  for (const sub of tree.subcommands) {
-    const subPath = prefix ? `${prefix} ${sub.name}` : sub.name;
-    const subCases = collectBashCases(sub, subPath);
-    for (const [k, v] of subCases) {
-      cases.set(k, v);
-    }
+  get formErrors() {
+    return this.flatten();
   }
-  return cases;
-}
-function generateZshCompletion(tree, binName) {
-  const lines = [];
-  lines.push(`#compdef ${binName}`);
-  lines.push(`# Zsh completion for ${binName}`);
-  lines.push(`# Generated by ${binName} completion --shell zsh`);
-  lines.push("#");
-  lines.push("# To enable, add to your ~/.zshrc:");
-  lines.push(`#   eval "$(${binName} completion --shell zsh)"`);
-  lines.push("");
-  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}`;
-  lines.push(`${funcName}() {`);
-  lines.push("  local -a commands");
-  lines.push("  local line state");
-  lines.push("");
-  generateZshCommandBlock(tree, lines, "  ", binName, true);
-  lines.push("}");
-  lines.push("");
-  generateZshSubFunctions(tree, lines, binName);
-  lines.push(`compdef ${funcName} ${binName}`);
-  lines.push("");
-  return lines.join("\n");
-}
-function generateZshCommandBlock(tree, lines, indent, _binName, isRoot) {
-  if (tree.subcommands.length > 0) {
-    lines.push(`${indent}_arguments -C \\`);
-    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
-    if (isRoot) {
-      lines.push(`${indent}  '(-V --version)'{-V,--version}'[Show version]' \\`);
-    }
-    for (const opt of tree.options) {
-      const desc = escapeForShell(opt.description);
-      if (opt.takesValue) {
-        if (opt.short) {
-          lines.push(
-            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
-          );
-        } else {
-          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
-        }
+};
+ZodError.create = (issues) => {
+  const error48 = new ZodError(issues);
+  return error48;
+};
+var errorMap = (issue2, _ctx) => {
+  let message;
+  switch (issue2.code) {
+    case ZodIssueCode.invalid_type:
+      if (issue2.received === ZodParsedType.undefined) {
+        message = "Required";
       } else {
-        if (opt.short) {
-          lines.push(
-            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
-          );
-        } else {
-          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
-        }
+        message = `Expected ${issue2.expected}, received ${issue2.received}`;
       }
-    }
-    lines.push(`${indent}  '1: :->command' \\`);
-    lines.push(`${indent}  '*::arg:->args'`);
-    lines.push("");
-    lines.push(`${indent}case "$state" in`);
-    lines.push(`${indent}  command)`);
-    lines.push(`${indent}    commands=(`);
-    for (const sub of tree.subcommands) {
-      const desc = escapeForShell(sub.description);
-      lines.push(`${indent}      '${sub.name}:${desc}'`);
-    }
-    lines.push(`${indent}    )`);
-    lines.push(`${indent}    _describe 'command' commands`);
-    lines.push(`${indent}    ;;`);
-    lines.push(`${indent}  args)`);
-    lines.push(`${indent}    case "$line[1]" in`);
-    for (const sub of tree.subcommands) {
-      const subFunc = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
-      lines.push(`${indent}      ${sub.name}) ${subFunc} ;;`);
-    }
-    lines.push(`${indent}    esac`);
-    lines.push(`${indent}    ;;`);
-    lines.push(`${indent}esac`);
-  } else {
-    lines.push(`${indent}_arguments \\`);
-    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
-    for (const opt of tree.options) {
-      const desc = escapeForShell(opt.description);
-      if (opt.takesValue) {
-        if (opt.short) {
-          lines.push(
-            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
-          );
+      break;
+    case ZodIssueCode.invalid_literal:
+      message = `Invalid literal value, expected ${JSON.stringify(issue2.expected, util.jsonStringifyReplacer)}`;
+      break;
+    case ZodIssueCode.unrecognized_keys:
+      message = `Unrecognized key(s) in object: ${util.joinValues(issue2.keys, ", ")}`;
+      break;
+    case ZodIssueCode.invalid_union:
+      message = `Invalid input`;
+      break;
+    case ZodIssueCode.invalid_union_discriminator:
+      message = `Invalid discriminator value. Expected ${util.joinValues(issue2.options)}`;
+      break;
+    case ZodIssueCode.invalid_enum_value:
+      message = `Invalid enum value. Expected ${util.joinValues(issue2.options)}, received '${issue2.received}'`;
+      break;
+    case ZodIssueCode.invalid_arguments:
+      message = `Invalid function arguments`;
+      break;
+    case ZodIssueCode.invalid_return_type:
+      message = `Invalid function return type`;
+      break;
+    case ZodIssueCode.invalid_date:
+      message = `Invalid date`;
+      break;
+    case ZodIssueCode.invalid_string:
+      if (typeof issue2.validation === "object") {
+        if ("includes" in issue2.validation) {
+          message = `Invalid input: must include "${issue2.validation.includes}"`;
+          if (typeof issue2.validation.position === "number") {
+            message = `${message} at one or more positions greater than or equal to ${issue2.validation.position}`;
+          }
+        } else if ("startsWith" in issue2.validation) {
+          message = `Invalid input: must start with "${issue2.validation.startsWith}"`;
+        } else if ("endsWith" in issue2.validation) {
+          message = `Invalid input: must end with "${issue2.validation.endsWith}"`;
         } else {
-          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
+          util.assertNever(issue2.validation);
         }
+      } else if (issue2.validation !== "regex") {
+        message = `Invalid ${issue2.validation}`;
       } else {
-        if (opt.short) {
-          lines.push(
-            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
-          );
-        } else {
-          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
-        }
+        message = "Invalid";
       }
-    }
-    lines.push(`${indent}  '*:file:_files'`);
-  }
-}
-function generateZshSubFunctions(tree, lines, binName) {
-  for (const sub of tree.subcommands) {
-    const funcName = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
-    lines.push(`${funcName}() {`);
-    generateZshCommandBlock(sub, lines, "  ", binName, false);
-    lines.push("}");
-    lines.push("");
-    if (sub.subcommands.length > 0) {
-      generateZshSubFunctions(sub, lines, binName);
-    }
-  }
-}
-function generateFishCompletion(tree, binName) {
-  const lines = [];
-  lines.push(`# Fish completion for ${binName}`);
-  lines.push(`# Generated by ${binName} completion --shell fish`);
-  lines.push("#");
-  lines.push(`# To enable, add to your ~/.config/fish/completions/${binName}.fish:`);
-  lines.push(`#   ${binName} completion --shell fish | source`);
-  lines.push("");
-  lines.push(`complete -c ${binName} -f`);
-  lines.push("");
-  generateFishCommands(tree, lines, binName, []);
-  lines.push("");
-  return lines.join("\n");
-}
-function generateFishCommands(tree, lines, binName, parentPath) {
-  const condition = buildFishCondition(binName, parentPath);
-  for (const sub of tree.subcommands) {
-    const desc = sub.description.replace(/'/g, "\\'");
-    lines.push(`complete -c ${binName} ${condition} -a '${sub.name}' -d '${desc}'`);
-  }
-  for (const opt of tree.options) {
-    const desc = opt.description.replace(/'/g, "\\'");
-    const longFlag = opt.long.replace(/^--/, "");
-    const parts = [`complete -c ${binName} ${condition}`];
-    if (opt.short) {
-      parts.push(`-s '${opt.short.replace(/^-/, "")}'`);
-    }
-    parts.push(`-l '${longFlag}'`);
-    parts.push(`-d '${desc}'`);
-    if (opt.takesValue) {
-      parts.push("-r");
-    }
-    lines.push(parts.join(" "));
-  }
-  for (const sub of tree.subcommands) {
-    const subPath = [...parentPath, sub.name];
-    generateFishCommands(sub, lines, binName, subPath);
+      break;
+    case ZodIssueCode.too_small:
+      if (issue2.type === "array")
+        message = `Array must contain ${issue2.exact ? "exactly" : issue2.inclusive ? `at least` : `more than`} ${issue2.minimum} element(s)`;
+      else if (issue2.type === "string")
+        message = `String must contain ${issue2.exact ? "exactly" : issue2.inclusive ? `at least` : `over`} ${issue2.minimum} character(s)`;
+      else if (issue2.type === "number")
+        message = `Number must be ${issue2.exact ? `exactly equal to ` : issue2.inclusive ? `greater than or equal to ` : `greater than `}${issue2.minimum}`;
+      else if (issue2.type === "date")
+        message = `Date must be ${issue2.exact ? `exactly equal to ` : issue2.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue2.minimum))}`;
+      else
+        message = "Invalid input";
+      break;
+    case ZodIssueCode.too_big:
+      if (issue2.type === "array")
+        message = `Array must contain ${issue2.exact ? `exactly` : issue2.inclusive ? `at most` : `less than`} ${issue2.maximum} element(s)`;
+      else if (issue2.type === "string")
+        message = `String must contain ${issue2.exact ? `exactly` : issue2.inclusive ? `at most` : `under`} ${issue2.maximum} character(s)`;
+      else if (issue2.type === "number")
+        message = `Number must be ${issue2.exact ? `exactly` : issue2.inclusive ? `less than or equal to` : `less than`} ${issue2.maximum}`;
+      else if (issue2.type === "bigint")
+        message = `BigInt must be ${issue2.exact ? `exactly` : issue2.inclusive ? `less than or equal to` : `less than`} ${issue2.maximum}`;
+      else if (issue2.type === "date")
+        message = `Date must be ${issue2.exact ? `exactly` : issue2.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue2.maximum))}`;
+      else
+        message = "Invalid input";
+      break;
+    case ZodIssueCode.custom:
+      message = `Invalid input`;
+      break;
+    case ZodIssueCode.invalid_intersection_types:
+      message = `Intersection results could not be merged`;
+      break;
+    case ZodIssueCode.not_multiple_of:
+      message = `Number must be a multiple of ${issue2.multipleOf}`;
+      break;
+    case ZodIssueCode.not_finite:
+      message = "Number must be finite";
+      break;
+    default:
+      message = _ctx.defaultError;
+      util.assertNever(issue2);
   }
+  return { message };
+};
+var overrideErrorMap = errorMap;
+function setErrorMap(map2) {
+  overrideErrorMap = map2;
 }
-function buildFishCondition(binName, parentPath) {
-  if (parentPath.length === 0) {
-    return `-n '__fish_use_subcommand'`;
-  }
-  if (parentPath.length === 1) {
-    return `-n '__fish_seen_subcommand_from ${parentPath[0]}'`;
-  }
-  const conditions = parentPath.map((p) => `__fish_seen_subcommand_from ${p}`);
-  return `-n '${conditions.join("; and ")}'`;
+function getErrorMap() {
+  return overrideErrorMap;
 }
-function generateCompletion(program3, shell, binName) {
-  const name = binName ?? program3.name();
-  const tree = extractCommandTree(program3);
-  switch (shell) {
-    case "bash":
-      return generateBashCompletion(tree, name);
-    case "zsh":
-      return generateZshCompletion(tree, name);
-    case "fish":
-      return generateFishCompletion(tree, name);
+var makeIssue = (params) => {
+  const { data, path, errorMaps, issueData } = params;
+  const fullPath = [...path, ...issueData.path || []];
+  const fullIssue = {
+    ...issueData,
+    path: fullPath
+  };
+  let errorMessage = "";
+  const maps = errorMaps.filter((m) => !!m).slice().reverse();
+  for (const map2 of maps) {
+    errorMessage = map2(fullIssue, { data, defaultError: errorMessage }).message;
   }
+  return {
+    ...issueData,
+    path: fullPath,
+    message: issueData.message || errorMessage
+  };
+};
+var EMPTY_PATH = [];
+function addIssueToContext(ctx, issueData) {
+  const issue2 = makeIssue({
+    issueData,
+    data: ctx.data,
+    path: ctx.path,
+    errorMaps: [
+      ctx.common.contextualErrorMap,
+      ctx.schemaErrorMap,
+      getErrorMap(),
+      errorMap
+      // then global default map
+    ].filter((x) => !!x)
+  });
+  ctx.common.issues.push(issue2);
 }
-
-// src/completion/install.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var TRACE_DIR = ".trace";
-function completionFileName(shell) {
-  switch (shell) {
-    case "bash":
-      return "tracecli-completion.bash";
-    case "zsh":
-      return "_tracecli";
-    case "fish":
-      return "tracecli-completion.fish";
+var ParseStatus = class _ParseStatus {
+  constructor() {
+    this.value = "valid";
   }
-}
-function getTraceDir() {
-  return join2(homedir2(), TRACE_DIR);
-}
-function getCompletionFilePath(shell) {
-  return join2(getTraceDir(), completionFileName(shell));
-}
-function writeCompletionFile(shell, script) {
-  const dir = getTraceDir();
-  if (!existsSync2(dir)) {
-    mkdirSync2(dir, { recursive: true });
+  dirty() {
+    if (this.value === "valid")
+      this.value = "dirty";
   }
-  const filePath = getCompletionFilePath(shell);
-  writeFileSync2(filePath, script, "utf-8");
-  return filePath;
-}
-function getSetupInstructions(shell) {
-  const traceDir = `~/${TRACE_DIR}`;
-  switch (shell) {
-    case "bash":
-      return [
-        "Add the following line to your .bashrc file:",
-        "",
-        "  # The next line enables shell command completion for Trace",
-        `  source ${traceDir}/tracecli-completion.bash`,
-        ""
-      ].join("\n");
-    case "zsh":
-      return [
-        "Add the following lines to your .zshrc file:",
-        "",
-        "  # The next lines enable shell command completion for Trace",
-        `  fpath=(${traceDir} $fpath)`,
-        "  autoload -Uz compinit && compinit -i",
-        ""
-      ].join("\n");
-    case "fish":
-      return [
-        "Copy the completion file to your fish completions directory:",
-        "",
-        `  cp ${traceDir}/tracecli-completion.fish ~/.config/fish/completions/tracecli.fish`,
-        ""
-      ].join("\n");
+  abort() {
+    if (this.value !== "aborted")
+      this.value = "aborted";
   }
-}
-
-// src/completion/commands.ts
-var SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
-function detectShell() {
-  const shellEnv = process.env["SHELL"] ?? "";
-  if (shellEnv.endsWith("/bash") || shellEnv.endsWith("/bash.exe")) {
-    return "bash";
+  static mergeArray(status, results) {
+    const arrayValue = [];
+    for (const s of results) {
+      if (s.status === "aborted")
+        return INVALID;
+      if (s.status === "dirty")
+        status.dirty();
+      arrayValue.push(s.value);
+    }
+    return { status: status.value, value: arrayValue };
   }
-  if (shellEnv.endsWith("/zsh")) {
-    return "zsh";
+  static async mergeObjectAsync(status, pairs) {
+    const syncPairs = [];
+    for (const pair of pairs) {
+      syncPairs.push({
+        key: await pair.key,
+        value: await pair.value
+      });
+    }
+    return _ParseStatus.mergeObjectSync(status, syncPairs);
   }
-  if (shellEnv.endsWith("/fish")) {
-    return "fish";
+  static mergeObjectSync(status, pairs) {
+    const finalObject = {};
+    for (const pair of pairs) {
+      const { key, value } = pair;
+      if (key.status === "aborted")
+        return INVALID;
+      if (value.status === "aborted")
+        return INVALID;
+      if (key.status === "dirty")
+        status.dirty();
+      if (value.status === "dirty")
+        status.dirty();
+      if (key.value !== "__proto__" && (typeof value.value !== "undefined" || pair.alwaysSet)) {
+        finalObject[key.value] = value.value;
+      }
+    }
+    return { status: status.value, value: finalObject };
   }
-  return null;
-}
-function resolveShell(shellOption) {
-  const shell = shellOption ?? detectShell();
-  if (!shell) {
-    console.error(
-      `Could not detect shell. Please specify one with --shell <${SUPPORTED_SHELLS.join("|")}>.`
-    );
-    process.exit(1);
-  }
-  if (!SUPPORTED_SHELLS.includes(shell)) {
-    console.error(
-      `Unsupported shell: '${shell}'. Supported shells: ${SUPPORTED_SHELLS.join(", ")}.`
-    );
-    process.exit(1);
-  }
-  return shell;
-}
-function createCompletionCommand(program3) {
-  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).action((options) => {
-    const shell = resolveShell(options.shell);
-    const script = generateCompletion(program3, shell);
-    const writtenPath = writeCompletionFile(shell, script);
-    console.log(`Completion file written to ${writtenPath}`);
-    console.log("");
-    console.log(getSetupInstructions(shell));
-  });
-}
-
-// ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
-var util;
-(function(util2) {
-  util2.assertEqual = (val) => val;
-  function assertIs2(_arg) {
-  }
-  util2.assertIs = assertIs2;
-  function assertNever2(_x) {
-    throw new Error();
+};
+var INVALID = Object.freeze({
+  status: "aborted"
+});
+var DIRTY = (value) => ({ status: "dirty", value });
+var OK = (value) => ({ status: "valid", value });
+var isAborted = (x) => x.status === "aborted";
+var isDirty = (x) => x.status === "dirty";
+var isValid = (x) => x.status === "valid";
+var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
+var errorUtil;
+(function(errorUtil2) {
+  errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
+  errorUtil2.toString = (message) => typeof message === "string" ? message : message === null || message === void 0 ? void 0 : message.message;
+})(errorUtil || (errorUtil = {}));
+var ParseInputLazyPath = class {
+  constructor(parent, value, path, key) {
+    this._cachedPath = [];
+    this.parent = parent;
+    this.data = value;
+    this._path = path;
+    this._key = key;
   }
-  util2.assertNever = assertNever2;
-  util2.arrayToEnum = (items) => {
-    const obj = {};
-    for (const item of items) {
-      obj[item] = item;
-    }
-    return obj;
-  };
-  util2.getValidEnumValues = (obj) => {
-    const validKeys = util2.objectKeys(obj).filter((k) => typeof obj[obj[k]] !== "number");
-    const filtered = {};
-    for (const k of validKeys) {
-      filtered[k] = obj[k];
-    }
-    return util2.objectValues(filtered);
-  };
-  util2.objectValues = (obj) => {
-    return util2.objectKeys(obj).map(function(e) {
-      return obj[e];
-    });
-  };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object2) => {
-    const keys = [];
-    for (const key in object2) {
-      if (Object.prototype.hasOwnProperty.call(object2, key)) {
-        keys.push(key);
+  get path() {
+    if (!this._cachedPath.length) {
+      if (this._key instanceof Array) {
+        this._cachedPath.push(...this._path, ...this._key);
+      } else {
+        this._cachedPath.push(...this._path, this._key);
       }
     }
-    return keys;
-  };
-  util2.find = (arr, checker) => {
-    for (const item of arr) {
-      if (checker(item))
-        return item;
-    }
-    return void 0;
-  };
-  util2.isInteger = typeof Number.isInteger === "function" ? (val) => Number.isInteger(val) : (val) => typeof val === "number" && isFinite(val) && Math.floor(val) === val;
-  function joinValues2(array2, separator = " | ") {
-    return array2.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
+    return this._cachedPath;
   }
-  util2.joinValues = joinValues2;
-  util2.jsonStringifyReplacer = (_, value) => {
-    if (typeof value === "bigint") {
-      return value.toString();
+};
+var handleResult = (ctx, result) => {
+  if (isValid(result)) {
+    return { success: true, data: result.value };
+  } else {
+    if (!ctx.common.issues.length) {
+      throw new Error("Validation failed but no issues detected.");
     }
-    return value;
-  };
-})(util || (util = {}));
-var objectUtil;
-(function(objectUtil2) {
-  objectUtil2.mergeShapes = (first, second) => {
     return {
-      ...first,
-      ...second
-      // second overwrites first
-    };
-  };
-})(objectUtil || (objectUtil = {}));
-var ZodParsedType = util.arrayToEnum([
-  "string",
-  "nan",
-  "number",
-  "integer",
-  "float",
-  "boolean",
-  "date",
-  "bigint",
-  "symbol",
-  "function",
-  "undefined",
-  "null",
-  "array",
-  "object",
-  "unknown",
-  "promise",
-  "void",
-  "never",
-  "map",
-  "set"
-]);
-var getParsedType = (data) => {
-  const t = typeof data;
-  switch (t) {
-    case "undefined":
-      return ZodParsedType.undefined;
-    case "string":
-      return ZodParsedType.string;
-    case "number":
-      return isNaN(data) ? ZodParsedType.nan : ZodParsedType.number;
-    case "boolean":
-      return ZodParsedType.boolean;
-    case "function":
-      return ZodParsedType.function;
-    case "bigint":
-      return ZodParsedType.bigint;
-    case "symbol":
-      return ZodParsedType.symbol;
-    case "object":
-      if (Array.isArray(data)) {
-        return ZodParsedType.array;
-      }
-      if (data === null) {
-        return ZodParsedType.null;
-      }
-      if (data.then && typeof data.then === "function" && data.catch && typeof data.catch === "function") {
-        return ZodParsedType.promise;
-      }
-      if (typeof Map !== "undefined" && data instanceof Map) {
-        return ZodParsedType.map;
-      }
-      if (typeof Set !== "undefined" && data instanceof Set) {
-        return ZodParsedType.set;
-      }
-      if (typeof Date !== "undefined" && data instanceof Date) {
-        return ZodParsedType.date;
+      success: false,
+      get error() {
+        if (this._error)
+          return this._error;
+        const error48 = new ZodError(ctx.common.issues);
+        this._error = error48;
+        return this._error;
       }
-      return ZodParsedType.object;
-    default:
-      return ZodParsedType.unknown;
-  }
-};
-var ZodIssueCode = util.arrayToEnum([
-  "invalid_type",
-  "invalid_literal",
-  "custom",
-  "invalid_union",
-  "invalid_union_discriminator",
-  "invalid_enum_value",
-  "unrecognized_keys",
-  "invalid_arguments",
-  "invalid_return_type",
-  "invalid_date",
-  "invalid_string",
-  "too_small",
-  "too_big",
-  "invalid_intersection_types",
-  "not_multiple_of",
-  "not_finite"
-]);
-var quotelessJson = (obj) => {
-  const json2 = JSON.stringify(obj, null, 2);
-  return json2.replace(/"([^"]+)":/g, "$1:");
-};
-var ZodError = class extends Error {
-  constructor(issues) {
-    super();
-    this.issues = [];
-    this.addIssue = (sub) => {
-      this.issues = [...this.issues, sub];
     };
-    this.addIssues = (subs = []) => {
-      this.issues = [...this.issues, ...subs];
-    };
-    const actualProto = new.target.prototype;
-    if (Object.setPrototypeOf) {
-      Object.setPrototypeOf(this, actualProto);
-    } else {
-      this.__proto__ = actualProto;
-    }
-    this.name = "ZodError";
-    this.issues = issues;
   }
-  get errors() {
-    return this.issues;
+};
+function processCreateParams(params) {
+  if (!params)
+    return {};
+  const { errorMap: errorMap2, invalid_type_error, required_error, description } = params;
+  if (errorMap2 && (invalid_type_error || required_error)) {
+    throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
   }
-  format(_mapper) {
-    const mapper = _mapper || function(issue2) {
-      return issue2.message;
-    };
-    const fieldErrors = { _errors: [] };
-    const processError = (error48) => {
-      for (const issue2 of error48.issues) {
-        if (issue2.code === "invalid_union") {
-          issue2.unionErrors.map(processError);
-        } else if (issue2.code === "invalid_return_type") {
-          processError(issue2.returnTypeError);
-        } else if (issue2.code === "invalid_arguments") {
-          processError(issue2.argumentsError);
-        } else if (issue2.path.length === 0) {
-          fieldErrors._errors.push(mapper(issue2));
-        } else {
-          let curr = fieldErrors;
-          let i = 0;
-          while (i < issue2.path.length) {
-            const el = issue2.path[i];
-            const terminal = i === issue2.path.length - 1;
-            if (!terminal) {
-              curr[el] = curr[el] || { _errors: [] };
-            } else {
-              curr[el] = curr[el] || { _errors: [] };
-              curr[el]._errors.push(mapper(issue2));
-            }
-            curr = curr[el];
-            i++;
-          }
-        }
-      }
-    };
-    processError(this);
-    return fieldErrors;
+  if (errorMap2)
+    return { errorMap: errorMap2, description };
+  const customMap = (iss, ctx) => {
+    if (iss.code !== "invalid_type")
+      return { message: ctx.defaultError };
+    if (typeof ctx.data === "undefined") {
+      return { message: required_error !== null && required_error !== void 0 ? required_error : ctx.defaultError };
+    }
+    return { message: invalid_type_error !== null && invalid_type_error !== void 0 ? invalid_type_error : ctx.defaultError };
+  };
+  return { errorMap: customMap, description };
+}
+var ZodType = class {
+  constructor(def) {
+    this.spa = this.safeParseAsync;
+    this._def = def;
+    this.parse = this.parse.bind(this);
+    this.safeParse = this.safeParse.bind(this);
+    this.parseAsync = this.parseAsync.bind(this);
+    this.safeParseAsync = this.safeParseAsync.bind(this);
+    this.spa = this.spa.bind(this);
+    this.refine = this.refine.bind(this);
+    this.refinement = this.refinement.bind(this);
+    this.superRefine = this.superRefine.bind(this);
+    this.optional = this.optional.bind(this);
+    this.nullable = this.nullable.bind(this);
+    this.nullish = this.nullish.bind(this);
+    this.array = this.array.bind(this);
+    this.promise = this.promise.bind(this);
+    this.or = this.or.bind(this);
+    this.and = this.and.bind(this);
+    this.transform = this.transform.bind(this);
+    this.brand = this.brand.bind(this);
+    this.default = this.default.bind(this);
+    this.catch = this.catch.bind(this);
+    this.describe = this.describe.bind(this);
+    this.pipe = this.pipe.bind(this);
+    this.readonly = this.readonly.bind(this);
+    this.isNullable = this.isNullable.bind(this);
+    this.isOptional = this.isOptional.bind(this);
   }
-  toString() {
-    return this.message;
+  get description() {
+    return this._def.description;
   }
-  get message() {
-    return JSON.stringify(this.issues, util.jsonStringifyReplacer, 2);
+  _getType(input) {
+    return getParsedType(input.data);
   }
-  get isEmpty() {
-    return this.issues.length === 0;
+  _getOrReturnCtx(input, ctx) {
+    return ctx || {
+      common: input.parent.common,
+      data: input.data,
+      parsedType: getParsedType(input.data),
+      schemaErrorMap: this._def.errorMap,
+      path: input.path,
+      parent: input.parent
+    };
   }
-  flatten(mapper = (issue2) => issue2.message) {
-    const fieldErrors = {};
-    const formErrors = [];
-    for (const sub of this.issues) {
-      if (sub.path.length > 0) {
-        fieldErrors[sub.path[0]] = fieldErrors[sub.path[0]] || [];
-        fieldErrors[sub.path[0]].push(mapper(sub));
-      } else {
-        formErrors.push(mapper(sub));
+  _processInputParams(input) {
+    return {
+      status: new ParseStatus(),
+      ctx: {
+        common: input.parent.common,
+        data: input.data,
+        parsedType: getParsedType(input.data),
+        schemaErrorMap: this._def.errorMap,
+        path: input.path,
+        parent: input.parent
       }
+    };
+  }
+  _parseSync(input) {
+    const result = this._parse(input);
+    if (isAsync(result)) {
+      throw new Error("Synchronous parse encountered promise.");
     }
-    return { formErrors, fieldErrors };
+    return result;
   }
-  get formErrors() {
-    return this.flatten();
+  _parseAsync(input) {
+    const result = this._parse(input);
+    return Promise.resolve(result);
   }
-};
-ZodError.create = (issues) => {
-  const error48 = new ZodError(issues);
-  return error48;
-};
-var errorMap = (issue2, _ctx) => {
-  let message;
-  switch (issue2.code) {
-    case ZodIssueCode.invalid_type:
-      if (issue2.received === ZodParsedType.undefined) {
-        message = "Required";
+  parse(data, params) {
+    const result = this.safeParse(data, params);
+    if (result.success)
+      return result.data;
+    throw result.error;
+  }
+  safeParse(data, params) {
+    var _a2;
+    const ctx = {
+      common: {
+        issues: [],
+        async: (_a2 = params === null || params === void 0 ? void 0 : params.async) !== null && _a2 !== void 0 ? _a2 : false,
+        contextualErrorMap: params === null || params === void 0 ? void 0 : params.errorMap
+      },
+      path: (params === null || params === void 0 ? void 0 : params.path) || [],
+      schemaErrorMap: this._def.errorMap,
+      parent: null,
+      data,
+      parsedType: getParsedType(data)
+    };
+    const result = this._parseSync({ data, path: ctx.path, parent: ctx });
+    return handleResult(ctx, result);
+  }
+  async parseAsync(data, params) {
+    const result = await this.safeParseAsync(data, params);
+    if (result.success)
+      return result.data;
+    throw result.error;
+  }
+  async safeParseAsync(data, params) {
+    const ctx = {
+      common: {
+        issues: [],
+        contextualErrorMap: params === null || params === void 0 ? void 0 : params.errorMap,
+        async: true
+      },
+      path: (params === null || params === void 0 ? void 0 : params.path) || [],
+      schemaErrorMap: this._def.errorMap,
+      parent: null,
+      data,
+      parsedType: getParsedType(data)
+    };
+    const maybeAsyncResult = this._parse({ data, path: ctx.path, parent: ctx });
+    const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
+    return handleResult(ctx, result);
+  }
+  refine(check2, message) {
+    const getIssueProperties = (val) => {
+      if (typeof message === "string" || typeof message === "undefined") {
+        return { message };
+      } else if (typeof message === "function") {
+        return message(val);
       } else {
-        message = `Expected ${issue2.expected}, received ${issue2.received}`;
+        return message;
       }
-      break;
-    case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(issue2.expected, util.jsonStringifyReplacer)}`;
-      break;
-    case ZodIssueCode.unrecognized_keys:
-      message = `Unrecognized key(s) in object: ${util.joinValues(issue2.keys, ", ")}`;
-      break;
-    case ZodIssueCode.invalid_union:
-      message = `Invalid input`;
-      break;
-    case ZodIssueCode.invalid_union_discriminator:
-      message = `Invalid discriminator value. Expected ${util.joinValues(issue2.options)}`;
-      break;
-    case ZodIssueCode.invalid_enum_value:
-      message = `Invalid enum value. Expected ${util.joinValues(issue2.options)}, received '${issue2.received}'`;
-      break;
-    case ZodIssueCode.invalid_arguments:
-      message = `Invalid function arguments`;
-      break;
-    case ZodIssueCode.invalid_return_type:
-      message = `Invalid function return type`;
-      break;
-    case ZodIssueCode.invalid_date:
-      message = `Invalid date`;
-      break;
-    case ZodIssueCode.invalid_string:
-      if (typeof issue2.validation === "object") {
-        if ("includes" in issue2.validation) {
-          message = `Invalid input: must include "${issue2.validation.includes}"`;
-          if (typeof issue2.validation.position === "number") {
-            message = `${message} at one or more positions greater than or equal to ${issue2.validation.position}`;
+    };
+    return this._refinement((val, ctx) => {
+      const result = check2(val);
+      const setError = () => ctx.addIssue({
+        code: ZodIssueCode.custom,
+        ...getIssueProperties(val)
+      });
+      if (typeof Promise !== "undefined" && result instanceof Promise) {
+        return result.then((data) => {
+          if (!data) {
+            setError();
+            return false;
+          } else {
+            return true;
           }
-        } else if ("startsWith" in issue2.validation) {
-          message = `Invalid input: must start with "${issue2.validation.startsWith}"`;
-        } else if ("endsWith" in issue2.validation) {
-          message = `Invalid input: must end with "${issue2.validation.endsWith}"`;
-        } else {
-          util.assertNever(issue2.validation);
-        }
-      } else if (issue2.validation !== "regex") {
-        message = `Invalid ${issue2.validation}`;
+        });
+      }
+      if (!result) {
+        setError();
+        return false;
       } else {
-        message = "Invalid";
+        return true;
       }
-      break;
-    case ZodIssueCode.too_small:
-      if (issue2.type === "array")
-        message = `Array must contain ${issue2.exact ? "exactly" : issue2.inclusive ? `at least` : `more than`} ${issue2.minimum} element(s)`;
-      else if (issue2.type === "string")
-        message = `String must contain ${issue2.exact ? "exactly" : issue2.inclusive ? `at least` : `over`} ${issue2.minimum} character(s)`;
-      else if (issue2.type === "number")
-        message = `Number must be ${issue2.exact ? `exactly equal to ` : issue2.inclusive ? `greater than or equal to ` : `greater than `}${issue2.minimum}`;
-      else if (issue2.type === "date")
-        message = `Date must be ${issue2.exact ? `exactly equal to ` : issue2.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue2.minimum))}`;
-      else
-        message = "Invalid input";
-      break;
-    case ZodIssueCode.too_big:
-      if (issue2.type === "array")
-        message = `Array must contain ${issue2.exact ? `exactly` : issue2.inclusive ? `at most` : `less than`} ${issue2.maximum} element(s)`;
-      else if (issue2.type === "string")
-        message = `String must contain ${issue2.exact ? `exactly` : issue2.inclusive ? `at most` : `under`} ${issue2.maximum} character(s)`;
-      else if (issue2.type === "number")
-        message = `Number must be ${issue2.exact ? `exactly` : issue2.inclusive ? `less than or equal to` : `less than`} ${issue2.maximum}`;
-      else if (issue2.type === "bigint")
-        message = `BigInt must be ${issue2.exact ? `exactly` : issue2.inclusive ? `less than or equal to` : `less than`} ${issue2.maximum}`;
-      else if (issue2.type === "date")
-        message = `Date must be ${issue2.exact ? `exactly` : issue2.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue2.maximum))}`;
-      else
-        message = "Invalid input";
-      break;
-    case ZodIssueCode.custom:
-      message = `Invalid input`;
-      break;
-    case ZodIssueCode.invalid_intersection_types:
-      message = `Intersection results could not be merged`;
-      break;
-    case ZodIssueCode.not_multiple_of:
-      message = `Number must be a multiple of ${issue2.multipleOf}`;
-      break;
-    case ZodIssueCode.not_finite:
-      message = "Number must be finite";
-      break;
-    default:
-      message = _ctx.defaultError;
-      util.assertNever(issue2);
+    });
   }
-  return { message };
-};
-var overrideErrorMap = errorMap;
-function setErrorMap(map2) {
-  overrideErrorMap = map2;
-}
-function getErrorMap() {
-  return overrideErrorMap;
-}
-var makeIssue = (params) => {
-  const { data, path, errorMaps, issueData } = params;
-  const fullPath = [...path, ...issueData.path || []];
-  const fullIssue = {
-    ...issueData,
-    path: fullPath
-  };
-  let errorMessage = "";
-  const maps = errorMaps.filter((m) => !!m).slice().reverse();
-  for (const map2 of maps) {
-    errorMessage = map2(fullIssue, { data, defaultError: errorMessage }).message;
+  refinement(check2, refinementData) {
+    return this._refinement((val, ctx) => {
+      if (!check2(val)) {
+        ctx.addIssue(typeof refinementData === "function" ? refinementData(val, ctx) : refinementData);
+        return false;
+      } else {
+        return true;
+      }
+    });
   }
-  return {
-    ...issueData,
-    path: fullPath,
-    message: issueData.message || errorMessage
-  };
-};
-var EMPTY_PATH = [];
-function addIssueToContext(ctx, issueData) {
-  const issue2 = makeIssue({
-    issueData,
-    data: ctx.data,
-    path: ctx.path,
-    errorMaps: [
-      ctx.common.contextualErrorMap,
-      ctx.schemaErrorMap,
-      getErrorMap(),
-      errorMap
-      // then global default map
-    ].filter((x) => !!x)
-  });
-  ctx.common.issues.push(issue2);
-}
-var ParseStatus = class _ParseStatus {
-  constructor() {
-    this.value = "valid";
+  _refinement(refinement) {
+    return new ZodEffects({
+      schema: this,
+      typeName: ZodFirstPartyTypeKind.ZodEffects,
+      effect: { type: "refinement", refinement }
+    });
   }
-  dirty() {
-    if (this.value === "valid")
-      this.value = "dirty";
+  superRefine(refinement) {
+    return this._refinement(refinement);
   }
-  abort() {
-    if (this.value !== "aborted")
-      this.value = "aborted";
+  optional() {
+    return ZodOptional.create(this, this._def);
   }
-  static mergeArray(status, results) {
-    const arrayValue = [];
-    for (const s of results) {
-      if (s.status === "aborted")
-        return INVALID;
-      if (s.status === "dirty")
-        status.dirty();
-      arrayValue.push(s.value);
-    }
-    return { status: status.value, value: arrayValue };
+  nullable() {
+    return ZodNullable.create(this, this._def);
   }
-  static async mergeObjectAsync(status, pairs) {
-    const syncPairs = [];
-    for (const pair of pairs) {
-      syncPairs.push({
-        key: await pair.key,
-        value: await pair.value
-      });
-    }
-    return _ParseStatus.mergeObjectSync(status, syncPairs);
+  nullish() {
+    return this.nullable().optional();
   }
-  static mergeObjectSync(status, pairs) {
-    const finalObject = {};
-    for (const pair of pairs) {
-      const { key, value } = pair;
-      if (key.status === "aborted")
-        return INVALID;
-      if (value.status === "aborted")
-        return INVALID;
-      if (key.status === "dirty")
-        status.dirty();
-      if (value.status === "dirty")
-        status.dirty();
-      if (key.value !== "__proto__" && (typeof value.value !== "undefined" || pair.alwaysSet)) {
-        finalObject[key.value] = value.value;
-      }
-    }
-    return { status: status.value, value: finalObject };
+  array() {
+    return ZodArray.create(this, this._def);
   }
-};
-var INVALID = Object.freeze({
-  status: "aborted"
-});
-var DIRTY = (value) => ({ status: "dirty", value });
-var OK = (value) => ({ status: "valid", value });
-var isAborted = (x) => x.status === "aborted";
-var isDirty = (x) => x.status === "dirty";
-var isValid = (x) => x.status === "valid";
-var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-var errorUtil;
-(function(errorUtil2) {
-  errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
-  errorUtil2.toString = (message) => typeof message === "string" ? message : message === null || message === void 0 ? void 0 : message.message;
-})(errorUtil || (errorUtil = {}));
-var ParseInputLazyPath = class {
-  constructor(parent, value, path, key) {
-    this._cachedPath = [];
-    this.parent = parent;
-    this.data = value;
-    this._path = path;
-    this._key = key;
+  promise() {
+    return ZodPromise.create(this, this._def);
   }
-  get path() {
-    if (!this._cachedPath.length) {
-      if (this._key instanceof Array) {
-        this._cachedPath.push(...this._path, ...this._key);
-      } else {
-        this._cachedPath.push(...this._path, this._key);
-      }
-    }
-    return this._cachedPath;
+  or(option) {
+    return ZodUnion.create([this, option], this._def);
   }
-};
-var handleResult = (ctx, result) => {
-  if (isValid(result)) {
-    return { success: true, data: result.value };
-  } else {
-    if (!ctx.common.issues.length) {
-      throw new Error("Validation failed but no issues detected.");
-    }
-    return {
-      success: false,
-      get error() {
-        if (this._error)
-          return this._error;
-        const error48 = new ZodError(ctx.common.issues);
-        this._error = error48;
-        return this._error;
-      }
-    };
+  and(incoming) {
+    return ZodIntersection.create(this, incoming, this._def);
   }
-};
-function processCreateParams(params) {
-  if (!params)
-    return {};
-  const { errorMap: errorMap2, invalid_type_error, required_error, description } = params;
-  if (errorMap2 && (invalid_type_error || required_error)) {
-    throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
+  transform(transform2) {
+    return new ZodEffects({
+      ...processCreateParams(this._def),
+      schema: this,
+      typeName: ZodFirstPartyTypeKind.ZodEffects,
+      effect: { type: "transform", transform: transform2 }
+    });
   }
-  if (errorMap2)
-    return { errorMap: errorMap2, description };
-  const customMap = (iss, ctx) => {
-    if (iss.code !== "invalid_type")
-      return { message: ctx.defaultError };
-    if (typeof ctx.data === "undefined") {
-      return { message: required_error !== null && required_error !== void 0 ? required_error : ctx.defaultError };
-    }
-    return { message: invalid_type_error !== null && invalid_type_error !== void 0 ? invalid_type_error : ctx.defaultError };
-  };
-  return { errorMap: customMap, description };
-}
-var ZodType = class {
-  constructor(def) {
-    this.spa = this.safeParseAsync;
-    this._def = def;
-    this.parse = this.parse.bind(this);
-    this.safeParse = this.safeParse.bind(this);
-    this.parseAsync = this.parseAsync.bind(this);
-    this.safeParseAsync = this.safeParseAsync.bind(this);
-    this.spa = this.spa.bind(this);
-    this.refine = this.refine.bind(this);
-    this.refinement = this.refinement.bind(this);
-    this.superRefine = this.superRefine.bind(this);
-    this.optional = this.optional.bind(this);
-    this.nullable = this.nullable.bind(this);
-    this.nullish = this.nullish.bind(this);
-    this.array = this.array.bind(this);
-    this.promise = this.promise.bind(this);
-    this.or = this.or.bind(this);
-    this.and = this.and.bind(this);
-    this.transform = this.transform.bind(this);
-    this.brand = this.brand.bind(this);
-    this.default = this.default.bind(this);
-    this.catch = this.catch.bind(this);
-    this.describe = this.describe.bind(this);
-    this.pipe = this.pipe.bind(this);
-    this.readonly = this.readonly.bind(this);
-    this.isNullable = this.isNullable.bind(this);
-    this.isOptional = this.isOptional.bind(this);
+  default(def) {
+    const defaultValueFunc = typeof def === "function" ? def : () => def;
+    return new ZodDefault({
+      ...processCreateParams(this._def),
+      innerType: this,
+      defaultValue: defaultValueFunc,
+      typeName: ZodFirstPartyTypeKind.ZodDefault
+    });
   }
-  get description() {
-    return this._def.description;
-  }
-  _getType(input) {
-    return getParsedType(input.data);
-  }
-  _getOrReturnCtx(input, ctx) {
-    return ctx || {
-      common: input.parent.common,
-      data: input.data,
-      parsedType: getParsedType(input.data),
-      schemaErrorMap: this._def.errorMap,
-      path: input.path,
-      parent: input.parent
-    };
-  }
-  _processInputParams(input) {
-    return {
-      status: new ParseStatus(),
-      ctx: {
-        common: input.parent.common,
-        data: input.data,
-        parsedType: getParsedType(input.data),
-        schemaErrorMap: this._def.errorMap,
-        path: input.path,
-        parent: input.parent
-      }
-    };
-  }
-  _parseSync(input) {
-    const result = this._parse(input);
-    if (isAsync(result)) {
-      throw new Error("Synchronous parse encountered promise.");
-    }
-    return result;
-  }
-  _parseAsync(input) {
-    const result = this._parse(input);
-    return Promise.resolve(result);
-  }
-  parse(data, params) {
-    const result = this.safeParse(data, params);
-    if (result.success)
-      return result.data;
-    throw result.error;
-  }
-  safeParse(data, params) {
-    var _a2;
-    const ctx = {
-      common: {
-        issues: [],
-        async: (_a2 = params === null || params === void 0 ? void 0 : params.async) !== null && _a2 !== void 0 ? _a2 : false,
-        contextualErrorMap: params === null || params === void 0 ? void 0 : params.errorMap
-      },
-      path: (params === null || params === void 0 ? void 0 : params.path) || [],
-      schemaErrorMap: this._def.errorMap,
-      parent: null,
-      data,
-      parsedType: getParsedType(data)
-    };
-    const result = this._parseSync({ data, path: ctx.path, parent: ctx });
-    return handleResult(ctx, result);
-  }
-  async parseAsync(data, params) {
-    const result = await this.safeParseAsync(data, params);
-    if (result.success)
-      return result.data;
-    throw result.error;
-  }
-  async safeParseAsync(data, params) {
-    const ctx = {
-      common: {
-        issues: [],
-        contextualErrorMap: params === null || params === void 0 ? void 0 : params.errorMap,
-        async: true
-      },
-      path: (params === null || params === void 0 ? void 0 : params.path) || [],
-      schemaErrorMap: this._def.errorMap,
-      parent: null,
-      data,
-      parsedType: getParsedType(data)
-    };
-    const maybeAsyncResult = this._parse({ data, path: ctx.path, parent: ctx });
-    const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
-    return handleResult(ctx, result);
-  }
-  refine(check2, message) {
-    const getIssueProperties = (val) => {
-      if (typeof message === "string" || typeof message === "undefined") {
-        return { message };
-      } else if (typeof message === "function") {
-        return message(val);
-      } else {
-        return message;
-      }
-    };
-    return this._refinement((val, ctx) => {
-      const result = check2(val);
-      const setError = () => ctx.addIssue({
-        code: ZodIssueCode.custom,
-        ...getIssueProperties(val)
-      });
-      if (typeof Promise !== "undefined" && result instanceof Promise) {
-        return result.then((data) => {
-          if (!data) {
-            setError();
-            return false;
-          } else {
-            return true;
-          }
-        });
-      }
-      if (!result) {
-        setError();
-        return false;
-      } else {
-        return true;
-      }
-    });
-  }
-  refinement(check2, refinementData) {
-    return this._refinement((val, ctx) => {
-      if (!check2(val)) {
-        ctx.addIssue(typeof refinementData === "function" ? refinementData(val, ctx) : refinementData);
-        return false;
-      } else {
-        return true;
-      }
-    });
-  }
-  _refinement(refinement) {
-    return new ZodEffects({
-      schema: this,
-      typeName: ZodFirstPartyTypeKind.ZodEffects,
-      effect: { type: "refinement", refinement }
-    });
-  }
-  superRefine(refinement) {
-    return this._refinement(refinement);
-  }
-  optional() {
-    return ZodOptional.create(this, this._def);
-  }
-  nullable() {
-    return ZodNullable.create(this, this._def);
-  }
-  nullish() {
-    return this.nullable().optional();
-  }
-  array() {
-    return ZodArray.create(this, this._def);
-  }
-  promise() {
-    return ZodPromise.create(this, this._def);
-  }
-  or(option) {
-    return ZodUnion.create([this, option], this._def);
-  }
-  and(incoming) {
-    return ZodIntersection.create(this, incoming, this._def);
-  }
-  transform(transform2) {
-    return new ZodEffects({
-      ...processCreateParams(this._def),
-      schema: this,
-      typeName: ZodFirstPartyTypeKind.ZodEffects,
-      effect: { type: "transform", transform: transform2 }
-    });
-  }
-  default(def) {
-    const defaultValueFunc = typeof def === "function" ? def : () => def;
-    return new ZodDefault({
-      ...processCreateParams(this._def),
-      innerType: this,
-      defaultValue: defaultValueFunc,
-      typeName: ZodFirstPartyTypeKind.ZodDefault
-    });
-  }
-  brand() {
-    return new ZodBranded({
-      typeName: ZodFirstPartyTypeKind.ZodBranded,
-      type: this,
-      ...processCreateParams(this._def)
-    });
+  brand() {
+    return new ZodBranded({
+      typeName: ZodFirstPartyTypeKind.ZodBranded,
+      type: this,
+      ...processCreateParams(this._def)
+    });
   }
   catch(def) {
     const catchValueFunc = typeof def === "function" ? def : () => def;
@@ -24464,7 +23781,7 @@ var VulnerabilityStatusValues = [
   "OPEN",
   "IN_PROGRESS",
   "FIXED",
-  "IGNORED",
+  "ARCHIVED",
   "FALSE_POSITIVE",
   "DISMISSED"
 ];
@@ -25226,7 +24543,7 @@ var PrVulnerabilitySummarySchema = external_exports.object({
   byStatus: external_exports.object({
     open: external_exports.number(),
     falsePositive: external_exports.number(),
-    acceptedRisk: external_exports.number(),
+    archived: external_exports.number(),
     fixed: external_exports.number()
   })
 });
@@ -25288,147 +24605,1116 @@ var FindingSchema = external_exports.object({
   updatedAt: external_exports.date()
 });
 
-// src/api-client.ts
-var readTokenSafe = readToken;
-var PRODUCTION_API_URL = "https://api.securewithtrace.com";
-var UNAUTHORIZED_STATUS = 401;
-function getApiBaseUrl() {
-  const raw = process.env["TRACE_API_URL"];
-  if (!raw) {
-    return PRODUCTION_API_URL;
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    console.error(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`);
-    return PRODUCTION_API_URL;
+// src/auth/device-flow.ts
+var WORKOS_DEVICE_AUTH_URL = "https://api.workos.com/user_management/authorize/device";
+var WORKOS_TOKEN_URL = "https://api.workos.com/user_management/authenticate";
+async function requestDeviceAuthorization(clientId) {
+  const response = await fetch(WORKOS_DEVICE_AUTH_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({ client_id: clientId })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Failed to request device authorization: ${response.status} ${text}`);
   }
-  if (parsed.protocol !== "https:") {
-    console.error("Invalid TRACE_API_URL: only https:// is allowed. Using default.");
-    return PRODUCTION_API_URL;
+  return await response.json();
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function pollForToken(clientId, deviceCode, options = {}) {
+  const expiresIn = options.expiresIn ?? 300;
+  let interval = options.interval ?? 5;
+  const deadline = Date.now() + expiresIn * 1e3;
+  while (Date.now() < deadline) {
+    const response = await fetch(WORKOS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: clientId
+      })
+    });
+    if (response.ok) {
+      return await response.json();
+    }
+    const data = await response.json();
+    switch (data.error) {
+      case "authorization_pending":
+        await sleep(interval * 1e3);
+        break;
+      case "slow_down":
+        interval += 1;
+        await sleep(interval * 1e3);
+        break;
+      case "access_denied":
+        throw new Error("Authorization was denied by the user.");
+      case "expired_token":
+        throw new Error("Device code has expired. Please try again.");
+      default:
+        throw new Error(
+          `Authorization failed: ${data.error}${data.error_description ? ` - ${data.error_description}` : ""}`
+        );
+    }
   }
-  const hostname3 = parsed.hostname;
-  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
+  throw new Error("Authorization timed out. Please try again.");
+}
+async function refreshAccessToken(clientId, refreshToken) {
+  const response = await fetch(WORKOS_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Failed to refresh token: ${response.status} ${text}`);
+  }
+  return await response.json();
+}
+
+// src/auth/token.ts
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var ACCESS_TOKEN_FILENAME = "token";
+var REFRESH_TOKEN_FILENAME = "refresh-token";
+var SELECTED_ORGANIZATION_FILENAME = "organization";
+function resolveTraceDir() {
+  const override = process.env["TRACE_CLI_AUTH_DIR"];
+  if (override && override.trim().length > 0) {
+    return override;
+  }
+  return join(homedir(), ".trace");
+}
+function ensureTraceDir() {
+  const traceDir = resolveTraceDir();
+  if (!existsSync(traceDir)) {
+    mkdirSync(traceDir, { recursive: true, mode: 448 });
+  }
+}
+function getTokenPath() {
+  return join(resolveTraceDir(), ACCESS_TOKEN_FILENAME);
+}
+function getRefreshTokenPath() {
+  return join(resolveTraceDir(), REFRESH_TOKEN_FILENAME);
+}
+function getSelectedOrganizationPath() {
+  return join(resolveTraceDir(), SELECTED_ORGANIZATION_FILENAME);
+}
+function readToken() {
+  const tokenPath = getTokenPath();
+  try {
+    if (!existsSync(tokenPath)) {
+      return null;
+    }
+    const token = readFileSync(tokenPath, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function readRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
+  try {
+    if (!existsSync(refreshTokenPath)) {
+      return null;
+    }
+    const token = readFileSync(refreshTokenPath, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function readSelectedOrganizationId() {
+  const organizationPath = getSelectedOrganizationPath();
+  try {
+    if (!existsSync(organizationPath)) {
+      return null;
+    }
+    const organizationId = readFileSync(organizationPath, "utf-8").trim();
+    return organizationId || null;
+  } catch {
+    return null;
+  }
+}
+function writeToken(token) {
+  ensureTraceDir();
+  writeFileSync(getTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeRefreshToken(token) {
+  ensureTraceDir();
+  writeFileSync(getRefreshTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeSelectedOrganizationId(organizationId) {
+  ensureTraceDir();
+  writeFileSync(getSelectedOrganizationPath(), organizationId, { encoding: "utf-8", mode: 384 });
+}
+function writeTokens(accessToken, refreshToken) {
+  writeToken(accessToken);
+  if (refreshToken && refreshToken.trim().length > 0) {
+    writeRefreshToken(refreshToken);
+    return;
+  }
+  removeRefreshToken();
+}
+function removeRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
+  if (!existsSync(refreshTokenPath)) {
+    return false;
+  }
+  rmSync(refreshTokenPath);
+  return true;
+}
+function removeSelectedOrganizationId() {
+  const organizationPath = getSelectedOrganizationPath();
+  if (!existsSync(organizationPath)) {
+    return false;
+  }
+  rmSync(organizationPath);
+  return true;
+}
+function removeToken() {
+  let removed = false;
+  const tokenPath = getTokenPath();
+  if (existsSync(tokenPath)) {
+    rmSync(tokenPath);
+    removed = true;
+  }
+  if (removeRefreshToken()) {
+    removed = true;
+  }
+  if (removeSelectedOrganizationId()) {
+    removed = true;
+  }
+  return removed;
+}
+
+// src/api-client.ts
+var readTokenSafe = readToken;
+var PRODUCTION_API_URL = "https://api.securewithtrace.com";
+var UNAUTHORIZED_STATUS = 401;
+function getApiBaseUrl() {
+  const raw = process.env["TRACE_API_URL"];
+  if (!raw) {
+    return PRODUCTION_API_URL;
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`);
+    return PRODUCTION_API_URL;
+  }
+  if (parsed.protocol !== "https:") {
+    console.error("Invalid TRACE_API_URL: only https:// is allowed. Using default.");
+    return PRODUCTION_API_URL;
+  }
+  const hostname3 = parsed.hostname;
+  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
     console.error(
       "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
     );
     return PRODUCTION_API_URL;
   }
-  return raw.replace(/\/+$/, "");
+  return raw.replace(/\/+$/, "");
+}
+function createClient(token) {
+  return initClient(v1Contract, {
+    baseUrl: getApiBaseUrl(),
+    baseHeaders: {
+      Authorization: `Bearer ${token}`
+    }
+  });
+}
+function getWorkosClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (!clientId || clientId.trim().length === 0) {
+    return null;
+  }
+  return clientId;
+}
+async function refreshStoredAccessToken() {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return null;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return tokenResponse.access_token;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return null;
+  }
+}
+async function authenticatedRequest(request) {
+  const token = readToken();
+  if (!token) {
+    console.error("Not logged in. Run `tracecli auth login` first.");
+    process.exit(1);
+  }
+  const firstResult = await request(createClient(token));
+  if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    return firstResult;
+  }
+  const refreshedToken = await refreshStoredAccessToken();
+  if (!refreshedToken) {
+    return firstResult;
+  }
+  return request(createClient(refreshedToken));
+}
+async function authenticatedRequestSafe(request) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const firstResult = await request(createClient(token));
+    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+      return firstResult;
+    }
+    const refreshedToken = await refreshStoredAccessToken();
+    if (!refreshedToken) {
+      return firstResult;
+    }
+    return await request(createClient(refreshedToken));
+  } catch {
+    return null;
+  }
+}
+var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+function determineActiveOrganization(organizations, selectedOrganizationId) {
+  if (organizations.length === 0) {
+    return null;
+  }
+  if (selectedOrganizationId && SAFE_ID_PATTERN.test(selectedOrganizationId)) {
+    const selectedOrganization = organizations.find(
+      (organization) => organization.organizationId === selectedOrganizationId
+    );
+    if (selectedOrganization) {
+      return {
+        organization: selectedOrganization,
+        source: "selected",
+        staleSelectionDetected: false
+      };
+    }
+  }
+  const [fallbackOrganization] = organizations;
+  if (!fallbackOrganization) {
+    return null;
+  }
+  return {
+    organization: fallbackOrganization,
+    source: "default",
+    staleSelectionDetected: selectedOrganizationId != null
+  };
+}
+async function resolveOrganizationId(client) {
+  const result = client ? await client.organization.listOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to resolve organization (status ${result.status}).`);
+    process.exit(1);
+  }
+  const organizations = result.body;
+  const selectedOrganizationId = readSelectedOrganizationId();
+  const activeOrganization = determineActiveOrganization(organizations, selectedOrganizationId);
+  if (!activeOrganization) {
+    console.error("No organization found for your account.");
+    process.exit(1);
+  }
+  const id = activeOrganization.organization.organizationId;
+  if (!SAFE_ID_PATTERN.test(id)) {
+    console.error("Invalid organization ID received from API.");
+    process.exit(1);
+  }
+  if (activeOrganization.staleSelectionDetected) {
+    removeSelectedOrganizationId();
+    writeSelectedOrganizationId(id);
+    if (selectedOrganizationId) {
+      console.warn(
+        `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
+      );
+    }
+  } else if (activeOrganization.source === "default") {
+    writeSelectedOrganizationId(id);
+  }
+  return id;
+}
+async function resolveOrganizationIdSafe(client) {
+  try {
+    const result = client ? await client.organization.listOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+    );
+    if (!result) {
+      return null;
+    }
+    if (result.status !== 200) {
+      return null;
+    }
+    const organizations = result.body;
+    const selectedOrganizationId = readSelectedOrganizationId();
+    const activeOrganization = determineActiveOrganization(organizations, selectedOrganizationId);
+    if (!activeOrganization) {
+      return null;
+    }
+    const id = activeOrganization.organization.organizationId;
+    if (!SAFE_ID_PATTERN.test(id)) {
+      return null;
+    }
+    if (activeOrganization.staleSelectionDetected) {
+      removeSelectedOrganizationId();
+      writeSelectedOrganizationId(id);
+    } else if (activeOrganization.source === "default") {
+      writeSelectedOrganizationId(id);
+    }
+    return id;
+  } catch {
+    return null;
+  }
+}
+
+// src/auth/commands.ts
+function getClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (clientId) {
+    return clientId;
+  }
+  throw new Error(
+    "TRACE_WORKOS_CLIENT_ID is not set. Build the CLI with TRACE_WORKOS_CLIENT_ID set, or provide it as an environment variable."
+  );
+}
+async function openBrowser(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "https:") {
+      return false;
+    }
+    const proc = Bun.spawn(["open", url2], {
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      const linuxProc = Bun.spawn(["xdg-open", url2], {
+        stdout: "ignore",
+        stderr: "ignore"
+      });
+      return await linuxProc.exited === 0;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+var SAFE_ORGANIZATION_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+function sanitizeForOutput(value) {
+  return value.replace(/[\r\n\t]/g, " ").trim();
+}
+function normalizeForComparison(value) {
+  return value.trim().toLowerCase();
+}
+function planOrganizationSelectionPersistence(args) {
+  if (args.staleSelectionDetected) {
+    return {
+      effectiveSelectedOrganizationId: args.activeOrganizationId,
+      shouldWriteSelection: true,
+      shouldRemoveStaleSelection: true
+    };
+  }
+  if (args.activeSource === "default") {
+    return {
+      effectiveSelectedOrganizationId: args.activeOrganizationId,
+      shouldWriteSelection: true,
+      shouldRemoveStaleSelection: false
+    };
+  }
+  return {
+    effectiveSelectedOrganizationId: args.activeOrganizationId,
+    shouldWriteSelection: false,
+    shouldRemoveStaleSelection: false
+  };
+}
+function isSafeOrganizationId(organizationId) {
+  return SAFE_ORGANIZATION_ID_PATTERN.test(organizationId);
+}
+async function fetchOrganizationContext() {
+  const result = await authenticatedRequest((client) => client.organization.listOrganizations());
+  if (result.status !== 200) {
+    console.error(`Failed to list organizations (status ${result.status}).`);
+    process.exit(1);
+  }
+  const organizations = result.body;
+  const selectedOrganizationId = readSelectedOrganizationId();
+  const active = determineActiveOrganization(organizations, selectedOrganizationId);
+  if (!active) {
+    console.error("No organizations found for your account.");
+    process.exit(1);
+  }
+  const persistencePlan = planOrganizationSelectionPersistence({
+    activeOrganizationId: active.organization.organizationId,
+    activeSource: active.source,
+    staleSelectionDetected: active.staleSelectionDetected
+  });
+  if (persistencePlan.shouldRemoveStaleSelection) {
+    removeSelectedOrganizationId();
+  }
+  if (persistencePlan.shouldWriteSelection) {
+    writeSelectedOrganizationId(persistencePlan.effectiveSelectedOrganizationId);
+    if (selectedOrganizationId) {
+      console.warn(
+        `Stored organization '${selectedOrganizationId}' is unavailable. Using '${active.organization.name}' (${active.organization.organizationId}) instead.`
+      );
+    }
+  }
+  return {
+    organizations,
+    activeOrganization: active.organization,
+    selectedOrganizationId: persistencePlan.effectiveSelectedOrganizationId,
+    staleSelectionDetected: active.staleSelectionDetected
+  };
+}
+function findOrganizationByInput(organizations, input) {
+  const normalizedInput = normalizeForComparison(input);
+  if (normalizedInput.length === 0) {
+    return { error: "Organization identifier cannot be empty." };
+  }
+  const byId = organizations.find(
+    (organization) => normalizeForComparison(organization.organizationId) === normalizedInput
+  );
+  if (byId) {
+    return { organization: byId };
+  }
+  const bySlug = organizations.find(
+    (organization) => normalizeForComparison(organization.slug) === normalizedInput
+  );
+  if (bySlug) {
+    return { organization: bySlug };
+  }
+  const exactNameMatches = organizations.filter(
+    (organization) => normalizeForComparison(organization.name) === normalizedInput
+  );
+  if (exactNameMatches.length === 1 && exactNameMatches[0]) {
+    return { organization: exactNameMatches[0] };
+  }
+  if (exactNameMatches.length > 1) {
+    return {
+      error: `Multiple organizations have the exact name '${input}'. Use an organization ID or slug instead.`
+    };
+  }
+  const partialMatches = organizations.filter((organization) => {
+    const normalizedName = normalizeForComparison(organization.name);
+    const normalizedSlug = normalizeForComparison(organization.slug);
+    return normalizedName.includes(normalizedInput) || normalizedSlug.includes(normalizedInput);
+  });
+  if (partialMatches.length === 1 && partialMatches[0]) {
+    return { organization: partialMatches[0] };
+  }
+  if (partialMatches.length > 1) {
+    const hints = partialMatches.map((organization) => `  - ${organization.name} (${organization.slug})`).join("\n");
+    return {
+      error: `Organization '${input}' is ambiguous. Multiple matches found:
+${hints}
+Use an organization ID or exact slug.`
+    };
+  }
+  return {
+    error: `Organization '${input}' not found. Run \`tracecli auth org list\` to see available organizations.`
+  };
+}
+function createLoginCommand() {
+  return new Command("login").description("Authenticate with Trace").action(async () => {
+    const existingToken = readToken();
+    if (existingToken) {
+      console.log("You are already logged in. Run `trace auth logout` first to re-authenticate.");
+      return;
+    }
+    const clientId = getClientId();
+    console.log("Initiating device authorization...\n");
+    const auth = await requestDeviceAuthorization(clientId);
+    console.log("Your one-time code is:\n");
+    console.log(`  ${auth.user_code}
+`);
+    console.log(`Open this URL in your browser: ${auth.verification_uri}`);
+    console.log("");
+    const opened = await openBrowser(auth.verification_uri_complete);
+    if (opened) {
+      console.log("A browser window has been opened for you.");
+    } else {
+      console.log(`Or visit: ${auth.verification_uri_complete}`);
+    }
+    console.log("\nWaiting for authorization...");
+    const tokenResponse = await pollForToken(clientId, auth.device_code, {
+      expiresIn: auth.expires_in,
+      interval: auth.interval
+    });
+    writeTokens(tokenResponse.access_token, tokenResponse.refresh_token);
+    const name = [tokenResponse.user.first_name, tokenResponse.user.last_name].filter(Boolean).join(" ");
+    const displayName = name || tokenResponse.user.email;
+    console.log(`
+Authenticated as ${displayName} (${tokenResponse.user.email})`);
+    console.log("Tokens saved to ~/.trace");
+  });
+}
+function createLogoutCommand() {
+  return new Command("logout").description("Log out of Trace").action(() => {
+    const removed = removeToken();
+    if (removed) {
+      console.log("Logged out successfully. Local session data removed from ~/.trace/");
+    } else {
+      console.log("No active session found.");
+    }
+  });
+}
+function createStatusCommand() {
+  return new Command("status").description("Show current authentication status").action(() => {
+    const token = readToken();
+    const refreshToken = readRefreshToken();
+    const selectedOrganizationId = readSelectedOrganizationId();
+    if (token) {
+      try {
+        const parts = token.split(".");
+        const payload = parts[1];
+        if (payload) {
+          const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+          const expiry = decoded.exp ? new Date(decoded.exp * 1e3) : null;
+          const isExpired = expiry ? expiry < /* @__PURE__ */ new Date() : false;
+          console.log("Logged in to Trace");
+          if (decoded.sub) {
+            console.log(`  User ID: ${decoded.sub}`);
+          }
+          if (decoded.org_id) {
+            console.log(`  Org ID:  ${decoded.org_id}`);
+          }
+          if (selectedOrganizationId) {
+            console.log(`  Active Org (CLI): ${selectedOrganizationId}`);
+          }
+          if (expiry) {
+            console.log(`  Expires: ${expiry.toISOString()}${isExpired ? " (EXPIRED)" : ""}`);
+          }
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
+          if (isExpired) {
+            if (refreshToken) {
+              console.log(
+                "\nYour access token is expired, but a refresh token is available and will be used automatically."
+              );
+            } else {
+              console.log(
+                "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
+              );
+            }
+          }
+        } else {
+          console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+          if (selectedOrganizationId) {
+            console.log(`  Active Org (CLI): ${selectedOrganizationId}`);
+          }
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
+        }
+      } catch {
+        console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+        if (selectedOrganizationId) {
+          console.log(`  Active Org (CLI): ${selectedOrganizationId}`);
+        }
+        console.log(
+          `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+        );
+      }
+    } else {
+      console.log("Not logged in. Run `trace auth login` to authenticate.");
+    }
+  });
+}
+function createOrgListCommand() {
+  return new Command("list").description("List organizations available to your account").option("--json", "Output as JSON").action(async (options) => {
+    const organizationContext = await fetchOrganizationContext();
+    const items = organizationContext.organizations.map(
+      (organization) => ({
+        ...organization,
+        active: organization.organizationId === organizationContext.activeOrganization.organizationId,
+        selected: organization.organizationId === organizationContext.selectedOrganizationId
+      })
+    );
+    if (options.json) {
+      console.log(JSON.stringify(items, null, 2));
+      return;
+    }
+    for (const item of items) {
+      const marker = item.active ? "*" : " ";
+      const labels = [item.active ? "active" : null, item.selected ? "selected" : null].filter(
+        Boolean
+      );
+      const suffix = labels.length > 0 ? ` [${labels.join(", ")}]` : "";
+      console.log(
+        `${marker} ${sanitizeForOutput(item.name)} (${sanitizeForOutput(item.slug)}) - ${item.organizationId}${suffix}`
+      );
+    }
+    if (organizationContext.staleSelectionDetected) {
+      console.log("\nYour previous organization selection is no longer available and was reset.");
+    }
+  });
+}
+function createOrgCurrentCommand() {
+  return new Command("current").description("Show the active organization used by CLI commands").option("--json", "Output as JSON").action(async (options) => {
+    const organizationContext = await fetchOrganizationContext();
+    const active = organizationContext.activeOrganization;
+    const source = organizationContext.selectedOrganizationId === active.organizationId ? "selected" : "default";
+    if (options.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ...active,
+            source
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    console.log(
+      `Active organization: ${sanitizeForOutput(active.name)} (${sanitizeForOutput(active.slug)})`
+    );
+    console.log(`  Org ID: ${active.organizationId}`);
+    console.log(`  Source: ${source}`);
+  });
+}
+function createOrgSwitchCommand() {
+  return new Command("switch").description("Switch the active organization for subsequent CLI commands").argument("<organization>", "Organization ID, slug, or name").action(async (organization) => {
+    const organizationContext = await fetchOrganizationContext();
+    const match = findOrganizationByInput(organizationContext.organizations, organization);
+    if ("error" in match) {
+      console.error(match.error);
+      process.exit(1);
+    }
+    if (!isSafeOrganizationId(match.organization.organizationId)) {
+      console.error(
+        `Cannot switch to organization '${match.organization.organizationId}': invalid organization ID format.`
+      );
+      process.exit(1);
+    }
+    writeSelectedOrganizationId(match.organization.organizationId);
+    console.log(
+      `Active organization set to ${sanitizeForOutput(match.organization.name)} (${sanitizeForOutput(match.organization.slug)})`
+    );
+    console.log(`  Org ID: ${match.organization.organizationId}`);
+  });
+}
+function createOrgCommand() {
+  const org = new Command("org").description("Manage active organization context");
+  org.addCommand(createOrgListCommand());
+  org.addCommand(createOrgCurrentCommand());
+  org.addCommand(createOrgSwitchCommand());
+  return org;
+}
+function createAuthCommand() {
+  const auth = new Command("auth").description("Manage authentication");
+  auth.addCommand(createLoginCommand());
+  auth.addCommand(createLogoutCommand());
+  auth.addCommand(createStatusCommand());
+  auth.addCommand(createOrgCommand());
+  return auth;
+}
+
+// src/banner.ts
+var ESC = "\x1B";
+var RESET = `${ESC}[0m`;
+var CYAN_BOLD = `${ESC}[1;36m`;
+var DIM = `${ESC}[2m`;
+var BANNER = `
+ \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
+ \u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D
+    \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2557  
+    \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2554\u2550\u2550\u255D  
+    \u2588\u2588\u2551   \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
+    \u255A\u2550\u255D   \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`;
+function showBanner() {
+  console.log(`${CYAN_BOLD}${BANNER}${RESET}`);
+  console.log(`${DIM}  Continuous security vulnerability intelligence${RESET}
+`);
+}
+
+// src/completion/index.ts
+function extractCommandTree(cmd) {
+  const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
+  const options = cmd.options.filter((o) => !o.hidden).filter((o) => !BUILTIN_FLAGS.has(o.long ?? "") && !BUILTIN_FLAGS.has(o.short ?? "")).map((o) => ({
+    flags: o.flags,
+    long: o.long ?? "",
+    short: o.short ?? null,
+    description: o.description,
+    takesValue: o.required || o.optional
+  }));
+  const subcommands = cmd.commands.filter((c25) => !c25._hidden).map((c25) => extractCommandTree(c25));
+  return {
+    name: cmd.name(),
+    description: cmd.description(),
+    options,
+    subcommands
+  };
+}
+function escapeForShell(s) {
+  return s.replace(/'/g, "'\\''");
+}
+function generateBashCompletion(tree, binName) {
+  const lines = [];
+  lines.push("#!/usr/bin/env bash");
+  lines.push(`# Bash completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell bash`);
+  lines.push("#");
+  lines.push("# To enable, add to your ~/.bashrc:");
+  lines.push(`#   eval "$(${binName} completion --shell bash)"`);
+  lines.push("");
+  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}_completions`;
+  lines.push(`${funcName}() {`);
+  lines.push("  local cur prev words cword");
+  lines.push("  _get_comp_words_by_ref -n : cur prev words cword 2>/dev/null || {");
+  lines.push(`    cur="\${COMP_WORDS[COMP_CWORD]}"`);
+  lines.push(`    prev="\${COMP_WORDS[COMP_CWORD-1]}"`);
+  lines.push(`    words=("\${COMP_WORDS[@]}")`);
+  lines.push(`    cword="\${COMP_CWORD}"`);
+  lines.push("  }");
+  lines.push("");
+  lines.push("  # Build the command chain (skip the binary name at index 0)");
+  lines.push(`  local cmd_chain=""`);
+  lines.push("  local i");
+  lines.push("  for (( i=1; i<cword; i++ )); do");
+  lines.push(`    case "\${words[i]}" in`);
+  lines.push("      -*) ;; # skip options");
+  lines.push(`      *) cmd_chain="\${cmd_chain} \${words[i]}" ;;`);
+  lines.push("    esac");
+  lines.push("  done");
+  lines.push(`  cmd_chain="\${cmd_chain## }" # trim leading space`);
+  lines.push("");
+  const cases = collectBashCases(tree, "");
+  lines.push(`  local completions=""`);
+  lines.push(`  case "\${cmd_chain}" in`);
+  for (const [path, { subcommands, options }] of cases) {
+    const pattern = path === "" ? `''` : `'${escapeForShell(path)}'`;
+    const all = [...subcommands, ...options];
+    lines.push(`    ${pattern})`);
+    lines.push(`      completions="${all.join(" ")}"`);
+    lines.push("      ;;");
+  }
+  lines.push("    *)");
+  lines.push(`      completions=""`);
+  lines.push("      ;;");
+  lines.push("  esac");
+  lines.push("");
+  lines.push(`  COMPREPLY=( $(compgen -W "\${completions}" -- "\${cur}") )`);
+  lines.push("  return 0");
+  lines.push("}");
+  lines.push("");
+  lines.push(`complete -o default -F ${funcName} ${binName}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function collectBashCases(tree, prefix) {
+  const cases = /* @__PURE__ */ new Map();
+  const subcommandNames = tree.subcommands.map((c25) => c25.name);
+  const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
+  const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
+  const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
+  cases.set(prefix, { subcommands: subcommandNames, options: allOptions });
+  for (const sub of tree.subcommands) {
+    const subPath = prefix ? `${prefix} ${sub.name}` : sub.name;
+    const subCases = collectBashCases(sub, subPath);
+    for (const [k, v] of subCases) {
+      cases.set(k, v);
+    }
+  }
+  return cases;
+}
+function generateZshCompletion(tree, binName) {
+  const lines = [];
+  lines.push(`#compdef ${binName}`);
+  lines.push(`# Zsh completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell zsh`);
+  lines.push("#");
+  lines.push("# To enable, add to your ~/.zshrc:");
+  lines.push(`#   eval "$(${binName} completion --shell zsh)"`);
+  lines.push("");
+  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}`;
+  lines.push(`${funcName}() {`);
+  lines.push("  local -a commands");
+  lines.push("  local line state");
+  lines.push("");
+  generateZshCommandBlock(tree, lines, "  ", binName, true);
+  lines.push("}");
+  lines.push("");
+  generateZshSubFunctions(tree, lines, binName);
+  lines.push(`compdef ${funcName} ${binName}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function generateZshCommandBlock(tree, lines, indent, _binName, isRoot) {
+  if (tree.subcommands.length > 0) {
+    lines.push(`${indent}_arguments -C \\`);
+    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
+    if (isRoot) {
+      lines.push(`${indent}  '(-V --version)'{-V,--version}'[Show version]' \\`);
+    }
+    for (const opt of tree.options) {
+      const desc = escapeForShell(opt.description);
+      if (opt.takesValue) {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
+        }
+      } else {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
+        }
+      }
+    }
+    lines.push(`${indent}  '1: :->command' \\`);
+    lines.push(`${indent}  '*::arg:->args'`);
+    lines.push("");
+    lines.push(`${indent}case "$state" in`);
+    lines.push(`${indent}  command)`);
+    lines.push(`${indent}    commands=(`);
+    for (const sub of tree.subcommands) {
+      const desc = escapeForShell(sub.description);
+      lines.push(`${indent}      '${sub.name}:${desc}'`);
+    }
+    lines.push(`${indent}    )`);
+    lines.push(`${indent}    _describe 'command' commands`);
+    lines.push(`${indent}    ;;`);
+    lines.push(`${indent}  args)`);
+    lines.push(`${indent}    case "$line[1]" in`);
+    for (const sub of tree.subcommands) {
+      const subFunc = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
+      lines.push(`${indent}      ${sub.name}) ${subFunc} ;;`);
+    }
+    lines.push(`${indent}    esac`);
+    lines.push(`${indent}    ;;`);
+    lines.push(`${indent}esac`);
+  } else {
+    lines.push(`${indent}_arguments \\`);
+    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
+    for (const opt of tree.options) {
+      const desc = escapeForShell(opt.description);
+      if (opt.takesValue) {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
+        }
+      } else {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
+        }
+      }
+    }
+    lines.push(`${indent}  '*:file:_files'`);
+  }
 }
-function createClient(token) {
-  return initClient(v1Contract, {
-    baseUrl: getApiBaseUrl(),
-    baseHeaders: {
-      Authorization: `Bearer ${token}`
+function generateZshSubFunctions(tree, lines, binName) {
+  for (const sub of tree.subcommands) {
+    const funcName = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
+    lines.push(`${funcName}() {`);
+    generateZshCommandBlock(sub, lines, "  ", binName, false);
+    lines.push("}");
+    lines.push("");
+    if (sub.subcommands.length > 0) {
+      generateZshSubFunctions(sub, lines, binName);
     }
-  });
-}
-function getWorkosClientId() {
-  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
-  if (!clientId || clientId.trim().length === 0) {
-    return null;
   }
-  return clientId;
 }
-async function refreshStoredAccessToken() {
-  const clientId = getWorkosClientId();
-  const refreshToken = readRefreshToken();
-  if (!clientId || !refreshToken) {
-    return null;
+function generateFishCompletion(tree, binName) {
+  const lines = [];
+  lines.push(`# Fish completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell fish`);
+  lines.push("#");
+  lines.push(`# To enable, add to your ~/.config/fish/completions/${binName}.fish:`);
+  lines.push(`#   ${binName} completion --shell fish | source`);
+  lines.push("");
+  lines.push(`complete -c ${binName} -f`);
+  lines.push("");
+  generateFishCommands(tree, lines, binName, []);
+  lines.push("");
+  return lines.join("\n");
+}
+function generateFishCommands(tree, lines, binName, parentPath) {
+  const condition = buildFishCondition(binName, parentPath);
+  for (const sub of tree.subcommands) {
+    const desc = sub.description.replace(/'/g, "\\'");
+    lines.push(`complete -c ${binName} ${condition} -a '${sub.name}' -d '${desc}'`);
   }
-  try {
-    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
-    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
-    writeTokens(tokenResponse.access_token, nextRefreshToken);
-    return tokenResponse.access_token;
-  } catch (error48) {
-    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
-      removeToken();
+  for (const opt of tree.options) {
+    const desc = opt.description.replace(/'/g, "\\'");
+    const longFlag = opt.long.replace(/^--/, "");
+    const parts = [`complete -c ${binName} ${condition}`];
+    if (opt.short) {
+      parts.push(`-s '${opt.short.replace(/^-/, "")}'`);
     }
-    return null;
+    parts.push(`-l '${longFlag}'`);
+    parts.push(`-d '${desc}'`);
+    if (opt.takesValue) {
+      parts.push("-r");
+    }
+    lines.push(parts.join(" "));
+  }
+  for (const sub of tree.subcommands) {
+    const subPath = [...parentPath, sub.name];
+    generateFishCommands(sub, lines, binName, subPath);
   }
 }
-async function authenticatedRequest(request) {
-  const token = readToken();
-  if (!token) {
-    console.error("Not logged in. Run `tracecli auth login` first.");
-    process.exit(1);
+function buildFishCondition(binName, parentPath) {
+  if (parentPath.length === 0) {
+    return `-n '__fish_use_subcommand'`;
   }
-  const firstResult = await request(createClient(token));
-  if (firstResult.status !== UNAUTHORIZED_STATUS) {
-    return firstResult;
+  if (parentPath.length === 1) {
+    return `-n '__fish_seen_subcommand_from ${parentPath[0]}'`;
   }
-  const refreshedToken = await refreshStoredAccessToken();
-  if (!refreshedToken) {
-    return firstResult;
+  const conditions = parentPath.map((p) => `__fish_seen_subcommand_from ${p}`);
+  return `-n '${conditions.join("; and ")}'`;
+}
+function generateCompletion(program3, shell, binName) {
+  const name = binName ?? program3.name();
+  const tree = extractCommandTree(program3);
+  switch (shell) {
+    case "bash":
+      return generateBashCompletion(tree, name);
+    case "zsh":
+      return generateZshCompletion(tree, name);
+    case "fish":
+      return generateFishCompletion(tree, name);
   }
-  return request(createClient(refreshedToken));
 }
-async function authenticatedRequestSafe(request) {
-  const token = readTokenSafe();
-  if (!token) {
-    return null;
+
+// src/completion/install.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var TRACE_DIR = ".trace";
+function completionFileName(shell) {
+  switch (shell) {
+    case "bash":
+      return "tracecli-completion.bash";
+    case "zsh":
+      return "_tracecli";
+    case "fish":
+      return "tracecli-completion.fish";
   }
-  try {
-    const firstResult = await request(createClient(token));
-    if (firstResult.status !== UNAUTHORIZED_STATUS) {
-      return firstResult;
-    }
-    const refreshedToken = await refreshStoredAccessToken();
-    if (!refreshedToken) {
-      return firstResult;
-    }
-    return await request(createClient(refreshedToken));
-  } catch {
-    return null;
+}
+function getTraceDir() {
+  return join2(homedir2(), TRACE_DIR);
+}
+function getCompletionFilePath(shell) {
+  return join2(getTraceDir(), completionFileName(shell));
+}
+function writeCompletionFile(shell, script) {
+  const dir = getTraceDir();
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
+  const filePath = getCompletionFilePath(shell);
+  writeFileSync2(filePath, script, "utf-8");
+  return filePath;
 }
-var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
-async function resolveOrganizationId(client) {
-  const result = client ? await client.organization.listOrganizations() : await authenticatedRequest(
-    (authenticatedClient) => authenticatedClient.organization.listOrganizations()
-  );
-  if (result.status !== 200) {
-    console.error(`Failed to resolve organization (status ${result.status}).`);
-    process.exit(1);
+function getSetupInstructions(shell) {
+  const traceDir = `~/${TRACE_DIR}`;
+  switch (shell) {
+    case "bash":
+      return [
+        "Add the following line to your .bashrc file:",
+        "",
+        "  # The next line enables shell command completion for Trace",
+        `  source ${traceDir}/tracecli-completion.bash`,
+        ""
+      ].join("\n");
+    case "zsh":
+      return [
+        "Add the following lines to your .zshrc file:",
+        "",
+        "  # The next lines enable shell command completion for Trace",
+        `  fpath=(${traceDir} $fpath)`,
+        "  autoload -Uz compinit && compinit -i",
+        ""
+      ].join("\n");
+    case "fish":
+      return [
+        "Copy the completion file to your fish completions directory:",
+        "",
+        `  cp ${traceDir}/tracecli-completion.fish ~/.config/fish/completions/tracecli.fish`,
+        ""
+      ].join("\n");
   }
-  const org = result.body[0];
-  if (!org) {
-    console.error("No organization found for your account.");
-    process.exit(1);
+}
+
+// src/completion/commands.ts
+var SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
+function detectShell() {
+  const shellEnv = process.env["SHELL"] ?? "";
+  if (shellEnv.endsWith("/bash") || shellEnv.endsWith("/bash.exe")) {
+    return "bash";
   }
-  const id = org.organizationId;
-  if (!SAFE_ID_PATTERN.test(id)) {
-    console.error("Invalid organization ID received from API.");
-    process.exit(1);
+  if (shellEnv.endsWith("/zsh")) {
+    return "zsh";
   }
-  return id;
+  if (shellEnv.endsWith("/fish")) {
+    return "fish";
+  }
+  return null;
 }
-async function resolveOrganizationIdSafe(client) {
-  try {
-    const result = client ? await client.organization.listOrganizations() : await authenticatedRequestSafe(
-      (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+function resolveShell(shellOption) {
+  const shell = shellOption ?? detectShell();
+  if (!shell) {
+    console.error(
+      `Could not detect shell. Please specify one with --shell <${SUPPORTED_SHELLS.join("|")}>.`
     );
-    if (!result) {
-      return null;
-    }
-    if (result.status !== 200) {
-      return null;
-    }
-    const org = result.body[0];
-    if (!org) {
-      return null;
-    }
-    const id = org.organizationId;
-    if (!SAFE_ID_PATTERN.test(id)) {
-      return null;
-    }
-    return id;
-  } catch {
-    return null;
+    process.exit(1);
+  }
+  if (!SUPPORTED_SHELLS.includes(shell)) {
+    console.error(
+      `Unsupported shell: '${shell}'. Supported shells: ${SUPPORTED_SHELLS.join(", ")}.`
+    );
+    process.exit(1);
   }
+  return shell;
+}
+function createCompletionCommand(program3) {
+  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).action((options) => {
+    const shell = resolveShell(options.shell);
+    const script = generateCompletion(program3, shell);
+    const writtenPath = writeCompletionFile(shell, script);
+    console.log(`Completion file written to ${writtenPath}`);
+    console.log("");
+    console.log(getSetupInstructions(shell));
+  });
 }
 
 // src/format.ts
@@ -25979,7 +26265,10 @@ function addRepositoryFilterOptions(command) {
 async function runRepositoryListCommand(options) {
   const organizationId = await resolveOrganizationId();
   if (options.dependency) {
-    await runDependencyFilter(organizationId, options);
+    await runDependencyFilter(organizationId, {
+      ...options,
+      dependency: options.dependency
+    });
     return;
   }
   let filteredRepositories;
@@ -26019,7 +26308,11 @@ async function runRepositoryListCommand(options) {
   }
 }
 async function runDependencyFilter(organizationId, options) {
-  const { name, version: version2 } = parseDependencyFilter(options.dependency);
+  const dependency = options.dependency;
+  if (!dependency) {
+    throw new Error("Dependency filter is required.");
+  }
+  const { name, version: version2 } = parseDependencyFilter(dependency);
   const result = await authenticatedRequest(
     (client) => client.dependency.searchDependencies({
       params: { organizationId },
@@ -26308,7 +26601,7 @@ function createListCommand3() {
     (value) => value.toUpperCase()
   ).option(
     "--status <status>",
-    "Filter by status (OPEN, IN_PROGRESS, FIXED, IGNORED, FALSE_POSITIVE)",
+    "Filter by status (OPEN, IN_PROGRESS, FIXED, ARCHIVED, FALSE_POSITIVE)",
     (value) => value.toUpperCase()
   ).option(
     "-L, --limit <n>",