securewithtrace 0.32.0 → 0.33.0

package/dist/index.js

@@ -10176,7 +10176,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c49) => c49 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c51) => c51 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -20220,9 +20220,9 @@ var ZodDate2 = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c49 = inst._zod.bag;
-  inst.minDate = c49.minimum ? new Date(c49.minimum) : null;
-  inst.maxDate = c49.maximum ? new Date(c49.maximum) : null;
+  const c51 = inst._zod.bag;
+  inst.minDate = c51.minimum ? new Date(c51.minimum) : null;
+  inst.maxDate = c51.maximum ? new Date(c51.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate2, params);
@@ -21911,7 +21911,8 @@ var OperatorPentestContextSchema = external_exports.object({
   environments: external_exports.array(
     external_exports.object({
       name: external_exports.string(),
-      primaryUrl: external_exports.string(),
+      // Null for repo-only application types (CLI, MOBILE, DESKTOP).
+      primaryUrl: external_exports.string().nullable(),
       isProduction: external_exports.boolean()
     })
   ),
@@ -22365,27 +22366,12 @@ var ApplicationRepositoryRoleValues = [
   "MOBILE_CLIENT",
   "OTHER"
 ];
-var ScopeDomainSourceValues = ["DERIVED", "MANUAL"];
 var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
   applicationId: external_exports.uuid()
 });
 var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
   applicationRepositoryId: external_exports.uuid()
 });
-var AuthorizedDomainIdParamsSchema = ApplicationIdParamsSchema.extend({
-  applicationAuthorizedDomainId: external_exports.uuid()
-});
-var AuthorizedDomainResponseSchema = external_exports.object({
-  applicationAuthorizedDomainId: external_exports.uuid(),
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  domain: external_exports.string(),
-  source: external_exports.enum(ScopeDomainSourceValues),
-  createdAt: external_exports.date()
-});
-var CreateAuthorizedDomainRequestSchema = external_exports.object({
-  domain: external_exports.string().trim().min(1).max(253)
-}).strict();
 var ApplicationRepositorySummarySchema = external_exports.object({
   applicationRepositoryId: external_exports.uuid().nullable(),
   applicationId: external_exports.uuid(),
@@ -22426,7 +22412,6 @@ var ApplicationResponseSchema = external_exports.object({
   // Environments-tab panel hydrates from this payload (no client GET). Defaulted
   // (like `type`) so a new client reading a pre-this-release API during a rolling
   // deploy doesn't reject application rows that predate the field.
-  authorizedDomains: external_exports.array(AuthorizedDomainResponseSchema).default([]),
   // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
   // reading a pre-this-release API during a rolling deploy doesn't reject rows
   // that omit the field. The raw S3 key is never on the wire.
@@ -22602,35 +22587,6 @@ var applicationContract = c4.router({
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
-  },
-  addAuthorizedDomain: {
-    method: "POST",
-    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains",
-    pathParams: ApplicationIdParamsSchema,
-    body: CreateAuthorizedDomainRequestSchema,
-    responses: {
-      201: AuthorizedDomainResponseSchema,
-      // 400 = INVALID_DOMAIN (not a registrable domain / IP / bare suffix);
-      // 409 = DOMAIN_ALREADY_AUTHORIZED.
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      409: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  },
-  deleteAuthorizedDomain: {
-    method: "DELETE",
-    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains/:applicationAuthorizedDomainId",
-    pathParams: AuthorizedDomainIdParamsSchema,
-    responses: {
-      204: DeleteResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
   }
 });
 
@@ -23871,6 +23827,68 @@ var cloudIntegrationContract = c7.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/code-size.api.ts
+var CodeSizeBucketTallySchema = external_exports.object({
+  files: external_exports.number().int().nonnegative(),
+  lines: external_exports.number().int().nonnegative(),
+  code: external_exports.number().int().nonnegative()
+});
+var CodeSizeLanguageTallySchema = external_exports.object({
+  language: external_exports.string(),
+  files: external_exports.number().int().nonnegative(),
+  code: external_exports.number().int().nonnegative()
+});
+var CodeSizePlatformValues = ["GITHUB", "BITBUCKET"];
+var CodeSizeRepositorySchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(CodeSizePlatformValues),
+  /** Billable SLOC of the current resolved branch. null = not measured yet. */
+  billableSloc: external_exports.number().int().nonnegative().nullable()
+});
+var CodeSizeBucketsSchema = external_exports.object({
+  code: CodeSizeBucketTallySchema,
+  tests: CodeSizeBucketTallySchema,
+  docs: CodeSizeBucketTallySchema,
+  config_data: CodeSizeBucketTallySchema,
+  vendored_generated: CodeSizeBucketTallySchema
+});
+var OrganizationCodeSizeResponseSchema = external_exports.object({
+  /** All CONNECTED GitHub/Bitbucket repos. Server-sorted: measured first by
+   *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
+   *  repositoryUrl asc — clients render as-is (spec-pr-2 §3.3). */
+  repositories: external_exports.array(CodeSizeRepositorySchema),
+  /** Sums over measured repos only. All-zero when none are measured. */
+  totals: external_exports.object({
+    billableSloc: external_exports.number().int().nonnegative(),
+    rawLines: external_exports.number().int().nonnegative(),
+    buckets: CodeSizeBucketsSchema,
+    /** Merged across repos, re-sorted code desc then language asc, capped
+     *  at 12 for display (stored lists are complete; spec-pr-2 §3.2). */
+    codeByLanguage: external_exports.array(CodeSizeLanguageTallySchema),
+    /** Distinct languages in the code bucket across measured repos — the
+     *  TRUE count, not codeByLanguage.length (which is display-capped). */
+    languageCount: external_exports.number().int().nonnegative()
+  })
+});
+
+// ../../packages/api-contracts/src/contracts/v1/code-size.ts
+var c8 = initContract();
+var codeSizeContract = c8.router({
+  getOrganizationCodeSize: {
+    method: "GET",
+    path: "/organizations/:organizationId/code-size",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: OrganizationCodeSizeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/domain/credential.schema.ts
 var CredentialTypeValues = [
   "BEARER_TOKEN",
@@ -23978,13 +23996,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c49, i) => {
-    const d2 = c49.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c51, i) => {
+    const d2 = c51.domain.replace(/^\./, "").toLowerCase();
     if (d2 !== host && !host.endsWith(`.${d2}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i, "domain"],
-        message: `cookie domain "${c49.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c51.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -24192,8 +24210,8 @@ var RevealCredentialSecretResponseSchema = external_exports.discriminatedUnion("
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/credential.ts
-var c8 = initContract();
-var credentialContract = c8.router({
+var c9 = initContract();
+var credentialContract = c9.router({
   listCredentials: {
     method: "GET",
     path: "/organizations/:organizationId/environments/:environmentId/credentials",
@@ -24285,7 +24303,7 @@ var credentialContract = c8.router({
     method: "POST",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/reveal",
     pathParams: CredentialIdParamsSchema,
-    body: c8.noBody(),
+    body: c9.noBody(),
     responses: {
       200: RevealCredentialSecretResponseSchema,
       401: ErrorResponseSchema,
@@ -24512,8 +24530,8 @@ var DependencySummaryResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/dependency.ts
-var c9 = initContract();
-var dependencyContract = c9.router({
+var c10 = initContract();
+var dependencyContract = c10.router({
   /** Cross-repo dependency search. Two-phase: pg_trgm on Package, then join repos. */
   searchDependencies: {
     method: "POST",
@@ -24658,8 +24676,8 @@ var DockerScoutIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/docker-scout-integration.ts
-var c10 = initContract();
-var dockerScoutIntegrationContract = c10.router({
+var c11 = initContract();
+var dockerScoutIntegrationContract = c11.router({
   createDockerScoutIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/docker-scout-integration",
@@ -24848,12 +24866,12 @@ var EngagementResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/engagement.ts
-var c11 = initContract();
+var c12 = initContract();
 var RecordDashboardSessionRequest = external_exports.object({
   sessionId: external_exports.string().min(1).max(100)
 });
 var RecordDashboardSessionResponse = external_exports.object({});
-var engagementContract = c11.router({
+var engagementContract = c12.router({
   recordDashboardSession: {
     method: "POST",
     // `pathPrefix: '/v1'` is applied at the router level (see
@@ -24902,7 +24920,7 @@ var EnvironmentResponseSchema = external_exports.object({
   applicationId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
   name: external_exports.string(),
-  primaryUrl: external_exports.string(),
+  primaryUrl: external_exports.string().nullable(),
   description: external_exports.string().nullable(),
   isProduction: external_exports.boolean(),
   createdAt: external_exports.date(),
@@ -24911,7 +24929,7 @@ var EnvironmentResponseSchema = external_exports.object({
 var ListEnvironmentsResponseSchema = external_exports.array(EnvironmentResponseSchema);
 var CreateEnvironmentRequestSchema = external_exports.object({
   name: EnvNameSchema,
-  primaryUrl: external_exports.url().max(2048),
+  primaryUrl: external_exports.url().max(2048).optional(),
   description: external_exports.string().max(1e3).optional(),
   isProduction: external_exports.boolean().optional().default(false)
 }).strict();
@@ -24923,8 +24941,8 @@ var UpdateEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/environment.ts
-var c12 = initContract();
-var environmentContract = c12.router({
+var c13 = initContract();
+var environmentContract = c13.router({
   listEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/applications/:applicationId/environments",
@@ -25174,8 +25192,8 @@ var GitHubRepoSchema = external_exports.object({
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/github.ts
-var c13 = initContract();
-var githubContract = c13.router({
+var c14 = initContract();
+var githubContract = c14.router({
   // Tier chooser data: which app tiers this env can connect + the org's
   // entitlement default. Pure read (auth context + server config).
   getConnectOptions: {
@@ -25274,7 +25292,7 @@ var githubContract = c13.router({
     method: "POST",
     path: "/organizations/:organizationId/github/install-requests/:requestId/cancel",
     pathParams: GitHubInstallRequestParamsSchema,
-    body: c13.type(),
+    body: c14.type(),
     responses: {
       200: GitHubInstallRequestSchema,
       401: ErrorResponseSchema,
@@ -25285,7 +25303,7 @@ var githubContract = c13.router({
     }
   }
 });
-var staffGithubContract = c13.router({
+var staffGithubContract = c14.router({
   listStaffInstallations: {
     method: "GET",
     path: "/staff/github/installations",
@@ -25328,8 +25346,8 @@ var ManagedInboxLabelParamsSchema = OrgIdParamsSchema.extend({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/inbox.ts
-var c14 = initContract();
-var inboxContract = c14.router({
+var c15 = initContract();
+var inboxContract = c15.router({
   listInboxes: {
     method: "GET",
     path: "/organizations/:organizationId/inboxes",
@@ -25406,8 +25424,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c15 = initContract();
-var knowledgeBaseContract = c15.router({
+var c16 = initContract();
+var knowledgeBaseContract = c16.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -25628,8 +25646,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c16 = initContract();
-var knowledgeDocumentContract = c16.router({
+var c17 = initContract();
+var knowledgeDocumentContract = c17.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -25955,8 +25973,8 @@ var LinearMetadataResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-integration.ts
-var c17 = initContract();
-var linearIntegrationContract = c17.router({
+var c18 = initContract();
+var linearIntegrationContract = c18.router({
   getLinearIntegration: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear",
@@ -25974,7 +25992,7 @@ var linearIntegrationContract = c17.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/connect",
     pathParams: OrgIdParamsSchema,
-    body: c17.noBody(),
+    body: c18.noBody(),
     responses: {
       200: LinearConnectResponseSchema,
       401: ErrorResponseSchema,
@@ -25989,7 +26007,7 @@ var linearIntegrationContract = c17.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/disconnect",
     pathParams: OrgIdParamsSchema,
-    body: c17.noBody(),
+    body: c18.noBody(),
     responses: {
       200: LinearIntegrationResponseSchema,
       401: ErrorResponseSchema,
@@ -26151,8 +26169,8 @@ var LinearTicketContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-tickets.ts
-var c18 = initContract();
-var linearTicketContract = c18.router({
+var c19 = initContract();
+var linearTicketContract = c19.router({
   /**
    * Push one or more pentest findings to Linear as tickets. Customer-side
    * (VIEW_RESULTS + PENTEST capability); non-admins create into the org's
@@ -26256,8 +26274,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c19 = initContract();
-var llmProviderKeyContract = c19.router({
+var c20 = initContract();
+var llmProviderKeyContract = c20.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -26451,8 +26469,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c20 = initContract();
-var organizationContract = c20.router({
+var c21 = initContract();
+var organizationContract = c21.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -26656,7 +26674,7 @@ var organizationContract = c20.router({
     method: "POST",
     path: "/organizations/:organizationId/logos-from-homepage",
     pathParams: OrgIdParamsSchema,
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: OrganizationResponseSchema,
       // 400 — no homepage set on the organization.
@@ -27429,8 +27447,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c21 = initContract();
-var pentestContract = c21.router({
+var c22 = initContract();
+var pentestContract = c22.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -27866,8 +27884,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c22 = initContract();
-var pentestAttestationContract = c22.router({
+var c23 = initContract();
+var pentestAttestationContract = c23.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -28009,8 +28027,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c23 = initContract();
-var pentestAuditLogContract = c23.router({
+var c24 = initContract();
+var pentestAuditLogContract = c24.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -28026,6 +28044,86 @@ var pentestAuditLogContract = c23.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-authorized-domain.api.ts
+var PentestAuthorizedDomainIdParamsSchema = PentestIdParamsSchema.extend({
+  pentestAuthorizedDomainId: external_exports.uuid()
+});
+var AuthorizedDomainOriginValues = ["DERIVED", "ENGAGEMENT"];
+var AuthorizedDomainOrigin = external_exports.enum(AuthorizedDomainOriginValues);
+var PentestAuthorizedDomainResponseSchema = external_exports.object({
+  /**
+   * NULL for a domain contributed by a bound application while the engagement is
+   * still tracking — there is no row yet, and nothing to address by id.
+   */
+  pentestAuthorizedDomainId: external_exports.uuid().nullable(),
+  pentestId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  domain: external_exports.string(),
+  applicationIds: external_exports.array(external_exports.uuid()),
+  origin: AuthorizedDomainOrigin,
+  /** NULL when the row was written by materialization rather than by a person. */
+  addedById: external_exports.uuid().nullable(),
+  addedAt: external_exports.date().nullable()
+});
+var PentestAuthorizedScopeResponseSchema = external_exports.object({
+  domains: external_exports.array(PentestAuthorizedDomainResponseSchema),
+  /** Null while the engagement still tracks its bound applications. */
+  materializedAt: external_exports.date().nullable()
+});
+var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
+  domain: external_exports.string().trim().min(1).max(253)
+}).strict();
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
+var c25 = initContract();
+var pentestAuthorizedDomainContract = c25.router({
+  getPentestAuthorizedScope: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
+    pathParams: PentestIdParamsSchema,
+    responses: {
+      200: PentestAuthorizedScopeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  addPentestAuthorizedDomain: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope/domains",
+    pathParams: PentestIdParamsSchema,
+    body: CreatePentestAuthorizedDomainRequestSchema,
+    responses: {
+      201: PentestAuthorizedDomainResponseSchema,
+      // 400 = INVALID_DOMAIN (not a registrable domain / IP / bare suffix);
+      // 409 = DOMAIN_ALREADY_AUTHORIZED or PENTEST_CLOSED.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  removePentestAuthorizedDomain: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope/domains/:pentestAuthorizedDomainId",
+    pathParams: PentestAuthorizedDomainIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      // 409 = DOMAIN_FROM_ENVIRONMENT (derived from a selected environment's
+      // Target URL, so removing the row here would not remove it from scope) or
+      // PENTEST_CLOSED.
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-engagement-exclusion.api.ts
 var PentestEngagementExclusionsParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -28051,8 +28149,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c24 = initContract();
-var pentestEngagementExclusionContract = c24.router({
+var c26 = initContract();
+var pentestEngagementExclusionContract = c26.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -28116,8 +28214,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c25 = initContract();
-var pentestEnvironmentContract = c25.router({
+var c27 = initContract();
+var pentestEnvironmentContract = c27.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -29492,8 +29590,8 @@ var GetParseTaskStatusResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c26 = initContract();
-var pentestFindingContract = c26.router({
+var c28 = initContract();
+var pentestFindingContract = c28.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -30082,8 +30180,8 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
 }).strict().optional();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c27 = initContract();
-var pentestHypothesisContract = c27.router({
+var c29 = initContract();
+var pentestHypothesisContract = c29.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -30186,8 +30284,8 @@ var pentestHypothesisContract = c27.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c28 = initContract();
-var pentestManualFindingContract = c28.router({
+var c30 = initContract();
+var pentestManualFindingContract = c30.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -30274,8 +30372,8 @@ var pentestManualFindingContract = c28.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c29 = initContract();
-var pentestReportPdfContract = c29.router({
+var c31 = initContract();
+var pentestReportPdfContract = c31.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -30368,7 +30466,7 @@ var pentestReportPdfContract = c29.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c29.noBody(),
+    body: c31.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -30559,8 +30657,8 @@ var pentestReportPdfContract = c29.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c30 = initContract();
-var pentestValidationContract = c30.router({
+var c32 = initContract();
+var pentestValidationContract = c32.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -30668,8 +30766,8 @@ var pentestValidationContract = c30.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c31 = initContract();
-var repositoryContract = c31.router({
+var c33 = initContract();
+var repositoryContract = c33.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -30826,7 +30924,7 @@ var repositoryContract = c31.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c31.noBody(),
+    body: c33.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -30960,8 +31058,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c32 = initContract();
-var scanContract = c32.router({
+var c34 = initContract();
+var scanContract = c34.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -31123,8 +31221,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c33 = initContract();
-var testIntegrationContract = c33.router({
+var c35 = initContract();
+var testIntegrationContract = c35.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -31251,8 +31349,8 @@ var UpdateStaffProfileRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c34 = initContract();
-var userContract = c34.router({
+var c36 = initContract();
+var userContract = c36.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -31349,8 +31447,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c35 = initContract();
-var vantaIntegrationContract = c35.router({
+var c37 = initContract();
+var vantaIntegrationContract = c37.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -31682,8 +31780,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c36 = initContract();
-var vulnerabilityContract = c36.router({
+var c38 = initContract();
+var vulnerabilityContract = c38.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -31891,8 +31989,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c37 = initContract();
-var vulnerabilityNoteContract = c37.router({
+var c39 = initContract();
+var vulnerabilityNoteContract = c39.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -32073,8 +32171,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c38 = initContract();
-var webhookSettingsContract = c38.router({
+var c40 = initContract();
+var webhookSettingsContract = c40.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -32212,11 +32310,12 @@ var webhookSettingsContract = c38.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c39 = initContract();
-var v1Contract = c39.router(
+var c41 = initContract();
+var v1Contract = c41.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
+    codeSize: codeSizeContract,
     scan: scanContract,
     organization: organizationContract,
     user: userContract,
@@ -32243,6 +32342,7 @@ var v1Contract = c39.router(
     pentestAuditLog: pentestAuditLogContract,
     pentestEnvironment: pentestEnvironmentContract,
     pentestEngagementExclusion: pentestEngagementExclusionContract,
+    pentestAuthorizedDomain: pentestAuthorizedDomainContract,
     pentestFinding: pentestFindingContract,
     pentestHypothesis: pentestHypothesisContract,
     pentestValidation: pentestValidationContract,
@@ -32261,8 +32361,8 @@ var v1Contract = c39.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c40 = initContract();
-var contract = c40.router({
+var c42 = initContract();
+var contract = c42.router({
   v1: v1Contract
 });
 
@@ -32311,7 +32411,7 @@ var ComplianceRegimeValues = [
 var ComplianceRegime = external_exports.enum(ComplianceRegimeValues);
 
 // ../../packages/api-contracts/src/contracts/v1/agent-session-internal.ts
-var c41 = initContract();
+var c43 = initContract();
 var AgentSessionInternalParamsSchema = external_exports.object({
   agentSessionId: external_exports.uuid()
 });
@@ -33166,7 +33266,7 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
   expectedUpdatedAt: reportExpectedUpdatedAt,
   rows: external_exports.array(ScopeRowSchema).max(100)
 });
-var agentSessionInternalContract = c41.router({
+var agentSessionInternalContract = c43.router({
   postEvents: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/events",
@@ -33866,8 +33966,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c42 = initContract();
-var githubWebhookContract = c42.router(
+var c44 = initContract();
+var githubWebhookContract = c44.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33885,7 +33985,7 @@ var githubWebhookContract = c42.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c42.router(
+var githubReadonlyWebhookContract = c44.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33905,9 +34005,9 @@ var githubReadonlyWebhookContract = c42.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c43 = initContract();
+var c45 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c43.router(
+var linearWebhookContract = c45.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33927,7 +34027,7 @@ var linearWebhookContract = c43.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c44 = initContract();
+var c46 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -33956,7 +34056,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c44.router(
+var forgeBitbucketContract = c46.router(
   {
     lifecycle: {
       method: "POST",
@@ -34003,8 +34103,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c45 = initContract();
-var healthContract = c45.router({
+var c47 = initContract();
+var healthContract = c47.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -34016,8 +34116,8 @@ var healthContract = c45.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c46 = initContract();
-var vulnerabilityShareContract = c46.router(
+var c48 = initContract();
+var vulnerabilityShareContract = c48.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -34104,8 +34204,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c47 = initContract();
-var prVulnerabilityContract = c47.router(
+var c49 = initContract();
+var prVulnerabilityContract = c49.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -36658,12 +36758,12 @@ function buildApplicationsTable(apps) {
     repos: String(a.repositories.length),
     url: a.applicationUrl ? sanitizeDisplay(a.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c49) => c49.type.length));
+  const idWidth = Math.max(2, ...cells.map((c51) => c51.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c51) => c51.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c51) => c51.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.name.padEnd(nameWidth)}  ${c49.type.padEnd(typeWidth)}  ${c49.repos.padStart(5)}  ${c49.url}`
+    (c51) => `${c51.id.padEnd(idWidth)}  ${c51.name.padEnd(nameWidth)}  ${c51.type.padEnd(typeWidth)}  ${c51.repos.padStart(5)}  ${c51.url}`
   );
   return { header, rows };
 }
@@ -36683,12 +36783,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l.repositoryPath ? sanitizeDisplay(l.repositoryPath) : "\u2014",
     status: formatStatus(l.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c49) => c49.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c49) => c49.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c49) => c49.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c51) => c51.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c51) => c51.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c51) => c51.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c49) => `${c49.name.padEnd(nameWidth)}  ${c49.scan.padEnd(4)}  ${c49.role.padEnd(roleWidth)}  ${c49.path.padEnd(pathWidth)}  ${c49.status}`
+    (c51) => `${c51.name.padEnd(nameWidth)}  ${c51.scan.padEnd(4)}  ${c51.role.padEnd(roleWidth)}  ${c51.path.padEnd(pathWidth)}  ${c51.status}`
   );
   return { header, rows };
 }
@@ -37800,14 +37900,14 @@ var yt = (t) => {
 };
 var ee = (t, r, s, i, u) => {
   let n = r, o = 0;
-  for (let c49 = s; c49 < i; c49++) {
-    const a = t[c49];
+  for (let c51 = s; c51 < i; c51++) {
+    const a = t[c51];
     if (n = n - a.length, o++, n <= u) break;
   }
   return { lineCount: n, removals: o };
 };
 var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItems: u = Number.POSITIVE_INFINITY, columnPadding: n = 0, rowPadding: o = 4 }) => {
-  const c49 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
+  const c51 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
   let p2 = 0;
   t >= y - 3 && (p2 = Math.max(Math.min(t - y + 3, r.length - y), 0));
   let m = y < r.length && p2 > 0, g = y < r.length && p2 + y < r.length;
@@ -37816,7 +37916,7 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
   m && f++, g && f++;
   const v2 = p2 + (m ? 1 : 0), T = S2 - (g ? 1 : 0);
   for (let b2 = v2; b2 < T; b2++) {
-    const G2 = wrapAnsi(s(r[b2], b2 === t), c49, { hard: true, trim: false }).split(`
+    const G2 = wrapAnsi(s(r[b2], b2 === t), c51, { hard: true, trim: false }).split(`
 `);
     h2.push(G2), f += G2.length;
   }
@@ -37833,22 +37933,22 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
 var ue = (t) => {
   const r = t.active ?? "Yes", s = t.inactive ?? "No";
   return new X({ active: r, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
-    const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${e("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c49 = `${i ? `${e("gray", $)}
+    const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${e("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c51 = `${i ? `${e("gray", $)}
 ` : ""}${o}
 `, a = this.value ? r : s;
     switch (this.state) {
       case "submit": {
         const l = i ? `${e("gray", $)}  ` : "";
-        return `${c49}${l}${e("dim", a)}`;
+        return `${c51}${l}${e("dim", a)}`;
       }
       case "cancel": {
         const l = i ? `${e("gray", $)}  ` : "";
-        return `${c49}${l}${e(["strikethrough", "dim"], a)}${i ? `
+        return `${c51}${l}${e(["strikethrough", "dim"], a)}${i ? `
 ${e("gray", $)}` : ""}`;
       }
       default: {
         const l = i ? `${e("cyan", $)}  ` : "", d2 = i ? e("cyan", E2) : "";
-        return `${c49}${l}${this.value ? `${e("green", z4)} ${r}` : `${e("dim", H)} ${e("dim", r)}`}${t.vertical ? i ? `
+        return `${c51}${l}${this.value ? `${e("green", z4)} ${r}` : `${e("dim", H)} ${e("dim", r)}`}${t.vertical ? i ? `
 ${e("cyan", $)}  ` : `
 ` : ` ${e("dim", "/")} `}${this.value ? `${e("dim", H)} ${e("dim", s)}` : `${e("green", z4)} ${s}`}
 ${d2}
@@ -37870,21 +37970,21 @@ var fe = (t) => new rt({ validate: t.validate, placeholder: t.placeholder, defau
   ${e(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
   switch (this.state) {
     case "error": {
-      const c49 = `${e("yellow", $)}  `, a = r ? W(t.output, u, c49, void 0) : u, l = e("yellow", E2);
+      const c51 = `${e("yellow", $)}  `, a = r ? W(t.output, u, c51, void 0) : u, l = e("yellow", E2);
       return `${s}${a}
 ${l}  ${e("yellow", this.error)}${o}
 `;
     }
     case "submit": {
-      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e("dim", l)) : n ? e("dim", n) : "";
+      const c51 = `${e("gray", $)}  `, a = r ? W(t.output, n, c51, void 0, (l) => e("dim", l)) : n ? e("dim", n) : "";
       return `${s}${a}`;
     }
     case "cancel": {
-      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e(["strikethrough", "dim"], l)) : n ? e(["strikethrough", "dim"], n) : "";
+      const c51 = `${e("gray", $)}  `, a = r ? W(t.output, n, c51, void 0, (l) => e(["strikethrough", "dim"], l)) : n ? e(["strikethrough", "dim"], n) : "";
       return `${s}${a}`;
     }
     default: {
-      const c49 = r ? `${e("cyan", $)}  ` : "", a = r ? e("cyan", E2) : "", l = r ? W(t.output, u, c49) : u;
+      const c51 = r ? `${e("cyan", $)}  ` : "", a = r ? e("cyan", E2) : "", l = r ? W(t.output, u, c51) : u;
       return `${s}${l}
 ${a}${o}
 `;
@@ -37905,7 +38005,7 @@ ${e("reset", e("dim", `Press ${e(["gray", "bgWhite", "inverse"], " space ")} to
   }, render() {
     const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${e("gray", $)}
 ` : ""}${u}
-`, o = this.value ?? [], c49 = (a, l) => {
+`, o = this.value ?? [], c51 = (a, l) => {
       if (a.disabled) return r(a, "disabled");
       const d2 = o.includes(a.value);
       return l && d2 ? r(a, "active-selected") : d2 ? r(a, "selected") : r(a, l ? "active" : "inactive");
@@ -37928,7 +38028,7 @@ ${e("gray", $)}` : ""}`;
 `), d2 = n.split(`
 `).length, y = l.split(`
 `).length + 1;
-        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: d2 + y, style: c49 }).join(`
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: d2 + y, style: c51 }).join(`
 ${a}`)}
 ${l}
 `;
@@ -37936,7 +38036,7 @@ ${l}
       default: {
         const a = i ? `${e("cyan", $)}  ` : "", l = n.split(`
 `).length, d2 = i ? 2 : 1;
-        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c49 }).join(`
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c51 }).join(`
 ${a}`)}
 ${i ? e("cyan", E2) : ""}
 `;
@@ -37950,9 +38050,9 @@ var Ce = (t) => new ot({ validate: t.validate, mask: t.mask ?? Gt, signal: t.sig
 `, i = this.userInputWithCursor, u = this.masked;
   switch (this.state) {
     case "error": {
-      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c49 = u ?? "";
+      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c51 = u ?? "";
       return t.clearOnError && this.clear(), `${s.trim()}
-${n}${c49}
+${n}${c51}
 ${o}${e("yellow", this.error)}
 `;
     }
@@ -38000,19 +38100,19 @@ var Ee = (t) => {
 `;
     switch (this.state) {
       case "submit": {
-        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c49);
+        const c51 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c51);
         return `${o}${a}`;
       }
       case "cancel": {
-        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c49);
+        const c51 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c51);
         return `${o}${a}${s ? `
 ${e("gray", $)}` : ""}`;
       }
       default: {
-        const c49 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
+        const c51 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
 `).length, d2 = s ? 2 : 1;
-        return `${o}${c49}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c49.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
-${c49}`)}
+        return `${o}${c51}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c51.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
+${c51}`)}
 ${a}
 `;
       }
@@ -38770,7 +38870,7 @@ function extractCommandTree(cmd) {
     description: o.description,
     takesValue: o.required || o.optional
   }));
-  const subcommands = cmd.commands.filter((c49) => !c49._hidden).map((c49) => extractCommandTree(c49));
+  const subcommands = cmd.commands.filter((c51) => !c51._hidden).map((c51) => extractCommandTree(c51));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -38836,7 +38936,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c49) => c49.name);
+  const subcommandNames = tree.subcommands.map((c51) => c51.name);
   const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -39519,16 +39619,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c49) => ({
-    id: c49.credentialId,
-    label: sanitizeDisplay(c49.label),
-    type: c49.credentialType
+  const cells = creds.map((c51) => ({
+    id: c51.credentialId,
+    label: sanitizeDisplay(c51.label),
+    type: c51.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c49) => c49.label.length));
+  const idWidth = Math.max(2, ...cells.map((c51) => c51.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c51) => c51.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.label.padEnd(labelWidth)}  ${c49.type}`
+    (c51) => `${c51.id.padEnd(idWidth)}  ${c51.label.padEnd(labelWidth)}  ${c51.type}`
   );
   return { header, rows };
 }
@@ -40017,7 +40117,7 @@ function renderEnvironmentDetail(env2) {
   return [
     `${"ID:".padEnd(pad)} ${env2.environmentId}`,
     `${"Name:".padEnd(pad)} ${sanitizeDisplay(env2.name)}`,
-    `${"URL:".padEnd(pad)} ${sanitizeDisplay(env2.primaryUrl)}`,
+    `${"URL:".padEnd(pad)} ${env2.primaryUrl != null ? sanitizeDisplay(env2.primaryUrl) : "\u2014"}`,
     `${"Production:".padEnd(pad)} ${env2.isProduction ? "yes" : "no"}`,
     `${"Description:".padEnd(pad)} ${env2.description ? sanitizeDisplay(env2.description) : "\u2014"}`,
     `${"Application:".padEnd(pad)} ${env2.applicationId}`,
@@ -40033,7 +40133,7 @@ function printEnvironmentsTsv(envs) {
       [
         tsvSafe(env2.environmentId),
         tsvSafe(sanitizeDisplay(env2.name)),
-        tsvSafe(sanitizeDisplay(env2.primaryUrl)),
+        tsvSafe(sanitizeDisplay(env2.primaryUrl ?? "")),
         String(env2.isProduction),
         tsvSafe(sanitizeDisplay(env2.description ?? "")),
         tsvSafe(toIso(env2.createdAt))
@@ -40065,7 +40165,7 @@ function printOrgEnvironmentsTsv(envs) {
         tsvSafe(env2.applicationId),
         tsvSafe(sanitizeDisplay(env2.applicationName)),
         tsvSafe(sanitizeDisplay(env2.name)),
-        tsvSafe(sanitizeDisplay(env2.primaryUrl)),
+        tsvSafe(sanitizeDisplay(env2.primaryUrl ?? "")),
         String(env2.isProduction),
         tsvSafe(toIso(env2.createdAt))
       ].join("	")
@@ -40077,17 +40177,17 @@ function buildEnvironmentTable(envs, leading) {
     leading: leading.map((column) => sanitizeDisplay(column.value(e2))),
     name: sanitizeDisplay(e2.name),
     prod: e2.isProduction ? "yes" : "no",
-    url: sanitizeDisplay(e2.primaryUrl)
+    url: e2.primaryUrl != null ? sanitizeDisplay(e2.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i) => Math.max(column.header.length, ...cells.map((c49) => c49.leading[i]?.length ?? 0))
+    (column, i) => Math.max(column.header.length, ...cells.map((c51) => c51.leading[i]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c51) => c51.name.length));
   const padLeading = (values) => values.map((v2, i) => v2.padEnd(leadingWidths[i] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c49) => c49.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c51) => c51.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c49) => `${padLeading(c49.leading)}  ${c49.name.padEnd(nameWidth)}  ${c49.prod.padEnd(4)}  ${c49.url}`
+      (c51) => `${padLeading(c51.leading)}  ${c51.name.padEnd(nameWidth)}  ${c51.prod.padEnd(4)}  ${c51.url}`
     )
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {