securewithtrace 0.39.0 → 0.40.1

package/dist/index.js

@@ -22144,7 +22144,7 @@ var AgentSessionFailureReasonValues = [
   "INTERNAL"
 ];
 var AgentSessionFailureReason = external_exports.enum(AgentSessionFailureReasonValues);
-var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC"];
+var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC", "OPENAI"];
 var AgentSessionProvider = external_exports.enum(AgentSessionProviderValues);
 var AgentSessionEventKindValues = [
   "AGENT_TEXT",
@@ -22283,6 +22283,9 @@ var AgentSessionSummarySchema = external_exports.object({
   status: AgentSessionStatus,
   waitingReason: AgentSessionWaitingReason.nullable(),
   failureReason: AgentSessionFailureReason.nullable(),
+  /** Sanitized, shape-only failure description (e.g. a provider refusal message) — never customer
+   *  data. In the summary so the staff console can show WHY a listed session failed. */
+  failureDetails: external_exports.string().nullable(),
   objective: external_exports.string(),
   provider: AgentSessionProvider,
   model: external_exports.string(),
@@ -22305,8 +22308,6 @@ var AgentSessionRepositoryPinSchema = external_exports.object({
   commitSha: external_exports.string()
 });
 var AgentSessionDetailSchema = AgentSessionSummarySchema.extend({
-  /** Sanitized, shape-only failure description — never customer data. */
-  failureDetails: external_exports.string().nullable(),
   sdkSessionId: external_exports.string().nullable(),
   promptVersion: external_exports.string(),
   toolsetVersion: external_exports.string(),
@@ -25006,34 +25007,6 @@ var PentestDetailResponseSchema = PentestResponseSchema.extend({
   testingWindowStart: external_exports.coerce.date().nullable().optional(),
   testingWindowEnd: external_exports.coerce.date().nullable().optional(),
   engagementMetadataOverrides: EngagementMetadataOverridesSchema.optional(),
-  /**
-   * True once the engagement's repository scope has been snapshotted, which
-   * PERMANENTLY refuses bind and unbind (`repositoryScopes > 0` in
-   * `requireBindableInLock`).
-   *
-   * This one refusal only — that guard also refuses on `PENTEST_CLOSED` and on a
-   * non-scoping stage, both of which the client can already read off `status` and
-   * `currentStage` on this same response. So `false` means "not frozen by the
-   * snapshot", NOT "a bind will succeed"; a consumer that gates a control must check
-   * the stage and closed state too.
-   *
-   * Needed as its OWN field because nothing else on the wire answers it: the scope
-   * freezes at the first scope-consuming session create, and only VALIDATION moves
-   * the stage, so RECON / CODE_REVIEW / PRODUCT_RECON leave the engagement in
-   * `DRAFT` with permanently frozen bindings. `getRepositoryScope` reports
-   * `source: 'PENTEST_SCOPE'` only PAST the scoping stages, so a frozen `DRAFT`
-   * engagement still returns live application links there.
-   *
-   * Scoped to BINDINGS, not to the whole target: environment add/remove is gated on
-   * stage alone (`PentestEnvironmentService`, `NON_SCOPING_PENTEST_STAGES`), and
-   * `DRAFT` is a scoping stage — so a consumer must not disable environment editing
-   * on this flag. Doing so would remove the one provisioning action a frozen
-   * multi-application engagement still legitimately needs.
-   *
-   * Detail-only (the list schema deliberately carries no per-pentest aggregates) and
-   * `.optional()` for the same rolling-deploy reason as the fields above.
-   */
-  applicationBindingFrozen: external_exports.boolean().optional(),
   /**
    * Optional customer intake questionnaire answers. Staff detail only.
    * `.optional()` for rolling-deploy safety (Vercel ahead of ECS).
@@ -25481,7 +25454,18 @@ var ClaimedDesktopActionSchema = external_exports.object({
   kind: external_exports.enum(DesktopActionKindValues),
   request: external_exports.unknown(),
   /** Epoch millis; past this the box abandons the work and reports nothing. */
-  expiresAtMs: external_exports.number().int().positive()
+  expiresAtMs: external_exports.number().int().positive(),
+  /**
+   * A presigned PUT for the ONE artifact this kind can produce, issued with the
+   * claim so an action does not spend a second api round trip asking for it.
+   * The key is target-relative and travels back on `complete` unchanged.
+   *
+   * Null when the api has no artifacts bucket configured, and absent from an
+   * api that predates this. The box presigns for itself in both cases, and also
+   * whenever the PUT is refused, which is what keeps the 15-minute URL safe to
+   * issue at claim time for an action that may run longer than that.
+   */
+  artifactUpload: external_exports.object({ key: external_exports.string().min(1).max(1024), url: external_exports.url() }).nullable().optional()
 });
 var DesktopTargetClaimResponseSchema = external_exports.object({
   action: ClaimedDesktopActionSchema.nullable(),
@@ -25501,7 +25485,18 @@ var DesktopTargetCompleteRequestSchema = external_exports.object({
    */
   resultS3Key: external_exports.string().min(1).max(1024).optional(),
   /** Shape-only. Never customer data. */
-  failureDetails: external_exports.string().max(2e3).optional()
+  failureDetails: external_exports.string().max(2e3).optional(),
+  /**
+   * What the box spent, as a SIBLING of `result` rather than a member of it.
+   *
+   * Two reasons it cannot live inside `result`: the api parses that against the
+   * kind's own schema, which strips anything the schema does not declare, and
+   * the box sizes its inline output against the 32 KB cap before this is known.
+   */
+  rigTimings: external_exports.object({
+    executeMs: external_exports.number().int().nonnegative(),
+    uploadMs: external_exports.number().int().nonnegative()
+  }).optional()
 });
 var DesktopTargetCompleteResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
 var DesktopTargetPresignRequestSchema = external_exports.object({
@@ -32310,12 +32305,15 @@ var StaffOrganizationSummarySchema = external_exports.object({
 var ListAllOrganizationsResponseSchema = external_exports.array(StaffOrganizationSummarySchema);
 var CreateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(2, "Organization name must be at least 2 characters").max(100, "Organization name must be 100 characters or fewer"),
-  referrerId: external_exports.uuid().nullable().optional()
+  referrerId: external_exports.uuid().nullable().optional(),
+  homepageUrl: external_exports.url("Homepage must be a full URL, like https://acme.com").max(2048).nullable().optional()
 });
+var LogoFetchOutcomeValues = ["skipped", "stored", "not_found", "failed"];
 var CreateOrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   slug: external_exports.string(),
-  name: external_exports.string()
+  name: external_exports.string(),
+  logoFetch: external_exports.enum(LogoFetchOutcomeValues)
 });
 var OnboardingItemValues = [
   "INVITE_MEMBERS",
@@ -33183,10 +33181,9 @@ var pentestContract = c27.router({
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
-      // 409 — PENTEST_APPLICATION_ALREADY_BOUND (unique violation),
-      // PENTEST_APPLICATION_FROZEN_AT_STAGE (past scoping), or
-      // PENTEST_APPLICATION_SCOPE_FROZEN (repository scope already snapshotted,
-      // so a new binding could never enter it).
+      // 409: PENTEST_APPLICATION_ALREADY_BOUND (unique violation), PENTEST_CLOSED,
+      // or PENTEST_APPLICATION_WITHOUT_REPOSITORY (the repository scope is already
+      // snapshotted and this application has no scan-enabled repository to add).
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -33202,7 +33199,7 @@ var pentestContract = c27.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // 409 — PENTEST_APPLICATION_UNBIND_BLOCKED (this application still has
-      // linked environments), or either frozen guard as on bind.
+      // linked environments) or PENTEST_CLOSED.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -41589,6 +41586,323 @@ ${b}
 };
 var i = `${styleText2("gray", S_BAR)}  `;
 
+// src/org/update.ts
+import { readFileSync as readFileSync2, statSync } from "fs";
+import { basename, extname } from "path";
+var LOGO_CONTENT_TYPE_BY_EXTENSION = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp"
+};
+var SUPPORTED_LOGO_EXTENSIONS = Object.keys(
+  LOGO_CONTENT_TYPE_BY_EXTENSION
+);
+var MAX_LOGO_UPLOAD_BYTES = 2 * 1024 * 1024;
+function logoContentTypeForFile(path) {
+  return LOGO_CONTENT_TYPE_BY_EXTENSION[extname(path).toLowerCase()] ?? null;
+}
+function isHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
+function resolveLogoValue(value, flag) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return { error: `--${flag} cannot be empty. Pass an image file path or an http(s) URL.` };
+  }
+  if (isHttpUrl(trimmed)) {
+    return { change: { action: "url", url: trimmed } };
+  }
+  if (URL_SCHEME_PATTERN.test(trimmed)) {
+    return {
+      error: `--${flag} '${sanitizeDisplay(trimmed)}' must be an http(s) URL or a file path.`
+    };
+  }
+  const contentType = logoContentTypeForFile(trimmed);
+  if (!contentType) {
+    return {
+      error: `--${flag} '${sanitizeDisplay(trimmed)}' has an unsupported extension. Use one of: ${SUPPORTED_LOGO_EXTENSIONS.join(", ")}.`
+    };
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync(trimmed);
+    if (!stats.isFile()) {
+      return { error: `--${flag} '${sanitizeDisplay(trimmed)}' is not a regular file.` };
+    }
+    sizeBytes = stats.size;
+  } catch {
+    return { error: `Cannot read --${flag} '${sanitizeDisplay(trimmed)}'.` };
+  }
+  if (sizeBytes === 0) {
+    return { error: `--${flag} '${sanitizeDisplay(trimmed)}' is empty.` };
+  }
+  if (sizeBytes > MAX_LOGO_UPLOAD_BYTES) {
+    return {
+      error: `--${flag} is ${formatBytes(sizeBytes)}; logo files must be ${formatBytes(MAX_LOGO_UPLOAD_BYTES)} or smaller.`
+    };
+  }
+  return { change: { action: "upload", file: { path: trimmed, contentType, sizeBytes } } };
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+var NOTHING_TO_UPDATE = "Nothing to update. Pass at least one of --homepage, --clear-homepage, --logo, --clear-logo, --dark-logo, --clear-dark-logo, --logos-from-homepage.";
+function resolveLogoSlot(value, clear, flag) {
+  const resolved = resolveClearableOption(value, clear, flag);
+  if ("error" in resolved) {
+    return resolved;
+  }
+  if (resolved.value === null) {
+    return { change: { action: "clear" } };
+  }
+  if (resolved.value === void 0) {
+    return { change: void 0 };
+  }
+  const logo = resolveLogoValue(resolved.value, flag);
+  return "error" in logo ? logo : { change: logo.change };
+}
+function planOrgUpdate(options) {
+  const homepage = resolveClearableOption(options.homepage, options.clearHomepage, "homepage");
+  if ("error" in homepage) {
+    return homepage;
+  }
+  if (typeof homepage.value === "string" && !isHttpUrl(homepage.value.trim())) {
+    return {
+      error: `--homepage '${sanitizeDisplay(homepage.value)}' must be an http(s) URL (e.g. https://acme.com).`
+    };
+  }
+  const logo = resolveLogoSlot(options.logo, options.clearLogo, "logo");
+  if ("error" in logo) {
+    return logo;
+  }
+  const darkLogo = resolveLogoSlot(options.darkLogo, options.clearDarkLogo, "dark-logo");
+  if ("error" in darkLogo) {
+    return darkLogo;
+  }
+  const derive = options.logosFromHomepage === true;
+  if (derive && (logo.change !== void 0 || darkLogo.change !== void 0)) {
+    return {
+      error: "Pass either --logos-from-homepage or explicit logo flags (--logo, --dark-logo, --clear-logo, --clear-dark-logo), not both."
+    };
+  }
+  if (derive && homepage.value === null) {
+    return { error: "--logos-from-homepage needs a homepage; drop --clear-homepage." };
+  }
+  const homepageUrl = typeof homepage.value === "string" ? homepage.value.trim() : homepage.value;
+  if (homepageUrl === void 0 && logo.change === void 0 && darkLogo.change === void 0 && !derive) {
+    return { error: NOTHING_TO_UPDATE };
+  }
+  return {
+    plan: {
+      homepageUrl,
+      logo: logo.change,
+      darkLogo: darkLogo.change,
+      deriveLogosFromHomepage: derive
+    }
+  };
+}
+function slotFields(change, uploadedKey, variant) {
+  switch (change.action) {
+    case "clear":
+      return { url: null, s3Key: null };
+    case "url":
+      return { url: change.url, s3Key: null };
+    case "upload":
+      if (uploadedKey === void 0) {
+        throw new Error(
+          `Missing uploaded S3 key for the ${variant} logo; expected the upload step to run before building the update body.`
+        );
+      }
+      return { url: null, s3Key: uploadedKey };
+  }
+}
+function buildOrgUpdateBody(plan, uploaded) {
+  const body = {};
+  if (plan.homepageUrl !== void 0) {
+    body.homepageUrl = plan.homepageUrl;
+  }
+  if (plan.logo !== void 0) {
+    const fields = slotFields(plan.logo, uploaded.light, "light");
+    body.logoUrl = fields.url;
+    body.logoS3Key = fields.s3Key;
+  }
+  if (plan.darkLogo !== void 0) {
+    const fields = slotFields(plan.darkLogo, uploaded.dark, "dark");
+    body.darkModeLogoUrl = fields.url;
+    body.darkModeLogoS3Key = fields.s3Key;
+  }
+  return body;
+}
+function isEmptyOrgUpdate(body) {
+  return Object.keys(body).length === 0;
+}
+var MAX_DISPLAY_URL_LENGTH = 120;
+function formatUrlForDisplay(url2) {
+  if (url2 === null) {
+    return "\u2014";
+  }
+  const clean = sanitizeDisplay(url2);
+  return clean.length > MAX_DISPLAY_URL_LENGTH ? `${clean.slice(0, MAX_DISPLAY_URL_LENGTH - 1)}\u2026` : clean;
+}
+function failOrgOp(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Updating organization settings requires an organization admin signed in with a browser session (API keys are rejected)."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "Organization not found."));
+    process.exit(1);
+  }
+  if (status === 400 || status === 422) {
+    console.error(colorError(message ?? `Failed to ${action} (status ${status}).`));
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+async function uploadLogo(organizationId, variant, file2) {
+  const slot = await authenticatedRequest(
+    (client) => client.organization.generateLogoUploadUrl({
+      params: { organizationId },
+      body: { variant, contentType: file2.contentType, fileName: basename(file2.path) }
+    })
+  );
+  if (slot.status !== SUCCESS_STATUS) {
+    failOrgOp(`start the ${variant} logo upload`, slot.status, slot.body);
+  }
+  const bytes = readFileSync2(file2.path);
+  const put = await fetch(slot.body.uploadUrl, {
+    method: "PUT",
+    body: new Uint8Array(bytes),
+    headers: { "Content-Type": file2.contentType }
+  });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload of the ${variant} logo to storage failed (status ${put.status}). The upload link is short-lived; re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  return slot.body.s3Key;
+}
+function outputOrganization(org, output, derived) {
+  if (output === "json") {
+    console.log(JSON.stringify(org, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log("name	slug	homepageUrl	logoUrl	darkModeLogoUrl");
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(org.name)),
+        tsvSafe(sanitizeDisplay(org.slug)),
+        tsvSafe(sanitizeDisplay(org.homepageUrl ?? "")),
+        tsvSafe(sanitizeDisplay(org.logoUrl ?? "")),
+        tsvSafe(sanitizeDisplay(org.darkModeLogoUrl ?? ""))
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(`Updated organization ${sanitizeDisplay(org.name)} (${sanitizeDisplay(org.slug)})`)
+  );
+  if (derived) {
+    console.log("  Logos fetched from the homepage.");
+  }
+  console.log(`  Homepage:   ${formatUrlForDisplay(org.homepageUrl)}`);
+  console.log(`  Light logo: ${formatUrlForDisplay(org.logoUrl)}`);
+  console.log(`  Dark logo:  ${formatUrlForDisplay(org.darkModeLogoUrl)}`);
+}
+async function runUpdate2(options) {
+  const output = parseOutput(options.output);
+  const planned = planOrgUpdate(options);
+  if ("error" in planned) {
+    console.error(colorError(planned.error));
+    process.exit(1);
+  }
+  const { plan } = planned;
+  const organizationId = await resolveOrganizationId();
+  const uploaded = {};
+  if (plan.logo?.action === "upload") {
+    uploaded.light = await uploadLogo(organizationId, "light", plan.logo.file);
+  }
+  if (plan.darkLogo?.action === "upload") {
+    uploaded.dark = await uploadLogo(organizationId, "dark", plan.darkLogo.file);
+  }
+  let org = null;
+  const body = buildOrgUpdateBody(plan, uploaded);
+  if (!isEmptyOrgUpdate(body)) {
+    const result = await authenticatedRequest(
+      (client) => client.organization.updateOrganization({ params: { organizationId }, body })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      failOrgOp("update organization settings", result.status, result.body);
+    }
+    org = result.body;
+  }
+  if (plan.deriveLogosFromHomepage) {
+    const result = await authenticatedRequest(
+      (client) => client.organization.deriveLogosFromHomepage({ params: { organizationId }, body: {} })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      failOrgOp("fetch logos from the homepage", result.status, result.body);
+    }
+    org = result.body;
+  }
+  if (org === null) {
+    throw new Error("Organization update produced no response; expected at least one API call.");
+  }
+  outputOrganization(org, output, plan.deriveLogosFromHomepage);
+}
+function createOrgUpdateCommand() {
+  return new Command("update").description("Update the active organization's homepage URL and logos").option("--homepage <url>", "Homepage URL (https://...)").option("--clear-homepage", "Remove the homepage URL").option("--logo <file-or-url>", "Light-mode logo: an image file to upload, or an http(s) URL").option("--clear-logo", "Remove the light-mode logo").option(
+    "--dark-logo <file-or-url>",
+    "Dark-mode logo: an image file to upload, or an http(s) URL"
+  ).option("--clear-dark-logo", "Remove the dark-mode logo").option(
+    "--logos-from-homepage",
+    "Fetch light and dark logos from the homepage (after saving --homepage, if given)"
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Requires an organization admin signed in with \`tracecli auth login\`; API keys
+are rejected. Logo files upload straight to storage (.png, .jpg, .jpeg, .gif,
+.svg, .webp; 2 MB max). Saving a file or URL for a slot replaces whatever that
+slot held before.
+
+Examples:
+  tracecli org update --homepage https://acme.com
+  tracecli org update --homepage https://acme.com --logos-from-homepage
+  tracecli org update --logo ./logo.svg --dark-logo ./logo-dark.svg
+  tracecli org update --logo https://cdn.acme.com/logo.png
+  tracecli org update --clear-dark-logo
+  tracecli org update --homepage https://acme.com --output json`
+  ).action(async (options) => {
+    await runUpdate2(options);
+  });
+}
+
 // src/auth/commands.ts
 function getClientId() {
   const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
@@ -42361,10 +42675,13 @@ Examples:
   });
 }
 function createOrgCommand() {
-  const org = new Command("org").description("Manage active organization context");
+  const org = new Command("org").description(
+    "Manage active organization context and organization settings"
+  );
   org.addCommand(createOrgListCommand());
   org.addCommand(createOrgCurrentCommand());
   org.addCommand(createOrgSwitchCommand());
+  org.addCommand(createOrgUpdateCommand());
   return org;
 }
 function createAuthCommand() {
@@ -43429,7 +43746,7 @@ function createInboxCommand() {
 }
 
 // src/secret-input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 var SecretInputError = class extends Error {
 };
 function secretSourceCount(opts) {
@@ -43464,7 +43781,7 @@ async function resolveSecret(label, flagBase, opts, readStdin = defaultReadStdin
   if (opts.file !== void 0) {
     let contents;
     try {
-      contents = readFileSync2(opts.file, "utf8");
+      contents = readFileSync3(opts.file, "utf8");
     } catch {
       throw new SecretInputError(`Could not read ${label} file: ${opts.file}`);
     }
@@ -44050,7 +44367,7 @@ async function runGet2(credentialId, options) {
   }
   outputCredential(result.body, output);
 }
-async function runUpdate2(credentialId, options) {
+async function runUpdate3(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
@@ -44302,7 +44619,7 @@ Examples:
   tracecli credential update <id> --env <envId> --clear-auth-config`
   );
   return command.action(async (credentialId, options) => {
-    await runUpdate2(credentialId, options);
+    await runUpdate3(credentialId, options);
   });
 }
 function createDeleteCommand3() {
@@ -44791,7 +45108,7 @@ async function runGet3(environmentId, options) {
   }
   outputEnvironment(result.body, output);
 }
-async function runUpdate3(environmentId, options) {
+async function runUpdate4(environmentId, options) {
   const output = parseOutput(options.output);
   requireAppId(options.app);
   requireEnvId2(environmentId);
@@ -44902,7 +45219,7 @@ Examples:
   tracecli environment update <envId> --app <appId> --additional-url https://api.acme.com
   tracecli environment update <envId> --app <appId> --production`
   ).action(async (environmentId, options) => {
-    await runUpdate3(environmentId, options);
+    await runUpdate4(environmentId, options);
   });
 }
 function createDeleteCommand4() {
@@ -44921,7 +45238,7 @@ function createEnvironmentCommand() {
 }
 
 // src/metadata.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_PACKAGE_NAME = "securewithtrace";
@@ -44930,7 +45247,7 @@ function readPackageMetadata() {
   const currentFilePath = fileURLToPath(import.meta.url);
   const packageJsonPath = join5(dirname2(currentFilePath), "..", "package.json");
   try {
-    const rawPackageJson = readFileSync3(packageJsonPath, "utf-8");
+    const rawPackageJson = readFileSync4(packageJsonPath, "utf-8");
     const parsed = JSON.parse(rawPackageJson);
     if (typeof parsed !== "object" || parsed === null) {
       return { name: DEFAULT_PACKAGE_NAME, version: DEFAULT_VERSION };
@@ -44948,10 +45265,10 @@ var CLI_PACKAGE_NAME = packageMetadata.name;
 var CLI_VERSION = packageMetadata.version;
 
 // src/pentest/commands.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/pentest/create-finding.ts
-import { readFileSync as readFileSync4, statSync } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 
 // src/pentest/resolve.ts
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -45030,14 +45347,14 @@ function parseCreateFindingJsonFile(raw, sourceLabel) {
 }
 function readUtf8File(path, flag) {
   try {
-    const stats = statSync(path);
+    const stats = statSync2(path);
     if (!stats.isFile()) {
       return { error: `${flag} '${sanitizeDisplay(path)}' is not a regular file.` };
     }
   } catch {
     return { error: `Cannot read ${flag} '${sanitizeDisplay(path)}'.` };
   }
-  const text = readFileSync4(path, "utf8");
+  const text = readFileSync5(path, "utf8");
   if (text.trim().length === 0) {
     return { error: `${flag} '${sanitizeDisplay(path)}' is empty.` };
   }
@@ -45263,8 +45580,8 @@ function createCreateFindingCommand() {
 }
 
 // src/pentest/evidence.ts
-import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { basename } from "path";
+import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { basename as basename2 } from "path";
 var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
 var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
 function isSection(value) {
@@ -45273,7 +45590,7 @@ function isSection(value) {
 function isKind(value) {
   return PentestExploitArtifactKindValues.includes(value);
 }
-function formatBytes(bytes) {
+function formatBytes2(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
@@ -45326,7 +45643,7 @@ async function runAttachEvidence(options) {
   }
   let sizeBytes;
   try {
-    const stats = statSync2(options.file);
+    const stats = statSync3(options.file);
     if (!stats.isFile()) {
       console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
       process.exit(1);
@@ -45343,7 +45660,7 @@ async function runAttachEvidence(options) {
   if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
     console.error(
       colorError(
-        `File is ${formatBytes(sizeBytes)}; the limit for one exhibit is ${formatBytes(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
       )
     );
     process.exit(1);
@@ -45352,7 +45669,7 @@ async function runAttachEvidence(options) {
   const pentestId = await resolvePentestId(organizationId, options.pentest);
   const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
   const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename(options.file);
+  const filename = basename2(options.file);
   const slot = await authenticatedRequest(
     (client) => client.pentestFinding.createFindingEvidenceUpload({
       params,
@@ -45369,7 +45686,7 @@ async function runAttachEvidence(options) {
     );
     process.exit(1);
   }
-  const body = readFileSync5(options.file);
+  const body = readFileSync6(options.file);
   const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
   if (!put.ok) {
     console.error(
@@ -45409,7 +45726,7 @@ async function runAttachEvidence(options) {
   const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
   console.log(
     colorSuccess(
-      `Attached ${attached.body.kind} \xB7 ${formatBytes(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
     )
   );
   console.log(`  artifact ${attached.body.artifactId}`);
@@ -46247,7 +46564,7 @@ function outputPentestUpdate(pt, output) {
   }
   printPentestUpdateDetail(pt);
 }
-async function runUpdate4(pentestIdentifier, options) {
+async function runUpdate5(pentestIdentifier, options) {
   const output = parseOutput(options.output);
   const description = resolveClearableOption(
     options.description,
@@ -46317,7 +46634,7 @@ Examples:
   tracecli pentest update PT-3 --clear-concerns --clear-priorities
   tracecli pentest update PT-3 --title "Acme Q3" -o json`
   ).action(async (pentestId, options) => {
-    await runUpdate4(pentestId, options);
+    await runUpdate5(pentestId, options);
   });
 }
 function failQuestionnaire(status, body, action, notFoundLabel) {
@@ -46508,7 +46825,7 @@ async function runQuestionnaire(pentestIdentifier, options) {
   if (filePath !== void 0) {
     let raw;
     try {
-      raw = readFileSync6(filePath, "utf8");
+      raw = readFileSync7(filePath, "utf8");
     } catch {
       console.error(colorError(`Could not read answers file: ${filePath}`));
       process.exit(1);
@@ -46592,7 +46909,7 @@ function createPentestCommand() {
 }
 
 // src/update/commands.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname3, join as join6 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -46610,7 +46927,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync7(cachePath, "utf-8");
+    const rawCache = readFileSync8(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -46976,9 +47293,9 @@ Examples:
 
 // src/upload/prepare.ts
 import { createHash } from "crypto";
-import { createReadStream, statSync as statSync3 } from "fs";
+import { createReadStream, statSync as statSync4 } from "fs";
 import { open } from "fs/promises";
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 var CodeUploadPrepareError = class extends Error {
   constructor(message) {
     super(message);
@@ -47077,7 +47394,7 @@ function assertPreparedMatchesUpload(upload, prepared) {
 async function prepareUploadFile(filePath, options = {}) {
   let sizeBytes;
   try {
-    const stats = statSync3(filePath);
+    const stats = statSync4(filePath);
     if (!stats.isFile()) {
       throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
     }
@@ -47092,7 +47409,7 @@ async function prepareUploadFile(filePath, options = {}) {
   if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
     throw new CodeUploadPrepareError(archiveTooLargeMessage());
   }
-  const originalFilename = basename2(filePath);
+  const originalFilename = basename3(filePath);
   const inferred = inferArtifactKindFromFilename(originalFilename);
   const artifactKind = options.artifactKind ?? inferred;
   if (artifactKind == null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.39.0",
+  "version": "0.40.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {