securewithtrace 0.7.1 → 0.9.0

package/dist/index.js

@@ -3410,37 +3410,110 @@ async function pollForToken(clientId, deviceCode, options = {}) {
   }
   throw new Error("Authorization timed out. Please try again.");
 }
+async function refreshAccessToken(clientId, refreshToken) {
+  const response = await fetch(WORKOS_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Failed to refresh token: ${response.status} ${text}`);
+  }
+  return await response.json();
+}
 
 // src/auth/token.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-var TRACE_DIR = join(homedir(), ".trace");
-var TOKEN_PATH = join(TRACE_DIR, "token");
+var ACCESS_TOKEN_FILENAME = "token";
+var REFRESH_TOKEN_FILENAME = "refresh-token";
+function resolveTraceDir() {
+  const override = process.env["TRACE_CLI_AUTH_DIR"];
+  if (override && override.trim().length > 0) {
+    return override;
+  }
+  return join(homedir(), ".trace");
+}
+function ensureTraceDir() {
+  const traceDir = resolveTraceDir();
+  if (!existsSync(traceDir)) {
+    mkdirSync(traceDir, { recursive: true, mode: 448 });
+  }
+}
+function getTokenPath() {
+  return join(resolveTraceDir(), ACCESS_TOKEN_FILENAME);
+}
+function getRefreshTokenPath() {
+  return join(resolveTraceDir(), REFRESH_TOKEN_FILENAME);
+}
 function readToken() {
+  const tokenPath = getTokenPath();
   try {
-    if (!existsSync(TOKEN_PATH)) {
+    if (!existsSync(tokenPath)) {
       return null;
     }
-    const token = readFileSync(TOKEN_PATH, "utf-8").trim();
+    const token = readFileSync(tokenPath, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function readRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
+  try {
+    if (!existsSync(refreshTokenPath)) {
+      return null;
+    }
+    const token = readFileSync(refreshTokenPath, "utf-8").trim();
     return token || null;
   } catch {
     return null;
   }
 }
 function writeToken(token) {
-  if (!existsSync(TRACE_DIR)) {
-    mkdirSync(TRACE_DIR, { recursive: true, mode: 448 });
+  ensureTraceDir();
+  writeFileSync(getTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeRefreshToken(token) {
+  ensureTraceDir();
+  writeFileSync(getRefreshTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeTokens(accessToken, refreshToken) {
+  writeToken(accessToken);
+  if (refreshToken && refreshToken.trim().length > 0) {
+    writeRefreshToken(refreshToken);
+    return;
   }
-  writeFileSync(TOKEN_PATH, token, { encoding: "utf-8", mode: 384 });
+  removeRefreshToken();
 }
-function removeToken() {
-  if (!existsSync(TOKEN_PATH)) {
+function removeRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
+  if (!existsSync(refreshTokenPath)) {
     return false;
   }
-  rmSync(TOKEN_PATH);
+  rmSync(refreshTokenPath);
   return true;
 }
+function removeToken() {
+  let removed = false;
+  const tokenPath = getTokenPath();
+  if (existsSync(tokenPath)) {
+    rmSync(tokenPath);
+    removed = true;
+  }
+  if (removeRefreshToken()) {
+    removed = true;
+  }
+  return removed;
+}
 
 // src/auth/commands.ts
 function getClientId() {
@@ -3501,12 +3574,12 @@ function createLoginCommand() {
       expiresIn: auth.expires_in,
       interval: auth.interval
     });
-    writeToken(tokenResponse.access_token);
+    writeTokens(tokenResponse.access_token, tokenResponse.refresh_token);
     const name = [tokenResponse.user.first_name, tokenResponse.user.last_name].filter(Boolean).join(" ");
     const displayName = name || tokenResponse.user.email;
     console.log(`
 Authenticated as ${displayName} (${tokenResponse.user.email})`);
-    console.log("Token saved to ~/.trace/token");
+    console.log("Tokens saved to ~/.trace");
   });
 }
 function createLogoutCommand() {
@@ -3522,6 +3595,7 @@ function createLogoutCommand() {
 function createStatusCommand() {
   return new Command("status").description("Show current authentication status").action(() => {
     const token = readToken();
+    const refreshToken = readRefreshToken();
     if (token) {
       try {
         const parts = token.split(".");
@@ -3540,16 +3614,31 @@ function createStatusCommand() {
           if (expiry) {
             console.log(`  Expires: ${expiry.toISOString()}${isExpired ? " (EXPIRED)" : ""}`);
           }
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
           if (isExpired) {
-            console.log(
-              "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
-            );
+            if (refreshToken) {
+              console.log(
+                "\nYour access token is expired, but a refresh token is available and will be used automatically."
+              );
+            } else {
+              console.log(
+                "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
+              );
+            }
           }
         } else {
-          console.log("Logged in to Trace (token stored at ~/.trace/token)");
+          console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
         }
       } catch {
-        console.log("Logged in to Trace (token stored at ~/.trace/token)");
+        console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+        console.log(
+          `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+        );
       }
     } else {
       console.log("Not logged in. Run `trace auth login` to authenticate.");
@@ -3593,7 +3682,7 @@ function extractCommandTree(cmd) {
     description: o.description,
     takesValue: o.required || o.optional
   }));
-  const subcommands = cmd.commands.filter((c21) => !c21._hidden).map((c21) => extractCommandTree(c21));
+  const subcommands = cmd.commands.filter((c24) => !c24._hidden).map((c24) => extractCommandTree(c24));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -3659,7 +3748,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c21) => c21.name);
+  const subcommandNames = tree.subcommands.map((c24) => c24.name);
   const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -3848,7 +3937,7 @@ function generateCompletion(program3, shell, binName) {
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-var TRACE_DIR2 = ".trace";
+var TRACE_DIR = ".trace";
 function completionFileName(shell) {
   switch (shell) {
     case "bash":
@@ -3860,7 +3949,7 @@ function completionFileName(shell) {
   }
 }
 function getTraceDir() {
-  return join2(homedir2(), TRACE_DIR2);
+  return join2(homedir2(), TRACE_DIR);
 }
 function getCompletionFilePath(shell) {
   return join2(getTraceDir(), completionFileName(shell));
@@ -3875,7 +3964,7 @@ function writeCompletionFile(shell, script) {
   return filePath;
 }
 function getSetupInstructions(shell) {
-  const traceDir = `~/${TRACE_DIR2}`;
+  const traceDir = `~/${TRACE_DIR}`;
   switch (shell) {
     case "bash":
       return [
@@ -3946,11 +4035,6 @@ function createCompletionCommand(program3) {
   });
 }
 
-// src/repo/commands.ts
-import { chmodSync, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
-
 // ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
 var util;
 (function(util2) {
@@ -10719,7 +10803,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c21) => c21 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c24) => c24 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -20763,9 +20847,9 @@ var ZodDate2 = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c21 = inst._zod.bag;
-  inst.minDate = c21.minimum ? new Date(c21.minimum) : null;
-  inst.maxDate = c21.maximum ? new Date(c21.maximum) : null;
+  const c24 = inst._zod.bag;
+  inst.minDate = c24.minimum ? new Date(c24.minimum) : null;
+  inst.maxDate = c24.maximum ? new Date(c24.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate2, params);
@@ -22887,19 +22971,51 @@ var llmProviderKeyContract = c7.router({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/organization.api.ts
+var OrgCapabilityValues = [
+  "PENTEST",
+  "SCAN_SAST",
+  "SCAN_SCA",
+  "SCAN_SECRETS",
+  "SCAN_DAST",
+  "AUTO_PR_SCANS",
+  "AUTO_PUSH_SCANS"
+];
 var UpdateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(255).optional(),
-  logoUrl: external_exports.string().url().max(2048).nullish()
+  logoUrl: external_exports.string().url().max(2048).nullish(),
+  logoS3Key: external_exports.string().max(1024).nullish(),
+  darkModeLogoUrl: external_exports.string().url().max(2048).nullish(),
+  darkModeLogoS3Key: external_exports.string().max(1024).nullish()
+});
+var LogoUploadRequestSchema = external_exports.object({
+  variant: external_exports.enum(["light", "dark"]),
+  contentType: external_exports.enum(["image/png", "image/jpeg", "image/gif", "image/svg+xml", "image/webp"]),
+  fileName: external_exports.string().min(1).max(255)
+});
+var LogoUploadResponseSchema = external_exports.object({
+  uploadUrl: external_exports.string(),
+  s3Key: external_exports.string()
+});
+var PatchCapabilitiesRequestSchema = external_exports.object({
+  capabilities: external_exports.array(external_exports.enum(OrgCapabilityValues)).min(1)
+});
+var PatchCapabilitiesResponseSchema = external_exports.object({
+  capabilities: external_exports.array(external_exports.enum(OrgCapabilityValues))
 });
 var OrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   name: external_exports.string(),
   slug: external_exports.string(),
   logoUrl: external_exports.string().nullable(),
+  darkModeLogoUrl: external_exports.string().nullable(),
+  capabilities: external_exports.array(external_exports.enum(OrgCapabilityValues)),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
 var ListOrganizationsResponseSchema = external_exports.array(OrganizationResponseSchema);
+var LogoDeleteRequestSchema = external_exports.object({
+  variant: external_exports.enum(["light", "dark"])
+});
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
 var c8 = initContract();
@@ -22951,103 +23067,167 @@ var organizationContract = c8.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  patchCapabilities: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/capabilities",
+    pathParams: OrgIdParamsSchema,
+    body: PatchCapabilitiesRequestSchema,
+    responses: {
+      200: PatchCapabilitiesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  generateLogoUploadUrl: {
+    method: "POST",
+    path: "/organizations/:organizationId/logo-upload-url",
+    pathParams: OrgIdParamsSchema,
+    body: LogoUploadRequestSchema,
+    responses: {
+      200: LogoUploadResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
-var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET"];
-var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
-var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
-  repositoryId: external_exports.uuid()
-});
-var CreateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  defaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var UpdateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url().optional(),
-  platform: external_exports.enum(PlatformValues).optional(),
-  defaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
+// ../../packages/api-contracts/src/schemas/domain/pentest.schema.ts
+var PentestStatusValues = ["SCOPING", "IN_PROGRESS", "REMEDIATION", "CLOSED"];
+var PentestStatus = external_exports.enum(PentestStatusValues);
+var PentestFindingStatusValues = [
+  "OPEN",
+  "CONTESTED",
+  "REMEDIATED",
+  "VERIFIED_FIXED",
+  "VERIFIED_OPEN"
+];
+var PentestFindingStatus = external_exports.enum(PentestFindingStatusValues);
+var PentestFindingSeverityValues = [
+  "INFORMATIONAL",
+  "LOW",
+  "MEDIUM",
+  "HIGH",
+  "CRITICAL"
+];
+var PentestFindingSeverity = external_exports.enum(PentestFindingSeverityValues);
+var ContestReasonValues = [
+  "FALSE_POSITIVE",
+  "ACCEPTED_RISK",
+  "MITIGATING_CONTROLS",
+  "OUT_OF_SCOPE",
+  "DUPLICATE",
+  "OTHER"
+];
+var ContestReason = external_exports.enum(ContestReasonValues);
+var RetestOutcomeValues = ["FIXED", "PARTIALLY_FIXED", "NOT_FIXED"];
+var RetestOutcome = external_exports.enum(RetestOutcomeValues);
+
+// ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
+var PentestIdParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: external_exports.uuid()
 });
-var RepositoryResponseSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
+var PentestResponseSchema = external_exports.object({
+  pentestId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  status: external_exports.enum(RepositoryStatusValues),
-  defaultBranch: external_exports.string(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
-var CloneTokenRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.string().url()
+  displayId: external_exports.number(),
+  title: external_exports.string(),
+  description: external_exports.string().nullable(),
+  status: PentestStatus,
+  scope: external_exports.string().nullable(),
+  startedAt: external_exports.coerce.date().nullable(),
+  endedAt: external_exports.coerce.date().nullable(),
+  createdById: external_exports.uuid(),
+  createdByName: external_exports.string(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date(),
+  findingCounts: external_exports.object({
+    total: external_exports.number(),
+    bySeverity: external_exports.record(PentestFindingSeverity, external_exports.number()),
+    byStatus: external_exports.record(PentestFindingStatus, external_exports.number())
+  })
 });
-var CloneTokenResponseSchema = external_exports.object({
-  token: external_exports.string(),
-  expiresAt: external_exports.string().datetime()
+var ListPentestsResponseSchema = external_exports.array(PentestResponseSchema);
+var CreatePentestRequestSchema = external_exports.object({
+  title: external_exports.string().min(1).max(500),
+  description: external_exports.string().max(1e4).optional(),
+  scope: external_exports.string().max(5e4).optional(),
+  status: PentestStatus.optional(),
+  startedAt: external_exports.coerce.date().optional(),
+  endedAt: external_exports.coerce.date().optional()
+});
+var UpdatePentestRequestSchema = external_exports.object({
+  title: external_exports.string().min(1).max(500).optional(),
+  description: external_exports.string().max(1e4).nullable().optional(),
+  status: PentestStatus.optional(),
+  scope: external_exports.string().max(5e4).nullable().optional(),
+  startedAt: external_exports.coerce.date().nullable().optional(),
+  endedAt: external_exports.coerce.date().nullable().optional()
 });
 
-// ../../packages/api-contracts/src/contracts/v1/repository.ts
+// ../../packages/api-contracts/src/contracts/v1/pentest.ts
 var c9 = initContract();
-var repositoryContract = c9.router({
-  createRepository: {
-    method: "POST",
-    path: "/organizations/:organizationId/repositories",
+var pentestContract = c9.router({
+  listPentests: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests",
     pathParams: OrgIdParamsSchema,
-    body: CreateRepositoryRequestSchema,
     responses: {
-      201: RepositoryResponseSchema,
+      200: ListPentestsResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  listRepositories: {
-    method: "GET",
-    path: "/organizations/:organizationId/repositories",
+  createPentest: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests",
     pathParams: OrgIdParamsSchema,
+    body: CreatePentestRequestSchema,
     responses: {
-      200: ListRepositoriesResponseSchema,
+      201: PentestResponseSchema,
+      400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  getRepository: {
+  getPentest: {
     method: "GET",
-    path: "/organizations/:organizationId/repositories/:repositoryId",
-    pathParams: RepositoryIdParamsSchema,
+    path: "/organizations/:organizationId/pentests/:pentestId",
+    pathParams: PentestIdParamsSchema,
     responses: {
-      200: RepositoryResponseSchema,
+      200: PentestResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  updateRepository: {
-    method: "PUT",
-    path: "/organizations/:organizationId/repositories/:repositoryId",
-    pathParams: RepositoryIdParamsSchema,
-    body: UpdateRepositoryRequestSchema,
+  updatePentest: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId",
+    pathParams: PentestIdParamsSchema,
+    body: UpdatePentestRequestSchema,
     responses: {
-      200: RepositoryResponseSchema,
+      200: PentestResponseSchema,
+      400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  deleteRepository: {
+  deletePentest: {
     method: "DELETE",
-    path: "/organizations/:organizationId/repositories/:repositoryId",
-    pathParams: RepositoryIdParamsSchema,
+    path: "/organizations/:organizationId/pentests/:pentestId",
+    pathParams: PentestIdParamsSchema,
     responses: {
       204: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -23055,135 +23235,612 @@ var repositoryContract = c9.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
-  },
-  getCloneToken: {
-    method: "POST",
-    path: "/organizations/:organizationId/repositories/clone-token",
-    pathParams: OrgIdParamsSchema,
-    body: CloneTokenRequestSchema,
-    responses: {
-      200: CloneTokenResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
   }
 });
 
-// ../../packages/api-contracts/src/schemas/domain/scan.schema.ts
-var ScanStatusValues = [
-  "PENDING",
-  "QUEUED",
-  "RUNNING",
-  "COMPLETED",
-  "FAILED",
-  "CANCELLED"
-];
-var ScanStatus = external_exports.enum(ScanStatusValues);
-var ScanModeValues = ["DAST", "SAST", "SCA", "SECRETS"];
-var ScanMode = external_exports.enum(ScanModeValues);
-var ScanTypeValues = ["FULL", "INCREMENTAL", "RETEST"];
-var ScanType = external_exports.enum(ScanTypeValues);
-var CancellationReasonValues = ["USER_ABORTED", "SUPERSEDED"];
-var CancellationReason = external_exports.enum(CancellationReasonValues);
-var ScanTriggerTypeValues = [
-  "MANUAL",
-  "PUSH",
-  "PULL_REQUEST",
-  "RETEST",
-  "SCHEDULED"
-];
-var ScanTriggerType = external_exports.enum(ScanTriggerTypeValues);
-
-// ../../packages/api-contracts/src/schemas/api/v1/scan.api.ts
-var ScanIdParamsSchema = OrgIdParamsSchema.extend({
-  scanId: external_exports.uuid()
-});
-var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
-  external_exports.object({
-    scanMode: external_exports.literal("DAST"),
-    webApplicationId: external_exports.uuid(),
-    targetUrl: external_exports.url(),
-    userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  }),
-  external_exports.object({
-    scanMode: external_exports.literal("SAST"),
-    repositoryId: external_exports.uuid(),
-    branch: external_exports.string().optional(),
-    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
-    userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  }),
-  external_exports.object({
-    scanMode: external_exports.literal("SCA"),
-    repositoryId: external_exports.uuid(),
-    branch: external_exports.string().optional(),
-    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
-    userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  }),
-  external_exports.object({
-    scanMode: external_exports.literal("SECRETS"),
-    repositoryId: external_exports.uuid(),
-    branch: external_exports.string().optional(),
-    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
-    userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-  })
-]);
-var ScanResponseSchema = external_exports.object({
-  scanId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  initiatedById: external_exports.uuid(),
-  initiatedByName: external_exports.string().nullable(),
-  initiatedByProfilePictureUrl: external_exports.string().nullable(),
-  scanMode: ScanMode,
-  scanType: external_exports.enum(ScanTypeValues),
-  webApplicationId: external_exports.uuid().nullable(),
-  targetUrl: external_exports.string().nullable(),
-  repositoryId: external_exports.uuid().nullable(),
-  branch: external_exports.string().nullable(),
-  status: external_exports.enum(ScanStatusValues),
-  cancellationReason: external_exports.enum(CancellationReasonValues).nullable(),
-  errorMessage: external_exports.string().nullable(),
-  userProvidedContext: external_exports.string().nullable(),
-  scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
-  triggerType: external_exports.enum(ScanTriggerTypeValues).nullable(),
-  triggerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
-  startedAt: external_exports.date().nullable(),
-  completedAt: external_exports.date().nullable(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-finding.api.ts
+var PentestFindingParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: external_exports.uuid()
 });
-var ListScansQuerySchema = external_exports.object({
-  status: external_exports.enum(ScanStatusValues).array().or(external_exports.enum(ScanStatusValues)).optional()
+var PentestFindingIdParamsSchema = PentestFindingParamsSchema.extend({
+  pentestFindingId: external_exports.uuid()
 });
-var ListScansResponseSchema = external_exports.array(ScanResponseSchema);
-var CancelScanResponseSchema = external_exports.object({
-  scanId: external_exports.uuid(),
-  status: external_exports.literal("CANCELLED")
+var PentestFindingContestIdParamsSchema = PentestFindingIdParamsSchema.extend({
+  contestId: external_exports.uuid()
 });
-
-// ../../packages/api-contracts/src/schemas/api/v1/scan-log.api.ts
-var ScanLogQuerySchema = external_exports.object({
-  offset: external_exports.coerce.number().int().min(0).optional()
+var PentestFindingRetestIdParamsSchema = PentestFindingIdParamsSchema.extend({
+  retestId: external_exports.uuid()
 });
-var ScanLogEntrySchema = external_exports.object({
-  timestamp: external_exports.string(),
-  level: external_exports.enum(["INFO", "WARN", "ERROR"]),
-  message: external_exports.string(),
-  phase: external_exports.string().nullable()
+var PentestFindingNoteIdParamsSchema = PentestFindingIdParamsSchema.extend({
+  noteId: external_exports.uuid()
 });
-var ListScanLogsResponseSchema = external_exports.object({
-  logs: external_exports.array(ScanLogEntrySchema),
-  nextOffset: external_exports.number()
+var PentestFindingRepositorySchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  repositoryName: external_exports.string(),
+  commitSha: external_exports.string().nullable(),
+  filePath: external_exports.string().nullable(),
+  startLine: external_exports.number().nullable(),
+  endLine: external_exports.number().nullable()
 });
-
+var PentestFindingResponseSchema = external_exports.object({
+  pentestFindingId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  displayId: external_exports.number(),
+  title: external_exports.string(),
+  description: external_exports.string(),
+  severity: PentestFindingSeverity,
+  category: external_exports.string(),
+  status: PentestFindingStatus,
+  cweIds: external_exports.array(external_exports.string()),
+  cvssVector: external_exports.string().nullable(),
+  cvssScore: external_exports.number().nullable(),
+  owaspCategory: external_exports.string().nullable(),
+  publishedAt: external_exports.coerce.date().nullable(),
+  createdById: external_exports.uuid(),
+  createdByName: external_exports.string(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date(),
+  repositories: external_exports.array(PentestFindingRepositorySchema)
+});
+var ListPentestFindingsResponseSchema = external_exports.array(PentestFindingResponseSchema);
+var CreatePentestFindingRequestSchema = external_exports.object({
+  title: external_exports.string().min(1).max(500),
+  description: external_exports.string().min(1).max(5e4),
+  severity: PentestFindingSeverity,
+  category: external_exports.string().min(1).max(200),
+  status: PentestFindingStatus.optional(),
+  cweIds: external_exports.array(external_exports.string()).optional(),
+  cvssVector: external_exports.string().max(200).optional(),
+  cvssScore: external_exports.number().min(0).max(10).optional(),
+  owaspCategory: external_exports.string().max(200).optional(),
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      commitSha: external_exports.string().optional(),
+      filePath: external_exports.string().optional(),
+      startLine: external_exports.number().int().optional(),
+      endLine: external_exports.number().int().optional()
+    })
+  ).optional()
+});
+var UpdatePentestFindingRequestSchema = external_exports.object({
+  title: external_exports.string().min(1).max(500).optional(),
+  description: external_exports.string().min(1).max(5e4).optional(),
+  severity: PentestFindingSeverity.optional(),
+  category: external_exports.string().min(1).max(200).optional(),
+  status: PentestFindingStatus.optional(),
+  cweIds: external_exports.array(external_exports.string()).optional(),
+  cvssVector: external_exports.string().max(200).nullable().optional(),
+  cvssScore: external_exports.number().min(0).max(10).nullable().optional(),
+  owaspCategory: external_exports.string().max(200).nullable().optional(),
+  publishedAt: external_exports.coerce.date().nullable().optional(),
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      commitSha: external_exports.string().optional(),
+      filePath: external_exports.string().optional(),
+      startLine: external_exports.number().int().optional(),
+      endLine: external_exports.number().int().optional()
+    })
+  ).optional()
+});
+var PentestFindingContestResponseSchema = external_exports.object({
+  contestId: external_exports.uuid(),
+  pentestFindingId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  reason: ContestReason,
+  justification: external_exports.string(),
+  contestedById: external_exports.uuid(),
+  contestedByName: external_exports.string(),
+  contestedAt: external_exports.coerce.date(),
+  resolution: external_exports.string().nullable(),
+  resolvedById: external_exports.uuid().nullable(),
+  resolvedByName: external_exports.string().nullable(),
+  resolvedAt: external_exports.coerce.date().nullable()
+});
+var ListPentestFindingContestsResponseSchema = external_exports.array(
+  PentestFindingContestResponseSchema
+);
+var CreatePentestFindingContestRequestSchema = external_exports.object({
+  reason: ContestReason,
+  justification: external_exports.string().min(1).max(1e4)
+});
+var ResolvePentestFindingContestRequestSchema = external_exports.object({
+  resolution: external_exports.string().min(1).max(1e4)
+});
+var PentestFindingRetestResponseSchema = external_exports.object({
+  retestId: external_exports.uuid(),
+  pentestFindingId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  outcome: RetestOutcome,
+  notes: external_exports.string().nullable(),
+  testedById: external_exports.uuid(),
+  testedByName: external_exports.string(),
+  testedAt: external_exports.coerce.date()
+});
+var ListPentestFindingRetestsResponseSchema = external_exports.array(PentestFindingRetestResponseSchema);
+var CreatePentestFindingRetestRequestSchema = external_exports.object({
+  outcome: RetestOutcome,
+  notes: external_exports.string().max(1e4).optional()
+});
+var PentestFindingNoteResponseSchema = external_exports.object({
+  noteId: external_exports.uuid(),
+  pentestFindingId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  authorId: external_exports.uuid(),
+  authorName: external_exports.string(),
+  content: external_exports.string(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var ListPentestFindingNotesResponseSchema = external_exports.array(PentestFindingNoteResponseSchema);
+var CreatePentestFindingNoteRequestSchema = external_exports.object({
+  content: external_exports.string().min(1).max(1e4)
+});
+var UpdatePentestFindingNoteRequestSchema = external_exports.object({
+  content: external_exports.string().min(1).max(1e4)
+});
+var ParseFindingMarkdownRequestSchema = external_exports.object({
+  markdown: external_exports.string().min(1).max(1e5)
+});
+var ParseFindingMarkdownResponseSchema = external_exports.object({
+  title: external_exports.string(),
+  description: external_exports.string(),
+  severity: PentestFindingSeverity,
+  category: external_exports.string(),
+  status: PentestFindingStatus,
+  cweIds: external_exports.array(external_exports.string()),
+  cvssVector: external_exports.string().nullable(),
+  cvssScore: external_exports.number().nullable(),
+  owaspCategory: external_exports.string().nullable()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
+var c10 = initContract();
+var pentestFindingContract = c10.router({
+  // ─── Findings ───
+  listFindings: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings",
+    pathParams: PentestFindingParamsSchema,
+    responses: {
+      200: ListPentestFindingsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createFinding: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings",
+    pathParams: PentestFindingParamsSchema,
+    body: CreatePentestFindingRequestSchema,
+    responses: {
+      201: PentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getFinding: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId",
+    pathParams: PentestFindingIdParamsSchema,
+    responses: {
+      200: PentestFindingResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateFinding: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId",
+    pathParams: PentestFindingIdParamsSchema,
+    body: UpdatePentestFindingRequestSchema,
+    responses: {
+      200: PentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteFinding: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId",
+    pathParams: PentestFindingIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // ─── Contests ───
+  listContests: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/contests",
+    pathParams: PentestFindingIdParamsSchema,
+    responses: {
+      200: ListPentestFindingContestsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createContest: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/contests",
+    pathParams: PentestFindingIdParamsSchema,
+    body: CreatePentestFindingContestRequestSchema,
+    responses: {
+      201: PentestFindingContestResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  resolveContest: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/contests/:contestId",
+    pathParams: PentestFindingContestIdParamsSchema,
+    body: ResolvePentestFindingContestRequestSchema,
+    responses: {
+      200: PentestFindingContestResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // ─── Retests ───
+  listRetests: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/retests",
+    pathParams: PentestFindingIdParamsSchema,
+    responses: {
+      200: ListPentestFindingRetestsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createRetest: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/retests",
+    pathParams: PentestFindingIdParamsSchema,
+    body: CreatePentestFindingRetestRequestSchema,
+    responses: {
+      201: PentestFindingRetestResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // ─── Notes ───
+  listNotes: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/notes",
+    pathParams: PentestFindingIdParamsSchema,
+    responses: {
+      200: ListPentestFindingNotesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createNote: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/notes",
+    pathParams: PentestFindingIdParamsSchema,
+    body: CreatePentestFindingNoteRequestSchema,
+    responses: {
+      201: PentestFindingNoteResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateNote: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/notes/:noteId",
+    pathParams: PentestFindingNoteIdParamsSchema,
+    body: UpdatePentestFindingNoteRequestSchema,
+    responses: {
+      200: PentestFindingNoteResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteNote: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/notes/:noteId",
+    pathParams: PentestFindingNoteIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // ─── AI parsing ───
+  parseFindingMarkdown: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/parse-markdown",
+    pathParams: PentestFindingParamsSchema,
+    body: ParseFindingMarkdownRequestSchema,
+    responses: {
+      200: ParseFindingMarkdownResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
+var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET"];
+var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
+var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
+  repositoryId: external_exports.uuid()
+});
+var CreateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  defaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var UpdateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url().optional(),
+  platform: external_exports.enum(PlatformValues).optional(),
+  defaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var RepositoryResponseSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  status: external_exports.enum(RepositoryStatusValues),
+  defaultBranch: external_exports.string(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var CloneTokenRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.string().url()
+});
+var CloneTokenResponseSchema = external_exports.object({
+  token: external_exports.string(),
+  expiresAt: external_exports.string().datetime()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/repository.ts
+var c11 = initContract();
+var repositoryContract = c11.router({
+  createRepository: {
+    method: "POST",
+    path: "/organizations/:organizationId/repositories",
+    pathParams: OrgIdParamsSchema,
+    body: CreateRepositoryRequestSchema,
+    responses: {
+      201: RepositoryResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  listRepositories: {
+    method: "GET",
+    path: "/organizations/:organizationId/repositories",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: ListRepositoriesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getRepository: {
+    method: "GET",
+    path: "/organizations/:organizationId/repositories/:repositoryId",
+    pathParams: RepositoryIdParamsSchema,
+    responses: {
+      200: RepositoryResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateRepository: {
+    method: "PUT",
+    path: "/organizations/:organizationId/repositories/:repositoryId",
+    pathParams: RepositoryIdParamsSchema,
+    body: UpdateRepositoryRequestSchema,
+    responses: {
+      200: RepositoryResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteRepository: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/repositories/:repositoryId",
+    pathParams: RepositoryIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getCloneToken: {
+    method: "POST",
+    path: "/organizations/:organizationId/repositories/clone-token",
+    pathParams: OrgIdParamsSchema,
+    body: CloneTokenRequestSchema,
+    responses: {
+      200: CloneTokenResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
+// ../../packages/api-contracts/src/schemas/domain/scan.schema.ts
+var ScanStatusValues = [
+  "PENDING",
+  "QUEUED",
+  "RUNNING",
+  "COMPLETED",
+  "FAILED",
+  "CANCELLED"
+];
+var ScanStatus = external_exports.enum(ScanStatusValues);
+var ScanModeValues = ["DAST", "SAST", "SCA", "SECRETS"];
+var ScanMode = external_exports.enum(ScanModeValues);
+var ScanTypeValues = ["FULL", "INCREMENTAL", "RETEST"];
+var ScanType = external_exports.enum(ScanTypeValues);
+var CancellationReasonValues = ["USER_ABORTED", "SUPERSEDED"];
+var CancellationReason = external_exports.enum(CancellationReasonValues);
+var ScanTriggerTypeValues = [
+  "MANUAL",
+  "PUSH",
+  "PULL_REQUEST",
+  "RETEST",
+  "SCHEDULED"
+];
+var ScanTriggerType = external_exports.enum(ScanTriggerTypeValues);
+
+// ../../packages/api-contracts/src/schemas/api/v1/scan.api.ts
+var ScanIdParamsSchema = OrgIdParamsSchema.extend({
+  scanId: external_exports.uuid()
+});
+var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
+  external_exports.object({
+    scanMode: external_exports.literal("DAST"),
+    webApplicationId: external_exports.uuid(),
+    targetUrl: external_exports.url(),
+    userProvidedContext: external_exports.string().optional(),
+    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }),
+  external_exports.object({
+    scanMode: external_exports.literal("SAST"),
+    repositoryId: external_exports.uuid(),
+    branch: external_exports.string().optional(),
+    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
+    userProvidedContext: external_exports.string().optional(),
+    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }),
+  external_exports.object({
+    scanMode: external_exports.literal("SCA"),
+    repositoryId: external_exports.uuid(),
+    branch: external_exports.string().optional(),
+    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
+    userProvidedContext: external_exports.string().optional(),
+    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }),
+  external_exports.object({
+    scanMode: external_exports.literal("SECRETS"),
+    repositoryId: external_exports.uuid(),
+    branch: external_exports.string().optional(),
+    scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
+    userProvidedContext: external_exports.string().optional(),
+    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  })
+]);
+var ScanResponseSchema = external_exports.object({
+  scanId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  initiatedById: external_exports.uuid(),
+  initiatedByName: external_exports.string().nullable(),
+  initiatedByProfilePictureUrl: external_exports.string().nullable(),
+  scanMode: ScanMode,
+  scanType: external_exports.enum(ScanTypeValues),
+  webApplicationId: external_exports.uuid().nullable(),
+  targetUrl: external_exports.string().nullable(),
+  repositoryId: external_exports.uuid().nullable(),
+  branch: external_exports.string().nullable(),
+  status: external_exports.enum(ScanStatusValues),
+  cancellationReason: external_exports.enum(CancellationReasonValues).nullable(),
+  errorMessage: external_exports.string().nullable(),
+  userProvidedContext: external_exports.string().nullable(),
+  scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  triggerType: external_exports.enum(ScanTriggerTypeValues).nullable(),
+  triggerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  startedAt: external_exports.date().nullable(),
+  completedAt: external_exports.date().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListScansQuerySchema = external_exports.object({
+  status: external_exports.enum(ScanStatusValues).array().or(external_exports.enum(ScanStatusValues)).optional(),
+  repositoryId: external_exports.uuid().optional(),
+  page: external_exports.coerce.number().int().min(1).max(1e4).optional(),
+  pageSize: external_exports.coerce.number().int().min(1).max(200).optional()
+});
+var ListScansResponseSchema = external_exports.object({
+  scans: external_exports.array(ScanResponseSchema),
+  total: external_exports.number(),
+  page: external_exports.number(),
+  pageSize: external_exports.number()
+});
+var ScanArrayResponseSchema = external_exports.array(ScanResponseSchema);
+var CancelScanResponseSchema = external_exports.object({
+  scanId: external_exports.uuid(),
+  status: external_exports.literal("CANCELLED")
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/scan-log.api.ts
+var ScanLogQuerySchema = external_exports.object({
+  offset: external_exports.coerce.number().int().min(0).optional()
+});
+var ScanLogEntrySchema = external_exports.object({
+  timestamp: external_exports.string(),
+  level: external_exports.enum(["INFO", "WARN", "ERROR"]),
+  message: external_exports.string(),
+  phase: external_exports.string().nullable()
+});
+var ListScanLogsResponseSchema = external_exports.object({
+  logs: external_exports.array(ScanLogEntrySchema),
+  nextOffset: external_exports.number()
+});
+
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c10 = initContract();
-var scanContract = c10.router({
+var c12 = initContract();
+var scanContract = c12.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -23281,14 +23938,15 @@ var UserResponseSchema = external_exports.object({
   lastName: external_exports.string(),
   email: external_exports.string(),
   profilePictureUrl: external_exports.string().nullable(),
+  isStaff: external_exports.boolean(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
 var ListUsersResponseSchema = external_exports.array(UserResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c11 = initContract();
-var userContract = c11.router({
+var c13 = initContract();
+var userContract = c13.router({
   listUsers: {
     method: "GET",
     path: "/organizations/:organizationId/users",
@@ -23360,8 +24018,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c12 = initContract();
-var vantaIntegrationContract = c12.router({
+var c14 = initContract();
+var vantaIntegrationContract = c14.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -23421,7 +24079,8 @@ var VulnerabilityStatusValues = [
   "IN_PROGRESS",
   "FIXED",
   "IGNORED",
-  "FALSE_POSITIVE"
+  "FALSE_POSITIVE",
+  "DISMISSED"
 ];
 var VulnerabilityStatus = external_exports.enum(VulnerabilityStatusValues);
 var VulnerabilitySeverityValues = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
@@ -23434,6 +24093,8 @@ var VulnerabilityTypeValues = [
   "MISCONFIGURATION"
 ];
 var VulnerabilityType = external_exports.enum(VulnerabilityTypeValues);
+var DismissReasonValues = ["ACCEPTED_RISK", "FALSE_POSITIVE", "OTHER"];
+var DismissReason = external_exports.enum(DismissReasonValues);
 var ScanModeValues2 = ["SAST", "DAST", "SCA", "SECRETS"];
 var ScanMode2 = external_exports.enum(ScanModeValues2);
 
@@ -23462,7 +24123,12 @@ var VulnerabilityLatestFindingSchema = external_exports.object({
   attackVector: external_exports.string(),
   exploitScenario: external_exports.string(),
   impact: external_exports.string(),
-  confidence: external_exports.number()
+  confidence: external_exports.number(),
+  // Threat model fields (null for findings from scans before this feature)
+  classification: external_exports.enum(["vulnerability", "defense_in_depth", "context_dependent"]).nullable(),
+  prerequisiteAccess: external_exports.string().nullable(),
+  capabilityGain: external_exports.string().nullable(),
+  technicalSeverity: VulnerabilitySeverity.nullable()
 });
 var DependencyGraphSchema = external_exports.object({
   vulnerablePackage: external_exports.string(),
@@ -23486,6 +24152,7 @@ var VulnerabilityResponseSchema = external_exports.object({
   scanMode: ScanMode2.nullable(),
   status: VulnerabilityStatus,
   statusReason: external_exports.string().nullable(),
+  dismissReason: DismissReason.nullable(),
   cweId: external_exports.string().nullable(),
   source: VulnerabilitySourceSchema,
   introducedBy: VulnerabilityIntroducedBySchema,
@@ -23572,12 +24239,13 @@ var VulnerabilityAggregatedCountsResponseSchema = external_exports.object({
 });
 var UpdateVulnerabilityRequestSchema = external_exports.object({
   status: VulnerabilityStatus.optional(),
-  statusReason: external_exports.string().optional()
+  statusReason: external_exports.string().optional(),
+  dismissReason: DismissReason.optional()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c13 = initContract();
-var vulnerabilityContract = c13.router({
+var c15 = initContract();
+var vulnerabilityContract = c15.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -23686,7 +24354,90 @@ var vulnerabilityContract = c13.router({
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/retests",
     pathParams: VulnerabilityIdParamsSchema,
     responses: {
-      200: ListScansResponseSchema,
+      200: ScanArrayResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/vulnerability-note.api.ts
+var VulnerabilityNoteParamsSchema = OrgIdParamsSchema.extend({
+  vulnerabilityId: external_exports.uuid()
+});
+var VulnerabilityNoteIdParamsSchema = VulnerabilityNoteParamsSchema.extend({
+  noteId: external_exports.uuid()
+});
+var VulnerabilityNoteResponseSchema = external_exports.object({
+  noteId: external_exports.uuid(),
+  vulnerabilityId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  authorId: external_exports.uuid(),
+  authorName: external_exports.string(),
+  authorProfilePictureUrl: external_exports.string().nullable(),
+  content: external_exports.string(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var ListVulnerabilityNotesResponseSchema = external_exports.array(VulnerabilityNoteResponseSchema);
+var CreateVulnerabilityNoteRequestSchema = external_exports.object({
+  content: external_exports.string().min(1).max(1e4)
+});
+var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
+  content: external_exports.string().min(1).max(1e4)
+});
+
+// ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
+var c16 = initContract();
+var vulnerabilityNoteContract = c16.router({
+  listNotes: {
+    method: "GET",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
+    pathParams: VulnerabilityNoteParamsSchema,
+    responses: {
+      200: ListVulnerabilityNotesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createNote: {
+    method: "POST",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
+    pathParams: VulnerabilityNoteParamsSchema,
+    body: CreateVulnerabilityNoteRequestSchema,
+    responses: {
+      201: VulnerabilityNoteResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateNote: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes/:noteId",
+    pathParams: VulnerabilityNoteIdParamsSchema,
+    body: UpdateVulnerabilityNoteRequestSchema,
+    responses: {
+      200: VulnerabilityNoteResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteNote: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes/:noteId",
+    pathParams: VulnerabilityNoteIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -23712,8 +24463,8 @@ var WebApplicationResponseSchema = external_exports.object({
 var ListWebApplicationsResponseSchema = external_exports.array(WebApplicationResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/web-application.ts
-var c14 = initContract();
-var webApplicationContract = c14.router({
+var c17 = initContract();
+var webApplicationContract = c17.router({
   listWebApplications: {
     method: "GET",
     path: "/organizations/:organizationId/web-applications",
@@ -23852,8 +24603,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c15 = initContract();
-var webhookSettingsContract = c15.router({
+var c18 = initContract();
+var webhookSettingsContract = c18.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -23991,8 +24742,8 @@ var webhookSettingsContract = c15.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c16 = initContract();
-var v1Contract = c16.router(
+var c19 = initContract();
+var v1Contract = c19.router(
   {
     admin: adminContract,
     scan: scanContract,
@@ -24006,9 +24757,12 @@ var v1Contract = c16.router(
     knowledgeBase: knowledgeBaseContract,
     knowledgeDocument: knowledgeDocumentContract,
     vulnerability: vulnerabilityContract,
+    vulnerabilityNote: vulnerabilityNoteContract,
     webhookSettings: webhookSettingsContract,
     webApplication: webApplicationContract,
-    chatSession: chatSessionContract
+    chatSession: chatSessionContract,
+    pentest: pentestContract,
+    pentestFinding: pentestFindingContract
   },
   {
     pathPrefix: "/v1"
@@ -24016,8 +24770,8 @@ var v1Contract = c16.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c17 = initContract();
-var contract = c17.router({
+var c20 = initContract();
+var contract = c20.router({
   v1: v1Contract
 });
 
@@ -24027,8 +24781,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c18 = initContract();
-var githubWebhookContract = c18.router(
+var c21 = initContract();
+var githubWebhookContract = c21.router(
   {
     handleWebhook: {
       method: "POST",
@@ -24053,8 +24807,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c19 = initContract();
-var healthContract = c19.router({
+var c22 = initContract();
+var healthContract = c22.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -24098,12 +24852,13 @@ var ListPrVulnerabilitiesResponseSchema = external_exports.object({
 });
 var UpdatePrVulnerabilityRequestSchema = external_exports.object({
   status: VulnerabilityStatus,
-  statusReason: external_exports.string().optional()
+  statusReason: external_exports.string().optional(),
+  dismissReason: DismissReason.optional()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c20 = initContract();
-var prVulnerabilityContract = c20.router(
+var c23 = initContract();
+var prVulnerabilityContract = c23.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -24149,6 +24904,7 @@ var FindingSchema = external_exports.object({
 // src/api-client.ts
 var readTokenSafe = readToken;
 var PRODUCTION_API_URL = "https://api.securewithtrace.com";
+var UNAUTHORIZED_STATUS = 401;
 function getApiBaseUrl() {
   const raw = process.env["TRACE_API_URL"];
   if (!raw) {
@@ -24174,14 +24930,6 @@ function getApiBaseUrl() {
   }
   return raw.replace(/\/+$/, "");
 }
-function requireAuth() {
-  const token = readToken();
-  if (!token) {
-    console.error("Not logged in. Run `tracecli auth login` first.");
-    process.exit(1);
-  }
-  return { token };
-}
 function createClient(token) {
   return initClient(v1Contract, {
     baseUrl: getApiBaseUrl(),
@@ -24190,9 +24938,71 @@ function createClient(token) {
     }
   });
 }
+function getWorkosClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (!clientId || clientId.trim().length === 0) {
+    return null;
+  }
+  return clientId;
+}
+async function refreshStoredAccessToken() {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return null;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return tokenResponse.access_token;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return null;
+  }
+}
+async function authenticatedRequest(request) {
+  const token = readToken();
+  if (!token) {
+    console.error("Not logged in. Run `tracecli auth login` first.");
+    process.exit(1);
+  }
+  const firstResult = await request(createClient(token));
+  if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    return firstResult;
+  }
+  const refreshedToken = await refreshStoredAccessToken();
+  if (!refreshedToken) {
+    return firstResult;
+  }
+  return request(createClient(refreshedToken));
+}
+async function authenticatedRequestSafe(request) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const firstResult = await request(createClient(token));
+    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+      return firstResult;
+    }
+    const refreshedToken = await refreshStoredAccessToken();
+    if (!refreshedToken) {
+      return firstResult;
+    }
+    return await request(createClient(refreshedToken));
+  } catch {
+    return null;
+  }
+}
 var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
 async function resolveOrganizationId(client) {
-  const result = await client.organization.listOrganizations();
+  const result = client ? await client.organization.listOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+  );
   if (result.status !== 200) {
     console.error(`Failed to resolve organization (status ${result.status}).`);
     process.exit(1);
@@ -24211,7 +25021,12 @@ async function resolveOrganizationId(client) {
 }
 async function resolveOrganizationIdSafe(client) {
   try {
-    const result = await client.organization.listOrganizations();
+    const result = client ? await client.organization.listOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+    );
+    if (!result) {
+      return null;
+    }
     if (result.status !== 200) {
       return null;
     }
@@ -24229,7 +25044,180 @@ async function resolveOrganizationIdSafe(client) {
   }
 }
 
+// src/format.ts
+var SEVERITY_ORDER = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3,
+  INFORMATIONAL: 4
+};
+function formatStatus(status) {
+  return status.toLowerCase().replace("_", " ");
+}
+
+// src/pentest/commands.ts
+function formatDate(date5) {
+  if (!date5) {
+    return "\u2014";
+  }
+  const d = typeof date5 === "string" ? new Date(date5) : date5;
+  return d.toLocaleDateString("en-US", { year: "numeric", month: "short", day: "numeric" });
+}
+function formatFindingSeverity(severity) {
+  switch (severity) {
+    case "CRITICAL":
+      return "CRIT";
+    case "HIGH":
+      return "HIGH";
+    case "MEDIUM":
+      return "MED";
+    case "LOW":
+      return "LOW";
+    case "INFORMATIONAL":
+      return "INFO";
+    default:
+      return severity;
+  }
+}
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolvePentestId(organizationId, identifier) {
+  if (UUID_PATTERN.test(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PT-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      `Invalid pentest identifier '${identifier}'. Use a display ID (e.g. PT-3) or UUID.`
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentest.listPentests({
+      params: { organizationId }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to list pentests (status ${result.status}).`);
+    process.exit(1);
+  }
+  const pentest = result.body.find((p) => p.displayId === displayId);
+  if (!pentest) {
+    console.error(
+      `Pentest with display ID ${displayId} not found.
+Run \`tracecli pentest list\` to see available pentests.`
+    );
+    process.exit(1);
+  }
+  return pentest.pentestId;
+}
+function createListCommand() {
+  return new Command("list").description("List pentests for your organization").option("--json", "Output as JSON").action(async (options) => {
+    const organizationId = await resolveOrganizationId();
+    const result = await authenticatedRequest(
+      (client) => client.pentest.listPentests({
+        params: { organizationId }
+      })
+    );
+    if (result.status !== 200) {
+      console.error(`Failed to list pentests (status ${result.status}).`);
+      process.exit(1);
+    }
+    const pentests = result.body;
+    if (pentests.length === 0) {
+      if (options.json) {
+        console.log("[]");
+      } else {
+        console.log("No pentests found.");
+      }
+      return;
+    }
+    if (options.json) {
+      console.log(JSON.stringify(pentests, null, 2));
+      return;
+    }
+    console.log(`Found ${pentests.length} pentest${pentests.length === 1 ? "" : "s"}:
+`);
+    for (const pt of pentests) {
+      const status = formatStatus(pt.status);
+      const started = formatDate(pt.startedAt);
+      const ended = formatDate(pt.endedAt);
+      const dateRange = pt.startedAt ? `${started} \u2013 ${ended}` : "Not started";
+      const findings = pt.findingCounts.total;
+      console.log(`  [PT-${pt.displayId}] ${pt.title}`);
+      console.log(`          Status: ${status} | Findings: ${findings} | ${dateRange}`);
+      if (pt.description) {
+        console.log(`          ${pt.description}`);
+      }
+      console.log("");
+    }
+  });
+}
+function createFindingsListCommand() {
+  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--json", "Output as JSON").action(async (options) => {
+    const organizationId = await resolveOrganizationId();
+    const pentestId = await resolvePentestId(organizationId, options.pentest);
+    const result = await authenticatedRequest(
+      (client) => client.pentestFinding.listFindings({
+        params: { organizationId, pentestId }
+      })
+    );
+    if (result.status !== 200) {
+      console.error(`Failed to list findings (status ${result.status}).`);
+      process.exit(1);
+    }
+    const findings = result.body;
+    if (findings.length === 0) {
+      if (options.json) {
+        console.log("[]");
+      } else {
+        console.log("No findings found for this pentest.");
+      }
+      return;
+    }
+    if (options.json) {
+      console.log(JSON.stringify(findings, null, 2));
+      return;
+    }
+    console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
+`);
+    const sorted = [...findings].sort(
+      (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
+    );
+    for (const finding of sorted) {
+      const sev = formatFindingSeverity(finding.severity);
+      const status = formatStatus(finding.status);
+      const cwes = finding.cweIds.length > 0 ? ` | ${finding.cweIds.join(", ")}` : "";
+      const score = finding.cvssScore != null ? ` | CVSS ${finding.cvssScore.toFixed(1)}` : "";
+      console.log(`  [${sev}] ${finding.title}`);
+      console.log(`         ${finding.category} \xB7 ${status}${cwes}${score}`);
+      if (finding.repositories.length > 0) {
+        for (const repo of finding.repositories) {
+          const location = repo.filePath ? `${repo.repositoryName} \xB7 ${repo.filePath}${repo.startLine != null ? `:${repo.startLine}` : ""}` : repo.repositoryName;
+          console.log(`         ${location}`);
+        }
+      }
+      console.log("");
+    }
+  });
+}
+function createFindingsCommand() {
+  const findings = new Command("findings").description("Manage pentest findings");
+  findings.addCommand(createFindingsListCommand());
+  return findings;
+}
+function createPentestCommand() {
+  const pentest = new Command("pentest").description("Manage pentests");
+  pentest.addCommand(createListCommand());
+  pentest.addCommand(createFindingsCommand());
+  return pentest;
+}
+
 // src/repo/commands.ts
+import { chmodSync, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
 function stripAnsi(str) {
   const ESC2 = String.fromCharCode(27);
   const CSI = String.fromCharCode(155);
@@ -24283,14 +25271,14 @@ function validateBranchName(branch) {
   }
   return branch;
 }
-function createListCommand() {
+function createListCommand2() {
   return new Command("list").description("List repositories in your organization").action(async () => {
-    const { token } = requireAuth();
-    const client = createClient(token);
-    const organizationId = await resolveOrganizationId(client);
-    const result = await client.repository.listRepositories({
-      params: { organizationId }
-    });
+    const organizationId = await resolveOrganizationId();
+    const result = await authenticatedRequest(
+      (client) => client.repository.listRepositories({
+        params: { organizationId }
+      })
+    );
     if (result.status !== 200) {
       console.error(`Failed to list repositories (status ${result.status}).`);
       process.exit(1);
@@ -24326,20 +25314,20 @@ echo '${token.replace(/'/g, "'\\''")}'
   return scriptPath;
 }
 async function fetchCloneToken(repoUrl) {
-  const token = readTokenSafe();
-  if (!token) {
-    return null;
-  }
   try {
-    const client = createClient(token);
-    const organizationId = await resolveOrganizationIdSafe(client);
+    const organizationId = await resolveOrganizationIdSafe();
     if (!organizationId) {
       return null;
     }
-    const result = await client.repository.getCloneToken({
-      params: { organizationId },
-      body: { repositoryUrl: repoUrl }
-    });
+    const result = await authenticatedRequestSafe(
+      (client) => client.repository.getCloneToken({
+        params: { organizationId },
+        body: { repositoryUrl: repoUrl }
+      })
+    );
+    if (!result) {
+      return null;
+    }
     if (result.status === 200) {
       return result.body.token;
     }
@@ -24409,24 +25397,20 @@ function createCloneCommand() {
 }
 function createRepoCommand() {
   const repo = new Command("repo").description("Manage repositories");
-  repo.addCommand(createListCommand());
+  repo.addCommand(createListCommand2());
   repo.addCommand(createCloneCommand());
   return repo;
 }
 
 // src/vulnerabilities/commands.ts
 import { createInterface } from "readline";
-var SEVERITY_ORDER = {
-  CRITICAL: 0,
-  HIGH: 1,
-  MEDIUM: 2,
-  LOW: 3
-};
 var DEFAULT_PAGE_SIZE = 25;
-async function resolveRepositoryId(client, organizationId, repoIdentifier) {
-  const result = await client.repository.listRepositories({
-    params: { organizationId }
-  });
+async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
+  const result = await authenticatedRequest(
+    (client) => client.repository.listRepositories({
+      params: { organizationId }
+    })
+  );
   if (result.status !== 200) {
     console.error(`Failed to list repositories (status ${result.status}).`);
     process.exit(1);
@@ -24490,7 +25474,7 @@ function printVulnerabilities(vulnerabilities) {
   );
   for (const vuln of sorted) {
     const sev = formatSeverity(vuln.severity);
-    const status = vuln.status.toLowerCase().replace("_", " ");
+    const status = formatStatus(vuln.status);
     const repo = vuln.repositoryName;
     const file2 = vuln.codeSnippet.filePath;
     const line = vuln.codeSnippet.startLine;
@@ -24510,7 +25494,7 @@ async function promptContinue(displayed, total) {
     });
   });
 }
-function createListCommand2() {
+function createListCommand3() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -24527,12 +25511,10 @@ function createListCommand2() {
     return Math.min(n, 200);
   }).option("--json", "Output as JSON").action(
     async (options) => {
-      const { token } = requireAuth();
-      const client = createClient(token);
-      const organizationId = await resolveOrganizationId(client);
+      const organizationId = await resolveOrganizationId();
       const conditions = [];
       if (options.repo) {
-        const repositoryId = await resolveRepositoryId(client, organizationId, options.repo);
+        const repositoryId = await resolveRepositoryIdAuthenticated(organizationId, options.repo);
         conditions.push({ field: "repositoryId", operator: "eq", value: repositoryId });
       }
       if (options.severity) {
@@ -24553,10 +25535,12 @@ function createListCommand2() {
       let total = 0;
       const allJsonVulnerabilities = [];
       while (true) {
-        const result = await client.vulnerability.filterVulnerabilities({
-          params: { organizationId },
-          body: { ...filterBody, page, pageSize }
-        });
+        const result = await authenticatedRequest(
+          (client) => client.vulnerability.filterVulnerabilities({
+            params: { organizationId },
+            body: { ...filterBody, page, pageSize }
+          })
+        );
         if (result.status !== 200) {
           console.error(`Failed to list vulnerabilities (status ${result.status}).`);
           process.exit(1);
@@ -24602,7 +25586,7 @@ function createListCommand2() {
 }
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
-  vulnerabilities.addCommand(createListCommand2());
+  vulnerabilities.addCommand(createListCommand3());
   return vulnerabilities;
 }
 
@@ -24616,5 +25600,6 @@ program2.action(() => {
 program2.addCommand(createAuthCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.parse();