securewithtrace 0.31.0 → 0.32.0

package/dist/index.js

@@ -6322,29 +6322,29 @@ var ZodFunction = class _ZodFunction extends ZodType {
     const params = { errorMap: ctx.common.contextualErrorMap };
     const fn = ctx.data;
     if (this._def.returns instanceof ZodPromise) {
-      const me = this;
+      const me2 = this;
       return OK(async function(...args) {
         const error48 = new ZodError([]);
-        const parsedArgs = await me._def.args.parseAsync(args, params).catch((e2) => {
+        const parsedArgs = await me2._def.args.parseAsync(args, params).catch((e2) => {
           error48.addIssue(makeArgsIssue(args, e2));
           throw error48;
         });
         const result = await Reflect.apply(fn, this, parsedArgs);
-        const parsedReturns = await me._def.returns._def.type.parseAsync(result, params).catch((e2) => {
+        const parsedReturns = await me2._def.returns._def.type.parseAsync(result, params).catch((e2) => {
           error48.addIssue(makeReturnsIssue(result, e2));
           throw error48;
         });
         return parsedReturns;
       });
     } else {
-      const me = this;
+      const me2 = this;
       return OK(function(...args) {
-        const parsedArgs = me._def.args.safeParse(args, params);
+        const parsedArgs = me2._def.args.safeParse(args, params);
         if (!parsedArgs.success) {
           throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
         }
         const result = Reflect.apply(fn, this, parsedArgs.data);
-        const parsedReturns = me._def.returns.safeParse(result, params);
+        const parsedReturns = me2._def.returns.safeParse(result, params);
         if (!parsedReturns.success) {
           throw new ZodError([makeReturnsIssue(result, parsedReturns.error)]);
         }
@@ -10176,7 +10176,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c50) => c50 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c49) => c49 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -20220,9 +20220,9 @@ var ZodDate2 = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c50 = inst._zod.bag;
-  inst.minDate = c50.minimum ? new Date(c50.minimum) : null;
-  inst.maxDate = c50.maximum ? new Date(c50.maximum) : null;
+  const c49 = inst._zod.bag;
+  inst.minDate = c49.minimum ? new Date(c49.minimum) : null;
+  inst.maxDate = c49.maximum ? new Date(c49.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate2, params);
@@ -21504,7 +21504,8 @@ var PentestEditEntityValues = [
   "PENTEST_TOOL_RUN",
   "PENTEST_ATTESTATION",
   "PENTEST_REPORT",
-  "PENTEST_EXPLOIT_ARTIFACT"
+  "PENTEST_EXPLOIT_ARTIFACT",
+  "PENTEST_FINDING_RETEST"
 ];
 var PentestEditEntity = external_exports.enum(PentestEditEntityValues);
 var PentestEditActionValues = [
@@ -21688,10 +21689,11 @@ var AgentSessionIdParamsSchema = AgentSessionsParamsSchema.extend({
 var AgentSessionEventIdParamsSchema = AgentSessionIdParamsSchema.extend({
   eventId: external_exports.uuid()
 });
+var MAX_AGENT_SESSION_MAX_USD = 1500;
 var CreateAgentSessionCommonSchema = external_exports.object({
   provider: AgentSessionProvider.optional(),
   model: external_exports.string().min(1).max(200).optional(),
-  maxUsd: external_exports.number().positive().max(500).optional(),
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional(),
   maxWallClockMin: external_exports.number().int().positive().max(24 * 60).optional()
 });
 var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type", [
@@ -21701,7 +21703,17 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
   }),
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("CODE_REVIEW"),
-    focus: external_exports.string().min(1).max(2e3).optional()
+    focus: external_exports.string().min(1).max(2e3).optional(),
+    /**
+     * Which bound application this review reads the codebase through (multi-application
+     * PR 4). REQUIRED once 2+ applications are bound — omitting it there is
+     * `APPLICATION_REQUIRED`, because the silent alternative is N reviews all scoping
+     * their threat model to the first binding and overwriting each other. Defaults to
+     * the sole binding at 1, and is legitimately absent for a bindingless engagement.
+     * Only CODE_REVIEW and PRODUCT_RECON carry it: the other types are engagement-wide
+     * by design, and the discriminated union is what keeps it off them.
+     */
+    applicationId: external_exports.uuid().optional()
   }),
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("VALIDATION"),
@@ -21736,7 +21748,10 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
   // / VALIDATION / RECON.
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("PRODUCT_RECON"),
-    focus: external_exports.string().min(1).max(2e3).optional()
+    focus: external_exports.string().min(1).max(2e3).optional(),
+    /** Which bound application this recon learns. Same rules as CODE_REVIEW's, except
+     *  a bindingless engagement is already rejected at prep (PRODUCT_RECON_NO_APPLICATION). */
+    applicationId: external_exports.uuid().optional()
   }),
   // REPORT (report-generation-session RS3): the report-authoring session. The
   // objective is server-built from the engagement (no repo/creds); `focus` is
@@ -21752,8 +21767,10 @@ var SendAgentSessionMessageRequestSchema = external_exports.object({
 var ResumeAgentSessionRequestSchema = external_exports.object({
   /** Manual failover: relaunch on the other provider (cold cache accepted). */
   provider: AgentSessionProvider.optional(),
-  /** Budget raise — required to leave WAITING_ON_STAFF(BUDGET_EXHAUSTED). */
-  maxUsd: external_exports.number().positive().max(500).optional()
+  /** Budget raise — required to leave WAITING_ON_STAFF(BUDGET_EXHAUSTED). Same
+   *  lifetime ceiling as create: a raise past it is not expressible, which is why
+   *  the create cap had to move for the engagement-wide validator. */
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional()
 });
 var ListAgentSessionEventsQuerySchema = external_exports.object({
   /** Return events with seq > sinceSeq (poll cursor). */
@@ -21765,6 +21782,12 @@ var AgentSessionSummarySchema = external_exports.object({
   organizationId: external_exports.uuid(),
   pentestId: external_exports.uuid(),
   type: AgentSessionType,
+  /**
+   * The application this session is scoped to, or null for engagement-wide (PR 4).
+   * Id only — `toSummary` is a pure row mapper feeding six call sites, and the staff
+   * console already holds the bound applications it needs to resolve a name.
+   */
+  applicationId: external_exports.uuid().nullable(),
   status: AgentSessionStatus,
   waitingReason: AgentSessionWaitingReason.nullable(),
   failureReason: AgentSessionFailureReason.nullable(),
@@ -21861,11 +21884,30 @@ var OperatorPentestContextSchema = external_exports.object({
   customerPriorityCategories: external_exports.array(external_exports.string()),
   status: PentestStatus,
   currentStage: PentestStage,
+  /**
+   * The lowest-ordinal binding. RETAINED rather than replaced by `applications`:
+   * `apps/agent-session-host` mirrors this interface by hand and raw-casts the JSON
+   * without a schema parse (`api-client.ts:858-872`), so dropping this field would
+   * give a parked or in-flight session `undefined` for its application block with no
+   * parse error and no log. It retires a release after no parked session predates
+   * `applications`.
+   */
   primaryApplication: external_exports.object({
     name: external_exports.string(),
     type: external_exports.string(),
     applicationUrl: external_exports.string().nullable()
   }).nullable(),
+  /**
+   * Every bound application, ordinal-ascending. Optional for the same host
+   * raw-cast reason: an older host image ignores what it does not know about.
+   */
+  applications: external_exports.array(
+    external_exports.object({
+      name: external_exports.string(),
+      type: external_exports.string(),
+      applicationUrl: external_exports.string().nullable()
+    })
+  ).optional(),
   environments: external_exports.array(
     external_exports.object({
       name: external_exports.string(),
@@ -22197,36 +22239,9 @@ function roleDisplay(role, roleLabel) {
   return APPLICATION_REPOSITORY_ROLE_LABELS[role] ?? null;
 }
 
-// ../../packages/core/src/ai-tooling/profile.ts
-var AI_TOOL_DETECTION = ["claude-code", "codex", "both", "neither"];
-var AI_TOOL_OVERRIDE = ["claude-code", "codex"];
-var Sha40 = external_exports.string().regex(/^[a-f0-9]{40}$/, "expected a 40-char hex git SHA");
-var AiToolingProfileSchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  detectedTool: external_exports.enum(AI_TOOL_DETECTION),
-  overrideTool: external_exports.enum(AI_TOOL_OVERRIDE).nullable(),
-  /** null = no detection has run yet (override-only seed); refresh on next scan. */
-  detectedAt: external_exports.iso.datetime().nullable(),
-  /** Scan commit-sha the detection ran against. null when detectedAt is null. */
-  detectedCommitSha: Sha40.nullable(),
-  evidence: external_exports.object({
-    claudeMdSha: Sha40.nullable(),
-    agentsMdSha: Sha40.nullable(),
-    claudeMdMtime: external_exports.iso.datetime().nullable(),
-    agentsMdMtime: external_exports.iso.datetime().nullable()
-  }).strict()
-}).strict();
-
 // ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
 var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET"];
 var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
-var SetAiToolingProfileOverrideRequestSchema = external_exports.object({
-  /** null clears the override and reverts to detection-driven resolution. */
-  overrideTool: external_exports.enum(AI_TOOL_OVERRIDE).nullable()
-}).strict();
-var SetAiToolingProfileOverrideResponseSchema = external_exports.object({
-  aiToolingProfile: AiToolingProfileSchema.nullable()
-}).strict();
 var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
   repositoryId: external_exports.uuid()
 });
@@ -22251,13 +22266,6 @@ var RepositoryResponseSchema = external_exports.object({
   githubDefaultBranch: external_exports.string(),
   scanningBranch: external_exports.string().nullable(),
   primaryLanguage: external_exports.string().nullable().optional(),
-  /**
-   * Null until the first post-scan detection writes a row, OR when the raw
-   * JSONB fails strict-schema parsing (mapper falls back to null so the
-   * response stays valid). PATCH override writes always preserve the live
-   * `overrideTool` via `parseOverrideTool`.
-   */
-  aiToolingProfile: AiToolingProfileSchema.nullable(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
@@ -22345,7 +22353,8 @@ var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
-var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "API_SERVICE"];
+var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
+var APPLICATION_NOTES_MAX_CHARS = 2e3;
 var ApplicationRepositoryRoleValues = [
   "FRONTEND",
   "BACKEND_API",
@@ -22356,12 +22365,27 @@ var ApplicationRepositoryRoleValues = [
   "MOBILE_CLIENT",
   "OTHER"
 ];
+var ScopeDomainSourceValues = ["DERIVED", "MANUAL"];
 var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
   applicationId: external_exports.uuid()
 });
 var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
   applicationRepositoryId: external_exports.uuid()
 });
+var AuthorizedDomainIdParamsSchema = ApplicationIdParamsSchema.extend({
+  applicationAuthorizedDomainId: external_exports.uuid()
+});
+var AuthorizedDomainResponseSchema = external_exports.object({
+  applicationAuthorizedDomainId: external_exports.uuid(),
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  domain: external_exports.string(),
+  source: external_exports.enum(ScopeDomainSourceValues),
+  createdAt: external_exports.date()
+});
+var CreateAuthorizedDomainRequestSchema = external_exports.object({
+  domain: external_exports.string().trim().min(1).max(253)
+}).strict();
 var ApplicationRepositorySummarySchema = external_exports.object({
   applicationRepositoryId: external_exports.uuid().nullable(),
   applicationId: external_exports.uuid(),
@@ -22393,9 +22417,20 @@ var ApplicationResponseSchema = external_exports.object({
   // reject application rows.
   type: external_exports.enum(ApplicationTypeValues).default("WEB"),
   applicationUrl: external_exports.string().nullable(),
+  // Customer-authored free-text context, any type ("Advanced → Notes").
+  notes: external_exports.string().nullable(),
   helpCenterUrl: external_exports.string().nullable(),
   documentationUrl: external_exports.string().nullable(),
   repositories: external_exports.array(ApplicationRepositorySummarySchema),
+  // Registrable domains RECON is authorized to discover subdomains under. The
+  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
+  // (like `type`) so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject application rows that predate the field.
+  authorizedDomains: external_exports.array(AuthorizedDomainResponseSchema).default([]),
+  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
+  // reading a pre-this-release API during a rolling deploy doesn't reject rows
+  // that omit the field. The raw S3 key is never on the wire.
+  screenshotUrl: external_exports.url().nullable().default(null),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
@@ -22404,6 +22439,7 @@ var CreateApplicationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(200),
   type: external_exports.enum(ApplicationTypeValues).default("WEB"),
   applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
   repositoryId: external_exports.uuid().optional(),
   repositoryPath: external_exports.string().max(500).optional(),
   helpCenterUrl: external_exports.url().max(2048).optional(),
@@ -22431,6 +22467,7 @@ var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
 var UpdateApplicationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(200).optional(),
   applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
   repositoryId: external_exports.uuid().nullable().optional(),
   repositoryPath: external_exports.string().max(500).nullable().optional(),
   helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
@@ -22565,6 +22602,35 @@ var applicationContract = c4.router({
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  addAuthorizedDomain: {
+    method: "POST",
+    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains",
+    pathParams: ApplicationIdParamsSchema,
+    body: CreateAuthorizedDomainRequestSchema,
+    responses: {
+      201: AuthorizedDomainResponseSchema,
+      // 400 = INVALID_DOMAIN (not a registrable domain / IP / bare suffix);
+      // 409 = DOMAIN_ALREADY_AUTHORIZED.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteAuthorizedDomain: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains/:applicationAuthorizedDomainId",
+    pathParams: AuthorizedDomainIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
@@ -22794,7 +22860,7 @@ var chatSessionContract = c6.router({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/cloud-integration.api.ts
-var CloudProviderValues = ["AWS", "GCP", "AZURE", "VERCEL"];
+var CloudProviderValues = ["AWS", "GCP", "AZURE", "VERCEL", "CONVEX"];
 var CloudIntegrationStatusValues = [
   "PENDING",
   "ACTIVE",
@@ -23304,6 +23370,107 @@ var DisconnectGcpCloudIntegrationResponseSchema = external_exports.object({
 var CancelPendingGcpCloudIntegrationResponseSchema = external_exports.object({
   deleted: external_exports.literal(true)
 }).strict();
+var ConvexAccountIdParamsSchema = CloudIntegrationIdParamsSchema.extend({
+  cloudProviderAccountId: external_exports.uuid()
+});
+var ConvexDeploymentIdParamsSchema = CloudIntegrationIdParamsSchema.extend({
+  convexLinkedDeploymentId: external_exports.uuid()
+});
+var CreateConvexInstallIntentRequestSchema = external_exports.object({
+  displayName: external_exports.string().trim().min(1).max(120).optional()
+}).strict();
+var FinalizeConvexCallbackRequestSchema = external_exports.object({
+  code: external_exports.string().trim().min(1).max(4096),
+  state: external_exports.string().trim().min(32).max(512)
+}).strict();
+var ConvexCloudIntegrationSummarySchema = external_exports.object({
+  cloudIntegrationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  provider: external_exports.literal("CONVEX"),
+  status: CloudIntegrationStatusSchema,
+  displayName: external_exports.string(),
+  templateVersion: external_exports.string(),
+  verifiedAt: external_exports.date().nullable(),
+  disconnectedAt: external_exports.date().nullable(),
+  disconnectedById: external_exports.uuid().nullable(),
+  lastErrorCode: external_exports.string().nullable(),
+  lastErrorMessage: external_exports.string().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+}).strict();
+var ConvexLinkedDeploymentSummarySchema = external_exports.object({
+  convexLinkedDeploymentId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  cloudIntegrationId: external_exports.uuid(),
+  cloudProviderAccountId: external_exports.uuid(),
+  cloudProviderConnectionId: external_exports.uuid(),
+  convexProjectId: external_exports.number().int(),
+  deploymentName: external_exports.string(),
+  deploymentType: external_exports.string(),
+  deploymentRegion: external_exports.string().nullable(),
+  convexCloudUrl: external_exports.string(),
+  convexSiteUrl: external_exports.string().nullable(),
+  deploymentExpiresAt: external_exports.date().nullable(),
+  /**
+   * Whether a usable credential envelope is stored. NOT a scope claim: the key is
+   * full-access, because Convex cannot mint a scoped one for an OAuth app. Read-only
+   * is enforced by the broker that holds the key, never by the credential.
+   */
+  hasStoredKey: external_exports.boolean(),
+  status: CloudIntegrationStatusSchema,
+  lastVerifiedAt: external_exports.date().nullable(),
+  lastAuthErrorCode: external_exports.string().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+}).strict();
+var ConvexCloudIntegrationListItemSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  deployments: external_exports.array(ConvexLinkedDeploymentSummarySchema)
+}).strict();
+var ListConvexCloudIntegrationsResponseSchema = external_exports.object({
+  integrations: external_exports.array(ConvexCloudIntegrationListItemSchema)
+}).strict();
+var CreateConvexInstallIntentResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  installUrl: external_exports.url()
+}).strict();
+var FinalizeConvexCallbackResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  deployments: external_exports.array(ConvexLinkedDeploymentSummarySchema),
+  /** Deployments beyond the CONVEX_MAX_DEPLOYMENTS cap that were not connected. */
+  droppedDeploymentCount: external_exports.number().int().nonnegative()
+}).strict();
+var DisconnectConvexCloudIntegrationResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  deploymentCount: external_exports.number().int().nonnegative(),
+  clearedKeyCount: external_exports.number().int().nonnegative(),
+  /**
+   * Trace cannot revoke a Convex deploy key: there is no deployment-plane endpoint,
+   * the key is not returned by list_deploy_keys, and delete_deploy_key needs an id
+   * the mint never returns. Removing the Trace OAuth app is the only lever the
+   * customer has. A closed union, so PR 2 owns the wording.
+   */
+  revocationHint: external_exports.literal("REVOKE_OAUTH_APP"),
+  convexApplicationsUrl: external_exports.url().nullable()
+}).strict();
+var DisconnectConvexProjectResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  convexProjectId: external_exports.number().int(),
+  deploymentCount: external_exports.number().int().nonnegative(),
+  clearedKeyCount: external_exports.number().int().nonnegative(),
+  revocationHint: external_exports.literal("REVOKE_OAUTH_APP"),
+  convexApplicationsUrl: external_exports.url().nullable()
+}).strict();
+var DisconnectConvexDeploymentResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  deployment: ConvexLinkedDeploymentSummarySchema,
+  revocationHint: external_exports.literal("REVOKE_OAUTH_APP"),
+  convexApplicationsUrl: external_exports.url().nullable()
+}).strict();
+var ReverifyConvexDeploymentResponseSchema = external_exports.object({
+  integration: ConvexCloudIntegrationSummarySchema,
+  deployment: ConvexLinkedDeploymentSummarySchema
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/cloud-integration.ts
 var c7 = initContract();
@@ -23604,6 +23771,103 @@ var cloudIntegrationContract = c7.router({
       503: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  listConvexIntegrations: {
+    method: "GET",
+    path: "/organizations/:organizationId/cloud-integrations/convex",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: ListConvexCloudIntegrationsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createConvexInstallIntent: {
+    method: "POST",
+    path: "/organizations/:organizationId/cloud-integrations/convex/install-intents",
+    pathParams: OrgIdParamsSchema,
+    body: CreateConvexInstallIntentRequestSchema,
+    responses: {
+      201: CreateConvexInstallIntentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  finalizeConvexCallback: {
+    method: "POST",
+    path: "/organizations/:organizationId/cloud-integrations/convex/callback",
+    pathParams: OrgIdParamsSchema,
+    body: FinalizeConvexCallbackRequestSchema,
+    responses: {
+      200: FinalizeConvexCallbackResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  disconnectConvexIntegration: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/convex",
+    pathParams: CloudIntegrationIdParamsSchema,
+    responses: {
+      200: DisconnectConvexCloudIntegrationResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  disconnectConvexProject: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/convex/accounts/:cloudProviderAccountId",
+    pathParams: ConvexAccountIdParamsSchema,
+    responses: {
+      200: DisconnectConvexProjectResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  disconnectConvexDeployment: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/convex/deployments/:convexLinkedDeploymentId",
+    pathParams: ConvexDeploymentIdParamsSchema,
+    responses: {
+      200: DisconnectConvexDeploymentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  reverifyConvexDeployment: {
+    method: "POST",
+    path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/convex/deployments/:convexLinkedDeploymentId/reverify",
+    pathParams: ConvexDeploymentIdParamsSchema,
+    body: c7.noBody(),
+    responses: {
+      200: ReverifyConvexDeploymentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
@@ -23714,13 +23978,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c50, i) => {
-    const d2 = c50.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c49, i) => {
+    const d2 = c49.domain.replace(/^\./, "").toLowerCase();
     if (d2 !== host && !host.endsWith(`.${d2}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i, "domain"],
-        message: `cookie domain "${c50.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c49.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -23751,10 +24015,42 @@ var CredentialIdParamsSchema = OrgIdParamsSchema.extend({
 var EnvironmentCredentialsParamsSchema = OrgIdParamsSchema.extend({
   environmentId: external_exports.uuid()
 });
+var OPAQUE_SECRET_SHAPE = { secretValue: external_exports.string().min(1).max(8192) };
+var SessionStateSecretValueSchema = external_exports.string().min(1).refine((s) => Buffer.byteLength(s, "utf8") <= 262144, "session state must be \u2264256KB").superRefine((s, ctx) => {
+  const parsed = StorageStateSchema.safeParse(parseJsonOrUndefined(s));
+  if (parsed.success) return;
+  if (parsed.error.issues.length === 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "secretValue is not a valid StorageState capture"
+    });
+    return;
+  }
+  for (const issue2 of parsed.error.issues) {
+    ctx.addIssue({ code: "custom", message: issue2.message, path: issue2.path });
+  }
+});
+var SECRET_SHAPES = {
+  BEARER_TOKEN: OPAQUE_SECRET_SHAPE,
+  JWT_TOKEN: OPAQUE_SECRET_SHAPE,
+  API_KEY: OPAQUE_SECRET_SHAPE,
+  PASSPHRASE: OPAQUE_SECRET_SHAPE,
+  COOKIE: { secretValue: external_exports.string().min(1).max(16384) },
+  // secretValue IS the test-account email (login id + inbox ref). Validated as
+  // an address so a typo is rejected at create/rotate time rather than failing
+  // later when the agent uses it as a login/inbox. 320 = RFC 5321 max length.
+  MAGIC_AUTH: { secretValue: external_exports.email().max(320) },
+  USERNAME_PASSWORD: {
+    username: external_exports.string().min(1).max(500),
+    password: external_exports.string().min(1).max(2048)
+  },
+  SESSION_STATE: { secretValue: SessionStateSecretValueSchema }
+};
+var CreateLabelSchema = external_exports.string().max(200).optional();
 var CreateBearerSchema = external_exports.object({
   credentialType: external_exports.literal("BEARER_TOKEN"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).max(8192),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.BEARER_TOKEN,
   authConfig: external_exports.object({
     type: external_exports.literal("BEARER_TOKEN"),
     headerName: external_exports.string().min(1).max(200).optional(),
@@ -23763,8 +24059,8 @@ var CreateBearerSchema = external_exports.object({
 }).strict();
 var CreateJwtSchema = external_exports.object({
   credentialType: external_exports.literal("JWT_TOKEN"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).max(8192),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.JWT_TOKEN,
   authConfig: external_exports.object({
     type: external_exports.literal("JWT_TOKEN"),
     headerName: external_exports.string().min(1).max(200).optional(),
@@ -23773,8 +24069,8 @@ var CreateJwtSchema = external_exports.object({
 }).strict();
 var CreateApiKeySchema = external_exports.object({
   credentialType: external_exports.literal("API_KEY"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).max(8192),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.API_KEY,
   authConfig: external_exports.object({
     type: external_exports.literal("API_KEY"),
     placement: external_exports.enum(["header", "query"]),
@@ -23783,16 +24079,15 @@ var CreateApiKeySchema = external_exports.object({
 }).strict();
 var CreatePassphraseSchema = external_exports.object({
   credentialType: external_exports.literal("PASSPHRASE"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).max(8192),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.PASSPHRASE,
   // Passphrases are non-HTTP context — authConfig is empty by design.
   authConfig: external_exports.object({ type: external_exports.literal("PASSPHRASE") }).strict().optional()
 }).strict();
 var CreateUsernamePasswordSchema = external_exports.object({
   credentialType: external_exports.literal("USERNAME_PASSWORD"),
-  label: external_exports.string().min(1).max(200),
-  username: external_exports.string().min(1).max(500),
-  password: external_exports.string().min(1).max(2048),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.USERNAME_PASSWORD,
   authConfig: external_exports.object({
     type: external_exports.literal("USERNAME_PASSWORD"),
     method: external_exports.enum(["form", "basic", "json"]),
@@ -23806,8 +24101,8 @@ var CreateUsernamePasswordSchema = external_exports.object({
 }).strict();
 var CreateCookieSchema = external_exports.object({
   credentialType: external_exports.literal("COOKIE"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).max(16384),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.COOKIE,
   authConfig: external_exports.object({
     type: external_exports.literal("COOKIE"),
     cookieName: external_exports.string().min(1).max(200),
@@ -23817,11 +24112,8 @@ var CreateCookieSchema = external_exports.object({
 }).strict();
 var CreateMagicAuthSchema = external_exports.object({
   credentialType: external_exports.literal("MAGIC_AUTH"),
-  label: external_exports.string().min(1).max(200),
-  // secretValue IS the test-account email (login id + inbox ref). Validate as
-  // an address so a typo is rejected at create time rather than failing later
-  // when the agent uses it as a login/inbox. 320 = RFC 5321 max length.
-  secretValue: external_exports.email().max(320),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.MAGIC_AUTH,
   authConfig: external_exports.object({
     type: external_exports.literal("MAGIC_AUTH"),
     /** @deprecated inert — retained for back-compat only. */
@@ -23830,21 +24122,8 @@ var CreateMagicAuthSchema = external_exports.object({
 }).strict();
 var CreateSessionStateSchema = external_exports.object({
   credentialType: external_exports.literal("SESSION_STATE"),
-  label: external_exports.string().min(1).max(200),
-  secretValue: external_exports.string().min(1).refine((s) => Buffer.byteLength(s, "utf8") <= 262144, "session state must be \u2264256KB").superRefine((s, ctx) => {
-    const parsed = StorageStateSchema.safeParse(parseJsonOrUndefined(s));
-    if (parsed.success) return;
-    if (parsed.error.issues.length === 0) {
-      ctx.addIssue({
-        code: "custom",
-        message: "secretValue is not a valid StorageState capture"
-      });
-      return;
-    }
-    for (const issue2 of parsed.error.issues) {
-      ctx.addIssue({ code: "custom", message: issue2.message, path: issue2.path });
-    }
-  })
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.SESSION_STATE
 }).strict();
 var CreateCredentialRequestSchema = external_exports.discriminatedUnion("credentialType", [
   CreateBearerSchema,
@@ -23864,7 +24143,15 @@ var CredentialResponseSchema = external_exports.object({
   credentialType: CredentialType,
   authConfig: CredentialAuthConfigSchema.nullable(),
   createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
+  updatedAt: external_exports.date(),
+  /**
+   * When the encrypted secret was last REPLACED. Null for a credential never
+   * rotated (including every one created before rotation existed). Distinct
+   * from `updatedAt`, which also moves on label / environment / authConfig
+   * edits — so only this field can evidence a secret change. Not secret
+   * material: a timestamp, safe on the read path.
+   */
+  secretRotatedAt: external_exports.date().nullable()
 }).strict();
 var ListCredentialsResponseSchema = external_exports.array(CredentialResponseSchema);
 var UpdateCredentialRequestSchema = external_exports.object({
@@ -23872,6 +24159,37 @@ var UpdateCredentialRequestSchema = external_exports.object({
   environmentId: external_exports.uuid().optional(),
   authConfig: CredentialAuthConfigSchema.nullable().optional()
 }).strict();
+var RotateCredentialSecretRequestSchema = external_exports.discriminatedUnion("credentialType", [
+  external_exports.object({ credentialType: external_exports.literal("BEARER_TOKEN"), ...SECRET_SHAPES.BEARER_TOKEN }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("JWT_TOKEN"), ...SECRET_SHAPES.JWT_TOKEN }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("API_KEY"), ...SECRET_SHAPES.API_KEY }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("PASSPHRASE"), ...SECRET_SHAPES.PASSPHRASE }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("COOKIE"), ...SECRET_SHAPES.COOKIE }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("MAGIC_AUTH"), ...SECRET_SHAPES.MAGIC_AUTH }).strict(),
+  external_exports.object({
+    credentialType: external_exports.literal("USERNAME_PASSWORD"),
+    ...SECRET_SHAPES.USERNAME_PASSWORD
+  }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("SESSION_STATE"), ...SECRET_SHAPES.SESSION_STATE }).strict()
+]);
+var RevealCredentialSecretResponseSchema = external_exports.discriminatedUnion("credentialType", [
+  external_exports.object({
+    credentialType: external_exports.literal("USERNAME_PASSWORD"),
+    username: external_exports.string(),
+    password: external_exports.string()
+  }).strict(),
+  external_exports.object({
+    credentialType: external_exports.enum([
+      "BEARER_TOKEN",
+      "JWT_TOKEN",
+      "API_KEY",
+      "PASSPHRASE",
+      "COOKIE",
+      "MAGIC_AUTH"
+    ]),
+    secretValue: external_exports.string()
+  }).strict()
+]);
 
 // ../../packages/api-contracts/src/contracts/v1/credential.ts
 var c8 = initContract();
@@ -23930,6 +24248,55 @@ var credentialContract = c8.router({
       500: ErrorResponseSchema
     }
   },
+  // Replace the stored secret IN PLACE — same credentialId, new KMS envelope.
+  // Separate from PATCH so every route touching KMS or plaintext is greppable
+  // at its own URL. PUT (not PATCH) because the body carries the COMPLETE
+  // secret for the type, so the same request twice yields the same end state.
+  //
+  // Deliberately NOT subject to the CREDENTIAL_IN_USE guard that blocks delete
+  // and env-move during a live pentest: rotation preserves credentialId, so the
+  // engagement's credential set and its ScanCredential rows are untouched —
+  // which is the invariant that guard protects. Mid-engagement is precisely when
+  // a wrong password needs fixing.
+  rotateCredentialSecret: {
+    method: "PUT",
+    path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/secret",
+    pathParams: CredentialIdParamsSchema,
+    body: RotateCredentialSecretRequestSchema,
+    responses: {
+      // Unchanged response shape — a rotate NEVER echoes the secret back.
+      200: CredentialResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // 422 — body's credentialType differs from the stored row's
+      // (errorCode CREDENTIAL_ROTATE_TYPE_MISMATCH). Type changes stay
+      // delete + recreate.
+      422: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Return the stored plaintext to an authorized human. POST, not GET: it must
+  // never sit in an access log, a browser history entry, or a cacheable read.
+  // Requires a user principal — API keys are rejected, so a leaked trace_sk_*
+  // cannot exfiltrate customer credentials.
+  revealCredentialSecret: {
+    method: "POST",
+    path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/reveal",
+    pathParams: CredentialIdParamsSchema,
+    body: c8.noBody(),
+    responses: {
+      200: RevealCredentialSecretResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // 422 — SESSION_STATE has no reveal variant by construction
+      // (errorCode CREDENTIAL_REVEAL_UNSUPPORTED).
+      422: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   deleteCredential: {
     method: "DELETE",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId",
@@ -25714,7 +26081,7 @@ var CreateLinearTicketsParamsSchema = OrgIdParamsSchema.extend({
 });
 var CreateLinearTicketsRequestSchema = external_exports.object({
   /** UUID or PTF-N display id. Cap sized to the ~30s synchronous request budget. */
-  findingIds: external_exports.array(external_exports.string().min(1).max(64)).min(1).max(10),
+  findingIds: external_exports.array(external_exports.string().min(1).max(64)).min(1).max(50),
   /** Single-finding requests only — a title with >1 finding is a 400. */
   title: external_exports.string().min(1).max(255).optional(),
   /** Destination overrides — ADMIN ONLY (MANAGE_ORGANIZATION); a non-admin sending any is a 403. */
@@ -25965,8 +26332,7 @@ var OrgCapabilityValues = [
   "SCAN_SECRETS",
   "SCAN_DAST",
   "AUTO_PR_SCANS",
-  "AUTO_PUSH_SCANS",
-  "AUTO_FIX_PR"
+  "AUTO_PUSH_SCANS"
 ];
 var UpdateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(255).optional(),
@@ -26053,6 +26419,14 @@ var StaffOrganizationSummarySchema = external_exports.object({
   createdAt: external_exports.date()
 });
 var ListAllOrganizationsResponseSchema = external_exports.array(StaffOrganizationSummarySchema);
+var CreateOrganizationRequestSchema = external_exports.object({
+  name: external_exports.string().trim().min(2, "Organization name must be at least 2 characters").max(100, "Organization name must be 100 characters or fewer")
+});
+var CreateOrganizationResponseSchema = external_exports.object({
+  organizationId: external_exports.uuid(),
+  slug: external_exports.string(),
+  name: external_exports.string()
+});
 var OnboardingItemValues = [
   "CONNECT_CODE",
   "CONNECT_CLOUD",
@@ -26109,6 +26483,19 @@ var organizationContract = c20.router({
     },
     summary: "List every organization (Trace staff only)"
   },
+  createOrganization: {
+    method: "POST",
+    path: "/staff/organizations",
+    body: CreateOrganizationRequestSchema,
+    responses: {
+      201: CreateOrganizationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Create an organization (Trace staff only)"
+  },
   getOrganization: {
     method: "GET",
     path: "/organizations/:organizationId",
@@ -26525,10 +26912,189 @@ var CustomerPriorityCategoryValues = [
 ];
 var CustomerPriorityCategory = external_exports.enum(CustomerPriorityCategoryValues);
 
+// ../../packages/api-contracts/src/schemas/domain/pentest-customer-intake.schema.ts
+var IntakeSurfaceValues = [
+  "WEB",
+  "PUBLIC_API",
+  "INTERNAL_API",
+  "GRAPHQL",
+  "WEBHOOKS",
+  "MCP",
+  "AI_AGENTS",
+  "MOBILE",
+  "DESKTOP",
+  "CLI",
+  "BACKGROUND_JOBS"
+];
+var IntakeSurface = external_exports.enum(IntakeSurfaceValues);
+var PentestCustomerIntakeAnswersShape = external_exports.object({
+  issueClasses: external_exports.array(CustomerPriorityCategory).max(11).optional(),
+  issueClassesNotes: external_exports.string().max(5e3).optional(),
+  focusAreas: external_exports.string().max(5e3).optional(),
+  rolesAndPermissions: external_exports.string().max(1e4).optional(),
+  authenticationSetup: external_exports.string().max(5e3).optional(),
+  tenantIsolationExpectation: external_exports.string().max(5e3).optional(),
+  surfaces: external_exports.array(IntakeSurface).max(11).optional(),
+  surfacesNotes: external_exports.string().max(5e3).optional(),
+  thirdParties: external_exports.string().max(5e3).optional(),
+  sensitiveData: external_exports.string().max(5e3).optional(),
+  neverTouch: external_exports.string().max(5e3).optional(),
+  knownRisks: external_exports.string().max(5e3).optional(),
+  tribalKnowledge: external_exports.string().max(1e4).optional()
+});
+var PentestCustomerIntakeAnswersSchema = PentestCustomerIntakeAnswersShape.strict();
+var PentestCustomerIntakeStoredAnswersSchema = PentestCustomerIntakeAnswersShape;
+var PentestCustomerIntakeWriteAnswersSchema = PentestCustomerIntakeAnswersShape.extend({
+  /** @deprecated Retired question. Accepted for in-flight clients, never stored. */
+  testEnvironment: external_exports.string().max(100).optional(),
+  /** @deprecated Retired question. Accepted for in-flight clients, never stored. */
+  reposAndBranches: external_exports.string().max(5e3).optional()
+}).strict();
+var PENTEST_CUSTOMER_INTAKE_ANSWER_KEYS = [
+  "issueClasses",
+  "issueClassesNotes",
+  "focusAreas",
+  "rolesAndPermissions",
+  "authenticationSetup",
+  "tenantIsolationExpectation",
+  "surfaces",
+  "surfacesNotes",
+  "thirdParties",
+  "sensitiveData",
+  "neverTouch",
+  "knownRisks",
+  "tribalKnowledge"
+];
+var PENTEST_CUSTOMER_INTAKE_LABELS = {
+  issueClasses: "Issue classes to prioritize",
+  issueClassesNotes: "Issue classes, additional notes",
+  focusAreas: "Focus areas",
+  rolesAndPermissions: "Roles and permissions",
+  authenticationSetup: "Authentication setup",
+  tenantIsolationExpectation: "Tenant isolation expectations",
+  surfaces: "Surfaces in scope",
+  surfacesNotes: "Surfaces, additional notes",
+  thirdParties: "Third parties and integrations",
+  sensitiveData: "Sensitive data",
+  neverTouch: "Out of bounds / never touch",
+  knownRisks: "Known risks",
+  tribalKnowledge: "Tribal knowledge"
+};
+var PENTEST_CUSTOMER_INTAKE_QUESTIONS = [
+  {
+    kind: "multiSelect",
+    key: "issueClasses",
+    notesKey: "issueClassesNotes",
+    question: "Which issue classes worry you most?",
+    helper: "(authn bypass / broken access control / injection / data exposure / supply chain / infra exposure / multi-tenant isolation / crypto / business logic / SSRF / XSS)",
+    notesQuestion: "Anything else about issue classes?"
+  },
+  {
+    kind: "text",
+    key: "focusAreas",
+    question: "Is there any particular application or area you want us to spend extra focus on?"
+  },
+  {
+    kind: "text",
+    key: "rolesAndPermissions",
+    question: "What roles/permissions can users take in your application?",
+    helper: "Explain each role and what it should/shouldn't be able to do."
+  },
+  {
+    kind: "text",
+    key: "authenticationSetup",
+    question: "Anything we should know about your authentication setup?",
+    helper: "(e.g. mid-migration between providers, legacy login still live; otherwise we'll figure it out from the code)"
+  },
+  {
+    kind: "text",
+    key: "tenantIsolationExpectation",
+    question: "What's your expectation for isolation between tenants/organizations?",
+    helper: "What should never be reachable across that boundary?"
+  },
+  {
+    kind: "multiSelect",
+    key: "surfaces",
+    notesKey: "surfacesNotes",
+    question: "Which surfaces exist?",
+    helper: "(web / public API / internal API / GraphQL / webhooks / MCP / AI agents / mobile / desktop / CLI / background jobs)",
+    notesQuestion: "Anything else about your surfaces?"
+  },
+  {
+    kind: "text",
+    key: "thirdParties",
+    question: "Which third parties do you connect to, and should we mock them or stand them up?",
+    helper: "(e.g. CRMs, payment/bank APIs, identity providers, email/SMS, LLM providers)"
+  },
+  {
+    kind: "text",
+    key: "sensitiveData",
+    question: "What data must no attacker ever access?",
+    helper: "And what data do you not care about?"
+  },
+  {
+    kind: "text",
+    key: "neverTouch",
+    question: "What must we never touch or trigger?",
+    helper: "(destructive endpoints, real customer emails/SMS, third-party prod accounts, specific tenants)"
+  },
+  {
+    kind: "text",
+    key: "knownRisks",
+    question: "What do you already know is broken or risky (i.e. what keeps you up at night)?"
+  },
+  {
+    kind: "text",
+    key: "tribalKnowledge",
+    question: "What tribal knowledge would we only learn by asking?",
+    helper: "Anything intentionally weird, counter-intuitive, or likely to trip us up; behavior that looks like a bug but isn't, dead code that's still deployed, a service that isn't what its name suggests."
+  }
+];
+var PENTEST_CUSTOMER_INTAKE_QUESTION_COUNT = PENTEST_CUSTOMER_INTAKE_QUESTIONS.length;
+var INTAKE_ISSUE_CLASS_LABELS = {
+  AUTHN_BYPASS: "Authn bypass",
+  AUTHZ_IDOR: "Broken access control",
+  INJECTION: "Injection",
+  DATA_EXPOSURE: "Data exposure",
+  SUPPLY_CHAIN: "Supply chain",
+  INFRA_EXPOSURE: "Infra exposure",
+  MULTI_TENANT_ISOLATION: "Multi-tenant isolation",
+  CRYPTO_WEAKNESS: "Crypto",
+  BUSINESS_LOGIC: "Business logic",
+  SSRF: "SSRF",
+  XSS: "XSS"
+};
+var INTAKE_SURFACE_LABELS = {
+  WEB: "Web",
+  PUBLIC_API: "Public API",
+  INTERNAL_API: "Internal API",
+  GRAPHQL: "GraphQL",
+  WEBHOOKS: "Webhooks",
+  MCP: "MCP",
+  AI_AGENTS: "AI agents",
+  MOBILE: "Mobile",
+  DESKTOP: "Desktop",
+  CLI: "CLI",
+  BACKGROUND_JOBS: "Background jobs"
+};
+function normalizePentestCustomerIntakeAnswers(answers) {
+  const next = { ...answers };
+  if (next.issueClasses !== void 0) {
+    next.issueClasses = Array.from(new Set(next.issueClasses)).sort();
+  }
+  if (next.surfaces !== void 0) {
+    next.surfaces = Array.from(new Set(next.surfaces)).sort();
+  }
+  return next;
+}
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
 });
+var PentestApplicationParamsSchema = PentestIdParamsSchema.extend({
+  applicationId: external_exports.uuid()
+});
 var CustomerPentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: PentestIdOrDisplayIdSchema
 });
@@ -26541,6 +27107,21 @@ var CustomerPentestStatusValues = [
   "PAUSED"
 ];
 var CustomerPentestStatus = external_exports.enum(CustomerPentestStatusValues);
+var BoundPentestApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string(),
+  type: external_exports.enum(ApplicationTypeValues),
+  // `z.string()`, not `z.url()` — every other URL field on this surface's RESPONSE
+  // side is a plain string. Writes already validate with `z.url()`
+  // (`application.api.ts`), so re-validating stored data here buys nothing and would
+  // let one legacy row 404 an entire staff page through `safeParse`.
+  applicationUrl: external_exports.string().nullable(),
+  /**
+   * Bind order. Never renumbered on unbind, so gaps are normal and only the
+   * relative order carries meaning — the lowest ordinal is the compat mirror.
+   */
+  ordinal: external_exports.number().int()
+});
 var PentestResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
@@ -26557,8 +27138,21 @@ var PentestResponseSchema = external_exports.object({
   scope: external_exports.string().nullable(),
   /** Granular stage state. Wizard surfaces this; worker transitions write it. */
   currentStage: PentestStage,
-  /** v1 supports one application per pentest. M:N (PentestApplication) deferred to v1.5. */
+  /**
+   * The LOWEST-ORDINAL bound application — a compat mirror of the authoritative
+   * `PentestApplication` join, not a distinct concept. Read `applications` when you
+   * need the engagement's real scope; a multi-application engagement reports its
+   * first binding here and would otherwise understate what it covers.
+   */
   primaryApplicationId: external_exports.uuid().nullable(),
+  /**
+   * Every bound application, ordinal-ascending. `.optional()` for rolling-deploy
+   * safety: `apps/web` (Vercel) deploys ahead of `apps/api` (ECS), so a new web
+   * build briefly reads responses from an API that does not send this yet — the
+   * precedent is `PentestDetailResponseSchema` below. Absent means "this API is
+   * older", NOT "no applications bound"; fall back to `primaryApplicationId`.
+   */
+  applications: external_exports.array(BoundPentestApplicationSchema).optional(),
   /** Customer threat-model context — free text. Used by hypothesis-gen prompt. */
   customerConcernsContext: external_exports.string().nullable(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory),
@@ -26587,7 +27181,44 @@ var PentestDetailResponseSchema = PentestResponseSchema.extend({
   systemUnderTest: external_exports.string().optional(),
   testingWindowStart: external_exports.coerce.date().nullable().optional(),
   testingWindowEnd: external_exports.coerce.date().nullable().optional(),
-  engagementMetadataOverrides: EngagementMetadataOverridesSchema.optional()
+  engagementMetadataOverrides: EngagementMetadataOverridesSchema.optional(),
+  /**
+   * True once the engagement's repository scope has been snapshotted, which
+   * PERMANENTLY refuses bind and unbind (`repositoryScopes > 0` in
+   * `requireBindableInLock`).
+   *
+   * This one refusal only — that guard also refuses on `PENTEST_CLOSED` and on a
+   * non-scoping stage, both of which the client can already read off `status` and
+   * `currentStage` on this same response. So `false` means "not frozen by the
+   * snapshot", NOT "a bind will succeed"; a consumer that gates a control must check
+   * the stage and closed state too.
+   *
+   * Needed as its OWN field because nothing else on the wire answers it: the scope
+   * freezes at the first scope-consuming session create, and only VALIDATION moves
+   * the stage, so RECON / CODE_REVIEW / PRODUCT_RECON leave the engagement in
+   * `DRAFT` with permanently frozen bindings. `getRepositoryScope` reports
+   * `source: 'PENTEST_SCOPE'` only PAST the scoping stages, so a frozen `DRAFT`
+   * engagement still returns live application links there.
+   *
+   * Scoped to BINDINGS, not to the whole target: environment add/remove is gated on
+   * stage alone (`PentestEnvironmentService`, `NON_SCOPING_PENTEST_STAGES`), and
+   * `DRAFT` is a scoping stage — so a consumer must not disable environment editing
+   * on this flag. Doing so would remove the one provisioning action a frozen
+   * multi-application engagement still legitimately needs.
+   *
+   * Detail-only (the list schema deliberately carries no per-pentest aggregates) and
+   * `.optional()` for the same rolling-deploy reason as the fields above.
+   */
+  applicationBindingFrozen: external_exports.boolean().optional(),
+  /**
+   * Optional customer intake questionnaire answers. Staff detail only.
+   * `.optional()` for rolling-deploy safety (Vercel ahead of ECS).
+   *
+   * Read with the lenient schema for the same reason: an API that hasn't
+   * deployed yet still answers with keys from a retired question, and a strict
+   * parse here would fail the whole response instead of ignoring them.
+   */
+  customerIntakeAnswers: PentestCustomerIntakeStoredAnswersSchema.nullable().optional()
 });
 var CustomerPentestShellResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
@@ -26596,6 +27227,24 @@ var CustomerPentestShellResponseSchema = external_exports.object({
   title: external_exports.string(),
   description: external_exports.string().nullable(),
   customerStatus: CustomerPentestStatus,
+  /** The LOWEST-ORDINAL application under test — a compat mirror of the join. Null =
+   * engagement not bound to an application. `.optional()` for rolling-deploy
+   * safety — apps/web (Vercel) deploys ahead of apps/api (ECS).
+   *
+   * Read `applicationIds` for the homepage "In scope" chips: this field names one
+   * application, so using it there marked the other bindings of a multi-application
+   * engagement "Not in current scope" — a false statement on a customer surface. */
+  primaryApplicationId: external_exports.uuid().nullable().optional(),
+  /**
+   * EVERY application this engagement covers, in bind order. Ids only — the customer
+   * homepage already has the org's applications and resolves names locally, and this
+   * surface deliberately shows no more application detail than it did.
+   *
+   * `.optional()` for the same rolling-deploy reason: absent means "this API is
+   * older", NOT "nothing bound", so a consumer must fall back to
+   * `primaryApplicationId` rather than claim the engagement covers nothing.
+   */
+  applicationIds: external_exports.array(external_exports.uuid()).optional(),
   startedAt: external_exports.coerce.date().nullable(),
   endedAt: external_exports.coerce.date().nullable(),
   createdAt: external_exports.coerce.date(),
@@ -26614,8 +27263,35 @@ var ListCustomerPentestsResponseSchema = external_exports.array(CustomerPentestR
 var CustomerPentestDetailResponseSchema = CustomerPentestResponseSchema.extend({
   systemUnderTest: external_exports.string().optional(),
   testingWindowStart: external_exports.coerce.date().nullable().optional(),
-  testingWindowEnd: external_exports.coerce.date().nullable().optional()
+  testingWindowEnd: external_exports.coerce.date().nullable().optional(),
+  /**
+   * Discovery flags for the questionnaire header CTA. Answer bodies live on
+   * GET …/questionnaire. `.optional()` for rolling-deploy safety.
+   */
+  questionnaireEditable: external_exports.boolean().optional(),
+  hasQuestionnaireAnswers: external_exports.boolean().optional()
 });
+var CustomerPentestQuestionnaireResponseSchema = external_exports.object({
+  pentestId: external_exports.uuid(),
+  /** True iff currentStage ∈ SCOPING_PENTEST_STAGES (DRAFT | READY_TO_START). */
+  editable: external_exports.boolean(),
+  /**
+   * Lenient on unknown keys: during a rolling deploy the dashboard runs against
+   * an API that still answers with a retired question's key, and a strict parse
+   * would turn that into a broken page instead of an ignored field. Writes stay
+   * strict — see the upsert request below.
+   */
+  answers: PentestCustomerIntakeStoredAnswersSchema.nullable(),
+  updatedAt: external_exports.coerce.date()
+});
+var UpsertCustomerPentestQuestionnaireRequestSchema = external_exports.object({
+  /**
+   * Full answers object, or null to clear. Keys of retired questions are
+   * accepted and dropped so a tab opened before the deploy can still save;
+   * keys that were never questions are still rejected.
+   */
+  answers: PentestCustomerIntakeWriteAnswersSchema.nullable()
+}).strict();
 var ReadPentestResponseSchema = external_exports.union([
   PentestDetailResponseSchema,
   CustomerPentestShellResponseSchema
@@ -26675,6 +27351,14 @@ var UpdatePentestRequestSchema = external_exports.object({
   scope: external_exports.string().max(5e4).nullable().optional(),
   startedAt: external_exports.coerce.date().nullable().optional(),
   endedAt: external_exports.coerce.date().nullable().optional(),
+  /**
+   * SINGLE-APPLICATION COMPAT PATH ONLY: means "replace the bound set with exactly
+   * this application", or clear it on `null`. Rejected with 409
+   * `PENTEST_MULTI_APPLICATION_USE_BIND_ENDPOINT` when 2+ applications are already
+   * bound — otherwise one PATCH would silently unbind N−1 of them and bypass the
+   * per-application unbind guard. Use `bindApplication` / `unbindApplication` for
+   * anything multi-application.
+   */
   primaryApplicationId: external_exports.uuid().nullable().optional(),
   customerConcernsContext: external_exports.string().max(2e4).nullable().optional(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory).max(20).optional(),
@@ -26688,6 +27372,9 @@ var UpdatePentestRequestSchema = external_exports.object({
   perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   lifecycleReason: external_exports.string().trim().min(1).max(2e3).optional()
 });
+var BindPentestApplicationRequestSchema = external_exports.object({
+  applicationId: external_exports.uuid()
+}).strict();
 
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-stage-transition.api.ts
 var StageTransitionResponseSchema = external_exports.object({
@@ -26793,6 +27480,33 @@ var pentestContract = c21.router({
       500: ErrorResponseSchema
     }
   },
+  getCustomerPentestQuestionnaire: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire",
+    pathParams: CustomerPentestIdParamsSchema,
+    responses: {
+      200: CustomerPentestQuestionnaireResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  upsertCustomerPentestQuestionnaire: {
+    method: "PUT",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: UpsertCustomerPentestQuestionnaireRequestSchema,
+    responses: {
+      200: CustomerPentestQuestionnaireResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   createPentest: {
     method: "POST",
     path: "/organizations/:organizationId/pentests",
@@ -26849,6 +27563,49 @@ var pentestContract = c21.router({
       500: ErrorResponseSchema
     }
   },
+  // POST/DELETE-per-row rather than a batch set on PATCH, mirroring
+  // `pentest-environment.ts`: every rejection stays attributable to ONE
+  // application, where a set-diff would fail an entire save on one blocked
+  // removal with no way to say which.
+  bindApplication: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/applications",
+    pathParams: PentestIdParamsSchema,
+    body: BindPentestApplicationRequestSchema,
+    responses: {
+      // The resulting bound set, NOT the detail shape. The 201 body is assembled purely
+      // inside the bind transaction, so it cannot describe a state the write did not
+      // produce; deriving the engagement cover here would mean a fallible read AFTER the
+      // commit. Callers that need the cover GET the pentest.
+      201: PentestResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // 409 — PENTEST_APPLICATION_ALREADY_BOUND (unique violation),
+      // PENTEST_APPLICATION_FROZEN_AT_STAGE (past scoping), or
+      // PENTEST_APPLICATION_SCOPE_FROZEN (repository scope already snapshotted,
+      // so a new binding could never enter it).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  unbindApplication: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/applications/:applicationId",
+    pathParams: PentestApplicationParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // 409 — PENTEST_APPLICATION_UNBIND_BLOCKED (this application still has
+      // linked environments), or either frozen guard as on bind.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getScanReuseSuggestions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/scan-reuse-suggestions",
@@ -27427,7 +28184,22 @@ var ScopeRowSchema = external_exports.object({
   type: ScopeRowType,
   label: external_exports.string().min(1).max(200),
   description: external_exports.string().max(500),
-  inScope: external_exports.boolean()
+  inScope: external_exports.boolean(),
+  /**
+   * Which bound applications this asset belongs to — DISPLAY NAMES in bind order
+   * (multi-application PR 7).
+   *
+   * A SNAPSHOT, like `PentestRepositoryScope.purposeSnapshot`, not a reference: the
+   * report row is a frozen customer-facing document, and resolving application ids at
+   * render time would let a regenerate after an unbind silently shrink a published
+   * scope column. A name that no longer matches a bound application is therefore
+   * legitimate history, not an error.
+   *
+   * Absent or empty means "provenance unknown" — the renderer omits the cell rather
+   * than printing "none" (the PR 1b hand-off rule, shared with the session briefs).
+   * Capped at the row cap so it can never be the binding constraint below it.
+   */
+  applications: external_exports.array(external_exports.string().min(1).max(200)).max(100).optional()
 });
 var ScopeRowsJsonSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -27650,7 +28422,13 @@ var ReportCoverBlockSchema = external_exports.object({
   testingWindowStart: NullableCoverFieldSchema,
   testingWindowEnd: NullableCoverFieldSchema,
   classification: CoverFieldSchema,
-  documentId: CoverFieldSchema
+  documentId: CoverFieldSchema,
+  /** Report attribution (derive-with-override like the rest; the derived
+   * value is a firm-default constant, so `value` is always present).
+   * testerName renders as "<name> · <firm>" in the cover's Tested-by row;
+   * approverName is the "Approved by" row (conventionally "Name, Title"). */
+  testerName: CoverFieldSchema,
+  approverName: CoverFieldSchema
 });
 var ReportCoverFieldNameValues = [
   "customerOrgName",
@@ -27660,7 +28438,9 @@ var ReportCoverFieldNameValues = [
   "testingWindowStart",
   "testingWindowEnd",
   "classification",
-  "documentId"
+  "documentId",
+  "testerName",
+  "approverName"
 ];
 var ReportCoverFieldName = external_exports.enum(ReportCoverFieldNameValues);
 var ApplyReportCoverRequestSchema = external_exports.object({
@@ -27719,6 +28499,20 @@ var ReportCanvasResponseSchema = external_exports.object({
   /** Per-field override provenance for the cover grid (RS2). */
   cover: ReportCoverBlockSchema,
   scopeRows: external_exports.array(ScopeRowSchema),
+  /**
+   * Every bound application's name, in bind order — what the scope editor offers as
+   * per-row application toggles (multi-application PR 7). Empty for an unbound
+   * engagement; a single entry means the editor stays hidden, matching the report's
+   * own rule that one application needs no attribution column.
+   *
+   * OPTIONAL for the wire, not because the server ever omits it: `apps/web` deploys on
+   * merge while the API deploys after it, and the ts-rest client does not validate
+   * response bodies (`apps/web/lib/api-client.ts` sets no `validateResponse`), so a new
+   * bundle briefly reads an old API's response. A required field would be typed as
+   * present while arriving `undefined` — the same reason
+   * `AgentSessionSpawnContextSchema.applications` is optional. Consumers default it.
+   */
+  boundApplications: external_exports.array(external_exports.string()).optional(),
   /** null = undrafted, or stored JSON was unparseable (degraded — never 500). */
   narrative: StoredNarrativeJsonSchema.nullable(),
   /** Render Section 05 (Remediation Timeline) in the PDF. Lazy/no-row previews
@@ -27862,6 +28656,11 @@ var IssuedReportSnapshotSchema = external_exports.object({
      * pre-feature `input_json` still parses (absent → undefined → standard
      * branding). */
     coBrandName: external_exports.string().nullable().optional(),
+    /** Report attribution frozen at issuance. Optional so every pre-feature
+     * `input_json` still parses (absent → legacy rendering: firm-only
+     * Tested-by row, no Approved-by row). */
+    testerName: external_exports.string().optional(),
+    approverName: external_exports.string().optional(),
     engagementTitle: external_exports.string(),
     engagementSubtitle: external_exports.string(),
     systemUnderTest: external_exports.string(),
@@ -28189,7 +28988,18 @@ var PentestFindingResponseSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
   pentestId: external_exports.uuid(),
-  displayId: external_exports.number(),
+  /**
+   * Customer-facing finding number (the N in `PTF-N`). NULL until the finding is
+   * published: a finding never shown to a customer has no customer-facing number yet.
+   * Staff and agents identify an unpublished finding by `pentestFindingId` + `title`.
+   *
+   * Nullable here so it cascades to the staff and AGENT derivations below — every
+   * agent-session type except REPORT reads findings with no visibility filter
+   * (agent-session.service.ts operatorListFindings/operatorGetFinding), so a draft
+   * reaches them and a non-null schema would be a Zod 500. The customer derivations
+   * re-narrow it to non-null, because customer visibility implies published.
+   */
+  displayId: external_exports.number().int().positive().nullable(),
   title: external_exports.string(),
   description: external_exports.string(),
   severity: PentestFindingSeverity,
@@ -28263,9 +29073,11 @@ var OperatorFindingReadSchema = PentestFindingResponseSchema.omit({
   externalTicket: true
 });
 var OperatorFindingRetestSchema = external_exports.object({
+  retestId: external_exports.uuid(),
   outcome: RetestOutcome,
   notes: external_exports.string().nullable(),
   testedAt: external_exports.coerce.date(),
+  editedAt: external_exports.coerce.date().nullable(),
   source: PentestFindingRetestSource
 });
 var OperatorFindingDetailSchema = OperatorFindingReadSchema.extend({
@@ -28295,10 +29107,20 @@ var CustomerPentestFindingResponseSchema = PentestFindingResponseSchema.omit({
   reportProseAt: true,
   reportProseStatus: true
 }).extend({
+  // Customer findings are published-only (customerVisiblePentestFindingWhere), and
+  // publishing is what assigns the number, so it always exists here. Re-narrowed from
+  // the nullable root so the customer dashboard never needs a draft affordance; the
+  // handler mapper throws if the invariant is ever violated rather than coercing.
+  displayId: external_exports.number().int().positive(),
   // Customer-safe prose/rendering status. This preserves report/PDF heading
   // semantics without exposing the staff-only provenance marker pair.
   renderedStatus: PentestFindingStatus,
-  repositories: external_exports.array(CustomerPentestFindingRepositorySchema)
+  repositories: external_exports.array(CustomerPentestFindingRepositorySchema),
+  // True when the customer has an unresolved dispute on this finding. Drives the
+  // customer "dispute under review" hint + suppresses the re-dispute affordance,
+  // even after a retest moved the finding off CONTESTED. Only this derived
+  // boolean crosses the trust boundary — never the staff contest list.
+  hasOpenContest: external_exports.boolean()
 });
 var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   organizationId: true,
@@ -28310,6 +29132,9 @@ var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   reportProseAt: true,
   reportProseStatus: true
 }).extend({
+  // Published-only, same as the customer detail schema above — re-narrowed from the
+  // nullable root.
+  displayId: external_exports.number().int().positive(),
   repositories: external_exports.array(CustomerPentestFindingRepositorySchema)
 });
 var ListCustomerPentestFindingsResponseSchema = external_exports.array(
@@ -28455,7 +29280,12 @@ var RecoveredFindingResultSchema = external_exports.object({
   status: external_exports.enum(["recovered", "skipped"]),
   reason: external_exports.string().optional(),
   pentestFindingId: external_exports.uuid().optional(),
-  findingDisplayId: external_exports.int().optional(),
+  /**
+   * NULL when the recovered finding has no number yet. Recovered findings land
+   * UNPUBLISHED (see the docstring above), and publishing is what assigns the number,
+   * so `.optional()` alone would reject the `null` the service returns.
+   */
+  findingDisplayId: external_exports.int().positive().nullish(),
   /** Preview-only (dryRun): the title + severity the finding WOULD get. */
   findingTitle: external_exports.string().optional(),
   severity: PentestFindingSeverity.nullable().optional(),
@@ -28552,8 +29382,9 @@ var PentestFindingContestResponseSchema = external_exports.object({
   resolvedById: external_exports.uuid().nullable(),
   resolvedByName: external_exports.string().nullable(),
   resolvedAt: external_exports.coerce.date().nullable(),
-  // The finding status the resolution moved the finding to (PR 3): OPEN =
-  // dispute rejected; DISMISSED / ACCEPTED_WITH_CONTROLS = upheld. NULL while open.
+  // The finding's ACTUAL status at resolution time (any active status for a
+  // status-neutral reject). DISMISSED / ACCEPTED_WITH_CONTROLS ⇔ the dispute
+  // was accepted; anything else ⇔ rejected. NULL while open.
   resultStatus: PentestFindingStatus.nullable()
 });
 var ListPentestFindingContestsResponseSchema = external_exports.array(
@@ -28578,6 +29409,9 @@ var PentestFindingRetestResponseSchema = external_exports.object({
   testedById: external_exports.uuid(),
   testedByName: external_exports.string(),
   testedAt: external_exports.coerce.date(),
+  // Null = never corrected. Staff-only: the customer schema below is an explicit
+  // allowlist, so this cannot reach a customer by omission.
+  editedAt: external_exports.coerce.date().nullable(),
   source: PentestFindingRetestSource,
   retestRunId: external_exports.uuid().nullable(),
   performedByActorType: PentestAuditActorType,
@@ -29024,7 +29858,8 @@ var pentestFindingContract = c26.router({
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
-      // CONTEST_ALREADY_RESOLVED, non-CONTESTED finding, or PENTEST_CLOSED.
+      // CONTEST_ALREADY_RESOLVED, CONTEST_REJECT_NOT_ALLOWED (reject on a
+      // dismissed/accepted finding), or PENTEST_CLOSED.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -30000,28 +30835,6 @@ var repositoryContract = c31.router({
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
-  },
-  /**
-   * Set / clear the per-repo AI coding-agent override (PR 5).
-   * Body `{overrideTool}`: 'claude-code'|'codex' sets, `null` clears.
-   * Response `{aiToolingProfile}` is nullable: clearing on an undetected
-   * repo writes NULL to the column and returns `{aiToolingProfile: null}`.
-   * 422 = `PLATFORM_VALIDATION_UNSUPPORTED` for non-GITHUB platforms.
-   */
-  setAiToolingProfileOverride: {
-    method: "PATCH",
-    path: "/organizations/:organizationId/repositories/:repositoryId/ai-tooling-profile",
-    pathParams: RepositoryIdParamsSchema,
-    body: SetAiToolingProfileOverrideRequestSchema,
-    responses: {
-      200: SetAiToolingProfileOverrideResponseSchema,
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      422: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
   }
 });
 
@@ -31051,122 +31864,6 @@ var vulnerabilityContract = c36.router({
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/vulnerability-fix-run.api.ts
-var AGENT_FLAVORS = ["claude-code", "codex"];
-var VULNERABILITY_FIX_RUN_STATUSES = [
-  "QUEUED",
-  "RUNNING",
-  "ARTIFACTS_READY",
-  "NO_SAFE_FIX",
-  "PATCH_TOO_LARGE",
-  "TESTS_FAILED",
-  "PR_OPENED",
-  "INFRA_FAILED",
-  "STALE_VULN",
-  "TIMED_OUT",
-  "CANCELLED"
-];
-var VulnerabilityFixRunPathParamsSchema = VulnerabilityLookupIdParamsSchema.extend({
-  runId: external_exports.uuid()
-});
-var TriggerFixRunRequestSchema = external_exports.object({
-  agentFlavor: external_exports.enum(AGENT_FLAVORS).optional()
-});
-var VulnerabilityFixRunResponseSchema = external_exports.object({
-  runId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  vulnerabilityId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  status: external_exports.enum(VULNERABILITY_FIX_RUN_STATUSES),
-  agentFlavor: external_exports.enum(AGENT_FLAVORS),
-  triggeredByUserId: external_exports.uuid().nullable(),
-  triggeredByApiKeyId: external_exports.uuid().nullable(),
-  /**
-   * Display name + avatar of the triggering staff user, resolved
-   * server-side (mirrors `ScanResponseSchema.initiatedByName`). Populated by
-   * every endpoint (list, trigger, get, cancel) so the polled active row in
-   * the runs table keeps the resolved name. `null` only when the run has no
-   * triggering user (api-key path) or the user no longer exists.
-   */
-  triggeredByName: external_exports.string().nullable(),
-  triggeredByProfilePictureUrl: external_exports.string().nullable(),
-  prUrl: external_exports.string().nullable(),
-  summaryStatus: external_exports.string().nullable(),
-  modelUsed: external_exports.string().nullable(),
-  addedLines: external_exports.number().int().nullable(),
-  removedLines: external_exports.number().int().nullable(),
-  filesChanged: external_exports.number().int().nullable(),
-  statusDetails: external_exports.string().nullable(),
-  queuedAt: external_exports.iso.datetime(),
-  claimedAt: external_exports.iso.datetime().nullable(),
-  deadlineAt: external_exports.iso.datetime().nullable(),
-  completedAt: external_exports.iso.datetime().nullable(),
-  updatedAt: external_exports.iso.datetime()
-});
-var ListVulnerabilityFixRunsResponseSchema = external_exports.array(VulnerabilityFixRunResponseSchema);
-
-// ../../packages/api-contracts/src/contracts/v1/vulnerability-fix-run.ts
-var c37 = initContract();
-var vulnerabilityFixRunContract = c37.router({
-  triggerRun: {
-    method: "POST",
-    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/fix-pr-runs",
-    pathParams: VulnerabilityLookupIdParamsSchema,
-    body: TriggerFixRunRequestSchema,
-    responses: {
-      201: VulnerabilityFixRunResponseSchema,
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      409: ErrorResponseSchema,
-      429: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  },
-  getRun: {
-    method: "GET",
-    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/fix-pr-runs/:runId",
-    pathParams: VulnerabilityFixRunPathParamsSchema,
-    responses: {
-      200: VulnerabilityFixRunResponseSchema,
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  },
-  cancelRun: {
-    method: "POST",
-    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/fix-pr-runs/:runId/cancel",
-    pathParams: VulnerabilityFixRunPathParamsSchema,
-    body: null,
-    responses: {
-      200: VulnerabilityFixRunResponseSchema,
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      409: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  },
-  listRuns: {
-    method: "GET",
-    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/fix-pr-runs",
-    pathParams: VulnerabilityLookupIdParamsSchema,
-    responses: {
-      200: ListVulnerabilityFixRunsResponseSchema,
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  }
-});
-
 // ../../packages/api-contracts/src/schemas/api/v1/vulnerability-note.api.ts
 var VulnerabilityLookupNoteParamsSchema = OrgIdParamsSchema.extend({
   vulnerabilityId: VulnerabilityLookupIdSchema
@@ -31194,8 +31891,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c38 = initContract();
-var vulnerabilityNoteContract = c38.router({
+var c37 = initContract();
+var vulnerabilityNoteContract = c37.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -31376,8 +32073,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c39 = initContract();
-var webhookSettingsContract = c39.router({
+var c38 = initContract();
+var webhookSettingsContract = c38.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -31515,8 +32212,8 @@ var webhookSettingsContract = c39.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c40 = initContract();
-var v1Contract = c40.router(
+var c39 = initContract();
+var v1Contract = c39.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -31536,7 +32233,6 @@ var v1Contract = c40.router(
     knowledgeDocument: knowledgeDocumentContract,
     vulnerability: vulnerabilityContract,
     vulnerabilityNote: vulnerabilityNoteContract,
-    vulnerabilityFixRun: vulnerabilityFixRunContract,
     webhookSettings: webhookSettingsContract,
     application: applicationContract,
     chatSession: chatSessionContract,
@@ -31565,8 +32261,8 @@ var v1Contract = c40.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c41 = initContract();
-var contract = c41.router({
+var c40 = initContract();
+var contract = c40.router({
   v1: v1Contract
 });
 
@@ -31615,7 +32311,7 @@ var ComplianceRegimeValues = [
 var ComplianceRegime = external_exports.enum(ComplianceRegimeValues);
 
 // ../../packages/api-contracts/src/contracts/v1/agent-session-internal.ts
-var c42 = initContract();
+var c41 = initContract();
 var AgentSessionInternalParamsSchema = external_exports.object({
   agentSessionId: external_exports.uuid()
 });
@@ -31729,8 +32425,13 @@ var RecordCandidateVulnRequestSchema = external_exports.object({
   /** Idempotency key, stable across POST retries of one tool invocation. */
   sourceKey: external_exports.string().min(1).max(256),
   candidate: external_exports.object({
-    title: external_exports.string().min(1).max(200),
-    description: external_exports.string().min(1).max(5e3),
+    // Kept in lockstep with the record_candidate_vuln tool schema in
+    // apps/agent-session-host/src/recording.ts — a tool cap looser than this
+    // one turns a model-visible limit into an opaque API rejection. title 250 /
+    // description 6000 were raised from 200/5000, which observed usage had
+    // saturated (median description 4154 of 5000).
+    title: external_exports.string().min(1).max(250),
+    description: external_exports.string().min(1).max(6e3),
     attackChain: external_exports.string().min(1).max(5e3),
     exploitTechnique: external_exports.string().min(1).max(5e3),
     prerequisiteAccess: external_exports.string().min(1).max(5e3).optional(),
@@ -31773,7 +32474,7 @@ var RecordProductContextResponseSchema = external_exports.object({
   disputed: external_exports.number().int().nonnegative(),
   rejected: external_exports.number().int().nonnegative()
 });
-var ThreatModelStatement = external_exports.string().min(1).max(8e3);
+var ThreatModelStatement = external_exports.string().min(1).max(2e3);
 var RepoScopedThreatItem = external_exports.object({
   repoAlias: external_exports.string().min(1).max(200),
   statement: ThreatModelStatement
@@ -31924,17 +32625,71 @@ var RecordValidationResultRequestSchema = external_exports.object({
    * customerFacing labels. The api stores them on the `PentestExploitArtifact` row (caption →
    * `description`) and links them to the promoted finding.
    */
-  evidence: external_exports.array(RecordValidationEvidenceItemSchema).max(32).optional()
+  evidence: external_exports.array(RecordValidationEvidenceItemSchema).max(32).optional(),
+  /**
+   * PROVEN-only. The EXISTING finding this proof belongs to — the same root-cause
+   * weakness, already reported by an earlier session. Set it INSTEAD of promoting:
+   * the covered candidate(s) attach to that finding and no second finding is created.
+   *
+   * When set, `prose` is that finding's COMPLETE prose with this investigation's
+   * addition folded in (read it with get_finding first), not a fragment — the api
+   * writes the prose columns verbatim. Scoring fields (cvssVector / cweIds / category /
+   * owaspCategory / severity) are REJECTED on a bind rather than silently dropped; a
+   * second proof of a known weakness must not re-score a finding staff already
+   * triaged. `repositories` IS applied, additively.
+   */
+  bindToPentestFindingId: external_exports.uuid().optional(),
+  /**
+   * The bound finding's `updatedAt` as returned by get_finding. Optimistic lock: a
+   * staff edit landing between the read and this call returns BIND_STALE_FINDING
+   * instead of silently clobbering their text. Required whenever
+   * `bindToPentestFindingId` is set AND `prose` is supplied.
+   */
+  bindExpectedUpdatedAt: external_exports.coerce.date().optional()
 }).refine((body) => (body.hypothesisIds?.length ?? 0) > 0 || body.hypothesisId !== void 0, {
   message: "record_validation_result requires hypothesisIds (or the legacy hypothesisId)",
   path: ["hypothesisIds"]
-});
+}).refine(
+  (body) => body.bindToPentestFindingId === void 0 || body.prose == null || body.bindExpectedUpdatedAt !== void 0,
+  {
+    message: "bindExpectedUpdatedAt is required when binding with prose (pass the finding updatedAt from get_finding)",
+    path: ["bindExpectedUpdatedAt"]
+  }
+);
 var RecordValidationResultResponseSchema = external_exports.object({
   attemptId: external_exports.uuid(),
   verdict: ValidationVerdict,
   /** True when a PentestFinding was created from this PROVEN result. */
   promoted: external_exports.boolean(),
-  findingDisplayId: external_exports.number().int().positive().optional(),
+  /**
+   * The promoted finding's customer-facing number, or NULL when it has none yet — a
+   * freshly promoted finding is UNPUBLISHED, and publishing is what assigns the number.
+   * `promoted: true` with `findingDisplayId: null` means "finding created, not yet
+   * numbered".
+   */
+  findingDisplayId: external_exports.number().int().positive().nullish(),
+  /**
+   * The promoted finding's durable id, present whenever `promoted` is true. This is the
+   * handle the agent acts on — and once numbering moves to publish it is the ONLY handle
+   * a freshly promoted finding has, since `findingDisplayId` is null until then.
+   */
+  pentestFindingId: external_exports.uuid().optional(),
+  /**
+   * True when the verdict attached to an EXISTING finding (`bindToPentestFindingId`)
+   * instead of promoting a new one. `promoted` stays false in that case, while
+   * `pentestFindingId` carries the bound finding — so the agent still holds the handle
+   * for the finding it just acted on.
+   */
+  bound: external_exports.boolean().optional(),
+  /**
+   * How the bind's addition landed. REPORT_PROSE = merged into the finding's report prose
+   * and its repository links (it was unpublished). FINDING_NOTE = filed as a staff note
+   * instead, because the finding is PUBLISHED: nothing customer-facing on it is
+   * agent-editable, which covers the prose AND any cited repository locations. NONE =
+   * there was nothing to apply — no prose and no citations, or a replay, whose original
+   * call already applied whatever it carried. Present whenever `bound`.
+   */
+  deltaApplied: external_exports.enum(["REPORT_PROSE", "FINDING_NOTE", "NONE"]).optional(),
   /**
    * The candidate(s) the verdict was bound to (PR A) — each as {displayId, title} so the
    * agent can notice a mis-tag by comparing the echoed TITLE against what it actually
@@ -31999,6 +32754,55 @@ var AgentSessionLoginCodeResponseSchema = external_exports.object({
   value: external_exports.string().optional(),
   receivedAt: external_exports.coerce.date().optional()
 });
+var AgentSessionListInboxMessagesRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Which account's inbox (by `Credential.label`); omit if exactly one is readable. */
+  credentialLabel: external_exports.string().min(1).max(200).optional(),
+  /** Max messages, newest first. Clamped server-side. */
+  limit: external_exports.number().int().positive().max(50).optional()
+});
+var InboxMessageSummarySchema = external_exports.object({
+  messageId: external_exports.string().min(1).max(500),
+  from: external_exports.string().max(500),
+  subject: external_exports.string().max(1e3).nullable(),
+  /** Provider-generated short body preview. */
+  preview: external_exports.string().max(2e3).nullable(),
+  receivedAt: external_exports.coerce.date(),
+  unread: external_exports.boolean()
+});
+var AgentSessionListInboxMessagesResponseSchema = external_exports.object({
+  /** The account whose inbox was read, echoed so the agent can pass it to get_email. */
+  credentialLabel: external_exports.string().max(200),
+  messages: external_exports.array(InboxMessageSummarySchema)
+});
+var AgentSessionGetInboxMessageRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Message id from a `list_emails` result. */
+  messageId: external_exports.string().min(1).max(500),
+  credentialLabel: external_exports.string().min(1).max(200).optional()
+});
+var AgentSessionGetInboxMessageResponseSchema = external_exports.object({
+  credentialLabel: external_exports.string().max(200),
+  message: InboxMessageSummarySchema.extend({
+    /**
+     * The body as plain text, prompt-injection-neutralized and length-capped
+     * ({@link INBOX_MESSAGE_BODY_MAX_CHARS}). Deliberately NOT run through the
+     * credential redactor — that would rewrite the `?token=…` in a magic link,
+     * which is the artifact the agent needs.
+     */
+    body: external_exports.string(),
+    /** True when the body was truncated at the cap. */
+    truncated: external_exports.boolean()
+  }),
+  /**
+   * http(s) links extracted from the message in priority order (hrefs first,
+   * then inline text URLs), pre-computed so the agent doesn't have to parse the
+   * body. Same extraction and same URL-safety guards the login flow used.
+   */
+  links: external_exports.array(external_exports.string()),
+  /** Detected one-time code, if the message carried one. */
+  otp: external_exports.string().nullable()
+});
 var RenewCloudCredentialsRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative()
 });
@@ -32014,6 +32818,42 @@ var RenewCloudCredentialsResponseSchema = external_exports.object({
     accessToken: external_exports.string().min(1)
   }).nullable()
 });
+var ConvexReconRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative()
+});
+var ConvexReconInventorySchema = external_exports.discriminatedUnion("status", [
+  /**
+   * Convex's `apiSpec` payload, forwarded verbatim: per function the identifier,
+   * type, visibility (public/internal) and argument validators, plus httpRoutes
+   * and cronSpecs. Deliberately `unknown` — it describes the customer's own
+   * deployment, not a Trace domain object, so pinning its shape would break when
+   * Convex extends it.
+   */
+  external_exports.object({ status: external_exports.literal("ok"), functions: external_exports.unknown() }),
+  /** Convex answered HTTP 200 with `status: "error"` — a function-level error. */
+  external_exports.object({ status: external_exports.literal("error"), message: external_exports.string() }),
+  /** Convex 401/403 — the grant is gone; the row was flipped ACCESS_DENIED. */
+  external_exports.object({ status: external_exports.literal("access_denied") }),
+  /** Convex 429/5xx/timeout, a decrypt failure, or the response budget spent. */
+  external_exports.object({ status: external_exports.literal("unavailable") }),
+  /** Over the per-deployment byte cap. NEVER truncated — a half inventory read as
+   *  complete is worse than an explicit gap. */
+  external_exports.object({ status: external_exports.literal("too_large"), bytes: external_exports.number().int().nonnegative() })
+]);
+var ConvexReconDeploymentSchema = external_exports.object({
+  deploymentName: external_exports.string().min(1),
+  /** Convex's DeploymentType verbatim (dev/prod/preview/custom) — never an enum. */
+  deploymentType: external_exports.string().min(1),
+  /** Region-qualified, from the stored row. NEVER synthesised from deploymentName. */
+  convexCloudUrl: external_exports.string().min(1),
+  /** Null when get_canonical_urls failed at connect; the host is not derivable. */
+  convexSiteUrl: external_exports.string().min(1).nullable(),
+  inventory: ConvexReconInventorySchema
+});
+var ConvexReconResponseSchema = external_exports.object({
+  /** Empty when the org has no connected, key-bearing Convex deployment. */
+  deployments: external_exports.array(ConvexReconDeploymentSchema)
+});
 var AgentSessionGetSessionStateRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   /** Which SESSION_STATE credential to fetch (from the non-secret env reference). */
@@ -32154,6 +32994,32 @@ var OperatorRecordFindingRetestRequestSchema = CreatePentestFindingRetestRequest
     });
   }
 });
+var OperatorRetestAckSchema = OperatorFindingReadSchema.extend({
+  retestId: external_exports.uuid()
+});
+var OperatorEditFindingRetestRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  retestId: external_exports.uuid(),
+  outcome: RetestOutcome.optional(),
+  notes: external_exports.string().trim().min(1).max(1e4).optional(),
+  verification: external_exports.string().min(1).max(8e3).optional()
+}).superRefine((v2, ctx) => {
+  if (v2.outcome === void 0 && v2.notes === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "provide outcome, notes, or both \u2014 an edit must change something",
+      path: ["notes"]
+    });
+  }
+  if (v2.verification !== void 0 && v2.outcome !== "FIXED") {
+    ctx.addIssue({
+      code: "custom",
+      message: "verification report prose is only allowed when outcome is FIXED",
+      path: ["verification"]
+    });
+  }
+});
 var OperatorMarkRemediationReportedRequestSchema = MarkPentestFindingRemediationReportedRequestSchema.extend({
   runVersion: operatorRunVersion,
   reason: operatorReason,
@@ -32300,7 +33166,7 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
   expectedUpdatedAt: reportExpectedUpdatedAt,
   rows: external_exports.array(ScopeRowSchema).max(100)
 });
-var agentSessionInternalContract = c42.router({
+var agentSessionInternalContract = c41.router({
   postEvents: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/events",
@@ -32457,6 +33323,10 @@ var agentSessionInternalContract = c42.router({
       200: ReattributeValidationResultResponseSchema,
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
+      // The attempt or the target hypothesis does not exist in this pentest — in practice a
+      // mistyped id in the agent's call. Declared because it is the likeliest failure here and
+      // a reader who assumes it cannot 404 mis-diagnoses the retry loop it causes.
+      404: ErrorResponseSchema,
       // runVersion/status guard, stage mismatch, R-not-approved, R-already-promoted,
       // or attempt-not-in-run.
       409: ErrorResponseSchema,
@@ -32478,7 +33348,53 @@ var agentSessionInternalContract = c42.router({
       409: ErrorResponseSchema,
       // No MAGIC_AUTH credential on the pentest's environments.
       404: ErrorResponseSchema,
-      500: ErrorResponseSchema
+      500: ErrorResponseSchema,
+      // Mail provider unavailable — RETRYABLE, and distinct from 500 so the host
+      // can tell "we could not look" from "this will never work".
+      503: ErrorResponseSchema
+    }
+  },
+  // list_emails: newest-first metadata for the pentest's readable Trace-managed
+  // inbox. Same resolution + ownership gate as login-code (org + pentest
+  // environments + provider-side inbox tenancy); no bodies cross the wire here.
+  listInboxMessages: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/inbox-messages",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListInboxMessagesRequestSchema,
+    responses: {
+      200: AgentSessionListInboxMessagesResponseSchema,
+      // Ambiguous credentialLabel (several readable inboxes, none named).
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // No readable Trace-managed inbox on the pentest's environments, or the
+      // resolved address is not owned by this run's organization.
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // Mail provider unavailable — RETRYABLE, and distinct from 500 so the host
+      // can tell "we could not look" from "this will never work".
+      503: ErrorResponseSchema
+    }
+  },
+  // get_email: one message from that inbox, body included. The body is
+  // third-party text — the api neutralizes and length-caps it before it can
+  // reach the agent's context.
+  getInboxMessage: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/inbox-message",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetInboxMessageRequestSchema,
+    responses: {
+      200: AgentSessionGetInboxMessageResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // Unknown inbox (as above) OR the message id is not in that inbox.
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // Mail provider unavailable — RETRYABLE (see listInboxMessages).
+      503: ErrorResponseSchema
     }
   },
   // get_session_state (SESSION_STATE, spec §2/§3): api-mediated JIT fetch — the api
@@ -32518,6 +33434,26 @@ var agentSessionInternalContract = c42.router({
       500: ErrorResponseSchema
     }
   },
+  // get_convex_deployments (Convex integration PR 3): the read-only broker. Every
+  // connected Convex deployment for the run's OWN org, each with its function
+  // inventory. No request identifier at all — see the schema block above. No 404:
+  // there is no agent-supplied id to miss. No 503: a Convex outage is the
+  // per-deployment `unavailable` status, so one bad deployment never fails the rest.
+  convexRecon: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/convex/recon",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: ConvexReconRequestSchema,
+    responses: {
+      200: ConvexReconResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Non-credentialed session type — this run may never reach customer clouds.
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Operator reads (operator-session PR 1 §2b). All run-token authed; org+pentest
   // derived from the session row. Detail ops 404 when the id is not in this pentest.
   getPentestContext: {
@@ -32714,7 +33650,21 @@ var agentSessionInternalContract = c42.router({
     pathParams: AgentSessionInternalParamsSchema,
     body: OperatorRecordFindingRetestRequestSchema,
     responses: {
-      200: OperatorFindingReadSchema,
+      200: OperatorRetestAckSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  editFindingRetest: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/retest/edit",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorEditFindingRetestRequestSchema,
+    responses: {
+      200: OperatorRetestAckSchema,
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -32916,8 +33866,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c43 = initContract();
-var githubWebhookContract = c43.router(
+var c42 = initContract();
+var githubWebhookContract = c42.router(
   {
     handleWebhook: {
       method: "POST",
@@ -32935,7 +33885,7 @@ var githubWebhookContract = c43.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c43.router(
+var githubReadonlyWebhookContract = c42.router(
   {
     handleWebhook: {
       method: "POST",
@@ -32955,9 +33905,9 @@ var githubReadonlyWebhookContract = c43.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c44 = initContract();
+var c43 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c44.router(
+var linearWebhookContract = c43.router(
   {
     handleWebhook: {
       method: "POST",
@@ -32977,7 +33927,7 @@ var linearWebhookContract = c44.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c45 = initContract();
+var c44 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -33006,7 +33956,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c45.router(
+var forgeBitbucketContract = c44.router(
   {
     lifecycle: {
       method: "POST",
@@ -33053,8 +34003,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c46 = initContract();
-var healthContract = c46.router({
+var c45 = initContract();
+var healthContract = c45.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -33066,8 +34016,8 @@ var healthContract = c46.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c47 = initContract();
-var vulnerabilityShareContract = c47.router(
+var c46 = initContract();
+var vulnerabilityShareContract = c46.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -33154,8 +34104,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c48 = initContract();
-var prVulnerabilityContract = c48.router(
+var c47 = initContract();
+var prVulnerabilityContract = c47.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -35541,6 +36491,7 @@ var APPLICATION_TYPE_BY_INPUT = {
   web: "WEB",
   cli: "CLI",
   mobile: "MOBILE",
+  desktop: "DESKTOP",
   "api-service": "API_SERVICE",
   api_service: "API_SERVICE"
 };
@@ -35707,12 +36658,12 @@ function buildApplicationsTable(apps) {
     repos: String(a.repositories.length),
     url: a.applicationUrl ? sanitizeDisplay(a.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c50) => c50.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c50) => c50.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c50) => c50.type.length));
+  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c49) => c49.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c50) => `${c50.id.padEnd(idWidth)}  ${c50.name.padEnd(nameWidth)}  ${c50.type.padEnd(typeWidth)}  ${c50.repos.padStart(5)}  ${c50.url}`
+    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.name.padEnd(nameWidth)}  ${c49.type.padEnd(typeWidth)}  ${c49.repos.padStart(5)}  ${c49.url}`
   );
   return { header, rows };
 }
@@ -35732,12 +36683,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l.repositoryPath ? sanitizeDisplay(l.repositoryPath) : "\u2014",
     status: formatStatus(l.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c50) => c50.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c50) => c50.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c50) => c50.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c49) => c49.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c49) => c49.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c49) => c49.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c50) => `${c50.name.padEnd(nameWidth)}  ${c50.scan.padEnd(4)}  ${c50.role.padEnd(roleWidth)}  ${c50.path.padEnd(pathWidth)}  ${c50.status}`
+    (c49) => `${c49.name.padEnd(nameWidth)}  ${c49.scan.padEnd(4)}  ${c49.role.padEnd(roleWidth)}  ${c49.path.padEnd(pathWidth)}  ${c49.status}`
   );
   return { header, rows };
 }
@@ -35999,7 +36950,7 @@ async function runDelete(applicationId, options) {
   console.log(colorSuccess(`Deleted application ${applicationId}`));
 }
 function createCreateCommand() {
-  return new Command("create").description("Create a new application").argument("<name>", "Application name").option("--type <type>", "Application type: web, cli, mobile, api-service", "web").option("--url <url>", "Application URL (required for web/api-service)").option("--repo <id-or-url>", "Link a repository at creation (UUID, URL, or owner/repo)").option("--repo-path <path>", "Path within the linked repository").option("--help-center-url <url>", "Help center URL").option("--docs-url <url>", "Documentation URL").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  return new Command("create").description("Create a new application").argument("<name>", "Application name").option("--type <type>", "Application type: web, cli, mobile, desktop, api-service", "web").option("--url <url>", "Application URL (required for web/api-service)").option("--repo <id-or-url>", "Link a repository at creation (UUID, URL, or owner/repo)").option("--repo-path <path>", "Path within the linked repository").option("--help-center-url <url>", "Help center URL").option("--docs-url <url>", "Documentation URL").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Examples:
@@ -36418,6 +37369,21 @@ function d(r, t, s) {
   const e2 = r + t, i = Math.max(s.length - 1, 0), n = e2 < 0 ? i : e2 > i ? 0 : e2;
   return s[n].disabled ? d(n, t < 0 ? -1 : 1, s) : n;
 }
+function I(r, t, s, e2) {
+  const i = e2.split(`
+`);
+  let n = 0, o = r;
+  for (const a of i) {
+    if (o <= a.length) break;
+    o -= a.length + 1, n++;
+  }
+  for (n = Math.max(0, Math.min(i.length - 1, n + s)), o = Math.min(o, i[n].length) + t; o < 0 && n > 0; ) n--, o += i[n].length + 1;
+  for (; o > i[n].length && n < i.length - 1; ) o -= i[n].length + 1, n++;
+  o = Math.max(0, Math.min(i[n].length, o));
+  let u = 0;
+  for (let a = 0; a < n; a++) u += i[a].length + 1;
+  return u + o;
+}
 var G = ["up", "down", "left", "right", "space", "enter", "cancel"];
 var K = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
 var h = { actions: new Set(G), aliases: /* @__PURE__ */ new Map([["k", "up"], ["j", "down"], ["h", "left"], ["l", "right"], ["", "cancel"], ["escape", "cancel"]]), messages: { cancel: "Canceled", error: "Something went wrong" }, withGuide: true, date: { monthNames: [...K], messages: { required: "Please enter a valid date", invalidMonth: "There are only 12 months in a year", invalidDay: (r, t) => `There are only ${r} days in ${t}`, afterMin: (r) => `Date must be on or after ${r.toISOString().slice(0, 10)}`, beforeMax: (r) => `Date must be on or before ${r.toISOString().slice(0, 10)}` } } };
@@ -36579,6 +37545,145 @@ var p = class {
     }
   }
 };
+var X = class extends p {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(t) {
+    super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+      this.value = this._value;
+    }), this.on("confirm", (s) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = s, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+};
+var rt = class extends p {
+  #s = false;
+  #r;
+  focused = "editor";
+  get userInputWithCursor() {
+    if (this.state === "submit") return this.userInput;
+    const t = this.userInput;
+    if (this.cursor >= t.length) return `${t}\u2588`;
+    const s = t.slice(0, this.cursor), e2 = t[this.cursor], i = t.slice(this.cursor + 1);
+    return e2 === `
+` ? `${s}\u2588
+${i}` : `${s}${v("inverse", e2)}${i}`;
+  }
+  get cursor() {
+    return this._cursor;
+  }
+  #t(t) {
+    if (this.userInput.length === 0) {
+      this._setUserInput(t);
+      return;
+    }
+    this._setUserInput(this.userInput.slice(0, this.cursor) + t + this.userInput.slice(this.cursor));
+  }
+  #n(t) {
+    const s = this.value ?? "";
+    switch (t) {
+      case "up":
+        this._cursor = I(this._cursor, 0, -1, s);
+        return;
+      case "down":
+        this._cursor = I(this._cursor, 0, 1, s);
+        return;
+      case "left":
+        this._cursor = I(this._cursor, -1, 0, s);
+        return;
+      case "right":
+        this._cursor = I(this._cursor, 1, 0, s);
+        return;
+    }
+  }
+  _shouldSubmit(t, s) {
+    if (this.#r) return this.focused === "submit" ? true : (this.#t(`
+`), this._cursor++, false);
+    const e2 = this.#s;
+    return this.#s = true, e2 ? (this.userInput[this.cursor - 1] === `
+` && (this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--), true) : (this.#t(`
+`), this._cursor++, false);
+  }
+  constructor(t) {
+    super(t, false), this.#r = t.showSubmit ?? false, this.on("key", (s, e2) => {
+      if (e2?.name && h.actions.has(e2.name)) {
+        this.#n(e2.name);
+        return;
+      }
+      if (s === "	" && this.#r) {
+        this.focused = this.focused === "editor" ? "submit" : "editor";
+        return;
+      }
+      if (e2?.name !== "return") {
+        if (this.#s = false, e2?.name === "backspace" && this.cursor > 0) {
+          this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--;
+          return;
+        }
+        if (e2?.name === "delete" && this.cursor < this.userInput.length) {
+          this._setUserInput(this.userInput.slice(0, this.cursor) + this.userInput.slice(this.cursor + 1));
+          return;
+        }
+        s && (this.#r && this.focused === "submit" && (this.focused = "editor"), this.#t(s ?? ""), this._cursor++);
+      }
+    }), this.on("userInput", (s) => {
+      this._setValue(s);
+    }), this.on("finalize", () => {
+      this.value || (this.value = t.defaultValue), this.value === void 0 && (this.value = "");
+    });
+  }
+};
+var nt = class extends p {
+  options;
+  cursor = 0;
+  get _value() {
+    return this.options[this.cursor].value;
+  }
+  get _enabledOptions() {
+    return this.options.filter((t) => t.disabled !== true);
+  }
+  toggleAll() {
+    const t = this._enabledOptions, s = this.value !== void 0 && this.value.length === t.length;
+    this.value = s ? [] : t.map((e2) => e2.value);
+  }
+  toggleInvert() {
+    const t = this.value;
+    if (!t) return;
+    const s = this._enabledOptions.filter((e2) => !t.includes(e2.value));
+    this.value = s.map((e2) => e2.value);
+  }
+  toggleValue() {
+    this.value === void 0 && (this.value = []);
+    const t = this.value.includes(this._value);
+    this.value = t ? this.value.filter((s) => s !== this._value) : [...this.value, this._value];
+  }
+  constructor(t) {
+    super(t, false), this.options = t.options, this.value = [...t.initialValues ?? []];
+    const s = Math.max(this.options.findIndex(({ value: e2 }) => e2 === t.cursorAt), 0);
+    this.cursor = this.options[s].disabled ? d(s, 1, this.options) : s, this.on("key", (e2) => {
+      e2 === "a" && this.toggleAll(), e2 === "i" && this.toggleInvert();
+    }), this.on("cursor", (e2) => {
+      switch (e2) {
+        case "left":
+        case "up":
+          this.cursor = d(this.cursor, -1, this.options);
+          break;
+        case "down":
+        case "right":
+          this.cursor = d(this.cursor, 1, this.options);
+          break;
+        case "space":
+          this.toggleValue();
+          break;
+      }
+    });
+  }
+};
 var ot = class extends p {
   _mask = "\u2022";
   get cursor() {
@@ -36695,14 +37800,14 @@ var yt = (t) => {
 };
 var ee = (t, r, s, i, u) => {
   let n = r, o = 0;
-  for (let c50 = s; c50 < i; c50++) {
-    const a = t[c50];
+  for (let c49 = s; c49 < i; c49++) {
+    const a = t[c49];
     if (n = n - a.length, o++, n <= u) break;
   }
   return { lineCount: n, removals: o };
 };
 var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItems: u = Number.POSITIVE_INFINITY, columnPadding: n = 0, rowPadding: o = 4 }) => {
-  const c50 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
+  const c49 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
   let p2 = 0;
   t >= y - 3 && (p2 = Math.max(Math.min(t - y + 3, r.length - y), 0));
   let m = y < r.length && p2 > 0, g = y < r.length && p2 + y < r.length;
@@ -36711,7 +37816,7 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
   m && f++, g && f++;
   const v2 = p2 + (m ? 1 : 0), T = S2 - (g ? 1 : 0);
   for (let b2 = v2; b2 < T; b2++) {
-    const G2 = wrapAnsi(s(r[b2], b2 === t), c50, { hard: true, trim: false }).split(`
+    const G2 = wrapAnsi(s(r[b2], b2 === t), c49, { hard: true, trim: false }).split(`
 `);
     h2.push(G2), f += G2.length;
   }
@@ -36725,15 +37830,129 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
   for (const b2 of h2) for (const G2 of b2) C2.push(G2);
   return g && C2.push(l), C2;
 };
+var ue = (t) => {
+  const r = t.active ?? "Yes", s = t.inactive ?? "No";
+  return new X({ active: r, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
+    const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${e("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c49 = `${i ? `${e("gray", $)}
+` : ""}${o}
+`, a = this.value ? r : s;
+    switch (this.state) {
+      case "submit": {
+        const l = i ? `${e("gray", $)}  ` : "";
+        return `${c49}${l}${e("dim", a)}`;
+      }
+      case "cancel": {
+        const l = i ? `${e("gray", $)}  ` : "";
+        return `${c49}${l}${e(["strikethrough", "dim"], a)}${i ? `
+${e("gray", $)}` : ""}`;
+      }
+      default: {
+        const l = i ? `${e("cyan", $)}  ` : "", d2 = i ? e("cyan", E2) : "";
+        return `${c49}${l}${this.value ? `${e("green", z4)} ${r}` : `${e("dim", H)} ${e("dim", r)}`}${t.vertical ? i ? `
+${e("cyan", $)}  ` : `
+` : ` ${e("dim", "/")} `}${this.value ? `${e("dim", H)} ${e("dim", s)}` : `${e("green", z4)} ${s}`}
+${d2}
+`;
+      }
+    }
+  } }).prompt();
+};
+var me = (t = "", r) => {
+  const s = r?.output ?? process.stdout, i = r?.withGuide ?? h.withGuide ? `${e("gray", E2)}  ` : "";
+  s.write(`${i}${e("red", t)}
+
+`);
+};
+var fe = (t) => new rt({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, showSubmit: t.showSubmit, output: t.output, signal: t.signal, input: t.input, render() {
+  const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${e("gray", $)}
+` : ""}${M(this.state)}  `}${t.message}
+`, i = t.placeholder ? e("inverse", t.placeholder[0]) + e("dim", t.placeholder.slice(1)) : e(["inverse", "hidden"], "_"), u = this.userInput ? this.userInputWithCursor : i, n = this.value ?? "", o = t.showSubmit ? `
+  ${e(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
+  switch (this.state) {
+    case "error": {
+      const c49 = `${e("yellow", $)}  `, a = r ? W(t.output, u, c49, void 0) : u, l = e("yellow", E2);
+      return `${s}${a}
+${l}  ${e("yellow", this.error)}${o}
+`;
+    }
+    case "submit": {
+      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e("dim", l)) : n ? e("dim", n) : "";
+      return `${s}${a}`;
+    }
+    case "cancel": {
+      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e(["strikethrough", "dim"], l)) : n ? e(["strikethrough", "dim"], n) : "";
+      return `${s}${a}`;
+    }
+    default: {
+      const c49 = r ? `${e("cyan", $)}  ` : "", a = r ? e("cyan", E2) : "", l = r ? W(t.output, u, c49) : u;
+      return `${s}${l}
+${a}${o}
+`;
+    }
+  }
+} }).prompt();
+var Q2 = (t, r) => t.split(`
+`).map((s) => r(s)).join(`
+`);
+var ve = (t) => {
+  const r = (i, u) => {
+    const n = i.label ?? String(i.value);
+    return u === "disabled" ? `${e("gray", J)} ${Q2(n, (o) => e(["strikethrough", "gray"], o))}${i.hint ? ` ${e("dim", `(${i.hint ?? "disabled"})`)}` : ""}` : u === "active" ? `${e("cyan", et2)} ${n}${i.hint ? ` ${e("dim", `(${i.hint})`)}` : ""}` : u === "selected" ? `${e("green", U)} ${Q2(n, (o) => e("dim", o))}${i.hint ? ` ${e("dim", `(${i.hint})`)}` : ""}` : u === "cancelled" ? `${Q2(n, (o) => e(["strikethrough", "dim"], o))}` : u === "active-selected" ? `${e("green", U)} ${n}${i.hint ? ` ${e("dim", `(${i.hint})`)}` : ""}` : u === "submitted" ? `${Q2(n, (o) => e("dim", o))}` : `${e("dim", J)} ${Q2(n, (o) => e("dim", o))}`;
+  }, s = t.required ?? true;
+  return new nt({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValues: t.initialValues, required: s, cursorAt: t.cursorAt, validate(i) {
+    if (s && (i === void 0 || i.length === 0)) return `Please select at least one option.
+${e("reset", e("dim", `Press ${e(["gray", "bgWhite", "inverse"], " space ")} to select, ${e("gray", e("bgWhite", e("inverse", " enter ")))} to submit`))}`;
+  }, render() {
+    const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${e("gray", $)}
+` : ""}${u}
+`, o = this.value ?? [], c49 = (a, l) => {
+      if (a.disabled) return r(a, "disabled");
+      const d2 = o.includes(a.value);
+      return l && d2 ? r(a, "active-selected") : d2 ? r(a, "selected") : r(a, l ? "active" : "inactive");
+    };
+    switch (this.state) {
+      case "submit": {
+        const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "submitted")).join(e("dim", ", ")) || e("dim", "none"), l = W(t.output, a, i ? `${e("gray", $)}  ` : "");
+        return `${n}${l}`;
+      }
+      case "cancel": {
+        const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "cancelled")).join(e("dim", ", "));
+        if (a.trim() === "") return `${n}${e("gray", $)}`;
+        const l = W(t.output, a, i ? `${e("gray", $)}  ` : "");
+        return `${n}${l}${i ? `
+${e("gray", $)}` : ""}`;
+      }
+      case "error": {
+        const a = i ? `${e("yellow", $)}  ` : "", l = this.error.split(`
+`).map((p2, m) => m === 0 ? `${i ? `${e("yellow", E2)}  ` : ""}${e("yellow", p2)}` : `   ${p2}`).join(`
+`), d2 = n.split(`
+`).length, y = l.split(`
+`).length + 1;
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: d2 + y, style: c49 }).join(`
+${a}`)}
+${l}
+`;
+      }
+      default: {
+        const a = i ? `${e("cyan", $)}  ` : "", l = n.split(`
+`).length, d2 = i ? 2 : 1;
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c49 }).join(`
+${a}`)}
+${i ? e("cyan", E2) : ""}
+`;
+      }
+    }
+  } }).prompt();
+};
 var Ce = (t) => new ot({ validate: t.validate, mask: t.mask ?? Gt, signal: t.signal, input: t.input, output: t.output, render() {
   const r = t.withGuide ?? h.withGuide, s = `${r ? `${e("gray", $)}
 ` : ""}${M(this.state)}  ${t.message}
 `, i = this.userInputWithCursor, u = this.masked;
   switch (this.state) {
     case "error": {
-      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c50 = u ?? "";
+      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c49 = u ?? "";
       return t.clearOnError && this.clear(), `${s.trim()}
-${n}${c50}
+${n}${c49}
 ${o}${e("yellow", this.error)}
 `;
     }
@@ -36781,19 +38000,19 @@ var Ee = (t) => {
 `;
     switch (this.state) {
       case "submit": {
-        const c50 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c50);
+        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c49);
         return `${o}${a}`;
       }
       case "cancel": {
-        const c50 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c50);
+        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c49);
         return `${o}${a}${s ? `
 ${e("gray", $)}` : ""}`;
       }
       default: {
-        const c50 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
+        const c49 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
 `).length, d2 = s ? 2 : 1;
-        return `${o}${c50}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c50.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
-${c50}`)}
+        return `${o}${c49}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c49.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
+${c49}`)}
 ${a}
 `;
       }
@@ -37551,7 +38770,7 @@ function extractCommandTree(cmd) {
     description: o.description,
     takesValue: o.required || o.optional
   }));
-  const subcommands = cmd.commands.filter((c50) => !c50._hidden).map((c50) => extractCommandTree(c50));
+  const subcommands = cmd.commands.filter((c49) => !c49._hidden).map((c49) => extractCommandTree(c49));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -37617,7 +38836,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c50) => c50.name);
+  const subcommandNames = tree.subcommands.map((c49) => c49.name);
   const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -38300,16 +39519,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c50) => ({
-    id: c50.credentialId,
-    label: sanitizeDisplay(c50.label),
-    type: c50.credentialType
+  const cells = creds.map((c49) => ({
+    id: c49.credentialId,
+    label: sanitizeDisplay(c49.label),
+    type: c49.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c50) => c50.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c50) => c50.label.length));
+  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c49) => c49.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c50) => `${c50.id.padEnd(idWidth)}  ${c50.label.padEnd(labelWidth)}  ${c50.type}`
+    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.label.padEnd(labelWidth)}  ${c49.type}`
   );
   return { header, rows };
 }
@@ -38365,7 +39584,7 @@ async function runCreate2(options) {
   }
   const organizationId = await resolveOrganizationId();
   const params = { organizationId, environmentId: options.env };
-  const label = options.label;
+  const label = options.label?.trim() ? options.label.trim() : void 0;
   let body;
   try {
     body = await buildCreateBody(type, label, options);
@@ -38388,6 +39607,7 @@ async function runCreate2(options) {
   outputCredential(result.body, output);
 }
 async function buildCreateBody(type, label, options) {
+  const labelFields = label !== void 0 ? { label } : {};
   switch (type) {
     case "BEARER_TOKEN": {
       const ac = buildBearerAuthConfig(options);
@@ -38395,7 +39615,7 @@ async function buildCreateBody(type, label, options) {
       const secretValue = await resolveSecret("secret value", "secret", secretOpts(options));
       return {
         credentialType: "BEARER_TOKEN",
-        label,
+        ...labelFields,
         secretValue,
         ...ac.value ? { authConfig: ac.value } : {}
       };
@@ -38406,7 +39626,7 @@ async function buildCreateBody(type, label, options) {
       const secretValue = await resolveSecret("secret value", "secret", secretOpts(options));
       return {
         credentialType: "JWT_TOKEN",
-        label,
+        ...labelFields,
         secretValue,
         ...ac.value ? { authConfig: ac.value } : {}
       };
@@ -38417,14 +39637,14 @@ async function buildCreateBody(type, label, options) {
       const secretValue = await resolveSecret("secret value", "secret", secretOpts(options));
       return {
         credentialType: "API_KEY",
-        label,
+        ...labelFields,
         secretValue,
         ...ac.value ? { authConfig: ac.value } : {}
       };
     }
     case "PASSPHRASE": {
       const secretValue = await resolveSecret("secret value", "secret", secretOpts(options));
-      return { credentialType: "PASSPHRASE", label, secretValue };
+      return { credentialType: "PASSPHRASE", ...labelFields, secretValue };
     }
     case "SESSION_STATE": {
       const secretValue = await resolveSecret(
@@ -38432,7 +39652,7 @@ async function buildCreateBody(type, label, options) {
         "secret",
         secretOpts(options)
       );
-      return { credentialType: "SESSION_STATE", label, secretValue };
+      return { credentialType: "SESSION_STATE", ...labelFields, secretValue };
     }
     case "COOKIE": {
       const ac = buildCookieAuthConfig(options);
@@ -38440,7 +39660,7 @@ async function buildCreateBody(type, label, options) {
       const secretValue = await resolveSecret("secret value", "secret", secretOpts(options));
       return {
         credentialType: "COOKIE",
-        label,
+        ...labelFields,
         secretValue,
         ...ac.value ? { authConfig: ac.value } : {}
       };
@@ -38451,7 +39671,7 @@ async function buildCreateBody(type, label, options) {
       const secretValue = await resolveSecret("test-account email", "secret", secretOpts(options));
       return {
         credentialType: "MAGIC_AUTH",
-        label,
+        ...labelFields,
         secretValue,
         ...ac.value ? { authConfig: ac.value } : {}
       };
@@ -38463,7 +39683,7 @@ async function buildCreateBody(type, label, options) {
       const password = await resolveSecret("password", "password", passwordOpts(options));
       return {
         credentialType: "USERNAME_PASSWORD",
-        label,
+        ...labelFields,
         username,
         password,
         ...ac.value ? { authConfig: ac.value } : {}
@@ -38616,17 +39836,21 @@ function createCreateCommand2() {
   const command = new Command("create").description("Create a credential in an environment").requiredOption("--env <environmentId>", "Parent environment UUID").requiredOption(
     "--type <type>",
     "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth"
-  ).requiredOption("--label <label>", "Human-readable label").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
+  ).option(
+    "--label <label>",
+    "Human-readable label (optional; defaults from type / username + environment)"
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
   addSecretInputOptions(command);
   addAuthConfigOptions(command).addHelpText(
     "after",
     `
 Secrets are read from stdin/file/env (or a no-echo prompt) \u2014 never an inline flag.
+--label is optional; when omitted the API picks a unique default.
 
 Examples:
-  vault read -field=token secret/x | tracecli credential create --env <envId> --type bearer-token --label prod --secret-stdin
+  vault read -field=token secret/x | tracecli credential create --env <envId> --type bearer-token --secret-stdin
   tracecli credential create --env <envId> --type api-key --label "prod key" --secret-env API_KEY --placement header --key-name X-API-Key
-  tracecli credential create --env <envId> --type username-password --label login --username-env U --password-env P --method form --login-url https://acme.com/login`
+  tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login`
   );
   return command.action(async (options) => {
     await runCreate2(options);
@@ -38856,14 +40080,14 @@ function buildEnvironmentTable(envs, leading) {
     url: sanitizeDisplay(e2.primaryUrl)
   }));
   const leadingWidths = leading.map(
-    (column, i) => Math.max(column.header.length, ...cells.map((c50) => c50.leading[i]?.length ?? 0))
+    (column, i) => Math.max(column.header.length, ...cells.map((c49) => c49.leading[i]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c50) => c50.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
   const padLeading = (values) => values.map((v2, i) => v2.padEnd(leadingWidths[i] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c50) => c50.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c49) => c49.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c50) => `${padLeading(c50.leading)}  ${c50.name.padEnd(nameWidth)}  ${c50.prod.padEnd(4)}  ${c50.url}`
+      (c49) => `${padLeading(c49.leading)}  ${c49.name.padEnd(nameWidth)}  ${c49.prod.padEnd(4)}  ${c49.url}`
     )
   };
 }
@@ -39225,6 +40449,120 @@ var packageMetadata = readPackageMetadata();
 var CLI_PACKAGE_NAME = packageMetadata.name;
 var CLI_VERSION = packageMetadata.version;
 
+// src/pentest/commands.ts
+import { readFileSync as readFileSync4 } from "fs";
+
+// src/pentest/questionnaire.ts
+function buildUpsertQuestionnaireBody(answers) {
+  if (answers === null) {
+    return { answers: null };
+  }
+  return { answers: normalizePentestCustomerIntakeAnswers(answers) };
+}
+function parseQuestionnaireAnswersFile(raw, sourceLabel = "file") {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: `Invalid JSON in ${sourceLabel}.` };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {
+      error: `${sourceLabel} must be a JSON object of questionnaire answers (not an array or null).`
+    };
+  }
+  if ("answers" in parsed && Object.keys(parsed).length === 1) {
+    return {
+      error: `${sourceLabel} must contain the answers object directly, not an { answers } wrapper. The CLI wraps it for the API.`
+    };
+  }
+  const result = PentestCustomerIntakeAnswersSchema.safeParse(parsed);
+  if (!result.success) {
+    const issue2 = result.error.issues[0];
+    const path = issue2?.path.length ? issue2.path.join(".") : "answers";
+    const message = issue2?.message ?? "invalid";
+    return { error: `Invalid questionnaire answers in ${sourceLabel}: ${path} \u2014 ${message}` };
+  }
+  return { answers: normalizePentestCustomerIntakeAnswers(result.data) };
+}
+function applyTextIntakeAnswer(current, key, input) {
+  const trimmed = input.trim();
+  if (trimmed.length === 0) {
+    return current;
+  }
+  return { ...current, [key]: trimmed };
+}
+function applyMultiSelectIntakeAnswer(current, key, selected) {
+  if (selected.length === 0) {
+    return current;
+  }
+  return {
+    ...current,
+    [key]: Array.from(new Set(selected)).sort()
+  };
+}
+function formatIssueClasses(values) {
+  return values.map((v2) => INTAKE_ISSUE_CLASS_LABELS[v2]).join(", ");
+}
+function formatSurfaces(values) {
+  return values.map((v2) => INTAKE_SURFACE_LABELS[v2]).join(", ");
+}
+function formatAnswerValue(key, answers) {
+  switch (key) {
+    case "issueClasses": {
+      const values = answers.issueClasses;
+      if (values === void 0 || values.length === 0) {
+        return null;
+      }
+      return formatIssueClasses(values);
+    }
+    case "surfaces": {
+      const values = answers.surfaces;
+      if (values === void 0 || values.length === 0) {
+        return null;
+      }
+      return formatSurfaces(values);
+    }
+    default: {
+      const value = answers[key];
+      if (value === void 0 || value.trim().length === 0) {
+        return null;
+      }
+      return value;
+    }
+  }
+}
+function formatQuestionnaireShow(input) {
+  const lines = [
+    `Editable: ${input.editable ? "yes (scoping window open)" : "no (editing closed after scoping)"}`
+  ];
+  if (input.answers === null || Object.keys(input.answers).length === 0) {
+    lines.push("Answers: (none)");
+    return lines.join("\n");
+  }
+  lines.push("Answers:");
+  for (const key of PENTEST_CUSTOMER_INTAKE_ANSWER_KEYS) {
+    const value = formatAnswerValue(key, input.answers);
+    if (value === null) {
+      continue;
+    }
+    lines.push(`${PENTEST_CUSTOMER_INTAKE_LABELS[key]}: ${value}`);
+  }
+  return lines.join("\n");
+}
+function issueClassSelectOptions() {
+  return CustomerPriorityCategoryValues.map((value) => ({
+    value,
+    label: INTAKE_ISSUE_CLASS_LABELS[value]
+  }));
+}
+function surfaceSelectOptions() {
+  return IntakeSurfaceValues.map((value) => ({
+    value,
+    label: INTAKE_SURFACE_LABELS[value]
+  }));
+}
+
 // src/pentest/commands.ts
 var DEFAULT_LIMIT2 = 30;
 var MAX_LIMIT2 = 100;
@@ -39474,13 +40812,9 @@ Examples:
         console.error(`Failed to list findings (status ${result.status}).`);
         process.exit(1);
       }
-      let filteredFindings = result.body;
-      if (options.severity) {
-        filteredFindings = filteredFindings.filter((f) => f.severity === options.severity);
-      }
-      if (options.status) {
-        filteredFindings = filteredFindings.filter((f) => f.status === options.status);
-      }
+      const filteredFindings = result.body.filter(
+        (f) => (!options.severity || f.severity === options.severity) && (!options.status || f.status === options.status)
+      );
       filteredFindings.sort(
         (a, b2) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b2.severity] ?? 99)
       );
@@ -39764,16 +41098,248 @@ Examples:
     await runUpdate4(pentestId, options);
   });
 }
+function failQuestionnaire(status, body, action, notFoundLabel) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    if (action === "write") {
+      console.error(
+        colorError(
+          "Questionnaire writes require an organization admin (or Trace staff) signed in with a browser session. API keys are rejected."
+        )
+      );
+    } else {
+      console.error(
+        colorError(message ?? "You do not have permission to view this questionnaire.")
+      );
+    }
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(
+      colorError(notFoundLabel ? `Pentest not found: ${notFoundLabel}.` : message ?? "Not found.")
+    );
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid questionnaire answers (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(
+        message ?? "Questionnaire editing is closed after scoping starts (current stage is past DRAFT / READY_TO_START)."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Failed to ${action === "write" ? "save" : "load"} questionnaire (status ${status})${message ? `: ${message}` : "."}`
+    )
+  );
+  process.exit(1);
+}
+async function fetchQuestionnaire(organizationId, pentestId, notFoundLabel) {
+  const result = await authenticatedRequest(
+    (client) => client.pentest.getCustomerPentestQuestionnaire({
+      params: { organizationId, pentestId }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failQuestionnaire(result.status, result.body, "read", notFoundLabel);
+  }
+  return result.body;
+}
+async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabel) {
+  const body = buildUpsertQuestionnaireBody(answers);
+  const result = await authenticatedRequest(
+    (client) => client.pentest.upsertCustomerPentestQuestionnaire({
+      params: { organizationId, pentestId },
+      body
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failQuestionnaire(result.status, result.body, "write", notFoundLabel);
+  }
+  return result.body;
+}
+function exitCancelled() {
+  me("Cancelled.");
+  process.exit(1);
+}
+async function promptQuestionnaireAnswers(existing) {
+  let working = { ...existing ?? {} };
+  const textPrompt = async (key, question) => {
+    const previous = existing?.[key];
+    const value = await fe({
+      message: `${question} (empty keeps previous)`,
+      initialValue: previous ?? "",
+      ...previous ? {} : { placeholder: "Optional, press Enter to skip" }
+    });
+    if (q(value)) {
+      exitCancelled();
+    }
+    working = applyTextIntakeAnswer(working, key, value);
+  };
+  for (const entry of PENTEST_CUSTOMER_INTAKE_QUESTIONS) {
+    if (entry.kind === "text") {
+      await textPrompt(entry.key, entry.question);
+      continue;
+    }
+    const message = `${entry.question} (empty keeps previous)`;
+    if (entry.key === "issueClasses") {
+      const selected = await ve({
+        message,
+        options: issueClassSelectOptions(),
+        required: false,
+        ...existing?.issueClasses !== void 0 ? { initialValues: existing.issueClasses } : {}
+      });
+      if (q(selected)) {
+        exitCancelled();
+      }
+      working = applyMultiSelectIntakeAnswer(working, "issueClasses", selected);
+    } else {
+      const selected = await ve({
+        message,
+        options: surfaceSelectOptions(),
+        required: false,
+        ...existing?.surfaces !== void 0 ? { initialValues: existing.surfaces } : {}
+      });
+      if (q(selected)) {
+        exitCancelled();
+      }
+      working = applyMultiSelectIntakeAnswer(working, "surfaces", selected);
+    }
+    await textPrompt(entry.notesKey, entry.notesQuestion);
+  }
+  const confirmed = await ue({
+    message: "Save questionnaire answers?",
+    initialValue: true
+  });
+  if (q(confirmed) || !confirmed) {
+    exitCancelled();
+  }
+  if (Object.keys(working).length === 0) {
+    return existing === null ? null : working;
+  }
+  return working;
+}
+async function runQuestionnaire(pentestIdentifier, options) {
+  const show = options.show === true;
+  const filePath = options.file;
+  if (show && filePath !== void 0) {
+    console.error(colorError("Pass only one of --show / --file."));
+    process.exit(1);
+  }
+  const isInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (!show && filePath === void 0 && !isInteractiveTty) {
+    console.error(
+      colorError(
+        "Interactive questionnaire requires a TTY. Use --show to print answers, or --file <path> to upload an answers JSON object."
+      )
+    );
+    process.exit(2);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
+  if (show) {
+    const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
+    console.log(
+      formatQuestionnaireShow({
+        answers: current2.answers,
+        editable: current2.editable
+      })
+    );
+    return;
+  }
+  if (filePath !== void 0) {
+    let raw;
+    try {
+      raw = readFileSync4(filePath, "utf8");
+    } catch {
+      console.error(colorError(`Could not read answers file: ${filePath}`));
+      process.exit(1);
+    }
+    const parsed = parseQuestionnaireAnswersFile(raw, filePath);
+    if ("error" in parsed) {
+      console.error(colorError(parsed.error));
+      process.exit(1);
+    }
+    const saved2 = await putQuestionnaire(
+      organizationId,
+      pentestId,
+      parsed.answers,
+      pentestIdentifier
+    );
+    console.log(colorSuccess("Saved questionnaire answers."));
+    console.log(
+      formatQuestionnaireShow({
+        answers: saved2.answers,
+        editable: saved2.editable
+      })
+    );
+    return;
+  }
+  const current = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
+  if (!current.editable) {
+    console.error(
+      colorError(
+        "Questionnaire editing is closed after scoping starts. Use --show to view the saved answers."
+      )
+    );
+    process.exit(1);
+  }
+  const merged = await promptQuestionnaireAnswers(current.answers);
+  const saved = await putQuestionnaire(organizationId, pentestId, merged, pentestIdentifier);
+  console.log(colorSuccess("Saved questionnaire answers."));
+  console.log(
+    formatQuestionnaireShow({
+      answers: saved.answers,
+      editable: saved.editable
+    })
+  );
+}
+function createQuestionnaireCommand() {
+  return new Command("questionnaire").description("View or fill the customer pentest intake questionnaire").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--show", "Print current answers using shared labels (GET)").option(
+    "--file <path>",
+    "Upload answers from a JSON file (answers object only \u2014 not { answers }; whole-object replace)"
+  ).addHelpText(
+    "after",
+    `
+Optional scoping questionnaire for a new pentest (editable while stage is DRAFT
+or READY_TO_START). Reads accept a browser session or API key; writes require an
+organization admin (or Trace staff) signed in via \`tracecli auth login\` \u2014 API
+keys are rejected.
+
+Modes:
+  --show          GET and print key: value with shared customer-facing labels
+  --file <path>   PUT the file's answers object (CLI wraps { answers } for the API)
+  (TTY default)   load-merge-write: GET, prompt each question, confirm, PUT
+
+Non-interactive shells must pass --show or --file (exit 2 otherwise).
+
+Examples:
+  tracecli pentest questionnaire PT-1 --show
+  tracecli pentest questionnaire PT-1 --file answers.json
+  tracecli pentest questionnaire PT-1`
+  ).action(async (pentestId, options) => {
+    await runQuestionnaire(pentestId, options);
+  });
+}
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand5());
   pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
   return pentest;
 }
 
 // src/update/commands.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -39791,7 +41357,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync4(cachePath, "utf-8");
+    const rawCache = readFileSync5(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -40521,177 +42087,10 @@ Examples:
     }
   );
 }
-var FIX_PR_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
-  "PR_OPENED",
-  "NO_SAFE_FIX",
-  "PATCH_TOO_LARGE",
-  "TESTS_FAILED",
-  "INFRA_FAILED",
-  "STALE_VULN",
-  "TIMED_OUT",
-  "CANCELLED"
-]);
-var FIX_PR_AGENT_FLAVORS = ["claude-code", "codex"];
-var FIX_PR_POLL_MS = 3e3;
-function isFixPrAgentFlavor(value) {
-  return FIX_PR_AGENT_FLAVORS.includes(value);
-}
-function formatFixPrWatchLine(row) {
-  return `[${row.status}] run=${row.runId.slice(0, 8)} agent=${row.agentFlavor}`;
-}
-function formatFixPrTerminalLines(row) {
-  const link = row.prUrl ? ` ${row.prUrl}` : "";
-  const lines = [`Run ${row.runId} \u2192 ${row.status}${link}`];
-  if (row.statusDetails) {
-    lines.push(`Details: ${row.statusDetails}`);
-  }
-  return lines;
-}
-function createFixCommand() {
-  return new Command("fix").description("Trigger a Trace auto-fix PR for the vulnerability (staff-only dogfood)").argument("<id>", "Vulnerability display ID (e.g. TRACE-123 or 123) or UUID").option(
-    "--agent <flavor>",
-    `Override the agent flavor (one of: ${FIX_PR_AGENT_FLAVORS.join(", ")})`
-  ).option("--watch", "Poll the run until it reaches a terminal status", false).option("-o, --output <format>", "Output format: table, json (default: table)", "table").addHelpText(
-    "after",
-    `
-Examples:
-  # Trigger and exit immediately (scripting):
-  tracecli vulnerabilities fix TRACE-123
-
-  # Trigger and watch until terminal:
-  tracecli vulnerabilities fix TRACE-123 --watch
-
-  # Trigger with codex agent (requires AZURE_OPENAI_ENABLED):
-  tracecli vulnerabilities fix TRACE-123 --agent codex
-
-  # JSON output (final row to stdout; rolling status to stderr under --watch):
-  tracecli vulnerabilities fix TRACE-123 --watch --output json | jq .`
-  ).action(
-    async (identifier, options) => {
-      if (options.agent && !isFixPrAgentFlavor(options.agent)) {
-        console.error(
-          `Invalid --agent '${options.agent}'. Expected one of: ${FIX_PR_AGENT_FLAVORS.join(", ")}.`
-        );
-        process.exit(1);
-      }
-      if (options.output !== "table" && options.output !== "json") {
-        console.error(`Invalid --output '${options.output}'. Expected one of: table, json.`);
-        process.exit(1);
-      }
-      const organizationId = await resolveOrganizationId();
-      const triggerResult = await authenticatedRequest(
-        (client) => client.vulnerabilityFixRun.triggerRun({
-          params: { organizationId, vulnerabilityId: identifier },
-          body: options.agent ? { agentFlavor: options.agent } : {}
-        })
-      );
-      if (triggerResult.status === 401) {
-        console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
-        process.exit(1);
-      }
-      if (triggerResult.status === 403) {
-        console.error(
-          "Forbidden \u2014 vulnerability fix-PR is a staff-only feature gated by the AUTO_FIX_PR capability."
-        );
-        process.exit(1);
-      }
-      if (triggerResult.status === 404) {
-        console.error(
-          `Vulnerability '${identifier}' not found.
-Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
-        );
-        process.exit(1);
-      }
-      if (triggerResult.status === 429) {
-        const body = triggerResult.body;
-        const retry = body.details?.retryAfterSeconds;
-        console.error(
-          `Daily cap exceeded. ${retry ? `Try again in ${retry}s.` : body.message ?? ""}`
-        );
-        process.exit(1);
-      }
-      if (triggerResult.status === 400) {
-        const body = triggerResult.body;
-        console.error(`Bad request: ${body.message ?? "invalid input"}`);
-        process.exit(1);
-      }
-      if (triggerResult.status !== 201) {
-        console.error(`Failed to trigger fix-PR run (status ${triggerResult.status}).`);
-        process.exit(1);
-      }
-      const triggered = triggerResult.body;
-      if (!options.watch) {
-        if (options.output === "json") {
-          console.log(JSON.stringify(triggered, null, 2));
-        } else {
-          console.log(
-            `Triggered fix-PR run ${triggered.runId} (status=${triggered.status}, agent=${triggered.agentFlavor})`
-          );
-        }
-        process.exit(0);
-      }
-      let latest = triggered;
-      const isTTY = process.stderr.isTTY ?? false;
-      const onSigint = () => {
-        const msg = `
-watch interrupted; run id=${latest.runId}`;
-        process.stderr.write(`${msg}
-`);
-        process.exit(130);
-      };
-      process.on("SIGINT", onSigint);
-      const writeRolling = (row) => {
-        const line = formatFixPrWatchLine(row);
-        if (isTTY && options.output !== "json") {
-          process.stderr.write(`\r${line}   `);
-        } else {
-          process.stderr.write(`${line}
-`);
-        }
-      };
-      while (!FIX_PR_TERMINAL_STATUSES.has(latest.status)) {
-        writeRolling(latest);
-        await new Promise((resolve) => setTimeout(resolve, FIX_PR_POLL_MS));
-        const pollResult = await authenticatedRequest(
-          (client) => client.vulnerabilityFixRun.getRun({
-            params: {
-              organizationId,
-              vulnerabilityId: identifier,
-              runId: latest.runId
-            }
-          })
-        );
-        if (pollResult.status === 401) {
-          process.stderr.write("\n");
-          console.error("Authentication failed during watch. Run `tracecli auth login`.");
-          process.exit(1);
-        }
-        if (pollResult.status !== 200) {
-          process.stderr.write("\n");
-          console.error(`Failed to read run status (status ${pollResult.status}).`);
-          process.exit(1);
-        }
-        latest = pollResult.body;
-      }
-      if (isTTY && options.output !== "json") {
-        process.stderr.write("\n");
-      }
-      if (options.output === "json") {
-        console.log(JSON.stringify(latest, null, 2));
-      } else {
-        for (const line of formatFixPrTerminalLines(latest)) {
-          console.log(line);
-        }
-      }
-      process.exit(latest.status === "PR_OPENED" ? 0 : 2);
-    }
-  );
-}
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
   vulnerabilities.addCommand(createGetCommand4());
   vulnerabilities.addCommand(createListCommand6());
-  vulnerabilities.addCommand(createFixCommand());
   return vulnerabilities;
 }