securewithtrace 0.32.0 → 0.34.0

package/dist/index.js

@@ -10176,7 +10176,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c49) => c49 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c51) => c51 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -20220,9 +20220,9 @@ var ZodDate2 = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c49 = inst._zod.bag;
-  inst.minDate = c49.minimum ? new Date(c49.minimum) : null;
-  inst.maxDate = c49.maximum ? new Date(c49.maximum) : null;
+  const c51 = inst._zod.bag;
+  inst.minDate = c51.minimum ? new Date(c51.minimum) : null;
+  inst.maxDate = c51.maximum ? new Date(c51.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate2, params);
@@ -21911,7 +21911,8 @@ var OperatorPentestContextSchema = external_exports.object({
   environments: external_exports.array(
     external_exports.object({
       name: external_exports.string(),
-      primaryUrl: external_exports.string(),
+      // Null for repo-only application types (CLI, MOBILE, DESKTOP).
+      primaryUrl: external_exports.string().nullable(),
       isProduction: external_exports.boolean()
     })
   ),
@@ -22365,27 +22366,12 @@ var ApplicationRepositoryRoleValues = [
   "MOBILE_CLIENT",
   "OTHER"
 ];
-var ScopeDomainSourceValues = ["DERIVED", "MANUAL"];
 var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
   applicationId: external_exports.uuid()
 });
 var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
   applicationRepositoryId: external_exports.uuid()
 });
-var AuthorizedDomainIdParamsSchema = ApplicationIdParamsSchema.extend({
-  applicationAuthorizedDomainId: external_exports.uuid()
-});
-var AuthorizedDomainResponseSchema = external_exports.object({
-  applicationAuthorizedDomainId: external_exports.uuid(),
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  domain: external_exports.string(),
-  source: external_exports.enum(ScopeDomainSourceValues),
-  createdAt: external_exports.date()
-});
-var CreateAuthorizedDomainRequestSchema = external_exports.object({
-  domain: external_exports.string().trim().min(1).max(253)
-}).strict();
 var ApplicationRepositorySummarySchema = external_exports.object({
   applicationRepositoryId: external_exports.uuid().nullable(),
   applicationId: external_exports.uuid(),
@@ -22426,7 +22412,6 @@ var ApplicationResponseSchema = external_exports.object({
   // Environments-tab panel hydrates from this payload (no client GET). Defaulted
   // (like `type`) so a new client reading a pre-this-release API during a rolling
   // deploy doesn't reject application rows that predate the field.
-  authorizedDomains: external_exports.array(AuthorizedDomainResponseSchema).default([]),
   // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
   // reading a pre-this-release API during a rolling deploy doesn't reject rows
   // that omit the field. The raw S3 key is never on the wire.
@@ -22602,35 +22587,6 @@ var applicationContract = c4.router({
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
-  },
-  addAuthorizedDomain: {
-    method: "POST",
-    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains",
-    pathParams: ApplicationIdParamsSchema,
-    body: CreateAuthorizedDomainRequestSchema,
-    responses: {
-      201: AuthorizedDomainResponseSchema,
-      // 400 = INVALID_DOMAIN (not a registrable domain / IP / bare suffix);
-      // 409 = DOMAIN_ALREADY_AUTHORIZED.
-      400: ErrorResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      409: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
-  },
-  deleteAuthorizedDomain: {
-    method: "DELETE",
-    path: "/organizations/:organizationId/applications/:applicationId/authorized-domains/:applicationAuthorizedDomainId",
-    pathParams: AuthorizedDomainIdParamsSchema,
-    responses: {
-      204: DeleteResponseSchema,
-      401: ErrorResponseSchema,
-      403: ErrorResponseSchema,
-      404: ErrorResponseSchema,
-      500: ErrorResponseSchema
-    }
   }
 });
 
@@ -23871,6 +23827,140 @@ var cloudIntegrationContract = c7.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/code-size.api.ts
+var CodeSizeBucketTallySchema = external_exports.object({
+  files: external_exports.number().int().nonnegative(),
+  lines: external_exports.number().int().nonnegative(),
+  code: external_exports.number().int().nonnegative()
+});
+var CodeSizeLanguageTallySchema = external_exports.object({
+  language: external_exports.string(),
+  files: external_exports.number().int().nonnegative(),
+  code: external_exports.number().int().nonnegative()
+});
+var CodeSizePlatformValues = ["GITHUB", "BITBUCKET"];
+var CodeSizeRepositorySchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(CodeSizePlatformValues),
+  /** Billable SLOC of the current resolved branch. null = not measured yet. */
+  billableSloc: external_exports.number().int().nonnegative().nullable()
+});
+var CodeSizeBucketsSchema = external_exports.object({
+  code: CodeSizeBucketTallySchema,
+  tests: CodeSizeBucketTallySchema,
+  docs: CodeSizeBucketTallySchema,
+  config_data: CodeSizeBucketTallySchema,
+  vendored_generated: CodeSizeBucketTallySchema
+});
+var OrganizationCodeSizeResponseSchema = external_exports.object({
+  /** All CONNECTED GitHub/Bitbucket repos. Server-sorted: measured first by
+   *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
+   *  repositoryUrl asc — clients render as-is (spec-pr-2 §3.3). */
+  repositories: external_exports.array(CodeSizeRepositorySchema),
+  /** Sums over measured repos only. All-zero when none are measured. */
+  totals: external_exports.object({
+    billableSloc: external_exports.number().int().nonnegative(),
+    rawLines: external_exports.number().int().nonnegative(),
+    buckets: CodeSizeBucketsSchema,
+    /** Merged across repos, re-sorted code desc then language asc, capped
+     *  at 12 for display (stored lists are complete; spec-pr-2 §3.2). */
+    codeByLanguage: external_exports.array(CodeSizeLanguageTallySchema),
+    /** Distinct languages in the code bucket across measured repos — the
+     *  TRUE count, not codeByLanguage.length (which is display-capped). */
+    languageCount: external_exports.number().int().nonnegative()
+  })
+});
+var StaffCodeSizeRepositorySchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(CodeSizePlatformValues),
+  /** Resolved branch the measurement is keyed on (scanningBranch ?? default). */
+  branch: external_exports.string(),
+  /** null = no successful measurement for the current resolved branch. */
+  billableSloc: external_exports.number().int().nonnegative().nullable(),
+  /** null exactly when `billableSloc` is null. */
+  measuredAt: external_exports.iso.datetime().nullable()
+});
+var StaffOrganizationCodeSizeResponseSchema = external_exports.object({
+  /** Same server-side sort as the customer wire: measured first by
+   *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
+   *  repositoryUrl asc. */
+  repositories: external_exports.array(StaffCodeSizeRepositorySchema),
+  // No language breakdown here on purpose: this panel answers "is every
+  // repository measured, and how fresh", and the language view already exists
+  // on the customer panel staff can impersonate into.
+  totals: external_exports.object({
+    billableSloc: external_exports.number().int().nonnegative(),
+    rawLines: external_exports.number().int().nonnegative(),
+    /** Connected GitHub/Bitbucket repos — the re-measure `all` scope size. */
+    repositoryCount: external_exports.number().int().nonnegative(),
+    /** Repos with a measurement for their current resolved branch. */
+    measuredCount: external_exports.number().int().nonnegative(),
+    /** Newest measuredAt across the org; null when nothing is measured. */
+    lastMeasuredAt: external_exports.iso.datetime().nullable()
+  })
+});
+var StaffCodeSizeRemeasureScopeValues = ["all", "unmeasured"];
+var StaffCodeSizeRemeasureRequestSchema = external_exports.object({
+  scope: external_exports.enum(StaffCodeSizeRemeasureScopeValues)
+});
+var StaffCodeSizeRemeasureResponseSchema = external_exports.object({
+  scope: external_exports.enum(StaffCodeSizeRemeasureScopeValues),
+  /** Repos the scope selected. */
+  requested: external_exports.number().int().nonnegative(),
+  /** Messages SQS accepted. Lower than `requested` means a partial send —
+   *  reported rather than masked (the panel states this number). */
+  enqueued: external_exports.number().int().nonnegative()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/code-size.ts
+var c8 = initContract();
+var codeSizeContract = c8.router({
+  getOrganizationCodeSize: {
+    method: "GET",
+    path: "/organizations/:organizationId/code-size",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: OrganizationCodeSizeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Staff-only: per-repo measurement freshness for the admin Controls panel.
+  getStaffOrganizationCodeSize: {
+    method: "GET",
+    path: "/staff/organizations/:organizationId/code-size",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: StaffOrganizationCodeSizeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Staff-only: enqueue measurements for the scoped repos. Enqueue-only — the
+  // worker measures asynchronously, so a 200 means "requested", not "measured".
+  remeasureStaffOrganizationCodeSize: {
+    method: "POST",
+    path: "/staff/organizations/:organizationId/code-size/re-measure",
+    pathParams: OrgIdParamsSchema,
+    body: StaffCodeSizeRemeasureRequestSchema,
+    responses: {
+      200: StaffCodeSizeRemeasureResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
+      503: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/domain/credential.schema.ts
 var CredentialTypeValues = [
   "BEARER_TOKEN",
@@ -23978,13 +24068,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c49, i) => {
-    const d2 = c49.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c51, i) => {
+    const d2 = c51.domain.replace(/^\./, "").toLowerCase();
     if (d2 !== host && !host.endsWith(`.${d2}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i, "domain"],
-        message: `cookie domain "${c49.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c51.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -24192,8 +24282,8 @@ var RevealCredentialSecretResponseSchema = external_exports.discriminatedUnion("
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/credential.ts
-var c8 = initContract();
-var credentialContract = c8.router({
+var c9 = initContract();
+var credentialContract = c9.router({
   listCredentials: {
     method: "GET",
     path: "/organizations/:organizationId/environments/:environmentId/credentials",
@@ -24285,7 +24375,7 @@ var credentialContract = c8.router({
     method: "POST",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/reveal",
     pathParams: CredentialIdParamsSchema,
-    body: c8.noBody(),
+    body: c9.noBody(),
     responses: {
       200: RevealCredentialSecretResponseSchema,
       401: ErrorResponseSchema,
@@ -24512,8 +24602,8 @@ var DependencySummaryResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/dependency.ts
-var c9 = initContract();
-var dependencyContract = c9.router({
+var c10 = initContract();
+var dependencyContract = c10.router({
   /** Cross-repo dependency search. Two-phase: pg_trgm on Package, then join repos. */
   searchDependencies: {
     method: "POST",
@@ -24658,8 +24748,8 @@ var DockerScoutIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/docker-scout-integration.ts
-var c10 = initContract();
-var dockerScoutIntegrationContract = c10.router({
+var c11 = initContract();
+var dockerScoutIntegrationContract = c11.router({
   createDockerScoutIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/docker-scout-integration",
@@ -24848,12 +24938,12 @@ var EngagementResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/engagement.ts
-var c11 = initContract();
+var c12 = initContract();
 var RecordDashboardSessionRequest = external_exports.object({
   sessionId: external_exports.string().min(1).max(100)
 });
 var RecordDashboardSessionResponse = external_exports.object({});
-var engagementContract = c11.router({
+var engagementContract = c12.router({
   recordDashboardSession: {
     method: "POST",
     // `pathPrefix: '/v1'` is applied at the router level (see
@@ -24902,7 +24992,7 @@ var EnvironmentResponseSchema = external_exports.object({
   applicationId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
   name: external_exports.string(),
-  primaryUrl: external_exports.string(),
+  primaryUrl: external_exports.string().nullable(),
   description: external_exports.string().nullable(),
   isProduction: external_exports.boolean(),
   createdAt: external_exports.date(),
@@ -24911,7 +25001,7 @@ var EnvironmentResponseSchema = external_exports.object({
 var ListEnvironmentsResponseSchema = external_exports.array(EnvironmentResponseSchema);
 var CreateEnvironmentRequestSchema = external_exports.object({
   name: EnvNameSchema,
-  primaryUrl: external_exports.url().max(2048),
+  primaryUrl: external_exports.url().max(2048).optional(),
   description: external_exports.string().max(1e3).optional(),
   isProduction: external_exports.boolean().optional().default(false)
 }).strict();
@@ -24923,8 +25013,8 @@ var UpdateEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/environment.ts
-var c12 = initContract();
-var environmentContract = c12.router({
+var c13 = initContract();
+var environmentContract = c13.router({
   listEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/applications/:applicationId/environments",
@@ -25174,8 +25264,8 @@ var GitHubRepoSchema = external_exports.object({
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/github.ts
-var c13 = initContract();
-var githubContract = c13.router({
+var c14 = initContract();
+var githubContract = c14.router({
   // Tier chooser data: which app tiers this env can connect + the org's
   // entitlement default. Pure read (auth context + server config).
   getConnectOptions: {
@@ -25274,7 +25364,7 @@ var githubContract = c13.router({
     method: "POST",
     path: "/organizations/:organizationId/github/install-requests/:requestId/cancel",
     pathParams: GitHubInstallRequestParamsSchema,
-    body: c13.type(),
+    body: c14.type(),
     responses: {
       200: GitHubInstallRequestSchema,
       401: ErrorResponseSchema,
@@ -25285,7 +25375,7 @@ var githubContract = c13.router({
     }
   }
 });
-var staffGithubContract = c13.router({
+var staffGithubContract = c14.router({
   listStaffInstallations: {
     method: "GET",
     path: "/staff/github/installations",
@@ -25328,8 +25418,8 @@ var ManagedInboxLabelParamsSchema = OrgIdParamsSchema.extend({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/inbox.ts
-var c14 = initContract();
-var inboxContract = c14.router({
+var c15 = initContract();
+var inboxContract = c15.router({
   listInboxes: {
     method: "GET",
     path: "/organizations/:organizationId/inboxes",
@@ -25406,8 +25496,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c15 = initContract();
-var knowledgeBaseContract = c15.router({
+var c16 = initContract();
+var knowledgeBaseContract = c16.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -25628,8 +25718,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c16 = initContract();
-var knowledgeDocumentContract = c16.router({
+var c17 = initContract();
+var knowledgeDocumentContract = c17.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -25955,8 +26045,8 @@ var LinearMetadataResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-integration.ts
-var c17 = initContract();
-var linearIntegrationContract = c17.router({
+var c18 = initContract();
+var linearIntegrationContract = c18.router({
   getLinearIntegration: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear",
@@ -25974,7 +26064,7 @@ var linearIntegrationContract = c17.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/connect",
     pathParams: OrgIdParamsSchema,
-    body: c17.noBody(),
+    body: c18.noBody(),
     responses: {
       200: LinearConnectResponseSchema,
       401: ErrorResponseSchema,
@@ -25989,7 +26079,7 @@ var linearIntegrationContract = c17.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/disconnect",
     pathParams: OrgIdParamsSchema,
-    body: c17.noBody(),
+    body: c18.noBody(),
     responses: {
       200: LinearIntegrationResponseSchema,
       401: ErrorResponseSchema,
@@ -26151,8 +26241,8 @@ var LinearTicketContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-tickets.ts
-var c18 = initContract();
-var linearTicketContract = c18.router({
+var c19 = initContract();
+var linearTicketContract = c19.router({
   /**
    * Push one or more pentest findings to Linear as tickets. Customer-side
    * (VIEW_RESULTS + PENTEST capability); non-admins create into the org's
@@ -26256,8 +26346,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c19 = initContract();
-var llmProviderKeyContract = c19.router({
+var c20 = initContract();
+var llmProviderKeyContract = c20.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -26451,8 +26541,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c20 = initContract();
-var organizationContract = c20.router({
+var c21 = initContract();
+var organizationContract = c21.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -26656,7 +26746,7 @@ var organizationContract = c20.router({
     method: "POST",
     path: "/organizations/:organizationId/logos-from-homepage",
     pathParams: OrgIdParamsSchema,
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: OrganizationResponseSchema,
       // 400 — no homepage set on the organization.
@@ -27269,11 +27359,19 @@ var CustomerPentestDetailResponseSchema = CustomerPentestResponseSchema.extend({
    * GET …/questionnaire. `.optional()` for rolling-deploy safety.
    */
   questionnaireEditable: external_exports.boolean().optional(),
-  hasQuestionnaireAnswers: external_exports.boolean().optional()
+  hasQuestionnaireAnswers: external_exports.boolean().optional(),
+  /**
+   * True once the customer has submitted the questionnaire (frozen). Optional
+   * for rolling-deploy safety against an older API that does not send it.
+   */
+  questionnaireSubmitted: external_exports.boolean().optional()
 });
 var CustomerPentestQuestionnaireResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
-  /** True iff currentStage ∈ SCOPING_PENTEST_STAGES (DRAFT | READY_TO_START). */
+  /**
+   * True iff the engagement is still in a scoping stage AND the questionnaire
+   * has not been submitted. A submitted intake is frozen even during scoping.
+   */
   editable: external_exports.boolean(),
   /**
    * Lenient on unknown keys: during a rolling deploy the dashboard runs against
@@ -27282,7 +27380,13 @@ var CustomerPentestQuestionnaireResponseSchema = external_exports.object({
    * strict — see the upsert request below.
    */
   answers: PentestCustomerIntakeStoredAnswersSchema.nullable(),
-  updatedAt: external_exports.coerce.date()
+  updatedAt: external_exports.coerce.date(),
+  /**
+   * When the customer submitted (froze) the questionnaire. Null = still a
+   * draft. Optional so an older API response still parses during a rolling
+   * deploy; absence means "not submitted" to new clients.
+   */
+  submittedAt: external_exports.coerce.date().nullable().optional()
 });
 var UpsertCustomerPentestQuestionnaireRequestSchema = external_exports.object({
   /**
@@ -27292,6 +27396,14 @@ var UpsertCustomerPentestQuestionnaireRequestSchema = external_exports.object({
    */
   answers: PentestCustomerIntakeWriteAnswersSchema.nullable()
 }).strict();
+var SubmitCustomerPentestQuestionnaireRequestSchema = external_exports.object({
+  /**
+   * Optional last draft to persist atomically with the freeze. Omitted keeps
+   * whatever is already stored. Retired keys are accepted and dropped, same
+   * as the upsert path.
+   */
+  answers: PentestCustomerIntakeWriteAnswersSchema.optional()
+}).strict();
 var ReadPentestResponseSchema = external_exports.union([
   PentestDetailResponseSchema,
   CustomerPentestShellResponseSchema
@@ -27429,8 +27541,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c21 = initContract();
-var pentestContract = c21.router({
+var c22 = initContract();
+var pentestContract = c22.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -27507,6 +27619,21 @@ var pentestContract = c21.router({
       500: ErrorResponseSchema
     }
   },
+  submitCustomerPentestQuestionnaire: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/submit",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: SubmitCustomerPentestQuestionnaireRequestSchema,
+    responses: {
+      200: CustomerPentestQuestionnaireResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   createPentest: {
     method: "POST",
     path: "/organizations/:organizationId/pentests",
@@ -27866,8 +27993,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c22 = initContract();
-var pentestAttestationContract = c22.router({
+var c23 = initContract();
+var pentestAttestationContract = c23.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -28009,8 +28136,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c23 = initContract();
-var pentestAuditLogContract = c23.router({
+var c24 = initContract();
+var pentestAuditLogContract = c24.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -28026,6 +28153,86 @@ var pentestAuditLogContract = c23.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-authorized-domain.api.ts
+var PentestAuthorizedDomainIdParamsSchema = PentestIdParamsSchema.extend({
+  pentestAuthorizedDomainId: external_exports.uuid()
+});
+var AuthorizedDomainOriginValues = ["DERIVED", "ENGAGEMENT"];
+var AuthorizedDomainOrigin = external_exports.enum(AuthorizedDomainOriginValues);
+var PentestAuthorizedDomainResponseSchema = external_exports.object({
+  /**
+   * NULL for a domain contributed by a bound application while the engagement is
+   * still tracking — there is no row yet, and nothing to address by id.
+   */
+  pentestAuthorizedDomainId: external_exports.uuid().nullable(),
+  pentestId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  domain: external_exports.string(),
+  applicationIds: external_exports.array(external_exports.uuid()),
+  origin: AuthorizedDomainOrigin,
+  /** NULL when the row was written by materialization rather than by a person. */
+  addedById: external_exports.uuid().nullable(),
+  addedAt: external_exports.date().nullable()
+});
+var PentestAuthorizedScopeResponseSchema = external_exports.object({
+  domains: external_exports.array(PentestAuthorizedDomainResponseSchema),
+  /** Null while the engagement still tracks its bound applications. */
+  materializedAt: external_exports.date().nullable()
+});
+var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
+  domain: external_exports.string().trim().min(1).max(253)
+}).strict();
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
+var c25 = initContract();
+var pentestAuthorizedDomainContract = c25.router({
+  getPentestAuthorizedScope: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
+    pathParams: PentestIdParamsSchema,
+    responses: {
+      200: PentestAuthorizedScopeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  addPentestAuthorizedDomain: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope/domains",
+    pathParams: PentestIdParamsSchema,
+    body: CreatePentestAuthorizedDomainRequestSchema,
+    responses: {
+      201: PentestAuthorizedDomainResponseSchema,
+      // 400 = INVALID_DOMAIN (not a registrable domain / IP / bare suffix);
+      // 409 = DOMAIN_ALREADY_AUTHORIZED or PENTEST_CLOSED.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  removePentestAuthorizedDomain: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope/domains/:pentestAuthorizedDomainId",
+    pathParams: PentestAuthorizedDomainIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      // 409 = DOMAIN_FROM_ENVIRONMENT (derived from a selected environment's
+      // Target URL, so removing the row here would not remove it from scope) or
+      // PENTEST_CLOSED.
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-engagement-exclusion.api.ts
 var PentestEngagementExclusionsParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -28051,8 +28258,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c24 = initContract();
-var pentestEngagementExclusionContract = c24.router({
+var c26 = initContract();
+var pentestEngagementExclusionContract = c26.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -28116,8 +28323,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c25 = initContract();
-var pentestEnvironmentContract = c25.router({
+var c27 = initContract();
+var pentestEnvironmentContract = c27.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -28976,6 +29183,25 @@ var CurateFindingEvidenceRequestSchema = external_exports.object({
 }).strict().refine((v2) => Object.keys(v2).length > 0, {
   message: "At least one curation field must be provided"
 });
+var MAX_STAFF_EVIDENCE_UPLOAD_BYTES = 256 * 1024 * 1024;
+var CreateFindingEvidenceUploadRequestSchema = external_exports.object({
+  filename: external_exports.string().min(1).max(255),
+  sizeBytes: external_exports.number().int().positive().max(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)
+}).strict();
+var CreateFindingEvidenceUploadResponseSchema = external_exports.object({
+  key: external_exports.string(),
+  uploadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date(),
+  kind: PentestExploitArtifactKind,
+  mimeType: external_exports.string()
+});
+var AttachFindingEvidenceRequestSchema = external_exports.object({
+  key: external_exports.string().min(1).max(1024),
+  kind: PentestExploitArtifactKind.optional(),
+  caption: external_exports.string().min(1).max(500).optional(),
+  section: ValidationEvidenceSection.optional(),
+  customerFacing: external_exports.boolean().optional()
+}).strict();
 var PentestFindingRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryName: external_exports.string(),
@@ -29492,8 +29718,8 @@ var GetParseTaskStatusResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c26 = initContract();
-var pentestFindingContract = c26.router({
+var c28 = initContract();
+var pentestFindingContract = c28.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -29582,6 +29808,43 @@ var pentestFindingContract = c26.router({
       500: ErrorResponseSchema
     }
   },
+  // ─── Evidence (staff manual attach) ───
+  //
+  // Two calls, because the bytes never pass through the api: mint a presigned
+  // PUT, upload straight to S3, then register the object as an exhibit. That
+  // keeps a screen-recorded PoC off the request path entirely (no body limit, no
+  // request timeout, no api memory) and mirrors how the operator agent session
+  // already attaches evidence.
+  createFindingEvidenceUpload: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence/uploads",
+    pathParams: PentestFindingIdParamsSchema,
+    body: CreateFindingEvidenceUploadRequestSchema,
+    responses: {
+      201: CreateFindingEvidenceUploadResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  attachFindingEvidence: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence",
+    pathParams: PentestFindingIdParamsSchema,
+    body: AttachFindingEvidenceRequestSchema,
+    responses: {
+      201: PentestExploitArtifactMetadataResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   curateFindingEvidence: {
     method: "PATCH",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence/:artifactId",
@@ -29962,6 +30225,12 @@ var PentestHypothesisAttemptSummarySchema = external_exports.object({
   status: PentestHypothesisAttemptStatus,
   attemptOrdinal: external_exports.number().int().positive(),
   conclusion: external_exports.string().nullable(),
+  // Optional for rolling-deploy safety: web (Vercel) can deploy this schema before the
+  // API sends the field, and web strictly `.parse()`s the response. Absent → undefined,
+  // which the web serializer coalesces to null. Carries the Blocked/Failed reason so the
+  // hypothesis drawer's verdict panel can show it when the deciding attempt is only in
+  // hand as this summary (a verdict from a prior run).
+  blockerReason: external_exports.string().nullable().optional(),
   startedAt: external_exports.coerce.date().nullable(),
   completedAt: external_exports.coerce.date().nullable(),
   durationMs: external_exports.number().int().nonnegative().nullable(),
@@ -30082,8 +30351,8 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
 }).strict().optional();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c27 = initContract();
-var pentestHypothesisContract = c27.router({
+var c29 = initContract();
+var pentestHypothesisContract = c29.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -30186,8 +30455,8 @@ var pentestHypothesisContract = c27.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c28 = initContract();
-var pentestManualFindingContract = c28.router({
+var c30 = initContract();
+var pentestManualFindingContract = c30.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -30274,8 +30543,8 @@ var pentestManualFindingContract = c28.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c29 = initContract();
-var pentestReportPdfContract = c29.router({
+var c31 = initContract();
+var pentestReportPdfContract = c31.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -30368,7 +30637,7 @@ var pentestReportPdfContract = c29.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c29.noBody(),
+    body: c31.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -30559,8 +30828,8 @@ var pentestReportPdfContract = c29.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c30 = initContract();
-var pentestValidationContract = c30.router({
+var c32 = initContract();
+var pentestValidationContract = c32.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -30668,8 +30937,8 @@ var pentestValidationContract = c30.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c31 = initContract();
-var repositoryContract = c31.router({
+var c33 = initContract();
+var repositoryContract = c33.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -30826,7 +31095,7 @@ var repositoryContract = c31.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c31.noBody(),
+    body: c33.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -30960,8 +31229,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c32 = initContract();
-var scanContract = c32.router({
+var c34 = initContract();
+var scanContract = c34.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -31123,8 +31392,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c33 = initContract();
-var testIntegrationContract = c33.router({
+var c35 = initContract();
+var testIntegrationContract = c35.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -31251,8 +31520,8 @@ var UpdateStaffProfileRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c34 = initContract();
-var userContract = c34.router({
+var c36 = initContract();
+var userContract = c36.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -31349,8 +31618,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c35 = initContract();
-var vantaIntegrationContract = c35.router({
+var c37 = initContract();
+var vantaIntegrationContract = c37.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -31682,8 +31951,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c36 = initContract();
-var vulnerabilityContract = c36.router({
+var c38 = initContract();
+var vulnerabilityContract = c38.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -31891,8 +32160,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c37 = initContract();
-var vulnerabilityNoteContract = c37.router({
+var c39 = initContract();
+var vulnerabilityNoteContract = c39.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -32073,8 +32342,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c38 = initContract();
-var webhookSettingsContract = c38.router({
+var c40 = initContract();
+var webhookSettingsContract = c40.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -32212,11 +32481,12 @@ var webhookSettingsContract = c38.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c39 = initContract();
-var v1Contract = c39.router(
+var c41 = initContract();
+var v1Contract = c41.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
+    codeSize: codeSizeContract,
     scan: scanContract,
     organization: organizationContract,
     user: userContract,
@@ -32243,6 +32513,7 @@ var v1Contract = c39.router(
     pentestAuditLog: pentestAuditLogContract,
     pentestEnvironment: pentestEnvironmentContract,
     pentestEngagementExclusion: pentestEngagementExclusionContract,
+    pentestAuthorizedDomain: pentestAuthorizedDomainContract,
     pentestFinding: pentestFindingContract,
     pentestHypothesis: pentestHypothesisContract,
     pentestValidation: pentestValidationContract,
@@ -32261,8 +32532,8 @@ var v1Contract = c39.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c40 = initContract();
-var contract = c40.router({
+var c42 = initContract();
+var contract = c42.router({
   v1: v1Contract
 });
 
@@ -32311,7 +32582,7 @@ var ComplianceRegimeValues = [
 var ComplianceRegime = external_exports.enum(ComplianceRegimeValues);
 
 // ../../packages/api-contracts/src/contracts/v1/agent-session-internal.ts
-var c41 = initContract();
+var c43 = initContract();
 var AgentSessionInternalParamsSchema = external_exports.object({
   agentSessionId: external_exports.uuid()
 });
@@ -33166,7 +33437,7 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
   expectedUpdatedAt: reportExpectedUpdatedAt,
   rows: external_exports.array(ScopeRowSchema).max(100)
 });
-var agentSessionInternalContract = c41.router({
+var agentSessionInternalContract = c43.router({
   postEvents: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/events",
@@ -33866,8 +34137,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c42 = initContract();
-var githubWebhookContract = c42.router(
+var c44 = initContract();
+var githubWebhookContract = c44.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33885,7 +34156,7 @@ var githubWebhookContract = c42.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c42.router(
+var githubReadonlyWebhookContract = c44.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33905,9 +34176,9 @@ var githubReadonlyWebhookContract = c42.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c43 = initContract();
+var c45 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c43.router(
+var linearWebhookContract = c45.router(
   {
     handleWebhook: {
       method: "POST",
@@ -33927,7 +34198,7 @@ var linearWebhookContract = c43.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c44 = initContract();
+var c46 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -33956,7 +34227,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c44.router(
+var forgeBitbucketContract = c46.router(
   {
     lifecycle: {
       method: "POST",
@@ -34003,8 +34274,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c45 = initContract();
-var healthContract = c45.router({
+var c47 = initContract();
+var healthContract = c47.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -34016,8 +34287,8 @@ var healthContract = c45.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c46 = initContract();
-var vulnerabilityShareContract = c46.router(
+var c48 = initContract();
+var vulnerabilityShareContract = c48.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -34104,8 +34375,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c47 = initContract();
-var prVulnerabilityContract = c47.router(
+var c49 = initContract();
+var prVulnerabilityContract = c49.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -36658,12 +36929,12 @@ function buildApplicationsTable(apps) {
     repos: String(a.repositories.length),
     url: a.applicationUrl ? sanitizeDisplay(a.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c49) => c49.type.length));
+  const idWidth = Math.max(2, ...cells.map((c51) => c51.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c51) => c51.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c51) => c51.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.name.padEnd(nameWidth)}  ${c49.type.padEnd(typeWidth)}  ${c49.repos.padStart(5)}  ${c49.url}`
+    (c51) => `${c51.id.padEnd(idWidth)}  ${c51.name.padEnd(nameWidth)}  ${c51.type.padEnd(typeWidth)}  ${c51.repos.padStart(5)}  ${c51.url}`
   );
   return { header, rows };
 }
@@ -36683,12 +36954,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l.repositoryPath ? sanitizeDisplay(l.repositoryPath) : "\u2014",
     status: formatStatus(l.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c49) => c49.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c49) => c49.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c49) => c49.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c51) => c51.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c51) => c51.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c51) => c51.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c49) => `${c49.name.padEnd(nameWidth)}  ${c49.scan.padEnd(4)}  ${c49.role.padEnd(roleWidth)}  ${c49.path.padEnd(pathWidth)}  ${c49.status}`
+    (c51) => `${c51.name.padEnd(nameWidth)}  ${c51.scan.padEnd(4)}  ${c51.role.padEnd(roleWidth)}  ${c51.path.padEnd(pathWidth)}  ${c51.status}`
   );
   return { header, rows };
 }
@@ -37800,14 +38071,14 @@ var yt = (t) => {
 };
 var ee = (t, r, s, i, u) => {
   let n = r, o = 0;
-  for (let c49 = s; c49 < i; c49++) {
-    const a = t[c49];
+  for (let c51 = s; c51 < i; c51++) {
+    const a = t[c51];
     if (n = n - a.length, o++, n <= u) break;
   }
   return { lineCount: n, removals: o };
 };
 var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItems: u = Number.POSITIVE_INFINITY, columnPadding: n = 0, rowPadding: o = 4 }) => {
-  const c49 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
+  const c51 = A(i) - n, a = L(i), l = e("dim", "..."), d2 = Math.max(a - o, 0), y = Math.max(Math.min(u, d2), 5);
   let p2 = 0;
   t >= y - 3 && (p2 = Math.max(Math.min(t - y + 3, r.length - y), 0));
   let m = y < r.length && p2 > 0, g = y < r.length && p2 + y < r.length;
@@ -37816,7 +38087,7 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
   m && f++, g && f++;
   const v2 = p2 + (m ? 1 : 0), T = S2 - (g ? 1 : 0);
   for (let b2 = v2; b2 < T; b2++) {
-    const G2 = wrapAnsi(s(r[b2], b2 === t), c49, { hard: true, trim: false }).split(`
+    const G2 = wrapAnsi(s(r[b2], b2 === t), c51, { hard: true, trim: false }).split(`
 `);
     h2.push(G2), f += G2.length;
   }
@@ -37833,22 +38104,22 @@ var Y2 = ({ cursor: t, options: r, style: s, output: i = process.stdout, maxItem
 var ue = (t) => {
   const r = t.active ?? "Yes", s = t.inactive ?? "No";
   return new X({ active: r, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
-    const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${e("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c49 = `${i ? `${e("gray", $)}
+    const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${e("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c51 = `${i ? `${e("gray", $)}
 ` : ""}${o}
 `, a = this.value ? r : s;
     switch (this.state) {
       case "submit": {
         const l = i ? `${e("gray", $)}  ` : "";
-        return `${c49}${l}${e("dim", a)}`;
+        return `${c51}${l}${e("dim", a)}`;
       }
       case "cancel": {
         const l = i ? `${e("gray", $)}  ` : "";
-        return `${c49}${l}${e(["strikethrough", "dim"], a)}${i ? `
+        return `${c51}${l}${e(["strikethrough", "dim"], a)}${i ? `
 ${e("gray", $)}` : ""}`;
       }
       default: {
         const l = i ? `${e("cyan", $)}  ` : "", d2 = i ? e("cyan", E2) : "";
-        return `${c49}${l}${this.value ? `${e("green", z4)} ${r}` : `${e("dim", H)} ${e("dim", r)}`}${t.vertical ? i ? `
+        return `${c51}${l}${this.value ? `${e("green", z4)} ${r}` : `${e("dim", H)} ${e("dim", r)}`}${t.vertical ? i ? `
 ${e("cyan", $)}  ` : `
 ` : ` ${e("dim", "/")} `}${this.value ? `${e("dim", H)} ${e("dim", s)}` : `${e("green", z4)} ${s}`}
 ${d2}
@@ -37870,21 +38141,21 @@ var fe = (t) => new rt({ validate: t.validate, placeholder: t.placeholder, defau
   ${e(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
   switch (this.state) {
     case "error": {
-      const c49 = `${e("yellow", $)}  `, a = r ? W(t.output, u, c49, void 0) : u, l = e("yellow", E2);
+      const c51 = `${e("yellow", $)}  `, a = r ? W(t.output, u, c51, void 0) : u, l = e("yellow", E2);
       return `${s}${a}
 ${l}  ${e("yellow", this.error)}${o}
 `;
     }
     case "submit": {
-      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e("dim", l)) : n ? e("dim", n) : "";
+      const c51 = `${e("gray", $)}  `, a = r ? W(t.output, n, c51, void 0, (l) => e("dim", l)) : n ? e("dim", n) : "";
       return `${s}${a}`;
     }
     case "cancel": {
-      const c49 = `${e("gray", $)}  `, a = r ? W(t.output, n, c49, void 0, (l) => e(["strikethrough", "dim"], l)) : n ? e(["strikethrough", "dim"], n) : "";
+      const c51 = `${e("gray", $)}  `, a = r ? W(t.output, n, c51, void 0, (l) => e(["strikethrough", "dim"], l)) : n ? e(["strikethrough", "dim"], n) : "";
       return `${s}${a}`;
     }
     default: {
-      const c49 = r ? `${e("cyan", $)}  ` : "", a = r ? e("cyan", E2) : "", l = r ? W(t.output, u, c49) : u;
+      const c51 = r ? `${e("cyan", $)}  ` : "", a = r ? e("cyan", E2) : "", l = r ? W(t.output, u, c51) : u;
       return `${s}${l}
 ${a}${o}
 `;
@@ -37905,7 +38176,7 @@ ${e("reset", e("dim", `Press ${e(["gray", "bgWhite", "inverse"], " space ")} to
   }, render() {
     const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${e("gray", $)}
 ` : ""}${u}
-`, o = this.value ?? [], c49 = (a, l) => {
+`, o = this.value ?? [], c51 = (a, l) => {
       if (a.disabled) return r(a, "disabled");
       const d2 = o.includes(a.value);
       return l && d2 ? r(a, "active-selected") : d2 ? r(a, "selected") : r(a, l ? "active" : "inactive");
@@ -37928,7 +38199,7 @@ ${e("gray", $)}` : ""}`;
 `), d2 = n.split(`
 `).length, y = l.split(`
 `).length + 1;
-        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: d2 + y, style: c49 }).join(`
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: d2 + y, style: c51 }).join(`
 ${a}`)}
 ${l}
 `;
@@ -37936,7 +38207,7 @@ ${l}
       default: {
         const a = i ? `${e("cyan", $)}  ` : "", l = n.split(`
 `).length, d2 = i ? 2 : 1;
-        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c49 }).join(`
+        return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c51 }).join(`
 ${a}`)}
 ${i ? e("cyan", E2) : ""}
 `;
@@ -37950,9 +38221,9 @@ var Ce = (t) => new ot({ validate: t.validate, mask: t.mask ?? Gt, signal: t.sig
 `, i = this.userInputWithCursor, u = this.masked;
   switch (this.state) {
     case "error": {
-      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c49 = u ?? "";
+      const n = r ? `${e("yellow", $)}  ` : "", o = r ? `${e("yellow", E2)}  ` : "", c51 = u ?? "";
       return t.clearOnError && this.clear(), `${s.trim()}
-${n}${c49}
+${n}${c51}
 ${o}${e("yellow", this.error)}
 `;
     }
@@ -38000,19 +38271,19 @@ var Ee = (t) => {
 `;
     switch (this.state) {
       case "submit": {
-        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c49);
+        const c51 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c51);
         return `${o}${a}`;
       }
       case "cancel": {
-        const c49 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c49);
+        const c51 = s ? `${e("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c51);
         return `${o}${a}${s ? `
 ${e("gray", $)}` : ""}`;
       }
       default: {
-        const c49 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
+        const c51 = s ? `${e("cyan", $)}  ` : "", a = s ? e("cyan", E2) : "", l = o.split(`
 `).length, d2 = s ? 2 : 1;
-        return `${o}${c49}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c49.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
-${c49}`)}
+        return `${o}${c51}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c51.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
+${c51}`)}
 ${a}
 `;
       }
@@ -38760,17 +39031,205 @@ function showBanner() {
 `);
 }
 
-// src/completion/index.ts
-function extractCommandTree(cmd) {
-  const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
-  const options = cmd.options.filter((o) => !o.hidden).filter((o) => !BUILTIN_FLAGS.has(o.long ?? "") && !BUILTIN_FLAGS.has(o.short ?? "")).map((o) => ({
+// src/code-size/format.ts
+function formatCount(value) {
+  return value.toLocaleString("en-US");
+}
+function repoDisplayName(repositoryUrl) {
+  try {
+    const path = new URL(repositoryUrl).pathname.replace(/^\//, "").replace(/\.git$/, "");
+    return path || repositoryUrl;
+  } catch {
+    return repositoryUrl;
+  }
+}
+function countedRows(totals) {
+  const b2 = totals.buckets;
+  return [
+    { label: "Billable code", value: b2.code.code },
+    { label: "Blank & comment lines in billable files", value: b2.code.lines - b2.code.code },
+    { label: "Tests", value: b2.tests.lines },
+    { label: "Documentation", value: b2.docs.lines },
+    { label: "Configuration & data", value: b2.config_data.lines },
+    { label: "Vendored & generated", value: b2.vendored_generated.lines }
+  ];
+}
+function countedTotal(totals) {
+  return countedRows(totals).reduce((sum, row) => sum + row.value, 0);
+}
+function padValues(rows) {
+  const formatted = rows.map((row) => formatCount(row.value));
+  const labelWidth = Math.max(...rows.map((row) => row.label.length));
+  const valueWidth = Math.max(...formatted.map((value) => value.length));
+  return rows.map(
+    (row, i) => `  ${row.label.padEnd(labelWidth)}  ${(formatted[i] ?? "").padStart(valueWidth)}`
+  );
+}
+function renderCodeSizeTable(codeSize, options) {
+  const { repositories, totals } = codeSize;
+  const measured = repositories.filter((repo) => repo.billableSloc !== null);
+  const lines = [`Code size for ${options.orgSlug}`, ""];
+  if (measured.length === 0) {
+    lines.push(
+      "  No measurements yet.",
+      `  ${formatCount(repositories.length)} connected ${plural(repositories.length, "repository has", "repositories have")} not been measured.`
+    );
+    return lines;
+  }
+  lines.push(
+    `  ${formatCount(totals.billableSloc)} billable SLOC`,
+    `  of ${formatCount(totals.rawLines)} total lines across ${formatCount(measured.length)} measured ${plural(measured.length, "repository", "repositories")}`
+  );
+  const unmeasured = repositories.length - measured.length;
+  if (unmeasured > 0) {
+    lines.push(
+      `  ${formatCount(unmeasured)} connected ${plural(unmeasured, "repository is", "repositories are")} not measured yet and not included`
+    );
+  }
+  lines.push("", "What's counted", ...padValues(countedRows(totals)));
+  const counted = countedTotal(totals);
+  if (counted !== totals.rawLines) {
+    lines.push(
+      `  These sum to ${formatCount(counted)}, not the ${formatCount(totals.rawLines)} above.`,
+      "  Some measurement predates the current counting rules; re-measure to reconcile."
+    );
+  }
+  lines.push("", "By repository");
+  const shown = measured.slice(0, options.repoLimit);
+  lines.push(
+    ...padValues(
+      shown.map((repo) => ({
+        label: repoDisplayName(repo.repositoryUrl),
+        value: repo.billableSloc ?? 0
+      }))
+    )
+  );
+  const hidden = measured.length - shown.length;
+  if (hidden > 0) {
+    lines.push(`  ... ${formatCount(hidden)} more`);
+  }
+  return lines;
+}
+function renderCodeSizeTsv(codeSize) {
+  return [
+    "repository	billableSloc",
+    ...codeSize.repositories.map(
+      (repo) => `${repoDisplayName(repo.repositoryUrl)}	${repo.billableSloc === null ? "" : repo.billableSloc}`
+    )
+  ];
+}
+function plural(count, one, many) {
+  return count === 1 ? one : many;
+}
+
+// src/code-size/commands.ts
+var DEFAULT_REPO_LIMIT = 20;
+var OUTPUT_FORMATS = ["table", "json", "tsv"];
+function isOutputFormat(value) {
+  return OUTPUT_FORMATS.includes(value);
+}
+function parseRepoLimit(value) {
+  if (!/^\d+$/.test(value.trim())) {
+    console.error("--repos must be a non-negative whole number (0 shows every repository).");
+    process.exit(1);
+  }
+  return Number.parseInt(value, 10);
+}
+function createCodeSizeCommand() {
+  return new Command("code-size").description("Show the organization's billable lines of code").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
+    "-n, --repos <count>",
+    `Per-repository rows to show in table output (default: ${DEFAULT_REPO_LIMIT}, 0 for all)`,
+    parseRepoLimit
+  ).option("-w, --web", "Open the code size panel in a browser").addHelpText(
+    "after",
+    `
+Billable SLOC is counted from each connected repository's current scanning
+branch. Blanks, comments, tests, docs, config and vendored code are excluded;
+"What's counted" reconciles the billable number to what plain scc reports.
+See ${getAppBaseUrl()}/docs/integrations/code-size
+
+Examples:
+  tracecli code-size
+  tracecli code-size --repos 0
+  tracecli code-size --output json | jq '.totals.billableSloc'
+  tracecli code-size --output tsv | cut -f1,2
+  tracecli code-size --web`
+  ).action(async (options) => {
+    if (!isOutputFormat(options.output)) {
+      console.error(
+        `Unsupported --output '${options.output}'. Expected one of: ${OUTPUT_FORMATS.join(", ")}.`
+      );
+      process.exit(1);
+    }
+    const listed = await authenticatedRequest(
+      (client) => client.organization.listMyOrganizations()
+    );
+    if (listed.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (listed.status !== 200) {
+      console.error(`Failed to resolve organization (status ${listed.status}).`);
+      process.exit(1);
+    }
+    const resolution = determineActiveOrganization(
+      listed.body,
+      readSelectedOrganizationId(),
+      extractOrganizationIdFromToken(readToken())
+    );
+    if (!resolution) {
+      console.error("No organization found for your account.");
+      process.exit(1);
+    }
+    const { organizationId, slug } = resolution.organization;
+    if (options.web) {
+      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/github`;
+      const opened = await openBrowser(url2);
+      if (!opened) {
+        console.log(`Open in browser: ${url2}`);
+      }
+      return;
+    }
+    const result = await authenticatedRequest(
+      (client) => client.codeSize.getOrganizationCodeSize({ params: { organizationId } })
+    );
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (result.status !== 200) {
+      console.error(`Failed to read code size (status ${result.status}).`);
+      process.exit(1);
+    }
+    const codeSize = result.body;
+    if (options.output === "json") {
+      console.log(JSON.stringify(codeSize, null, 2));
+      return;
+    }
+    if (options.output === "tsv") {
+      for (const line of renderCodeSizeTsv(codeSize)) {
+        console.log(line);
+      }
+      return;
+    }
+    const repoLimit = options.repos === void 0 ? DEFAULT_REPO_LIMIT : options.repos === 0 ? Number.POSITIVE_INFINITY : options.repos;
+    for (const line of renderCodeSizeTable(codeSize, { orgSlug: slug, repoLimit })) {
+      console.log(line);
+    }
+  });
+}
+
+// src/completion/index.ts
+function extractCommandTree(cmd) {
+  const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
+  const options = cmd.options.filter((o) => !o.hidden).filter((o) => !BUILTIN_FLAGS.has(o.long ?? "") && !BUILTIN_FLAGS.has(o.short ?? "")).map((o) => ({
     flags: o.flags,
     long: o.long ?? "",
     short: o.short ?? null,
     description: o.description,
     takesValue: o.required || o.optional
   }));
-  const subcommands = cmd.commands.filter((c49) => !c49._hidden).map((c49) => extractCommandTree(c49));
+  const subcommands = cmd.commands.filter((c51) => !c51._hidden).map((c51) => extractCommandTree(c51));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -38836,7 +39295,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c49) => c49.name);
+  const subcommandNames = tree.subcommands.map((c51) => c51.name);
   const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -39131,6 +39590,251 @@ Examples:
   });
 }
 
+// src/inbox/commands.ts
+function validateInboxLabel(label) {
+  const parsed = InboxLabelSchema.safeParse(label);
+  if (parsed.success) {
+    return null;
+  }
+  return "Inbox label must be lowercase letters, digits, or dashes, starting with a letter (max 40 characters).";
+}
+function buildCreateInboxBody(label) {
+  return { label };
+}
+function failWriteOp2(action, status, body, notFoundLabel) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} inboxes.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(
+      colorError(message ?? (notFoundLabel ? `No inbox labeled '${notFoundLabel}'.` : "Not found."))
+    );
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "INBOX_ALREADY_EXISTS") {
+      console.error(
+        colorError(message ?? "An inbox with this label already exists in this organization.")
+      );
+    } else if (errorCode === "INBOX_BEING_DELETED") {
+      console.error(
+        colorError(
+          message ?? "That name was recently removed and is still being cleaned up. Try again shortly, or choose another."
+        )
+      );
+    } else if (errorCode === "INBOX_QUOTA_EXCEEDED") {
+      console.error(
+        colorError(message ?? "Inbox limit reached. Delete an unused inbox to create a new one.")
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(
+        message ?? "Managed inboxes are not enabled on this server: no mail provider is configured."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} inbox (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function failReadOp2(status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(colorError("You don't have access to view inboxes in this organization."));
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(
+        message ?? "Managed inboxes are not enabled on this server: no mail provider is configured."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to list inboxes (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function renderInboxDetail(inbox) {
+  const pad = 10;
+  return [
+    `${"Address:".padEnd(pad)} ${sanitizeDisplay(inbox.address)}`,
+    `${"Label:".padEnd(pad)} ${sanitizeDisplay(inbox.label)}`,
+    `${"Created:".padEnd(pad)} ${formatDate(inbox.createdAt)}`
+  ].join("\n");
+}
+function printInboxesTsv(inboxes) {
+  console.log(["address", "label", "createdAt"].join("	"));
+  for (const inbox of inboxes) {
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(inbox.address)),
+        tsvSafe(sanitizeDisplay(inbox.label)),
+        tsvSafe(toIso(inbox.createdAt))
+      ].join("	")
+    );
+  }
+}
+function buildInboxesTable(inboxes) {
+  const cells = inboxes.map((inbox) => ({
+    address: sanitizeDisplay(inbox.address),
+    label: sanitizeDisplay(inbox.label)
+  }));
+  const addressWidth = Math.max(7, ...cells.map((c51) => c51.address.length));
+  const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
+  const rows = cells.map((c51) => `${c51.address.padEnd(addressWidth)}  ${c51.label}`);
+  return { header, rows };
+}
+function formatInboxQuota(quota) {
+  return `${quota.used} of ${quota.limit} inboxes`;
+}
+function outputInbox(inbox, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(inbox, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printInboxesTsv([inbox]);
+    return;
+  }
+  console.log(renderInboxDetail(inbox));
+}
+function requireInboxLabel(label) {
+  const error48 = validateInboxLabel(label);
+  if (error48) {
+    console.error(colorError(error48));
+    process.exit(1);
+  }
+}
+async function runCreate2(label, options) {
+  const output = parseOutput(options.output);
+  requireInboxLabel(label);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.createInbox({
+      params: { organizationId },
+      body: buildCreateInboxBody(label)
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failWriteOp2("create", result.status, result.body);
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Created inbox ${sanitizeDisplay(result.body.address)}`));
+  }
+  outputInbox(result.body, output);
+}
+async function runList2(options) {
+  const output = parseOutput(options.output);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.listInboxes({ params: { organizationId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp2(result.status, result.body);
+  }
+  const { inboxes, quota } = result.body;
+  if (output === "json") {
+    console.log(JSON.stringify({ inboxes, quota }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printInboxesTsv(inboxes);
+    return;
+  }
+  if (inboxes.length === 0) {
+    console.log(`No inboxes found. ${formatInboxQuota(quota)}.`);
+    return;
+  }
+  const { header, rows } = buildInboxesTable(inboxes);
+  await runInteractivePager({
+    items: inboxes,
+    header,
+    renderItem: (_inbox, i) => [rows[i] ?? ""],
+    disabled: options.pager === false
+  });
+  console.log(formatInboxQuota(quota));
+}
+async function runDelete2(label, options) {
+  requireInboxLabel(label);
+  const confirmed = await confirmDeletion(`inbox ${label}`, options.yes);
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.deleteInbox({
+      params: { organizationId, label }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failWriteOp2("delete", result.status, result.body, label);
+  }
+  console.log(colorSuccess(`Deleted inbox ${sanitizeDisplay(label)}`));
+}
+function createCreateCommand2() {
+  return new Command("create").description("Provision a Trace-hosted email inbox").argument("<label>", "Inbox name (lowercase letters/digits/dashes, max 40)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Trace hosts this inbox; the pentest agent reads its emails automatically.
+The minted address is {org-slug}-{label}@pentest.securewithtrace.com.
+
+Use the printed address as the test-account email when creating a magic-auth
+or username-password credential.
+
+Examples:
+  tracecli credential inbox create portal
+  ADDRESS=$(tracecli credential inbox create qa-admin -o json | jq -r .address)
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
+  ).action(async (label, options) => {
+    await runCreate2(label, options);
+  });
+}
+function createListCommand3() {
+  return new Command("list").description("List Trace-hosted email inboxes in the active organization").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").action(async (options) => {
+    await runList2(options);
+  });
+}
+function createDeleteCommand2() {
+  return new Command("delete").description("Delete a Trace-hosted email inbox").argument("<label>", "Inbox label").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (label, options) => {
+    await runDelete2(label, options);
+  });
+}
+function createInboxCommand() {
+  const inbox = new Command("inbox").description(
+    "Provision Trace-hosted email inboxes for test-account credentials"
+  );
+  inbox.addCommand(createCreateCommand2());
+  inbox.addCommand(createListCommand3());
+  inbox.addCommand(createDeleteCommand2());
+  return inbox;
+}
+
 // src/secret-input.ts
 import { readFileSync as readFileSync2 } from "fs";
 var SecretInputError = class extends Error {
@@ -39423,7 +40127,7 @@ function usernameOpts(opts) {
 function passwordOpts(opts) {
   return { stdin: opts.passwordStdin, file: opts.passwordFile, env: opts.passwordEnv };
 }
-function failWriteOp2(action, status, body, notFoundLabel) {
+function failWriteOp3(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -39467,7 +40171,7 @@ function failWriteOp2(action, status, body, notFoundLabel) {
   );
   process.exit(1);
 }
-function failReadOp2(action, status, body, notFoundLabel) {
+function failReadOp3(action, status, body, notFoundLabel) {
   const { message } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -39519,16 +40223,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c49) => ({
-    id: c49.credentialId,
-    label: sanitizeDisplay(c49.label),
-    type: c49.credentialType
+  const cells = creds.map((c51) => ({
+    id: c51.credentialId,
+    label: sanitizeDisplay(c51.label),
+    type: c51.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c49) => c49.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c49) => c49.label.length));
+  const idWidth = Math.max(2, ...cells.map((c51) => c51.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c51) => c51.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c49) => `${c49.id.padEnd(idWidth)}  ${c49.label.padEnd(labelWidth)}  ${c49.type}`
+    (c51) => `${c51.id.padEnd(idWidth)}  ${c51.label.padEnd(labelWidth)}  ${c51.type}`
   );
   return { header, rows };
 }
@@ -39559,7 +40263,7 @@ function failAuthBuild(result) {
   console.error(colorError(result.error));
   process.exit(1);
 }
-async function runCreate2(options) {
+async function runCreate3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   const type = normalizeCredentialType(options.type);
@@ -39599,7 +40303,7 @@ async function runCreate2(options) {
     (client) => client.credential.createCredential({ params, body })
   );
   if (result.status !== CREATED_STATUS) {
-    failWriteOp2("create", result.status, result.body);
+    failWriteOp3("create", result.status, result.body);
   }
   if (output === "table") {
     console.log(colorSuccess(`Created credential ${sanitizeDisplay(result.body.label)}`));
@@ -39691,7 +40395,7 @@ async function buildCreateBody(type, label, options) {
     }
   }
 }
-async function runList2(options) {
+async function runList3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   const organizationId = await resolveOrganizationId();
@@ -39699,7 +40403,7 @@ async function runList2(options) {
     (client) => client.credential.listCredentials({ params: { organizationId, environmentId: options.env } })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp2("list credentials", result.status, result.body, options.env);
+    failReadOp3("list credentials", result.status, result.body, options.env);
   }
   const creds = result.body;
   if (output === "json") {
@@ -39733,7 +40437,7 @@ async function runGet2(credentialId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp2("get credential", result.status, result.body, credentialId);
+    failReadOp3("get credential", result.status, result.body, credentialId);
   }
   outputCredential(result.body, output);
 }
@@ -39767,7 +40471,7 @@ async function runUpdate2(credentialId, options) {
       (client) => client.credential.getCredential({ params })
     );
     if (current.status !== SUCCESS_STATUS) {
-      failReadOp2("get credential", current.status, current.body, credentialId);
+      failReadOp3("get credential", current.status, current.body, credentialId);
     }
     const type = current.body.credentialType;
     const foreign = rejectForeignAuthFlags(type, options);
@@ -39800,14 +40504,14 @@ async function runUpdate2(credentialId, options) {
     (client) => client.credential.updateCredential({ params, body })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failWriteOp2("update", result.status, result.body, credentialId);
+    failWriteOp3("update", result.status, result.body, credentialId);
   }
   if (output === "table") {
     console.log(colorSuccess(`Updated credential ${sanitizeDisplay(result.body.label)}`));
   }
   outputCredential(result.body, output);
 }
-async function runDelete2(credentialId, options) {
+async function runDelete3(credentialId, options) {
   requireEnvId(options.env);
   requireCredId(credentialId);
   const confirmed = await confirmDeletion(`credential ${credentialId}`, options.yes);
@@ -39822,7 +40526,7 @@ async function runDelete2(credentialId, options) {
     })
   );
   if (result.status !== NO_CONTENT_STATUS) {
-    failWriteOp2("delete", result.status, result.body, credentialId);
+    failWriteOp3("delete", result.status, result.body, credentialId);
   }
   console.log(colorSuccess(`Deleted credential ${credentialId}`));
 }
@@ -39832,7 +40536,7 @@ function addSecretInputOptions(command) {
 function addAuthConfigOptions(command) {
   return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)");
 }
-function createCreateCommand2() {
+function createCreateCommand3() {
   const command = new Command("create").description("Create a credential in an environment").requiredOption("--env <environmentId>", "Parent environment UUID").requiredOption(
     "--type <type>",
     "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth"
@@ -39850,15 +40554,17 @@ Secrets are read from stdin/file/env (or a no-echo prompt) \u2014 never an inlin
 Examples:
   vault read -field=token secret/x | tracecli credential create --env <envId> --type bearer-token --secret-stdin
   tracecli credential create --env <envId> --type api-key --label "prod key" --secret-env API_KEY --placement header --key-name X-API-Key
-  tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login`
+  tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login
+  ADDRESS=$(tracecli credential inbox create portal -o json | jq -r .address)
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
   );
   return command.action(async (options) => {
-    await runCreate2(options);
+    await runCreate3(options);
   });
 }
-function createListCommand3() {
+function createListCommand4() {
   return new Command("list").description("List an environment's credentials (secrets are never shown)").requiredOption("--env <environmentId>", "Parent environment UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").action(async (options) => {
-    await runList2(options);
+    await runList3(options);
   });
 }
 function createGetCommand2() {
@@ -39884,18 +40590,19 @@ Examples:
     await runUpdate2(credentialId, options);
   });
 }
-function createDeleteCommand2() {
+function createDeleteCommand3() {
   return new Command("delete").description("Delete a credential").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Parent environment UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (credentialId, options) => {
-    await runDelete2(credentialId, options);
+    await runDelete3(credentialId, options);
   });
 }
 function createCredentialCommand() {
   const credential = new Command("credential").alias("cred").description("Manage environment credentials");
-  credential.addCommand(createCreateCommand2());
-  credential.addCommand(createListCommand3());
+  credential.addCommand(createCreateCommand3());
+  credential.addCommand(createListCommand4());
   credential.addCommand(createGetCommand2());
   credential.addCommand(createUpdateCommand2());
-  credential.addCommand(createDeleteCommand2());
+  credential.addCommand(createDeleteCommand3());
+  credential.addCommand(createInboxCommand());
   return credential;
 }
 
@@ -39938,7 +40645,7 @@ function resolveProductionFlag(input) {
   }
   return { value: void 0 };
 }
-function failWriteOp3(action, status, body, notFoundLabel) {
+function failWriteOp4(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -39986,7 +40693,7 @@ function failWriteOp3(action, status, body, notFoundLabel) {
   );
   process.exit(1);
 }
-function failReadOp3(action, status, body, notFoundLabel) {
+function failReadOp4(action, status, body, notFoundLabel) {
   const { message } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -40017,7 +40724,7 @@ function renderEnvironmentDetail(env2) {
   return [
     `${"ID:".padEnd(pad)} ${env2.environmentId}`,
     `${"Name:".padEnd(pad)} ${sanitizeDisplay(env2.name)}`,
-    `${"URL:".padEnd(pad)} ${sanitizeDisplay(env2.primaryUrl)}`,
+    `${"URL:".padEnd(pad)} ${env2.primaryUrl != null ? sanitizeDisplay(env2.primaryUrl) : "\u2014"}`,
     `${"Production:".padEnd(pad)} ${env2.isProduction ? "yes" : "no"}`,
     `${"Description:".padEnd(pad)} ${env2.description ? sanitizeDisplay(env2.description) : "\u2014"}`,
     `${"Application:".padEnd(pad)} ${env2.applicationId}`,
@@ -40033,7 +40740,7 @@ function printEnvironmentsTsv(envs) {
       [
         tsvSafe(env2.environmentId),
         tsvSafe(sanitizeDisplay(env2.name)),
-        tsvSafe(sanitizeDisplay(env2.primaryUrl)),
+        tsvSafe(sanitizeDisplay(env2.primaryUrl ?? "")),
         String(env2.isProduction),
         tsvSafe(sanitizeDisplay(env2.description ?? "")),
         tsvSafe(toIso(env2.createdAt))
@@ -40065,7 +40772,7 @@ function printOrgEnvironmentsTsv(envs) {
         tsvSafe(env2.applicationId),
         tsvSafe(sanitizeDisplay(env2.applicationName)),
         tsvSafe(sanitizeDisplay(env2.name)),
-        tsvSafe(sanitizeDisplay(env2.primaryUrl)),
+        tsvSafe(sanitizeDisplay(env2.primaryUrl ?? "")),
         String(env2.isProduction),
         tsvSafe(toIso(env2.createdAt))
       ].join("	")
@@ -40077,17 +40784,17 @@ function buildEnvironmentTable(envs, leading) {
     leading: leading.map((column) => sanitizeDisplay(column.value(e2))),
     name: sanitizeDisplay(e2.name),
     prod: e2.isProduction ? "yes" : "no",
-    url: sanitizeDisplay(e2.primaryUrl)
+    url: e2.primaryUrl != null ? sanitizeDisplay(e2.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i) => Math.max(column.header.length, ...cells.map((c49) => c49.leading[i]?.length ?? 0))
+    (column, i) => Math.max(column.header.length, ...cells.map((c51) => c51.leading[i]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c49) => c49.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c51) => c51.name.length));
   const padLeading = (values) => values.map((v2, i) => v2.padEnd(leadingWidths[i] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c49) => c49.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c51) => c51.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c49) => `${padLeading(c49.leading)}  ${c49.name.padEnd(nameWidth)}  ${c49.prod.padEnd(4)}  ${c49.url}`
+      (c51) => `${padLeading(c51.leading)}  ${c51.name.padEnd(nameWidth)}  ${c51.prod.padEnd(4)}  ${c51.url}`
     )
   };
 }
@@ -40127,7 +40834,7 @@ function requireEnvId2(environmentId) {
     process.exit(1);
   }
 }
-async function runCreate3(name, options) {
+async function runCreate4(name, options) {
   const output = parseOutput(options.output);
   requireAppId(options.app);
   const nameError = validateEnvName(name);
@@ -40149,7 +40856,7 @@ async function runCreate3(name, options) {
     })
   );
   if (result.status !== CREATED_STATUS) {
-    failWriteOp3("create", result.status, result.body);
+    failWriteOp4("create", result.status, result.body);
   }
   if (output === "table") {
     console.log(colorSuccess(`Created environment ${sanitizeDisplay(result.body.name)}`));
@@ -40176,7 +40883,7 @@ function createOrgEnvironmentRequests(organizationId) {
 async function collectOrgEnvironments(requests) {
   const appsResult = await requests.listApplications();
   if (!appsResult.ok) {
-    failReadOp3("list applications", appsResult.status, appsResult.body);
+    failReadOp4("list applications", appsResult.status, appsResult.body);
   }
   const apps = appsResult.data;
   const environments = [];
@@ -40248,7 +40955,7 @@ async function runListAcrossOrganization(output, pager) {
     disabled: pager === false
   });
 }
-async function runList3(options) {
+async function runList4(options) {
   const output = parseOutput(options.output);
   if (options.app === void 0) {
     await runListAcrossOrganization(output, options.pager);
@@ -40263,7 +40970,7 @@ async function runList3(options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp3("list environments", result.status, result.body, applicationId);
+    failReadOp4("list environments", result.status, result.body, applicationId);
   }
   const envs = result.body;
   if (output === "json") {
@@ -40297,7 +41004,7 @@ async function runGet3(environmentId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp3("get environment", result.status, result.body, environmentId);
+    failReadOp4("get environment", result.status, result.body, environmentId);
   }
   outputEnvironment(result.body, output);
 }
@@ -40339,14 +41046,14 @@ async function runUpdate3(environmentId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failWriteOp3("update", result.status, result.body, environmentId);
+    failWriteOp4("update", result.status, result.body, environmentId);
   }
   if (output === "table") {
     console.log(colorSuccess(`Updated environment ${sanitizeDisplay(result.body.name)}`));
   }
   outputEnvironment(result.body, output);
 }
-async function runDelete3(environmentId, options) {
+async function runDelete4(environmentId, options) {
   requireAppId(options.app);
   requireEnvId2(environmentId);
   const confirmed = await confirmDeletion(`environment ${environmentId}`, options.yes);
@@ -40361,11 +41068,11 @@ async function runDelete3(environmentId, options) {
     })
   );
   if (result.status !== NO_CONTENT_STATUS) {
-    failWriteOp3("delete", result.status, result.body, environmentId);
+    failWriteOp4("delete", result.status, result.body, environmentId);
   }
   console.log(colorSuccess(`Deleted environment ${environmentId}`));
 }
-function createCreateCommand3() {
+function createCreateCommand4() {
   return new Command("create").description("Create an environment for an application").argument("<name>", "Environment name (lowercase letters/digits/dashes)").requiredOption("--app <applicationId>", "Parent application UUID").requiredOption("--url <url>", "Primary URL for the environment").option("--description <text>", "Description").option("--production", "Mark as the production environment").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
@@ -40373,10 +41080,10 @@ Examples:
   tracecli environment create staging --app <appId> --url https://staging.acme.com
   tracecli environment create production --app <appId> --url https://acme.com --production`
   ).action(async (name, options) => {
-    await runCreate3(name, options);
+    await runCreate4(name, options);
   });
 }
-function createListCommand4() {
+function createListCommand5() {
   return new Command("list").description("List environments \u2014 an application's, or every one in the organization").option("--app <applicationId>", "Parent application UUID (omit to list the whole org)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").addHelpText(
     "after",
     `
@@ -40388,7 +41095,7 @@ Examples:
   tracecli environment list --app <appId>
   tracecli environment list --output tsv | cut -f2,3,4`
   ).action(async (options) => {
-    await runList3(options);
+    await runList4(options);
   });
 }
 function createGetCommand3() {
@@ -40407,18 +41114,18 @@ Examples:
     await runUpdate3(environmentId, options);
   });
 }
-function createDeleteCommand3() {
+function createDeleteCommand4() {
   return new Command("delete").description("Delete an environment").argument("<environmentId>", "Environment UUID").requiredOption("--app <applicationId>", "Parent application UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (environmentId, options) => {
-    await runDelete3(environmentId, options);
+    await runDelete4(environmentId, options);
   });
 }
 function createEnvironmentCommand() {
   const environment = new Command("environment").alias("env").description("Manage application environments");
-  environment.addCommand(createCreateCommand3());
-  environment.addCommand(createListCommand4());
+  environment.addCommand(createCreateCommand4());
+  environment.addCommand(createListCommand5());
   environment.addCommand(createGetCommand3());
   environment.addCommand(createUpdateCommand3());
-  environment.addCommand(createDeleteCommand3());
+  environment.addCommand(createDeleteCommand4());
   return environment;
 }
 
@@ -40450,7 +41157,223 @@ var CLI_PACKAGE_NAME = packageMetadata.name;
 var CLI_VERSION = packageMetadata.version;
 
 // src/pentest/commands.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
+
+// src/pentest/evidence.ts
+import { readFileSync as readFileSync4, statSync } from "fs";
+import { basename } from "path";
+
+// src/pentest/resolve.ts
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolvePentestId(organizationId, identifier) {
+  if (UUID_PATTERN2.test(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PT-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      `Invalid pentest identifier '${identifier}'. Use a display ID (e.g. PT-3) or UUID.`
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentest.listPentests({
+      params: { organizationId }
+    })
+  );
+  if (result.status === 401) {
+    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    process.exit(1);
+  }
+  if (result.status !== 200) {
+    console.error(`Failed to list pentests (status ${result.status}).`);
+    process.exit(1);
+  }
+  const pentest = result.body.find((p2) => p2.displayId === displayId);
+  if (!pentest) {
+    console.error(
+      `Pentest with display ID ${displayId} not found.
+Run \`tracecli pentest list\` to see available pentests.`
+    );
+    process.exit(1);
+  }
+  return pentest.pentestId;
+}
+
+// src/pentest/evidence.ts
+var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
+var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
+function isSection(value) {
+  return ValidationEvidenceSectionValues.includes(value);
+}
+function isKind(value) {
+  return PentestExploitArtifactKindValues.includes(value);
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function resolveFindingId(organizationId, pentestId, identifier) {
+  if (isUuid(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list findings (status ${result.status}).`));
+    process.exit(1);
+  }
+  const match = result.body.find((f) => f.displayId === displayId);
+  if (!match || !("pentestFindingId" in match)) {
+    console.error(
+      colorError(
+        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
+      )
+    );
+    process.exit(1);
+  }
+  return match.pentestFindingId;
+}
+async function runAttachEvidence(options) {
+  if (options.section !== void 0 && !isSection(options.section)) {
+    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
+    console.error(`Valid sections: ${SECTION_LIST}`);
+    process.exit(1);
+  }
+  if (options.kind !== void 0 && !isKind(options.kind)) {
+    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
+    console.error(`Valid kinds: ${KIND_LIST}`);
+    process.exit(1);
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync(options.file);
+    if (!stats.isFile()) {
+      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
+      process.exit(1);
+    }
+    sizeBytes = stats.size;
+  } catch {
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
+    process.exit(1);
+  }
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
+    process.exit(1);
+  }
+  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
+    console.error(
+      colorError(
+        `File is ${formatBytes(sizeBytes)}; the limit for one exhibit is ${formatBytes(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+  const params = { organizationId, pentestId, pentestFindingId };
+  const filename = basename(options.file);
+  const slot = await authenticatedRequest(
+    (client) => client.pentestFinding.createFindingEvidenceUpload({
+      params,
+      body: { filename, sizeBytes }
+    })
+  );
+  if (slot.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (slot.status !== 201) {
+    const { message } = readErrorFields(slot.body);
+    console.error(
+      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
+    );
+    process.exit(1);
+  }
+  const body = readFileSync4(options.file);
+  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  const attached = await authenticatedRequest(
+    (client) => client.pentestFinding.attachFindingEvidence({
+      params,
+      body: {
+        key: slot.body.key,
+        ...options.caption !== void 0 ? { caption: options.caption } : {},
+        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
+        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
+        ...options.customerFacing ? { customerFacing: true } : {}
+      }
+    })
+  );
+  if (attached.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (attached.status !== 201) {
+    const { message } = readErrorFields(attached.body);
+    console.error(
+      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    console.log(JSON.stringify(attached.body, null, 2));
+    return;
+  }
+  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
+  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
+  console.log(
+    colorSuccess(
+      `Attached ${attached.body.kind} \xB7 ${formatBytes(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+    )
+  );
+  console.log(`  artifact ${attached.body.artifactId}`);
+  if (attached.body.kind === "HAR") {
+    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
+  } else if (!attached.body.customerFacing) {
+    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  }
+}
+function createAttachEvidenceCommand() {
+  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+The file uploads straight to storage, so recordings of any reasonable size work.
+Videos and HAR captures always land staff-internal \u2014 publish a video with the
+toggle in the staff console's evidence panel after reviewing it for redaction.
+
+Examples:
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
+    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
+    --caption "Full member roster returned to a non-member" --customer-facing --output json`
+  ).action(async (options) => {
+    await runAttachEvidence(options);
+  });
+}
 
 // src/pentest/questionnaire.ts
 function buildUpsertQuestionnaireBody(answers) {
@@ -40533,9 +41456,9 @@ function formatAnswerValue(key, answers) {
   }
 }
 function formatQuestionnaireShow(input) {
-  const lines = [
-    `Editable: ${input.editable ? "yes (scoping window open)" : "no (editing closed after scoping)"}`
-  ];
+  const submitted = input.submitted === true;
+  const editableLine = input.editable ? "yes (scoping window open)" : submitted ? "no (submitted)" : "no (editing closed after scoping)";
+  const lines = [`Editable: ${editableLine}`, `Submitted: ${submitted ? "yes" : "no"}`];
   if (input.answers === null || Object.keys(input.answers).length === 0) {
     lines.push("Answers: (none)");
     return lines.join("\n");
@@ -40595,43 +41518,7 @@ function formatFindingSeverity(severity) {
       return severity;
   }
 }
-var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function resolvePentestId(organizationId, identifier) {
-  if (UUID_PATTERN2.test(identifier)) {
-    return identifier;
-  }
-  const numericMatch = identifier.match(/^(?:PT-)?(\d+)$/i);
-  if (!numericMatch?.[1]) {
-    console.error(
-      `Invalid pentest identifier '${identifier}'. Use a display ID (e.g. PT-3) or UUID.`
-    );
-    process.exit(1);
-  }
-  const displayId = Number.parseInt(numericMatch[1], 10);
-  const result = await authenticatedRequest(
-    (client) => client.pentest.listPentests({
-      params: { organizationId }
-    })
-  );
-  if (result.status === 401) {
-    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
-    process.exit(1);
-  }
-  if (result.status !== 200) {
-    console.error(`Failed to list pentests (status ${result.status}).`);
-    process.exit(1);
-  }
-  const pentest = result.body.find((p2) => p2.displayId === displayId);
-  if (!pentest) {
-    console.error(
-      `Pentest with display ID ${displayId} not found.
-Run \`tracecli pentest list\` to see available pentests.`
-    );
-    process.exit(1);
-  }
-  return pentest.pentestId;
-}
-function createListCommand5() {
+function createListCommand6() {
   return new Command("list").description("List pentests for your organization").option(
     "--status <status>",
     "Filter by status (SCOPING, IN_PROGRESS, REMEDIATION, CLOSED)",
@@ -40881,6 +41768,7 @@ function renderPentestFindingLines(finding) {
 function createFindingsCommand() {
   const findings = new Command("findings").description("Manage pentest findings");
   findings.addCommand(createFindingsListCommand());
+  findings.addCommand(createAttachEvidenceCommand());
   return findings;
 }
 var PRIORITY_SET = new Set(CustomerPriorityCategoryValues);
@@ -41151,7 +42039,7 @@ async function fetchQuestionnaire(organizationId, pentestId, notFoundLabel) {
   if (result.status !== SUCCESS_STATUS) {
     failQuestionnaire(result.status, result.body, "read", notFoundLabel);
   }
-  return result.body;
+  return toQuestionnaireGetBody(result.body);
 }
 async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabel) {
   const body = buildUpsertQuestionnaireBody(answers);
@@ -41164,7 +42052,35 @@ async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabe
   if (result.status !== SUCCESS_STATUS) {
     failQuestionnaire(result.status, result.body, "write", notFoundLabel);
   }
-  return result.body;
+  return toQuestionnaireGetBody(result.body);
+}
+async function submitQuestionnaire(organizationId, pentestId, answers, notFoundLabel) {
+  const result = await authenticatedRequest(
+    (client) => client.pentest.submitCustomerPentestQuestionnaire({
+      params: { organizationId, pentestId },
+      body: answers === void 0 ? {} : { answers }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failQuestionnaire(result.status, result.body, "write", notFoundLabel);
+  }
+  return toQuestionnaireGetBody(result.body);
+}
+function toQuestionnaireGetBody(body) {
+  return {
+    pentestId: body.pentestId,
+    editable: body.editable,
+    answers: body.answers,
+    updatedAt: body.updatedAt,
+    ...body.submittedAt !== void 0 ? { submittedAt: body.submittedAt } : {}
+  };
+}
+function questionnaireShowInput(body) {
+  return {
+    answers: body.answers,
+    editable: body.editable,
+    submitted: body.submittedAt != null
+  };
 }
 function exitCancelled() {
   me("Cancelled.");
@@ -41230,15 +42146,20 @@ async function promptQuestionnaireAnswers(existing) {
 async function runQuestionnaire(pentestIdentifier, options) {
   const show = options.show === true;
   const filePath = options.file;
+  const submit = options.submit === true;
   if (show && filePath !== void 0) {
     console.error(colorError("Pass only one of --show / --file."));
     process.exit(1);
   }
+  if (show && submit) {
+    console.error(colorError("Pass only one of --show / --submit."));
+    process.exit(1);
+  }
   const isInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  if (!show && filePath === void 0 && !isInteractiveTty) {
+  if (!show && filePath === void 0 && !submit && !isInteractiveTty) {
     console.error(
       colorError(
-        "Interactive questionnaire requires a TTY. Use --show to print answers, or --file <path> to upload an answers JSON object."
+        "Interactive questionnaire requires a TTY. Use --show to print answers, --file <path> to upload an answers JSON object, or --submit to freeze the current answers."
       )
     );
     process.exit(2);
@@ -41247,18 +42168,13 @@ async function runQuestionnaire(pentestIdentifier, options) {
   const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
   if (show) {
     const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
-    console.log(
-      formatQuestionnaireShow({
-        answers: current2.answers,
-        editable: current2.editable
-      })
-    );
+    console.log(formatQuestionnaireShow(questionnaireShowInput(current2)));
     return;
   }
   if (filePath !== void 0) {
     let raw;
     try {
-      raw = readFileSync4(filePath, "utf8");
+      raw = readFileSync5(filePath, "utf8");
     } catch {
       console.error(colorError(`Could not read answers file: ${filePath}`));
       process.exit(1);
@@ -41268,26 +42184,31 @@ async function runQuestionnaire(pentestIdentifier, options) {
       console.error(colorError(parsed.error));
       process.exit(1);
     }
-    const saved2 = await putQuestionnaire(
+    const saved2 = submit ? await submitQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier) : await putQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier);
+    console.log(
+      colorSuccess(
+        submit ? "Submitted questionnaire. Answers are locked." : "Saved questionnaire answers."
+      )
+    );
+    console.log(formatQuestionnaireShow(questionnaireShowInput(saved2)));
+    return;
+  }
+  if (submit) {
+    const submitted = await submitQuestionnaire(
       organizationId,
       pentestId,
-      parsed.answers,
+      void 0,
       pentestIdentifier
     );
-    console.log(colorSuccess("Saved questionnaire answers."));
-    console.log(
-      formatQuestionnaireShow({
-        answers: saved2.answers,
-        editable: saved2.editable
-      })
-    );
+    console.log(colorSuccess("Submitted questionnaire. Answers are locked."));
+    console.log(formatQuestionnaireShow(questionnaireShowInput(submitted)));
     return;
   }
   const current = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
   if (!current.editable) {
     console.error(
       colorError(
-        "Questionnaire editing is closed after scoping starts. Use --show to view the saved answers."
+        current.submittedAt != null ? "Questionnaire has already been submitted. Use --show to view the saved answers." : "Questionnaire editing is closed after scoping starts. Use --show to view the saved answers."
       )
     );
     process.exit(1);
@@ -41295,35 +42216,33 @@ async function runQuestionnaire(pentestIdentifier, options) {
   const merged = await promptQuestionnaireAnswers(current.answers);
   const saved = await putQuestionnaire(organizationId, pentestId, merged, pentestIdentifier);
   console.log(colorSuccess("Saved questionnaire answers."));
-  console.log(
-    formatQuestionnaireShow({
-      answers: saved.answers,
-      editable: saved.editable
-    })
-  );
+  console.log(formatQuestionnaireShow(questionnaireShowInput(saved)));
 }
 function createQuestionnaireCommand() {
   return new Command("questionnaire").description("View or fill the customer pentest intake questionnaire").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--show", "Print current answers using shared labels (GET)").option(
     "--file <path>",
     "Upload answers from a JSON file (answers object only \u2014 not { answers }; whole-object replace)"
-  ).addHelpText(
+  ).option("--submit", "Freeze the questionnaire after saving (or freeze the current answers)").addHelpText(
     "after",
     `
 Optional scoping questionnaire for a new pentest (editable while stage is DRAFT
-or READY_TO_START). Reads accept a browser session or API key; writes require an
-organization admin (or Trace staff) signed in via \`tracecli auth login\` \u2014 API
-keys are rejected.
+or READY_TO_START, until submitted). Reads accept a browser session or API key;
+writes require an organization admin (or Trace staff) signed in via \`tracecli
+auth login\` \u2014 API keys are rejected.
 
 Modes:
   --show          GET and print key: value with shared customer-facing labels
   --file <path>   PUT the file's answers object (CLI wraps { answers } for the API)
+  --submit        Freeze answers (combine with --file or TTY fill, or alone to freeze current)
   (TTY default)   load-merge-write: GET, prompt each question, confirm, PUT
 
-Non-interactive shells must pass --show or --file (exit 2 otherwise).
+Non-interactive shells must pass --show, --file, or --submit (exit 2 otherwise).
 
 Examples:
   tracecli pentest questionnaire PT-1 --show
   tracecli pentest questionnaire PT-1 --file answers.json
+  tracecli pentest questionnaire PT-1 --file answers.json --submit
+  tracecli pentest questionnaire PT-1 --submit
   tracecli pentest questionnaire PT-1`
   ).action(async (pentestId, options) => {
     await runQuestionnaire(pentestId, options);
@@ -41331,7 +42250,7 @@ Examples:
 }
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
-  pentest.addCommand(createListCommand5());
+  pentest.addCommand(createListCommand6());
   pentest.addCommand(createUpdateCommand4());
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
@@ -41339,7 +42258,7 @@ function createPentestCommand() {
 }
 
 // src/update/commands.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -41357,7 +42276,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync5(cachePath, "utf-8");
+    const rawCache = readFileSync6(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -41956,7 +42875,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand6() {
+function createListCommand7() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -42090,7 +43009,7 @@ Examples:
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
   vulnerabilities.addCommand(createGetCommand4());
-  vulnerabilities.addCommand(createListCommand6());
+  vulnerabilities.addCommand(createListCommand7());
   return vulnerabilities;
 }
 
@@ -42111,6 +43030,7 @@ program2.addCommand(createEnvironmentCommand());
 program2.addCommand(createCredentialCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());