securewithtrace 0.33.0 → 0.34.0

package/dist/index.js

@@ -23871,6 +23871,48 @@ var OrganizationCodeSizeResponseSchema = external_exports.object({
     languageCount: external_exports.number().int().nonnegative()
   })
 });
+var StaffCodeSizeRepositorySchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(CodeSizePlatformValues),
+  /** Resolved branch the measurement is keyed on (scanningBranch ?? default). */
+  branch: external_exports.string(),
+  /** null = no successful measurement for the current resolved branch. */
+  billableSloc: external_exports.number().int().nonnegative().nullable(),
+  /** null exactly when `billableSloc` is null. */
+  measuredAt: external_exports.iso.datetime().nullable()
+});
+var StaffOrganizationCodeSizeResponseSchema = external_exports.object({
+  /** Same server-side sort as the customer wire: measured first by
+   *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
+   *  repositoryUrl asc. */
+  repositories: external_exports.array(StaffCodeSizeRepositorySchema),
+  // No language breakdown here on purpose: this panel answers "is every
+  // repository measured, and how fresh", and the language view already exists
+  // on the customer panel staff can impersonate into.
+  totals: external_exports.object({
+    billableSloc: external_exports.number().int().nonnegative(),
+    rawLines: external_exports.number().int().nonnegative(),
+    /** Connected GitHub/Bitbucket repos — the re-measure `all` scope size. */
+    repositoryCount: external_exports.number().int().nonnegative(),
+    /** Repos with a measurement for their current resolved branch. */
+    measuredCount: external_exports.number().int().nonnegative(),
+    /** Newest measuredAt across the org; null when nothing is measured. */
+    lastMeasuredAt: external_exports.iso.datetime().nullable()
+  })
+});
+var StaffCodeSizeRemeasureScopeValues = ["all", "unmeasured"];
+var StaffCodeSizeRemeasureRequestSchema = external_exports.object({
+  scope: external_exports.enum(StaffCodeSizeRemeasureScopeValues)
+});
+var StaffCodeSizeRemeasureResponseSchema = external_exports.object({
+  scope: external_exports.enum(StaffCodeSizeRemeasureScopeValues),
+  /** Repos the scope selected. */
+  requested: external_exports.number().int().nonnegative(),
+  /** Messages SQS accepted. Lower than `requested` means a partial send —
+   *  reported rather than masked (the panel states this number). */
+  enqueued: external_exports.number().int().nonnegative()
+});
 
 // ../../packages/api-contracts/src/contracts/v1/code-size.ts
 var c8 = initContract();
@@ -23886,6 +23928,36 @@ var codeSizeContract = c8.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  // Staff-only: per-repo measurement freshness for the admin Controls panel.
+  getStaffOrganizationCodeSize: {
+    method: "GET",
+    path: "/staff/organizations/:organizationId/code-size",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: StaffOrganizationCodeSizeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Staff-only: enqueue measurements for the scoped repos. Enqueue-only — the
+  // worker measures asynchronously, so a 200 means "requested", not "measured".
+  remeasureStaffOrganizationCodeSize: {
+    method: "POST",
+    path: "/staff/organizations/:organizationId/code-size/re-measure",
+    pathParams: OrgIdParamsSchema,
+    body: StaffCodeSizeRemeasureRequestSchema,
+    responses: {
+      200: StaffCodeSizeRemeasureResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
+      503: ErrorResponseSchema
+    }
   }
 });
 
@@ -27287,11 +27359,19 @@ var CustomerPentestDetailResponseSchema = CustomerPentestResponseSchema.extend({
    * GET …/questionnaire. `.optional()` for rolling-deploy safety.
    */
   questionnaireEditable: external_exports.boolean().optional(),
-  hasQuestionnaireAnswers: external_exports.boolean().optional()
+  hasQuestionnaireAnswers: external_exports.boolean().optional(),
+  /**
+   * True once the customer has submitted the questionnaire (frozen). Optional
+   * for rolling-deploy safety against an older API that does not send it.
+   */
+  questionnaireSubmitted: external_exports.boolean().optional()
 });
 var CustomerPentestQuestionnaireResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
-  /** True iff currentStage ∈ SCOPING_PENTEST_STAGES (DRAFT | READY_TO_START). */
+  /**
+   * True iff the engagement is still in a scoping stage AND the questionnaire
+   * has not been submitted. A submitted intake is frozen even during scoping.
+   */
   editable: external_exports.boolean(),
   /**
    * Lenient on unknown keys: during a rolling deploy the dashboard runs against
@@ -27300,7 +27380,13 @@ var CustomerPentestQuestionnaireResponseSchema = external_exports.object({
    * strict — see the upsert request below.
    */
   answers: PentestCustomerIntakeStoredAnswersSchema.nullable(),
-  updatedAt: external_exports.coerce.date()
+  updatedAt: external_exports.coerce.date(),
+  /**
+   * When the customer submitted (froze) the questionnaire. Null = still a
+   * draft. Optional so an older API response still parses during a rolling
+   * deploy; absence means "not submitted" to new clients.
+   */
+  submittedAt: external_exports.coerce.date().nullable().optional()
 });
 var UpsertCustomerPentestQuestionnaireRequestSchema = external_exports.object({
   /**
@@ -27310,6 +27396,14 @@ var UpsertCustomerPentestQuestionnaireRequestSchema = external_exports.object({
    */
   answers: PentestCustomerIntakeWriteAnswersSchema.nullable()
 }).strict();
+var SubmitCustomerPentestQuestionnaireRequestSchema = external_exports.object({
+  /**
+   * Optional last draft to persist atomically with the freeze. Omitted keeps
+   * whatever is already stored. Retired keys are accepted and dropped, same
+   * as the upsert path.
+   */
+  answers: PentestCustomerIntakeWriteAnswersSchema.optional()
+}).strict();
 var ReadPentestResponseSchema = external_exports.union([
   PentestDetailResponseSchema,
   CustomerPentestShellResponseSchema
@@ -27525,6 +27619,21 @@ var pentestContract = c22.router({
       500: ErrorResponseSchema
     }
   },
+  submitCustomerPentestQuestionnaire: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/submit",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: SubmitCustomerPentestQuestionnaireRequestSchema,
+    responses: {
+      200: CustomerPentestQuestionnaireResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   createPentest: {
     method: "POST",
     path: "/organizations/:organizationId/pentests",
@@ -29074,6 +29183,25 @@ var CurateFindingEvidenceRequestSchema = external_exports.object({
 }).strict().refine((v2) => Object.keys(v2).length > 0, {
   message: "At least one curation field must be provided"
 });
+var MAX_STAFF_EVIDENCE_UPLOAD_BYTES = 256 * 1024 * 1024;
+var CreateFindingEvidenceUploadRequestSchema = external_exports.object({
+  filename: external_exports.string().min(1).max(255),
+  sizeBytes: external_exports.number().int().positive().max(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)
+}).strict();
+var CreateFindingEvidenceUploadResponseSchema = external_exports.object({
+  key: external_exports.string(),
+  uploadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date(),
+  kind: PentestExploitArtifactKind,
+  mimeType: external_exports.string()
+});
+var AttachFindingEvidenceRequestSchema = external_exports.object({
+  key: external_exports.string().min(1).max(1024),
+  kind: PentestExploitArtifactKind.optional(),
+  caption: external_exports.string().min(1).max(500).optional(),
+  section: ValidationEvidenceSection.optional(),
+  customerFacing: external_exports.boolean().optional()
+}).strict();
 var PentestFindingRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryName: external_exports.string(),
@@ -29680,6 +29808,43 @@ var pentestFindingContract = c28.router({
       500: ErrorResponseSchema
     }
   },
+  // ─── Evidence (staff manual attach) ───
+  //
+  // Two calls, because the bytes never pass through the api: mint a presigned
+  // PUT, upload straight to S3, then register the object as an exhibit. That
+  // keeps a screen-recorded PoC off the request path entirely (no body limit, no
+  // request timeout, no api memory) and mirrors how the operator agent session
+  // already attaches evidence.
+  createFindingEvidenceUpload: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence/uploads",
+    pathParams: PentestFindingIdParamsSchema,
+    body: CreateFindingEvidenceUploadRequestSchema,
+    responses: {
+      201: CreateFindingEvidenceUploadResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  attachFindingEvidence: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence",
+    pathParams: PentestFindingIdParamsSchema,
+    body: AttachFindingEvidenceRequestSchema,
+    responses: {
+      201: PentestExploitArtifactMetadataResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   curateFindingEvidence: {
     method: "PATCH",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/evidence/:artifactId",
@@ -30060,6 +30225,12 @@ var PentestHypothesisAttemptSummarySchema = external_exports.object({
   status: PentestHypothesisAttemptStatus,
   attemptOrdinal: external_exports.number().int().positive(),
   conclusion: external_exports.string().nullable(),
+  // Optional for rolling-deploy safety: web (Vercel) can deploy this schema before the
+  // API sends the field, and web strictly `.parse()`s the response. Absent → undefined,
+  // which the web serializer coalesces to null. Carries the Blocked/Failed reason so the
+  // hypothesis drawer's verdict panel can show it when the deciding attempt is only in
+  // hand as this summary (a verdict from a prior run).
+  blockerReason: external_exports.string().nullable().optional(),
   startedAt: external_exports.coerce.date().nullable(),
   completedAt: external_exports.coerce.date().nullable(),
   durationMs: external_exports.number().int().nonnegative().nullable(),
@@ -38860,6 +39031,194 @@ function showBanner() {
 `);
 }
 
+// src/code-size/format.ts
+function formatCount(value) {
+  return value.toLocaleString("en-US");
+}
+function repoDisplayName(repositoryUrl) {
+  try {
+    const path = new URL(repositoryUrl).pathname.replace(/^\//, "").replace(/\.git$/, "");
+    return path || repositoryUrl;
+  } catch {
+    return repositoryUrl;
+  }
+}
+function countedRows(totals) {
+  const b2 = totals.buckets;
+  return [
+    { label: "Billable code", value: b2.code.code },
+    { label: "Blank & comment lines in billable files", value: b2.code.lines - b2.code.code },
+    { label: "Tests", value: b2.tests.lines },
+    { label: "Documentation", value: b2.docs.lines },
+    { label: "Configuration & data", value: b2.config_data.lines },
+    { label: "Vendored & generated", value: b2.vendored_generated.lines }
+  ];
+}
+function countedTotal(totals) {
+  return countedRows(totals).reduce((sum, row) => sum + row.value, 0);
+}
+function padValues(rows) {
+  const formatted = rows.map((row) => formatCount(row.value));
+  const labelWidth = Math.max(...rows.map((row) => row.label.length));
+  const valueWidth = Math.max(...formatted.map((value) => value.length));
+  return rows.map(
+    (row, i) => `  ${row.label.padEnd(labelWidth)}  ${(formatted[i] ?? "").padStart(valueWidth)}`
+  );
+}
+function renderCodeSizeTable(codeSize, options) {
+  const { repositories, totals } = codeSize;
+  const measured = repositories.filter((repo) => repo.billableSloc !== null);
+  const lines = [`Code size for ${options.orgSlug}`, ""];
+  if (measured.length === 0) {
+    lines.push(
+      "  No measurements yet.",
+      `  ${formatCount(repositories.length)} connected ${plural(repositories.length, "repository has", "repositories have")} not been measured.`
+    );
+    return lines;
+  }
+  lines.push(
+    `  ${formatCount(totals.billableSloc)} billable SLOC`,
+    `  of ${formatCount(totals.rawLines)} total lines across ${formatCount(measured.length)} measured ${plural(measured.length, "repository", "repositories")}`
+  );
+  const unmeasured = repositories.length - measured.length;
+  if (unmeasured > 0) {
+    lines.push(
+      `  ${formatCount(unmeasured)} connected ${plural(unmeasured, "repository is", "repositories are")} not measured yet and not included`
+    );
+  }
+  lines.push("", "What's counted", ...padValues(countedRows(totals)));
+  const counted = countedTotal(totals);
+  if (counted !== totals.rawLines) {
+    lines.push(
+      `  These sum to ${formatCount(counted)}, not the ${formatCount(totals.rawLines)} above.`,
+      "  Some measurement predates the current counting rules; re-measure to reconcile."
+    );
+  }
+  lines.push("", "By repository");
+  const shown = measured.slice(0, options.repoLimit);
+  lines.push(
+    ...padValues(
+      shown.map((repo) => ({
+        label: repoDisplayName(repo.repositoryUrl),
+        value: repo.billableSloc ?? 0
+      }))
+    )
+  );
+  const hidden = measured.length - shown.length;
+  if (hidden > 0) {
+    lines.push(`  ... ${formatCount(hidden)} more`);
+  }
+  return lines;
+}
+function renderCodeSizeTsv(codeSize) {
+  return [
+    "repository	billableSloc",
+    ...codeSize.repositories.map(
+      (repo) => `${repoDisplayName(repo.repositoryUrl)}	${repo.billableSloc === null ? "" : repo.billableSloc}`
+    )
+  ];
+}
+function plural(count, one, many) {
+  return count === 1 ? one : many;
+}
+
+// src/code-size/commands.ts
+var DEFAULT_REPO_LIMIT = 20;
+var OUTPUT_FORMATS = ["table", "json", "tsv"];
+function isOutputFormat(value) {
+  return OUTPUT_FORMATS.includes(value);
+}
+function parseRepoLimit(value) {
+  if (!/^\d+$/.test(value.trim())) {
+    console.error("--repos must be a non-negative whole number (0 shows every repository).");
+    process.exit(1);
+  }
+  return Number.parseInt(value, 10);
+}
+function createCodeSizeCommand() {
+  return new Command("code-size").description("Show the organization's billable lines of code").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
+    "-n, --repos <count>",
+    `Per-repository rows to show in table output (default: ${DEFAULT_REPO_LIMIT}, 0 for all)`,
+    parseRepoLimit
+  ).option("-w, --web", "Open the code size panel in a browser").addHelpText(
+    "after",
+    `
+Billable SLOC is counted from each connected repository's current scanning
+branch. Blanks, comments, tests, docs, config and vendored code are excluded;
+"What's counted" reconciles the billable number to what plain scc reports.
+See ${getAppBaseUrl()}/docs/integrations/code-size
+
+Examples:
+  tracecli code-size
+  tracecli code-size --repos 0
+  tracecli code-size --output json | jq '.totals.billableSloc'
+  tracecli code-size --output tsv | cut -f1,2
+  tracecli code-size --web`
+  ).action(async (options) => {
+    if (!isOutputFormat(options.output)) {
+      console.error(
+        `Unsupported --output '${options.output}'. Expected one of: ${OUTPUT_FORMATS.join(", ")}.`
+      );
+      process.exit(1);
+    }
+    const listed = await authenticatedRequest(
+      (client) => client.organization.listMyOrganizations()
+    );
+    if (listed.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (listed.status !== 200) {
+      console.error(`Failed to resolve organization (status ${listed.status}).`);
+      process.exit(1);
+    }
+    const resolution = determineActiveOrganization(
+      listed.body,
+      readSelectedOrganizationId(),
+      extractOrganizationIdFromToken(readToken())
+    );
+    if (!resolution) {
+      console.error("No organization found for your account.");
+      process.exit(1);
+    }
+    const { organizationId, slug } = resolution.organization;
+    if (options.web) {
+      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/github`;
+      const opened = await openBrowser(url2);
+      if (!opened) {
+        console.log(`Open in browser: ${url2}`);
+      }
+      return;
+    }
+    const result = await authenticatedRequest(
+      (client) => client.codeSize.getOrganizationCodeSize({ params: { organizationId } })
+    );
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (result.status !== 200) {
+      console.error(`Failed to read code size (status ${result.status}).`);
+      process.exit(1);
+    }
+    const codeSize = result.body;
+    if (options.output === "json") {
+      console.log(JSON.stringify(codeSize, null, 2));
+      return;
+    }
+    if (options.output === "tsv") {
+      for (const line of renderCodeSizeTsv(codeSize)) {
+        console.log(line);
+      }
+      return;
+    }
+    const repoLimit = options.repos === void 0 ? DEFAULT_REPO_LIMIT : options.repos === 0 ? Number.POSITIVE_INFINITY : options.repos;
+    for (const line of renderCodeSizeTable(codeSize, { orgSlug: slug, repoLimit })) {
+      console.log(line);
+    }
+  });
+}
+
 // src/completion/index.ts
 function extractCommandTree(cmd) {
   const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
@@ -39231,73 +39590,318 @@ Examples:
   });
 }
 
-// src/secret-input.ts
-import { readFileSync as readFileSync2 } from "fs";
-var SecretInputError = class extends Error {
-};
-function secretSourceCount(opts) {
-  return [opts.stdin === true, opts.file !== void 0, opts.env !== void 0].filter(Boolean).length;
-}
-function usesStdin(opts) {
-  return opts.stdin === true;
+// src/inbox/commands.ts
+function validateInboxLabel(label) {
+  const parsed = InboxLabelSchema.safeParse(label);
+  if (parsed.success) {
+    return null;
+  }
+  return "Inbox label must be lowercase letters, digits, or dashes, starting with a letter (max 40 characters).";
 }
-function stripTrailingNewline(value) {
-  return value.replace(/\r?\n$/, "");
+function buildCreateInboxBody(label) {
+  return { label };
 }
-async function defaultReadStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
+function failWriteOp2(action, status, body, notFoundLabel) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
   }
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function resolveSecret(label, flagBase, opts, readStdin = defaultReadStdin) {
-  if (secretSourceCount(opts) > 1) {
-    throw new SecretInputError(
-      `Provide only one source for ${label} (--${flagBase}-stdin / --${flagBase}-file / --${flagBase}-env).`
+  if (status === 403) {
+    console.error(
+      colorError(
+        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} inboxes.`
+      )
     );
+    process.exit(1);
   }
-  if (opts.stdin === true) {
-    const value = stripTrailingNewline(await readStdin());
-    if (value.length === 0) {
-      throw new SecretInputError(`No ${label} received on stdin.`);
-    }
-    return value;
+  if (status === 404) {
+    console.error(
+      colorError(message ?? (notFoundLabel ? `No inbox labeled '${notFoundLabel}'.` : "Not found."))
+    );
+    process.exit(1);
   }
-  if (opts.file !== void 0) {
-    let contents;
-    try {
-      contents = readFileSync2(opts.file, "utf8");
-    } catch {
-      throw new SecretInputError(`Could not read ${label} file: ${opts.file}`);
-    }
-    const value = stripTrailingNewline(contents);
-    if (value.length === 0) {
-      throw new SecretInputError(`${label} file is empty: ${opts.file}`);
-    }
-    return value;
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
   }
-  if (opts.env !== void 0) {
-    const value = process.env[opts.env];
-    if (value === void 0 || value.length === 0) {
-      throw new SecretInputError(
-        `Environment variable ${opts.env} for ${label} is unset or empty.`
+  if (status === 409) {
+    if (errorCode === "INBOX_ALREADY_EXISTS") {
+      console.error(
+        colorError(message ?? "An inbox with this label already exists in this organization.")
+      );
+    } else if (errorCode === "INBOX_BEING_DELETED") {
+      console.error(
+        colorError(
+          message ?? "That name was recently removed and is still being cleaned up. Try again shortly, or choose another."
+        )
+      );
+    } else if (errorCode === "INBOX_QUOTA_EXCEEDED") {
+      console.error(
+        colorError(message ?? "Inbox limit reached. Delete an unused inbox to create a new one.")
       );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
     }
-    return value;
+    process.exit(1);
   }
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new SecretInputError(
-      `No source for ${label}. Use --${flagBase}-stdin, --${flagBase}-file, or --${flagBase}-env (or run interactively to be prompted).`
+  if (status === 503) {
+    console.error(
+      colorError(
+        message ?? "Managed inboxes are not enabled on this server: no mail provider is configured."
+      )
     );
+    process.exit(1);
   }
-  const entered = await Ce({ message: `Enter ${label}:` });
-  if (q(entered) || typeof entered !== "string" || entered.length === 0) {
-    throw new SecretInputError(`${label} entry was cancelled or empty.`);
-  }
-  return entered;
+  console.error(
+    colorError(`Failed to ${action} inbox (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
 }
-
+function failReadOp2(status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(colorError("You don't have access to view inboxes in this organization."));
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(
+        message ?? "Managed inboxes are not enabled on this server: no mail provider is configured."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to list inboxes (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function renderInboxDetail(inbox) {
+  const pad = 10;
+  return [
+    `${"Address:".padEnd(pad)} ${sanitizeDisplay(inbox.address)}`,
+    `${"Label:".padEnd(pad)} ${sanitizeDisplay(inbox.label)}`,
+    `${"Created:".padEnd(pad)} ${formatDate(inbox.createdAt)}`
+  ].join("\n");
+}
+function printInboxesTsv(inboxes) {
+  console.log(["address", "label", "createdAt"].join("	"));
+  for (const inbox of inboxes) {
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(inbox.address)),
+        tsvSafe(sanitizeDisplay(inbox.label)),
+        tsvSafe(toIso(inbox.createdAt))
+      ].join("	")
+    );
+  }
+}
+function buildInboxesTable(inboxes) {
+  const cells = inboxes.map((inbox) => ({
+    address: sanitizeDisplay(inbox.address),
+    label: sanitizeDisplay(inbox.label)
+  }));
+  const addressWidth = Math.max(7, ...cells.map((c51) => c51.address.length));
+  const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
+  const rows = cells.map((c51) => `${c51.address.padEnd(addressWidth)}  ${c51.label}`);
+  return { header, rows };
+}
+function formatInboxQuota(quota) {
+  return `${quota.used} of ${quota.limit} inboxes`;
+}
+function outputInbox(inbox, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(inbox, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printInboxesTsv([inbox]);
+    return;
+  }
+  console.log(renderInboxDetail(inbox));
+}
+function requireInboxLabel(label) {
+  const error48 = validateInboxLabel(label);
+  if (error48) {
+    console.error(colorError(error48));
+    process.exit(1);
+  }
+}
+async function runCreate2(label, options) {
+  const output = parseOutput(options.output);
+  requireInboxLabel(label);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.createInbox({
+      params: { organizationId },
+      body: buildCreateInboxBody(label)
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failWriteOp2("create", result.status, result.body);
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Created inbox ${sanitizeDisplay(result.body.address)}`));
+  }
+  outputInbox(result.body, output);
+}
+async function runList2(options) {
+  const output = parseOutput(options.output);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.listInboxes({ params: { organizationId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp2(result.status, result.body);
+  }
+  const { inboxes, quota } = result.body;
+  if (output === "json") {
+    console.log(JSON.stringify({ inboxes, quota }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printInboxesTsv(inboxes);
+    return;
+  }
+  if (inboxes.length === 0) {
+    console.log(`No inboxes found. ${formatInboxQuota(quota)}.`);
+    return;
+  }
+  const { header, rows } = buildInboxesTable(inboxes);
+  await runInteractivePager({
+    items: inboxes,
+    header,
+    renderItem: (_inbox, i) => [rows[i] ?? ""],
+    disabled: options.pager === false
+  });
+  console.log(formatInboxQuota(quota));
+}
+async function runDelete2(label, options) {
+  requireInboxLabel(label);
+  const confirmed = await confirmDeletion(`inbox ${label}`, options.yes);
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.inbox.deleteInbox({
+      params: { organizationId, label }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failWriteOp2("delete", result.status, result.body, label);
+  }
+  console.log(colorSuccess(`Deleted inbox ${sanitizeDisplay(label)}`));
+}
+function createCreateCommand2() {
+  return new Command("create").description("Provision a Trace-hosted email inbox").argument("<label>", "Inbox name (lowercase letters/digits/dashes, max 40)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Trace hosts this inbox; the pentest agent reads its emails automatically.
+The minted address is {org-slug}-{label}@pentest.securewithtrace.com.
+
+Use the printed address as the test-account email when creating a magic-auth
+or username-password credential.
+
+Examples:
+  tracecli credential inbox create portal
+  ADDRESS=$(tracecli credential inbox create qa-admin -o json | jq -r .address)
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
+  ).action(async (label, options) => {
+    await runCreate2(label, options);
+  });
+}
+function createListCommand3() {
+  return new Command("list").description("List Trace-hosted email inboxes in the active organization").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").action(async (options) => {
+    await runList2(options);
+  });
+}
+function createDeleteCommand2() {
+  return new Command("delete").description("Delete a Trace-hosted email inbox").argument("<label>", "Inbox label").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (label, options) => {
+    await runDelete2(label, options);
+  });
+}
+function createInboxCommand() {
+  const inbox = new Command("inbox").description(
+    "Provision Trace-hosted email inboxes for test-account credentials"
+  );
+  inbox.addCommand(createCreateCommand2());
+  inbox.addCommand(createListCommand3());
+  inbox.addCommand(createDeleteCommand2());
+  return inbox;
+}
+
+// src/secret-input.ts
+import { readFileSync as readFileSync2 } from "fs";
+var SecretInputError = class extends Error {
+};
+function secretSourceCount(opts) {
+  return [opts.stdin === true, opts.file !== void 0, opts.env !== void 0].filter(Boolean).length;
+}
+function usesStdin(opts) {
+  return opts.stdin === true;
+}
+function stripTrailingNewline(value) {
+  return value.replace(/\r?\n$/, "");
+}
+async function defaultReadStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function resolveSecret(label, flagBase, opts, readStdin = defaultReadStdin) {
+  if (secretSourceCount(opts) > 1) {
+    throw new SecretInputError(
+      `Provide only one source for ${label} (--${flagBase}-stdin / --${flagBase}-file / --${flagBase}-env).`
+    );
+  }
+  if (opts.stdin === true) {
+    const value = stripTrailingNewline(await readStdin());
+    if (value.length === 0) {
+      throw new SecretInputError(`No ${label} received on stdin.`);
+    }
+    return value;
+  }
+  if (opts.file !== void 0) {
+    let contents;
+    try {
+      contents = readFileSync2(opts.file, "utf8");
+    } catch {
+      throw new SecretInputError(`Could not read ${label} file: ${opts.file}`);
+    }
+    const value = stripTrailingNewline(contents);
+    if (value.length === 0) {
+      throw new SecretInputError(`${label} file is empty: ${opts.file}`);
+    }
+    return value;
+  }
+  if (opts.env !== void 0) {
+    const value = process.env[opts.env];
+    if (value === void 0 || value.length === 0) {
+      throw new SecretInputError(
+        `Environment variable ${opts.env} for ${label} is unset or empty.`
+      );
+    }
+    return value;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new SecretInputError(
+      `No source for ${label}. Use --${flagBase}-stdin, --${flagBase}-file, or --${flagBase}-env (or run interactively to be prompted).`
+    );
+  }
+  const entered = await Ce({ message: `Enter ${label}:` });
+  if (q(entered) || typeof entered !== "string" || entered.length === 0) {
+    throw new SecretInputError(`${label} entry was cancelled or empty.`);
+  }
+  return entered;
+}
+
 // src/credential/commands.ts
 var CREDENTIAL_TYPE_BY_INPUT = {
   "bearer-token": "BEARER_TOKEN",
@@ -39523,7 +40127,7 @@ function usernameOpts(opts) {
 function passwordOpts(opts) {
   return { stdin: opts.passwordStdin, file: opts.passwordFile, env: opts.passwordEnv };
 }
-function failWriteOp2(action, status, body, notFoundLabel) {
+function failWriteOp3(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -39567,7 +40171,7 @@ function failWriteOp2(action, status, body, notFoundLabel) {
   );
   process.exit(1);
 }
-function failReadOp2(action, status, body, notFoundLabel) {
+function failReadOp3(action, status, body, notFoundLabel) {
   const { message } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -39659,7 +40263,7 @@ function failAuthBuild(result) {
   console.error(colorError(result.error));
   process.exit(1);
 }
-async function runCreate2(options) {
+async function runCreate3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   const type = normalizeCredentialType(options.type);
@@ -39699,7 +40303,7 @@ async function runCreate2(options) {
     (client) => client.credential.createCredential({ params, body })
   );
   if (result.status !== CREATED_STATUS) {
-    failWriteOp2("create", result.status, result.body);
+    failWriteOp3("create", result.status, result.body);
   }
   if (output === "table") {
     console.log(colorSuccess(`Created credential ${sanitizeDisplay(result.body.label)}`));
@@ -39791,7 +40395,7 @@ async function buildCreateBody(type, label, options) {
     }
   }
 }
-async function runList2(options) {
+async function runList3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   const organizationId = await resolveOrganizationId();
@@ -39799,7 +40403,7 @@ async function runList2(options) {
     (client) => client.credential.listCredentials({ params: { organizationId, environmentId: options.env } })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp2("list credentials", result.status, result.body, options.env);
+    failReadOp3("list credentials", result.status, result.body, options.env);
   }
   const creds = result.body;
   if (output === "json") {
@@ -39833,7 +40437,7 @@ async function runGet2(credentialId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp2("get credential", result.status, result.body, credentialId);
+    failReadOp3("get credential", result.status, result.body, credentialId);
   }
   outputCredential(result.body, output);
 }
@@ -39867,7 +40471,7 @@ async function runUpdate2(credentialId, options) {
       (client) => client.credential.getCredential({ params })
     );
     if (current.status !== SUCCESS_STATUS) {
-      failReadOp2("get credential", current.status, current.body, credentialId);
+      failReadOp3("get credential", current.status, current.body, credentialId);
     }
     const type = current.body.credentialType;
     const foreign = rejectForeignAuthFlags(type, options);
@@ -39900,14 +40504,14 @@ async function runUpdate2(credentialId, options) {
     (client) => client.credential.updateCredential({ params, body })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failWriteOp2("update", result.status, result.body, credentialId);
+    failWriteOp3("update", result.status, result.body, credentialId);
   }
   if (output === "table") {
     console.log(colorSuccess(`Updated credential ${sanitizeDisplay(result.body.label)}`));
   }
   outputCredential(result.body, output);
 }
-async function runDelete2(credentialId, options) {
+async function runDelete3(credentialId, options) {
   requireEnvId(options.env);
   requireCredId(credentialId);
   const confirmed = await confirmDeletion(`credential ${credentialId}`, options.yes);
@@ -39922,7 +40526,7 @@ async function runDelete2(credentialId, options) {
     })
   );
   if (result.status !== NO_CONTENT_STATUS) {
-    failWriteOp2("delete", result.status, result.body, credentialId);
+    failWriteOp3("delete", result.status, result.body, credentialId);
   }
   console.log(colorSuccess(`Deleted credential ${credentialId}`));
 }
@@ -39932,7 +40536,7 @@ function addSecretInputOptions(command) {
 function addAuthConfigOptions(command) {
   return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)");
 }
-function createCreateCommand2() {
+function createCreateCommand3() {
   const command = new Command("create").description("Create a credential in an environment").requiredOption("--env <environmentId>", "Parent environment UUID").requiredOption(
     "--type <type>",
     "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth"
@@ -39950,15 +40554,17 @@ Secrets are read from stdin/file/env (or a no-echo prompt) \u2014 never an inlin
 Examples:
   vault read -field=token secret/x | tracecli credential create --env <envId> --type bearer-token --secret-stdin
   tracecli credential create --env <envId> --type api-key --label "prod key" --secret-env API_KEY --placement header --key-name X-API-Key
-  tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login`
+  tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login
+  ADDRESS=$(tracecli credential inbox create portal -o json | jq -r .address)
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
   );
   return command.action(async (options) => {
-    await runCreate2(options);
+    await runCreate3(options);
   });
 }
-function createListCommand3() {
+function createListCommand4() {
   return new Command("list").description("List an environment's credentials (secrets are never shown)").requiredOption("--env <environmentId>", "Parent environment UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").action(async (options) => {
-    await runList2(options);
+    await runList3(options);
   });
 }
 function createGetCommand2() {
@@ -39984,18 +40590,19 @@ Examples:
     await runUpdate2(credentialId, options);
   });
 }
-function createDeleteCommand2() {
+function createDeleteCommand3() {
   return new Command("delete").description("Delete a credential").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Parent environment UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (credentialId, options) => {
-    await runDelete2(credentialId, options);
+    await runDelete3(credentialId, options);
   });
 }
 function createCredentialCommand() {
   const credential = new Command("credential").alias("cred").description("Manage environment credentials");
-  credential.addCommand(createCreateCommand2());
-  credential.addCommand(createListCommand3());
+  credential.addCommand(createCreateCommand3());
+  credential.addCommand(createListCommand4());
   credential.addCommand(createGetCommand2());
   credential.addCommand(createUpdateCommand2());
-  credential.addCommand(createDeleteCommand2());
+  credential.addCommand(createDeleteCommand3());
+  credential.addCommand(createInboxCommand());
   return credential;
 }
 
@@ -40038,7 +40645,7 @@ function resolveProductionFlag(input) {
   }
   return { value: void 0 };
 }
-function failWriteOp3(action, status, body, notFoundLabel) {
+function failWriteOp4(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -40086,7 +40693,7 @@ function failWriteOp3(action, status, body, notFoundLabel) {
   );
   process.exit(1);
 }
-function failReadOp3(action, status, body, notFoundLabel) {
+function failReadOp4(action, status, body, notFoundLabel) {
   const { message } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -40227,7 +40834,7 @@ function requireEnvId2(environmentId) {
     process.exit(1);
   }
 }
-async function runCreate3(name, options) {
+async function runCreate4(name, options) {
   const output = parseOutput(options.output);
   requireAppId(options.app);
   const nameError = validateEnvName(name);
@@ -40249,7 +40856,7 @@ async function runCreate3(name, options) {
     })
   );
   if (result.status !== CREATED_STATUS) {
-    failWriteOp3("create", result.status, result.body);
+    failWriteOp4("create", result.status, result.body);
   }
   if (output === "table") {
     console.log(colorSuccess(`Created environment ${sanitizeDisplay(result.body.name)}`));
@@ -40276,7 +40883,7 @@ function createOrgEnvironmentRequests(organizationId) {
 async function collectOrgEnvironments(requests) {
   const appsResult = await requests.listApplications();
   if (!appsResult.ok) {
-    failReadOp3("list applications", appsResult.status, appsResult.body);
+    failReadOp4("list applications", appsResult.status, appsResult.body);
   }
   const apps = appsResult.data;
   const environments = [];
@@ -40348,7 +40955,7 @@ async function runListAcrossOrganization(output, pager) {
     disabled: pager === false
   });
 }
-async function runList3(options) {
+async function runList4(options) {
   const output = parseOutput(options.output);
   if (options.app === void 0) {
     await runListAcrossOrganization(output, options.pager);
@@ -40363,7 +40970,7 @@ async function runList3(options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp3("list environments", result.status, result.body, applicationId);
+    failReadOp4("list environments", result.status, result.body, applicationId);
   }
   const envs = result.body;
   if (output === "json") {
@@ -40397,7 +41004,7 @@ async function runGet3(environmentId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failReadOp3("get environment", result.status, result.body, environmentId);
+    failReadOp4("get environment", result.status, result.body, environmentId);
   }
   outputEnvironment(result.body, output);
 }
@@ -40439,14 +41046,14 @@ async function runUpdate3(environmentId, options) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failWriteOp3("update", result.status, result.body, environmentId);
+    failWriteOp4("update", result.status, result.body, environmentId);
   }
   if (output === "table") {
     console.log(colorSuccess(`Updated environment ${sanitizeDisplay(result.body.name)}`));
   }
   outputEnvironment(result.body, output);
 }
-async function runDelete3(environmentId, options) {
+async function runDelete4(environmentId, options) {
   requireAppId(options.app);
   requireEnvId2(environmentId);
   const confirmed = await confirmDeletion(`environment ${environmentId}`, options.yes);
@@ -40461,11 +41068,11 @@ async function runDelete3(environmentId, options) {
     })
   );
   if (result.status !== NO_CONTENT_STATUS) {
-    failWriteOp3("delete", result.status, result.body, environmentId);
+    failWriteOp4("delete", result.status, result.body, environmentId);
   }
   console.log(colorSuccess(`Deleted environment ${environmentId}`));
 }
-function createCreateCommand3() {
+function createCreateCommand4() {
   return new Command("create").description("Create an environment for an application").argument("<name>", "Environment name (lowercase letters/digits/dashes)").requiredOption("--app <applicationId>", "Parent application UUID").requiredOption("--url <url>", "Primary URL for the environment").option("--description <text>", "Description").option("--production", "Mark as the production environment").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
@@ -40473,10 +41080,10 @@ Examples:
   tracecli environment create staging --app <appId> --url https://staging.acme.com
   tracecli environment create production --app <appId> --url https://acme.com --production`
   ).action(async (name, options) => {
-    await runCreate3(name, options);
+    await runCreate4(name, options);
   });
 }
-function createListCommand4() {
+function createListCommand5() {
   return new Command("list").description("List environments \u2014 an application's, or every one in the organization").option("--app <applicationId>", "Parent application UUID (omit to list the whole org)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").addHelpText(
     "after",
     `
@@ -40488,7 +41095,7 @@ Examples:
   tracecli environment list --app <appId>
   tracecli environment list --output tsv | cut -f2,3,4`
   ).action(async (options) => {
-    await runList3(options);
+    await runList4(options);
   });
 }
 function createGetCommand3() {
@@ -40507,18 +41114,18 @@ Examples:
     await runUpdate3(environmentId, options);
   });
 }
-function createDeleteCommand3() {
+function createDeleteCommand4() {
   return new Command("delete").description("Delete an environment").argument("<environmentId>", "Environment UUID").requiredOption("--app <applicationId>", "Parent application UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (environmentId, options) => {
-    await runDelete3(environmentId, options);
+    await runDelete4(environmentId, options);
   });
 }
 function createEnvironmentCommand() {
   const environment = new Command("environment").alias("env").description("Manage application environments");
-  environment.addCommand(createCreateCommand3());
-  environment.addCommand(createListCommand4());
+  environment.addCommand(createCreateCommand4());
+  environment.addCommand(createListCommand5());
   environment.addCommand(createGetCommand3());
   environment.addCommand(createUpdateCommand3());
-  environment.addCommand(createDeleteCommand3());
+  environment.addCommand(createDeleteCommand4());
   return environment;
 }
 
@@ -40550,7 +41157,223 @@ var CLI_PACKAGE_NAME = packageMetadata.name;
 var CLI_VERSION = packageMetadata.version;
 
 // src/pentest/commands.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
+
+// src/pentest/evidence.ts
+import { readFileSync as readFileSync4, statSync } from "fs";
+import { basename } from "path";
+
+// src/pentest/resolve.ts
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolvePentestId(organizationId, identifier) {
+  if (UUID_PATTERN2.test(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PT-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      `Invalid pentest identifier '${identifier}'. Use a display ID (e.g. PT-3) or UUID.`
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentest.listPentests({
+      params: { organizationId }
+    })
+  );
+  if (result.status === 401) {
+    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    process.exit(1);
+  }
+  if (result.status !== 200) {
+    console.error(`Failed to list pentests (status ${result.status}).`);
+    process.exit(1);
+  }
+  const pentest = result.body.find((p2) => p2.displayId === displayId);
+  if (!pentest) {
+    console.error(
+      `Pentest with display ID ${displayId} not found.
+Run \`tracecli pentest list\` to see available pentests.`
+    );
+    process.exit(1);
+  }
+  return pentest.pentestId;
+}
+
+// src/pentest/evidence.ts
+var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
+var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
+function isSection(value) {
+  return ValidationEvidenceSectionValues.includes(value);
+}
+function isKind(value) {
+  return PentestExploitArtifactKindValues.includes(value);
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function resolveFindingId(organizationId, pentestId, identifier) {
+  if (isUuid(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list findings (status ${result.status}).`));
+    process.exit(1);
+  }
+  const match = result.body.find((f) => f.displayId === displayId);
+  if (!match || !("pentestFindingId" in match)) {
+    console.error(
+      colorError(
+        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
+      )
+    );
+    process.exit(1);
+  }
+  return match.pentestFindingId;
+}
+async function runAttachEvidence(options) {
+  if (options.section !== void 0 && !isSection(options.section)) {
+    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
+    console.error(`Valid sections: ${SECTION_LIST}`);
+    process.exit(1);
+  }
+  if (options.kind !== void 0 && !isKind(options.kind)) {
+    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
+    console.error(`Valid kinds: ${KIND_LIST}`);
+    process.exit(1);
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync(options.file);
+    if (!stats.isFile()) {
+      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
+      process.exit(1);
+    }
+    sizeBytes = stats.size;
+  } catch {
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
+    process.exit(1);
+  }
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
+    process.exit(1);
+  }
+  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
+    console.error(
+      colorError(
+        `File is ${formatBytes(sizeBytes)}; the limit for one exhibit is ${formatBytes(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+  const params = { organizationId, pentestId, pentestFindingId };
+  const filename = basename(options.file);
+  const slot = await authenticatedRequest(
+    (client) => client.pentestFinding.createFindingEvidenceUpload({
+      params,
+      body: { filename, sizeBytes }
+    })
+  );
+  if (slot.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (slot.status !== 201) {
+    const { message } = readErrorFields(slot.body);
+    console.error(
+      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
+    );
+    process.exit(1);
+  }
+  const body = readFileSync4(options.file);
+  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  const attached = await authenticatedRequest(
+    (client) => client.pentestFinding.attachFindingEvidence({
+      params,
+      body: {
+        key: slot.body.key,
+        ...options.caption !== void 0 ? { caption: options.caption } : {},
+        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
+        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
+        ...options.customerFacing ? { customerFacing: true } : {}
+      }
+    })
+  );
+  if (attached.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (attached.status !== 201) {
+    const { message } = readErrorFields(attached.body);
+    console.error(
+      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    console.log(JSON.stringify(attached.body, null, 2));
+    return;
+  }
+  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
+  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
+  console.log(
+    colorSuccess(
+      `Attached ${attached.body.kind} \xB7 ${formatBytes(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+    )
+  );
+  console.log(`  artifact ${attached.body.artifactId}`);
+  if (attached.body.kind === "HAR") {
+    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
+  } else if (!attached.body.customerFacing) {
+    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  }
+}
+function createAttachEvidenceCommand() {
+  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+The file uploads straight to storage, so recordings of any reasonable size work.
+Videos and HAR captures always land staff-internal \u2014 publish a video with the
+toggle in the staff console's evidence panel after reviewing it for redaction.
+
+Examples:
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
+    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
+    --caption "Full member roster returned to a non-member" --customer-facing --output json`
+  ).action(async (options) => {
+    await runAttachEvidence(options);
+  });
+}
 
 // src/pentest/questionnaire.ts
 function buildUpsertQuestionnaireBody(answers) {
@@ -40633,9 +41456,9 @@ function formatAnswerValue(key, answers) {
   }
 }
 function formatQuestionnaireShow(input) {
-  const lines = [
-    `Editable: ${input.editable ? "yes (scoping window open)" : "no (editing closed after scoping)"}`
-  ];
+  const submitted = input.submitted === true;
+  const editableLine = input.editable ? "yes (scoping window open)" : submitted ? "no (submitted)" : "no (editing closed after scoping)";
+  const lines = [`Editable: ${editableLine}`, `Submitted: ${submitted ? "yes" : "no"}`];
   if (input.answers === null || Object.keys(input.answers).length === 0) {
     lines.push("Answers: (none)");
     return lines.join("\n");
@@ -40695,43 +41518,7 @@ function formatFindingSeverity(severity) {
       return severity;
   }
 }
-var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function resolvePentestId(organizationId, identifier) {
-  if (UUID_PATTERN2.test(identifier)) {
-    return identifier;
-  }
-  const numericMatch = identifier.match(/^(?:PT-)?(\d+)$/i);
-  if (!numericMatch?.[1]) {
-    console.error(
-      `Invalid pentest identifier '${identifier}'. Use a display ID (e.g. PT-3) or UUID.`
-    );
-    process.exit(1);
-  }
-  const displayId = Number.parseInt(numericMatch[1], 10);
-  const result = await authenticatedRequest(
-    (client) => client.pentest.listPentests({
-      params: { organizationId }
-    })
-  );
-  if (result.status === 401) {
-    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
-    process.exit(1);
-  }
-  if (result.status !== 200) {
-    console.error(`Failed to list pentests (status ${result.status}).`);
-    process.exit(1);
-  }
-  const pentest = result.body.find((p2) => p2.displayId === displayId);
-  if (!pentest) {
-    console.error(
-      `Pentest with display ID ${displayId} not found.
-Run \`tracecli pentest list\` to see available pentests.`
-    );
-    process.exit(1);
-  }
-  return pentest.pentestId;
-}
-function createListCommand5() {
+function createListCommand6() {
   return new Command("list").description("List pentests for your organization").option(
     "--status <status>",
     "Filter by status (SCOPING, IN_PROGRESS, REMEDIATION, CLOSED)",
@@ -40981,6 +41768,7 @@ function renderPentestFindingLines(finding) {
 function createFindingsCommand() {
   const findings = new Command("findings").description("Manage pentest findings");
   findings.addCommand(createFindingsListCommand());
+  findings.addCommand(createAttachEvidenceCommand());
   return findings;
 }
 var PRIORITY_SET = new Set(CustomerPriorityCategoryValues);
@@ -41251,7 +42039,7 @@ async function fetchQuestionnaire(organizationId, pentestId, notFoundLabel) {
   if (result.status !== SUCCESS_STATUS) {
     failQuestionnaire(result.status, result.body, "read", notFoundLabel);
   }
-  return result.body;
+  return toQuestionnaireGetBody(result.body);
 }
 async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabel) {
   const body = buildUpsertQuestionnaireBody(answers);
@@ -41264,7 +42052,35 @@ async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabe
   if (result.status !== SUCCESS_STATUS) {
     failQuestionnaire(result.status, result.body, "write", notFoundLabel);
   }
-  return result.body;
+  return toQuestionnaireGetBody(result.body);
+}
+async function submitQuestionnaire(organizationId, pentestId, answers, notFoundLabel) {
+  const result = await authenticatedRequest(
+    (client) => client.pentest.submitCustomerPentestQuestionnaire({
+      params: { organizationId, pentestId },
+      body: answers === void 0 ? {} : { answers }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failQuestionnaire(result.status, result.body, "write", notFoundLabel);
+  }
+  return toQuestionnaireGetBody(result.body);
+}
+function toQuestionnaireGetBody(body) {
+  return {
+    pentestId: body.pentestId,
+    editable: body.editable,
+    answers: body.answers,
+    updatedAt: body.updatedAt,
+    ...body.submittedAt !== void 0 ? { submittedAt: body.submittedAt } : {}
+  };
+}
+function questionnaireShowInput(body) {
+  return {
+    answers: body.answers,
+    editable: body.editable,
+    submitted: body.submittedAt != null
+  };
 }
 function exitCancelled() {
   me("Cancelled.");
@@ -41330,15 +42146,20 @@ async function promptQuestionnaireAnswers(existing) {
 async function runQuestionnaire(pentestIdentifier, options) {
   const show = options.show === true;
   const filePath = options.file;
+  const submit = options.submit === true;
   if (show && filePath !== void 0) {
     console.error(colorError("Pass only one of --show / --file."));
     process.exit(1);
   }
+  if (show && submit) {
+    console.error(colorError("Pass only one of --show / --submit."));
+    process.exit(1);
+  }
   const isInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  if (!show && filePath === void 0 && !isInteractiveTty) {
+  if (!show && filePath === void 0 && !submit && !isInteractiveTty) {
     console.error(
       colorError(
-        "Interactive questionnaire requires a TTY. Use --show to print answers, or --file <path> to upload an answers JSON object."
+        "Interactive questionnaire requires a TTY. Use --show to print answers, --file <path> to upload an answers JSON object, or --submit to freeze the current answers."
       )
     );
     process.exit(2);
@@ -41347,18 +42168,13 @@ async function runQuestionnaire(pentestIdentifier, options) {
   const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
   if (show) {
     const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
-    console.log(
-      formatQuestionnaireShow({
-        answers: current2.answers,
-        editable: current2.editable
-      })
-    );
+    console.log(formatQuestionnaireShow(questionnaireShowInput(current2)));
     return;
   }
   if (filePath !== void 0) {
     let raw;
     try {
-      raw = readFileSync4(filePath, "utf8");
+      raw = readFileSync5(filePath, "utf8");
     } catch {
       console.error(colorError(`Could not read answers file: ${filePath}`));
       process.exit(1);
@@ -41368,26 +42184,31 @@ async function runQuestionnaire(pentestIdentifier, options) {
       console.error(colorError(parsed.error));
       process.exit(1);
     }
-    const saved2 = await putQuestionnaire(
+    const saved2 = submit ? await submitQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier) : await putQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier);
+    console.log(
+      colorSuccess(
+        submit ? "Submitted questionnaire. Answers are locked." : "Saved questionnaire answers."
+      )
+    );
+    console.log(formatQuestionnaireShow(questionnaireShowInput(saved2)));
+    return;
+  }
+  if (submit) {
+    const submitted = await submitQuestionnaire(
       organizationId,
       pentestId,
-      parsed.answers,
+      void 0,
       pentestIdentifier
     );
-    console.log(colorSuccess("Saved questionnaire answers."));
-    console.log(
-      formatQuestionnaireShow({
-        answers: saved2.answers,
-        editable: saved2.editable
-      })
-    );
+    console.log(colorSuccess("Submitted questionnaire. Answers are locked."));
+    console.log(formatQuestionnaireShow(questionnaireShowInput(submitted)));
     return;
   }
   const current = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
   if (!current.editable) {
     console.error(
       colorError(
-        "Questionnaire editing is closed after scoping starts. Use --show to view the saved answers."
+        current.submittedAt != null ? "Questionnaire has already been submitted. Use --show to view the saved answers." : "Questionnaire editing is closed after scoping starts. Use --show to view the saved answers."
       )
     );
     process.exit(1);
@@ -41395,35 +42216,33 @@ async function runQuestionnaire(pentestIdentifier, options) {
   const merged = await promptQuestionnaireAnswers(current.answers);
   const saved = await putQuestionnaire(organizationId, pentestId, merged, pentestIdentifier);
   console.log(colorSuccess("Saved questionnaire answers."));
-  console.log(
-    formatQuestionnaireShow({
-      answers: saved.answers,
-      editable: saved.editable
-    })
-  );
+  console.log(formatQuestionnaireShow(questionnaireShowInput(saved)));
 }
 function createQuestionnaireCommand() {
   return new Command("questionnaire").description("View or fill the customer pentest intake questionnaire").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--show", "Print current answers using shared labels (GET)").option(
     "--file <path>",
     "Upload answers from a JSON file (answers object only \u2014 not { answers }; whole-object replace)"
-  ).addHelpText(
+  ).option("--submit", "Freeze the questionnaire after saving (or freeze the current answers)").addHelpText(
     "after",
     `
 Optional scoping questionnaire for a new pentest (editable while stage is DRAFT
-or READY_TO_START). Reads accept a browser session or API key; writes require an
-organization admin (or Trace staff) signed in via \`tracecli auth login\` \u2014 API
-keys are rejected.
+or READY_TO_START, until submitted). Reads accept a browser session or API key;
+writes require an organization admin (or Trace staff) signed in via \`tracecli
+auth login\` \u2014 API keys are rejected.
 
 Modes:
   --show          GET and print key: value with shared customer-facing labels
   --file <path>   PUT the file's answers object (CLI wraps { answers } for the API)
+  --submit        Freeze answers (combine with --file or TTY fill, or alone to freeze current)
   (TTY default)   load-merge-write: GET, prompt each question, confirm, PUT
 
-Non-interactive shells must pass --show or --file (exit 2 otherwise).
+Non-interactive shells must pass --show, --file, or --submit (exit 2 otherwise).
 
 Examples:
   tracecli pentest questionnaire PT-1 --show
   tracecli pentest questionnaire PT-1 --file answers.json
+  tracecli pentest questionnaire PT-1 --file answers.json --submit
+  tracecli pentest questionnaire PT-1 --submit
   tracecli pentest questionnaire PT-1`
   ).action(async (pentestId, options) => {
     await runQuestionnaire(pentestId, options);
@@ -41431,7 +42250,7 @@ Examples:
 }
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
-  pentest.addCommand(createListCommand5());
+  pentest.addCommand(createListCommand6());
   pentest.addCommand(createUpdateCommand4());
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
@@ -41439,7 +42258,7 @@ function createPentestCommand() {
 }
 
 // src/update/commands.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -41457,7 +42276,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync5(cachePath, "utf-8");
+    const rawCache = readFileSync6(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -42056,7 +42875,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand6() {
+function createListCommand7() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -42190,7 +43009,7 @@ Examples:
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
   vulnerabilities.addCommand(createGetCommand4());
-  vulnerabilities.addCommand(createListCommand6());
+  vulnerabilities.addCommand(createListCommand7());
   return vulnerabilities;
 }
 
@@ -42211,6 +43030,7 @@ program2.addCommand(createEnvironmentCommand());
 program2.addCommand(createCredentialCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());