securewithtrace 0.37.0 → 0.38.0

package/dist/index.js

@@ -6276,7 +6276,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c58) => c58 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c59) => c59 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16320,9 +16320,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c58 = inst._zod.bag;
-  inst.minDate = c58.minimum ? new Date(c58.minimum) : null;
-  inst.maxDate = c58.maximum ? new Date(c58.maximum) : null;
+  const c59 = inst._zod.bag;
+  inst.minDate = c59.minimum ? new Date(c59.minimum) : null;
+  inst.maxDate = c59.maximum ? new Date(c59.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -21998,7 +21998,7 @@ var PentestEditActionValues = [
   "DELIVER"
 ];
 var PentestEditAction = external_exports.enum(PentestEditActionValues);
-var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT"];
+var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY"];
 var PentestAuditActorType = external_exports.enum(PentestAuditActorTypeValues);
 var PentestHypothesisStatusValues = [
   "DRAFTED",
@@ -23008,6 +23008,263 @@ var LinearTicketContextResponseSchema = external_exports.object({
 var AttestationClassificationValues = ["PUBLIC", "CONFIDENTIAL"];
 var AttestationClassification = external_exports.enum(AttestationClassificationValues);
 
+// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
+var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
+var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
+var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
+  repositoryId: external_exports.uuid()
+});
+var CreateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var UpdateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url().optional(),
+  platform: external_exports.enum(PlatformValues).optional(),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var RepositoryResponseSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  status: external_exports.enum(RepositoryStatusValues),
+  githubDefaultBranch: external_exports.string(),
+  scanningBranch: external_exports.string().nullable(),
+  primaryLanguage: external_exports.string().nullable().optional(),
+  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
+  prScansEnabled: external_exports.boolean(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var SetPrScansEnabledRequestSchema = external_exports.object({
+  enabled: external_exports.boolean()
+});
+var StaffRepositoryPrScanSettingSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
+  fullName: external_exports.string().nullable(),
+  repositoryUrl: external_exports.url(),
+  /** The staff-set opt-in arm of the gate. */
+  prScansEnabled: external_exports.boolean(),
+  /**
+   * The implicit arm: a completed FULL SAST scan exists for this repo (any
+   * branch). With the org capability granted, either arm open means PR scans run.
+   */
+  hasSastBaseline: external_exports.boolean()
+});
+var StaffPrScanSettingsResponseSchema = external_exports.object({
+  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
+  orgHasAutoPrScans: external_exports.boolean(),
+  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
+});
+var CloneTokenRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.string().url()
+});
+var CloneTokenResponseSchema = external_exports.object({
+  token: external_exports.string(),
+  expiresAt: external_exports.string().datetime(),
+  // Git username scheme to pair with this token. GitHub installation tokens
+  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
+  // for back-compat with CLIs that predate Bitbucket support and hardcode
+  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
+  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
+});
+var ScanningBranchHistoryEntrySchema = external_exports.object({
+  historyId: external_exports.uuid(),
+  branch: external_exports.string(),
+  configuredAt: external_exports.date(),
+  replacedAt: external_exports.date(),
+  configuredByUserId: external_exports.uuid().nullable()
+});
+var ScanningBranchStateSchema = external_exports.object({
+  scanningBranch: external_exports.string().nullable(),
+  githubDefaultBranch: external_exports.string(),
+  history: external_exports.array(ScanningBranchHistoryEntrySchema)
+});
+var SetScanningBranchRequestSchema = external_exports.object({
+  branch: external_exports.string().min(1).max(255),
+  migrateOpenVulnerabilities: external_exports.boolean(),
+  /**
+   * Optional compare-and-swap guard. When provided, the switch only commits
+   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
+   * `null` means "expect this repo to still be unconfigured."
+   */
+  expectedCurrentBranch: external_exports.string().nullable().optional()
+});
+var SetScanningBranchResponseSchema = external_exports.object({
+  previousBranch: external_exports.string().nullable(),
+  newBranch: external_exports.string(),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0),
+  /** Null when previousBranch was null (initial configuration). */
+  historyId: external_exports.uuid().nullable()
+});
+var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
+  external_exports.object({ kind: external_exports.literal("github-default") })
+]);
+var BulkSetScanningBranchRequestSchema = external_exports.object({
+  branch: BulkSetScanningBranchBranchSchema,
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
+  migrateOpenVulnerabilities: external_exports.boolean()
+});
+var BulkSetScanningBranchResultStatusValues = [
+  "switched",
+  "branch-missing-on-github",
+  "forbidden",
+  "already-on-branch",
+  "not-found",
+  "error"
+];
+var BulkSetScanningBranchResultSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
+  historyId: external_exports.uuid().nullable().optional(),
+  errorMessage: external_exports.string().optional()
+});
+var BulkSetScanningBranchResponseSchema = external_exports.object({
+  results: external_exports.array(BulkSetScanningBranchResultSchema)
+});
+var ScanningBranchPreferenceSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.boolean()
+});
+var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.literal(true),
+  /** Repos the sweep configured to their default-branch mirror. */
+  configuredCount: external_exports.number().int().min(0),
+  /**
+   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
+   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
+   */
+  skippedCount: external_exports.number().int().min(0)
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
+var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
+var APPLICATION_NOTES_MAX_CHARS = 2e3;
+var ApplicationRepositoryRoleValues = [
+  "FRONTEND",
+  "BACKEND_API",
+  "AUTH_SERVICE",
+  "WORKER_JOB_SERVICE",
+  "SHARED_PACKAGE_SDK",
+  "INFRASTRUCTURE_IAC",
+  "MOBILE_CLIENT",
+  "MONOREPO",
+  "OTHER"
+];
+var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
+  applicationId: external_exports.uuid()
+});
+var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
+  applicationRepositoryId: external_exports.uuid()
+});
+var ApplicationRepositorySummarySchema = external_exports.object({
+  applicationRepositoryId: external_exports.uuid().nullable(),
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryId: external_exports.uuid(),
+  repositoryName: external_exports.string(),
+  repositoryUrl: external_exports.string(),
+  repositoryStatus: external_exports.enum(RepositoryStatusValues),
+  htmlUrl: external_exports.string().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
+var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
+  // First of `roles` (enum order), or null when unspecified. Kept so a new
+  // client reading a pre-this-release API during a rolling deploy still parses.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
+  // Source of truth. Defaulted empty so a new client reading a pre-this-release
+  // API that omitted the field doesn't reject the row; the client then falls
+  // back to wrapping `role`.
+  roles: ApplicationRepositoryRolesSchema.default([]),
+  roleLabel: external_exports.string().max(120).nullable(),
+  repositoryPath: external_exports.string().max(500).nullable(),
+  scanEnabled: external_exports.boolean()
+});
+var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
+  ApplicationRepositoryLinkResponseSchema
+);
+var ApplicationResponseSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  name: external_exports.string(),
+  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
+  // never emitted `type` parses cleanly (existing apps are semantically WEB),
+  // so a new frontend reading an old API during a mixed-version rollout doesn't
+  // reject application rows.
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.string().nullable(),
+  // Customer-authored free-text context, any type ("Advanced → Notes").
+  notes: external_exports.string().nullable(),
+  helpCenterUrl: external_exports.string().nullable(),
+  documentationUrl: external_exports.string().nullable(),
+  repositories: external_exports.array(ApplicationRepositorySummarySchema),
+  // Registrable domains RECON is authorized to discover subdomains under. The
+  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
+  // (like `type`) so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject application rows that predate the field.
+  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
+  // reading a pre-this-release API during a rolling deploy doesn't reject rows
+  // that omit the field. The raw S3 key is never on the wire.
+  screenshotUrl: external_exports.url().nullable().default(null),
+  // Defaulted null so a new client reading a pre-this-release API during a
+  // rolling deploy doesn't reject application rows that omit the field.
+  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
+var CreateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200),
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
+  repositoryId: external_exports.uuid().optional(),
+  repositoryPath: external_exports.string().max(500).optional(),
+  helpCenterUrl: external_exports.url().max(2048).optional(),
+  documentationUrl: external_exports.url().max(2048).optional()
+}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
+  path: ["applicationUrl"],
+  message: "A web or API application requires an application URL."
+}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
+  path: ["applicationUrl"],
+  message: "Only web or API applications can have an application URL."
+});
+var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200).optional(),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
+  repositoryId: external_exports.uuid().nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
+  documentationUrl: external_exports.url().max(2048).nullable().optional()
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-report-pdf.api.ts
 var ReportPdfPentestParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -23093,6 +23350,28 @@ var PartnerNarrativeJsonSchema = external_exports.object({
     notExploitable: external_exports.string().max(4e3).optional()
   })
 });
+var BskNarrativeSectionIdValues = [
+  "engagement_context",
+  "platform_and_data",
+  "overall_assessment",
+  "findings_overview",
+  "target",
+  "approach",
+  "limitations",
+  "not_exploitable"
+];
+var BskNarrativeSectionId = external_exports.enum(BskNarrativeSectionIdValues);
+var TraceNarrativeSectionIdValues = [
+  "executive_summary",
+  "scope_summary",
+  "key_themes"
+];
+var ReportWriteSectionIdValues = [
+  ...TraceNarrativeSectionIdValues,
+  ...BskNarrativeSectionIdValues
+];
+var ReportWriteSectionId = external_exports.enum(ReportWriteSectionIdValues);
+var REPORT_SECTION_CONTENT_MAX_CHARS = 4e3;
 var SeverityCountsSchema = external_exports.object({
   critical: external_exports.int().min(0),
   high: external_exports.int().min(0),
@@ -23415,6 +23694,8 @@ var ApplyReportSettingsRequestSchema = external_exports.object({
   includeRemediationTimeline: external_exports.boolean(),
   expectedUpdatedAt: external_exports.coerce.date().nullable()
 });
+var CustomerReportDownloadFormatValues = ["pdf", "bundle"];
+var CustomerReportDownloadFormatSchema = external_exports.enum(CustomerReportDownloadFormatValues);
 var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
   organizationId: true,
   pentestId: true,
@@ -23446,7 +23727,14 @@ var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
    * before the API's, so a new bundle briefly reads an old API's response, where
    * this field does not exist. Consumers default it to false.
    */
-  canViewInline: external_exports.boolean().optional()
+  canViewInline: external_exports.boolean().optional(),
+  /**
+   * What the Download action hands the customer: the PDF alone, or one zip
+   * carrying the PDF, the markdown report, and the evidence files (partner
+   * templates whose tooling consumes the markdown). Preview always opens the
+   * PDF. Optional for the deploy-order reason above; consumers default to 'pdf'.
+   */
+  downloadFormat: CustomerReportDownloadFormatSchema.optional()
 });
 var GetCustomerReportPdfResponseSchema = external_exports.object({
   report: CustomerReportPdfResponseSchema.nullable()
@@ -23566,6 +23854,12 @@ var IssuedReportSnapshotSchema = external_exports.object({
      * parses those rows for the changelog diff — a required field would throw
      * there and break issuing a new version of any pre-feature report. */
     testType: PentestTestType.optional(),
+    /** Types of the applications bound at issuance: the archival record of which
+     * OWASP families the delivered PDF named. Optional for the same reason as
+     * `testType` above: a pre-feature snapshot has no value, and
+     * `latestIssuedSnapshot` parses those rows for the changelog diff. Absent
+     * re-renders as the web family, matching what those reports contain. */
+    applicationTypes: external_exports.array(external_exports.enum(ApplicationTypeValues)).optional(),
     versionLabel: external_exports.string(),
     revisionCount: external_exports.int().min(1)
   }),
@@ -24390,15 +24684,34 @@ var StartProgressPentestFindingRequestSchema = external_exports.object({});
 var ReportRemediationPentestFindingRequestSchema = external_exports.object({
   note: external_exports.string().trim().min(1).max(1e4).optional()
 });
+var AutomationFindingTransitionSchema = external_exports.enum(["IN_PROGRESS", "REMEDIATED"]);
+var AutomationStatusUpdateRequestSchema = external_exports.object({
+  status: AutomationFindingTransitionSchema,
+  note: external_exports.string().trim().min(1).max(1e4).optional()
+}).refine((value) => value.note === void 0 || value.status === "REMEDIATED", {
+  message: "note is only accepted when reporting remediation (status REMEDIATED)",
+  path: ["note"]
+});
 var ReopenPentestFindingTargetStatusSchema = external_exports.enum(["OPEN", "IN_PROGRESS"]);
 var ReopenPentestFindingRequestSchema = external_exports.object({
   targetStatus: ReopenPentestFindingTargetStatusSchema,
   noteContent: external_exports.string().trim().min(1).max(1e4)
 });
+var retestVerificationOnlyOnFixed = (value, ctx) => {
+  if (value.outcome !== "FIXED" && value.verification !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "verification report prose is only allowed when outcome is FIXED",
+      path: ["verification"]
+    });
+  }
+};
 var CreatePentestFindingRetestRequestSchema = external_exports.object({
   outcome: ManualRetestOutcome,
-  notes: external_exports.string().trim().min(1).max(1e4)
+  notes: external_exports.string().trim().min(1).max(1e4),
+  verification: external_exports.string().trim().min(1).max(8e3).optional()
 });
+var CreatePentestFindingRetestBodySchema = CreatePentestFindingRetestRequestSchema.superRefine(retestVerificationOnlyOnFixed);
 var CreatePentestFindingNoteRequestSchema = external_exports.object({
   content: external_exports.string().min(1).max(1e4)
 });
@@ -24592,263 +24905,6 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
   manualFindingIds: HypothesisSourceIdsSchema.optional()
 }).strict().optional();
 
-// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
-var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
-var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
-var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
-  repositoryId: external_exports.uuid()
-});
-var CreateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var UpdateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url().optional(),
-  platform: external_exports.enum(PlatformValues).optional(),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var RepositoryResponseSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  status: external_exports.enum(RepositoryStatusValues),
-  githubDefaultBranch: external_exports.string(),
-  scanningBranch: external_exports.string().nullable(),
-  primaryLanguage: external_exports.string().nullable().optional(),
-  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
-  prScansEnabled: external_exports.boolean(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
-var SetPrScansEnabledRequestSchema = external_exports.object({
-  enabled: external_exports.boolean()
-});
-var StaffRepositoryPrScanSettingSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
-  fullName: external_exports.string().nullable(),
-  repositoryUrl: external_exports.url(),
-  /** The staff-set opt-in arm of the gate. */
-  prScansEnabled: external_exports.boolean(),
-  /**
-   * The implicit arm: a completed FULL SAST scan exists for this repo (any
-   * branch). With the org capability granted, either arm open means PR scans run.
-   */
-  hasSastBaseline: external_exports.boolean()
-});
-var StaffPrScanSettingsResponseSchema = external_exports.object({
-  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
-  orgHasAutoPrScans: external_exports.boolean(),
-  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
-});
-var CloneTokenRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.string().url()
-});
-var CloneTokenResponseSchema = external_exports.object({
-  token: external_exports.string(),
-  expiresAt: external_exports.string().datetime(),
-  // Git username scheme to pair with this token. GitHub installation tokens
-  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
-  // for back-compat with CLIs that predate Bitbucket support and hardcode
-  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
-  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
-});
-var ScanningBranchHistoryEntrySchema = external_exports.object({
-  historyId: external_exports.uuid(),
-  branch: external_exports.string(),
-  configuredAt: external_exports.date(),
-  replacedAt: external_exports.date(),
-  configuredByUserId: external_exports.uuid().nullable()
-});
-var ScanningBranchStateSchema = external_exports.object({
-  scanningBranch: external_exports.string().nullable(),
-  githubDefaultBranch: external_exports.string(),
-  history: external_exports.array(ScanningBranchHistoryEntrySchema)
-});
-var SetScanningBranchRequestSchema = external_exports.object({
-  branch: external_exports.string().min(1).max(255),
-  migrateOpenVulnerabilities: external_exports.boolean(),
-  /**
-   * Optional compare-and-swap guard. When provided, the switch only commits
-   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
-   * `null` means "expect this repo to still be unconfigured."
-   */
-  expectedCurrentBranch: external_exports.string().nullable().optional()
-});
-var SetScanningBranchResponseSchema = external_exports.object({
-  previousBranch: external_exports.string().nullable(),
-  newBranch: external_exports.string(),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0),
-  /** Null when previousBranch was null (initial configuration). */
-  historyId: external_exports.uuid().nullable()
-});
-var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
-  external_exports.object({ kind: external_exports.literal("github-default") })
-]);
-var BulkSetScanningBranchRequestSchema = external_exports.object({
-  branch: BulkSetScanningBranchBranchSchema,
-  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
-  migrateOpenVulnerabilities: external_exports.boolean()
-});
-var BulkSetScanningBranchResultStatusValues = [
-  "switched",
-  "branch-missing-on-github",
-  "forbidden",
-  "already-on-branch",
-  "not-found",
-  "error"
-];
-var BulkSetScanningBranchResultSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
-  historyId: external_exports.uuid().nullable().optional(),
-  errorMessage: external_exports.string().optional()
-});
-var BulkSetScanningBranchResponseSchema = external_exports.object({
-  results: external_exports.array(BulkSetScanningBranchResultSchema)
-});
-var ScanningBranchPreferenceSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.boolean()
-});
-var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.literal(true),
-  /** Repos the sweep configured to their default-branch mirror. */
-  configuredCount: external_exports.number().int().min(0),
-  /**
-   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
-   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
-   */
-  skippedCount: external_exports.number().int().min(0)
-});
-
-// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
-var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
-var APPLICATION_NOTES_MAX_CHARS = 2e3;
-var ApplicationRepositoryRoleValues = [
-  "FRONTEND",
-  "BACKEND_API",
-  "AUTH_SERVICE",
-  "WORKER_JOB_SERVICE",
-  "SHARED_PACKAGE_SDK",
-  "INFRASTRUCTURE_IAC",
-  "MOBILE_CLIENT",
-  "MONOREPO",
-  "OTHER"
-];
-var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
-  applicationId: external_exports.uuid()
-});
-var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
-  applicationRepositoryId: external_exports.uuid()
-});
-var ApplicationRepositorySummarySchema = external_exports.object({
-  applicationRepositoryId: external_exports.uuid().nullable(),
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  repositoryName: external_exports.string(),
-  repositoryUrl: external_exports.string(),
-  repositoryStatus: external_exports.enum(RepositoryStatusValues),
-  htmlUrl: external_exports.string().nullable(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
-var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
-  // First of `roles` (enum order), or null when unspecified. Kept so a new
-  // client reading a pre-this-release API during a rolling deploy still parses.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
-  // Source of truth. Defaulted empty so a new client reading a pre-this-release
-  // API that omitted the field doesn't reject the row; the client then falls
-  // back to wrapping `role`.
-  roles: ApplicationRepositoryRolesSchema.default([]),
-  roleLabel: external_exports.string().max(120).nullable(),
-  repositoryPath: external_exports.string().max(500).nullable(),
-  scanEnabled: external_exports.boolean()
-});
-var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
-  ApplicationRepositoryLinkResponseSchema
-);
-var ApplicationResponseSchema = external_exports.object({
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  name: external_exports.string(),
-  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
-  // never emitted `type` parses cleanly (existing apps are semantically WEB),
-  // so a new frontend reading an old API during a mixed-version rollout doesn't
-  // reject application rows.
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.string().nullable(),
-  // Customer-authored free-text context, any type ("Advanced → Notes").
-  notes: external_exports.string().nullable(),
-  helpCenterUrl: external_exports.string().nullable(),
-  documentationUrl: external_exports.string().nullable(),
-  repositories: external_exports.array(ApplicationRepositorySummarySchema),
-  // Registrable domains RECON is authorized to discover subdomains under. The
-  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
-  // (like `type`) so a new client reading a pre-this-release API during a rolling
-  // deploy doesn't reject application rows that predate the field.
-  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
-  // reading a pre-this-release API during a rolling deploy doesn't reject rows
-  // that omit the field. The raw S3 key is never on the wire.
-  screenshotUrl: external_exports.url().nullable().default(null),
-  // Defaulted null so a new client reading a pre-this-release API during a
-  // rolling deploy doesn't reject application rows that omit the field.
-  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
-var CreateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200),
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
-  repositoryId: external_exports.uuid().optional(),
-  repositoryPath: external_exports.string().max(500).optional(),
-  helpCenterUrl: external_exports.url().max(2048).optional(),
-  documentationUrl: external_exports.url().max(2048).optional()
-}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
-  path: ["applicationUrl"],
-  message: "A web or API application requires an application URL."
-}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
-  path: ["applicationUrl"],
-  message: "Only web or API applications can have an application URL."
-});
-var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200).optional(),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
-  repositoryId: external_exports.uuid().nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
-  documentationUrl: external_exports.url().max(2048).nullable().optional()
-}).strict();
-
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -25289,13 +25345,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c58, i2) => {
-    const d = c58.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c59, i2) => {
+    const d = c59.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c58.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c59.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -25993,7 +26049,19 @@ var AgentSessionLoginCodeResponseSchema = external_exports.object({
 var AgentSessionTotpCodeRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   /** Which account (by `Credential.label`); omit if exactly one is enrolled. */
-  credentialLabel: external_exports.string().min(1).max(200).optional()
+  credentialLabel: external_exports.string().min(1).max(200).optional(),
+  /**
+   * Which account by ID, which is what a DESKTOP session holds.
+   *
+   * `Credential.label` is unique per ENVIRONMENT, not per pentest, so an
+   * engagement spanning staging and production can carry two accounts labelled
+   * `admin` and the label identifies neither. The desktop credential catalog
+   * hands the agent an unambiguous id, and without this the only way to use an
+   * enrolled desktop account was to ask staff to relabel one mid-engagement.
+   *
+   * Wins over `credentialLabel` when both are given.
+   */
+  credentialId: external_exports.uuid().optional()
 });
 var AgentSessionTotpCodeResponseSchema = external_exports.object({
   /** The account the code belongs to, echoed so the agent can name it. */
@@ -26393,17 +26461,9 @@ var OperatorRecordFindingRetestRequestSchema = CreatePentestFindingRetestRequest
   runVersion: operatorRunVersion,
   reason: operatorReason,
   pentestFindingId: external_exports.uuid(),
-  outcome: RetestOutcome,
-  verification: external_exports.string().min(1).max(8e3).optional()
-}).superRefine((v, ctx) => {
-  if (v.outcome !== "FIXED" && v.verification !== void 0) {
-    ctx.addIssue({
-      code: "custom",
-      message: "verification report prose is only allowed when outcome is FIXED",
-      path: ["verification"]
-    });
-  }
-});
+  // Widened from the dashboard's 3 values; `verification` comes from the base.
+  outcome: RetestOutcome
+}).superRefine(retestVerificationOnlyOnFixed);
 var OperatorRetestAckSchema = OperatorFindingReadSchema.extend({
   retestId: external_exports.uuid()
 });
@@ -26564,7 +26624,21 @@ var ReportSessionCoverSchema = external_exports.object({
   classification: AttestationClassification,
   documentId: external_exports.string(),
   testingWindowStart: external_exports.string().nullable(),
-  testingWindowEnd: external_exports.string().nullable()
+  testingWindowEnd: external_exports.string().nullable(),
+  /**
+   * The engagement approach in the exact words the rendered document prints
+   * ("white-box" / "authenticated grey-box" / "black-box", from the pentest's
+   * `testType`).
+   *
+   * Here because the agent writing an Approach section otherwise cannot know it,
+   * while the BSK document's methodology appendix prints it three paragraphs
+   * later — one page apart and flatly contradictory in a partner deliverable.
+   *
+   * Optional for the reason the whole view is: the host reads this response with
+   * a raw cast and no validation, so a host running against an older api would
+   * read a required-typed field as `undefined`.
+   */
+  approachLabel: external_exports.string().optional()
 });
 var ReportSessionViewSchema = external_exports.object({
   rendered: external_exports.boolean(),
@@ -26575,7 +26649,19 @@ var ReportSessionViewSchema = external_exports.object({
     keyThemes: external_exports.array(KeyThemeSchema)
   }),
   scopeRows: external_exports.array(ScopeRowSchema),
-  updatedAt: external_exports.string().nullable()
+  updatedAt: external_exports.string().nullable(),
+  /** Which template this org's report renders with. Absent = TRACE (older api). */
+  reportTemplate: PentestReportTemplateSchema.optional(),
+  /**
+   * The BSK partner narrative as stored; null when nothing is written, absent on
+   * a TRACE org (or an older api).
+   *
+   * A section key ABSENT from `sections` has not been written yet. That is the
+   * BSK agent's only channel for "which of my eight sections already exist", and
+   * every write returns this view, so a follow-up or resumed session reads it
+   * back rather than re-authoring all eight.
+   */
+  partnerNarrative: PartnerNarrativeJsonSchema.nullable().optional()
 });
 var reportRunVersion = external_exports.number().int().nonnegative();
 var reportReason = external_exports.string().min(1).max(2e3);
@@ -26587,8 +26673,8 @@ var ReportWriteSectionRequestSchema = external_exports.object({
   runVersion: reportRunVersion,
   reason: reportReason,
   expectedUpdatedAt: reportExpectedUpdatedAt,
-  section: external_exports.enum(["executive_summary", "scope_summary", "key_themes"]),
-  content: external_exports.string().min(1).max(2e3).optional(),
+  section: ReportWriteSectionId,
+  content: external_exports.string().min(1).max(REPORT_SECTION_CONTENT_MAX_CHARS).optional(),
   themes: external_exports.array(KeyThemeSchema).max(4).optional()
 });
 var ReportUpdateScopeRequestSchema = external_exports.object({
@@ -26602,13 +26688,24 @@ var RequestDesktopTargetRequestSchema = external_exports.object({
   /** Only Windows exists; a literal keeps the macOS follow-on additive. */
   platform: external_exports.literal("WINDOWS")
 });
+var DesktopCredentialRefSchema = external_exports.object({
+  credentialId: external_exports.uuid(),
+  label: external_exports.string(),
+  credentialType: external_exports.enum(CredentialTypeValues),
+  environmentId: external_exports.uuid(),
+  /** Present when the account has a second factor enrolled. `get_totp_code`
+   *  resolves by LABEL, which is not unique per pentest, so an enrolled desktop
+   *  account would otherwise dead-end. */
+  mfaKind: CredentialMfaKind.nullable()
+});
 var RequestDesktopTargetResponseSchema = external_exports.object({
   desktopTargetId: external_exports.uuid(),
   status: external_exports.enum(DesktopTargetStatusValues),
   /** True when this session already owned a live box, so a second call in one
    *  assistant turn cannot bill a second instance. */
   reused: external_exports.boolean(),
-  screen: external_exports.object({ width: external_exports.number().int().positive(), height: external_exports.number().int().positive() })
+  screen: external_exports.object({ width: external_exports.number().int().positive(), height: external_exports.number().int().positive() }),
+  credentials: external_exports.array(DesktopCredentialRefSchema)
 });
 var DesktopTargetStatusRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
@@ -26654,7 +26751,15 @@ var DesktopActionViewSchema = external_exports.object({
    * so a caller-chosen name is how an unredacted clip would publish as a
    * customer-facing screenshot.
    */
-  artifactName: external_exports.string().max(256).nullable()
+  artifactName: external_exports.string().max(256).nullable(),
+  /**
+   * Shape-only reason a FAILED action carries. Load-bearing for `type_secret`:
+   * claim-time substitution fails the action with one of three codes
+   * (`credential_not_found`, `credential_field_absent`, `decrypt_failed`), and
+   * without this projection the agent could not tell those apart from a box
+   * that crashed.
+   */
+  failureDetails: external_exports.string().nullable()
 });
 var ReadDesktopActionRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
@@ -31977,7 +32082,8 @@ var OrgCapabilityValues = [
   "SCAN_SECRETS",
   "SCAN_DAST",
   "AUTO_PR_SCANS",
-  "AUTO_PUSH_SCANS"
+  "AUTO_PUSH_SCANS",
+  "PENTEST_FINDING_AUTOMATION"
 ];
 var UpdateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(255).optional(),
@@ -34270,6 +34376,28 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // ─── Automation lifecycle transition (API keys) ───
+  // A separate route rather than a widened `start-progress` / `report-remediation`:
+  // those stay human-only, and everything that makes a machine-driven write
+  // different lives here. API-key principals only, gated on the org owning
+  // PENTEST_FINDING_AUTOMATION, and audited as API_KEY with the key's name.
+  automationStatusUpdate: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/automation/status",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: AutomationStatusUpdateRequestSchema,
+    responses: {
+      200: CustomerPentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // FINDING_TRANSITION_NOT_ALLOWED (bad source status), FINDING_STALE
+      // (concurrent write), or PENTEST_CLOSED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Customer opens a dispute (PR 3) → finding status CONTESTED. Same auth as the
   // other customer transitions (VIEW_RESULTS + user principal + customer visibility).
   contest: {
@@ -34362,7 +34490,7 @@ var pentestFindingContract = c35.router({
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/retests",
     pathParams: PentestFindingIdParamsSchema,
-    body: CreatePentestFindingRetestRequestSchema,
+    body: CreatePentestFindingRetestBodySchema,
     responses: {
       201: PentestFindingRetestResponseSchema,
       400: ErrorResponseSchema,
@@ -35466,6 +35594,128 @@ var staffPentestStatsContract = c42.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/staff-queue.api.ts
+var StaffQueueItemKindValues = [
+  "RETEST_OWED",
+  "CONTESTED",
+  "SESSION_WAITING",
+  "SESSION_FAILED",
+  "REVIEW_GATE",
+  "INTAKE_SUBMITTED"
+];
+var StaffQueueItemKind = external_exports.enum(StaffQueueItemKindValues);
+var STAFF_QUEUE_EXCERPT_MAX = 280;
+var since = external_exports.iso.datetime();
+var findingIdentity = {
+  pentestFindingId: external_exports.uuid(),
+  /** Null until published; the finding is then named by title alone. */
+  displayId: external_exports.int().positive().nullable(),
+  title: external_exports.string(),
+  severity: PentestFindingSeverity,
+  /** False for a finding the customer has never seen; they are not the one waiting. */
+  published: external_exports.boolean()
+};
+var StaffQueueRetestOwedItemSchema = external_exports.object({
+  kind: external_exports.literal("RETEST_OWED"),
+  since,
+  ...findingIdentity,
+  /** The most recent automatic retest, when one ran and did not settle it. */
+  lastAutoRetest: external_exports.object({ outcome: RetestOutcome, testedAt: external_exports.iso.datetime() }).nullable()
+}).strict();
+var StaffQueueContestedItemSchema = external_exports.object({
+  kind: external_exports.literal("CONTESTED"),
+  since,
+  ...findingIdentity,
+  /** The open contest row. Null only if a finding is CONTESTED with no open row. */
+  contest: external_exports.object({
+    reason: ContestReason,
+    justification: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+    contestedBy: external_exports.string()
+  }).strict().nullable()
+}).strict();
+var StaffQueueSessionWaitingItemSchema = external_exports.object({
+  kind: external_exports.literal("SESSION_WAITING"),
+  since,
+  agentSessionId: external_exports.uuid(),
+  sessionType: AgentSessionType,
+  waitingReason: AgentSessionWaitingReason.nullable(),
+  /** The console's session list names sessions by objective, so the row carries it. */
+  objective: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+  /** The agent's question when the park carries one. */
+  question: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX).nullable()
+}).strict();
+var StaffQueueSessionFailedItemSchema = external_exports.object({
+  kind: external_exports.literal("SESSION_FAILED"),
+  since,
+  agentSessionId: external_exports.uuid(),
+  sessionType: AgentSessionType,
+  objective: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+  failureReason: AgentSessionFailureReason.nullable()
+}).strict();
+var StaffQueueReviewGateItemSchema = external_exports.object({
+  kind: external_exports.literal("REVIEW_GATE"),
+  since,
+  stage: PentestStage
+}).strict();
+var StaffQueueIntakeSubmittedItemSchema = external_exports.object({
+  kind: external_exports.literal("INTAKE_SUBMITTED"),
+  since
+}).strict();
+var StaffQueueItemSchema = external_exports.discriminatedUnion("kind", [
+  StaffQueueRetestOwedItemSchema,
+  StaffQueueContestedItemSchema,
+  StaffQueueSessionWaitingItemSchema,
+  StaffQueueSessionFailedItemSchema,
+  StaffQueueReviewGateItemSchema,
+  StaffQueueIntakeSubmittedItemSchema
+]);
+var StaffQueueEngagementSchema = external_exports.object({
+  organization: external_exports.object({
+    organizationId: external_exports.uuid(),
+    slug: external_exports.string(),
+    name: external_exports.string(),
+    logoUrl: external_exports.string().nullable(),
+    darkModeLogoUrl: external_exports.string().nullable()
+  }).strict(),
+  pentest: external_exports.object({
+    pentestId: external_exports.uuid(),
+    displayId: external_exports.int().positive(),
+    title: external_exports.string(),
+    status: PentestStatus,
+    currentStage: PentestStage
+  }).strict(),
+  /** Oldest first within the engagement. */
+  items: external_exports.array(StaffQueueItemSchema).min(1),
+  /** The `since` of the oldest item; engagements sort by it ascending. */
+  oldestSince: external_exports.iso.datetime()
+}).strict();
+var StaffQueueCountsSchema = external_exports.object(
+  Object.fromEntries(StaffQueueItemKindValues.map((kind) => [kind, external_exports.int().nonnegative()]))
+).strict();
+var StaffQueueResponseSchema = external_exports.object({
+  generatedAt: external_exports.iso.datetime(),
+  /** Non-deleted, non-closed pentests considered, so an empty queue can prove the query ran. */
+  liveEngagementCount: external_exports.int().nonnegative(),
+  counts: StaffQueueCountsSchema,
+  engagements: external_exports.array(StaffQueueEngagementSchema)
+}).strict();
+
+// ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
+var c43 = initContract();
+var staffQueueContract = c43.router({
+  getStaffQueue: {
+    method: "GET",
+    path: "/staff/queue",
+    responses: {
+      200: StaffQueueResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Engagements where the next move is staff\u2019s, grouped by engagement"
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/test-integration.api.ts
 var NOTES_MAX = 2e3;
 var TestIntegrationIdParamsSchema = external_exports.object({
@@ -35522,8 +35772,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c43 = initContract();
-var testIntegrationContract = c43.router({
+var c44 = initContract();
+var testIntegrationContract = c44.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -35655,8 +35905,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c44 = initContract();
-var userContract = c44.router({
+var c45 = initContract();
+var userContract = c45.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -35771,8 +36021,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c45 = initContract();
-var vantaIntegrationContract = c45.router({
+var c46 = initContract();
+var vantaIntegrationContract = c46.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -36104,8 +36354,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c46 = initContract();
-var vulnerabilityContract = c46.router({
+var c47 = initContract();
+var vulnerabilityContract = c47.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -36313,8 +36563,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c47 = initContract();
-var vulnerabilityNoteContract = c47.router({
+var c48 = initContract();
+var vulnerabilityNoteContract = c48.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -36495,8 +36745,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c48 = initContract();
-var webhookSettingsContract = c48.router({
+var c49 = initContract();
+var webhookSettingsContract = c49.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -36634,8 +36884,8 @@ var webhookSettingsContract = c48.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c49 = initContract();
-var v1Contract = c49.router(
+var c50 = initContract();
+var v1Contract = c50.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -36684,7 +36934,8 @@ var v1Contract = c49.router(
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
     pentestEgress: pentestEgressContract,
-    staffPentestStats: staffPentestStatsContract
+    staffPentestStats: staffPentestStatsContract,
+    staffQueue: staffQueueContract
   },
   {
     pathPrefix: "/v1"
@@ -36692,8 +36943,8 @@ var v1Contract = c49.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c50 = initContract();
-var contract = c50.router({
+var c51 = initContract();
+var contract = c51.router({
   v1: v1Contract
 });
 
@@ -36703,8 +36954,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c51 = initContract();
-var githubWebhookContract = c51.router(
+var c52 = initContract();
+var githubWebhookContract = c52.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36722,7 +36973,7 @@ var githubWebhookContract = c51.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c51.router(
+var githubReadonlyWebhookContract = c52.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36742,9 +36993,9 @@ var githubReadonlyWebhookContract = c51.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c52 = initContract();
+var c53 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c52.router(
+var linearWebhookContract = c53.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36764,7 +37015,7 @@ var linearWebhookContract = c52.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c53 = initContract();
+var c54 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -36793,7 +37044,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c53.router(
+var forgeBitbucketContract = c54.router(
   {
     lifecycle: {
       method: "POST",
@@ -36840,8 +37091,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c54 = initContract();
-var healthContract = c54.router({
+var c55 = initContract();
+var healthContract = c55.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -36853,8 +37104,8 @@ var healthContract = c54.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c55 = initContract();
-var vulnerabilityShareContract = c55.router(
+var c56 = initContract();
+var vulnerabilityShareContract = c56.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -36941,8 +37192,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c56 = initContract();
-var prVulnerabilityContract = c56.router(
+var c57 = initContract();
+var prVulnerabilityContract = c57.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -37811,6 +38062,10 @@ function getApiBaseUrl() {
   }
   return raw.replace(/\/+$/, "");
 }
+function requireAuth() {
+  const credential = loadCredentialOrExit();
+  return { token: credential.token, kind: credential.kind };
+}
 function loadCredentialOrExit() {
   const credential = resolveCredentialOrExit();
   if (!credential) {
@@ -39646,12 +39901,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c58) => c58.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c58) => c58.type.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c59) => c59.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.name.padEnd(nameWidth)}  ${c58.type.padEnd(typeWidth)}  ${c58.repos.padStart(5)}  ${c58.url}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.name.padEnd(nameWidth)}  ${c59.type.padEnd(typeWidth)}  ${c59.repos.padStart(5)}  ${c59.url}`
   );
   return { header, rows };
 }
@@ -39671,12 +39926,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c58) => c58.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c58) => c58.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c58) => c58.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c59) => c59.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c59) => c59.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c59) => c59.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c58) => `${c58.name.padEnd(nameWidth)}  ${c58.scan.padEnd(4)}  ${c58.role.padEnd(roleWidth)}  ${c58.path.padEnd(pathWidth)}  ${c58.status}`
+    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.scan.padEnd(4)}  ${c59.role.padEnd(roleWidth)}  ${c59.path.padEnd(pathWidth)}  ${c59.status}`
   );
   return { header, rows };
 }
@@ -40461,8 +40716,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c58, i2, m2) => {
-    const d = n3 ? n3(c58, i2) : c58;
+`).map((c59, i2, m2) => {
+    const d = n3 ? n3(c59, i2) : c59;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -40960,14 +41215,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c58 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c59 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c58 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c58 ? 1 : 0);
+  d && g++, c59 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c59 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -40988,14 +41243,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c58 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c58 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c58 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c59 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c58 && x.push(M), x;
+  return c59 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -41014,15 +41269,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c58 = this.value ? a2 : s;
+`, c59 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c58)}`;
+          return `${o2}${r2}${styleText2("dim", c59)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c58)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c59)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -41170,13 +41425,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c58 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c59 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c58}
+${u4}  ${styleText2("yellow", this.error)}${c59}
 `;
       }
       case "submit": {
@@ -41204,7 +41459,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c58}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c58}
+${r2}${c59}
 `;
       }
     }
@@ -41219,7 +41474,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c58 = this.userInputWithCursor, i2 = this.masked;
+`, c59 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -41239,7 +41494,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c58}
+        return `${o2}${s}${c59}
 ${n3}
 `;
       }
@@ -41255,7 +41510,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c57 = (t2, o2) => t2.includes(`
+var c58 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -41266,15 +41521,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c57(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c57(s, (i2) => styleText2("dim", i2))}`;
+        return `${c58(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c57(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c58(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c57(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -42334,7 +42589,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c58) => !c58._hidden).map((c58) => extractCommandTree(c58));
+  const subcommands = cmd.commands.filter((c59) => !c59._hidden).map((c59) => extractCommandTree(c59));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -42400,7 +42655,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c58) => c58.name);
+  const subcommandNames = tree.subcommands.map((c59) => c59.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -42815,9 +43070,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c58) => c58.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c59) => c59.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c58) => `${c58.address.padEnd(addressWidth)}  ${c58.label}`);
+  const rows = cells.map((c59) => `${c59.address.padEnd(addressWidth)}  ${c59.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -42841,14 +43096,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c58) => c58.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c58) => c58.from.length));
-  const toWidth = Math.max(2, ...cells.map((c58) => c58.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c58) => c58.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c59) => c59.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c59) => c59.from.length));
+  const toWidth = Math.max(2, ...cells.map((c59) => c59.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c59) => c59.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.received.padEnd(receivedWidth)}  ${c58.from.padEnd(fromWidth)}  ${c58.to.padEnd(toWidth)}  ${c58.subject.padEnd(subjectWidth)}  ${c58.unread}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.received.padEnd(receivedWidth)}  ${c59.from.padEnd(fromWidth)}  ${c59.to.padEnd(toWidth)}  ${c59.subject.padEnd(subjectWidth)}  ${c59.unread}`
   );
   return { header, rows };
 }
@@ -43076,14 +43331,14 @@ async function runEmails(label, options) {
   const output = parseOutput(options.output);
   requireInboxLabel(label);
   const limit = parseEmailLimit(options.limit);
-  const since = parseEmailSince(options.since);
+  const since2 = parseEmailSince(options.since);
   const organizationId = await resolveOrganizationId();
   const result = await authenticatedRequest(
     (client) => client.inbox.listInboxMessages({
       params: { organizationId, label },
       query: {
         ...limit !== void 0 ? { limit } : {},
-        ...since !== void 0 ? { since } : {}
+        ...since2 !== void 0 ? { since: since2 } : {}
       }
     })
   );
@@ -43576,16 +43831,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c58) => ({
-    id: c58.credentialId,
-    label: sanitizeDisplay(c58.label),
-    type: c58.credentialType
+  const cells = creds.map((c59) => ({
+    id: c59.credentialId,
+    label: sanitizeDisplay(c59.label),
+    type: c59.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c58) => c58.label.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c59) => c59.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.label.padEnd(labelWidth)}  ${c58.type}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.label.padEnd(labelWidth)}  ${c59.type}`
   );
   return { header, rows };
 }
@@ -44313,14 +44568,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c58) => c58.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c59) => c59.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c58) => c58.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c58) => c58.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c59) => c59.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c58) => `${padLeading(c58.leading)}  ${c58.name.padEnd(nameWidth)}  ${c58.prod.padEnd(4)}  ${c58.url}`
+      (c59) => `${padLeading(c59.leading)}  ${c59.name.padEnd(nameWidth)}  ${c59.prod.padEnd(4)}  ${c59.url}`
     )
   };
 }
@@ -45317,11 +45572,26 @@ function isPentestIdentifier(value) {
 function isFindingIdentifier(value) {
   return FINDING_IDENTIFIER_PATTERN.test(value);
 }
-function failStatusUpdate(status, body) {
+function failStatusUpdate(status, body, viaApiKey) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
   }
+  if (status === 403 && viaApiKey) {
+    console.error(
+      colorError(
+        `${message ?? "Request failed (status 403)."}
+API keys can update finding status once Trace enables finding automation for your organization. Ask Trace to turn it on, or run this with \`tracecli auth login\`.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 409 && errorCode === "FINDING_STALE") {
+    console.error(
+      colorError(message ?? "The finding changed while this update was in flight. Retry it.")
+    );
+    process.exit(1);
+  }
   if (status === 404) {
     console.error(colorError(message ?? "Pentest or finding not found."));
     process.exit(1);
@@ -45398,13 +45668,19 @@ async function runStatusUpdate(options) {
     );
     process.exit(1);
   }
+  const viaApiKey = requireAuth().kind === "api_key";
   const organizationId = await resolveOrganizationId();
   const params = {
     organizationId,
     pentestId: options.pentest,
     pentestFindingId: options.finding
   };
-  const result = target === "IN_PROGRESS" ? await authenticatedRequest(
+  const result = viaApiKey ? await authenticatedRequest(
+    (client) => client.pentestFinding.automationStatusUpdate({
+      params,
+      body: { status: target, ...note !== void 0 ? { note } : {} }
+    })
+  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
     (client) => client.pentestFinding.startProgress({ params, body: {} })
   ) : await authenticatedRequest(
     (client) => client.pentestFinding.reportRemediation({
@@ -45413,7 +45689,7 @@ async function runStatusUpdate(options) {
     })
   );
   if (result.status !== 200) {
-    failStatusUpdate(result.status, result.body);
+    failStatusUpdate(result.status, result.body, viaApiKey);
   }
   if (options.output === "json") {
     console.log(JSON.stringify(result.body, null, 2));
@@ -45436,8 +45712,12 @@ fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
 sending REMEDIATED) keeps it out of the retest queue.
 
 IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN. Requires \`tracecli auth login\` (API keys
-are rejected \u2014 the change is attributed to the signed-in user).
+OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+
+A signed-in session (\`tracecli auth login\`) attributes the change to you. A
+Trace API key works too, once Trace enables finding automation for your
+organization: those writes are recorded as \`api-key:<key name>\` and show up as
+yours in the finding's history.
 
 Examples:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS