securewithtrace 0.37.0 → 0.39.0

package/dist/index.js

@@ -6276,7 +6276,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c58) => c58 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c59) => c59 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16320,9 +16320,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c58 = inst._zod.bag;
-  inst.minDate = c58.minimum ? new Date(c58.minimum) : null;
-  inst.maxDate = c58.maximum ? new Date(c58.maximum) : null;
+  const c59 = inst._zod.bag;
+  inst.minDate = c59.minimum ? new Date(c59.minimum) : null;
+  inst.maxDate = c59.maximum ? new Date(c59.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -21998,7 +21998,7 @@ var PentestEditActionValues = [
   "DELIVER"
 ];
 var PentestEditAction = external_exports.enum(PentestEditActionValues);
-var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT"];
+var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY"];
 var PentestAuditActorType = external_exports.enum(PentestAuditActorTypeValues);
 var PentestHypothesisStatusValues = [
   "DRAFTED",
@@ -23008,6 +23008,263 @@ var LinearTicketContextResponseSchema = external_exports.object({
 var AttestationClassificationValues = ["PUBLIC", "CONFIDENTIAL"];
 var AttestationClassification = external_exports.enum(AttestationClassificationValues);
 
+// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
+var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
+var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
+var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
+  repositoryId: external_exports.uuid()
+});
+var CreateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var UpdateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url().optional(),
+  platform: external_exports.enum(PlatformValues).optional(),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var RepositoryResponseSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  status: external_exports.enum(RepositoryStatusValues),
+  githubDefaultBranch: external_exports.string(),
+  scanningBranch: external_exports.string().nullable(),
+  primaryLanguage: external_exports.string().nullable().optional(),
+  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
+  prScansEnabled: external_exports.boolean(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var SetPrScansEnabledRequestSchema = external_exports.object({
+  enabled: external_exports.boolean()
+});
+var StaffRepositoryPrScanSettingSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
+  fullName: external_exports.string().nullable(),
+  repositoryUrl: external_exports.url(),
+  /** The staff-set opt-in arm of the gate. */
+  prScansEnabled: external_exports.boolean(),
+  /**
+   * The implicit arm: a completed FULL SAST scan exists for this repo (any
+   * branch). With the org capability granted, either arm open means PR scans run.
+   */
+  hasSastBaseline: external_exports.boolean()
+});
+var StaffPrScanSettingsResponseSchema = external_exports.object({
+  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
+  orgHasAutoPrScans: external_exports.boolean(),
+  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
+});
+var CloneTokenRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.string().url()
+});
+var CloneTokenResponseSchema = external_exports.object({
+  token: external_exports.string(),
+  expiresAt: external_exports.string().datetime(),
+  // Git username scheme to pair with this token. GitHub installation tokens
+  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
+  // for back-compat with CLIs that predate Bitbucket support and hardcode
+  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
+  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
+});
+var ScanningBranchHistoryEntrySchema = external_exports.object({
+  historyId: external_exports.uuid(),
+  branch: external_exports.string(),
+  configuredAt: external_exports.date(),
+  replacedAt: external_exports.date(),
+  configuredByUserId: external_exports.uuid().nullable()
+});
+var ScanningBranchStateSchema = external_exports.object({
+  scanningBranch: external_exports.string().nullable(),
+  githubDefaultBranch: external_exports.string(),
+  history: external_exports.array(ScanningBranchHistoryEntrySchema)
+});
+var SetScanningBranchRequestSchema = external_exports.object({
+  branch: external_exports.string().min(1).max(255),
+  migrateOpenVulnerabilities: external_exports.boolean(),
+  /**
+   * Optional compare-and-swap guard. When provided, the switch only commits
+   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
+   * `null` means "expect this repo to still be unconfigured."
+   */
+  expectedCurrentBranch: external_exports.string().nullable().optional()
+});
+var SetScanningBranchResponseSchema = external_exports.object({
+  previousBranch: external_exports.string().nullable(),
+  newBranch: external_exports.string(),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0),
+  /** Null when previousBranch was null (initial configuration). */
+  historyId: external_exports.uuid().nullable()
+});
+var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
+  external_exports.object({ kind: external_exports.literal("github-default") })
+]);
+var BulkSetScanningBranchRequestSchema = external_exports.object({
+  branch: BulkSetScanningBranchBranchSchema,
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
+  migrateOpenVulnerabilities: external_exports.boolean()
+});
+var BulkSetScanningBranchResultStatusValues = [
+  "switched",
+  "branch-missing-on-github",
+  "forbidden",
+  "already-on-branch",
+  "not-found",
+  "error"
+];
+var BulkSetScanningBranchResultSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
+  historyId: external_exports.uuid().nullable().optional(),
+  errorMessage: external_exports.string().optional()
+});
+var BulkSetScanningBranchResponseSchema = external_exports.object({
+  results: external_exports.array(BulkSetScanningBranchResultSchema)
+});
+var ScanningBranchPreferenceSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.boolean()
+});
+var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.literal(true),
+  /** Repos the sweep configured to their default-branch mirror. */
+  configuredCount: external_exports.number().int().min(0),
+  /**
+   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
+   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
+   */
+  skippedCount: external_exports.number().int().min(0)
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
+var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
+var APPLICATION_NOTES_MAX_CHARS = 2e3;
+var ApplicationRepositoryRoleValues = [
+  "FRONTEND",
+  "BACKEND_API",
+  "AUTH_SERVICE",
+  "WORKER_JOB_SERVICE",
+  "SHARED_PACKAGE_SDK",
+  "INFRASTRUCTURE_IAC",
+  "MOBILE_CLIENT",
+  "MONOREPO",
+  "OTHER"
+];
+var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
+  applicationId: external_exports.uuid()
+});
+var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
+  applicationRepositoryId: external_exports.uuid()
+});
+var ApplicationRepositorySummarySchema = external_exports.object({
+  applicationRepositoryId: external_exports.uuid().nullable(),
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryId: external_exports.uuid(),
+  repositoryName: external_exports.string(),
+  repositoryUrl: external_exports.string(),
+  repositoryStatus: external_exports.enum(RepositoryStatusValues),
+  htmlUrl: external_exports.string().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
+var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
+  // First of `roles` (enum order), or null when unspecified. Kept so a new
+  // client reading a pre-this-release API during a rolling deploy still parses.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
+  // Source of truth. Defaulted empty so a new client reading a pre-this-release
+  // API that omitted the field doesn't reject the row; the client then falls
+  // back to wrapping `role`.
+  roles: ApplicationRepositoryRolesSchema.default([]),
+  roleLabel: external_exports.string().max(120).nullable(),
+  repositoryPath: external_exports.string().max(500).nullable(),
+  scanEnabled: external_exports.boolean()
+});
+var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
+  ApplicationRepositoryLinkResponseSchema
+);
+var ApplicationResponseSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  name: external_exports.string(),
+  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
+  // never emitted `type` parses cleanly (existing apps are semantically WEB),
+  // so a new frontend reading an old API during a mixed-version rollout doesn't
+  // reject application rows.
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.string().nullable(),
+  // Customer-authored free-text context, any type ("Advanced → Notes").
+  notes: external_exports.string().nullable(),
+  helpCenterUrl: external_exports.string().nullable(),
+  documentationUrl: external_exports.string().nullable(),
+  repositories: external_exports.array(ApplicationRepositorySummarySchema),
+  // Registrable domains RECON is authorized to discover subdomains under. The
+  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
+  // (like `type`) so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject application rows that predate the field.
+  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
+  // reading a pre-this-release API during a rolling deploy doesn't reject rows
+  // that omit the field. The raw S3 key is never on the wire.
+  screenshotUrl: external_exports.url().nullable().default(null),
+  // Defaulted null so a new client reading a pre-this-release API during a
+  // rolling deploy doesn't reject application rows that omit the field.
+  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
+var CreateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200),
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
+  repositoryId: external_exports.uuid().optional(),
+  repositoryPath: external_exports.string().max(500).optional(),
+  helpCenterUrl: external_exports.url().max(2048).optional(),
+  documentationUrl: external_exports.url().max(2048).optional()
+}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
+  path: ["applicationUrl"],
+  message: "A web or API application requires an application URL."
+}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
+  path: ["applicationUrl"],
+  message: "Only web or API applications can have an application URL."
+});
+var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200).optional(),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
+  repositoryId: external_exports.uuid().nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
+  documentationUrl: external_exports.url().max(2048).nullable().optional()
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-report-pdf.api.ts
 var ReportPdfPentestParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -23093,6 +23350,28 @@ var PartnerNarrativeJsonSchema = external_exports.object({
     notExploitable: external_exports.string().max(4e3).optional()
   })
 });
+var BskNarrativeSectionIdValues = [
+  "engagement_context",
+  "platform_and_data",
+  "overall_assessment",
+  "findings_overview",
+  "target",
+  "approach",
+  "limitations",
+  "not_exploitable"
+];
+var BskNarrativeSectionId = external_exports.enum(BskNarrativeSectionIdValues);
+var TraceNarrativeSectionIdValues = [
+  "executive_summary",
+  "scope_summary",
+  "key_themes"
+];
+var ReportWriteSectionIdValues = [
+  ...TraceNarrativeSectionIdValues,
+  ...BskNarrativeSectionIdValues
+];
+var ReportWriteSectionId = external_exports.enum(ReportWriteSectionIdValues);
+var REPORT_SECTION_CONTENT_MAX_CHARS = 4e3;
 var SeverityCountsSchema = external_exports.object({
   critical: external_exports.int().min(0),
   high: external_exports.int().min(0),
@@ -23415,6 +23694,8 @@ var ApplyReportSettingsRequestSchema = external_exports.object({
   includeRemediationTimeline: external_exports.boolean(),
   expectedUpdatedAt: external_exports.coerce.date().nullable()
 });
+var CustomerReportDownloadFormatValues = ["pdf", "bundle"];
+var CustomerReportDownloadFormatSchema = external_exports.enum(CustomerReportDownloadFormatValues);
 var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
   organizationId: true,
   pentestId: true,
@@ -23446,7 +23727,14 @@ var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
    * before the API's, so a new bundle briefly reads an old API's response, where
    * this field does not exist. Consumers default it to false.
    */
-  canViewInline: external_exports.boolean().optional()
+  canViewInline: external_exports.boolean().optional(),
+  /**
+   * What the Download action hands the customer: the PDF alone, or one zip
+   * carrying the PDF, the markdown report, and the evidence files (partner
+   * templates whose tooling consumes the markdown). Preview always opens the
+   * PDF. Optional for the deploy-order reason above; consumers default to 'pdf'.
+   */
+  downloadFormat: CustomerReportDownloadFormatSchema.optional()
 });
 var GetCustomerReportPdfResponseSchema = external_exports.object({
   report: CustomerReportPdfResponseSchema.nullable()
@@ -23566,6 +23854,12 @@ var IssuedReportSnapshotSchema = external_exports.object({
      * parses those rows for the changelog diff — a required field would throw
      * there and break issuing a new version of any pre-feature report. */
     testType: PentestTestType.optional(),
+    /** Types of the applications bound at issuance: the archival record of which
+     * OWASP families the delivered PDF named. Optional for the same reason as
+     * `testType` above: a pre-feature snapshot has no value, and
+     * `latestIssuedSnapshot` parses those rows for the changelog diff. Absent
+     * re-renders as the web family, matching what those reports contain. */
+    applicationTypes: external_exports.array(external_exports.enum(ApplicationTypeValues)).optional(),
     versionLabel: external_exports.string(),
     revisionCount: external_exports.int().min(1)
   }),
@@ -24390,15 +24684,34 @@ var StartProgressPentestFindingRequestSchema = external_exports.object({});
 var ReportRemediationPentestFindingRequestSchema = external_exports.object({
   note: external_exports.string().trim().min(1).max(1e4).optional()
 });
+var AutomationFindingTransitionSchema = external_exports.enum(["IN_PROGRESS", "REMEDIATED"]);
+var AutomationStatusUpdateRequestSchema = external_exports.object({
+  status: AutomationFindingTransitionSchema,
+  note: external_exports.string().trim().min(1).max(1e4).optional()
+}).refine((value) => value.note === void 0 || value.status === "REMEDIATED", {
+  message: "note is only accepted when reporting remediation (status REMEDIATED)",
+  path: ["note"]
+});
 var ReopenPentestFindingTargetStatusSchema = external_exports.enum(["OPEN", "IN_PROGRESS"]);
 var ReopenPentestFindingRequestSchema = external_exports.object({
   targetStatus: ReopenPentestFindingTargetStatusSchema,
   noteContent: external_exports.string().trim().min(1).max(1e4)
 });
+var retestVerificationOnlyOnFixed = (value, ctx) => {
+  if (value.outcome !== "FIXED" && value.verification !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "verification report prose is only allowed when outcome is FIXED",
+      path: ["verification"]
+    });
+  }
+};
 var CreatePentestFindingRetestRequestSchema = external_exports.object({
   outcome: ManualRetestOutcome,
-  notes: external_exports.string().trim().min(1).max(1e4)
+  notes: external_exports.string().trim().min(1).max(1e4),
+  verification: external_exports.string().trim().min(1).max(8e3).optional()
 });
+var CreatePentestFindingRetestBodySchema = CreatePentestFindingRetestRequestSchema.superRefine(retestVerificationOnlyOnFixed);
 var CreatePentestFindingNoteRequestSchema = external_exports.object({
   content: external_exports.string().min(1).max(1e4)
 });
@@ -24592,263 +24905,6 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
   manualFindingIds: HypothesisSourceIdsSchema.optional()
 }).strict().optional();
 
-// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
-var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
-var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
-var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
-  repositoryId: external_exports.uuid()
-});
-var CreateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var UpdateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url().optional(),
-  platform: external_exports.enum(PlatformValues).optional(),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var RepositoryResponseSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  status: external_exports.enum(RepositoryStatusValues),
-  githubDefaultBranch: external_exports.string(),
-  scanningBranch: external_exports.string().nullable(),
-  primaryLanguage: external_exports.string().nullable().optional(),
-  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
-  prScansEnabled: external_exports.boolean(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
-var SetPrScansEnabledRequestSchema = external_exports.object({
-  enabled: external_exports.boolean()
-});
-var StaffRepositoryPrScanSettingSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
-  fullName: external_exports.string().nullable(),
-  repositoryUrl: external_exports.url(),
-  /** The staff-set opt-in arm of the gate. */
-  prScansEnabled: external_exports.boolean(),
-  /**
-   * The implicit arm: a completed FULL SAST scan exists for this repo (any
-   * branch). With the org capability granted, either arm open means PR scans run.
-   */
-  hasSastBaseline: external_exports.boolean()
-});
-var StaffPrScanSettingsResponseSchema = external_exports.object({
-  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
-  orgHasAutoPrScans: external_exports.boolean(),
-  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
-});
-var CloneTokenRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.string().url()
-});
-var CloneTokenResponseSchema = external_exports.object({
-  token: external_exports.string(),
-  expiresAt: external_exports.string().datetime(),
-  // Git username scheme to pair with this token. GitHub installation tokens
-  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
-  // for back-compat with CLIs that predate Bitbucket support and hardcode
-  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
-  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
-});
-var ScanningBranchHistoryEntrySchema = external_exports.object({
-  historyId: external_exports.uuid(),
-  branch: external_exports.string(),
-  configuredAt: external_exports.date(),
-  replacedAt: external_exports.date(),
-  configuredByUserId: external_exports.uuid().nullable()
-});
-var ScanningBranchStateSchema = external_exports.object({
-  scanningBranch: external_exports.string().nullable(),
-  githubDefaultBranch: external_exports.string(),
-  history: external_exports.array(ScanningBranchHistoryEntrySchema)
-});
-var SetScanningBranchRequestSchema = external_exports.object({
-  branch: external_exports.string().min(1).max(255),
-  migrateOpenVulnerabilities: external_exports.boolean(),
-  /**
-   * Optional compare-and-swap guard. When provided, the switch only commits
-   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
-   * `null` means "expect this repo to still be unconfigured."
-   */
-  expectedCurrentBranch: external_exports.string().nullable().optional()
-});
-var SetScanningBranchResponseSchema = external_exports.object({
-  previousBranch: external_exports.string().nullable(),
-  newBranch: external_exports.string(),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0),
-  /** Null when previousBranch was null (initial configuration). */
-  historyId: external_exports.uuid().nullable()
-});
-var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
-  external_exports.object({ kind: external_exports.literal("github-default") })
-]);
-var BulkSetScanningBranchRequestSchema = external_exports.object({
-  branch: BulkSetScanningBranchBranchSchema,
-  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
-  migrateOpenVulnerabilities: external_exports.boolean()
-});
-var BulkSetScanningBranchResultStatusValues = [
-  "switched",
-  "branch-missing-on-github",
-  "forbidden",
-  "already-on-branch",
-  "not-found",
-  "error"
-];
-var BulkSetScanningBranchResultSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
-  historyId: external_exports.uuid().nullable().optional(),
-  errorMessage: external_exports.string().optional()
-});
-var BulkSetScanningBranchResponseSchema = external_exports.object({
-  results: external_exports.array(BulkSetScanningBranchResultSchema)
-});
-var ScanningBranchPreferenceSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.boolean()
-});
-var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.literal(true),
-  /** Repos the sweep configured to their default-branch mirror. */
-  configuredCount: external_exports.number().int().min(0),
-  /**
-   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
-   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
-   */
-  skippedCount: external_exports.number().int().min(0)
-});
-
-// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
-var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
-var APPLICATION_NOTES_MAX_CHARS = 2e3;
-var ApplicationRepositoryRoleValues = [
-  "FRONTEND",
-  "BACKEND_API",
-  "AUTH_SERVICE",
-  "WORKER_JOB_SERVICE",
-  "SHARED_PACKAGE_SDK",
-  "INFRASTRUCTURE_IAC",
-  "MOBILE_CLIENT",
-  "MONOREPO",
-  "OTHER"
-];
-var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
-  applicationId: external_exports.uuid()
-});
-var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
-  applicationRepositoryId: external_exports.uuid()
-});
-var ApplicationRepositorySummarySchema = external_exports.object({
-  applicationRepositoryId: external_exports.uuid().nullable(),
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  repositoryName: external_exports.string(),
-  repositoryUrl: external_exports.string(),
-  repositoryStatus: external_exports.enum(RepositoryStatusValues),
-  htmlUrl: external_exports.string().nullable(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
-var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
-  // First of `roles` (enum order), or null when unspecified. Kept so a new
-  // client reading a pre-this-release API during a rolling deploy still parses.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
-  // Source of truth. Defaulted empty so a new client reading a pre-this-release
-  // API that omitted the field doesn't reject the row; the client then falls
-  // back to wrapping `role`.
-  roles: ApplicationRepositoryRolesSchema.default([]),
-  roleLabel: external_exports.string().max(120).nullable(),
-  repositoryPath: external_exports.string().max(500).nullable(),
-  scanEnabled: external_exports.boolean()
-});
-var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
-  ApplicationRepositoryLinkResponseSchema
-);
-var ApplicationResponseSchema = external_exports.object({
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  name: external_exports.string(),
-  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
-  // never emitted `type` parses cleanly (existing apps are semantically WEB),
-  // so a new frontend reading an old API during a mixed-version rollout doesn't
-  // reject application rows.
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.string().nullable(),
-  // Customer-authored free-text context, any type ("Advanced → Notes").
-  notes: external_exports.string().nullable(),
-  helpCenterUrl: external_exports.string().nullable(),
-  documentationUrl: external_exports.string().nullable(),
-  repositories: external_exports.array(ApplicationRepositorySummarySchema),
-  // Registrable domains RECON is authorized to discover subdomains under. The
-  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
-  // (like `type`) so a new client reading a pre-this-release API during a rolling
-  // deploy doesn't reject application rows that predate the field.
-  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
-  // reading a pre-this-release API during a rolling deploy doesn't reject rows
-  // that omit the field. The raw S3 key is never on the wire.
-  screenshotUrl: external_exports.url().nullable().default(null),
-  // Defaulted null so a new client reading a pre-this-release API during a
-  // rolling deploy doesn't reject application rows that omit the field.
-  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
-var CreateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200),
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
-  repositoryId: external_exports.uuid().optional(),
-  repositoryPath: external_exports.string().max(500).optional(),
-  helpCenterUrl: external_exports.url().max(2048).optional(),
-  documentationUrl: external_exports.url().max(2048).optional()
-}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
-  path: ["applicationUrl"],
-  message: "A web or API application requires an application URL."
-}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
-  path: ["applicationUrl"],
-  message: "Only web or API applications can have an application URL."
-});
-var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200).optional(),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
-  repositoryId: external_exports.uuid().nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
-  documentationUrl: external_exports.url().max(2048).nullable().optional()
-}).strict();
-
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -25289,13 +25345,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c58, i2) => {
-    const d = c58.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c59, i2) => {
+    const d = c59.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c58.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c59.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -25993,7 +26049,19 @@ var AgentSessionLoginCodeResponseSchema = external_exports.object({
 var AgentSessionTotpCodeRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   /** Which account (by `Credential.label`); omit if exactly one is enrolled. */
-  credentialLabel: external_exports.string().min(1).max(200).optional()
+  credentialLabel: external_exports.string().min(1).max(200).optional(),
+  /**
+   * Which account by ID, which is what a DESKTOP session holds.
+   *
+   * `Credential.label` is unique per ENVIRONMENT, not per pentest, so an
+   * engagement spanning staging and production can carry two accounts labelled
+   * `admin` and the label identifies neither. The desktop credential catalog
+   * hands the agent an unambiguous id, and without this the only way to use an
+   * enrolled desktop account was to ask staff to relabel one mid-engagement.
+   *
+   * Wins over `credentialLabel` when both are given.
+   */
+  credentialId: external_exports.uuid().optional()
 });
 var AgentSessionTotpCodeResponseSchema = external_exports.object({
   /** The account the code belongs to, echoed so the agent can name it. */
@@ -26393,17 +26461,9 @@ var OperatorRecordFindingRetestRequestSchema = CreatePentestFindingRetestRequest
   runVersion: operatorRunVersion,
   reason: operatorReason,
   pentestFindingId: external_exports.uuid(),
-  outcome: RetestOutcome,
-  verification: external_exports.string().min(1).max(8e3).optional()
-}).superRefine((v, ctx) => {
-  if (v.outcome !== "FIXED" && v.verification !== void 0) {
-    ctx.addIssue({
-      code: "custom",
-      message: "verification report prose is only allowed when outcome is FIXED",
-      path: ["verification"]
-    });
-  }
-});
+  // Widened from the dashboard's 3 values; `verification` comes from the base.
+  outcome: RetestOutcome
+}).superRefine(retestVerificationOnlyOnFixed);
 var OperatorRetestAckSchema = OperatorFindingReadSchema.extend({
   retestId: external_exports.uuid()
 });
@@ -26564,7 +26624,21 @@ var ReportSessionCoverSchema = external_exports.object({
   classification: AttestationClassification,
   documentId: external_exports.string(),
   testingWindowStart: external_exports.string().nullable(),
-  testingWindowEnd: external_exports.string().nullable()
+  testingWindowEnd: external_exports.string().nullable(),
+  /**
+   * The engagement approach in the exact words the rendered document prints
+   * ("white-box" / "authenticated grey-box" / "black-box", from the pentest's
+   * `testType`).
+   *
+   * Here because the agent writing an Approach section otherwise cannot know it,
+   * while the BSK document's methodology appendix prints it three paragraphs
+   * later — one page apart and flatly contradictory in a partner deliverable.
+   *
+   * Optional for the reason the whole view is: the host reads this response with
+   * a raw cast and no validation, so a host running against an older api would
+   * read a required-typed field as `undefined`.
+   */
+  approachLabel: external_exports.string().optional()
 });
 var ReportSessionViewSchema = external_exports.object({
   rendered: external_exports.boolean(),
@@ -26575,7 +26649,19 @@ var ReportSessionViewSchema = external_exports.object({
     keyThemes: external_exports.array(KeyThemeSchema)
   }),
   scopeRows: external_exports.array(ScopeRowSchema),
-  updatedAt: external_exports.string().nullable()
+  updatedAt: external_exports.string().nullable(),
+  /** Which template this org's report renders with. Absent = TRACE (older api). */
+  reportTemplate: PentestReportTemplateSchema.optional(),
+  /**
+   * The BSK partner narrative as stored; null when nothing is written, absent on
+   * a TRACE org (or an older api).
+   *
+   * A section key ABSENT from `sections` has not been written yet. That is the
+   * BSK agent's only channel for "which of my eight sections already exist", and
+   * every write returns this view, so a follow-up or resumed session reads it
+   * back rather than re-authoring all eight.
+   */
+  partnerNarrative: PartnerNarrativeJsonSchema.nullable().optional()
 });
 var reportRunVersion = external_exports.number().int().nonnegative();
 var reportReason = external_exports.string().min(1).max(2e3);
@@ -26587,8 +26673,8 @@ var ReportWriteSectionRequestSchema = external_exports.object({
   runVersion: reportRunVersion,
   reason: reportReason,
   expectedUpdatedAt: reportExpectedUpdatedAt,
-  section: external_exports.enum(["executive_summary", "scope_summary", "key_themes"]),
-  content: external_exports.string().min(1).max(2e3).optional(),
+  section: ReportWriteSectionId,
+  content: external_exports.string().min(1).max(REPORT_SECTION_CONTENT_MAX_CHARS).optional(),
   themes: external_exports.array(KeyThemeSchema).max(4).optional()
 });
 var ReportUpdateScopeRequestSchema = external_exports.object({
@@ -26602,13 +26688,24 @@ var RequestDesktopTargetRequestSchema = external_exports.object({
   /** Only Windows exists; a literal keeps the macOS follow-on additive. */
   platform: external_exports.literal("WINDOWS")
 });
+var DesktopCredentialRefSchema = external_exports.object({
+  credentialId: external_exports.uuid(),
+  label: external_exports.string(),
+  credentialType: external_exports.enum(CredentialTypeValues),
+  environmentId: external_exports.uuid(),
+  /** Present when the account has a second factor enrolled. `get_totp_code`
+   *  resolves by LABEL, which is not unique per pentest, so an enrolled desktop
+   *  account would otherwise dead-end. */
+  mfaKind: CredentialMfaKind.nullable()
+});
 var RequestDesktopTargetResponseSchema = external_exports.object({
   desktopTargetId: external_exports.uuid(),
   status: external_exports.enum(DesktopTargetStatusValues),
   /** True when this session already owned a live box, so a second call in one
    *  assistant turn cannot bill a second instance. */
   reused: external_exports.boolean(),
-  screen: external_exports.object({ width: external_exports.number().int().positive(), height: external_exports.number().int().positive() })
+  screen: external_exports.object({ width: external_exports.number().int().positive(), height: external_exports.number().int().positive() }),
+  credentials: external_exports.array(DesktopCredentialRefSchema)
 });
 var DesktopTargetStatusRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
@@ -26654,7 +26751,15 @@ var DesktopActionViewSchema = external_exports.object({
    * so a caller-chosen name is how an unredacted clip would publish as a
    * customer-facing screenshot.
    */
-  artifactName: external_exports.string().max(256).nullable()
+  artifactName: external_exports.string().max(256).nullable(),
+  /**
+   * Shape-only reason a FAILED action carries. Load-bearing for `type_secret`:
+   * claim-time substitution fails the action with one of three codes
+   * (`credential_not_found`, `credential_field_absent`, `decrypt_failed`), and
+   * without this projection the agent could not tell those apart from a box
+   * that crashed.
+   */
+  failureDetails: external_exports.string().nullable()
 });
 var ReadDesktopActionRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
@@ -31977,7 +32082,8 @@ var OrgCapabilityValues = [
   "SCAN_SECRETS",
   "SCAN_DAST",
   "AUTO_PR_SCANS",
-  "AUTO_PUSH_SCANS"
+  "AUTO_PUSH_SCANS",
+  "PENTEST_FINDING_AUTOMATION"
 ];
 var UpdateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().min(1).max(255).optional(),
@@ -34270,6 +34376,28 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // ─── Automation lifecycle transition (API keys) ───
+  // A separate route rather than a widened `start-progress` / `report-remediation`:
+  // those stay human-only, and everything that makes a machine-driven write
+  // different lives here. API-key principals only, gated on the org owning
+  // PENTEST_FINDING_AUTOMATION, and audited as API_KEY with the key's name.
+  automationStatusUpdate: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/automation/status",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: AutomationStatusUpdateRequestSchema,
+    responses: {
+      200: CustomerPentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // FINDING_TRANSITION_NOT_ALLOWED (bad source status), FINDING_STALE
+      // (concurrent write), or PENTEST_CLOSED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Customer opens a dispute (PR 3) → finding status CONTESTED. Same auth as the
   // other customer transitions (VIEW_RESULTS + user principal + customer visibility).
   contest: {
@@ -34362,7 +34490,7 @@ var pentestFindingContract = c35.router({
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/retests",
     pathParams: PentestFindingIdParamsSchema,
-    body: CreatePentestFindingRetestRequestSchema,
+    body: CreatePentestFindingRetestBodySchema,
     responses: {
       201: PentestFindingRetestResponseSchema,
       400: ErrorResponseSchema,
@@ -35466,6 +35594,128 @@ var staffPentestStatsContract = c42.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/staff-queue.api.ts
+var StaffQueueItemKindValues = [
+  "RETEST_OWED",
+  "CONTESTED",
+  "SESSION_WAITING",
+  "SESSION_FAILED",
+  "REVIEW_GATE",
+  "INTAKE_SUBMITTED"
+];
+var StaffQueueItemKind = external_exports.enum(StaffQueueItemKindValues);
+var STAFF_QUEUE_EXCERPT_MAX = 280;
+var since = external_exports.iso.datetime();
+var findingIdentity = {
+  pentestFindingId: external_exports.uuid(),
+  /** Null until published; the finding is then named by title alone. */
+  displayId: external_exports.int().positive().nullable(),
+  title: external_exports.string(),
+  severity: PentestFindingSeverity,
+  /** False for a finding the customer has never seen; they are not the one waiting. */
+  published: external_exports.boolean()
+};
+var StaffQueueRetestOwedItemSchema = external_exports.object({
+  kind: external_exports.literal("RETEST_OWED"),
+  since,
+  ...findingIdentity,
+  /** The most recent automatic retest, when one ran and did not settle it. */
+  lastAutoRetest: external_exports.object({ outcome: RetestOutcome, testedAt: external_exports.iso.datetime() }).nullable()
+}).strict();
+var StaffQueueContestedItemSchema = external_exports.object({
+  kind: external_exports.literal("CONTESTED"),
+  since,
+  ...findingIdentity,
+  /** The open contest row. Null only if a finding is CONTESTED with no open row. */
+  contest: external_exports.object({
+    reason: ContestReason,
+    justification: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+    contestedBy: external_exports.string()
+  }).strict().nullable()
+}).strict();
+var StaffQueueSessionWaitingItemSchema = external_exports.object({
+  kind: external_exports.literal("SESSION_WAITING"),
+  since,
+  agentSessionId: external_exports.uuid(),
+  sessionType: AgentSessionType,
+  waitingReason: AgentSessionWaitingReason.nullable(),
+  /** The console's session list names sessions by objective, so the row carries it. */
+  objective: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+  /** The agent's question when the park carries one. */
+  question: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX).nullable()
+}).strict();
+var StaffQueueSessionFailedItemSchema = external_exports.object({
+  kind: external_exports.literal("SESSION_FAILED"),
+  since,
+  agentSessionId: external_exports.uuid(),
+  sessionType: AgentSessionType,
+  objective: external_exports.string().max(STAFF_QUEUE_EXCERPT_MAX),
+  failureReason: AgentSessionFailureReason.nullable()
+}).strict();
+var StaffQueueReviewGateItemSchema = external_exports.object({
+  kind: external_exports.literal("REVIEW_GATE"),
+  since,
+  stage: PentestStage
+}).strict();
+var StaffQueueIntakeSubmittedItemSchema = external_exports.object({
+  kind: external_exports.literal("INTAKE_SUBMITTED"),
+  since
+}).strict();
+var StaffQueueItemSchema = external_exports.discriminatedUnion("kind", [
+  StaffQueueRetestOwedItemSchema,
+  StaffQueueContestedItemSchema,
+  StaffQueueSessionWaitingItemSchema,
+  StaffQueueSessionFailedItemSchema,
+  StaffQueueReviewGateItemSchema,
+  StaffQueueIntakeSubmittedItemSchema
+]);
+var StaffQueueEngagementSchema = external_exports.object({
+  organization: external_exports.object({
+    organizationId: external_exports.uuid(),
+    slug: external_exports.string(),
+    name: external_exports.string(),
+    logoUrl: external_exports.string().nullable(),
+    darkModeLogoUrl: external_exports.string().nullable()
+  }).strict(),
+  pentest: external_exports.object({
+    pentestId: external_exports.uuid(),
+    displayId: external_exports.int().positive(),
+    title: external_exports.string(),
+    status: PentestStatus,
+    currentStage: PentestStage
+  }).strict(),
+  /** Oldest first within the engagement. */
+  items: external_exports.array(StaffQueueItemSchema).min(1),
+  /** The `since` of the oldest item; engagements sort by it ascending. */
+  oldestSince: external_exports.iso.datetime()
+}).strict();
+var StaffQueueCountsSchema = external_exports.object(
+  Object.fromEntries(StaffQueueItemKindValues.map((kind) => [kind, external_exports.int().nonnegative()]))
+).strict();
+var StaffQueueResponseSchema = external_exports.object({
+  generatedAt: external_exports.iso.datetime(),
+  /** Non-deleted, non-closed pentests considered, so an empty queue can prove the query ran. */
+  liveEngagementCount: external_exports.int().nonnegative(),
+  counts: StaffQueueCountsSchema,
+  engagements: external_exports.array(StaffQueueEngagementSchema)
+}).strict();
+
+// ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
+var c43 = initContract();
+var staffQueueContract = c43.router({
+  getStaffQueue: {
+    method: "GET",
+    path: "/staff/queue",
+    responses: {
+      200: StaffQueueResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Engagements where the next move is staff\u2019s, grouped by engagement"
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/test-integration.api.ts
 var NOTES_MAX = 2e3;
 var TestIntegrationIdParamsSchema = external_exports.object({
@@ -35522,8 +35772,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c43 = initContract();
-var testIntegrationContract = c43.router({
+var c44 = initContract();
+var testIntegrationContract = c44.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -35655,8 +35905,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c44 = initContract();
-var userContract = c44.router({
+var c45 = initContract();
+var userContract = c45.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -35771,8 +36021,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c45 = initContract();
-var vantaIntegrationContract = c45.router({
+var c46 = initContract();
+var vantaIntegrationContract = c46.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -36104,8 +36354,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c46 = initContract();
-var vulnerabilityContract = c46.router({
+var c47 = initContract();
+var vulnerabilityContract = c47.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -36313,8 +36563,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c47 = initContract();
-var vulnerabilityNoteContract = c47.router({
+var c48 = initContract();
+var vulnerabilityNoteContract = c48.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -36495,8 +36745,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c48 = initContract();
-var webhookSettingsContract = c48.router({
+var c49 = initContract();
+var webhookSettingsContract = c49.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -36634,8 +36884,8 @@ var webhookSettingsContract = c48.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c49 = initContract();
-var v1Contract = c49.router(
+var c50 = initContract();
+var v1Contract = c50.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -36684,7 +36934,8 @@ var v1Contract = c49.router(
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
     pentestEgress: pentestEgressContract,
-    staffPentestStats: staffPentestStatsContract
+    staffPentestStats: staffPentestStatsContract,
+    staffQueue: staffQueueContract
   },
   {
     pathPrefix: "/v1"
@@ -36692,8 +36943,8 @@ var v1Contract = c49.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c50 = initContract();
-var contract = c50.router({
+var c51 = initContract();
+var contract = c51.router({
   v1: v1Contract
 });
 
@@ -36703,8 +36954,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c51 = initContract();
-var githubWebhookContract = c51.router(
+var c52 = initContract();
+var githubWebhookContract = c52.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36722,7 +36973,7 @@ var githubWebhookContract = c51.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c51.router(
+var githubReadonlyWebhookContract = c52.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36742,9 +36993,9 @@ var githubReadonlyWebhookContract = c51.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c52 = initContract();
+var c53 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c52.router(
+var linearWebhookContract = c53.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36764,7 +37015,7 @@ var linearWebhookContract = c52.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c53 = initContract();
+var c54 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -36793,7 +37044,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c53.router(
+var forgeBitbucketContract = c54.router(
   {
     lifecycle: {
       method: "POST",
@@ -36840,8 +37091,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c54 = initContract();
-var healthContract = c54.router({
+var c55 = initContract();
+var healthContract = c55.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -36853,8 +37104,8 @@ var healthContract = c54.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c55 = initContract();
-var vulnerabilityShareContract = c55.router(
+var c56 = initContract();
+var vulnerabilityShareContract = c56.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -36941,8 +37192,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c56 = initContract();
-var prVulnerabilityContract = c56.router(
+var c57 = initContract();
+var prVulnerabilityContract = c57.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -37678,18 +37929,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open, close, parent) => {
+var createStyler = (open2, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open;
+    openAll = open2;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open;
+    openAll = parent.openAll + open2;
     closeAll = close + parent.closeAll;
   }
   return {
-    open,
+    open: open2,
     close,
     openAll,
     closeAll,
@@ -37811,6 +38062,10 @@ function getApiBaseUrl() {
   }
   return raw.replace(/\/+$/, "");
 }
+function requireAuth() {
+  const credential = loadCredentialOrExit();
+  return { token: credential.token, kind: credential.kind };
+}
 function loadCredentialOrExit() {
   const credential = resolveCredentialOrExit();
   if (!credential) {
@@ -39404,6 +39659,7 @@ function sanitizeDisplay(value) {
 }
 var SUCCESS_STATUS = 200;
 var CREATED_STATUS = 201;
+var ACCEPTED_STATUS = 202;
 var NO_CONTENT_STATUS = 204;
 var UNAUTHORIZED_STATUS2 = 401;
 function parseOutput(value) {
@@ -39646,12 +39902,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c58) => c58.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c58) => c58.type.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c59) => c59.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.name.padEnd(nameWidth)}  ${c58.type.padEnd(typeWidth)}  ${c58.repos.padStart(5)}  ${c58.url}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.name.padEnd(nameWidth)}  ${c59.type.padEnd(typeWidth)}  ${c59.repos.padStart(5)}  ${c59.url}`
   );
   return { header, rows };
 }
@@ -39671,12 +39927,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c58) => c58.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c58) => c58.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c58) => c58.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c59) => c59.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c59) => c59.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c59) => c59.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c58) => `${c58.name.padEnd(nameWidth)}  ${c58.scan.padEnd(4)}  ${c58.role.padEnd(roleWidth)}  ${c58.path.padEnd(pathWidth)}  ${c58.status}`
+    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.scan.padEnd(4)}  ${c59.role.padEnd(roleWidth)}  ${c59.path.padEnd(pathWidth)}  ${c59.status}`
   );
   return { header, rows };
 }
@@ -40461,8 +40717,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c58, i2, m2) => {
-    const d = n3 ? n3(c58, i2) : c58;
+`).map((c59, i2, m2) => {
+    const d = n3 ? n3(c59, i2) : c59;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -40960,14 +41216,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c58 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c59 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c58 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c58 ? 1 : 0);
+  d && g++, c59 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c59 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -40988,14 +41244,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c58 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c58 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c58 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c59 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c58 && x.push(M), x;
+  return c59 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -41014,15 +41270,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c58 = this.value ? a2 : s;
+`, c59 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c58)}`;
+          return `${o2}${r2}${styleText2("dim", c59)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c58)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c59)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -41170,13 +41426,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c58 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c59 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c58}
+${u4}  ${styleText2("yellow", this.error)}${c59}
 `;
       }
       case "submit": {
@@ -41204,7 +41460,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c58}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c58}
+${r2}${c59}
 `;
       }
     }
@@ -41219,7 +41475,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c58 = this.userInputWithCursor, i2 = this.masked;
+`, c59 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -41239,7 +41495,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c58}
+        return `${o2}${s}${c59}
 ${n3}
 `;
       }
@@ -41255,7 +41511,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c57 = (t2, o2) => t2.includes(`
+var c58 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -41266,15 +41522,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c57(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c57(s, (i2) => styleText2("dim", i2))}`;
+        return `${c58(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c57(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c58(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c57(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -42334,7 +42590,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c58) => !c58._hidden).map((c58) => extractCommandTree(c58));
+  const subcommands = cmd.commands.filter((c59) => !c59._hidden).map((c59) => extractCommandTree(c59));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -42400,7 +42656,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c58) => c58.name);
+  const subcommandNames = tree.subcommands.map((c59) => c59.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -42815,9 +43071,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c58) => c58.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c59) => c59.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c58) => `${c58.address.padEnd(addressWidth)}  ${c58.label}`);
+  const rows = cells.map((c59) => `${c59.address.padEnd(addressWidth)}  ${c59.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -42841,14 +43097,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c58) => c58.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c58) => c58.from.length));
-  const toWidth = Math.max(2, ...cells.map((c58) => c58.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c58) => c58.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c59) => c59.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c59) => c59.from.length));
+  const toWidth = Math.max(2, ...cells.map((c59) => c59.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c59) => c59.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.received.padEnd(receivedWidth)}  ${c58.from.padEnd(fromWidth)}  ${c58.to.padEnd(toWidth)}  ${c58.subject.padEnd(subjectWidth)}  ${c58.unread}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.received.padEnd(receivedWidth)}  ${c59.from.padEnd(fromWidth)}  ${c59.to.padEnd(toWidth)}  ${c59.subject.padEnd(subjectWidth)}  ${c59.unread}`
   );
   return { header, rows };
 }
@@ -43076,14 +43332,14 @@ async function runEmails(label, options) {
   const output = parseOutput(options.output);
   requireInboxLabel(label);
   const limit = parseEmailLimit(options.limit);
-  const since = parseEmailSince(options.since);
+  const since2 = parseEmailSince(options.since);
   const organizationId = await resolveOrganizationId();
   const result = await authenticatedRequest(
     (client) => client.inbox.listInboxMessages({
       params: { organizationId, label },
       query: {
         ...limit !== void 0 ? { limit } : {},
-        ...since !== void 0 ? { since } : {}
+        ...since2 !== void 0 ? { since: since2 } : {}
       }
     })
   );
@@ -43576,16 +43832,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c58) => ({
-    id: c58.credentialId,
-    label: sanitizeDisplay(c58.label),
-    type: c58.credentialType
+  const cells = creds.map((c59) => ({
+    id: c59.credentialId,
+    label: sanitizeDisplay(c59.label),
+    type: c59.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c58) => c58.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c58) => c58.label.length));
+  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c59) => c59.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c58) => `${c58.id.padEnd(idWidth)}  ${c58.label.padEnd(labelWidth)}  ${c58.type}`
+    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.label.padEnd(labelWidth)}  ${c59.type}`
   );
   return { header, rows };
 }
@@ -44313,14 +44569,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c58) => c58.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c59) => c59.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c58) => c58.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c58) => c58.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c59) => c59.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c58) => `${padLeading(c58.leading)}  ${c58.name.padEnd(nameWidth)}  ${c58.prod.padEnd(4)}  ${c58.url}`
+      (c59) => `${padLeading(c59.leading)}  ${c59.name.padEnd(nameWidth)}  ${c59.prod.padEnd(4)}  ${c59.url}`
     )
   };
 }
@@ -45317,11 +45573,26 @@ function isPentestIdentifier(value) {
 function isFindingIdentifier(value) {
   return FINDING_IDENTIFIER_PATTERN.test(value);
 }
-function failStatusUpdate(status, body) {
+function failStatusUpdate(status, body, viaApiKey) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
   }
+  if (status === 403 && viaApiKey) {
+    console.error(
+      colorError(
+        `${message ?? "Request failed (status 403)."}
+API keys can update finding status once Trace enables finding automation for your organization. Ask Trace to turn it on, or run this with \`tracecli auth login\`.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 409 && errorCode === "FINDING_STALE") {
+    console.error(
+      colorError(message ?? "The finding changed while this update was in flight. Retry it.")
+    );
+    process.exit(1);
+  }
   if (status === 404) {
     console.error(colorError(message ?? "Pentest or finding not found."));
     process.exit(1);
@@ -45398,13 +45669,19 @@ async function runStatusUpdate(options) {
     );
     process.exit(1);
   }
+  const viaApiKey = requireAuth().kind === "api_key";
   const organizationId = await resolveOrganizationId();
   const params = {
     organizationId,
     pentestId: options.pentest,
     pentestFindingId: options.finding
   };
-  const result = target === "IN_PROGRESS" ? await authenticatedRequest(
+  const result = viaApiKey ? await authenticatedRequest(
+    (client) => client.pentestFinding.automationStatusUpdate({
+      params,
+      body: { status: target, ...note !== void 0 ? { note } : {} }
+    })
+  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
     (client) => client.pentestFinding.startProgress({ params, body: {} })
   ) : await authenticatedRequest(
     (client) => client.pentestFinding.reportRemediation({
@@ -45413,7 +45690,7 @@ async function runStatusUpdate(options) {
     })
   );
   if (result.status !== 200) {
-    failStatusUpdate(result.status, result.body);
+    failStatusUpdate(result.status, result.body, viaApiKey);
   }
   if (options.output === "json") {
     console.log(JSON.stringify(result.body, null, 2));
@@ -45436,8 +45713,12 @@ fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
 sending REMEDIATED) keeps it out of the retest queue.
 
 IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN. Requires \`tracecli auth login\` (API keys
-are rejected \u2014 the change is attributed to the signed-in user).
+OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+
+A signed-in session (\`tracecli auth login\`) attributes the change to you. A
+Trace API key works too, once Trace enables finding automation for your
+organization: those writes are recorded as \`api-key:<key name>\` and show up as
+yours in the finding's history.
 
 Examples:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
@@ -46693,6 +46974,961 @@ Examples:
   });
 }
 
+// src/upload/prepare.ts
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync3 } from "fs";
+import { open } from "fs/promises";
+import { basename as basename2 } from "path";
+var CodeUploadPrepareError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadPrepareError";
+  }
+};
+var KIND_BY_INPUT = {
+  source: "SOURCE_ARCHIVE",
+  code: "SOURCE_ARCHIVE",
+  "source-archive": "SOURCE_ARCHIVE",
+  source_archive: "SOURCE_ARCHIVE",
+  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
+  apk: "ANDROID_APK",
+  android: "ANDROID_APK",
+  "android-apk": "ANDROID_APK",
+  android_apk: "ANDROID_APK",
+  ANDROID_APK: "ANDROID_APK",
+  ipa: "IOS_IPA",
+  ios: "IOS_IPA",
+  "ios-ipa": "IOS_IPA",
+  ios_ipa: "IOS_IPA",
+  IOS_IPA: "IOS_IPA"
+};
+function normalizeArtifactKind(input) {
+  const trimmed = input.trim();
+  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
+}
+function inferArtifactKindFromFilename(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
+  if (lower.endsWith(".apk")) return "ANDROID_APK";
+  if (lower.endsWith(".ipa")) return "IOS_IPA";
+  return null;
+}
+function requiredExtensionForKind(kind) {
+  if (kind === "ANDROID_APK") return ".apk";
+  if (kind === "IOS_IPA") return ".ipa";
+  return ".zip";
+}
+function defaultDisplayName(originalFilename) {
+  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base.slice(0, 200) || "source";
+}
+function formatArchiveBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) {
+    const kb = bytes / 1024;
+    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
+  }
+  if (bytes < 1024 * 1024 * 1024) {
+    const mb = bytes / (1024 * 1024);
+    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
+  }
+  const gb = bytes / (1024 * 1024 * 1024);
+  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
+}
+function archiveTooLargeMessage() {
+  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
+}
+async function hashFileSha256(filePath) {
+  const hash2 = createHash("sha256");
+  const stream = createReadStream(filePath);
+  for await (const chunk of stream) {
+    hash2.update(chunk);
+  }
+  return hash2.digest("hex");
+}
+async function readFileSlice(filePath, start, endExclusive) {
+  const length = endExclusive - start;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
+    throw new Error(
+      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
+    );
+  }
+  const buffer = Buffer.alloc(length);
+  const handle = await open(filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    if (bytesRead !== length) {
+      throw new Error(
+        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
+      );
+    }
+    return buffer;
+  } finally {
+    await handle.close();
+  }
+}
+function assertPreparedMatchesUpload(upload, prepared) {
+  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
+    throw new CodeUploadPrepareError(
+      "The file does not match the interrupted upload (size or SHA-256 differs)."
+    );
+  }
+}
+async function prepareUploadFile(filePath, options = {}) {
+  let sizeBytes;
+  try {
+    const stats = statSync3(filePath);
+    if (!stats.isFile()) {
+      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
+    }
+    sizeBytes = stats.size;
+  } catch (error48) {
+    if (error48 instanceof CodeUploadPrepareError) throw error48;
+    throw new CodeUploadPrepareError("Cannot read that file.");
+  }
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
+    throw new CodeUploadPrepareError("The file is empty.");
+  }
+  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
+    throw new CodeUploadPrepareError(archiveTooLargeMessage());
+  }
+  const originalFilename = basename2(filePath);
+  const inferred = inferArtifactKindFromFilename(originalFilename);
+  const artifactKind = options.artifactKind ?? inferred;
+  if (artifactKind == null) {
+    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
+  }
+  const expected = requiredExtensionForKind(artifactKind);
+  if (!originalFilename.toLowerCase().endsWith(expected)) {
+    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
+    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
+  }
+  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
+  if (displayName.length < 1 || displayName.length > 200) {
+    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
+  }
+  return {
+    path: filePath,
+    displayName,
+    originalFilename,
+    sizeBytes,
+    archiveSha256: await hashFileSha256(filePath),
+    artifactKind
+  };
+}
+
+// src/upload/multipart.ts
+var MAX_CONCURRENT_UPLOADS = 3;
+var MAX_PART_ATTEMPTS = 3;
+var MAX_URL_REFRESHES = 12;
+async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts, options = {}) {
+  assertUploadPlan(totalBytes, partSizeBytes, parts);
+  const fetchPart = options.fetch ?? globalThis.fetch;
+  const wait = options.wait ?? defaultWait;
+  let uploadedBytes = options.initialUploadedBytes ?? 0;
+  if (!Number.isSafeInteger(uploadedBytes) || uploadedBytes < 0 || uploadedBytes > totalBytes) {
+    throw new Error("Invalid multipart progress: uploaded byte count is outside the archive.");
+  }
+  options.onProgress?.(progress(uploadedBytes, totalBytes));
+  if (parts.length === 0) return;
+  const urls = new Map(parts.map((part) => [part.partNumber, part.uploadUrl]));
+  const refreshUrls = createUrlRefresher(urls, options.refreshParts);
+  let cursor3 = 0;
+  const workerCount = Math.min(MAX_CONCURRENT_UPLOADS, parts.length);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor3 < parts.length) {
+        const part = parts[cursor3];
+        cursor3 += 1;
+        if (!part) return;
+        const start = (part.partNumber - 1) * partSizeBytes;
+        const end = Math.min(start + partSizeBytes, totalBytes);
+        const body = await readFileSlice(filePath, start, end);
+        await uploadPartWithRetry(part.partNumber, urls, body, fetchPart, wait, refreshUrls);
+        uploadedBytes += body.byteLength;
+        options.onProgress?.(progress(uploadedBytes, totalBytes));
+      }
+    })
+  );
+}
+function createUrlRefresher(urls, refreshParts) {
+  if (!refreshParts) return async () => false;
+  let inflight = null;
+  let rounds = 0;
+  return async () => {
+    if (rounds >= MAX_URL_REFRESHES) return false;
+    if (!inflight) {
+      rounds += 1;
+      inflight = (async () => {
+        const fresh = await refreshParts();
+        for (const part of fresh) {
+          assertPresignedUploadUrl(part.uploadUrl);
+          urls.set(part.partNumber, part.uploadUrl);
+        }
+      })().finally(() => {
+        inflight = null;
+      });
+    }
+    await inflight;
+    return true;
+  };
+}
+function assertUploadPlan(totalBytes, partSizeBytes, parts) {
+  if (!Number.isSafeInteger(totalBytes) || totalBytes < 1) {
+    throw new Error("Invalid multipart upload: archive size must be a positive integer.");
+  }
+  if (!Number.isSafeInteger(partSizeBytes) || partSizeBytes < 1) {
+    throw new Error("Invalid multipart upload: part size must be a positive integer.");
+  }
+  const totalParts = Math.ceil(totalBytes / partSizeBytes);
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    if (!Number.isSafeInteger(part.partNumber) || part.partNumber < 1 || part.partNumber > totalParts || seen.has(part.partNumber)) {
+      throw new Error("Invalid multipart upload: part numbers must be unique and in range.");
+    }
+    assertPresignedUploadUrl(part.uploadUrl);
+    seen.add(part.partNumber);
+  }
+}
+async function uploadPartWithRetry(partNumber, urls, body, fetchPart, wait, refreshUrls) {
+  let lastStatus = null;
+  for (let attempt = 1; attempt <= MAX_PART_ATTEMPTS; attempt += 1) {
+    const uploadUrl = urls.get(partNumber);
+    if (!uploadUrl) {
+      throw new Error(`Source upload part ${partNumber.toString()} has no upload URL.`);
+    }
+    try {
+      const response = await fetchPart(uploadUrl, {
+        method: "PUT",
+        body: new Uint8Array(body),
+        redirect: "error"
+      });
+      if (response.ok) return;
+      lastStatus = response.status;
+      if (response.status === 403 && await refreshUrls()) {
+        attempt -= 1;
+        continue;
+      }
+      if (response.status >= 400 && response.status < 500 && response.status !== 408) break;
+    } catch {
+      lastStatus = null;
+    }
+    if (attempt < MAX_PART_ATTEMPTS) {
+      await wait(250 * 2 ** (attempt - 1));
+    }
+  }
+  const statusDetail = lastStatus === null ? "network error" : `status ${lastStatus.toString()}`;
+  throw new Error(
+    `Source upload part ${partNumber.toString()} failed after retries (${statusDetail}).`
+  );
+}
+function assertPresignedUploadUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new Error("Invalid multipart upload: the API returned an invalid part URL.");
+  }
+  const localHttp = url2.protocol === "http:" && (url2.hostname === "localhost" || url2.hostname === "127.0.0.1" || url2.hostname === "host.docker.internal");
+  if (url2.protocol !== "https:" && !localHttp) {
+    throw new Error("Invalid multipart upload: part URLs must use HTTPS.");
+  }
+}
+function progress(uploadedBytes, totalBytes) {
+  return {
+    uploadedBytes,
+    totalBytes,
+    fraction: totalBytes === 0 ? 0 : Math.min(1, uploadedBytes / totalBytes)
+  };
+}
+function defaultWait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+// src/upload/commands.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
+var DEFAULT_RUNTIME = {
+  wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  pollIntervalMs: 3e3,
+  fetch: (input, init) => globalThis.fetch(input, init)
+};
+function resolveRuntime(runtime) {
+  return {
+    wait: runtime.wait ?? DEFAULT_RUNTIME.wait,
+    pollIntervalMs: runtime.pollIntervalMs ?? DEFAULT_RUNTIME.pollIntervalMs,
+    fetch: runtime.fetch ?? DEFAULT_RUNTIME.fetch
+  };
+}
+function isTerminalCodeUploadStatus(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+function requireUuid(value, label) {
+  if (!isUuid(value)) {
+    console.error(colorError(`Invalid ${label} '${sanitizeDisplay(value)}'. Expected a UUID.`));
+    process.exit(1);
+  }
+  return value;
+}
+function parseKindOption(value) {
+  if (value === void 0) return void 0;
+  const kind = normalizeArtifactKind(value);
+  if (kind == null) {
+    console.error(
+      colorError(`Invalid --kind '${sanitizeDisplay(value)}'. Use source (code ZIP), apk, or ipa.`)
+    );
+    process.exit(1);
+  }
+  return kind;
+}
+function failPrepare(error48) {
+  const message = error48 instanceof CodeUploadPrepareError ? error48.message : error48 instanceof Error ? error48.message : "Failed to prepare the file.";
+  console.error(colorError(message));
+  process.exit(1);
+}
+function failWriteOp5(action, status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} source uploads.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CODE_UPLOAD_NOT_READY") {
+      console.error(
+        colorError(
+          message ?? "The upload must be ready and pass malware scanning before it can be linked. Run `tracecli upload wait <id>`."
+        )
+      );
+    } else if (errorCode === "CODE_UPLOAD_NOT_SOURCE") {
+      console.error(
+        colorError(message ?? "APK and IPA uploads cannot be linked as source repositories.")
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} upload (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function failReadOp5(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only an organization admin (or Trace staff) on a pentest-enabled organization can view source uploads."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function resumeHint(codeUploadId, filePath) {
+  return `Resume with: tracecli upload resume ${codeUploadId} ${filePath}`;
+}
+function buildUploadsTable(uploads) {
+  const cells = uploads.map((upload) => ({
+    name: sanitizeDisplay(upload.displayName),
+    kind: formatStatus(upload.artifactKind),
+    status: formatStatus(upload.status),
+    size: formatArchiveBytes(upload.sizeBytes),
+    id: upload.codeUploadId
+  }));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c59) => c59.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c59) => c59.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c59) => c59.size.length));
+  const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
+  const rows = cells.map(
+    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.kind.padEnd(kindWidth)}  ${c59.status.padEnd(statusWidth)}  ${c59.size.padEnd(sizeWidth)}  ${c59.id}`
+  );
+  return { header, rows };
+}
+function renderUploadDetail(upload) {
+  const pad = 18;
+  const linked = upload.linkedApplications.length === 0 ? "\u2014" : upload.linkedApplications.map((app) => `${sanitizeDisplay(app.name)} (${app.applicationId})`).join(", ");
+  return [
+    `${"Name:".padEnd(pad)} ${sanitizeDisplay(upload.displayName)}`,
+    `${"Filename:".padEnd(pad)} ${sanitizeDisplay(upload.originalFilename)}`,
+    `${"Kind:".padEnd(pad)} ${formatStatus(upload.artifactKind)}`,
+    `${"Status:".padEnd(pad)} ${formatStatus(upload.status)}`,
+    `${"Size:".padEnd(pad)} ${formatArchiveBytes(upload.sizeBytes)}`,
+    `${"SHA-256:".padEnd(pad)} ${upload.archiveSha256}`,
+    `${"Upload ID:".padEnd(pad)} ${upload.codeUploadId}`,
+    `${"Repository ID:".padEnd(pad)} ${upload.repositoryId}`,
+    `${"Malware:".padEnd(pad)} ${upload.malwareScanResult ? formatStatus(upload.malwareScanResult) : "\u2014"}`,
+    `${"Rejection:".padEnd(pad)} ${upload.rejectionReason ? formatStatus(upload.rejectionReason) : "\u2014"}`,
+    `${"Linked apps:".padEnd(pad)} ${linked}`,
+    `${"Created:".padEnd(pad)} ${formatDate(upload.createdAt)}`,
+    `${"Ready:".padEnd(pad)} ${formatDate(upload.readyAt)}`
+  ].join("\n");
+}
+function printUploadsTsv(uploads) {
+  console.log(
+    [
+      "codeUploadId",
+      "repositoryId",
+      "displayName",
+      "originalFilename",
+      "artifactKind",
+      "status",
+      "sizeBytes",
+      "archiveSha256",
+      "malwareScanResult",
+      "rejectionReason",
+      "applicationId",
+      "createdAt",
+      "readyAt"
+    ].join("	")
+  );
+  for (const upload of uploads) {
+    console.log(
+      [
+        tsvSafe(upload.codeUploadId),
+        tsvSafe(upload.repositoryId),
+        tsvSafe(sanitizeDisplay(upload.displayName)),
+        tsvSafe(sanitizeDisplay(upload.originalFilename)),
+        tsvSafe(upload.artifactKind),
+        tsvSafe(upload.status),
+        String(upload.sizeBytes),
+        tsvSafe(upload.archiveSha256),
+        tsvSafe(upload.malwareScanResult ?? ""),
+        tsvSafe(upload.rejectionReason ?? ""),
+        tsvSafe(upload.applicationId ?? ""),
+        tsvSafe(toIso(upload.createdAt)),
+        tsvSafe(upload.readyAt ? toIso(upload.readyAt) : "")
+      ].join("	")
+    );
+  }
+}
+function outputUpload(upload, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(upload, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv([upload]);
+    return;
+  }
+  console.log(renderUploadDetail(upload));
+}
+function writeProgress(progress2) {
+  if (!process.stderr.isTTY) return;
+  const pct = Math.floor(progress2.fraction * 100);
+  process.stderr.write(
+    `\rUploading ${pct}% (${formatArchiveBytes(progress2.uploadedBytes)} / ${formatArchiveBytes(progress2.totalBytes)})`
+  );
+}
+function finishProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+async function listUploads(organizationId, query = {}) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.listCodeUploads({
+      params: { organizationId },
+      query
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp5("list uploads", result.status, result.body);
+  }
+  return result.body.uploads;
+}
+async function requireUpload(organizationId, codeUploadId, query = {}) {
+  const uploads = await listUploads(organizationId, query);
+  const match = uploads.find((upload) => upload.codeUploadId === codeUploadId);
+  if (!match) {
+    console.error(colorError(`No code upload '${codeUploadId}'.`));
+    process.exit(1);
+  }
+  return match;
+}
+async function refreshRemainingParts(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", result.status, result.body);
+  }
+  return result.body.multipart.parts;
+}
+async function completeUpload(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.completeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== ACCEPTED_STATUS) {
+    failWriteOp5("complete", result.status, result.body);
+  }
+  return result.body;
+}
+async function waitForTerminal(organizationId, codeUploadId, runtime) {
+  for (; ; ) {
+    const upload = await requireUpload(organizationId, codeUploadId);
+    if (isTerminalCodeUploadStatus(upload.status)) {
+      return upload;
+    }
+    if (process.stderr.isTTY) {
+      process.stderr.write(`\rWaiting for malware scan (${formatStatus(upload.status)})...`);
+    }
+    await runtime.wait(runtime.pollIntervalMs);
+  }
+}
+function printWaitOutcome(upload, output) {
+  if (output !== "table") {
+    outputUpload(upload, output);
+    if (upload.status !== "READY") process.exit(1);
+    return;
+  }
+  if (upload.status === "READY") {
+    console.log(colorSuccess(`Upload ${upload.codeUploadId} is ready.`));
+    outputUpload(upload, output);
+    if (upload.artifactKind === "SOURCE_ARCHIVE") {
+      console.log(
+        `Link it with: tracecli upload link --app <applicationId> --upload ${upload.codeUploadId}`
+      );
+    }
+    return;
+  }
+  const reason = upload.rejectionReason ? ` (${formatStatus(upload.rejectionReason)})` : "";
+  console.error(
+    colorError(`Upload ${upload.codeUploadId} ended as ${formatStatus(upload.status)}${reason}.`)
+  );
+  outputUpload(upload, output);
+  process.exit(1);
+}
+async function runTransfer(filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath, {
+      displayName: options.name,
+      artifactKind: options.artifactKind
+    });
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const initialized = await authenticatedRequest(
+    (client) => client.codeUpload.initializeCodeUpload({
+      params: { organizationId },
+      body: {
+        displayName: prepared.displayName,
+        originalFilename: prepared.originalFilename,
+        sizeBytes: prepared.sizeBytes,
+        archiveSha256: prepared.archiveSha256,
+        artifactKind: prepared.artifactKind,
+        ...options.applicationId !== void 0 ? { applicationId: options.applicationId } : {}
+      }
+    })
+  );
+  if (initialized.status !== CREATED_STATUS) {
+    failWriteOp5("create", initialized.status, initialized.body);
+  }
+  const codeUploadId = initialized.body.upload.codeUploadId;
+  if (output === "table") {
+    console.error(
+      `Initialized upload ${codeUploadId} (${formatArchiveBytes(prepared.sizeBytes)}).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      initialized.body.multipart.partSizeBytes,
+      initialized.body.multipart.parts,
+      {
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runCreate5(filePath, options, runtime) {
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred != null && isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "That file is a mobile build, not a source archive. Attach it to an existing application with:"
+      )
+    );
+    console.error("  tracecli upload build <file> --app <applicationId>");
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      artifactKind: "SOURCE_ARCHIVE"
+    },
+    runtime
+  );
+}
+async function runBuild(filePath, options, runtime) {
+  const applicationId = requireUuid(options.app, "--app");
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred == null || !isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "Build uploads are an APK or IPA attached to an existing application. For a source ZIP, use `tracecli upload create <file>`."
+      )
+    );
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      applicationId,
+      artifactKind: inferred
+    },
+    runtime
+  );
+}
+async function runResume(codeUploadIdArg, filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const resumed = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (resumed.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", resumed.status, resumed.body);
+  }
+  try {
+    assertPreparedMatchesUpload(resumed.body.upload, prepared);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const uploadedBytes = resumed.body.multipart.uploadedParts.reduce(
+    (sum, part) => sum + part.sizeBytes,
+    0
+  );
+  if (output === "table") {
+    console.error(
+      `Resuming upload ${codeUploadId} (${formatArchiveBytes(uploadedBytes)} already stored).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      resumed.body.multipart.partSizeBytes,
+      resumed.body.multipart.parts,
+      {
+        initialUploadedBytes: uploadedBytes,
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runList5(options) {
+  const output = parseOutput(options.output);
+  if (options.web) {
+    const slug = await resolveOrganizationSlug();
+    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/sources`;
+    const opened = await openBrowser(url2);
+    if (!opened) console.log(url2);
+    return;
+  }
+  const kind = parseKindOption(options.kind);
+  const applicationId = options.app !== void 0 ? requireUuid(options.app, "--app") : void 0;
+  const organizationId = await resolveOrganizationId();
+  const uploads = await listUploads(organizationId, {
+    ...kind !== void 0 ? { artifactKind: kind } : {},
+    ...applicationId !== void 0 ? { applicationId } : {}
+  });
+  if (output === "json") {
+    console.log(JSON.stringify({ uploads }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv(uploads);
+    return;
+  }
+  if (uploads.length === 0) {
+    console.log("No source uploads found.");
+    return;
+  }
+  const { header, rows } = buildUploadsTable(uploads);
+  await runInteractivePager({
+    items: uploads,
+    header,
+    renderItem: (_upload, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+async function runGet4(codeUploadIdArg, options) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  outputUpload(upload, output);
+}
+async function runWait(codeUploadIdArg, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await waitForTerminal(organizationId, codeUploadId, runtime);
+  if (process.stderr.isTTY) process.stderr.write("\n");
+  printWaitOutcome(upload, output);
+}
+async function runDelete5(codeUploadIdArg, options) {
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const confirmed = await confirmDeletion(`upload ${codeUploadId}`, options.yes);
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.deleteCodeUpload({
+      params: { organizationId, codeUploadId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failWriteOp5("delete", result.status, result.body);
+  }
+  console.log(colorSuccess(`Deleted upload ${codeUploadId}`));
+}
+async function runLink(options) {
+  const output = parseOutput(options.output);
+  const applicationId = requireUuid(options.app, "--app");
+  const codeUploadId = requireUuid(options.upload, "--upload");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  if (isApplicationBuildArtifactKind(upload.artifactKind)) {
+    console.error(colorError("APK and IPA uploads cannot be linked as source repositories."));
+    process.exit(1);
+  }
+  if (upload.status !== "READY" || upload.malwareScanResult !== "NO_THREATS_FOUND") {
+    console.error(
+      colorError(
+        `Upload is ${formatStatus(upload.status)}; it must be ready and pass malware scanning before it can be linked.`
+      )
+    );
+    process.exit(1);
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.createApplicationRepository({
+      params: { organizationId, applicationId },
+      body: {
+        repositoryId: upload.repositoryId,
+        ...options.path !== void 0 ? { repositoryPath: options.path } : {}
+      }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failWriteOp5("link", result.status, result.body);
+  }
+  if (output === "json") {
+    console.log(JSON.stringify(result.body, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["applicationId", "repositoryId", "codeUploadId"].join("	"));
+    console.log([applicationId, upload.repositoryId, codeUploadId].join("	"));
+    return;
+  }
+  console.log(
+    colorSuccess(`Linked ${sanitizeDisplay(upload.displayName)} to application ${applicationId}.`)
+  );
+}
+function createCreateCommand5(runtime) {
+  return new Command("create").alias("source").description("Upload a source ZIP as a code archive (not a mobile build)").argument("<file>", "Path to a .zip source archive").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+This is a code upload: a source ZIP that becomes an uploaded repository after
+it is ready. Link it with \`upload link\`. APK and IPA files belong on
+\`upload build --app\`, which attaches a build to an existing application.
+
+Requires a human login (\`tracecli auth login\`) on a pentest-enabled organization.
+API keys are rejected.
+
+Examples:
+  tracecli upload create ./checkout.zip
+  tracecli upload create ./checkout.zip --name "Checkout" --wait`
+  ).action(async (file2, options) => {
+    await runCreate5(file2, options, runtime);
+  });
+}
+function createBuildCommand(runtime) {
+  return new Command("build").description("Upload an APK or IPA and attach it to an existing application").argument("<file>", "Path to an .apk or .ipa").requiredOption("--app <applicationId>", "Application that owns this build").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Build uploads are not source archives. They attach to --app immediately and
+cannot be linked as a repository. For a source ZIP, use \`upload create\`.
+
+Examples:
+  tracecli upload build ./app-release.apk --app <applicationId>
+  tracecli upload build ./app.ipa --app <applicationId> --name "iOS build"`
+  ).action(async (file2, options) => {
+    await runBuild(file2, options, runtime);
+  });
+}
+function createListCommand7() {
+  return new Command("list").description("List source and build uploads in the active organization").option("--kind <kind>", "Filter: source (code ZIP), apk, or ipa").option("--app <applicationId>", "Filter build uploads for one application").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").option("-w, --web", "Open the source uploads page in a browser").action(async (options) => {
+    await runList5(options);
+  });
+}
+function createGetCommand4() {
+  return new Command("get").description("Show a single upload").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runGet4(codeUploadId, options);
+  });
+}
+function createResumeCommand(runtime) {
+  return new Command("resume").description("Resume an interrupted upload with the same file").argument("<codeUploadId>", "Upload UUID from the interrupted create").argument("<file>", "The same .zip, .apk, or .ipa file").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The file must match the original size and SHA-256. Trace skips parts that
+already landed in storage.
+
+Examples:
+  tracecli upload resume <codeUploadId> ./checkout.zip`
+  ).action(async (codeUploadId, file2, options) => {
+    await runResume(codeUploadId, file2, options, runtime);
+  });
+}
+function createWaitCommand(runtime) {
+  return new Command("wait").description("Wait until an upload finishes malware scanning and validation").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runWait(codeUploadId, options, runtime);
+  });
+}
+function createDeleteCommand5() {
+  return new Command("delete").description("Delete an uploaded archive and its stored bytes").argument("<codeUploadId>", "Upload UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (codeUploadId, options) => {
+    await runDelete5(codeUploadId, options);
+  });
+}
+function createLinkCommand() {
+  return new Command("link").description("Link a ready source upload to an application").requiredOption("--app <applicationId>", "Application UUID").requiredOption("--upload <codeUploadId>", "Upload UUID (must be a ready source ZIP)").option("--path <repositoryPath>", "Path within the archive").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Only a READY source archive that passed malware scanning can be linked.
+APK and IPA builds attach to an application with \`upload build --app\`.
+
+Examples:
+  tracecli upload link --app <applicationId> --upload <codeUploadId>`
+  ).action(async (options) => {
+    await runLink(options);
+  });
+}
+function createUploadCommand(runtime = {}) {
+  const resolved = resolveRuntime(runtime);
+  const upload = new Command("upload").alias("code-upload").description("Upload source archives (and separately, mobile builds) for pentest");
+  upload.addCommand(createCreateCommand5(resolved));
+  upload.addCommand(createBuildCommand(resolved));
+  upload.addCommand(createListCommand7());
+  upload.addCommand(createGetCommand4());
+  upload.addCommand(createResumeCommand(resolved));
+  upload.addCommand(createWaitCommand(resolved));
+  upload.addCommand(createDeleteCommand5());
+  upload.addCommand(createLinkCommand());
+  return upload;
+}
+
 // src/vulnerabilities/commands.ts
 var DEFAULT_LIMIT3 = 30;
 var MAX_LIMIT3 = 100;
@@ -46869,7 +48105,7 @@ function printVulnerabilityDetailTsv(vulnerability) {
   ].map(sanitizeTsvField);
   console.log(cols.join("	"));
 }
-function createGetCommand4() {
+function createGetCommand5() {
   return new Command("get").description("Get a vulnerability by display ID or UUID").argument("<id>", "Vulnerability display ID (e.g. TRACE-123 or 123) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerability detail page in a browser").addHelpText(
     "after",
     `
@@ -46928,7 +48164,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand7() {
+function createListCommand8() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -47061,8 +48297,8 @@ Examples:
 }
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
-  vulnerabilities.addCommand(createGetCommand4());
-  vulnerabilities.addCommand(createListCommand7());
+  vulnerabilities.addCommand(createGetCommand5());
+  vulnerabilities.addCommand(createListCommand8());
   return vulnerabilities;
 }
 
@@ -47085,6 +48321,7 @@ program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createCodeSizeCommand());
+program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());