securewithtrace 0.38.0 → 0.40.0

package/dist/index.js

@@ -25006,34 +25006,6 @@ var PentestDetailResponseSchema = PentestResponseSchema.extend({
   testingWindowStart: external_exports.coerce.date().nullable().optional(),
   testingWindowEnd: external_exports.coerce.date().nullable().optional(),
   engagementMetadataOverrides: EngagementMetadataOverridesSchema.optional(),
-  /**
-   * True once the engagement's repository scope has been snapshotted, which
-   * PERMANENTLY refuses bind and unbind (`repositoryScopes > 0` in
-   * `requireBindableInLock`).
-   *
-   * This one refusal only — that guard also refuses on `PENTEST_CLOSED` and on a
-   * non-scoping stage, both of which the client can already read off `status` and
-   * `currentStage` on this same response. So `false` means "not frozen by the
-   * snapshot", NOT "a bind will succeed"; a consumer that gates a control must check
-   * the stage and closed state too.
-   *
-   * Needed as its OWN field because nothing else on the wire answers it: the scope
-   * freezes at the first scope-consuming session create, and only VALIDATION moves
-   * the stage, so RECON / CODE_REVIEW / PRODUCT_RECON leave the engagement in
-   * `DRAFT` with permanently frozen bindings. `getRepositoryScope` reports
-   * `source: 'PENTEST_SCOPE'` only PAST the scoping stages, so a frozen `DRAFT`
-   * engagement still returns live application links there.
-   *
-   * Scoped to BINDINGS, not to the whole target: environment add/remove is gated on
-   * stage alone (`PentestEnvironmentService`, `NON_SCOPING_PENTEST_STAGES`), and
-   * `DRAFT` is a scoping stage — so a consumer must not disable environment editing
-   * on this flag. Doing so would remove the one provisioning action a frozen
-   * multi-application engagement still legitimately needs.
-   *
-   * Detail-only (the list schema deliberately carries no per-pentest aggregates) and
-   * `.optional()` for the same rolling-deploy reason as the fields above.
-   */
-  applicationBindingFrozen: external_exports.boolean().optional(),
   /**
    * Optional customer intake questionnaire answers. Staff detail only.
    * `.optional()` for rolling-deploy safety (Vercel ahead of ECS).
@@ -25481,7 +25453,18 @@ var ClaimedDesktopActionSchema = external_exports.object({
   kind: external_exports.enum(DesktopActionKindValues),
   request: external_exports.unknown(),
   /** Epoch millis; past this the box abandons the work and reports nothing. */
-  expiresAtMs: external_exports.number().int().positive()
+  expiresAtMs: external_exports.number().int().positive(),
+  /**
+   * A presigned PUT for the ONE artifact this kind can produce, issued with the
+   * claim so an action does not spend a second api round trip asking for it.
+   * The key is target-relative and travels back on `complete` unchanged.
+   *
+   * Null when the api has no artifacts bucket configured, and absent from an
+   * api that predates this. The box presigns for itself in both cases, and also
+   * whenever the PUT is refused, which is what keeps the 15-minute URL safe to
+   * issue at claim time for an action that may run longer than that.
+   */
+  artifactUpload: external_exports.object({ key: external_exports.string().min(1).max(1024), url: external_exports.url() }).nullable().optional()
 });
 var DesktopTargetClaimResponseSchema = external_exports.object({
   action: ClaimedDesktopActionSchema.nullable(),
@@ -25501,7 +25484,18 @@ var DesktopTargetCompleteRequestSchema = external_exports.object({
    */
   resultS3Key: external_exports.string().min(1).max(1024).optional(),
   /** Shape-only. Never customer data. */
-  failureDetails: external_exports.string().max(2e3).optional()
+  failureDetails: external_exports.string().max(2e3).optional(),
+  /**
+   * What the box spent, as a SIBLING of `result` rather than a member of it.
+   *
+   * Two reasons it cannot live inside `result`: the api parses that against the
+   * kind's own schema, which strips anything the schema does not declare, and
+   * the box sizes its inline output against the 32 KB cap before this is known.
+   */
+  rigTimings: external_exports.object({
+    executeMs: external_exports.number().int().nonnegative(),
+    uploadMs: external_exports.number().int().nonnegative()
+  }).optional()
 });
 var DesktopTargetCompleteResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
 var DesktopTargetPresignRequestSchema = external_exports.object({
@@ -32310,12 +32304,15 @@ var StaffOrganizationSummarySchema = external_exports.object({
 var ListAllOrganizationsResponseSchema = external_exports.array(StaffOrganizationSummarySchema);
 var CreateOrganizationRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(2, "Organization name must be at least 2 characters").max(100, "Organization name must be 100 characters or fewer"),
-  referrerId: external_exports.uuid().nullable().optional()
+  referrerId: external_exports.uuid().nullable().optional(),
+  homepageUrl: external_exports.url("Homepage must be a full URL, like https://acme.com").max(2048).nullable().optional()
 });
+var LogoFetchOutcomeValues = ["skipped", "stored", "not_found", "failed"];
 var CreateOrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   slug: external_exports.string(),
-  name: external_exports.string()
+  name: external_exports.string(),
+  logoFetch: external_exports.enum(LogoFetchOutcomeValues)
 });
 var OnboardingItemValues = [
   "INVITE_MEMBERS",
@@ -33183,10 +33180,9 @@ var pentestContract = c27.router({
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
-      // 409 — PENTEST_APPLICATION_ALREADY_BOUND (unique violation),
-      // PENTEST_APPLICATION_FROZEN_AT_STAGE (past scoping), or
-      // PENTEST_APPLICATION_SCOPE_FROZEN (repository scope already snapshotted,
-      // so a new binding could never enter it).
+      // 409: PENTEST_APPLICATION_ALREADY_BOUND (unique violation), PENTEST_CLOSED,
+      // or PENTEST_APPLICATION_WITHOUT_REPOSITORY (the repository scope is already
+      // snapshotted and this application has no scan-enabled repository to add).
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -33202,7 +33198,7 @@ var pentestContract = c27.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // 409 — PENTEST_APPLICATION_UNBIND_BLOCKED (this application still has
-      // linked environments), or either frozen guard as on bind.
+      // linked environments) or PENTEST_CLOSED.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -37929,18 +37925,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open, close, parent) => {
+var createStyler = (open2, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open;
+    openAll = open2;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open;
+    openAll = parent.openAll + open2;
     closeAll = close + parent.closeAll;
   }
   return {
-    open,
+    open: open2,
     close,
     openAll,
     closeAll,
@@ -39659,6 +39655,7 @@ function sanitizeDisplay(value) {
 }
 var SUCCESS_STATUS = 200;
 var CREATED_STATUS = 201;
+var ACCEPTED_STATUS = 202;
 var NO_CONTENT_STATUS = 204;
 var UNAUTHORIZED_STATUS2 = 401;
 function parseOutput(value) {
@@ -41588,6 +41585,323 @@ ${b}
 };
 var i = `${styleText2("gray", S_BAR)}  `;
 
+// src/org/update.ts
+import { readFileSync as readFileSync2, statSync } from "fs";
+import { basename, extname } from "path";
+var LOGO_CONTENT_TYPE_BY_EXTENSION = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp"
+};
+var SUPPORTED_LOGO_EXTENSIONS = Object.keys(
+  LOGO_CONTENT_TYPE_BY_EXTENSION
+);
+var MAX_LOGO_UPLOAD_BYTES = 2 * 1024 * 1024;
+function logoContentTypeForFile(path) {
+  return LOGO_CONTENT_TYPE_BY_EXTENSION[extname(path).toLowerCase()] ?? null;
+}
+function isHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
+function resolveLogoValue(value, flag) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return { error: `--${flag} cannot be empty. Pass an image file path or an http(s) URL.` };
+  }
+  if (isHttpUrl(trimmed)) {
+    return { change: { action: "url", url: trimmed } };
+  }
+  if (URL_SCHEME_PATTERN.test(trimmed)) {
+    return {
+      error: `--${flag} '${sanitizeDisplay(trimmed)}' must be an http(s) URL or a file path.`
+    };
+  }
+  const contentType = logoContentTypeForFile(trimmed);
+  if (!contentType) {
+    return {
+      error: `--${flag} '${sanitizeDisplay(trimmed)}' has an unsupported extension. Use one of: ${SUPPORTED_LOGO_EXTENSIONS.join(", ")}.`
+    };
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync(trimmed);
+    if (!stats.isFile()) {
+      return { error: `--${flag} '${sanitizeDisplay(trimmed)}' is not a regular file.` };
+    }
+    sizeBytes = stats.size;
+  } catch {
+    return { error: `Cannot read --${flag} '${sanitizeDisplay(trimmed)}'.` };
+  }
+  if (sizeBytes === 0) {
+    return { error: `--${flag} '${sanitizeDisplay(trimmed)}' is empty.` };
+  }
+  if (sizeBytes > MAX_LOGO_UPLOAD_BYTES) {
+    return {
+      error: `--${flag} is ${formatBytes(sizeBytes)}; logo files must be ${formatBytes(MAX_LOGO_UPLOAD_BYTES)} or smaller.`
+    };
+  }
+  return { change: { action: "upload", file: { path: trimmed, contentType, sizeBytes } } };
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+var NOTHING_TO_UPDATE = "Nothing to update. Pass at least one of --homepage, --clear-homepage, --logo, --clear-logo, --dark-logo, --clear-dark-logo, --logos-from-homepage.";
+function resolveLogoSlot(value, clear, flag) {
+  const resolved = resolveClearableOption(value, clear, flag);
+  if ("error" in resolved) {
+    return resolved;
+  }
+  if (resolved.value === null) {
+    return { change: { action: "clear" } };
+  }
+  if (resolved.value === void 0) {
+    return { change: void 0 };
+  }
+  const logo = resolveLogoValue(resolved.value, flag);
+  return "error" in logo ? logo : { change: logo.change };
+}
+function planOrgUpdate(options) {
+  const homepage = resolveClearableOption(options.homepage, options.clearHomepage, "homepage");
+  if ("error" in homepage) {
+    return homepage;
+  }
+  if (typeof homepage.value === "string" && !isHttpUrl(homepage.value.trim())) {
+    return {
+      error: `--homepage '${sanitizeDisplay(homepage.value)}' must be an http(s) URL (e.g. https://acme.com).`
+    };
+  }
+  const logo = resolveLogoSlot(options.logo, options.clearLogo, "logo");
+  if ("error" in logo) {
+    return logo;
+  }
+  const darkLogo = resolveLogoSlot(options.darkLogo, options.clearDarkLogo, "dark-logo");
+  if ("error" in darkLogo) {
+    return darkLogo;
+  }
+  const derive = options.logosFromHomepage === true;
+  if (derive && (logo.change !== void 0 || darkLogo.change !== void 0)) {
+    return {
+      error: "Pass either --logos-from-homepage or explicit logo flags (--logo, --dark-logo, --clear-logo, --clear-dark-logo), not both."
+    };
+  }
+  if (derive && homepage.value === null) {
+    return { error: "--logos-from-homepage needs a homepage; drop --clear-homepage." };
+  }
+  const homepageUrl = typeof homepage.value === "string" ? homepage.value.trim() : homepage.value;
+  if (homepageUrl === void 0 && logo.change === void 0 && darkLogo.change === void 0 && !derive) {
+    return { error: NOTHING_TO_UPDATE };
+  }
+  return {
+    plan: {
+      homepageUrl,
+      logo: logo.change,
+      darkLogo: darkLogo.change,
+      deriveLogosFromHomepage: derive
+    }
+  };
+}
+function slotFields(change, uploadedKey, variant) {
+  switch (change.action) {
+    case "clear":
+      return { url: null, s3Key: null };
+    case "url":
+      return { url: change.url, s3Key: null };
+    case "upload":
+      if (uploadedKey === void 0) {
+        throw new Error(
+          `Missing uploaded S3 key for the ${variant} logo; expected the upload step to run before building the update body.`
+        );
+      }
+      return { url: null, s3Key: uploadedKey };
+  }
+}
+function buildOrgUpdateBody(plan, uploaded) {
+  const body = {};
+  if (plan.homepageUrl !== void 0) {
+    body.homepageUrl = plan.homepageUrl;
+  }
+  if (plan.logo !== void 0) {
+    const fields = slotFields(plan.logo, uploaded.light, "light");
+    body.logoUrl = fields.url;
+    body.logoS3Key = fields.s3Key;
+  }
+  if (plan.darkLogo !== void 0) {
+    const fields = slotFields(plan.darkLogo, uploaded.dark, "dark");
+    body.darkModeLogoUrl = fields.url;
+    body.darkModeLogoS3Key = fields.s3Key;
+  }
+  return body;
+}
+function isEmptyOrgUpdate(body) {
+  return Object.keys(body).length === 0;
+}
+var MAX_DISPLAY_URL_LENGTH = 120;
+function formatUrlForDisplay(url2) {
+  if (url2 === null) {
+    return "\u2014";
+  }
+  const clean = sanitizeDisplay(url2);
+  return clean.length > MAX_DISPLAY_URL_LENGTH ? `${clean.slice(0, MAX_DISPLAY_URL_LENGTH - 1)}\u2026` : clean;
+}
+function failOrgOp(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Updating organization settings requires an organization admin signed in with a browser session (API keys are rejected)."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "Organization not found."));
+    process.exit(1);
+  }
+  if (status === 400 || status === 422) {
+    console.error(colorError(message ?? `Failed to ${action} (status ${status}).`));
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+async function uploadLogo(organizationId, variant, file2) {
+  const slot = await authenticatedRequest(
+    (client) => client.organization.generateLogoUploadUrl({
+      params: { organizationId },
+      body: { variant, contentType: file2.contentType, fileName: basename(file2.path) }
+    })
+  );
+  if (slot.status !== SUCCESS_STATUS) {
+    failOrgOp(`start the ${variant} logo upload`, slot.status, slot.body);
+  }
+  const bytes = readFileSync2(file2.path);
+  const put = await fetch(slot.body.uploadUrl, {
+    method: "PUT",
+    body: new Uint8Array(bytes),
+    headers: { "Content-Type": file2.contentType }
+  });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload of the ${variant} logo to storage failed (status ${put.status}). The upload link is short-lived; re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  return slot.body.s3Key;
+}
+function outputOrganization(org, output, derived) {
+  if (output === "json") {
+    console.log(JSON.stringify(org, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log("name	slug	homepageUrl	logoUrl	darkModeLogoUrl");
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(org.name)),
+        tsvSafe(sanitizeDisplay(org.slug)),
+        tsvSafe(sanitizeDisplay(org.homepageUrl ?? "")),
+        tsvSafe(sanitizeDisplay(org.logoUrl ?? "")),
+        tsvSafe(sanitizeDisplay(org.darkModeLogoUrl ?? ""))
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(`Updated organization ${sanitizeDisplay(org.name)} (${sanitizeDisplay(org.slug)})`)
+  );
+  if (derived) {
+    console.log("  Logos fetched from the homepage.");
+  }
+  console.log(`  Homepage:   ${formatUrlForDisplay(org.homepageUrl)}`);
+  console.log(`  Light logo: ${formatUrlForDisplay(org.logoUrl)}`);
+  console.log(`  Dark logo:  ${formatUrlForDisplay(org.darkModeLogoUrl)}`);
+}
+async function runUpdate2(options) {
+  const output = parseOutput(options.output);
+  const planned = planOrgUpdate(options);
+  if ("error" in planned) {
+    console.error(colorError(planned.error));
+    process.exit(1);
+  }
+  const { plan } = planned;
+  const organizationId = await resolveOrganizationId();
+  const uploaded = {};
+  if (plan.logo?.action === "upload") {
+    uploaded.light = await uploadLogo(organizationId, "light", plan.logo.file);
+  }
+  if (plan.darkLogo?.action === "upload") {
+    uploaded.dark = await uploadLogo(organizationId, "dark", plan.darkLogo.file);
+  }
+  let org = null;
+  const body = buildOrgUpdateBody(plan, uploaded);
+  if (!isEmptyOrgUpdate(body)) {
+    const result = await authenticatedRequest(
+      (client) => client.organization.updateOrganization({ params: { organizationId }, body })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      failOrgOp("update organization settings", result.status, result.body);
+    }
+    org = result.body;
+  }
+  if (plan.deriveLogosFromHomepage) {
+    const result = await authenticatedRequest(
+      (client) => client.organization.deriveLogosFromHomepage({ params: { organizationId }, body: {} })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      failOrgOp("fetch logos from the homepage", result.status, result.body);
+    }
+    org = result.body;
+  }
+  if (org === null) {
+    throw new Error("Organization update produced no response; expected at least one API call.");
+  }
+  outputOrganization(org, output, plan.deriveLogosFromHomepage);
+}
+function createOrgUpdateCommand() {
+  return new Command("update").description("Update the active organization's homepage URL and logos").option("--homepage <url>", "Homepage URL (https://...)").option("--clear-homepage", "Remove the homepage URL").option("--logo <file-or-url>", "Light-mode logo: an image file to upload, or an http(s) URL").option("--clear-logo", "Remove the light-mode logo").option(
+    "--dark-logo <file-or-url>",
+    "Dark-mode logo: an image file to upload, or an http(s) URL"
+  ).option("--clear-dark-logo", "Remove the dark-mode logo").option(
+    "--logos-from-homepage",
+    "Fetch light and dark logos from the homepage (after saving --homepage, if given)"
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Requires an organization admin signed in with \`tracecli auth login\`; API keys
+are rejected. Logo files upload straight to storage (.png, .jpg, .jpeg, .gif,
+.svg, .webp; 2 MB max). Saving a file or URL for a slot replaces whatever that
+slot held before.
+
+Examples:
+  tracecli org update --homepage https://acme.com
+  tracecli org update --homepage https://acme.com --logos-from-homepage
+  tracecli org update --logo ./logo.svg --dark-logo ./logo-dark.svg
+  tracecli org update --logo https://cdn.acme.com/logo.png
+  tracecli org update --clear-dark-logo
+  tracecli org update --homepage https://acme.com --output json`
+  ).action(async (options) => {
+    await runUpdate2(options);
+  });
+}
+
 // src/auth/commands.ts
 function getClientId() {
   const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
@@ -42360,10 +42674,13 @@ Examples:
   });
 }
 function createOrgCommand() {
-  const org = new Command("org").description("Manage active organization context");
+  const org = new Command("org").description(
+    "Manage active organization context and organization settings"
+  );
   org.addCommand(createOrgListCommand());
   org.addCommand(createOrgCurrentCommand());
   org.addCommand(createOrgSwitchCommand());
+  org.addCommand(createOrgUpdateCommand());
   return org;
 }
 function createAuthCommand() {
@@ -43428,7 +43745,7 @@ function createInboxCommand() {
 }
 
 // src/secret-input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 var SecretInputError = class extends Error {
 };
 function secretSourceCount(opts) {
@@ -43463,7 +43780,7 @@ async function resolveSecret(label, flagBase, opts, readStdin = defaultReadStdin
   if (opts.file !== void 0) {
     let contents;
     try {
-      contents = readFileSync2(opts.file, "utf8");
+      contents = readFileSync3(opts.file, "utf8");
     } catch {
       throw new SecretInputError(`Could not read ${label} file: ${opts.file}`);
     }
@@ -44049,7 +44366,7 @@ async function runGet2(credentialId, options) {
   }
   outputCredential(result.body, output);
 }
-async function runUpdate2(credentialId, options) {
+async function runUpdate3(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
@@ -44301,7 +44618,7 @@ Examples:
   tracecli credential update <id> --env <envId> --clear-auth-config`
   );
   return command.action(async (credentialId, options) => {
-    await runUpdate2(credentialId, options);
+    await runUpdate3(credentialId, options);
   });
 }
 function createDeleteCommand3() {
@@ -44790,7 +45107,7 @@ async function runGet3(environmentId, options) {
   }
   outputEnvironment(result.body, output);
 }
-async function runUpdate3(environmentId, options) {
+async function runUpdate4(environmentId, options) {
   const output = parseOutput(options.output);
   requireAppId(options.app);
   requireEnvId2(environmentId);
@@ -44901,7 +45218,7 @@ Examples:
   tracecli environment update <envId> --app <appId> --additional-url https://api.acme.com
   tracecli environment update <envId> --app <appId> --production`
   ).action(async (environmentId, options) => {
-    await runUpdate3(environmentId, options);
+    await runUpdate4(environmentId, options);
   });
 }
 function createDeleteCommand4() {
@@ -44920,7 +45237,7 @@ function createEnvironmentCommand() {
 }
 
 // src/metadata.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_PACKAGE_NAME = "securewithtrace";
@@ -44929,7 +45246,7 @@ function readPackageMetadata() {
   const currentFilePath = fileURLToPath(import.meta.url);
   const packageJsonPath = join5(dirname2(currentFilePath), "..", "package.json");
   try {
-    const rawPackageJson = readFileSync3(packageJsonPath, "utf-8");
+    const rawPackageJson = readFileSync4(packageJsonPath, "utf-8");
     const parsed = JSON.parse(rawPackageJson);
     if (typeof parsed !== "object" || parsed === null) {
       return { name: DEFAULT_PACKAGE_NAME, version: DEFAULT_VERSION };
@@ -44947,10 +45264,10 @@ var CLI_PACKAGE_NAME = packageMetadata.name;
 var CLI_VERSION = packageMetadata.version;
 
 // src/pentest/commands.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/pentest/create-finding.ts
-import { readFileSync as readFileSync4, statSync } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 
 // src/pentest/resolve.ts
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -45029,14 +45346,14 @@ function parseCreateFindingJsonFile(raw, sourceLabel) {
 }
 function readUtf8File(path, flag) {
   try {
-    const stats = statSync(path);
+    const stats = statSync2(path);
     if (!stats.isFile()) {
       return { error: `${flag} '${sanitizeDisplay(path)}' is not a regular file.` };
     }
   } catch {
     return { error: `Cannot read ${flag} '${sanitizeDisplay(path)}'.` };
   }
-  const text = readFileSync4(path, "utf8");
+  const text = readFileSync5(path, "utf8");
   if (text.trim().length === 0) {
     return { error: `${flag} '${sanitizeDisplay(path)}' is empty.` };
   }
@@ -45262,8 +45579,8 @@ function createCreateFindingCommand() {
 }
 
 // src/pentest/evidence.ts
-import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { basename } from "path";
+import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { basename as basename2 } from "path";
 var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
 var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
 function isSection(value) {
@@ -45272,7 +45589,7 @@ function isSection(value) {
 function isKind(value) {
   return PentestExploitArtifactKindValues.includes(value);
 }
-function formatBytes(bytes) {
+function formatBytes2(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
@@ -45325,7 +45642,7 @@ async function runAttachEvidence(options) {
   }
   let sizeBytes;
   try {
-    const stats = statSync2(options.file);
+    const stats = statSync3(options.file);
     if (!stats.isFile()) {
       console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
       process.exit(1);
@@ -45342,7 +45659,7 @@ async function runAttachEvidence(options) {
   if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
     console.error(
       colorError(
-        `File is ${formatBytes(sizeBytes)}; the limit for one exhibit is ${formatBytes(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
       )
     );
     process.exit(1);
@@ -45351,7 +45668,7 @@ async function runAttachEvidence(options) {
   const pentestId = await resolvePentestId(organizationId, options.pentest);
   const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
   const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename(options.file);
+  const filename = basename2(options.file);
   const slot = await authenticatedRequest(
     (client) => client.pentestFinding.createFindingEvidenceUpload({
       params,
@@ -45368,7 +45685,7 @@ async function runAttachEvidence(options) {
     );
     process.exit(1);
   }
-  const body = readFileSync5(options.file);
+  const body = readFileSync6(options.file);
   const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
   if (!put.ok) {
     console.error(
@@ -45408,7 +45725,7 @@ async function runAttachEvidence(options) {
   const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
   console.log(
     colorSuccess(
-      `Attached ${attached.body.kind} \xB7 ${formatBytes(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
     )
   );
   console.log(`  artifact ${attached.body.artifactId}`);
@@ -46246,7 +46563,7 @@ function outputPentestUpdate(pt, output) {
   }
   printPentestUpdateDetail(pt);
 }
-async function runUpdate4(pentestIdentifier, options) {
+async function runUpdate5(pentestIdentifier, options) {
   const output = parseOutput(options.output);
   const description = resolveClearableOption(
     options.description,
@@ -46316,7 +46633,7 @@ Examples:
   tracecli pentest update PT-3 --clear-concerns --clear-priorities
   tracecli pentest update PT-3 --title "Acme Q3" -o json`
   ).action(async (pentestId, options) => {
-    await runUpdate4(pentestId, options);
+    await runUpdate5(pentestId, options);
   });
 }
 function failQuestionnaire(status, body, action, notFoundLabel) {
@@ -46507,7 +46824,7 @@ async function runQuestionnaire(pentestIdentifier, options) {
   if (filePath !== void 0) {
     let raw;
     try {
-      raw = readFileSync6(filePath, "utf8");
+      raw = readFileSync7(filePath, "utf8");
     } catch {
       console.error(colorError(`Could not read answers file: ${filePath}`));
       process.exit(1);
@@ -46591,7 +46908,7 @@ function createPentestCommand() {
 }
 
 // src/update/commands.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname3, join as join6 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -46609,7 +46926,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync7(cachePath, "utf-8");
+    const rawCache = readFileSync8(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -46973,88 +47290,1043 @@ Examples:
   });
 }
 
-// src/vulnerabilities/commands.ts
-var DEFAULT_LIMIT3 = 30;
-var MAX_LIMIT3 = 100;
-var VULNERABILITY_FILTER_FIELDS = [
-  "repositoryId",
-  "severity",
-  "vulnerabilityType",
-  "status",
-  "cweId",
-  "scanMode"
-];
-function parseVulnerabilityFilter(expression) {
-  const match = expression.match(/^([^!=]+)(!=|=)(.+)$/);
-  if (!match?.[1] || !match[2] || !match[3]) {
-    return {
-      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. cweId=CWE-89).`
-    };
+// src/upload/prepare.ts
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync4 } from "fs";
+import { open } from "fs/promises";
+import { basename as basename3 } from "path";
+var CodeUploadPrepareError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadPrepareError";
+  }
+};
+var KIND_BY_INPUT = {
+  source: "SOURCE_ARCHIVE",
+  code: "SOURCE_ARCHIVE",
+  "source-archive": "SOURCE_ARCHIVE",
+  source_archive: "SOURCE_ARCHIVE",
+  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
+  apk: "ANDROID_APK",
+  android: "ANDROID_APK",
+  "android-apk": "ANDROID_APK",
+  android_apk: "ANDROID_APK",
+  ANDROID_APK: "ANDROID_APK",
+  ipa: "IOS_IPA",
+  ios: "IOS_IPA",
+  "ios-ipa": "IOS_IPA",
+  ios_ipa: "IOS_IPA",
+  IOS_IPA: "IOS_IPA"
+};
+function normalizeArtifactKind(input) {
+  const trimmed = input.trim();
+  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
+}
+function inferArtifactKindFromFilename(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
+  if (lower.endsWith(".apk")) return "ANDROID_APK";
+  if (lower.endsWith(".ipa")) return "IOS_IPA";
+  return null;
+}
+function requiredExtensionForKind(kind) {
+  if (kind === "ANDROID_APK") return ".apk";
+  if (kind === "IOS_IPA") return ".ipa";
+  return ".zip";
+}
+function defaultDisplayName(originalFilename) {
+  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base.slice(0, 200) || "source";
+}
+function formatArchiveBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) {
+    const kb = bytes / 1024;
+    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
   }
-  const field = match[1].trim();
-  const op = match[2];
-  const value = match[3].trim();
-  if (value.length === 0) {
-    return { error: `Filter value cannot be empty in expression '${expression}'.` };
+  if (bytes < 1024 * 1024 * 1024) {
+    const mb = bytes / (1024 * 1024);
+    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
   }
-  if (!VULNERABILITY_FILTER_FIELDS.includes(field)) {
-    return {
-      error: `Unknown filter field '${field}'. Supported fields: ${VULNERABILITY_FILTER_FIELDS.join(", ")}.`
-    };
+  const gb = bytes / (1024 * 1024 * 1024);
+  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
+}
+function archiveTooLargeMessage() {
+  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
+}
+async function hashFileSha256(filePath) {
+  const hash2 = createHash("sha256");
+  const stream = createReadStream(filePath);
+  for await (const chunk of stream) {
+    hash2.update(chunk);
   }
-  return { field, operator: op === "!=" ? "neq" : "eq", value };
+  return hash2.digest("hex");
 }
-async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
-  const result = await authenticatedRequest(
-    (client) => client.repository.listRepositories({
-      params: { organizationId }
-    })
-  );
-  if (result.status !== 200) {
-    console.error(`Failed to list repositories (status ${result.status}).`);
-    process.exit(1);
+async function readFileSlice(filePath, start, endExclusive) {
+  const length = endExclusive - start;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
+    throw new Error(
+      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
+    );
   }
-  const repos = result.body;
-  const isBareNameOnly = !repoIdentifier.includes("/") && !repoIdentifier.startsWith("http");
-  if (!isBareNameOnly) {
-    const match = repos.find((r2) => {
-      const url2 = r2.repositoryUrl;
-      if (url2.endsWith(`/${repoIdentifier}`)) return true;
-      if (url2.endsWith(`/${repoIdentifier}.git`)) return true;
-      if (url2 === repoIdentifier) return true;
-      return false;
-    });
-    if (match) {
-      return match.repositoryId;
+  const buffer = Buffer.alloc(length);
+  const handle = await open(filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    if (bytesRead !== length) {
+      throw new Error(
+        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
+      );
     }
+    return buffer;
+  } finally {
+    await handle.close();
   }
-  const byName = repos.filter((r2) => {
-    const segments = r2.repositoryUrl.replace(/\.git$/, "").split("/");
-    const name = segments[segments.length - 1];
-    return name === repoIdentifier;
-  });
-  if (byName.length === 1 && byName[0]) {
-    return byName[0].repositoryId;
-  }
-  if (byName.length > 1) {
-    console.error(
-      `Ambiguous repository name '${repoIdentifier}'. Multiple matches found:
-${byName.map((r2) => `  - ${r2.repositoryUrl}`).join("\n")}
-Please use the full owner/repo format.`
+}
+function assertPreparedMatchesUpload(upload, prepared) {
+  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
+    throw new CodeUploadPrepareError(
+      "The file does not match the interrupted upload (size or SHA-256 differs)."
     );
-    process.exit(1);
   }
-  console.error(
-    `Repository '${repoIdentifier}' not found.
-Run \`tracecli repo list\` to see available repositories.`
-  );
-  process.exit(1);
 }
-function formatSeverity(severity) {
-  switch (severity) {
-    case "CRITICAL":
-      return "CRIT";
-    case "HIGH":
+async function prepareUploadFile(filePath, options = {}) {
+  let sizeBytes;
+  try {
+    const stats = statSync4(filePath);
+    if (!stats.isFile()) {
+      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
+    }
+    sizeBytes = stats.size;
+  } catch (error48) {
+    if (error48 instanceof CodeUploadPrepareError) throw error48;
+    throw new CodeUploadPrepareError("Cannot read that file.");
+  }
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
+    throw new CodeUploadPrepareError("The file is empty.");
+  }
+  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
+    throw new CodeUploadPrepareError(archiveTooLargeMessage());
+  }
+  const originalFilename = basename3(filePath);
+  const inferred = inferArtifactKindFromFilename(originalFilename);
+  const artifactKind = options.artifactKind ?? inferred;
+  if (artifactKind == null) {
+    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
+  }
+  const expected = requiredExtensionForKind(artifactKind);
+  if (!originalFilename.toLowerCase().endsWith(expected)) {
+    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
+    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
+  }
+  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
+  if (displayName.length < 1 || displayName.length > 200) {
+    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
+  }
+  return {
+    path: filePath,
+    displayName,
+    originalFilename,
+    sizeBytes,
+    archiveSha256: await hashFileSha256(filePath),
+    artifactKind
+  };
+}
+
+// src/upload/multipart.ts
+var MAX_CONCURRENT_UPLOADS = 3;
+var MAX_PART_ATTEMPTS = 3;
+var MAX_URL_REFRESHES = 12;
+async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts, options = {}) {
+  assertUploadPlan(totalBytes, partSizeBytes, parts);
+  const fetchPart = options.fetch ?? globalThis.fetch;
+  const wait = options.wait ?? defaultWait;
+  let uploadedBytes = options.initialUploadedBytes ?? 0;
+  if (!Number.isSafeInteger(uploadedBytes) || uploadedBytes < 0 || uploadedBytes > totalBytes) {
+    throw new Error("Invalid multipart progress: uploaded byte count is outside the archive.");
+  }
+  options.onProgress?.(progress(uploadedBytes, totalBytes));
+  if (parts.length === 0) return;
+  const urls = new Map(parts.map((part) => [part.partNumber, part.uploadUrl]));
+  const refreshUrls = createUrlRefresher(urls, options.refreshParts);
+  let cursor3 = 0;
+  const workerCount = Math.min(MAX_CONCURRENT_UPLOADS, parts.length);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor3 < parts.length) {
+        const part = parts[cursor3];
+        cursor3 += 1;
+        if (!part) return;
+        const start = (part.partNumber - 1) * partSizeBytes;
+        const end = Math.min(start + partSizeBytes, totalBytes);
+        const body = await readFileSlice(filePath, start, end);
+        await uploadPartWithRetry(part.partNumber, urls, body, fetchPart, wait, refreshUrls);
+        uploadedBytes += body.byteLength;
+        options.onProgress?.(progress(uploadedBytes, totalBytes));
+      }
+    })
+  );
+}
+function createUrlRefresher(urls, refreshParts) {
+  if (!refreshParts) return async () => false;
+  let inflight = null;
+  let rounds = 0;
+  return async () => {
+    if (rounds >= MAX_URL_REFRESHES) return false;
+    if (!inflight) {
+      rounds += 1;
+      inflight = (async () => {
+        const fresh = await refreshParts();
+        for (const part of fresh) {
+          assertPresignedUploadUrl(part.uploadUrl);
+          urls.set(part.partNumber, part.uploadUrl);
+        }
+      })().finally(() => {
+        inflight = null;
+      });
+    }
+    await inflight;
+    return true;
+  };
+}
+function assertUploadPlan(totalBytes, partSizeBytes, parts) {
+  if (!Number.isSafeInteger(totalBytes) || totalBytes < 1) {
+    throw new Error("Invalid multipart upload: archive size must be a positive integer.");
+  }
+  if (!Number.isSafeInteger(partSizeBytes) || partSizeBytes < 1) {
+    throw new Error("Invalid multipart upload: part size must be a positive integer.");
+  }
+  const totalParts = Math.ceil(totalBytes / partSizeBytes);
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    if (!Number.isSafeInteger(part.partNumber) || part.partNumber < 1 || part.partNumber > totalParts || seen.has(part.partNumber)) {
+      throw new Error("Invalid multipart upload: part numbers must be unique and in range.");
+    }
+    assertPresignedUploadUrl(part.uploadUrl);
+    seen.add(part.partNumber);
+  }
+}
+async function uploadPartWithRetry(partNumber, urls, body, fetchPart, wait, refreshUrls) {
+  let lastStatus = null;
+  for (let attempt = 1; attempt <= MAX_PART_ATTEMPTS; attempt += 1) {
+    const uploadUrl = urls.get(partNumber);
+    if (!uploadUrl) {
+      throw new Error(`Source upload part ${partNumber.toString()} has no upload URL.`);
+    }
+    try {
+      const response = await fetchPart(uploadUrl, {
+        method: "PUT",
+        body: new Uint8Array(body),
+        redirect: "error"
+      });
+      if (response.ok) return;
+      lastStatus = response.status;
+      if (response.status === 403 && await refreshUrls()) {
+        attempt -= 1;
+        continue;
+      }
+      if (response.status >= 400 && response.status < 500 && response.status !== 408) break;
+    } catch {
+      lastStatus = null;
+    }
+    if (attempt < MAX_PART_ATTEMPTS) {
+      await wait(250 * 2 ** (attempt - 1));
+    }
+  }
+  const statusDetail = lastStatus === null ? "network error" : `status ${lastStatus.toString()}`;
+  throw new Error(
+    `Source upload part ${partNumber.toString()} failed after retries (${statusDetail}).`
+  );
+}
+function assertPresignedUploadUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new Error("Invalid multipart upload: the API returned an invalid part URL.");
+  }
+  const localHttp = url2.protocol === "http:" && (url2.hostname === "localhost" || url2.hostname === "127.0.0.1" || url2.hostname === "host.docker.internal");
+  if (url2.protocol !== "https:" && !localHttp) {
+    throw new Error("Invalid multipart upload: part URLs must use HTTPS.");
+  }
+}
+function progress(uploadedBytes, totalBytes) {
+  return {
+    uploadedBytes,
+    totalBytes,
+    fraction: totalBytes === 0 ? 0 : Math.min(1, uploadedBytes / totalBytes)
+  };
+}
+function defaultWait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+// src/upload/commands.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
+var DEFAULT_RUNTIME = {
+  wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  pollIntervalMs: 3e3,
+  fetch: (input, init) => globalThis.fetch(input, init)
+};
+function resolveRuntime(runtime) {
+  return {
+    wait: runtime.wait ?? DEFAULT_RUNTIME.wait,
+    pollIntervalMs: runtime.pollIntervalMs ?? DEFAULT_RUNTIME.pollIntervalMs,
+    fetch: runtime.fetch ?? DEFAULT_RUNTIME.fetch
+  };
+}
+function isTerminalCodeUploadStatus(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+function requireUuid(value, label) {
+  if (!isUuid(value)) {
+    console.error(colorError(`Invalid ${label} '${sanitizeDisplay(value)}'. Expected a UUID.`));
+    process.exit(1);
+  }
+  return value;
+}
+function parseKindOption(value) {
+  if (value === void 0) return void 0;
+  const kind = normalizeArtifactKind(value);
+  if (kind == null) {
+    console.error(
+      colorError(`Invalid --kind '${sanitizeDisplay(value)}'. Use source (code ZIP), apk, or ipa.`)
+    );
+    process.exit(1);
+  }
+  return kind;
+}
+function failPrepare(error48) {
+  const message = error48 instanceof CodeUploadPrepareError ? error48.message : error48 instanceof Error ? error48.message : "Failed to prepare the file.";
+  console.error(colorError(message));
+  process.exit(1);
+}
+function failWriteOp5(action, status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} source uploads.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CODE_UPLOAD_NOT_READY") {
+      console.error(
+        colorError(
+          message ?? "The upload must be ready and pass malware scanning before it can be linked. Run `tracecli upload wait <id>`."
+        )
+      );
+    } else if (errorCode === "CODE_UPLOAD_NOT_SOURCE") {
+      console.error(
+        colorError(message ?? "APK and IPA uploads cannot be linked as source repositories.")
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} upload (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function failReadOp5(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only an organization admin (or Trace staff) on a pentest-enabled organization can view source uploads."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function resumeHint(codeUploadId, filePath) {
+  return `Resume with: tracecli upload resume ${codeUploadId} ${filePath}`;
+}
+function buildUploadsTable(uploads) {
+  const cells = uploads.map((upload) => ({
+    name: sanitizeDisplay(upload.displayName),
+    kind: formatStatus(upload.artifactKind),
+    status: formatStatus(upload.status),
+    size: formatArchiveBytes(upload.sizeBytes),
+    id: upload.codeUploadId
+  }));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c59) => c59.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c59) => c59.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c59) => c59.size.length));
+  const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
+  const rows = cells.map(
+    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.kind.padEnd(kindWidth)}  ${c59.status.padEnd(statusWidth)}  ${c59.size.padEnd(sizeWidth)}  ${c59.id}`
+  );
+  return { header, rows };
+}
+function renderUploadDetail(upload) {
+  const pad = 18;
+  const linked = upload.linkedApplications.length === 0 ? "\u2014" : upload.linkedApplications.map((app) => `${sanitizeDisplay(app.name)} (${app.applicationId})`).join(", ");
+  return [
+    `${"Name:".padEnd(pad)} ${sanitizeDisplay(upload.displayName)}`,
+    `${"Filename:".padEnd(pad)} ${sanitizeDisplay(upload.originalFilename)}`,
+    `${"Kind:".padEnd(pad)} ${formatStatus(upload.artifactKind)}`,
+    `${"Status:".padEnd(pad)} ${formatStatus(upload.status)}`,
+    `${"Size:".padEnd(pad)} ${formatArchiveBytes(upload.sizeBytes)}`,
+    `${"SHA-256:".padEnd(pad)} ${upload.archiveSha256}`,
+    `${"Upload ID:".padEnd(pad)} ${upload.codeUploadId}`,
+    `${"Repository ID:".padEnd(pad)} ${upload.repositoryId}`,
+    `${"Malware:".padEnd(pad)} ${upload.malwareScanResult ? formatStatus(upload.malwareScanResult) : "\u2014"}`,
+    `${"Rejection:".padEnd(pad)} ${upload.rejectionReason ? formatStatus(upload.rejectionReason) : "\u2014"}`,
+    `${"Linked apps:".padEnd(pad)} ${linked}`,
+    `${"Created:".padEnd(pad)} ${formatDate(upload.createdAt)}`,
+    `${"Ready:".padEnd(pad)} ${formatDate(upload.readyAt)}`
+  ].join("\n");
+}
+function printUploadsTsv(uploads) {
+  console.log(
+    [
+      "codeUploadId",
+      "repositoryId",
+      "displayName",
+      "originalFilename",
+      "artifactKind",
+      "status",
+      "sizeBytes",
+      "archiveSha256",
+      "malwareScanResult",
+      "rejectionReason",
+      "applicationId",
+      "createdAt",
+      "readyAt"
+    ].join("	")
+  );
+  for (const upload of uploads) {
+    console.log(
+      [
+        tsvSafe(upload.codeUploadId),
+        tsvSafe(upload.repositoryId),
+        tsvSafe(sanitizeDisplay(upload.displayName)),
+        tsvSafe(sanitizeDisplay(upload.originalFilename)),
+        tsvSafe(upload.artifactKind),
+        tsvSafe(upload.status),
+        String(upload.sizeBytes),
+        tsvSafe(upload.archiveSha256),
+        tsvSafe(upload.malwareScanResult ?? ""),
+        tsvSafe(upload.rejectionReason ?? ""),
+        tsvSafe(upload.applicationId ?? ""),
+        tsvSafe(toIso(upload.createdAt)),
+        tsvSafe(upload.readyAt ? toIso(upload.readyAt) : "")
+      ].join("	")
+    );
+  }
+}
+function outputUpload(upload, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(upload, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv([upload]);
+    return;
+  }
+  console.log(renderUploadDetail(upload));
+}
+function writeProgress(progress2) {
+  if (!process.stderr.isTTY) return;
+  const pct = Math.floor(progress2.fraction * 100);
+  process.stderr.write(
+    `\rUploading ${pct}% (${formatArchiveBytes(progress2.uploadedBytes)} / ${formatArchiveBytes(progress2.totalBytes)})`
+  );
+}
+function finishProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+async function listUploads(organizationId, query = {}) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.listCodeUploads({
+      params: { organizationId },
+      query
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp5("list uploads", result.status, result.body);
+  }
+  return result.body.uploads;
+}
+async function requireUpload(organizationId, codeUploadId, query = {}) {
+  const uploads = await listUploads(organizationId, query);
+  const match = uploads.find((upload) => upload.codeUploadId === codeUploadId);
+  if (!match) {
+    console.error(colorError(`No code upload '${codeUploadId}'.`));
+    process.exit(1);
+  }
+  return match;
+}
+async function refreshRemainingParts(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", result.status, result.body);
+  }
+  return result.body.multipart.parts;
+}
+async function completeUpload(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.completeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== ACCEPTED_STATUS) {
+    failWriteOp5("complete", result.status, result.body);
+  }
+  return result.body;
+}
+async function waitForTerminal(organizationId, codeUploadId, runtime) {
+  for (; ; ) {
+    const upload = await requireUpload(organizationId, codeUploadId);
+    if (isTerminalCodeUploadStatus(upload.status)) {
+      return upload;
+    }
+    if (process.stderr.isTTY) {
+      process.stderr.write(`\rWaiting for malware scan (${formatStatus(upload.status)})...`);
+    }
+    await runtime.wait(runtime.pollIntervalMs);
+  }
+}
+function printWaitOutcome(upload, output) {
+  if (output !== "table") {
+    outputUpload(upload, output);
+    if (upload.status !== "READY") process.exit(1);
+    return;
+  }
+  if (upload.status === "READY") {
+    console.log(colorSuccess(`Upload ${upload.codeUploadId} is ready.`));
+    outputUpload(upload, output);
+    if (upload.artifactKind === "SOURCE_ARCHIVE") {
+      console.log(
+        `Link it with: tracecli upload link --app <applicationId> --upload ${upload.codeUploadId}`
+      );
+    }
+    return;
+  }
+  const reason = upload.rejectionReason ? ` (${formatStatus(upload.rejectionReason)})` : "";
+  console.error(
+    colorError(`Upload ${upload.codeUploadId} ended as ${formatStatus(upload.status)}${reason}.`)
+  );
+  outputUpload(upload, output);
+  process.exit(1);
+}
+async function runTransfer(filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath, {
+      displayName: options.name,
+      artifactKind: options.artifactKind
+    });
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const initialized = await authenticatedRequest(
+    (client) => client.codeUpload.initializeCodeUpload({
+      params: { organizationId },
+      body: {
+        displayName: prepared.displayName,
+        originalFilename: prepared.originalFilename,
+        sizeBytes: prepared.sizeBytes,
+        archiveSha256: prepared.archiveSha256,
+        artifactKind: prepared.artifactKind,
+        ...options.applicationId !== void 0 ? { applicationId: options.applicationId } : {}
+      }
+    })
+  );
+  if (initialized.status !== CREATED_STATUS) {
+    failWriteOp5("create", initialized.status, initialized.body);
+  }
+  const codeUploadId = initialized.body.upload.codeUploadId;
+  if (output === "table") {
+    console.error(
+      `Initialized upload ${codeUploadId} (${formatArchiveBytes(prepared.sizeBytes)}).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      initialized.body.multipart.partSizeBytes,
+      initialized.body.multipart.parts,
+      {
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runCreate5(filePath, options, runtime) {
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred != null && isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "That file is a mobile build, not a source archive. Attach it to an existing application with:"
+      )
+    );
+    console.error("  tracecli upload build <file> --app <applicationId>");
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      artifactKind: "SOURCE_ARCHIVE"
+    },
+    runtime
+  );
+}
+async function runBuild(filePath, options, runtime) {
+  const applicationId = requireUuid(options.app, "--app");
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred == null || !isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "Build uploads are an APK or IPA attached to an existing application. For a source ZIP, use `tracecli upload create <file>`."
+      )
+    );
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      applicationId,
+      artifactKind: inferred
+    },
+    runtime
+  );
+}
+async function runResume(codeUploadIdArg, filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const resumed = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (resumed.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", resumed.status, resumed.body);
+  }
+  try {
+    assertPreparedMatchesUpload(resumed.body.upload, prepared);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const uploadedBytes = resumed.body.multipart.uploadedParts.reduce(
+    (sum, part) => sum + part.sizeBytes,
+    0
+  );
+  if (output === "table") {
+    console.error(
+      `Resuming upload ${codeUploadId} (${formatArchiveBytes(uploadedBytes)} already stored).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      resumed.body.multipart.partSizeBytes,
+      resumed.body.multipart.parts,
+      {
+        initialUploadedBytes: uploadedBytes,
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runList5(options) {
+  const output = parseOutput(options.output);
+  if (options.web) {
+    const slug = await resolveOrganizationSlug();
+    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/sources`;
+    const opened = await openBrowser(url2);
+    if (!opened) console.log(url2);
+    return;
+  }
+  const kind = parseKindOption(options.kind);
+  const applicationId = options.app !== void 0 ? requireUuid(options.app, "--app") : void 0;
+  const organizationId = await resolveOrganizationId();
+  const uploads = await listUploads(organizationId, {
+    ...kind !== void 0 ? { artifactKind: kind } : {},
+    ...applicationId !== void 0 ? { applicationId } : {}
+  });
+  if (output === "json") {
+    console.log(JSON.stringify({ uploads }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv(uploads);
+    return;
+  }
+  if (uploads.length === 0) {
+    console.log("No source uploads found.");
+    return;
+  }
+  const { header, rows } = buildUploadsTable(uploads);
+  await runInteractivePager({
+    items: uploads,
+    header,
+    renderItem: (_upload, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+async function runGet4(codeUploadIdArg, options) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  outputUpload(upload, output);
+}
+async function runWait(codeUploadIdArg, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await waitForTerminal(organizationId, codeUploadId, runtime);
+  if (process.stderr.isTTY) process.stderr.write("\n");
+  printWaitOutcome(upload, output);
+}
+async function runDelete5(codeUploadIdArg, options) {
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const confirmed = await confirmDeletion(`upload ${codeUploadId}`, options.yes);
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.deleteCodeUpload({
+      params: { organizationId, codeUploadId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failWriteOp5("delete", result.status, result.body);
+  }
+  console.log(colorSuccess(`Deleted upload ${codeUploadId}`));
+}
+async function runLink(options) {
+  const output = parseOutput(options.output);
+  const applicationId = requireUuid(options.app, "--app");
+  const codeUploadId = requireUuid(options.upload, "--upload");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  if (isApplicationBuildArtifactKind(upload.artifactKind)) {
+    console.error(colorError("APK and IPA uploads cannot be linked as source repositories."));
+    process.exit(1);
+  }
+  if (upload.status !== "READY" || upload.malwareScanResult !== "NO_THREATS_FOUND") {
+    console.error(
+      colorError(
+        `Upload is ${formatStatus(upload.status)}; it must be ready and pass malware scanning before it can be linked.`
+      )
+    );
+    process.exit(1);
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.createApplicationRepository({
+      params: { organizationId, applicationId },
+      body: {
+        repositoryId: upload.repositoryId,
+        ...options.path !== void 0 ? { repositoryPath: options.path } : {}
+      }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failWriteOp5("link", result.status, result.body);
+  }
+  if (output === "json") {
+    console.log(JSON.stringify(result.body, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["applicationId", "repositoryId", "codeUploadId"].join("	"));
+    console.log([applicationId, upload.repositoryId, codeUploadId].join("	"));
+    return;
+  }
+  console.log(
+    colorSuccess(`Linked ${sanitizeDisplay(upload.displayName)} to application ${applicationId}.`)
+  );
+}
+function createCreateCommand5(runtime) {
+  return new Command("create").alias("source").description("Upload a source ZIP as a code archive (not a mobile build)").argument("<file>", "Path to a .zip source archive").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+This is a code upload: a source ZIP that becomes an uploaded repository after
+it is ready. Link it with \`upload link\`. APK and IPA files belong on
+\`upload build --app\`, which attaches a build to an existing application.
+
+Requires a human login (\`tracecli auth login\`) on a pentest-enabled organization.
+API keys are rejected.
+
+Examples:
+  tracecli upload create ./checkout.zip
+  tracecli upload create ./checkout.zip --name "Checkout" --wait`
+  ).action(async (file2, options) => {
+    await runCreate5(file2, options, runtime);
+  });
+}
+function createBuildCommand(runtime) {
+  return new Command("build").description("Upload an APK or IPA and attach it to an existing application").argument("<file>", "Path to an .apk or .ipa").requiredOption("--app <applicationId>", "Application that owns this build").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Build uploads are not source archives. They attach to --app immediately and
+cannot be linked as a repository. For a source ZIP, use \`upload create\`.
+
+Examples:
+  tracecli upload build ./app-release.apk --app <applicationId>
+  tracecli upload build ./app.ipa --app <applicationId> --name "iOS build"`
+  ).action(async (file2, options) => {
+    await runBuild(file2, options, runtime);
+  });
+}
+function createListCommand7() {
+  return new Command("list").description("List source and build uploads in the active organization").option("--kind <kind>", "Filter: source (code ZIP), apk, or ipa").option("--app <applicationId>", "Filter build uploads for one application").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").option("-w, --web", "Open the source uploads page in a browser").action(async (options) => {
+    await runList5(options);
+  });
+}
+function createGetCommand4() {
+  return new Command("get").description("Show a single upload").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runGet4(codeUploadId, options);
+  });
+}
+function createResumeCommand(runtime) {
+  return new Command("resume").description("Resume an interrupted upload with the same file").argument("<codeUploadId>", "Upload UUID from the interrupted create").argument("<file>", "The same .zip, .apk, or .ipa file").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The file must match the original size and SHA-256. Trace skips parts that
+already landed in storage.
+
+Examples:
+  tracecli upload resume <codeUploadId> ./checkout.zip`
+  ).action(async (codeUploadId, file2, options) => {
+    await runResume(codeUploadId, file2, options, runtime);
+  });
+}
+function createWaitCommand(runtime) {
+  return new Command("wait").description("Wait until an upload finishes malware scanning and validation").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runWait(codeUploadId, options, runtime);
+  });
+}
+function createDeleteCommand5() {
+  return new Command("delete").description("Delete an uploaded archive and its stored bytes").argument("<codeUploadId>", "Upload UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (codeUploadId, options) => {
+    await runDelete5(codeUploadId, options);
+  });
+}
+function createLinkCommand() {
+  return new Command("link").description("Link a ready source upload to an application").requiredOption("--app <applicationId>", "Application UUID").requiredOption("--upload <codeUploadId>", "Upload UUID (must be a ready source ZIP)").option("--path <repositoryPath>", "Path within the archive").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Only a READY source archive that passed malware scanning can be linked.
+APK and IPA builds attach to an application with \`upload build --app\`.
+
+Examples:
+  tracecli upload link --app <applicationId> --upload <codeUploadId>`
+  ).action(async (options) => {
+    await runLink(options);
+  });
+}
+function createUploadCommand(runtime = {}) {
+  const resolved = resolveRuntime(runtime);
+  const upload = new Command("upload").alias("code-upload").description("Upload source archives (and separately, mobile builds) for pentest");
+  upload.addCommand(createCreateCommand5(resolved));
+  upload.addCommand(createBuildCommand(resolved));
+  upload.addCommand(createListCommand7());
+  upload.addCommand(createGetCommand4());
+  upload.addCommand(createResumeCommand(resolved));
+  upload.addCommand(createWaitCommand(resolved));
+  upload.addCommand(createDeleteCommand5());
+  upload.addCommand(createLinkCommand());
+  return upload;
+}
+
+// src/vulnerabilities/commands.ts
+var DEFAULT_LIMIT3 = 30;
+var MAX_LIMIT3 = 100;
+var VULNERABILITY_FILTER_FIELDS = [
+  "repositoryId",
+  "severity",
+  "vulnerabilityType",
+  "status",
+  "cweId",
+  "scanMode"
+];
+function parseVulnerabilityFilter(expression) {
+  const match = expression.match(/^([^!=]+)(!=|=)(.+)$/);
+  if (!match?.[1] || !match[2] || !match[3]) {
+    return {
+      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. cweId=CWE-89).`
+    };
+  }
+  const field = match[1].trim();
+  const op = match[2];
+  const value = match[3].trim();
+  if (value.length === 0) {
+    return { error: `Filter value cannot be empty in expression '${expression}'.` };
+  }
+  if (!VULNERABILITY_FILTER_FIELDS.includes(field)) {
+    return {
+      error: `Unknown filter field '${field}'. Supported fields: ${VULNERABILITY_FILTER_FIELDS.join(", ")}.`
+    };
+  }
+  return { field, operator: op === "!=" ? "neq" : "eq", value };
+}
+async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
+  const result = await authenticatedRequest(
+    (client) => client.repository.listRepositories({
+      params: { organizationId }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to list repositories (status ${result.status}).`);
+    process.exit(1);
+  }
+  const repos = result.body;
+  const isBareNameOnly = !repoIdentifier.includes("/") && !repoIdentifier.startsWith("http");
+  if (!isBareNameOnly) {
+    const match = repos.find((r2) => {
+      const url2 = r2.repositoryUrl;
+      if (url2.endsWith(`/${repoIdentifier}`)) return true;
+      if (url2.endsWith(`/${repoIdentifier}.git`)) return true;
+      if (url2 === repoIdentifier) return true;
+      return false;
+    });
+    if (match) {
+      return match.repositoryId;
+    }
+  }
+  const byName = repos.filter((r2) => {
+    const segments = r2.repositoryUrl.replace(/\.git$/, "").split("/");
+    const name = segments[segments.length - 1];
+    return name === repoIdentifier;
+  });
+  if (byName.length === 1 && byName[0]) {
+    return byName[0].repositoryId;
+  }
+  if (byName.length > 1) {
+    console.error(
+      `Ambiguous repository name '${repoIdentifier}'. Multiple matches found:
+${byName.map((r2) => `  - ${r2.repositoryUrl}`).join("\n")}
+Please use the full owner/repo format.`
+    );
+    process.exit(1);
+  }
+  console.error(
+    `Repository '${repoIdentifier}' not found.
+Run \`tracecli repo list\` to see available repositories.`
+  );
+  process.exit(1);
+}
+function formatSeverity(severity) {
+  switch (severity) {
+    case "CRITICAL":
+      return "CRIT";
+    case "HIGH":
       return "HIGH";
     case "MEDIUM":
       return "MED";
@@ -47149,7 +48421,7 @@ function printVulnerabilityDetailTsv(vulnerability) {
   ].map(sanitizeTsvField);
   console.log(cols.join("	"));
 }
-function createGetCommand4() {
+function createGetCommand5() {
   return new Command("get").description("Get a vulnerability by display ID or UUID").argument("<id>", "Vulnerability display ID (e.g. TRACE-123 or 123) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerability detail page in a browser").addHelpText(
     "after",
     `
@@ -47208,7 +48480,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand7() {
+function createListCommand8() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -47341,8 +48613,8 @@ Examples:
 }
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
-  vulnerabilities.addCommand(createGetCommand4());
-  vulnerabilities.addCommand(createListCommand7());
+  vulnerabilities.addCommand(createGetCommand5());
+  vulnerabilities.addCommand(createListCommand8());
   return vulnerabilities;
 }
 
@@ -47365,6 +48637,7 @@ program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createCodeSizeCommand());
+program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());