securewithtrace 0.40.1 → 0.42.0

package/dist/index.js

@@ -6276,7 +6276,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c59) => c59 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c62) => c62 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16320,9 +16320,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c59 = inst._zod.bag;
-  inst.minDate = c59.minimum ? new Date(c59.minimum) : null;
-  inst.maxDate = c59.maximum ? new Date(c59.maximum) : null;
+  const c62 = inst._zod.bag;
+  inst.minDate = c62.minimum ? new Date(c62.minimum) : null;
+  inst.maxDate = c62.maximum ? new Date(c62.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -21920,6 +21920,17 @@ var ContestReasonValues = [
   "OTHER"
 ];
 var ContestReason = external_exports.enum(ContestReasonValues);
+var PentestFindingFeedbackRatingValues = ["THUMBS_UP", "THUMBS_DOWN"];
+var PentestFindingFeedbackRating = external_exports.enum(PentestFindingFeedbackRatingValues);
+var PentestFindingFeedbackReasonValues = [
+  "FALSE_POSITIVE",
+  "SEVERITY_TOO_HIGH",
+  "SEVERITY_TOO_LOW",
+  "UNCLEAR_WRITEUP",
+  "REMEDIATION_NOT_ACTIONABLE",
+  "OTHER"
+];
+var PentestFindingFeedbackReason = external_exports.enum(PentestFindingFeedbackReasonValues);
 var ManualRetestOutcomeValues = ["FIXED", "PARTIALLY_FIXED", "NOT_FIXED"];
 var ManualRetestOutcome = external_exports.enum(ManualRetestOutcomeValues);
 var RetestOutcomeValues = [...ManualRetestOutcomeValues, "UNABLE_TO_VERIFY"];
@@ -21998,7 +22009,7 @@ var PentestEditActionValues = [
   "DELIVER"
 ];
 var PentestEditAction = external_exports.enum(PentestEditActionValues);
-var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY"];
+var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY", "STAFF"];
 var PentestAuditActorType = external_exports.enum(PentestAuditActorTypeValues);
 var PentestHypothesisStatusValues = [
   "DRAFTED",
@@ -22362,6 +22373,20 @@ var AgentSessionEventPayloadUrlResponseSchema = external_exports.object({
   /** Presigned S3 GET for the overflow payload (short TTL). */
   url: external_exports.url()
 });
+var ExportAgentSessionTranscriptResponseSchema = external_exports.object({
+  /** Presigned S3 GET with an attachment Content-Disposition (short TTL). */
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date(),
+  fileName: external_exports.string(),
+  /** Bytes of the exported document. */
+  sizeBytes: external_exports.number().int().nonnegative(),
+  eventCount: external_exports.number().int().nonnegative(),
+  subagentCount: external_exports.number().int().nonnegative(),
+  /** High-water mark captured by the export; a live session keeps moving past it. */
+  lastEventSeq: external_exports.number().int().nonnegative(),
+  /** Overflow payloads whose S3 object no longer exists; the export keeps the inline preview for those. */
+  missingOverflowPayloadCount: external_exports.number().int().nonnegative()
+});
 var SendAgentSessionMessageResponseSchema = external_exports.object({
   event: AgentSessionEventResponseSchema,
   /** True when the message relaunched a parked session. */
@@ -22507,6 +22532,21 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  // POST, not GET: each call assembles the transcript from Postgres + S3 overflow
+  // objects and writes a new export object before presigning it.
+  exportTranscript: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/transcript-export",
+    pathParams: AgentSessionIdParamsSchema,
+    body: null,
+    responses: {
+      200: ExportAgentSessionTranscriptResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   sendMessage: {
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/messages",
@@ -23731,11 +23771,19 @@ var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
   canViewInline: external_exports.boolean().optional(),
   /**
    * What the Download action hands the customer: the PDF alone, or one zip
-   * carrying the PDF, the markdown report, and the evidence files (partner
-   * templates whose tooling consumes the markdown). Preview always opens the
-   * PDF. Optional for the deploy-order reason above; consumers default to 'pdf'.
+   * carrying the PDF, the Word document, the markdown report, and the evidence
+   * files (partner templates whose tooling consumes the markdown). Preview
+   * always opens the PDF. Optional for the deploy-order reason above; consumers
+   * default to 'pdf'.
+   */
+  downloadFormat: CustomerReportDownloadFormatSchema.optional(),
+  /**
+   * Whether a Word document (.docx) from the same render as the served PDF is
+   * available through `downloadCustomer?artifact=docx`. Partner templates only;
+   * resolved server-side from storage, never from the template alone. Optional
+   * for the deploy-order reason above; consumers default to false.
    */
-  downloadFormat: CustomerReportDownloadFormatSchema.optional()
+  docxAvailable: external_exports.boolean().optional()
 });
 var GetCustomerReportPdfResponseSchema = external_exports.object({
   report: CustomerReportPdfResponseSchema.nullable()
@@ -23749,8 +23797,13 @@ var DeleteReportPdfRequestSchema = external_exports.object({
 var DeleteReportIssueRequestSchema = external_exports.object({
   reason: external_exports.string().min(1).max(1e4).optional()
 }).strict().optional();
+var ReportPdfDownloadArtifactValues = ["pdf", "markdown", "docx"];
+var ReportPdfDownloadArtifactSchema = external_exports.enum(ReportPdfDownloadArtifactValues);
 var ReportPdfDownloadQuerySchema = external_exports.object({
-  artifact: external_exports.enum(["pdf", "markdown"]).optional()
+  artifact: ReportPdfDownloadArtifactSchema.optional()
+});
+var CustomerReportPdfDownloadQuerySchema = PentestPdfDownloadQuerySchema.extend({
+  artifact: external_exports.enum(["docx"]).optional()
 });
 var ReportPdfDownloadResponseSchema = external_exports.object({
   report: ReportPdfResponseSchema,
@@ -24318,6 +24371,10 @@ var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
 var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit({
   repositoryId: true
 });
+var CustomerFindingPendingRetestSchema = external_exports.object({
+  state: external_exports.enum(["QUEUED", "RUNNING"]),
+  since: external_exports.coerce.date()
+}).nullable().default(null);
 var CustomerPentestFindingResponseSchema = PentestFindingResponseSchema.omit({
   organizationId: true,
   pentestId: true,
@@ -24341,7 +24398,8 @@ var CustomerPentestFindingResponseSchema = PentestFindingResponseSchema.omit({
   // customer "dispute under review" hint + suppresses the re-dispute affordance,
   // even after a retest moved the finding off CONTESTED. Only this derived
   // boolean crosses the trust boundary — never the staff contest list.
-  hasOpenContest: external_exports.boolean()
+  hasOpenContest: external_exports.boolean(),
+  pendingRetest: CustomerFindingPendingRetestSchema
 });
 var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   organizationId: true,
@@ -24356,7 +24414,10 @@ var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   // Published-only, same as the customer detail schema above — re-narrowed from the
   // nullable root.
   displayId: external_exports.number().int().positive(),
-  repositories: external_exports.array(CustomerPentestFindingRepositorySchema)
+  repositories: external_exports.array(CustomerPentestFindingRepositorySchema),
+  // On the list row too: the findings table is what the customer watches while a
+  // retest they queued runs, and polling it is how the row flips without a reload.
+  pendingRetest: CustomerFindingPendingRetestSchema
 });
 var ListCustomerPentestFindingsResponseSchema = external_exports.array(
   CustomerPentestFindingListItemSchema
@@ -24365,6 +24426,7 @@ var ListCustomerPentestFindingDeliveryResponseSchema = external_exports.array(
   CustomerPentestFindingListItemSchema
 );
 var ResolutionTimelineActor = external_exports.enum(["CUSTOMER", "TRACE"]);
+var ResolutionTimelineActorName = external_exports.string().nullable().default(null);
 var ResolutionTimelineVia = external_exports.object({
   provider: external_exports.enum(["LINEAR"]),
   identifier: external_exports.string(),
@@ -24375,12 +24437,17 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("remediation_reported"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string().nullable(),
     via: ResolutionTimelineVia
   }),
+  // Retests are run by Trace (staff or a Trace agent), so the actor is fixed;
+  // the default keeps a web build ahead of the api parsing older payloads.
   external_exports.object({
     kind: external_exports.literal("retest"),
     at: external_exports.coerce.date(),
+    actor: external_exports.literal("TRACE").default("TRACE"),
+    actorName: ResolutionTimelineActorName,
     outcome: RetestOutcome,
     note: external_exports.string().nullable()
   }),
@@ -24388,12 +24455,14 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("accepted_with_controls"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string()
   }),
   external_exports.object({
     kind: external_exports.literal("dismissed"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     reason: PentestFindingDismissReason,
     note: external_exports.string()
   }),
@@ -24403,6 +24472,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("reopened"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     toStatus: external_exports.enum(["OPEN", "IN_PROGRESS"]),
     note: external_exports.string().nullable(),
     via: ResolutionTimelineVia
@@ -24412,6 +24482,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("note"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string()
   }),
   // Customer opened a dispute (PR 3). `note` = the customer's justification.
@@ -24419,6 +24490,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("contested"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     reason: ContestReason,
     note: external_exports.string()
   }),
@@ -24429,6 +24501,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("contest_resolved"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     resultStatus: PentestFindingStatus.nullable(),
     note: external_exports.string()
   }),
@@ -24438,22 +24511,61 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("ticket_created"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     provider: external_exports.enum(["LINEAR"]),
     identifier: external_exports.string(),
     url: external_exports.url()
+  }),
+  // A reader rated the finding. `reason` is set only on a thumbs down; `note` is
+  // the optional comment left with the vote.
+  external_exports.object({
+    kind: external_exports.literal("feedback_rated"),
+    at: external_exports.coerce.date(),
+    actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
+    rating: PentestFindingFeedbackRating,
+    reason: PentestFindingFeedbackReason.nullable(),
+    note: external_exports.string().nullable()
+  }),
+  // A reader left a comment without a vote.
+  external_exports.object({
+    kind: external_exports.literal("feedback_commented"),
+    at: external_exports.coerce.date(),
+    actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
+    note: external_exports.string()
   })
 ]);
 var ResolutionTimelineSchema = external_exports.array(ResolutionTimelineEntrySchema);
+var PentestFindingFeedbackSummarySchema = external_exports.object({
+  thumbsUp: external_exports.number().int().nonnegative(),
+  thumbsDown: external_exports.number().int().nonnegative(),
+  viewerRating: PentestFindingFeedbackRating.nullable()
+});
+var PentestFindingFeedbackSummaryField = PentestFindingFeedbackSummarySchema.default({
+  thumbsUp: 0,
+  thumbsDown: 0,
+  viewerRating: null
+});
 var PentestFindingDetailResponseSchema = PentestFindingResponseSchema.extend({
-  resolutionTimeline: ResolutionTimelineSchema
+  resolutionTimeline: ResolutionTimelineSchema,
+  feedbackSummary: PentestFindingFeedbackSummaryField
 });
 var CustomerPentestFindingDetailResponseSchema = CustomerPentestFindingResponseSchema.extend({
-  resolutionTimeline: ResolutionTimelineSchema
+  resolutionTimeline: ResolutionTimelineSchema,
+  feedbackSummary: PentestFindingFeedbackSummaryField
 });
 var ReadPentestFindingResponseSchema = external_exports.union([
   PentestFindingDetailResponseSchema,
   CustomerPentestFindingDetailResponseSchema
 ]);
+var PentestFindingPdfExportResponseSchema = external_exports.object({
+  /** Download name the presigned URL carries, e.g. `PTF-12-idor-on-invoices.pdf`. */
+  fileName: external_exports.string(),
+  downloadUrl: external_exports.url(),
+  /** False when an identical export already existed and was reused without a render. */
+  rendered: external_exports.boolean()
+});
 var ListReadPentestFindingsResponseSchema = external_exports.union([
   ListPentestFindingsResponseSchema,
   ListCustomerPentestFindingsResponseSchema
@@ -24644,6 +24756,18 @@ var ResolvePentestFindingContestRequestSchema = external_exports.object({
   dismissReason: PentestFindingDismissReason.optional(),
   note: external_exports.string().min(1).max(1e4)
 });
+var PENTEST_FINDING_FEEDBACK_COMMENT_MAX_LENGTH = 5e3;
+var CreatePentestFindingFeedbackRequestSchema = external_exports.object({
+  rating: PentestFindingFeedbackRating.nullable().default(null),
+  reason: PentestFindingFeedbackReason.nullable().default(null),
+  comment: external_exports.string().trim().max(PENTEST_FINDING_FEEDBACK_COMMENT_MAX_LENGTH).transform((value) => value.length === 0 ? null : value).nullable().default(null)
+}).refine((input) => input.rating !== null || input.comment !== null, {
+  message: "Feedback needs a rating or a comment",
+  path: ["comment"]
+}).refine((input) => input.reason === null || input.rating === "THUMBS_DOWN", {
+  message: "A reason only accompanies a thumbs down",
+  path: ["reason"]
+});
 var PentestFindingRetestResponseSchema = external_exports.object({
   retestId: external_exports.uuid(),
   pentestFindingId: external_exports.uuid(),
@@ -25220,7 +25344,8 @@ var CredentialTypeValues = [
   "USERNAME_PASSWORD",
   "COOKIE",
   "MAGIC_AUTH",
-  "SESSION_STATE"
+  "SESSION_STATE",
+  "SSH_PRIVATE_KEY"
 ];
 var CredentialType = external_exports.enum(CredentialTypeValues);
 var BearerAuthConfigSchema = external_exports.object({
@@ -25318,17 +25443,94 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c59, i2) => {
-    const d = c59.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c62, i2) => {
+    const d = c62.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c59.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c62.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
 });
+var SSH_DEFAULT_PORT = 22;
+var SSH_HOST_MAX_CHARS = 253;
+var SSH_USERNAME_MAX_CHARS = 128;
+var SSH_PRIVATE_KEY_PEM_MAX_BYTES = 16384;
+var SSH_PASSPHRASE_MAX_CHARS = 1024;
+var SSH_HOST_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.:-]*$/;
+var SSH_USERNAME_PATTERN = /^[^\s\p{Cc}]+$/u;
+var SSH_HOST_KEY_FINGERPRINT_PATTERN = /^SHA256:[A-Za-z0-9+/]{43}=?$/;
+var SshPrivateKeyAuthConfigSchema = external_exports.object({
+  type: external_exports.literal("SSH_PRIVATE_KEY"),
+  host: external_exports.string().min(1, "host is required").max(SSH_HOST_MAX_CHARS).regex(SSH_HOST_PATTERN, "host must be a hostname or IP address"),
+  port: external_exports.number().int().min(1).max(65535).default(SSH_DEFAULT_PORT),
+  username: external_exports.string().min(1, "username is required").max(SSH_USERNAME_MAX_CHARS).regex(SSH_USERNAME_PATTERN, "username must not contain whitespace or control characters"),
+  hostKeyFingerprint: external_exports.string().regex(SSH_HOST_KEY_FINGERPRINT_PATTERN, "host key fingerprint must be SHA256:<base64>").optional()
+}).strict();
+var SSH_PRIVATE_KEY_PEM_LABELS = [
+  "OPENSSH PRIVATE KEY",
+  "RSA PRIVATE KEY",
+  "EC PRIVATE KEY",
+  "PRIVATE KEY",
+  "ENCRYPTED PRIVATE KEY"
+];
+var PEM_BEGIN_LINE = /^-----BEGIN ([A-Z ]+)-----$/;
+var PEM_END_LINE = /^-----END ([A-Z ]+)-----$/;
+var PEM_BASE64_LINE = /^[A-Za-z0-9+/]+={0,2}$/;
+var PEM_HEADER_LINE = /^[A-Za-z0-9-]+: [\x20-\x7e]*$/;
+function sshPrivateKeyPemError(value) {
+  if (new TextEncoder().encode(value).length > SSH_PRIVATE_KEY_PEM_MAX_BYTES) {
+    return `private key must be at most ${SSH_PRIVATE_KEY_PEM_MAX_BYTES} bytes`;
+  }
+  if (/[^\P{Cc}\r\n]/u.test(value)) {
+    return "private key contains control characters";
+  }
+  const lines = value.replace(/\r\n/g, "\n").split("\n").map((line) => line.trimEnd());
+  while (lines.length > 0 && lines[0] === "") lines.shift();
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  if (lines.length < 3) {
+    return "private key must be a PEM block with BEGIN and END lines";
+  }
+  const begin = PEM_BEGIN_LINE.exec(lines[0] ?? "");
+  if (begin === null) {
+    return "private key must start with a -----BEGIN \u2026 PRIVATE KEY----- line";
+  }
+  const end = PEM_END_LINE.exec(lines[lines.length - 1] ?? "");
+  if (end === null) {
+    return "private key must end with a -----END \u2026 PRIVATE KEY----- line";
+  }
+  const label = begin[1];
+  if (!SSH_PRIVATE_KEY_PEM_LABELS.includes(label ?? "")) {
+    return `private key label must be one of: ${SSH_PRIVATE_KEY_PEM_LABELS.join(", ")}`;
+  }
+  if (end[1] !== label) {
+    return "private key BEGIN and END labels do not match";
+  }
+  let sawBody = false;
+  for (const line of lines.slice(1, -1)) {
+    if (line === "") continue;
+    if (PEM_BASE64_LINE.test(line)) {
+      sawBody = true;
+      continue;
+    }
+    if (PEM_HEADER_LINE.test(line) && !sawBody) continue;
+    return "private key body must be base64 lines";
+  }
+  if (!sawBody) {
+    return "private key body is empty";
+  }
+  return null;
+}
+var SshPrivateKeyPemSchema = external_exports.string().min(1, "private key is required").superRefine((value, ctx) => {
+  const message = sshPrivateKeyPemError(value);
+  if (message !== null) ctx.addIssue({ code: "custom", message });
+});
+var SshPrivateKeySecretSchema = external_exports.object({
+  privateKeyPem: SshPrivateKeyPemSchema,
+  passphrase: external_exports.string().min(1).max(SSH_PASSPHRASE_MAX_CHARS).optional()
+}).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
 var TotpSetupKeySchema = external_exports.string().min(1).max(TOTP_MAX_SECRET_CHARS * 4).superRefine((value, ctx) => {
@@ -25362,7 +25564,8 @@ var CredentialAuthConfigSchema = external_exports.discriminatedUnion("type", [
   UsernamePasswordAuthConfigSchema,
   PassphraseAuthConfigSchema,
   MagicAuthConfigSchema,
-  SessionStateAuthConfigSchema
+  SessionStateAuthConfigSchema,
+  SshPrivateKeyAuthConfigSchema
 ]);
 
 // ../../packages/api-contracts/src/schemas/domain/knowledge-fact.schema.ts
@@ -29594,6 +29797,11 @@ var ResumeCodeUploadResponseSchema = external_exports.object({
 var ListCodeUploadsResponseSchema = external_exports.object({
   uploads: external_exports.array(CodeUploadSchema)
 });
+var DownloadCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
 
 // ../../packages/api-contracts/src/contracts/v1/code-upload.ts
 var c12 = initContract();
@@ -29647,6 +29855,15 @@ var codeUploadContract = c12.router({
       ...commonErrors
     }
   },
+  downloadCodeUpload: {
+    method: "GET",
+    path: "/organizations/:organizationId/code-uploads/:codeUploadId/download",
+    pathParams: CodeUploadIdParamsSchema,
+    responses: {
+      200: DownloadCodeUploadResponseSchema,
+      ...commonErrors
+    }
+  },
   deleteCodeUpload: {
     method: "DELETE",
     path: "/organizations/:organizationId/code-uploads/:codeUploadId",
@@ -29702,7 +29919,13 @@ var SECRET_SHAPES = {
     username: external_exports.string().min(1).max(500),
     password: external_exports.string().min(1).max(2048)
   },
-  SESSION_STATE: { secretValue: SessionStateSecretValueSchema }
+  SESSION_STATE: { secretValue: SessionStateSecretValueSchema },
+  // The key and its passphrase are one secret: they are encrypted together and
+  // replaced together (see SshPrivateKeySecretSchema for the stored shape).
+  SSH_PRIVATE_KEY: {
+    privateKeyPem: SshPrivateKeyPemSchema,
+    passphrase: external_exports.string().min(1).max(SSH_PASSPHRASE_MAX_CHARS).optional()
+  }
 };
 var CreateLabelSchema = external_exports.string().max(200).optional();
 var CreateBearerSchema = external_exports.object({
@@ -29783,6 +30006,12 @@ var CreateSessionStateSchema = external_exports.object({
   label: CreateLabelSchema,
   ...SECRET_SHAPES.SESSION_STATE
 }).strict();
+var CreateSshPrivateKeySchema = external_exports.object({
+  credentialType: external_exports.literal("SSH_PRIVATE_KEY"),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.SSH_PRIVATE_KEY,
+  authConfig: SshPrivateKeyAuthConfigSchema
+}).strict();
 var CreateCredentialRequestSchema = external_exports.discriminatedUnion("credentialType", [
   CreateBearerSchema,
   CreateJwtSchema,
@@ -29791,7 +30020,8 @@ var CreateCredentialRequestSchema = external_exports.discriminatedUnion("credent
   CreateUsernamePasswordSchema,
   CreateCookieSchema,
   CreateMagicAuthSchema,
-  CreateSessionStateSchema
+  CreateSessionStateSchema,
+  CreateSshPrivateKeySchema
 ]);
 var CredentialResponseSchema = external_exports.object({
   credentialId: external_exports.uuid(),
@@ -29834,7 +30064,8 @@ var RotateCredentialSecretRequestSchema = external_exports.discriminatedUnion("c
     credentialType: external_exports.literal("USERNAME_PASSWORD"),
     ...SECRET_SHAPES.USERNAME_PASSWORD
   }).strict(),
-  external_exports.object({ credentialType: external_exports.literal("SESSION_STATE"), ...SECRET_SHAPES.SESSION_STATE }).strict()
+  external_exports.object({ credentialType: external_exports.literal("SESSION_STATE"), ...SECRET_SHAPES.SESSION_STATE }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("SSH_PRIVATE_KEY"), ...SECRET_SHAPES.SSH_PRIVATE_KEY }).strict()
 ]);
 var SetCredentialMfaRequestSchema = external_exports.object({
   kind: external_exports.literal("TOTP"),
@@ -31186,6 +31417,159 @@ var inboxContract = c19.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/member.api.ts
+var MemberOrgParamsSchema = OrgIdParamsSchema;
+var MemberRoleSlugSchema = external_exports.enum(["admin", "analyst", "developer"]);
+var CreateMemberInvitationRequestSchema = external_exports.object({
+  email: external_exports.email().max(320),
+  roleSlug: MemberRoleSlugSchema.default("developer")
+});
+var CreateMemberInvitationResponseSchema = external_exports.object({
+  invitationId: external_exports.string().min(1),
+  email: external_exports.email(),
+  roleSlug: MemberRoleSlugSchema
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/invite-link.api.ts
+var INVITE_LINK_MIN_EXPIRES_IN_HOURS = 1;
+var INVITE_LINK_MAX_EXPIRES_IN_HOURS = 24 * 30;
+var INVITE_LINK_DEFAULT_EXPIRES_IN_HOURS = 24 * 7;
+var INVITE_LINK_MIN_USES = 1;
+var INVITE_LINK_MAX_USES = 100;
+var INVITE_LINK_DEFAULT_MAX_USES = 1;
+var InviteLinkOrgParamsSchema = OrgIdParamsSchema;
+var InviteLinkParamsSchema = OrgIdParamsSchema.extend({
+  inviteLinkId: external_exports.uuid()
+});
+var InviteLinkTokenSchema = external_exports.string().min(32).max(128).regex(/^[A-Za-z0-9_-]+$/, {
+  message: "token must contain only URL-safe base64 characters"
+});
+var InviteLinkTokenParamsSchema = external_exports.object({
+  token: InviteLinkTokenSchema
+});
+var CreateInviteLinkRequestSchema = external_exports.object({
+  roleSlug: MemberRoleSlugSchema.default("developer"),
+  expiresInHours: external_exports.number().int().min(INVITE_LINK_MIN_EXPIRES_IN_HOURS).max(INVITE_LINK_MAX_EXPIRES_IN_HOURS).default(INVITE_LINK_DEFAULT_EXPIRES_IN_HOURS),
+  maxUses: external_exports.number().int().min(INVITE_LINK_MIN_USES).max(INVITE_LINK_MAX_USES).default(INVITE_LINK_DEFAULT_MAX_USES)
+});
+var InviteLinkStatusSchema = external_exports.enum(["active", "expired", "exhausted", "revoked"]);
+var InviteLinkResponseSchema = external_exports.object({
+  inviteLinkId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  roleSlug: MemberRoleSlugSchema,
+  status: InviteLinkStatusSchema,
+  expiresAt: external_exports.coerce.date(),
+  maxUses: external_exports.number().int(),
+  useCount: external_exports.number().int(),
+  createdById: external_exports.uuid(),
+  createdByName: external_exports.string(),
+  createdByEmail: external_exports.string(),
+  revokedAt: external_exports.coerce.date().nullable(),
+  createdAt: external_exports.coerce.date()
+});
+var CreateInviteLinkResponseSchema = InviteLinkResponseSchema.extend({
+  url: external_exports.url()
+});
+var ListInviteLinksResponseSchema = external_exports.array(InviteLinkResponseSchema);
+var RevokeInviteLinkResponseSchema = external_exports.object({
+  inviteLinkId: external_exports.uuid(),
+  revokedAt: external_exports.coerce.date()
+});
+var InviteLinkPreviewResponseSchema = external_exports.object({
+  status: InviteLinkStatusSchema,
+  organizationName: external_exports.string(),
+  organizationLogoUrl: external_exports.string().nullable(),
+  roleSlug: MemberRoleSlugSchema,
+  expiresAt: external_exports.coerce.date()
+});
+var AcceptInviteLinkResponseSchema = external_exports.object({
+  /** `joined` created a membership; `already_member` found an active one and consumed nothing. */
+  outcome: external_exports.enum(["joined", "already_member"]),
+  organizationSlug: external_exports.string(),
+  organizationName: external_exports.string(),
+  workosOrganizationId: external_exports.string(),
+  roleSlug: MemberRoleSlugSchema
+});
+var AcceptInviteLinkRejectedResponseSchema = ErrorResponseSchema.extend({
+  status: InviteLinkStatusSchema.optional()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/invite-link.ts
+var c20 = initContract();
+var inviteLinkContract = c20.router({
+  createInviteLink: {
+    method: "POST",
+    path: "/organizations/:organizationId/invite-links",
+    pathParams: InviteLinkOrgParamsSchema,
+    body: CreateInviteLinkRequestSchema,
+    responses: {
+      201: CreateInviteLinkResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  listInviteLinks: {
+    method: "GET",
+    path: "/organizations/:organizationId/invite-links",
+    pathParams: InviteLinkOrgParamsSchema,
+    responses: {
+      200: ListInviteLinksResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  revokeInviteLink: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/invite-links/:inviteLinkId",
+    pathParams: InviteLinkParamsSchema,
+    responses: {
+      200: RevokeInviteLinkResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+var inviteLinkPublicContract = c20.router(
+  {
+    previewInviteLink: {
+      method: "GET",
+      path: "/invite-links/:token",
+      pathParams: InviteLinkTokenParamsSchema,
+      responses: {
+        200: InviteLinkPreviewResponseSchema,
+        400: ErrorResponseSchema,
+        404: ErrorResponseSchema,
+        500: ErrorResponseSchema
+      }
+    },
+    acceptInviteLink: {
+      method: "POST",
+      path: "/invite-links/:token/accept",
+      pathParams: InviteLinkTokenParamsSchema,
+      body: c20.noBody(),
+      responses: {
+        200: AcceptInviteLinkResponseSchema,
+        400: ErrorResponseSchema,
+        401: ErrorResponseSchema,
+        404: ErrorResponseSchema,
+        409: AcceptInviteLinkRejectedResponseSchema,
+        503: ErrorResponseSchema,
+        500: ErrorResponseSchema
+      }
+    }
+  },
+  {
+    pathPrefix: "/v1"
+  }
+);
+
 // ../../packages/api-contracts/src/schemas/api/v1/knowledge-base.api.ts
 var KnowledgeBaseAuthorSchema = external_exports.object({
   userId: external_exports.string(),
@@ -31217,8 +31601,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c20 = initContract();
-var knowledgeBaseContract = c20.router({
+var c21 = initContract();
+var knowledgeBaseContract = c21.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -31439,8 +31823,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c21 = initContract();
-var knowledgeDocumentContract = c21.router({
+var c22 = initContract();
+var knowledgeDocumentContract = c22.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -31766,8 +32150,8 @@ var LinearMetadataResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-integration.ts
-var c22 = initContract();
-var linearIntegrationContract = c22.router({
+var c23 = initContract();
+var linearIntegrationContract = c23.router({
   getLinearIntegration: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear",
@@ -31785,7 +32169,7 @@ var linearIntegrationContract = c22.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/connect",
     pathParams: OrgIdParamsSchema,
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: LinearConnectResponseSchema,
       401: ErrorResponseSchema,
@@ -31800,7 +32184,7 @@ var linearIntegrationContract = c22.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/disconnect",
     pathParams: OrgIdParamsSchema,
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: LinearIntegrationResponseSchema,
       401: ErrorResponseSchema,
@@ -31862,8 +32246,8 @@ var linearIntegrationContract = c22.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-tickets.ts
-var c23 = initContract();
-var linearTicketContract = c23.router({
+var c24 = initContract();
+var linearTicketContract = c24.router({
   /**
    * Push one or more pentest findings to Linear as tickets. Customer-side
    * (VIEW_RESULTS + PENTEST capability); non-admins create into the org's
@@ -31967,8 +32351,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c24 = initContract();
-var llmProviderKeyContract = c24.router({
+var c25 = initContract();
+var llmProviderKeyContract = c25.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -32035,22 +32419,9 @@ var llmProviderKeyContract = c24.router({
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/member.api.ts
-var MemberOrgParamsSchema = OrgIdParamsSchema;
-var MemberRoleSlugSchema = external_exports.enum(["admin", "analyst", "developer"]);
-var CreateMemberInvitationRequestSchema = external_exports.object({
-  email: external_exports.email().max(320),
-  roleSlug: MemberRoleSlugSchema.default("developer")
-});
-var CreateMemberInvitationResponseSchema = external_exports.object({
-  invitationId: external_exports.string().min(1),
-  email: external_exports.email(),
-  roleSlug: MemberRoleSlugSchema
-});
-
 // ../../packages/api-contracts/src/contracts/v1/member.ts
-var c25 = initContract();
-var memberContract = c25.router({
+var c26 = initContract();
+var memberContract = c26.router({
   createInvitation: {
     method: "POST",
     path: "/organizations/:organizationId/members/invitations",
@@ -32350,8 +32721,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c26 = initContract();
-var organizationContract = c26.router({
+var c27 = initContract();
+var organizationContract = c27.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -32396,6 +32767,23 @@ var organizationContract = c26.router({
     },
     summary: "Create an organization (Trace staff only)"
   },
+  // Staff-only, cross-org: removes the tenant from Trace and WorkOS together.
+  // 409 when members, repositories, or retained audit history still reference
+  // the organization; those must be removed first (or cannot be, for WORM rows).
+  deleteOrganizationAsStaff: {
+    method: "DELETE",
+    path: "/staff/organizations/:organizationId",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Delete an organization (Trace staff only)"
+  },
   getOrganization: {
     method: "GET",
     path: "/organizations/:organizationId",
@@ -32706,7 +33094,7 @@ var organizationContract = c26.router({
     method: "POST",
     path: "/organizations/:organizationId/logos-from-homepage",
     pathParams: OrgIdParamsSchema,
-    body: c26.type(),
+    body: c27.type(),
     responses: {
       200: OrganizationResponseSchema,
       // 400 — no homepage set on the organization.
@@ -33013,8 +33401,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c27 = initContract();
-var pentestContract = c27.router({
+var c28 = initContract();
+var pentestContract = c28.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -33324,8 +33712,8 @@ var pentestContract = c27.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attack-chain.ts
-var c28 = initContract();
-var pentestAttackChainContract = c28.router({
+var c29 = initContract();
+var pentestAttackChainContract = c29.router({
   listAttackChains: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains",
@@ -33424,7 +33812,7 @@ var pentestAttackChainContract = c28.router({
     method: "DELETE",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId",
     pathParams: PentestAttackChainIdParamsSchema,
-    body: c28.noBody(),
+    body: c29.noBody(),
     responses: {
       200: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -33585,8 +33973,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c29 = initContract();
-var pentestAttestationContract = c29.router({
+var c30 = initContract();
+var pentestAttestationContract = c30.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -33729,8 +34117,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c30 = initContract();
-var pentestAuditLogContract = c30.router({
+var c31 = initContract();
+var pentestAuditLogContract = c31.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -33777,8 +34165,8 @@ var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
-var c31 = initContract();
-var pentestAuthorizedDomainContract = c31.router({
+var c32 = initContract();
+var pentestAuthorizedDomainContract = c32.router({
   getPentestAuthorizedScope: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
@@ -33832,8 +34220,8 @@ var PentestEgressResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-egress.ts
-var c32 = initContract();
-var pentestEgressContract = c32.router({
+var c33 = initContract();
+var pentestEgressContract = c33.router({
   getPentestEgress: {
     method: "GET",
     path: "/staff/pentest-egress",
@@ -33872,8 +34260,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c33 = initContract();
-var pentestEngagementExclusionContract = c33.router({
+var c34 = initContract();
+var pentestEngagementExclusionContract = c34.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -33937,8 +34325,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c34 = initContract();
-var pentestEnvironmentContract = c34.router({
+var c35 = initContract();
+var pentestEnvironmentContract = c35.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -33987,8 +34375,8 @@ var pentestEnvironmentContract = c34.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c35 = initContract();
-var pentestFindingContract = c35.router({
+var c36 = initContract();
+var pentestFindingContract = c36.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -34092,6 +34480,24 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // Same visibility as getCustomerFinding: published findings only, customer DTO,
+  // so the document never carries staff identity or a draft.
+  exportCustomerFindingPdf: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/pdf",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    summary: "Render one pentest finding as a Trace-branded PDF",
+    description: "Renders the published finding on demand, stores the PDF, and returns a short-lived presigned download URL. An identical export from the same day is reused without a render. The document names the finding, its classification, and its affected repositories only: no people and no organization name appear on it. Rendering shares one browser per API task, so exports are admission-controlled per organization; a 429 means retry after the interval in `details.retryAfterSeconds`.",
+    responses: {
+      200: PentestFindingPdfExportResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Evidence (PR 2: surface & curate) ───
   listCustomerFindingEvidence: {
     method: "GET",
@@ -34414,6 +34820,25 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // Reader feedback on a published finding: a thumbs up/down, a comment, or both.
+  // Append-only and never a status change (disputes are `contest`). Same auth as
+  // the other customer writes: VIEW_RESULTS + user principal + customer visibility.
+  submitFeedback: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/feedback",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: CreatePentestFindingFeedbackRequestSchema,
+    summary: "Leave feedback on a pentest finding",
+    description: "Records a thumbs up or thumbs down, an optional reason for a thumbs down, and an optional comment. Each reader counts once in the tallies: a new vote replaces the previous one in the count while the change stays in the resolution history. Returns the updated tallies.",
+    responses: {
+      201: PentestFindingFeedbackSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Contests ───
   listContests: {
     method: "GET",
@@ -34544,8 +34969,8 @@ var pentestFindingContract = c35.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c36 = initContract();
-var pentestHypothesisContract = c36.router({
+var c37 = initContract();
+var pentestHypothesisContract = c37.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -34647,9 +35072,148 @@ var pentestHypothesisContract = c36.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-intake-document.api.ts
+var PentestIntakeDocumentTypeValues = [
+  "PREVIOUS_PENTEST",
+  "ARCHITECTURE_DIAGRAM",
+  "THREAT_MODEL",
+  "OTHER"
+];
+var PentestIntakeDocumentTypeSchema = external_exports.enum(PentestIntakeDocumentTypeValues);
+var MAX_PENTEST_INTAKE_DOCUMENT_BYTES = 50 * 1024 * 1024;
+var PentestIntakeDocumentIdParamsSchema = CustomerPentestIdParamsSchema.extend({
+  documentId: external_exports.uuid()
+});
+var PentestIntakeDocumentResponseSchema = external_exports.object({
+  documentId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  documentType: PentestIntakeDocumentTypeSchema,
+  fileName: external_exports.string(),
+  fileType: external_exports.string(),
+  fileSizeBytes: external_exports.number().int().nonnegative(),
+  uploadedByName: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var ListPentestIntakeDocumentsResponseSchema = external_exports.object({
+  /** Mirrors the questionnaire's `editable`: uploads and removals are refused once false. */
+  editable: external_exports.boolean(),
+  documents: external_exports.array(PentestIntakeDocumentResponseSchema)
+});
+var CreatePentestIntakeDocumentUploadRequestSchema = external_exports.object({
+  fileName: external_exports.string().min(1).max(255),
+  fileSizeBytes: external_exports.number().int().positive().max(MAX_PENTEST_INTAKE_DOCUMENT_BYTES)
+}).strict();
+var CreatePentestIntakeDocumentUploadResponseSchema = external_exports.object({
+  /** Server-minted S3 key; hand it back unchanged on attach. */
+  uploadKey: external_exports.string(),
+  uploadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
+var AttachPentestIntakeDocumentRequestSchema = external_exports.object({
+  uploadKey: external_exports.string().min(1).max(1024),
+  documentType: PentestIntakeDocumentTypeSchema,
+  fileName: external_exports.string().min(1).max(255),
+  fileType: external_exports.string().min(1).max(100)
+}).strict();
+var UpdatePentestIntakeDocumentRequestSchema = external_exports.object({
+  documentType: PentestIntakeDocumentTypeSchema
+}).strict();
+var DownloadPentestIntakeDocumentResponseSchema = external_exports.object({
+  document: PentestIntakeDocumentResponseSchema,
+  downloadUrl: external_exports.url()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-intake-document.ts
+var c38 = initContract();
+var pentestIntakeDocumentContract = c38.router({
+  listDocuments: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
+    pathParams: CustomerPentestIdParamsSchema,
+    responses: {
+      200: ListPentestIntakeDocumentsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createUpload: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/uploads",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: CreatePentestIntakeDocumentUploadRequestSchema,
+    responses: {
+      201: CreatePentestIntakeDocumentUploadResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  attachDocument: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: AttachPentestIntakeDocumentRequestSchema,
+    responses: {
+      201: PentestIntakeDocumentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateDocument: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    body: UpdatePentestIntakeDocumentRequestSchema,
+    responses: {
+      200: PentestIntakeDocumentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  downloadDocument: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId/download",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    responses: {
+      200: DownloadPentestIntakeDocumentResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteDocument: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c37 = initContract();
-var pentestManualFindingContract = c37.router({
+var c39 = initContract();
+var pentestManualFindingContract = c39.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -34736,8 +35300,8 @@ var pentestManualFindingContract = c37.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c38 = initContract();
-var pentestReportPdfContract = c38.router({
+var c40 = initContract();
+var pentestReportPdfContract = c40.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -34830,7 +35394,7 @@ var pentestReportPdfContract = c38.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c38.noBody(),
+    body: c40.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -34955,7 +35519,8 @@ var pentestReportPdfContract = c38.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // REPORT_NOT_RENDERED — no PDF exists yet (spec-pr-rs1 §2c) — or
-      // BUNDLE_NOT_RENDERED for artifact=markdown with no bundle object.
+      // BUNDLE_NOT_RENDERED / DOCX_NOT_RENDERED for artifact=markdown / docx
+      // with no such object beside the current PDF.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -35012,20 +35577,23 @@ var pentestReportPdfContract = c38.router({
     method: "GET",
     path: "/organizations/:organizationId/customer-pentests/:pentestId/report-pdf/download",
     pathParams: CustomerReportPdfPentestParamsSchema,
-    query: PentestPdfDownloadQuerySchema,
+    query: CustomerReportPdfDownloadQuerySchema,
     responses: {
       200: CustomerReportPdfDownloadResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
+      // DOCX_NOT_RENDERED for artifact=docx when no Word document from the
+      // served render exists.
+      409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   }
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c39 = initContract();
-var pentestValidationContract = c39.router({
+var c41 = initContract();
+var pentestValidationContract = c41.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -35133,8 +35701,8 @@ var pentestValidationContract = c39.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c40 = initContract();
-var repositoryContract = c40.router({
+var c42 = initContract();
+var repositoryContract = c42.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -35320,7 +35888,7 @@ var repositoryContract = c40.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c40.noBody(),
+    body: c42.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -35454,8 +36022,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c41 = initContract();
-var scanContract = c41.router({
+var c43 = initContract();
+var scanContract = c43.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -35576,8 +36144,8 @@ var StaffPentestStatsResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentest-stats.ts
-var c42 = initContract();
-var staffPentestStatsContract = c42.router({
+var c44 = initContract();
+var staffPentestStatsContract = c44.router({
   getStaffPentestStats: {
     method: "GET",
     path: "/staff/pentest-stats",
@@ -35591,6 +36159,59 @@ var staffPentestStatsContract = c42.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/staff-pentests.api.ts
+var StaffOrganizationPentestParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: external_exports.uuid()
+});
+var StaffOrganizationPentestSummarySchema = external_exports.object({
+  pentestId: external_exports.uuid(),
+  displayId: external_exports.int().positive(),
+  title: external_exports.string(),
+  status: PentestStatus,
+  currentStage: PentestStage,
+  testType: PentestTestType,
+  /** Bound application names, ordinal-ascending. Empty for an unbound draft. */
+  applicationNames: external_exports.array(external_exports.string()),
+  findingCount: external_exports.int().nonnegative(),
+  startedAt: external_exports.iso.datetime().nullable(),
+  endedAt: external_exports.iso.datetime().nullable(),
+  createdAt: external_exports.iso.datetime()
+}).strict();
+var ListStaffOrganizationPentestsResponseSchema = external_exports.array(
+  StaffOrganizationPentestSummarySchema
+);
+
+// ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
+var c45 = initContract();
+var staffPentestsContract = c45.router({
+  listStaffOrganizationPentests: {
+    method: "GET",
+    path: "/organizations/:organizationId/staff/pentests",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: ListStaffOrganizationPentestsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "List an organization\u2019s pentests (Trace staff only)"
+  },
+  deleteStaffOrganizationPentest: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Soft-delete a pentest from the admin console (Trace staff only)"
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/staff-queue.api.ts
 var StaffQueueItemKindValues = [
   "RETEST_OWED",
@@ -35698,8 +36319,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c43 = initContract();
-var staffQueueContract = c43.router({
+var c46 = initContract();
+var staffQueueContract = c46.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -35769,8 +36390,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c44 = initContract();
-var testIntegrationContract = c44.router({
+var c47 = initContract();
+var testIntegrationContract = c47.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -35902,8 +36523,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c45 = initContract();
-var userContract = c45.router({
+var c48 = initContract();
+var userContract = c48.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -36018,8 +36639,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c46 = initContract();
-var vantaIntegrationContract = c46.router({
+var c49 = initContract();
+var vantaIntegrationContract = c49.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -36151,6 +36772,13 @@ var VulnerabilityResponseSchema = external_exports.object({
   updatedAt: external_exports.coerce.date()
 });
 var ListVulnerabilitiesResponseSchema = external_exports.array(VulnerabilityResponseSchema);
+var VulnerabilityPdfExportResponseSchema = external_exports.object({
+  /** Download name the presigned URL carries, e.g. `TRACE-042-sql-injection.pdf`. */
+  fileName: external_exports.string(),
+  downloadUrl: external_exports.url(),
+  /** False when an identical export already existed and was reused without a render. */
+  rendered: external_exports.boolean()
+});
 var FilterValueSchema = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]);
 var FilterConditionSchema = external_exports.object({
   field: external_exports.enum(["repositoryId", "severity", "vulnerabilityType", "status", "cweId", "scanMode"]),
@@ -36351,8 +36979,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c47 = initContract();
-var vulnerabilityContract = c47.router({
+var c50 = initContract();
+var vulnerabilityContract = c50.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -36404,6 +37032,22 @@ var vulnerabilityContract = c47.router({
       500: ErrorResponseSchema
     }
   },
+  exportVulnerabilityPdf: {
+    method: "GET",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/pdf",
+    pathParams: VulnerabilityLookupIdParamsSchema,
+    summary: "Render one vulnerability as a Trace-branded PDF",
+    description: "Renders the vulnerability on demand, stores the PDF, and returns a short-lived presigned download URL. An identical export from the same day is reused without a render. The document names the finding and its code location only: no people and no organization name appear on it. Rendering shares one browser per API task, so exports are admission-controlled per organization; a 429 means retry after the interval in `details.retryAfterSeconds`.",
+    responses: {
+      200: VulnerabilityPdfExportResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   updateVulnerability: {
     method: "PATCH",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId",
@@ -36560,8 +37204,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c48 = initContract();
-var vulnerabilityNoteContract = c48.router({
+var c51 = initContract();
+var vulnerabilityNoteContract = c51.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -36742,8 +37386,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c49 = initContract();
-var webhookSettingsContract = c49.router({
+var c52 = initContract();
+var webhookSettingsContract = c52.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -36881,8 +37525,8 @@ var webhookSettingsContract = c49.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c50 = initContract();
-var v1Contract = c50.router(
+var c53 = initContract();
+var v1Contract = c53.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -36911,6 +37555,7 @@ var v1Contract = c50.router(
     agentTask: agentTaskContract,
     verifyApplicationSetup: verifyApplicationSetupContract,
     pentest: pentestContract,
+    pentestIntakeDocument: pentestIntakeDocumentContract,
     pentestAttestation: pentestAttestationContract,
     pentestManualFinding: pentestManualFindingContract,
     pentestAuditLog: pentestAuditLogContract,
@@ -36928,10 +37573,12 @@ var v1Contract = c50.router(
     inbox: inboxContract,
     apiKey: apiKeyContract,
     member: memberContract,
+    inviteLink: inviteLinkContract,
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
     pentestEgress: pentestEgressContract,
     staffPentestStats: staffPentestStatsContract,
+    staffPentests: staffPentestsContract,
     staffQueue: staffQueueContract
   },
   {
@@ -36940,8 +37587,8 @@ var v1Contract = c50.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c51 = initContract();
-var contract = c51.router({
+var c54 = initContract();
+var contract = c54.router({
   v1: v1Contract
 });
 
@@ -36951,8 +37598,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c52 = initContract();
-var githubWebhookContract = c52.router(
+var c55 = initContract();
+var githubWebhookContract = c55.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36970,7 +37617,7 @@ var githubWebhookContract = c52.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c52.router(
+var githubReadonlyWebhookContract = c55.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36990,9 +37637,9 @@ var githubReadonlyWebhookContract = c52.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c53 = initContract();
+var c56 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c53.router(
+var linearWebhookContract = c56.router(
   {
     handleWebhook: {
       method: "POST",
@@ -37012,7 +37659,7 @@ var linearWebhookContract = c53.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c54 = initContract();
+var c57 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -37041,7 +37688,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c54.router(
+var forgeBitbucketContract = c57.router(
   {
     lifecycle: {
       method: "POST",
@@ -37088,8 +37735,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c55 = initContract();
-var healthContract = c55.router({
+var c58 = initContract();
+var healthContract = c58.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -37101,8 +37748,8 @@ var healthContract = c55.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c56 = initContract();
-var vulnerabilityShareContract = c56.router(
+var c59 = initContract();
+var vulnerabilityShareContract = c59.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -37189,8 +37836,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c57 = initContract();
-var prVulnerabilityContract = c57.router(
+var c60 = initContract();
+var prVulnerabilityContract = c60.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -37241,7 +37888,7 @@ async function requestDeviceAuthorization(clientId) {
   }
   return await response.json();
 }
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 async function pollForToken(clientId, deviceCode, options = {}) {
   const expiresIn = options.expiresIn ?? 300;
   let interval = options.interval ?? 5;
@@ -37926,18 +38573,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open2, close, parent) => {
+var createStyler = (open3, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open2;
+    openAll = open3;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open2;
+    openAll = parent.openAll + open3;
     closeAll = close + parent.closeAll;
   }
   return {
-    open: open2,
+    open: open3,
     close,
     openAll,
     closeAll,
@@ -39899,12 +40546,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c59) => c59.type.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c62) => c62.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.name.padEnd(nameWidth)}  ${c59.type.padEnd(typeWidth)}  ${c59.repos.padStart(5)}  ${c59.url}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.name.padEnd(nameWidth)}  ${c62.type.padEnd(typeWidth)}  ${c62.repos.padStart(5)}  ${c62.url}`
   );
   return { header, rows };
 }
@@ -39924,12 +40571,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c59) => c59.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c59) => c59.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c59) => c59.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c62) => c62.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c62) => c62.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c62) => c62.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.scan.padEnd(4)}  ${c59.role.padEnd(roleWidth)}  ${c59.path.padEnd(pathWidth)}  ${c59.status}`
+    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.scan.padEnd(4)}  ${c62.role.padEnd(roleWidth)}  ${c62.path.padEnd(pathWidth)}  ${c62.status}`
   );
   return { header, rows };
 }
@@ -40714,8 +41361,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c59, i2, m2) => {
-    const d = n3 ? n3(c59, i2) : c59;
+`).map((c62, i2, m2) => {
+    const d = n3 ? n3(c62, i2) : c62;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -41213,14 +41860,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c59 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c62 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c59 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c59 ? 1 : 0);
+  d && g++, c62 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c62 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -41241,14 +41888,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c59 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c62 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c59 && x.push(M), x;
+  return c62 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -41267,15 +41914,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c59 = this.value ? a2 : s;
+`, c62 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c59)}`;
+          return `${o2}${r2}${styleText2("dim", c62)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c59)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c62)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -41423,13 +42070,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c59 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c62 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c59}
+${u4}  ${styleText2("yellow", this.error)}${c62}
 `;
       }
       case "submit": {
@@ -41457,7 +42104,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c59}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c59}
+${r2}${c62}
 `;
       }
     }
@@ -41472,7 +42119,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c59 = this.userInputWithCursor, i2 = this.masked;
+`, c62 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -41492,7 +42139,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c59}
+        return `${o2}${s}${c62}
 ${n3}
 `;
       }
@@ -41508,7 +42155,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c58 = (t2, o2) => t2.includes(`
+var c61 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -41519,15 +42166,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c58(s, (i2) => styleText2("dim", i2))}`;
+        return `${c61(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c58(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c61(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -42907,7 +43554,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c59) => !c59._hidden).map((c59) => extractCommandTree(c59));
+  const subcommands = cmd.commands.filter((c62) => !c62._hidden).map((c62) => extractCommandTree(c62));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -42973,7 +43620,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c59) => c59.name);
+  const subcommandNames = tree.subcommands.map((c62) => c62.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -43388,9 +44035,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c59) => c59.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c62) => c62.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c59) => `${c59.address.padEnd(addressWidth)}  ${c59.label}`);
+  const rows = cells.map((c62) => `${c62.address.padEnd(addressWidth)}  ${c62.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -43414,14 +44061,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c59) => c59.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c59) => c59.from.length));
-  const toWidth = Math.max(2, ...cells.map((c59) => c59.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c59) => c59.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c62) => c62.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c62) => c62.from.length));
+  const toWidth = Math.max(2, ...cells.map((c62) => c62.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c62) => c62.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.received.padEnd(receivedWidth)}  ${c59.from.padEnd(fromWidth)}  ${c59.to.padEnd(toWidth)}  ${c59.subject.padEnd(subjectWidth)}  ${c59.unread}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.received.padEnd(receivedWidth)}  ${c62.from.padEnd(fromWidth)}  ${c62.to.padEnd(toWidth)}  ${c62.subject.padEnd(subjectWidth)}  ${c62.unread}`
   );
   return { header, rows };
 }
@@ -43827,7 +44474,9 @@ var CREDENTIAL_TYPE_BY_INPUT = {
   "magic-auth": "MAGIC_AUTH",
   magic_auth: "MAGIC_AUTH",
   "session-state": "SESSION_STATE",
-  session_state: "SESSION_STATE"
+  session_state: "SESSION_STATE",
+  "ssh-private-key": "SSH_PRIVATE_KEY",
+  ssh_private_key: "SSH_PRIVATE_KEY"
 };
 function normalizeCredentialType(input) {
   return CREDENTIAL_TYPE_BY_INPUT[input.trim().toLowerCase()] ?? null;
@@ -43849,7 +44498,11 @@ var AUTH_FLAG_KEBAB = {
   passwordField: "password-field",
   sessionCookieName: "session-cookie-name",
   csrfTokenSelector: "csrf-token-selector",
-  csrfFieldName: "csrf-field-name"
+  csrfFieldName: "csrf-field-name",
+  sshHost: "ssh-host",
+  sshPort: "ssh-port",
+  sshUsername: "ssh-username",
+  sshHostKeyFingerprint: "ssh-host-key-fingerprint"
 };
 var ALL_AUTH_KEYS = Object.keys(AUTH_FLAG_KEBAB);
 var ALLOWED_AUTH_KEYS = {
@@ -43869,7 +44522,8 @@ var ALLOWED_AUTH_KEYS = {
   COOKIE: ["cookieName", "cookieDomain", "cookiePath"],
   MAGIC_AUTH: [],
   // SESSION_STATE takes no authConfig flags — origin is server-derived from the blob.
-  SESSION_STATE: []
+  SESSION_STATE: [],
+  SSH_PRIVATE_KEY: ["sshHost", "sshPort", "sshUsername", "sshHostKeyFingerprint"]
 };
 function rejectForeignAuthFlags(type, opts) {
   const allowed = new Set(ALLOWED_AUTH_KEYS[type]);
@@ -43913,6 +44567,13 @@ function authConfigToOptions(authConfig) {
       return {};
     case "SESSION_STATE":
       return {};
+    case "SSH_PRIVATE_KEY":
+      return {
+        sshHost: authConfig.host,
+        sshPort: String(authConfig.port),
+        sshUsername: authConfig.username,
+        ...authConfig.hostKeyFingerprint !== void 0 ? { sshHostKeyFingerprint: authConfig.hostKeyFingerprint } : {}
+      };
     case "USERNAME_PASSWORD":
       return {
         method: authConfig.method,
@@ -44006,6 +44667,34 @@ function buildUsernamePasswordAuthConfig(opts) {
     }
   };
 }
+function buildSshPrivateKeyAuthConfig(opts) {
+  const hasAny = opts.sshHost !== void 0 || opts.sshPort !== void 0 || opts.sshUsername !== void 0 || opts.sshHostKeyFingerprint !== void 0;
+  if (!hasAny) {
+    return { value: void 0 };
+  }
+  if (opts.sshHost === void 0 || opts.sshUsername === void 0) {
+    return { error: "--ssh-host and --ssh-username are required for ssh-private-key." };
+  }
+  let port = SSH_DEFAULT_PORT;
+  if (opts.sshPort !== void 0) {
+    if (!/^\d{1,5}$/.test(opts.sshPort.trim())) {
+      return { error: "--ssh-port must be a whole number from 1 to 65535." };
+    }
+    port = Number(opts.sshPort.trim());
+    if (port < 1 || port > 65535) {
+      return { error: "--ssh-port must be a whole number from 1 to 65535." };
+    }
+  }
+  return {
+    value: {
+      type: "SSH_PRIVATE_KEY",
+      host: opts.sshHost,
+      port,
+      username: opts.sshUsername,
+      ...opts.sshHostKeyFingerprint !== void 0 ? { hostKeyFingerprint: opts.sshHostKeyFingerprint } : {}
+    }
+  };
+}
 function buildAuthConfig(type, opts) {
   switch (type) {
     case "BEARER_TOKEN":
@@ -44020,6 +44709,8 @@ function buildAuthConfig(type, opts) {
       return buildMagicAuthAuthConfig(opts);
     case "USERNAME_PASSWORD":
       return buildUsernamePasswordAuthConfig(opts);
+    case "SSH_PRIVATE_KEY":
+      return buildSshPrivateKeyAuthConfig(opts);
     case "PASSPHRASE":
     case "SESSION_STATE":
       return { value: void 0 };
@@ -44028,6 +44719,9 @@ function buildAuthConfig(type, opts) {
 function anySecretFlag(opts) {
   return opts.secretStdin === true || opts.secretFile !== void 0 || opts.secretEnv !== void 0 || opts.usernameStdin === true || opts.usernameFile !== void 0 || opts.usernameEnv !== void 0 || opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
 }
+function anyPasswordFlag(opts) {
+  return opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
+}
 function secretOpts(opts) {
   return { stdin: opts.secretStdin, file: opts.secretFile, env: opts.secretEnv };
 }
@@ -44149,16 +44843,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c59) => ({
-    id: c59.credentialId,
-    label: sanitizeDisplay(c59.label),
-    type: c59.credentialType
+  const cells = creds.map((c62) => ({
+    id: c62.credentialId,
+    label: sanitizeDisplay(c62.label),
+    type: c62.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c59) => c59.label.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c62) => c62.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.label.padEnd(labelWidth)}  ${c59.type}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.label.padEnd(labelWidth)}  ${c62.type}`
   );
   return { header, rows };
 }
@@ -44189,6 +44883,14 @@ function failAuthBuild(result) {
   console.error(colorError(result.error));
   process.exit(1);
 }
+function requireSshAuthConfig(options) {
+  const ac = buildSshPrivateKeyAuthConfig(options);
+  if ("error" in ac) failAuthBuild(ac);
+  if (ac.value === void 0) {
+    failAuthBuild({ error: "--ssh-host and --ssh-username are required for ssh-private-key." });
+  }
+  return ac.value;
+}
 async function runCreate3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
@@ -44212,6 +44914,17 @@ async function runCreate3(options) {
     );
     process.exit(1);
   }
+  if (type === "SSH_PRIVATE_KEY") {
+    requireSshAuthConfig(options);
+    if (usesStdin(secretOpts(options)) && usesStdin(passwordOpts(options))) {
+      console.error(
+        colorError(
+          "Only one secret can come from stdin. Use --password-file/-env for the passphrase."
+        )
+      );
+      process.exit(1);
+    }
+  }
   const organizationId = await resolveOrganizationId();
   const params = { organizationId, environmentId: options.env };
   const label = options.label?.trim() ? options.label.trim() : void 0;
@@ -44284,6 +44997,18 @@ async function buildCreateBody(type, label, options) {
       );
       return { credentialType: "SESSION_STATE", ...labelFields, secretValue };
     }
+    case "SSH_PRIVATE_KEY": {
+      const authConfig = requireSshAuthConfig(options);
+      const privateKeyPem = await resolveSecret("private key PEM", "secret", secretOpts(options));
+      const passphrase = anyPasswordFlag(options) ? await resolveSecret("key passphrase", "password", passwordOpts(options)) : void 0;
+      return {
+        credentialType: "SSH_PRIVATE_KEY",
+        ...labelFields,
+        privateKeyPem,
+        ...passphrase !== void 0 ? { passphrase } : {},
+        authConfig
+      };
+    }
     case "COOKIE": {
       const ac = buildCookieAuthConfig(options);
       if ("error" in ac) failAuthBuild(ac);
@@ -44566,12 +45291,15 @@ function addSecretInputOptions(command) {
   return command.option("--secret-stdin", "Read the secret value from stdin").option("--secret-file <path>", "Read the secret value from a file").option("--secret-env <name>", "Read the secret value from an env var").option("--username-stdin", "Read the username from stdin").option("--username-file <path>", "Read the username from a file").option("--username-env <name>", "Read the username from an env var").option("--password-stdin", "Read the password from stdin").option("--password-file <path>", "Read the password from a file").option("--password-env <name>", "Read the password from an env var");
 }
 function addAuthConfigOptions(command) {
-  return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)");
+  return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)").option("--ssh-host <host>", "authConfig: SSH host (ssh-private-key, required)").option("--ssh-port <port>", "authConfig: SSH port, 1-65535 (ssh-private-key, default 22)").option("--ssh-username <user>", "authConfig: SSH username (ssh-private-key, required)").option(
+    "--ssh-host-key-fingerprint <fp>",
+    "authConfig: expected host key, SHA256:<base64> (ssh-private-key)"
+  );
 }
 function createCreateCommand3() {
   const command = new Command("create").description("Create a credential in an environment").requiredOption("--env <environmentId>", "Parent environment UUID").requiredOption(
     "--type <type>",
-    "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth"
+    "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth, session-state, ssh-private-key"
   ).option(
     "--label <label>",
     "Human-readable label (optional; defaults from type / username + environment)"
@@ -44588,7 +45316,9 @@ Examples:
   tracecli credential create --env <envId> --type api-key --label "prod key" --secret-env API_KEY --placement header --key-name X-API-Key
   tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login
   ADDRESS=$(tracecli inbox create portal -o json | jq -r .address)
-  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin
+  tracecli credential create --env <envId> --type ssh-private-key --secret-file ~/.ssh/bastion_ed25519 --ssh-host bastion.example.com --ssh-username deploy
+  tracecli credential create --env <envId> --type ssh-private-key --secret-file ./key.pem --password-env KEY_PASSPHRASE --ssh-host 10.0.0.5 --ssh-port 2222 --ssh-username ops`
   );
   return command.action(async (options) => {
     await runCreate3(options);
@@ -44886,14 +45616,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c59) => c59.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c62) => c62.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c59) => c59.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c62) => c62.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c59) => `${padLeading(c59.leading)}  ${c59.name.padEnd(nameWidth)}  ${c59.prod.padEnd(4)}  ${c59.url}`
+      (c62) => `${padLeading(c62.leading)}  ${c62.name.padEnd(nameWidth)}  ${c62.prod.padEnd(4)}  ${c62.url}`
     )
   };
 }
@@ -47291,6 +48021,11 @@ Examples:
   });
 }
 
+// src/upload/download.ts
+import { createHash as createHash2 } from "crypto";
+import { open as open2, rename, rm, stat } from "fs/promises";
+import { basename as basename4, join as join7, resolve } from "path";
+
 // src/upload/prepare.ts
 import { createHash } from "crypto";
 import { createReadStream, statSync as statSync4 } from "fs";
@@ -47434,6 +48169,128 @@ async function prepareUploadFile(filePath, options = {}) {
   };
 }
 
+// src/upload/download.ts
+var CodeUploadDownloadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadDownloadError";
+  }
+};
+function safeDownloadFilename(upload) {
+  const extension = requiredExtensionForKind(upload.artifactKind);
+  const fallback = `app${extension}`;
+  const stripped = Array.from(basename4(upload.originalFilename.replace(/\\/g, "/")), (char) => {
+    const code = char.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127 ? "_" : char;
+  }).join("").trim();
+  if (stripped.length === 0 || stripped === "." || stripped === "..") return fallback;
+  return stripped.toLowerCase().endsWith(extension) ? stripped : `${stripped}${extension}`;
+}
+async function resolveDownloadDestination(upload, outOption) {
+  const filename = safeDownloadFilename(upload);
+  if (outOption === void 0) return resolve(process.cwd(), filename);
+  const target = resolve(outOption);
+  try {
+    const info = await stat(target);
+    if (info.isDirectory()) return join7(target, filename);
+  } catch {
+  }
+  return target;
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downloadCodeUploadToFile(upload, downloadUrl, destination, options = {}) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const partialPath = `${destination}.part`;
+  let response;
+  try {
+    response = await fetchImpl(downloadUrl, { method: "GET", redirect: "manual" });
+  } catch (error48) {
+    const detail = error48 instanceof Error ? error48.message : "network error";
+    throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
+  }
+  if (!response.ok || response.body === null) {
+    if (response.body !== null) await response.body.cancel();
+    throw new CodeUploadDownloadError(
+      `Storage answered HTTP ${response.status} instead of the build bytes. Retry; the download link may have expired.`
+    );
+  }
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    const declared = Number(contentLength);
+    if (!Number.isSafeInteger(declared) || declared !== upload.sizeBytes) {
+      await response.body.cancel();
+      throw new CodeUploadDownloadError(
+        `Storage declared ${contentLength} bytes; the upload record says ${upload.sizeBytes}.`
+      );
+    }
+  }
+  await rm(partialPath, { force: true });
+  const file2 = await open2(partialPath, "wx");
+  const hash2 = createHash2("sha256");
+  const reader = response.body.getReader();
+  let downloadedBytes = 0;
+  options.onProgress?.(progress(0, upload.sizeBytes));
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      downloadedBytes += chunk.value.byteLength;
+      if (downloadedBytes > upload.sizeBytes) {
+        await reader.cancel();
+        throw new CodeUploadDownloadError(
+          `Storage sent more than the ${upload.sizeBytes} bytes on record.`
+        );
+      }
+      hash2.update(chunk.value);
+      await writeAll(file2, chunk.value);
+      options.onProgress?.(progress(downloadedBytes, upload.sizeBytes));
+    }
+    await file2.close();
+    if (downloadedBytes !== upload.sizeBytes) {
+      throw new CodeUploadDownloadError(
+        `Download ended after ${downloadedBytes} of ${upload.sizeBytes} bytes.`
+      );
+    }
+    const digest = hash2.digest("hex");
+    if (digest !== upload.archiveSha256) {
+      throw new CodeUploadDownloadError(
+        "Downloaded bytes do not match the SHA-256 recorded at upload time."
+      );
+    }
+    await rename(partialPath, destination);
+  } catch (error48) {
+    await file2.close().catch(() => void 0);
+    await rm(partialPath, { force: true });
+    if (error48 instanceof CodeUploadDownloadError) throw error48;
+    const detail = error48 instanceof Error ? error48.message : "unknown error";
+    throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
+  }
+}
+function progress(downloadedBytes, totalBytes) {
+  return {
+    downloadedBytes,
+    totalBytes,
+    fraction: totalBytes === 0 ? 1 : downloadedBytes / totalBytes
+  };
+}
+async function writeAll(file2, bytes) {
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
+    if (bytesWritten === 0) {
+      throw new CodeUploadDownloadError("Writing the build to disk stalled.");
+    }
+    offset += bytesWritten;
+  }
+}
+
 // src/upload/multipart.ts
 var MAX_CONCURRENT_UPLOADS = 3;
 var MAX_PART_ATTEMPTS = 3;
@@ -47446,7 +48303,7 @@ async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts
   if (!Number.isSafeInteger(uploadedBytes) || uploadedBytes < 0 || uploadedBytes > totalBytes) {
     throw new Error("Invalid multipart progress: uploaded byte count is outside the archive.");
   }
-  options.onProgress?.(progress(uploadedBytes, totalBytes));
+  options.onProgress?.(progress2(uploadedBytes, totalBytes));
   if (parts.length === 0) return;
   const urls = new Map(parts.map((part) => [part.partNumber, part.uploadUrl]));
   const refreshUrls = createUrlRefresher(urls, options.refreshParts);
@@ -47463,7 +48320,7 @@ async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts
         const body = await readFileSlice(filePath, start, end);
         await uploadPartWithRetry(part.partNumber, urls, body, fetchPart, wait, refreshUrls);
         uploadedBytes += body.byteLength;
-        options.onProgress?.(progress(uploadedBytes, totalBytes));
+        options.onProgress?.(progress2(uploadedBytes, totalBytes));
       }
     })
   );
@@ -47551,7 +48408,7 @@ function assertPresignedUploadUrl(value) {
     throw new Error("Invalid multipart upload: part URLs must use HTTPS.");
   }
 }
-function progress(uploadedBytes, totalBytes) {
+function progress2(uploadedBytes, totalBytes) {
   return {
     uploadedBytes,
     totalBytes,
@@ -47559,13 +48416,13 @@ function progress(uploadedBytes, totalBytes) {
   };
 }
 function defaultWait(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
 
 // src/upload/commands.ts
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
 var DEFAULT_RUNTIME = {
-  wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  wait: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
   pollIntervalMs: 3e3,
   fetch: (input, init) => globalThis.fetch(input, init)
 };
@@ -47678,6 +48535,53 @@ function failReadOp5(action, status, body) {
   );
   process.exit(1);
 }
+function failDownloadOp(codeUploadId, status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only an organization admin (or Trace staff) on a pentest-enabled organization can download builds."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CODE_UPLOAD_NOT_BUILD") {
+      console.error(
+        colorError(
+          message ?? "Only APK and IPA builds can be downloaded. Source archives stay on the server."
+        )
+      );
+    } else if (errorCode === "CODE_UPLOAD_NOT_READY") {
+      console.error(
+        colorError(
+          message ?? "The build must be ready and pass malware scanning before it can be downloaded."
+        )
+      );
+      console.error(`Wait for it with: tracecli upload wait ${codeUploadId}`);
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to download build (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
 function resumeHint(codeUploadId, filePath) {
   return `Resume with: tracecli upload resume ${codeUploadId} ${filePath}`;
 }
@@ -47689,13 +48593,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c59) => c59.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c59) => c59.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c59) => c59.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c62) => c62.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c62) => c62.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c62) => c62.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.kind.padEnd(kindWidth)}  ${c59.status.padEnd(statusWidth)}  ${c59.size.padEnd(sizeWidth)}  ${c59.id}`
+    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.kind.padEnd(kindWidth)}  ${c62.status.padEnd(statusWidth)}  ${c62.size.padEnd(sizeWidth)}  ${c62.id}`
   );
   return { header, rows };
 }
@@ -47767,11 +48671,18 @@ function outputUpload(upload, output) {
   }
   console.log(renderUploadDetail(upload));
 }
-function writeProgress(progress2) {
+function writeProgress(progress3) {
+  if (!process.stderr.isTTY) return;
+  const pct = Math.floor(progress3.fraction * 100);
+  process.stderr.write(
+    `\rUploading ${pct}% (${formatArchiveBytes(progress3.uploadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
+  );
+}
+function writeDownloadProgress(progress3) {
   if (!process.stderr.isTTY) return;
-  const pct = Math.floor(progress2.fraction * 100);
+  const pct = Math.floor(progress3.fraction * 100);
   process.stderr.write(
-    `\rUploading ${pct}% (${formatArchiveBytes(progress2.uploadedBytes)} / ${formatArchiveBytes(progress2.totalBytes)})`
+    `\rDownloading ${pct}% (${formatArchiveBytes(progress3.downloadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
 function finishProgress() {
@@ -48085,6 +48996,76 @@ async function runGet4(codeUploadIdArg, options) {
   const upload = await requireUpload(organizationId, codeUploadId);
   outputUpload(upload, output);
 }
+async function runDownload(codeUploadIdArg, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.downloadCodeUpload({
+      params: { organizationId, codeUploadId }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDownloadOp(codeUploadId, result.status, result.body);
+  }
+  const { upload, downloadUrl } = result.body;
+  const destination = await resolveDownloadDestination(upload, options.out);
+  if (!options.force && await pathExists(destination)) {
+    console.error(
+      colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
+    );
+    process.exit(1);
+  }
+  if (output === "table") {
+    console.error(
+      `Downloading ${sanitizeDisplay(upload.displayName)} (${formatArchiveBytes(upload.sizeBytes)}) to ${destination}`
+    );
+  }
+  try {
+    await downloadCodeUploadToFile(upload, downloadUrl, destination, {
+      fetch: runtime.fetch,
+      onProgress: writeDownloadProgress
+    });
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
+    console.error(colorError(detail));
+    process.exit(1);
+  }
+  if (output === "json") {
+    console.log(
+      JSON.stringify(
+        {
+          upload,
+          path: destination,
+          sizeBytes: upload.sizeBytes,
+          archiveSha256: upload.archiveSha256
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["codeUploadId", "path", "sizeBytes", "archiveSha256"].join("	"));
+    console.log(
+      [
+        tsvSafe(upload.codeUploadId),
+        tsvSafe(destination),
+        String(upload.sizeBytes),
+        tsvSafe(upload.archiveSha256)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(upload.displayName)} to ${destination} (${formatArchiveBytes(upload.sizeBytes)}, SHA-256 verified).`
+    )
+  );
+}
 async function runWait(codeUploadIdArg, options, runtime) {
   const output = parseOutput(options.output);
   const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
@@ -48209,6 +49190,23 @@ Examples:
     await runResume(codeUploadId, file2, options, runtime);
   });
 }
+function createDownloadCommand(runtime) {
+  return new Command("download").description("Download an APK or IPA build that finished malware scanning").argument("<codeUploadId>", "Upload UUID of the build").option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Only READY builds with a clean malware scan can be downloaded. Source ZIPs
+are not downloadable. The file is written under the name it was uploaded
+with and its size and SHA-256 are checked against the upload record before
+it is moved into place.
+
+Examples:
+  tracecli upload download <codeUploadId>
+  tracecli upload download <codeUploadId> --out ./builds/
+  tracecli upload download <codeUploadId> --out ./release.apk --force`
+  ).action(async (codeUploadId, options) => {
+    await runDownload(codeUploadId, options, runtime);
+  });
+}
 function createWaitCommand(runtime) {
   return new Command("wait").description("Wait until an upload finishes malware scanning and validation").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
     await runWait(codeUploadId, options, runtime);
@@ -48234,11 +49232,12 @@ Examples:
 }
 function createUploadCommand(runtime = {}) {
   const resolved = resolveRuntime(runtime);
-  const upload = new Command("upload").alias("code-upload").description("Upload source archives (and separately, mobile builds) for pentest");
+  const upload = new Command("upload").alias("code-upload").description("Upload source archives and mobile builds for pentest; download builds back");
   upload.addCommand(createCreateCommand5(resolved));
   upload.addCommand(createBuildCommand(resolved));
   upload.addCommand(createListCommand7());
   upload.addCommand(createGetCommand4());
+  upload.addCommand(createDownloadCommand(resolved));
   upload.addCommand(createResumeCommand(resolved));
   upload.addCommand(createWaitCommand(resolved));
   upload.addCommand(createDeleteCommand5());