securewithtrace 0.41.0 → 0.42.0

package/dist/index.js

@@ -6276,7 +6276,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c59) => c59 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c62) => c62 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16320,9 +16320,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c59 = inst._zod.bag;
-  inst.minDate = c59.minimum ? new Date(c59.minimum) : null;
-  inst.maxDate = c59.maximum ? new Date(c59.maximum) : null;
+  const c62 = inst._zod.bag;
+  inst.minDate = c62.minimum ? new Date(c62.minimum) : null;
+  inst.maxDate = c62.maximum ? new Date(c62.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -21920,6 +21920,17 @@ var ContestReasonValues = [
   "OTHER"
 ];
 var ContestReason = external_exports.enum(ContestReasonValues);
+var PentestFindingFeedbackRatingValues = ["THUMBS_UP", "THUMBS_DOWN"];
+var PentestFindingFeedbackRating = external_exports.enum(PentestFindingFeedbackRatingValues);
+var PentestFindingFeedbackReasonValues = [
+  "FALSE_POSITIVE",
+  "SEVERITY_TOO_HIGH",
+  "SEVERITY_TOO_LOW",
+  "UNCLEAR_WRITEUP",
+  "REMEDIATION_NOT_ACTIONABLE",
+  "OTHER"
+];
+var PentestFindingFeedbackReason = external_exports.enum(PentestFindingFeedbackReasonValues);
 var ManualRetestOutcomeValues = ["FIXED", "PARTIALLY_FIXED", "NOT_FIXED"];
 var ManualRetestOutcome = external_exports.enum(ManualRetestOutcomeValues);
 var RetestOutcomeValues = [...ManualRetestOutcomeValues, "UNABLE_TO_VERIFY"];
@@ -21998,7 +22009,7 @@ var PentestEditActionValues = [
   "DELIVER"
 ];
 var PentestEditAction = external_exports.enum(PentestEditActionValues);
-var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY"];
+var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY", "STAFF"];
 var PentestAuditActorType = external_exports.enum(PentestAuditActorTypeValues);
 var PentestHypothesisStatusValues = [
   "DRAFTED",
@@ -22362,6 +22373,20 @@ var AgentSessionEventPayloadUrlResponseSchema = external_exports.object({
   /** Presigned S3 GET for the overflow payload (short TTL). */
   url: external_exports.url()
 });
+var ExportAgentSessionTranscriptResponseSchema = external_exports.object({
+  /** Presigned S3 GET with an attachment Content-Disposition (short TTL). */
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date(),
+  fileName: external_exports.string(),
+  /** Bytes of the exported document. */
+  sizeBytes: external_exports.number().int().nonnegative(),
+  eventCount: external_exports.number().int().nonnegative(),
+  subagentCount: external_exports.number().int().nonnegative(),
+  /** High-water mark captured by the export; a live session keeps moving past it. */
+  lastEventSeq: external_exports.number().int().nonnegative(),
+  /** Overflow payloads whose S3 object no longer exists; the export keeps the inline preview for those. */
+  missingOverflowPayloadCount: external_exports.number().int().nonnegative()
+});
 var SendAgentSessionMessageResponseSchema = external_exports.object({
   event: AgentSessionEventResponseSchema,
   /** True when the message relaunched a parked session. */
@@ -22507,6 +22532,21 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  // POST, not GET: each call assembles the transcript from Postgres + S3 overflow
+  // objects and writes a new export object before presigning it.
+  exportTranscript: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/transcript-export",
+    pathParams: AgentSessionIdParamsSchema,
+    body: null,
+    responses: {
+      200: ExportAgentSessionTranscriptResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   sendMessage: {
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/messages",
@@ -23731,11 +23771,19 @@ var CustomerReportPdfResponseSchema = ReportPdfResponseSchema.omit({
   canViewInline: external_exports.boolean().optional(),
   /**
    * What the Download action hands the customer: the PDF alone, or one zip
-   * carrying the PDF, the markdown report, and the evidence files (partner
-   * templates whose tooling consumes the markdown). Preview always opens the
-   * PDF. Optional for the deploy-order reason above; consumers default to 'pdf'.
+   * carrying the PDF, the Word document, the markdown report, and the evidence
+   * files (partner templates whose tooling consumes the markdown). Preview
+   * always opens the PDF. Optional for the deploy-order reason above; consumers
+   * default to 'pdf'.
+   */
+  downloadFormat: CustomerReportDownloadFormatSchema.optional(),
+  /**
+   * Whether a Word document (.docx) from the same render as the served PDF is
+   * available through `downloadCustomer?artifact=docx`. Partner templates only;
+   * resolved server-side from storage, never from the template alone. Optional
+   * for the deploy-order reason above; consumers default to false.
    */
-  downloadFormat: CustomerReportDownloadFormatSchema.optional()
+  docxAvailable: external_exports.boolean().optional()
 });
 var GetCustomerReportPdfResponseSchema = external_exports.object({
   report: CustomerReportPdfResponseSchema.nullable()
@@ -23749,8 +23797,13 @@ var DeleteReportPdfRequestSchema = external_exports.object({
 var DeleteReportIssueRequestSchema = external_exports.object({
   reason: external_exports.string().min(1).max(1e4).optional()
 }).strict().optional();
+var ReportPdfDownloadArtifactValues = ["pdf", "markdown", "docx"];
+var ReportPdfDownloadArtifactSchema = external_exports.enum(ReportPdfDownloadArtifactValues);
 var ReportPdfDownloadQuerySchema = external_exports.object({
-  artifact: external_exports.enum(["pdf", "markdown"]).optional()
+  artifact: ReportPdfDownloadArtifactSchema.optional()
+});
+var CustomerReportPdfDownloadQuerySchema = PentestPdfDownloadQuerySchema.extend({
+  artifact: external_exports.enum(["docx"]).optional()
 });
 var ReportPdfDownloadResponseSchema = external_exports.object({
   report: ReportPdfResponseSchema,
@@ -24318,6 +24371,10 @@ var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
 var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit({
   repositoryId: true
 });
+var CustomerFindingPendingRetestSchema = external_exports.object({
+  state: external_exports.enum(["QUEUED", "RUNNING"]),
+  since: external_exports.coerce.date()
+}).nullable().default(null);
 var CustomerPentestFindingResponseSchema = PentestFindingResponseSchema.omit({
   organizationId: true,
   pentestId: true,
@@ -24341,7 +24398,8 @@ var CustomerPentestFindingResponseSchema = PentestFindingResponseSchema.omit({
   // customer "dispute under review" hint + suppresses the re-dispute affordance,
   // even after a retest moved the finding off CONTESTED. Only this derived
   // boolean crosses the trust boundary — never the staff contest list.
-  hasOpenContest: external_exports.boolean()
+  hasOpenContest: external_exports.boolean(),
+  pendingRetest: CustomerFindingPendingRetestSchema
 });
 var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   organizationId: true,
@@ -24356,7 +24414,10 @@ var CustomerPentestFindingListItemSchema = PentestFindingListItemSchema.omit({
   // Published-only, same as the customer detail schema above — re-narrowed from the
   // nullable root.
   displayId: external_exports.number().int().positive(),
-  repositories: external_exports.array(CustomerPentestFindingRepositorySchema)
+  repositories: external_exports.array(CustomerPentestFindingRepositorySchema),
+  // On the list row too: the findings table is what the customer watches while a
+  // retest they queued runs, and polling it is how the row flips without a reload.
+  pendingRetest: CustomerFindingPendingRetestSchema
 });
 var ListCustomerPentestFindingsResponseSchema = external_exports.array(
   CustomerPentestFindingListItemSchema
@@ -24365,6 +24426,7 @@ var ListCustomerPentestFindingDeliveryResponseSchema = external_exports.array(
   CustomerPentestFindingListItemSchema
 );
 var ResolutionTimelineActor = external_exports.enum(["CUSTOMER", "TRACE"]);
+var ResolutionTimelineActorName = external_exports.string().nullable().default(null);
 var ResolutionTimelineVia = external_exports.object({
   provider: external_exports.enum(["LINEAR"]),
   identifier: external_exports.string(),
@@ -24375,12 +24437,17 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("remediation_reported"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string().nullable(),
     via: ResolutionTimelineVia
   }),
+  // Retests are run by Trace (staff or a Trace agent), so the actor is fixed;
+  // the default keeps a web build ahead of the api parsing older payloads.
   external_exports.object({
     kind: external_exports.literal("retest"),
     at: external_exports.coerce.date(),
+    actor: external_exports.literal("TRACE").default("TRACE"),
+    actorName: ResolutionTimelineActorName,
     outcome: RetestOutcome,
     note: external_exports.string().nullable()
   }),
@@ -24388,12 +24455,14 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("accepted_with_controls"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string()
   }),
   external_exports.object({
     kind: external_exports.literal("dismissed"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     reason: PentestFindingDismissReason,
     note: external_exports.string()
   }),
@@ -24403,6 +24472,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("reopened"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     toStatus: external_exports.enum(["OPEN", "IN_PROGRESS"]),
     note: external_exports.string().nullable(),
     via: ResolutionTimelineVia
@@ -24412,6 +24482,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("note"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     note: external_exports.string()
   }),
   // Customer opened a dispute (PR 3). `note` = the customer's justification.
@@ -24419,6 +24490,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("contested"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     reason: ContestReason,
     note: external_exports.string()
   }),
@@ -24429,6 +24501,7 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("contest_resolved"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     resultStatus: PentestFindingStatus.nullable(),
     note: external_exports.string()
   }),
@@ -24438,22 +24511,61 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     kind: external_exports.literal("ticket_created"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
     provider: external_exports.enum(["LINEAR"]),
     identifier: external_exports.string(),
     url: external_exports.url()
+  }),
+  // A reader rated the finding. `reason` is set only on a thumbs down; `note` is
+  // the optional comment left with the vote.
+  external_exports.object({
+    kind: external_exports.literal("feedback_rated"),
+    at: external_exports.coerce.date(),
+    actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
+    rating: PentestFindingFeedbackRating,
+    reason: PentestFindingFeedbackReason.nullable(),
+    note: external_exports.string().nullable()
+  }),
+  // A reader left a comment without a vote.
+  external_exports.object({
+    kind: external_exports.literal("feedback_commented"),
+    at: external_exports.coerce.date(),
+    actor: ResolutionTimelineActor,
+    actorName: ResolutionTimelineActorName,
+    note: external_exports.string()
   })
 ]);
 var ResolutionTimelineSchema = external_exports.array(ResolutionTimelineEntrySchema);
+var PentestFindingFeedbackSummarySchema = external_exports.object({
+  thumbsUp: external_exports.number().int().nonnegative(),
+  thumbsDown: external_exports.number().int().nonnegative(),
+  viewerRating: PentestFindingFeedbackRating.nullable()
+});
+var PentestFindingFeedbackSummaryField = PentestFindingFeedbackSummarySchema.default({
+  thumbsUp: 0,
+  thumbsDown: 0,
+  viewerRating: null
+});
 var PentestFindingDetailResponseSchema = PentestFindingResponseSchema.extend({
-  resolutionTimeline: ResolutionTimelineSchema
+  resolutionTimeline: ResolutionTimelineSchema,
+  feedbackSummary: PentestFindingFeedbackSummaryField
 });
 var CustomerPentestFindingDetailResponseSchema = CustomerPentestFindingResponseSchema.extend({
-  resolutionTimeline: ResolutionTimelineSchema
+  resolutionTimeline: ResolutionTimelineSchema,
+  feedbackSummary: PentestFindingFeedbackSummaryField
 });
 var ReadPentestFindingResponseSchema = external_exports.union([
   PentestFindingDetailResponseSchema,
   CustomerPentestFindingDetailResponseSchema
 ]);
+var PentestFindingPdfExportResponseSchema = external_exports.object({
+  /** Download name the presigned URL carries, e.g. `PTF-12-idor-on-invoices.pdf`. */
+  fileName: external_exports.string(),
+  downloadUrl: external_exports.url(),
+  /** False when an identical export already existed and was reused without a render. */
+  rendered: external_exports.boolean()
+});
 var ListReadPentestFindingsResponseSchema = external_exports.union([
   ListPentestFindingsResponseSchema,
   ListCustomerPentestFindingsResponseSchema
@@ -24644,6 +24756,18 @@ var ResolvePentestFindingContestRequestSchema = external_exports.object({
   dismissReason: PentestFindingDismissReason.optional(),
   note: external_exports.string().min(1).max(1e4)
 });
+var PENTEST_FINDING_FEEDBACK_COMMENT_MAX_LENGTH = 5e3;
+var CreatePentestFindingFeedbackRequestSchema = external_exports.object({
+  rating: PentestFindingFeedbackRating.nullable().default(null),
+  reason: PentestFindingFeedbackReason.nullable().default(null),
+  comment: external_exports.string().trim().max(PENTEST_FINDING_FEEDBACK_COMMENT_MAX_LENGTH).transform((value) => value.length === 0 ? null : value).nullable().default(null)
+}).refine((input) => input.rating !== null || input.comment !== null, {
+  message: "Feedback needs a rating or a comment",
+  path: ["comment"]
+}).refine((input) => input.reason === null || input.rating === "THUMBS_DOWN", {
+  message: "A reason only accompanies a thumbs down",
+  path: ["reason"]
+});
 var PentestFindingRetestResponseSchema = external_exports.object({
   retestId: external_exports.uuid(),
   pentestFindingId: external_exports.uuid(),
@@ -25220,7 +25344,8 @@ var CredentialTypeValues = [
   "USERNAME_PASSWORD",
   "COOKIE",
   "MAGIC_AUTH",
-  "SESSION_STATE"
+  "SESSION_STATE",
+  "SSH_PRIVATE_KEY"
 ];
 var CredentialType = external_exports.enum(CredentialTypeValues);
 var BearerAuthConfigSchema = external_exports.object({
@@ -25318,17 +25443,94 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c59, i2) => {
-    const d = c59.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c62, i2) => {
+    const d = c62.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c59.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c62.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
 });
+var SSH_DEFAULT_PORT = 22;
+var SSH_HOST_MAX_CHARS = 253;
+var SSH_USERNAME_MAX_CHARS = 128;
+var SSH_PRIVATE_KEY_PEM_MAX_BYTES = 16384;
+var SSH_PASSPHRASE_MAX_CHARS = 1024;
+var SSH_HOST_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.:-]*$/;
+var SSH_USERNAME_PATTERN = /^[^\s\p{Cc}]+$/u;
+var SSH_HOST_KEY_FINGERPRINT_PATTERN = /^SHA256:[A-Za-z0-9+/]{43}=?$/;
+var SshPrivateKeyAuthConfigSchema = external_exports.object({
+  type: external_exports.literal("SSH_PRIVATE_KEY"),
+  host: external_exports.string().min(1, "host is required").max(SSH_HOST_MAX_CHARS).regex(SSH_HOST_PATTERN, "host must be a hostname or IP address"),
+  port: external_exports.number().int().min(1).max(65535).default(SSH_DEFAULT_PORT),
+  username: external_exports.string().min(1, "username is required").max(SSH_USERNAME_MAX_CHARS).regex(SSH_USERNAME_PATTERN, "username must not contain whitespace or control characters"),
+  hostKeyFingerprint: external_exports.string().regex(SSH_HOST_KEY_FINGERPRINT_PATTERN, "host key fingerprint must be SHA256:<base64>").optional()
+}).strict();
+var SSH_PRIVATE_KEY_PEM_LABELS = [
+  "OPENSSH PRIVATE KEY",
+  "RSA PRIVATE KEY",
+  "EC PRIVATE KEY",
+  "PRIVATE KEY",
+  "ENCRYPTED PRIVATE KEY"
+];
+var PEM_BEGIN_LINE = /^-----BEGIN ([A-Z ]+)-----$/;
+var PEM_END_LINE = /^-----END ([A-Z ]+)-----$/;
+var PEM_BASE64_LINE = /^[A-Za-z0-9+/]+={0,2}$/;
+var PEM_HEADER_LINE = /^[A-Za-z0-9-]+: [\x20-\x7e]*$/;
+function sshPrivateKeyPemError(value) {
+  if (new TextEncoder().encode(value).length > SSH_PRIVATE_KEY_PEM_MAX_BYTES) {
+    return `private key must be at most ${SSH_PRIVATE_KEY_PEM_MAX_BYTES} bytes`;
+  }
+  if (/[^\P{Cc}\r\n]/u.test(value)) {
+    return "private key contains control characters";
+  }
+  const lines = value.replace(/\r\n/g, "\n").split("\n").map((line) => line.trimEnd());
+  while (lines.length > 0 && lines[0] === "") lines.shift();
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  if (lines.length < 3) {
+    return "private key must be a PEM block with BEGIN and END lines";
+  }
+  const begin = PEM_BEGIN_LINE.exec(lines[0] ?? "");
+  if (begin === null) {
+    return "private key must start with a -----BEGIN \u2026 PRIVATE KEY----- line";
+  }
+  const end = PEM_END_LINE.exec(lines[lines.length - 1] ?? "");
+  if (end === null) {
+    return "private key must end with a -----END \u2026 PRIVATE KEY----- line";
+  }
+  const label = begin[1];
+  if (!SSH_PRIVATE_KEY_PEM_LABELS.includes(label ?? "")) {
+    return `private key label must be one of: ${SSH_PRIVATE_KEY_PEM_LABELS.join(", ")}`;
+  }
+  if (end[1] !== label) {
+    return "private key BEGIN and END labels do not match";
+  }
+  let sawBody = false;
+  for (const line of lines.slice(1, -1)) {
+    if (line === "") continue;
+    if (PEM_BASE64_LINE.test(line)) {
+      sawBody = true;
+      continue;
+    }
+    if (PEM_HEADER_LINE.test(line) && !sawBody) continue;
+    return "private key body must be base64 lines";
+  }
+  if (!sawBody) {
+    return "private key body is empty";
+  }
+  return null;
+}
+var SshPrivateKeyPemSchema = external_exports.string().min(1, "private key is required").superRefine((value, ctx) => {
+  const message = sshPrivateKeyPemError(value);
+  if (message !== null) ctx.addIssue({ code: "custom", message });
+});
+var SshPrivateKeySecretSchema = external_exports.object({
+  privateKeyPem: SshPrivateKeyPemSchema,
+  passphrase: external_exports.string().min(1).max(SSH_PASSPHRASE_MAX_CHARS).optional()
+}).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
 var TotpSetupKeySchema = external_exports.string().min(1).max(TOTP_MAX_SECRET_CHARS * 4).superRefine((value, ctx) => {
@@ -25362,7 +25564,8 @@ var CredentialAuthConfigSchema = external_exports.discriminatedUnion("type", [
   UsernamePasswordAuthConfigSchema,
   PassphraseAuthConfigSchema,
   MagicAuthConfigSchema,
-  SessionStateAuthConfigSchema
+  SessionStateAuthConfigSchema,
+  SshPrivateKeyAuthConfigSchema
 ]);
 
 // ../../packages/api-contracts/src/schemas/domain/knowledge-fact.schema.ts
@@ -29716,7 +29919,13 @@ var SECRET_SHAPES = {
     username: external_exports.string().min(1).max(500),
     password: external_exports.string().min(1).max(2048)
   },
-  SESSION_STATE: { secretValue: SessionStateSecretValueSchema }
+  SESSION_STATE: { secretValue: SessionStateSecretValueSchema },
+  // The key and its passphrase are one secret: they are encrypted together and
+  // replaced together (see SshPrivateKeySecretSchema for the stored shape).
+  SSH_PRIVATE_KEY: {
+    privateKeyPem: SshPrivateKeyPemSchema,
+    passphrase: external_exports.string().min(1).max(SSH_PASSPHRASE_MAX_CHARS).optional()
+  }
 };
 var CreateLabelSchema = external_exports.string().max(200).optional();
 var CreateBearerSchema = external_exports.object({
@@ -29797,6 +30006,12 @@ var CreateSessionStateSchema = external_exports.object({
   label: CreateLabelSchema,
   ...SECRET_SHAPES.SESSION_STATE
 }).strict();
+var CreateSshPrivateKeySchema = external_exports.object({
+  credentialType: external_exports.literal("SSH_PRIVATE_KEY"),
+  label: CreateLabelSchema,
+  ...SECRET_SHAPES.SSH_PRIVATE_KEY,
+  authConfig: SshPrivateKeyAuthConfigSchema
+}).strict();
 var CreateCredentialRequestSchema = external_exports.discriminatedUnion("credentialType", [
   CreateBearerSchema,
   CreateJwtSchema,
@@ -29805,7 +30020,8 @@ var CreateCredentialRequestSchema = external_exports.discriminatedUnion("credent
   CreateUsernamePasswordSchema,
   CreateCookieSchema,
   CreateMagicAuthSchema,
-  CreateSessionStateSchema
+  CreateSessionStateSchema,
+  CreateSshPrivateKeySchema
 ]);
 var CredentialResponseSchema = external_exports.object({
   credentialId: external_exports.uuid(),
@@ -29848,7 +30064,8 @@ var RotateCredentialSecretRequestSchema = external_exports.discriminatedUnion("c
     credentialType: external_exports.literal("USERNAME_PASSWORD"),
     ...SECRET_SHAPES.USERNAME_PASSWORD
   }).strict(),
-  external_exports.object({ credentialType: external_exports.literal("SESSION_STATE"), ...SECRET_SHAPES.SESSION_STATE }).strict()
+  external_exports.object({ credentialType: external_exports.literal("SESSION_STATE"), ...SECRET_SHAPES.SESSION_STATE }).strict(),
+  external_exports.object({ credentialType: external_exports.literal("SSH_PRIVATE_KEY"), ...SECRET_SHAPES.SSH_PRIVATE_KEY }).strict()
 ]);
 var SetCredentialMfaRequestSchema = external_exports.object({
   kind: external_exports.literal("TOTP"),
@@ -31200,6 +31417,159 @@ var inboxContract = c19.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/member.api.ts
+var MemberOrgParamsSchema = OrgIdParamsSchema;
+var MemberRoleSlugSchema = external_exports.enum(["admin", "analyst", "developer"]);
+var CreateMemberInvitationRequestSchema = external_exports.object({
+  email: external_exports.email().max(320),
+  roleSlug: MemberRoleSlugSchema.default("developer")
+});
+var CreateMemberInvitationResponseSchema = external_exports.object({
+  invitationId: external_exports.string().min(1),
+  email: external_exports.email(),
+  roleSlug: MemberRoleSlugSchema
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/invite-link.api.ts
+var INVITE_LINK_MIN_EXPIRES_IN_HOURS = 1;
+var INVITE_LINK_MAX_EXPIRES_IN_HOURS = 24 * 30;
+var INVITE_LINK_DEFAULT_EXPIRES_IN_HOURS = 24 * 7;
+var INVITE_LINK_MIN_USES = 1;
+var INVITE_LINK_MAX_USES = 100;
+var INVITE_LINK_DEFAULT_MAX_USES = 1;
+var InviteLinkOrgParamsSchema = OrgIdParamsSchema;
+var InviteLinkParamsSchema = OrgIdParamsSchema.extend({
+  inviteLinkId: external_exports.uuid()
+});
+var InviteLinkTokenSchema = external_exports.string().min(32).max(128).regex(/^[A-Za-z0-9_-]+$/, {
+  message: "token must contain only URL-safe base64 characters"
+});
+var InviteLinkTokenParamsSchema = external_exports.object({
+  token: InviteLinkTokenSchema
+});
+var CreateInviteLinkRequestSchema = external_exports.object({
+  roleSlug: MemberRoleSlugSchema.default("developer"),
+  expiresInHours: external_exports.number().int().min(INVITE_LINK_MIN_EXPIRES_IN_HOURS).max(INVITE_LINK_MAX_EXPIRES_IN_HOURS).default(INVITE_LINK_DEFAULT_EXPIRES_IN_HOURS),
+  maxUses: external_exports.number().int().min(INVITE_LINK_MIN_USES).max(INVITE_LINK_MAX_USES).default(INVITE_LINK_DEFAULT_MAX_USES)
+});
+var InviteLinkStatusSchema = external_exports.enum(["active", "expired", "exhausted", "revoked"]);
+var InviteLinkResponseSchema = external_exports.object({
+  inviteLinkId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  roleSlug: MemberRoleSlugSchema,
+  status: InviteLinkStatusSchema,
+  expiresAt: external_exports.coerce.date(),
+  maxUses: external_exports.number().int(),
+  useCount: external_exports.number().int(),
+  createdById: external_exports.uuid(),
+  createdByName: external_exports.string(),
+  createdByEmail: external_exports.string(),
+  revokedAt: external_exports.coerce.date().nullable(),
+  createdAt: external_exports.coerce.date()
+});
+var CreateInviteLinkResponseSchema = InviteLinkResponseSchema.extend({
+  url: external_exports.url()
+});
+var ListInviteLinksResponseSchema = external_exports.array(InviteLinkResponseSchema);
+var RevokeInviteLinkResponseSchema = external_exports.object({
+  inviteLinkId: external_exports.uuid(),
+  revokedAt: external_exports.coerce.date()
+});
+var InviteLinkPreviewResponseSchema = external_exports.object({
+  status: InviteLinkStatusSchema,
+  organizationName: external_exports.string(),
+  organizationLogoUrl: external_exports.string().nullable(),
+  roleSlug: MemberRoleSlugSchema,
+  expiresAt: external_exports.coerce.date()
+});
+var AcceptInviteLinkResponseSchema = external_exports.object({
+  /** `joined` created a membership; `already_member` found an active one and consumed nothing. */
+  outcome: external_exports.enum(["joined", "already_member"]),
+  organizationSlug: external_exports.string(),
+  organizationName: external_exports.string(),
+  workosOrganizationId: external_exports.string(),
+  roleSlug: MemberRoleSlugSchema
+});
+var AcceptInviteLinkRejectedResponseSchema = ErrorResponseSchema.extend({
+  status: InviteLinkStatusSchema.optional()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/invite-link.ts
+var c20 = initContract();
+var inviteLinkContract = c20.router({
+  createInviteLink: {
+    method: "POST",
+    path: "/organizations/:organizationId/invite-links",
+    pathParams: InviteLinkOrgParamsSchema,
+    body: CreateInviteLinkRequestSchema,
+    responses: {
+      201: CreateInviteLinkResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  listInviteLinks: {
+    method: "GET",
+    path: "/organizations/:organizationId/invite-links",
+    pathParams: InviteLinkOrgParamsSchema,
+    responses: {
+      200: ListInviteLinksResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  revokeInviteLink: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/invite-links/:inviteLinkId",
+    pathParams: InviteLinkParamsSchema,
+    responses: {
+      200: RevokeInviteLinkResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+var inviteLinkPublicContract = c20.router(
+  {
+    previewInviteLink: {
+      method: "GET",
+      path: "/invite-links/:token",
+      pathParams: InviteLinkTokenParamsSchema,
+      responses: {
+        200: InviteLinkPreviewResponseSchema,
+        400: ErrorResponseSchema,
+        404: ErrorResponseSchema,
+        500: ErrorResponseSchema
+      }
+    },
+    acceptInviteLink: {
+      method: "POST",
+      path: "/invite-links/:token/accept",
+      pathParams: InviteLinkTokenParamsSchema,
+      body: c20.noBody(),
+      responses: {
+        200: AcceptInviteLinkResponseSchema,
+        400: ErrorResponseSchema,
+        401: ErrorResponseSchema,
+        404: ErrorResponseSchema,
+        409: AcceptInviteLinkRejectedResponseSchema,
+        503: ErrorResponseSchema,
+        500: ErrorResponseSchema
+      }
+    }
+  },
+  {
+    pathPrefix: "/v1"
+  }
+);
+
 // ../../packages/api-contracts/src/schemas/api/v1/knowledge-base.api.ts
 var KnowledgeBaseAuthorSchema = external_exports.object({
   userId: external_exports.string(),
@@ -31231,8 +31601,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c20 = initContract();
-var knowledgeBaseContract = c20.router({
+var c21 = initContract();
+var knowledgeBaseContract = c21.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -31453,8 +31823,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c21 = initContract();
-var knowledgeDocumentContract = c21.router({
+var c22 = initContract();
+var knowledgeDocumentContract = c22.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -31780,8 +32150,8 @@ var LinearMetadataResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-integration.ts
-var c22 = initContract();
-var linearIntegrationContract = c22.router({
+var c23 = initContract();
+var linearIntegrationContract = c23.router({
   getLinearIntegration: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear",
@@ -31799,7 +32169,7 @@ var linearIntegrationContract = c22.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/connect",
     pathParams: OrgIdParamsSchema,
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: LinearConnectResponseSchema,
       401: ErrorResponseSchema,
@@ -31814,7 +32184,7 @@ var linearIntegrationContract = c22.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/disconnect",
     pathParams: OrgIdParamsSchema,
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: LinearIntegrationResponseSchema,
       401: ErrorResponseSchema,
@@ -31876,8 +32246,8 @@ var linearIntegrationContract = c22.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-tickets.ts
-var c23 = initContract();
-var linearTicketContract = c23.router({
+var c24 = initContract();
+var linearTicketContract = c24.router({
   /**
    * Push one or more pentest findings to Linear as tickets. Customer-side
    * (VIEW_RESULTS + PENTEST capability); non-admins create into the org's
@@ -31981,8 +32351,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c24 = initContract();
-var llmProviderKeyContract = c24.router({
+var c25 = initContract();
+var llmProviderKeyContract = c25.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -32049,22 +32419,9 @@ var llmProviderKeyContract = c24.router({
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/member.api.ts
-var MemberOrgParamsSchema = OrgIdParamsSchema;
-var MemberRoleSlugSchema = external_exports.enum(["admin", "analyst", "developer"]);
-var CreateMemberInvitationRequestSchema = external_exports.object({
-  email: external_exports.email().max(320),
-  roleSlug: MemberRoleSlugSchema.default("developer")
-});
-var CreateMemberInvitationResponseSchema = external_exports.object({
-  invitationId: external_exports.string().min(1),
-  email: external_exports.email(),
-  roleSlug: MemberRoleSlugSchema
-});
-
 // ../../packages/api-contracts/src/contracts/v1/member.ts
-var c25 = initContract();
-var memberContract = c25.router({
+var c26 = initContract();
+var memberContract = c26.router({
   createInvitation: {
     method: "POST",
     path: "/organizations/:organizationId/members/invitations",
@@ -32364,8 +32721,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c26 = initContract();
-var organizationContract = c26.router({
+var c27 = initContract();
+var organizationContract = c27.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -32410,6 +32767,23 @@ var organizationContract = c26.router({
     },
     summary: "Create an organization (Trace staff only)"
   },
+  // Staff-only, cross-org: removes the tenant from Trace and WorkOS together.
+  // 409 when members, repositories, or retained audit history still reference
+  // the organization; those must be removed first (or cannot be, for WORM rows).
+  deleteOrganizationAsStaff: {
+    method: "DELETE",
+    path: "/staff/organizations/:organizationId",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Delete an organization (Trace staff only)"
+  },
   getOrganization: {
     method: "GET",
     path: "/organizations/:organizationId",
@@ -32720,7 +33094,7 @@ var organizationContract = c26.router({
     method: "POST",
     path: "/organizations/:organizationId/logos-from-homepage",
     pathParams: OrgIdParamsSchema,
-    body: c26.type(),
+    body: c27.type(),
     responses: {
       200: OrganizationResponseSchema,
       // 400 — no homepage set on the organization.
@@ -33027,8 +33401,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c27 = initContract();
-var pentestContract = c27.router({
+var c28 = initContract();
+var pentestContract = c28.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -33338,8 +33712,8 @@ var pentestContract = c27.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attack-chain.ts
-var c28 = initContract();
-var pentestAttackChainContract = c28.router({
+var c29 = initContract();
+var pentestAttackChainContract = c29.router({
   listAttackChains: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains",
@@ -33438,7 +33812,7 @@ var pentestAttackChainContract = c28.router({
     method: "DELETE",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId",
     pathParams: PentestAttackChainIdParamsSchema,
-    body: c28.noBody(),
+    body: c29.noBody(),
     responses: {
       200: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -33599,8 +33973,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c29 = initContract();
-var pentestAttestationContract = c29.router({
+var c30 = initContract();
+var pentestAttestationContract = c30.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -33743,8 +34117,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c30 = initContract();
-var pentestAuditLogContract = c30.router({
+var c31 = initContract();
+var pentestAuditLogContract = c31.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -33791,8 +34165,8 @@ var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
-var c31 = initContract();
-var pentestAuthorizedDomainContract = c31.router({
+var c32 = initContract();
+var pentestAuthorizedDomainContract = c32.router({
   getPentestAuthorizedScope: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
@@ -33846,8 +34220,8 @@ var PentestEgressResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-egress.ts
-var c32 = initContract();
-var pentestEgressContract = c32.router({
+var c33 = initContract();
+var pentestEgressContract = c33.router({
   getPentestEgress: {
     method: "GET",
     path: "/staff/pentest-egress",
@@ -33886,8 +34260,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c33 = initContract();
-var pentestEngagementExclusionContract = c33.router({
+var c34 = initContract();
+var pentestEngagementExclusionContract = c34.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -33951,8 +34325,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c34 = initContract();
-var pentestEnvironmentContract = c34.router({
+var c35 = initContract();
+var pentestEnvironmentContract = c35.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -34001,8 +34375,8 @@ var pentestEnvironmentContract = c34.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c35 = initContract();
-var pentestFindingContract = c35.router({
+var c36 = initContract();
+var pentestFindingContract = c36.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -34106,6 +34480,24 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // Same visibility as getCustomerFinding: published findings only, customer DTO,
+  // so the document never carries staff identity or a draft.
+  exportCustomerFindingPdf: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/pdf",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    summary: "Render one pentest finding as a Trace-branded PDF",
+    description: "Renders the published finding on demand, stores the PDF, and returns a short-lived presigned download URL. An identical export from the same day is reused without a render. The document names the finding, its classification, and its affected repositories only: no people and no organization name appear on it. Rendering shares one browser per API task, so exports are admission-controlled per organization; a 429 means retry after the interval in `details.retryAfterSeconds`.",
+    responses: {
+      200: PentestFindingPdfExportResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Evidence (PR 2: surface & curate) ───
   listCustomerFindingEvidence: {
     method: "GET",
@@ -34428,6 +34820,25 @@ var pentestFindingContract = c35.router({
       500: ErrorResponseSchema
     }
   },
+  // Reader feedback on a published finding: a thumbs up/down, a comment, or both.
+  // Append-only and never a status change (disputes are `contest`). Same auth as
+  // the other customer writes: VIEW_RESULTS + user principal + customer visibility.
+  submitFeedback: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/feedback",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: CreatePentestFindingFeedbackRequestSchema,
+    summary: "Leave feedback on a pentest finding",
+    description: "Records a thumbs up or thumbs down, an optional reason for a thumbs down, and an optional comment. Each reader counts once in the tallies: a new vote replaces the previous one in the count while the change stays in the resolution history. Returns the updated tallies.",
+    responses: {
+      201: PentestFindingFeedbackSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Contests ───
   listContests: {
     method: "GET",
@@ -34558,8 +34969,8 @@ var pentestFindingContract = c35.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c36 = initContract();
-var pentestHypothesisContract = c36.router({
+var c37 = initContract();
+var pentestHypothesisContract = c37.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -34661,9 +35072,148 @@ var pentestHypothesisContract = c36.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-intake-document.api.ts
+var PentestIntakeDocumentTypeValues = [
+  "PREVIOUS_PENTEST",
+  "ARCHITECTURE_DIAGRAM",
+  "THREAT_MODEL",
+  "OTHER"
+];
+var PentestIntakeDocumentTypeSchema = external_exports.enum(PentestIntakeDocumentTypeValues);
+var MAX_PENTEST_INTAKE_DOCUMENT_BYTES = 50 * 1024 * 1024;
+var PentestIntakeDocumentIdParamsSchema = CustomerPentestIdParamsSchema.extend({
+  documentId: external_exports.uuid()
+});
+var PentestIntakeDocumentResponseSchema = external_exports.object({
+  documentId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  documentType: PentestIntakeDocumentTypeSchema,
+  fileName: external_exports.string(),
+  fileType: external_exports.string(),
+  fileSizeBytes: external_exports.number().int().nonnegative(),
+  uploadedByName: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var ListPentestIntakeDocumentsResponseSchema = external_exports.object({
+  /** Mirrors the questionnaire's `editable`: uploads and removals are refused once false. */
+  editable: external_exports.boolean(),
+  documents: external_exports.array(PentestIntakeDocumentResponseSchema)
+});
+var CreatePentestIntakeDocumentUploadRequestSchema = external_exports.object({
+  fileName: external_exports.string().min(1).max(255),
+  fileSizeBytes: external_exports.number().int().positive().max(MAX_PENTEST_INTAKE_DOCUMENT_BYTES)
+}).strict();
+var CreatePentestIntakeDocumentUploadResponseSchema = external_exports.object({
+  /** Server-minted S3 key; hand it back unchanged on attach. */
+  uploadKey: external_exports.string(),
+  uploadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
+var AttachPentestIntakeDocumentRequestSchema = external_exports.object({
+  uploadKey: external_exports.string().min(1).max(1024),
+  documentType: PentestIntakeDocumentTypeSchema,
+  fileName: external_exports.string().min(1).max(255),
+  fileType: external_exports.string().min(1).max(100)
+}).strict();
+var UpdatePentestIntakeDocumentRequestSchema = external_exports.object({
+  documentType: PentestIntakeDocumentTypeSchema
+}).strict();
+var DownloadPentestIntakeDocumentResponseSchema = external_exports.object({
+  document: PentestIntakeDocumentResponseSchema,
+  downloadUrl: external_exports.url()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-intake-document.ts
+var c38 = initContract();
+var pentestIntakeDocumentContract = c38.router({
+  listDocuments: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
+    pathParams: CustomerPentestIdParamsSchema,
+    responses: {
+      200: ListPentestIntakeDocumentsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createUpload: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/uploads",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: CreatePentestIntakeDocumentUploadRequestSchema,
+    responses: {
+      201: CreatePentestIntakeDocumentUploadResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  attachDocument: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
+    pathParams: CustomerPentestIdParamsSchema,
+    body: AttachPentestIntakeDocumentRequestSchema,
+    responses: {
+      201: PentestIntakeDocumentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateDocument: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    body: UpdatePentestIntakeDocumentRequestSchema,
+    responses: {
+      200: PentestIntakeDocumentResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  downloadDocument: {
+    method: "GET",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId/download",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    responses: {
+      200: DownloadPentestIntakeDocumentResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deleteDocument: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents/:documentId",
+    pathParams: PentestIntakeDocumentIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c37 = initContract();
-var pentestManualFindingContract = c37.router({
+var c39 = initContract();
+var pentestManualFindingContract = c39.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -34750,8 +35300,8 @@ var pentestManualFindingContract = c37.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c38 = initContract();
-var pentestReportPdfContract = c38.router({
+var c40 = initContract();
+var pentestReportPdfContract = c40.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -34844,7 +35394,7 @@ var pentestReportPdfContract = c38.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c38.noBody(),
+    body: c40.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -34969,7 +35519,8 @@ var pentestReportPdfContract = c38.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // REPORT_NOT_RENDERED — no PDF exists yet (spec-pr-rs1 §2c) — or
-      // BUNDLE_NOT_RENDERED for artifact=markdown with no bundle object.
+      // BUNDLE_NOT_RENDERED / DOCX_NOT_RENDERED for artifact=markdown / docx
+      // with no such object beside the current PDF.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -35026,20 +35577,23 @@ var pentestReportPdfContract = c38.router({
     method: "GET",
     path: "/organizations/:organizationId/customer-pentests/:pentestId/report-pdf/download",
     pathParams: CustomerReportPdfPentestParamsSchema,
-    query: PentestPdfDownloadQuerySchema,
+    query: CustomerReportPdfDownloadQuerySchema,
     responses: {
       200: CustomerReportPdfDownloadResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
+      // DOCX_NOT_RENDERED for artifact=docx when no Word document from the
+      // served render exists.
+      409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   }
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c39 = initContract();
-var pentestValidationContract = c39.router({
+var c41 = initContract();
+var pentestValidationContract = c41.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -35147,8 +35701,8 @@ var pentestValidationContract = c39.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c40 = initContract();
-var repositoryContract = c40.router({
+var c42 = initContract();
+var repositoryContract = c42.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -35334,7 +35888,7 @@ var repositoryContract = c40.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c40.noBody(),
+    body: c42.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -35468,8 +36022,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c41 = initContract();
-var scanContract = c41.router({
+var c43 = initContract();
+var scanContract = c43.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -35590,8 +36144,8 @@ var StaffPentestStatsResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentest-stats.ts
-var c42 = initContract();
-var staffPentestStatsContract = c42.router({
+var c44 = initContract();
+var staffPentestStatsContract = c44.router({
   getStaffPentestStats: {
     method: "GET",
     path: "/staff/pentest-stats",
@@ -35605,6 +36159,59 @@ var staffPentestStatsContract = c42.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/staff-pentests.api.ts
+var StaffOrganizationPentestParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: external_exports.uuid()
+});
+var StaffOrganizationPentestSummarySchema = external_exports.object({
+  pentestId: external_exports.uuid(),
+  displayId: external_exports.int().positive(),
+  title: external_exports.string(),
+  status: PentestStatus,
+  currentStage: PentestStage,
+  testType: PentestTestType,
+  /** Bound application names, ordinal-ascending. Empty for an unbound draft. */
+  applicationNames: external_exports.array(external_exports.string()),
+  findingCount: external_exports.int().nonnegative(),
+  startedAt: external_exports.iso.datetime().nullable(),
+  endedAt: external_exports.iso.datetime().nullable(),
+  createdAt: external_exports.iso.datetime()
+}).strict();
+var ListStaffOrganizationPentestsResponseSchema = external_exports.array(
+  StaffOrganizationPentestSummarySchema
+);
+
+// ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
+var c45 = initContract();
+var staffPentestsContract = c45.router({
+  listStaffOrganizationPentests: {
+    method: "GET",
+    path: "/organizations/:organizationId/staff/pentests",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: ListStaffOrganizationPentestsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "List an organization\u2019s pentests (Trace staff only)"
+  },
+  deleteStaffOrganizationPentest: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Soft-delete a pentest from the admin console (Trace staff only)"
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/staff-queue.api.ts
 var StaffQueueItemKindValues = [
   "RETEST_OWED",
@@ -35712,8 +36319,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c43 = initContract();
-var staffQueueContract = c43.router({
+var c46 = initContract();
+var staffQueueContract = c46.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -35783,8 +36390,8 @@ var AttachTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c44 = initContract();
-var testIntegrationContract = c44.router({
+var c47 = initContract();
+var testIntegrationContract = c47.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -35916,8 +36523,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c45 = initContract();
-var userContract = c45.router({
+var c48 = initContract();
+var userContract = c48.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -36032,8 +36639,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c46 = initContract();
-var vantaIntegrationContract = c46.router({
+var c49 = initContract();
+var vantaIntegrationContract = c49.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -36165,6 +36772,13 @@ var VulnerabilityResponseSchema = external_exports.object({
   updatedAt: external_exports.coerce.date()
 });
 var ListVulnerabilitiesResponseSchema = external_exports.array(VulnerabilityResponseSchema);
+var VulnerabilityPdfExportResponseSchema = external_exports.object({
+  /** Download name the presigned URL carries, e.g. `TRACE-042-sql-injection.pdf`. */
+  fileName: external_exports.string(),
+  downloadUrl: external_exports.url(),
+  /** False when an identical export already existed and was reused without a render. */
+  rendered: external_exports.boolean()
+});
 var FilterValueSchema = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]);
 var FilterConditionSchema = external_exports.object({
   field: external_exports.enum(["repositoryId", "severity", "vulnerabilityType", "status", "cweId", "scanMode"]),
@@ -36365,8 +36979,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c47 = initContract();
-var vulnerabilityContract = c47.router({
+var c50 = initContract();
+var vulnerabilityContract = c50.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -36418,6 +37032,22 @@ var vulnerabilityContract = c47.router({
       500: ErrorResponseSchema
     }
   },
+  exportVulnerabilityPdf: {
+    method: "GET",
+    path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/pdf",
+    pathParams: VulnerabilityLookupIdParamsSchema,
+    summary: "Render one vulnerability as a Trace-branded PDF",
+    description: "Renders the vulnerability on demand, stores the PDF, and returns a short-lived presigned download URL. An identical export from the same day is reused without a render. The document names the finding and its code location only: no people and no organization name appear on it. Rendering shares one browser per API task, so exports are admission-controlled per organization; a 429 means retry after the interval in `details.retryAfterSeconds`.",
+    responses: {
+      200: VulnerabilityPdfExportResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   updateVulnerability: {
     method: "PATCH",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId",
@@ -36574,8 +37204,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c48 = initContract();
-var vulnerabilityNoteContract = c48.router({
+var c51 = initContract();
+var vulnerabilityNoteContract = c51.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -36756,8 +37386,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c49 = initContract();
-var webhookSettingsContract = c49.router({
+var c52 = initContract();
+var webhookSettingsContract = c52.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -36895,8 +37525,8 @@ var webhookSettingsContract = c49.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c50 = initContract();
-var v1Contract = c50.router(
+var c53 = initContract();
+var v1Contract = c53.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -36925,6 +37555,7 @@ var v1Contract = c50.router(
     agentTask: agentTaskContract,
     verifyApplicationSetup: verifyApplicationSetupContract,
     pentest: pentestContract,
+    pentestIntakeDocument: pentestIntakeDocumentContract,
     pentestAttestation: pentestAttestationContract,
     pentestManualFinding: pentestManualFindingContract,
     pentestAuditLog: pentestAuditLogContract,
@@ -36942,10 +37573,12 @@ var v1Contract = c50.router(
     inbox: inboxContract,
     apiKey: apiKeyContract,
     member: memberContract,
+    inviteLink: inviteLinkContract,
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
     pentestEgress: pentestEgressContract,
     staffPentestStats: staffPentestStatsContract,
+    staffPentests: staffPentestsContract,
     staffQueue: staffQueueContract
   },
   {
@@ -36954,8 +37587,8 @@ var v1Contract = c50.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c51 = initContract();
-var contract = c51.router({
+var c54 = initContract();
+var contract = c54.router({
   v1: v1Contract
 });
 
@@ -36965,8 +37598,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c52 = initContract();
-var githubWebhookContract = c52.router(
+var c55 = initContract();
+var githubWebhookContract = c55.router(
   {
     handleWebhook: {
       method: "POST",
@@ -36984,7 +37617,7 @@ var githubWebhookContract = c52.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c52.router(
+var githubReadonlyWebhookContract = c55.router(
   {
     handleWebhook: {
       method: "POST",
@@ -37004,9 +37637,9 @@ var githubReadonlyWebhookContract = c52.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c53 = initContract();
+var c56 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c53.router(
+var linearWebhookContract = c56.router(
   {
     handleWebhook: {
       method: "POST",
@@ -37026,7 +37659,7 @@ var linearWebhookContract = c53.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c54 = initContract();
+var c57 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -37055,7 +37688,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c54.router(
+var forgeBitbucketContract = c57.router(
   {
     lifecycle: {
       method: "POST",
@@ -37102,8 +37735,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c55 = initContract();
-var healthContract = c55.router({
+var c58 = initContract();
+var healthContract = c58.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -37115,8 +37748,8 @@ var healthContract = c55.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c56 = initContract();
-var vulnerabilityShareContract = c56.router(
+var c59 = initContract();
+var vulnerabilityShareContract = c59.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -37203,8 +37836,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c57 = initContract();
-var prVulnerabilityContract = c57.router(
+var c60 = initContract();
+var prVulnerabilityContract = c60.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -39913,12 +40546,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c59) => c59.type.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c62) => c62.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.name.padEnd(nameWidth)}  ${c59.type.padEnd(typeWidth)}  ${c59.repos.padStart(5)}  ${c59.url}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.name.padEnd(nameWidth)}  ${c62.type.padEnd(typeWidth)}  ${c62.repos.padStart(5)}  ${c62.url}`
   );
   return { header, rows };
 }
@@ -39938,12 +40571,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c59) => c59.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c59) => c59.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c59) => c59.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c62) => c62.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c62) => c62.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c62) => c62.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.scan.padEnd(4)}  ${c59.role.padEnd(roleWidth)}  ${c59.path.padEnd(pathWidth)}  ${c59.status}`
+    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.scan.padEnd(4)}  ${c62.role.padEnd(roleWidth)}  ${c62.path.padEnd(pathWidth)}  ${c62.status}`
   );
   return { header, rows };
 }
@@ -40728,8 +41361,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c59, i2, m2) => {
-    const d = n3 ? n3(c59, i2) : c59;
+`).map((c62, i2, m2) => {
+    const d = n3 ? n3(c62, i2) : c62;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -41227,14 +41860,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c59 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c62 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c59 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c59 ? 1 : 0);
+  d && g++, c62 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c62 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -41255,14 +41888,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c59 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c59 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c62 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c59 && x.push(M), x;
+  return c62 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -41281,15 +41914,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c59 = this.value ? a2 : s;
+`, c62 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c59)}`;
+          return `${o2}${r2}${styleText2("dim", c62)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c59)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c62)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -41437,13 +42070,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c59 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c62 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c59}
+${u4}  ${styleText2("yellow", this.error)}${c62}
 `;
       }
       case "submit": {
@@ -41471,7 +42104,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c59}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c59}
+${r2}${c62}
 `;
       }
     }
@@ -41486,7 +42119,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c59 = this.userInputWithCursor, i2 = this.masked;
+`, c62 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -41506,7 +42139,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c59}
+        return `${o2}${s}${c62}
 ${n3}
 `;
       }
@@ -41522,7 +42155,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c58 = (t2, o2) => t2.includes(`
+var c61 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -41533,15 +42166,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c58(s, (i2) => styleText2("dim", i2))}`;
+        return `${c61(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c58(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c61(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c58(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -42921,7 +43554,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c59) => !c59._hidden).map((c59) => extractCommandTree(c59));
+  const subcommands = cmd.commands.filter((c62) => !c62._hidden).map((c62) => extractCommandTree(c62));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -42987,7 +43620,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c59) => c59.name);
+  const subcommandNames = tree.subcommands.map((c62) => c62.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -43402,9 +44035,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c59) => c59.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c62) => c62.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c59) => `${c59.address.padEnd(addressWidth)}  ${c59.label}`);
+  const rows = cells.map((c62) => `${c62.address.padEnd(addressWidth)}  ${c62.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -43428,14 +44061,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c59) => c59.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c59) => c59.from.length));
-  const toWidth = Math.max(2, ...cells.map((c59) => c59.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c59) => c59.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c62) => c62.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c62) => c62.from.length));
+  const toWidth = Math.max(2, ...cells.map((c62) => c62.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c62) => c62.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.received.padEnd(receivedWidth)}  ${c59.from.padEnd(fromWidth)}  ${c59.to.padEnd(toWidth)}  ${c59.subject.padEnd(subjectWidth)}  ${c59.unread}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.received.padEnd(receivedWidth)}  ${c62.from.padEnd(fromWidth)}  ${c62.to.padEnd(toWidth)}  ${c62.subject.padEnd(subjectWidth)}  ${c62.unread}`
   );
   return { header, rows };
 }
@@ -43841,7 +44474,9 @@ var CREDENTIAL_TYPE_BY_INPUT = {
   "magic-auth": "MAGIC_AUTH",
   magic_auth: "MAGIC_AUTH",
   "session-state": "SESSION_STATE",
-  session_state: "SESSION_STATE"
+  session_state: "SESSION_STATE",
+  "ssh-private-key": "SSH_PRIVATE_KEY",
+  ssh_private_key: "SSH_PRIVATE_KEY"
 };
 function normalizeCredentialType(input) {
   return CREDENTIAL_TYPE_BY_INPUT[input.trim().toLowerCase()] ?? null;
@@ -43863,7 +44498,11 @@ var AUTH_FLAG_KEBAB = {
   passwordField: "password-field",
   sessionCookieName: "session-cookie-name",
   csrfTokenSelector: "csrf-token-selector",
-  csrfFieldName: "csrf-field-name"
+  csrfFieldName: "csrf-field-name",
+  sshHost: "ssh-host",
+  sshPort: "ssh-port",
+  sshUsername: "ssh-username",
+  sshHostKeyFingerprint: "ssh-host-key-fingerprint"
 };
 var ALL_AUTH_KEYS = Object.keys(AUTH_FLAG_KEBAB);
 var ALLOWED_AUTH_KEYS = {
@@ -43883,7 +44522,8 @@ var ALLOWED_AUTH_KEYS = {
   COOKIE: ["cookieName", "cookieDomain", "cookiePath"],
   MAGIC_AUTH: [],
   // SESSION_STATE takes no authConfig flags — origin is server-derived from the blob.
-  SESSION_STATE: []
+  SESSION_STATE: [],
+  SSH_PRIVATE_KEY: ["sshHost", "sshPort", "sshUsername", "sshHostKeyFingerprint"]
 };
 function rejectForeignAuthFlags(type, opts) {
   const allowed = new Set(ALLOWED_AUTH_KEYS[type]);
@@ -43927,6 +44567,13 @@ function authConfigToOptions(authConfig) {
       return {};
     case "SESSION_STATE":
       return {};
+    case "SSH_PRIVATE_KEY":
+      return {
+        sshHost: authConfig.host,
+        sshPort: String(authConfig.port),
+        sshUsername: authConfig.username,
+        ...authConfig.hostKeyFingerprint !== void 0 ? { sshHostKeyFingerprint: authConfig.hostKeyFingerprint } : {}
+      };
     case "USERNAME_PASSWORD":
       return {
         method: authConfig.method,
@@ -44020,6 +44667,34 @@ function buildUsernamePasswordAuthConfig(opts) {
     }
   };
 }
+function buildSshPrivateKeyAuthConfig(opts) {
+  const hasAny = opts.sshHost !== void 0 || opts.sshPort !== void 0 || opts.sshUsername !== void 0 || opts.sshHostKeyFingerprint !== void 0;
+  if (!hasAny) {
+    return { value: void 0 };
+  }
+  if (opts.sshHost === void 0 || opts.sshUsername === void 0) {
+    return { error: "--ssh-host and --ssh-username are required for ssh-private-key." };
+  }
+  let port = SSH_DEFAULT_PORT;
+  if (opts.sshPort !== void 0) {
+    if (!/^\d{1,5}$/.test(opts.sshPort.trim())) {
+      return { error: "--ssh-port must be a whole number from 1 to 65535." };
+    }
+    port = Number(opts.sshPort.trim());
+    if (port < 1 || port > 65535) {
+      return { error: "--ssh-port must be a whole number from 1 to 65535." };
+    }
+  }
+  return {
+    value: {
+      type: "SSH_PRIVATE_KEY",
+      host: opts.sshHost,
+      port,
+      username: opts.sshUsername,
+      ...opts.sshHostKeyFingerprint !== void 0 ? { hostKeyFingerprint: opts.sshHostKeyFingerprint } : {}
+    }
+  };
+}
 function buildAuthConfig(type, opts) {
   switch (type) {
     case "BEARER_TOKEN":
@@ -44034,6 +44709,8 @@ function buildAuthConfig(type, opts) {
       return buildMagicAuthAuthConfig(opts);
     case "USERNAME_PASSWORD":
       return buildUsernamePasswordAuthConfig(opts);
+    case "SSH_PRIVATE_KEY":
+      return buildSshPrivateKeyAuthConfig(opts);
     case "PASSPHRASE":
     case "SESSION_STATE":
       return { value: void 0 };
@@ -44042,6 +44719,9 @@ function buildAuthConfig(type, opts) {
 function anySecretFlag(opts) {
   return opts.secretStdin === true || opts.secretFile !== void 0 || opts.secretEnv !== void 0 || opts.usernameStdin === true || opts.usernameFile !== void 0 || opts.usernameEnv !== void 0 || opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
 }
+function anyPasswordFlag(opts) {
+  return opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
+}
 function secretOpts(opts) {
   return { stdin: opts.secretStdin, file: opts.secretFile, env: opts.secretEnv };
 }
@@ -44163,16 +44843,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c59) => ({
-    id: c59.credentialId,
-    label: sanitizeDisplay(c59.label),
-    type: c59.credentialType
+  const cells = creds.map((c62) => ({
+    id: c62.credentialId,
+    label: sanitizeDisplay(c62.label),
+    type: c62.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c59) => c59.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c59) => c59.label.length));
+  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c62) => c62.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c59) => `${c59.id.padEnd(idWidth)}  ${c59.label.padEnd(labelWidth)}  ${c59.type}`
+    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.label.padEnd(labelWidth)}  ${c62.type}`
   );
   return { header, rows };
 }
@@ -44203,6 +44883,14 @@ function failAuthBuild(result) {
   console.error(colorError(result.error));
   process.exit(1);
 }
+function requireSshAuthConfig(options) {
+  const ac = buildSshPrivateKeyAuthConfig(options);
+  if ("error" in ac) failAuthBuild(ac);
+  if (ac.value === void 0) {
+    failAuthBuild({ error: "--ssh-host and --ssh-username are required for ssh-private-key." });
+  }
+  return ac.value;
+}
 async function runCreate3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
@@ -44226,6 +44914,17 @@ async function runCreate3(options) {
     );
     process.exit(1);
   }
+  if (type === "SSH_PRIVATE_KEY") {
+    requireSshAuthConfig(options);
+    if (usesStdin(secretOpts(options)) && usesStdin(passwordOpts(options))) {
+      console.error(
+        colorError(
+          "Only one secret can come from stdin. Use --password-file/-env for the passphrase."
+        )
+      );
+      process.exit(1);
+    }
+  }
   const organizationId = await resolveOrganizationId();
   const params = { organizationId, environmentId: options.env };
   const label = options.label?.trim() ? options.label.trim() : void 0;
@@ -44298,6 +44997,18 @@ async function buildCreateBody(type, label, options) {
       );
       return { credentialType: "SESSION_STATE", ...labelFields, secretValue };
     }
+    case "SSH_PRIVATE_KEY": {
+      const authConfig = requireSshAuthConfig(options);
+      const privateKeyPem = await resolveSecret("private key PEM", "secret", secretOpts(options));
+      const passphrase = anyPasswordFlag(options) ? await resolveSecret("key passphrase", "password", passwordOpts(options)) : void 0;
+      return {
+        credentialType: "SSH_PRIVATE_KEY",
+        ...labelFields,
+        privateKeyPem,
+        ...passphrase !== void 0 ? { passphrase } : {},
+        authConfig
+      };
+    }
     case "COOKIE": {
       const ac = buildCookieAuthConfig(options);
       if ("error" in ac) failAuthBuild(ac);
@@ -44580,12 +45291,15 @@ function addSecretInputOptions(command) {
   return command.option("--secret-stdin", "Read the secret value from stdin").option("--secret-file <path>", "Read the secret value from a file").option("--secret-env <name>", "Read the secret value from an env var").option("--username-stdin", "Read the username from stdin").option("--username-file <path>", "Read the username from a file").option("--username-env <name>", "Read the username from an env var").option("--password-stdin", "Read the password from stdin").option("--password-file <path>", "Read the password from a file").option("--password-env <name>", "Read the password from an env var");
 }
 function addAuthConfigOptions(command) {
-  return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)");
+  return command.option("--header-name <name>", "authConfig: header name (bearer-token/jwt-token)").option("--token-prefix <prefix>", "authConfig: token prefix (bearer-token/jwt-token)").option("--placement <header|query>", "authConfig: API key placement (api-key)").option("--key-name <name>", "authConfig: API key name (api-key)").option("--cookie-name <name>", "authConfig: cookie name (cookie)").option("--cookie-domain <domain>", "authConfig: cookie domain (cookie)").option("--cookie-path <path>", "authConfig: cookie path (cookie)").option("--method <form|basic|json>", "authConfig: login method (username-password)").option("--login-url <url>", "authConfig: login URL (username-password)").option("--username-field <name>", "authConfig: username field (username-password)").option("--password-field <name>", "authConfig: password field (username-password)").option("--session-cookie-name <name>", "authConfig: session cookie (username-password)").option("--csrf-token-selector <sel>", "authConfig: CSRF token selector (username-password)").option("--csrf-field-name <name>", "authConfig: CSRF field name (username-password)").option("--ssh-host <host>", "authConfig: SSH host (ssh-private-key, required)").option("--ssh-port <port>", "authConfig: SSH port, 1-65535 (ssh-private-key, default 22)").option("--ssh-username <user>", "authConfig: SSH username (ssh-private-key, required)").option(
+    "--ssh-host-key-fingerprint <fp>",
+    "authConfig: expected host key, SHA256:<base64> (ssh-private-key)"
+  );
 }
 function createCreateCommand3() {
   const command = new Command("create").description("Create a credential in an environment").requiredOption("--env <environmentId>", "Parent environment UUID").requiredOption(
     "--type <type>",
-    "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth"
+    "bearer-token, jwt-token, api-key, passphrase, username-password, cookie, magic-auth, session-state, ssh-private-key"
   ).option(
     "--label <label>",
     "Human-readable label (optional; defaults from type / username + environment)"
@@ -44602,7 +45316,9 @@ Examples:
   tracecli credential create --env <envId> --type api-key --label "prod key" --secret-env API_KEY --placement header --key-name X-API-Key
   tracecli credential create --env <envId> --type username-password --username-env U --password-env P --method form --login-url https://acme.com/login
   ADDRESS=$(tracecli inbox create portal -o json | jq -r .address)
-  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin`
+  echo "$ADDRESS" | tracecli credential create --env <envId> --type magic-auth --secret-stdin
+  tracecli credential create --env <envId> --type ssh-private-key --secret-file ~/.ssh/bastion_ed25519 --ssh-host bastion.example.com --ssh-username deploy
+  tracecli credential create --env <envId> --type ssh-private-key --secret-file ./key.pem --password-env KEY_PASSPHRASE --ssh-host 10.0.0.5 --ssh-port 2222 --ssh-username ops`
   );
   return command.action(async (options) => {
     await runCreate3(options);
@@ -44900,14 +45616,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c59) => c59.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c62) => c62.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c59) => c59.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c62) => c62.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c59) => `${padLeading(c59.leading)}  ${c59.name.padEnd(nameWidth)}  ${c59.prod.padEnd(4)}  ${c59.url}`
+      (c62) => `${padLeading(c62.leading)}  ${c62.name.padEnd(nameWidth)}  ${c62.prod.padEnd(4)}  ${c62.url}`
     )
   };
 }
@@ -47877,13 +48593,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c59) => c59.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c59) => c59.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c59) => c59.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c62) => c62.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c62) => c62.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c62) => c62.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.kind.padEnd(kindWidth)}  ${c59.status.padEnd(statusWidth)}  ${c59.size.padEnd(sizeWidth)}  ${c59.id}`
+    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.kind.padEnd(kindWidth)}  ${c62.status.padEnd(statusWidth)}  ${c62.size.padEnd(sizeWidth)}  ${c62.id}`
   );
   return { header, rows };
 }