securewithtrace 0.43.0 → 0.45.0

package/dist/index.js

@@ -3683,6 +3683,22 @@ function linkRolesDisplay(roles, role, roleLabel) {
 // ../../packages/core/src/application/environment-urls.ts
 var ENVIRONMENT_ADDITIONAL_URLS_MAX = 20;
 
+// ../../packages/core/src/pentest/attack-chain-status.ts
+var ATTACK_CHAIN_STATUS_VALUES = ["OPEN", "REMEDIATED", "VERIFIED_FIXED"];
+var ATTACK_CHAIN_STEP_STATE_VALUES = ATTACK_CHAIN_STATUS_VALUES;
+
+// ../../packages/core/src/pentest/finding-status.ts
+var PENTEST_FINDING_STATUS_VALUES = [
+  "OPEN",
+  "IN_PROGRESS",
+  "CONTESTED",
+  "REMEDIATED",
+  "VERIFIED_FIXED",
+  "VERIFIED_OPEN",
+  "ACCEPTED_WITH_CONTROLS",
+  "DISMISSED"
+];
+
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -21884,16 +21900,7 @@ var PentestStatusValues = ["SCOPING", "IN_PROGRESS", "REMEDIATION", "CLOSED"];
 var PentestStatus = external_exports.enum(PentestStatusValues);
 var PentestTestTypeValues = ["BLACK_BOX", "GREY_BOX", "WHITE_BOX"];
 var PentestTestType = external_exports.enum(PentestTestTypeValues);
-var PentestFindingStatusValues = [
-  "OPEN",
-  "IN_PROGRESS",
-  "CONTESTED",
-  "REMEDIATED",
-  "VERIFIED_FIXED",
-  "VERIFIED_OPEN",
-  "ACCEPTED_WITH_CONTROLS",
-  "DISMISSED"
-];
+var PentestFindingStatusValues = PENTEST_FINDING_STATUS_VALUES;
 var PentestFindingStatus = external_exports.enum(PentestFindingStatusValues);
 var PentestFindingDismissReasonValues = [
   "FALSE_POSITIVE",
@@ -22633,7 +22640,11 @@ var agentSessionContract = c2.router({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/agent-task.api.ts
-var AGENT_TASK_TYPES = ["ENGAGEMENT_BRIEF", "VERIFY_APPLICATION_SETUP"];
+var AGENT_TASK_TYPES = [
+  "ENGAGEMENT_BRIEF",
+  "VERIFY_APPLICATION_SETUP",
+  "TRIAGE_DISTILL"
+];
 var AgentTaskTypeSchema = external_exports.enum(AGENT_TASK_TYPES);
 var TRIGGERABLE_AGENT_TASK_TYPES = ["ENGAGEMENT_BRIEF"];
 var TriggerableAgentTaskTypeSchema = external_exports.enum(TRIGGERABLE_AGENT_TASK_TYPES);
@@ -22694,6 +22705,7 @@ var AgentTaskResponseSchema = external_exports.object({
   status: AgentTaskStatusSchema,
   subjectPentestId: external_exports.uuid().nullable(),
   subjectApplicationId: external_exports.uuid().nullable(),
+  subjectVulnerabilityId: external_exports.uuid().nullable(),
   capabilities: external_exports.array(external_exports.string()),
   /**
    * Null until the worker claims the task and records what it actually ran —
@@ -22846,6 +22858,78 @@ var ListAgentTasksQuerySchema = external_exports.object({
 });
 var ListAgentTasksResponseSchema = external_exports.array(AgentTaskResponseSchema);
 
+// ../../packages/api-contracts/src/schemas/api/v1/inbox.api.ts
+var InboxLabelSchema = external_exports.string().regex(
+  /^[a-z][a-z0-9-]{0,39}$/,
+  "Inbox label must be lowercase letters/digits/dashes, starting with a letter, at most 40 characters"
+);
+var MAX_INBOX_LABEL_LENGTH = 40;
+var MAX_LOCAL_PART_LENGTH = 64;
+var MAX_INBOX_ADDRESS_PREFIX_LENGTH = MAX_LOCAL_PART_LENGTH - MAX_INBOX_LABEL_LENGTH - 1;
+var MANAGED_INBOX_DOMAINS = [
+  "pentest.securewithtrace.com",
+  "pentest.rmrflabs.com"
+];
+var ManagedInboxDomainSchema = external_exports.enum(MANAGED_INBOX_DOMAINS);
+var DEFAULT_MANAGED_INBOX_DOMAIN = MANAGED_INBOX_DOMAINS[0];
+var ManagedInboxResponseSchema = external_exports.object({
+  /** Full derived address, e.g. `acme-qa-admin@pentest.securewithtrace.com`. */
+  address: external_exports.email(),
+  label: external_exports.string(),
+  createdAt: external_exports.date()
+});
+var ListManagedInboxesResponseSchema = external_exports.object({
+  inboxes: external_exports.array(ManagedInboxResponseSchema),
+  quota: external_exports.object({
+    used: external_exports.number().int().nonnegative(),
+    limit: external_exports.number().int().positive()
+  })
+});
+var CreateManagedInboxRequestSchema = external_exports.object({
+  label: InboxLabelSchema
+}).strict();
+var ManagedInboxLabelParamsSchema = OrgIdParamsSchema.extend({
+  label: external_exports.string().min(1).max(64)
+});
+var ManagedInboxMessageParamsSchema = ManagedInboxLabelParamsSchema.extend({
+  messageId: external_exports.string().min(1).max(500)
+});
+var ListInboxMessagesQuerySchema = external_exports.object({
+  /** Max messages, newest first. The provider may clamp further. */
+  limit: external_exports.coerce.number().int().positive().max(50).optional(),
+  /** Only messages received strictly after this instant. */
+  since: external_exports.coerce.date().optional()
+}).strict();
+var ManagedInboxMessageSummarySchema = external_exports.object({
+  messageId: external_exports.string().min(1).max(500),
+  from: external_exports.string().max(500),
+  /** Recipients as the provider returned them (display-name form allowed). */
+  to: external_exports.array(external_exports.string().max(500)),
+  subject: external_exports.string().max(1e3).nullable(),
+  preview: external_exports.string().max(2e3).nullable(),
+  receivedAt: external_exports.coerce.date(),
+  unread: external_exports.boolean()
+});
+var ListInboxMessagesResponseSchema = external_exports.object({
+  address: external_exports.email(),
+  label: external_exports.string(),
+  messages: external_exports.array(ManagedInboxMessageSummarySchema)
+});
+var GetInboxMessageResponseSchema = external_exports.object({
+  address: external_exports.email(),
+  label: external_exports.string(),
+  message: ManagedInboxMessageSummarySchema.extend({
+    body: external_exports.string(),
+    truncated: external_exports.boolean(),
+    /**
+     * http(s) links extracted from the message (hrefs first, then inline
+     * text URLs). Button-style mail often carries the magic link only in
+     * `href`, which a tag-stripped body can still miss if extraction fails.
+     */
+    links: external_exports.array(external_exports.string())
+  })
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-attack-chain.api.ts
 var PentestAttackChainParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -22876,6 +22960,23 @@ var UpdatePentestAttackChainRequestSchema = CreatePentestAttackChainRequestSchem
 var PublishPentestAttackChainRequestSchema = external_exports.object({
   expectedUpdatedAt: external_exports.coerce.date()
 });
+var PublishAllAttackChainsRequestSchema = external_exports.object({
+  attackChainIds: external_exports.array(external_exports.uuid()).max(1e3).optional()
+});
+var PublishedAttackChainSchema = external_exports.object({
+  attackChainId: external_exports.uuid(),
+  displayId: external_exports.int()
+});
+var SkippedAttackChainReason = external_exports.enum(["TOO_SHORT", "FINDING_UNPUBLISHED"]);
+var SkippedAttackChainSchema = external_exports.object({
+  attackChainId: external_exports.uuid(),
+  title: external_exports.string(),
+  reason: SkippedAttackChainReason
+});
+var PublishAllAttackChainsResponseSchema = external_exports.object({
+  published: external_exports.array(PublishedAttackChainSchema),
+  skipped: external_exports.array(SkippedAttackChainSchema)
+});
 var AttackChainStepFindingSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   displayId: external_exports.number().int().nullable(),
@@ -22884,12 +22985,15 @@ var AttackChainStepFindingSchema = external_exports.object({
   status: PentestFindingStatus,
   publishedAt: external_exports.coerce.date().nullable()
 });
+var AttackChainStatus = external_exports.enum(ATTACK_CHAIN_STATUS_VALUES);
+var AttackChainStepState = external_exports.enum(ATTACK_CHAIN_STEP_STATE_VALUES);
 var AttackChainStepSchema = external_exports.object({
   stepId: external_exports.uuid(),
   stepOrder: external_exports.number().int(),
   title: external_exports.string(),
   narrative: external_exports.string(),
-  findings: external_exports.array(AttackChainStepFindingSchema)
+  findings: external_exports.array(AttackChainStepFindingSchema),
+  remediationState: AttackChainStepState
 });
 var PentestAttackChainSchema = external_exports.object({
   attackChainId: external_exports.uuid(),
@@ -22900,6 +23004,7 @@ var PentestAttackChainSchema = external_exports.object({
   severity: PentestFindingSeverity,
   cvssVector: external_exports.string().nullable(),
   cvssScore: external_exports.number().nullable(),
+  status: AttackChainStatus,
   publishedAt: external_exports.coerce.date().nullable(),
   createdAt: external_exports.coerce.date(),
   updatedAt: external_exports.coerce.date(),
@@ -23078,10 +23183,22 @@ var RepositoryResponseSchema = external_exports.object({
   primaryLanguage: external_exports.string().nullable().optional(),
   /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
   prScansEnabled: external_exports.boolean(),
+  /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
+  includedInScanning: external_exports.boolean(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
 var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var SetScanningInclusionRequestSchema = external_exports.object({
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(500),
+  includedInScanning: external_exports.boolean()
+});
+var SetScanningInclusionResponseSchema = external_exports.object({
+  /** Rows whose flag now matches the request (already-matching rows count). */
+  updatedCount: external_exports.number().int().min(0),
+  /** IDs from the request that are not repositories of this organization. */
+  notFoundRepositoryIds: external_exports.array(external_exports.uuid())
+});
 var SetPrScansEnabledRequestSchema = external_exports.object({
   enabled: external_exports.boolean()
 });
@@ -23449,6 +23566,14 @@ var FindingRewriteJsonSchema = external_exports.object({
    * falls back to live `f.status` in either case.
    */
   statusAtRewrite: PentestFindingStatus.nullish(),
+  /**
+   * Plain-language lead, two or three sentences, rendered before Description.
+   * The cap is a paragraph, not a section: a summary that needs more room is a
+   * description. `.default(null)` keeps rewrites persisted before the field
+   * shipped parseable (the JSON has no key) while the output type stays
+   * `string | null`, so every reader handles "no summary" the same way.
+   */
+  summary: external_exports.string().min(1).max(1e3).nullable().default(null),
   description: external_exports.string().min(1).max(12e3),
   rootCauseAnalysis: external_exports.string().min(1).max(12e3).nullable(),
   impact: external_exports.string().min(1).max(8e3),
@@ -23480,6 +23605,7 @@ var FindingRewritesJsonSchema = external_exports.object({
   path: ["rewrites"]
 });
 var FindingRewriteCorrectionFieldValues = [
+  "summary",
   "description",
   "rootCauseAnalysis",
   "impact",
@@ -23557,6 +23683,7 @@ var ReportPdfResponseSchema = external_exports.object({
 var GetReportPdfResponseSchema = external_exports.object({
   report: ReportPdfResponseSchema.nullable()
 });
+var CvssVersionSchema = external_exports.enum(["3.1", "4.0"]);
 var ReportCanvasFindingSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   displayId: external_exports.int().min(1),
@@ -23710,6 +23837,12 @@ var ReportCanvasResponseSchema = external_exports.object({
    * project the default (true) — the value the first render will use. */
   includeRemediationTimeline: external_exports.boolean(),
   findings: external_exports.array(ReportCanvasFindingSchema),
+  /** The CVSS version this engagement scores with (its stored vectors, else the
+   * producer default). The editor renders this version's metric grid; the api
+   * rejects the other version on every write, so no finding can differ from it.
+   * Optional for the same reason as `boundApplications` above; consumers default
+   * it to the producer default, which is what an api that predates it scored with. */
+  cvssVersion: CvssVersionSchema.optional(),
   // Counts reuse the module-local Severity/Status counts + totalFindings trio.
   liveSeverityCounts: SeverityCountsSchema,
   liveStatusCounts: StatusCountsSchema,
@@ -23908,6 +24041,11 @@ var IssuedReportSnapshotSchema = external_exports.object({
      * parses those rows for the changelog diff — a required field would throw
      * there and break issuing a new version of any pre-feature report. */
     testType: PentestTestType.optional(),
+    /** The CVSS version the engagement was scored with at issuance: the archival
+     * record of which version the delivered PDF names when its rendered findings
+     * carry no vector to read it from. Optional because every pre-feature snapshot
+     * lacks it, and those were all issued under 3.1. */
+    cvssVersion: CvssVersionSchema.optional(),
     /** Types of the applications bound at issuance: the archival record of which
      * OWASP families the delivered PDF named. Optional for the same reason as
      * `testType` above: a pre-feature snapshot has no value, and
@@ -24198,6 +24336,9 @@ var PentestFindingRetestIdParamsSchema = PentestFindingIdParamsSchema.extend({
 var PentestFindingEvidenceIdParamsSchema = PentestFindingIdParamsSchema.extend({
   artifactId: external_exports.uuid()
 });
+var PentestFindingTimelineEntryParamsSchema = PentestFindingIdParamsSchema.extend({
+  entryId: external_exports.uuid()
+});
 var CustomerExploitArtifactResponseSchema = external_exports.object({
   artifactId: external_exports.uuid(),
   kind: PentestExploitArtifactKind,
@@ -24275,6 +24416,8 @@ var PentestFindingResponseSchema = external_exports.object({
    */
   displayId: external_exports.number().int().positive().nullable(),
   title: external_exports.string(),
+  /** Plain-language lead rendered before `description`; null on findings authored before it existed. */
+  summary: external_exports.string().nullable(),
   description: external_exports.string(),
   severity: PentestFindingSeverity,
   category: external_exports.string(),
@@ -24310,6 +24453,7 @@ var PentestFindingResponseSchema = external_exports.object({
   externalTicket: ExternalTicketSummarySchema.nullable().default(null)
 });
 var PentestFindingListItemSchema = PentestFindingResponseSchema.omit({
+  summary: true,
   description: true,
   proofOfConcept: true,
   remediation: true,
@@ -24432,14 +24576,29 @@ var ResolutionTimelineVia = external_exports.object({
   identifier: external_exports.string(),
   url: external_exports.url()
 }).nullable().default(null);
+var ResolutionTimelineEntrySource = external_exports.enum(["NOTE", "CONTEST_RESOLUTION", "RETEST"]);
+var ResolutionTimelineEditHandleSchema = external_exports.object({
+  source: ResolutionTimelineEntrySource,
+  id: external_exports.uuid()
+}).nullable().default(null);
 var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind", [
+  // The finding became customer-visible. Derived from `publishedAt`, not from
+  // an audit row, so every published finding carries exactly one regardless of
+  // which path (batch publish, attack chain, legacy backfill) stamped it.
+  external_exports.object({
+    kind: external_exports.literal("published"),
+    at: external_exports.coerce.date(),
+    actor: external_exports.literal("TRACE").default("TRACE"),
+    actorName: ResolutionTimelineActorName
+  }),
   external_exports.object({
     kind: external_exports.literal("remediation_reported"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
     actorName: ResolutionTimelineActorName,
     note: external_exports.string().nullable(),
-    via: ResolutionTimelineVia
+    via: ResolutionTimelineVia,
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   // Retests are run by Trace (staff or a Trace agent), so the actor is fixed;
   // the default keeps a web build ahead of the api parsing older payloads.
@@ -24449,14 +24608,16 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     actor: external_exports.literal("TRACE").default("TRACE"),
     actorName: ResolutionTimelineActorName,
     outcome: RetestOutcome,
-    note: external_exports.string().nullable()
+    note: external_exports.string().nullable(),
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   external_exports.object({
     kind: external_exports.literal("accepted_with_controls"),
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
     actorName: ResolutionTimelineActorName,
-    note: external_exports.string()
+    note: external_exports.string(),
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   external_exports.object({
     kind: external_exports.literal("dismissed"),
@@ -24464,7 +24625,8 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     actor: ResolutionTimelineActor,
     actorName: ResolutionTimelineActorName,
     reason: PentestFindingDismissReason,
-    note: external_exports.string()
+    note: external_exports.string(),
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   // `note` nullable: webhook-driven reopens carry no customer note (the via
   // badge is the payload); human reopens always have one.
@@ -24475,7 +24637,8 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     actorName: ResolutionTimelineActorName,
     toStatus: external_exports.enum(["OPEN", "IN_PROGRESS"]),
     note: external_exports.string().nullable(),
-    via: ResolutionTimelineVia
+    via: ResolutionTimelineVia,
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   // Legacy/unattributed note whose transition isn't on the WORM audit log.
   external_exports.object({
@@ -24483,7 +24646,8 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     at: external_exports.coerce.date(),
     actor: ResolutionTimelineActor,
     actorName: ResolutionTimelineActorName,
-    note: external_exports.string()
+    note: external_exports.string(),
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   // Customer opened a dispute (PR 3). `note` = the customer's justification.
   external_exports.object({
@@ -24503,7 +24667,8 @@ var ResolutionTimelineEntrySchema = external_exports.discriminatedUnion("kind",
     actor: ResolutionTimelineActor,
     actorName: ResolutionTimelineActorName,
     resultStatus: PentestFindingStatus.nullable(),
-    note: external_exports.string()
+    note: external_exports.string(),
+    editHandle: ResolutionTimelineEditHandleSchema
   }),
   // An external ticket was created from this finding (PR 2). No `note` — the
   // identifier + url are the payload; actor is the customer who pushed it.
@@ -24650,7 +24815,24 @@ var RecoveredFindingResultSchema = external_exports.object({
 var RecoverStrandedFindingsResponseSchema = external_exports.object({
   results: external_exports.array(RecoveredFindingResultSchema)
 });
+var DraftMissingFindingSummariesRequestSchema = external_exports.object({
+  /** Limit the run to these findings; omit for every finding in the pentest missing a summary. */
+  pentestFindingIds: external_exports.array(external_exports.uuid()).max(500).optional()
+});
+var DraftedFindingSummaryResultSchema = external_exports.object({
+  pentestFindingId: external_exports.uuid(),
+  displayId: external_exports.int().positive().nullable(),
+  status: external_exports.enum(["written", "failed"]),
+  /** Failure shape only (no prose): what the drafter returned and what was expected. */
+  reason: external_exports.string().optional()
+});
+var DraftMissingFindingSummariesResponseSchema = external_exports.object({
+  /** Findings that already had a summary and were not touched. */
+  skipped: external_exports.int().min(0),
+  results: external_exports.array(DraftedFindingSummaryResultSchema)
+});
 var FindingProseSchema = FindingRewriteJsonSchema.pick({
+  summary: true,
   description: true,
   rootCauseAnalysis: true,
   impact: true,
@@ -24660,8 +24842,11 @@ var FindingProseSchema = FindingRewriteJsonSchema.pick({
   remediation: true,
   verification: true
 });
+var FindingProsePatchSchema = FindingProseSchema.partial().extend({
+  summary: FindingRewriteJsonSchema.shape.summary.unwrap().optional()
+});
 var ApplyFindingProseRequestSchema = external_exports.object({
-  prose: FindingProseSchema,
+  prose: FindingProsePatchSchema,
   /**
    * Optimistic precondition — the finding's `updatedAt` at edit-open. A mismatch
    * means a concurrent writer (staff / report agent / retest) moved the row →
@@ -24683,7 +24868,9 @@ var CreatePentestFindingRequestSchema = external_exports.object({
   category: external_exports.string().min(1).max(200),
   status: PentestFindingStatus.optional(),
   cweIds: external_exports.array(external_exports.string()).optional(),
+  /** `CVSS:3.1/…` or `CVSS:4.0/…`; scored server-side and checked against the engagement's version. */
   cvssVector: external_exports.string().max(200).optional(),
+  /** Accepted for compatibility and ignored: the score is always derived from `cvssVector`. */
   cvssScore: external_exports.number().min(0).max(10).optional(),
   owaspCategory: external_exports.string().max(200).optional(),
   proofOfConcept: external_exports.string().max(5e4).optional(),
@@ -24707,7 +24894,9 @@ var UpdatePentestFindingRequestSchema = external_exports.object({
   category: external_exports.string().min(1).max(200).optional(),
   status: PentestFindingStatus.optional(),
   cweIds: external_exports.array(external_exports.string()).optional(),
+  /** `CVSS:3.1/…` or `CVSS:4.0/…` (scored server-side, version-checked), or null to clear both columns. */
   cvssVector: external_exports.string().max(200).nullable().optional(),
+  /** Accepted for compatibility and ignored: the score is always derived from `cvssVector`. */
   cvssScore: external_exports.number().min(0).max(10).nullable().optional(),
   owaspCategory: external_exports.string().max(200).nullable().optional(),
   proofOfConcept: external_exports.string().max(5e4).nullable().optional(),
@@ -24756,6 +24945,11 @@ var ResolvePentestFindingContestRequestSchema = external_exports.object({
   dismissReason: PentestFindingDismissReason.optional(),
   note: external_exports.string().min(1).max(1e4)
 });
+var UpdateResolutionTimelineEntryRequestSchema = external_exports.object({
+  source: ResolutionTimelineEntrySource,
+  note: external_exports.string().trim().min(1).max(1e4)
+});
+var UpdateResolutionTimelineEntryResponseSchema = external_exports.array(ResolutionTimelineEntrySchema);
 var PENTEST_FINDING_FEEDBACK_COMMENT_MAX_LENGTH = 5e3;
 var CreatePentestFindingFeedbackRequestSchema = external_exports.object({
   rating: PentestFindingFeedbackRating.nullable().default(null),
@@ -25110,6 +25304,12 @@ var PentestResponseSchema = external_exports.object({
   perHypothesisBudgetCapUsd: external_exports.number(),
   startedAt: external_exports.coerce.date().nullable(),
   endedAt: external_exports.coerce.date().nullable(),
+  /**
+   * Set while staff have curtained the engagement from every customer
+   * principal; null = the customer can open it. `.optional()` for the same
+   * rolling-deploy reason as `applications` above.
+   */
+  hiddenFromCustomerAt: external_exports.coerce.date().nullable().optional(),
   createdById: external_exports.uuid(),
   createdByName: external_exports.string(),
   createdAt: external_exports.coerce.date(),
@@ -25531,8 +25731,40 @@ var SshPrivateKeySecretSchema = external_exports.object({
   privateKeyPem: SshPrivateKeyPemSchema,
   passphrase: external_exports.string().min(1).max(SSH_PASSPHRASE_MAX_CHARS).optional()
 }).strict();
+var PasskeySecretSchema = external_exports.object({
+  /** ECDSA P-256 private key, PKCS#8, base64. */
+  privateKey: external_exports.string().min(1).max(4096),
+  /** Opaque RP-assigned user id, base64 (≤64 bytes decoded). */
+  userHandle: external_exports.string().max(128),
+  userName: external_exports.string().max(320).optional(),
+  userDisplayName: external_exports.string().max(320).optional(),
+  /** largeBlob extension payload, base64. */
+  largeBlob: external_exports.string().max(8192).optional()
+}).strict();
+var CredentialPasskeySummarySchema = external_exports.object({
+  credentialPasskeyId: external_exports.uuid(),
+  /** Relying party id: the hostname the passkey answers for. */
+  rpId: external_exports.string().min(1).max(253),
+  /**
+   * The user name the site set at creation, read from the envelope. Null when the
+   * site set none, or when `unreadable` is true.
+   */
+  userName: external_exports.string().max(320).nullable(),
+  /**
+   * The envelope decrypted but did not parse as a passkey document: a permanent
+   * state, and the agent skips this row too. A decrypt failure (KMS, a bad auth tag)
+   * is not this flag; it fails the read, as every other envelope read does.
+   */
+  unreadable: external_exports.boolean(),
+  // Coerced, not `z.date()`: the web parses this out of the wire body with
+  // safeParse, where the value is a string.
+  createdAt: external_exports.coerce.date(),
+  /** Moves only when the signature counter moved, the one observable sign of a use. */
+  lastAssertedAt: external_exports.coerce.date().nullable()
+}).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
+var MFA_CAPABLE_CREDENTIAL_TYPES = ["USERNAME_PASSWORD", "MAGIC_AUTH"];
 var TotpSetupKeySchema = external_exports.string().min(1).max(TOTP_MAX_SECRET_CHARS * 4).superRefine((value, ctx) => {
   const message = totpSetupKeyError(value);
   if (message !== null) ctx.addIssue({ code: "custom", message });
@@ -25999,6 +26231,9 @@ var ValidationResultProseSchema = external_exports.object({
   // Optional/nullable on the wire for rolling-deploy safety (a pre-title host omits
   // it); the api falls back to the candidate hypothesis title. The host tool requires it.
   title: external_exports.string().min(1).max(300).nullable().optional(),
+  // Same rolling-deploy shape as `title`: the host tool requires it, the wire
+  // accepts its absence so a pre-summary host image still lands its verdict.
+  summary: external_exports.string().min(1).max(1e3).nullable().optional(),
   description: external_exports.string().min(1).max(12e3),
   impact: external_exports.string().min(1).max(8e3),
   remediation: external_exports.string().min(1).max(12e3),
@@ -26080,12 +26315,14 @@ var RecordValidationResultRequestSchema = external_exports.object({
    */
   owaspCategory: external_exports.string().min(1).max(120).nullable().optional(),
   /**
-   * Agent-assigned CVSS v3.1 base vector for the demonstrated impact
-   * (PROVEN-only). The api derives and persists the canonical vector + base
-   * score AND the finding severity (from the score's band) server-side; an
-   * unparseable explicit vector is rejected (400). The score is NEVER
-   * client-supplied. Absent → both cvss columns null and severity falls back
-   * to the agent's `severity` field (informational findings carry no vector).
+   * Agent-assigned CVSS base vector (`CVSS:3.1/…` or `CVSS:4.0/…`) for the
+   * demonstrated impact (PROVEN-only). The api derives and persists the
+   * canonical vector + base score AND the finding severity (from the score's
+   * band) server-side; an unparseable explicit vector is rejected (400
+   * INVALID_CVSS_VECTOR), and so is a vector of the other version than the
+   * engagement's stored vectors (400 CVSS_VERSION_MISMATCH). The score is
+   * NEVER client-supplied. Absent → both cvss columns null and severity falls
+   * back to the agent's `severity` field (informational findings carry no vector).
    */
   cvssVector: external_exports.string().min(1).max(120).nullable().optional(),
   /**
@@ -26345,7 +26582,22 @@ var AgentSessionCreateTestEmailRequestSchema = external_exports.object({
    * `too_big` blob for a purpose it then rephrased to something shorter and
    * equivalent. Validate what the target requires, not what our storage prefers.
    */
-  purpose: external_exports.string().min(1).max(200)
+  purpose: external_exports.string().min(1).max(200),
+  /**
+   * Which Trace-managed mail domain to mint on. Omitted means the server's
+   * default (`pentest.securewithtrace.com` unless overridden per environment).
+   *
+   * An enum rather than free text: the address is registered on the customer's
+   * target as a login identity, so the set of domains mail can be minted on is
+   * a Trace decision, not an agent one. The alternates exist for a target that
+   * blocks or rate-limits one domain, or a check that needs two accounts whose
+   * email domains differ.
+   *
+   * Reuse of an unsaved address is per domain: asking for the alternate never
+   * hands back an address minted on the default, since the agent asked for a
+   * different domain precisely because that one did not do.
+   */
+  domain: ManagedInboxDomainSchema.optional()
 });
 var AgentSessionCreateTestEmailResponseSchema = external_exports.object({
   /**
@@ -26528,6 +26780,74 @@ var AgentSessionSessionStateResponseSchema = external_exports.object({
   /** The decrypted, parsed captured browser session. */
   state: StorageStateSchema
 });
+var AgentSessionGetSshPrivateKeyRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Which SSH_PRIVATE_KEY credential to fetch (from the non-secret env reference). */
+  credentialId: external_exports.uuid()
+});
+var AgentSessionSshPrivateKeyResponseSchema = external_exports.object({
+  credentialId: external_exports.uuid(),
+  /** `Credential.updatedAt` (ISO): logged so a run names the revision it loaded. */
+  revision: external_exports.iso.datetime(),
+  /**
+   * The decrypted key material. Returned VERBATIM as stored: the host seeds its
+   * redactor with these exact bytes, and `redactString` matches exact substrings,
+   * so normalizing line endings here would silently defeat redaction downstream.
+   */
+  secret: SshPrivateKeySecretSchema
+});
+var AgentSessionPasskeySchema = external_exports.object({
+  /** Relying party id (a hostname). */
+  rpId: external_exports.string().min(1).max(253),
+  /** WebAuthn credential id, base64 (≤1023 bytes decoded). */
+  webauthnCredentialId: external_exports.string().min(1).max(1400),
+  /** ECDSA P-256 private key, PKCS#8, base64. */
+  privateKey: external_exports.string().min(1).max(4096).optional(),
+  /** Opaque RP-assigned user id, base64. */
+  userHandle: external_exports.string().max(128).optional(),
+  userName: external_exports.string().max(320).optional(),
+  userDisplayName: external_exports.string().max(320).optional(),
+  largeBlob: external_exports.string().max(8192).optional(),
+  /** Signature counter as the authenticator reports it. Never -1 on this wire. */
+  signCount: external_exports.number().int().min(0),
+  backupEligibility: external_exports.boolean(),
+  backupState: external_exports.boolean()
+});
+var AgentSessionListPasskeysRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Which account (by `Credential.label`). Required: the host persists under it. */
+  credentialLabel: external_exports.string().min(1).max(200)
+});
+var AgentSessionStoredPasskeySchema = AgentSessionPasskeySchema.extend({
+  credentialPasskeyId: external_exports.uuid(),
+  privateKey: external_exports.string().min(1).max(4096),
+  userHandle: external_exports.string().max(128)
+});
+var AgentSessionListPasskeysResponseSchema = external_exports.object({
+  credentialId: external_exports.uuid(),
+  credentialLabel: external_exports.string().max(200),
+  /** The account types a browser logs in as; the same set that can carry a second factor. */
+  credentialType: external_exports.enum(MFA_CAPABLE_CREDENTIAL_TYPES),
+  passkeys: external_exports.array(AgentSessionStoredPasskeySchema),
+  /**
+   * Stored rows whose envelope could not be read. Reported rather than swallowed so a
+   * partial list is never presented to the agent as the whole store, and rather than
+   * failing the call so the readable passkeys still load.
+   */
+  unreadable: external_exports.number().int().min(0)
+});
+var AgentSessionUpsertPasskeyRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** From the list response, never agent-supplied. */
+  credentialId: external_exports.uuid(),
+  passkey: AgentSessionPasskeySchema
+});
+var AgentSessionUpsertPasskeyResponseSchema = external_exports.object({
+  credentialPasskeyId: external_exports.uuid(),
+  created: external_exports.boolean(),
+  /** The stored counter after the write (never lower than before). */
+  signCount: external_exports.number().int().min(0)
+});
 var ParkAgentSessionRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   outcome: external_exports.enum(["IDLE", "WAITING_ON_STAFF", "FAILED"]),
@@ -27239,9 +27559,8 @@ var agentSessionInternalContract = c4.router({
       // Session type receives no account credentials, or its pinned toolset does
       // not carry these tools.
       403: ErrorResponseSchema,
-      // RUN_REVOKED only. Provider-side label collisions are resolved by
-      // re-suffixing rather than surfaced, and quota is a 422 — a bare 409 here
-      // would read as run revocation and kill the session.
+      // RUN_REVOKED or INBOX_ALREADY_EXISTS. The host treats only RUN_REVOKED
+      // as fatal; a concurrent label claim is a recoverable conflict.
       409: ErrorResponseSchema,
       // The org is at its managed-inbox quota (INBOX_QUOTA_EXCEEDED) — the agent
       // has no delete tool, so it must escalate rather than retry. Also
@@ -27344,8 +27663,78 @@ var agentSessionInternalContract = c4.router({
       401: ErrorResponseSchema,
       409: ErrorResponseSchema,
       // Credential not found, not SESSION_STATE, or outside the run's
-      // org/pentest/environments — no cross-tenant existence leak.
+      // org/pentest/environments: no cross-tenant existence leak.
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // get_ssh_private_key: the SESSION_STATE counterpart for SSH_PRIVATE_KEY. Same
+  // scoping (org + pentest environments from the run token), same 404 for anything
+  // outside it. The host calls this once per reference at boot and pipes the result
+  // into ssh-add; nothing downstream can read the key back.
+  getSshPrivateKey: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/ssh-private-key",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetSshPrivateKeyRequestSchema,
+    responses: {
+      200: AgentSessionSshPrivateKeyResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // Credential not found, not SSH_PRIVATE_KEY, or outside the run's
+      // org/pentest/environments: no cross-tenant existence leak.
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // provision_passkey, read half: every passkey Trace holds for one of the run's
+  // accounts, decrypted, so the host can load them into the virtual authenticator
+  // it arms on the agent's browser. Same resolution and ownership gate as
+  // enroll-mfa (org + pentest from the run token; label must resolve to exactly
+  // one launch-visible credential). Returns 200 with an empty array for an
+  // account with no passkeys yet: that is how the host learns the credentialId
+  // it will persist a new one under.
+  listPasskeys: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/passkeys",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListPasskeysRequestSchema,
+    responses: {
+      200: AgentSessionListPasskeysResponseSchema,
+      // Label on more than one environment (terminal), or a Trace fixture label.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Session type receives no account credentials.
+      403: ErrorResponseSchema,
+      // No launch-visible credential with that label; same message for another
+      // tenant's.
       404: ErrorResponseSchema,
+      // RUN_REVOKED, including the liveness recheck inside the service.
+      409: ErrorResponseSchema,
+      // The credential's type is not an account a browser logs in as.
+      422: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // provision_passkey, write half: the host observed a passkey on the armed
+  // authenticator (new, or its counter moved) and persists it. Keyed by the
+  // credentialId the list call returned, never by label, and idempotent on
+  // (credentialId, rpId, webauthnCredentialId) because the host retries on 5xx.
+  upsertPasskey: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/passkeys/upsert",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionUpsertPasskeyRequestSchema,
+    responses: {
+      200: AgentSessionUpsertPasskeyResponseSchema,
+      // PASSKEY_SECRET_REQUIRED: no row for the natural key and no key in the body.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      // credentialId not on this run's pentest under this org.
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
@@ -27515,6 +27904,7 @@ var agentSessionInternalContract = c4.router({
     body: OperatorApplyFindingCvssRequestSchema,
     responses: {
       200: OperatorFindingReadSchema,
+      // INVALID_CVSS_VECTOR or CVSS_VERSION_MISMATCH (see the staff applyFindingCvss route).
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -29541,11 +29931,12 @@ var CodeSizeLanguageTallySchema = external_exports.object({
   files: external_exports.number().int().nonnegative(),
   code: external_exports.number().int().nonnegative()
 });
-var CodeSizePlatformValues = ["GITHUB", "BITBUCKET"];
+var CodeSizePlatformValues = ["GITHUB", "BITBUCKET", "UPLOAD"];
 var CodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
   platform: external_exports.enum(CodeSizePlatformValues),
+  displayName: external_exports.string(),
   /** Billable SLOC of the current resolved branch. null = not measured yet. */
   billableSloc: external_exports.number().int().nonnegative().nullable()
 });
@@ -29557,7 +29948,8 @@ var CodeSizeBucketsSchema = external_exports.object({
   vendored_generated: CodeSizeBucketTallySchema
 });
 var OrganizationCodeSizeResponseSchema = external_exports.object({
-  /** All CONNECTED GitHub/Bitbucket repos. Server-sorted: measured first by
+  /** All CONNECTED GitHub/Bitbucket repos plus READY source uploads.
+   *  Server-sorted: measured first by
    *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
    *  repositoryUrl asc — clients render as-is (spec-pr-2 §3.3). */
   repositories: external_exports.array(CodeSizeRepositorySchema),
@@ -29578,7 +29970,9 @@ var StaffCodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
   platform: external_exports.enum(CodeSizePlatformValues),
-  /** Resolved branch the measurement is keyed on (scanningBranch ?? default). */
+  displayName: external_exports.string(),
+  /** Resolved branch the measurement is keyed on (scanningBranch ?? default;
+   *  `snapshot` for uploads). */
   branch: external_exports.string(),
   /** null = no successful measurement for the current resolved branch. */
   billableSloc: external_exports.number().int().nonnegative().nullable(),
@@ -29596,7 +29990,8 @@ var StaffOrganizationCodeSizeResponseSchema = external_exports.object({
   totals: external_exports.object({
     billableSloc: external_exports.number().int().nonnegative(),
     rawLines: external_exports.number().int().nonnegative(),
-    /** Connected GitHub/Bitbucket repos — the re-measure `all` scope size. */
+    /** Connected GitHub/Bitbucket repos plus READY source uploads: the
+     *  re-measure `all` scope size. */
     repositoryCount: external_exports.number().int().nonnegative(),
     /** Repos with a measurement for their current resolved branch. */
     measuredCount: external_exports.number().int().nonnegative(),
@@ -29887,6 +30282,9 @@ var CredentialIdParamsSchema = OrgIdParamsSchema.extend({
   environmentId: external_exports.uuid(),
   credentialId: external_exports.uuid()
 });
+var CredentialPasskeyIdParamsSchema = CredentialIdParamsSchema.extend({
+  credentialPasskeyId: external_exports.uuid()
+});
 var EnvironmentCredentialsParamsSchema = OrgIdParamsSchema.extend({
   environmentId: external_exports.uuid()
 });
@@ -30045,7 +30443,12 @@ var CredentialResponseSchema = external_exports.object({
    * parameters only — the seed lives in its own KMS envelope on the row and
    * has no reveal endpoint at all (see the reveal union below).
    */
-  mfa: CredentialMfaSummarySchema.nullable()
+  mfa: CredentialMfaSummarySchema.nullable(),
+  /**
+   * Passkeys an agent created on this account, oldest first. Always present; empty
+   * for every credential type that cannot hold one. Summaries only.
+   */
+  passkeys: external_exports.array(CredentialPasskeySummarySchema)
 }).strict();
 var ListCredentialsResponseSchema = external_exports.array(CredentialResponseSchema);
 var UpdateCredentialRequestSchema = external_exports.object({
@@ -30268,6 +30671,27 @@ var credentialContract = c13.router({
       500: ErrorResponseSchema
     }
   },
+  // Remove ONE passkey Trace holds for the account. Not idempotent: the id names a
+  // row, and a second call 404s like deleteCredential. Allowed mid-engagement like
+  // clearCredentialMfa, and for the same reason: the customer decides what Trace
+  // holds on their account. A session already armed keeps the key in Chrome's
+  // memory until that browser closes, but cannot recreate the row (a counter tick
+  // carries no key, a rejected tick is never re-sent, and a fresh arm reads the
+  // store), so the removal sticks. Trace's copy only: the site keeps its own
+  // registration of the public key until the customer removes it there.
+  deleteCredentialPasskey: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/passkeys/:credentialPasskeyId",
+    pathParams: CredentialPasskeyIdParamsSchema,
+    responses: {
+      // The refreshed credential, so the dashboard's row state comes from the api.
+      200: CredentialResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   deleteCredential: {
     method: "DELETE",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId",
@@ -30704,7 +31128,13 @@ var VulnerabilityTypeValues = [
   "MISCONFIGURATION"
 ];
 var VulnerabilityType = external_exports.enum(VulnerabilityTypeValues);
-var DismissReasonValues = ["ACCEPTED_RISK", "FALSE_POSITIVE", "OTHER"];
+var DismissReasonValues = [
+  "ACCEPTED_RISK",
+  "FALSE_POSITIVE",
+  "OTHER",
+  "INTENDED_BEHAVIOR",
+  "DEFERRED"
+];
 var DismissReason = external_exports.enum(DismissReasonValues);
 
 // ../../packages/api-contracts/src/schemas/api/v1/engagement.api.ts
@@ -30752,6 +31182,11 @@ var EngagementCardsSchema = external_exports.object({
   statusChangesViaPrComment: external_exports.number().int(),
   botCommentsPosted: external_exports.number().int(),
   structuralReplies: external_exports.number().int(),
+  /**
+   * Always 0. Its only source is the `issue_comment` webhook, which GitHub
+   * does not deliver to any Trace app (GITHUB_APP_PERMISSIONS.md §Issue
+   * comment). Read a reply figure as `structuralReplies` alone.
+   */
   heuristicReplies: external_exports.number().int(),
   /** structuralReplies / max(1, botCommentsPosted), clamped to [0, 1]. */
   replyRate: external_exports.number().min(0).max(1)
@@ -31274,72 +31709,6 @@ var staffGithubContract = c18.router({
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/inbox.api.ts
-var InboxLabelSchema = external_exports.string().regex(
-  /^[a-z][a-z0-9-]{0,39}$/,
-  "Inbox label must be lowercase letters/digits/dashes, starting with a letter, at most 40 characters"
-);
-var MAX_INBOX_LABEL_LENGTH = 40;
-var MAX_LOCAL_PART_LENGTH = 64;
-var MAX_INBOX_ADDRESS_PREFIX_LENGTH = MAX_LOCAL_PART_LENGTH - MAX_INBOX_LABEL_LENGTH - 1;
-var ManagedInboxResponseSchema = external_exports.object({
-  /** Full derived address, e.g. `acme-qa-admin@pentest.securewithtrace.com`. */
-  address: external_exports.email(),
-  label: external_exports.string(),
-  createdAt: external_exports.date()
-});
-var ListManagedInboxesResponseSchema = external_exports.object({
-  inboxes: external_exports.array(ManagedInboxResponseSchema),
-  quota: external_exports.object({
-    used: external_exports.number().int().nonnegative(),
-    limit: external_exports.number().int().positive()
-  })
-});
-var CreateManagedInboxRequestSchema = external_exports.object({
-  label: InboxLabelSchema
-}).strict();
-var ManagedInboxLabelParamsSchema = OrgIdParamsSchema.extend({
-  label: external_exports.string().min(1).max(64)
-});
-var ManagedInboxMessageParamsSchema = ManagedInboxLabelParamsSchema.extend({
-  messageId: external_exports.string().min(1).max(500)
-});
-var ListInboxMessagesQuerySchema = external_exports.object({
-  /** Max messages, newest first. The provider may clamp further. */
-  limit: external_exports.coerce.number().int().positive().max(50).optional(),
-  /** Only messages received strictly after this instant. */
-  since: external_exports.coerce.date().optional()
-}).strict();
-var ManagedInboxMessageSummarySchema = external_exports.object({
-  messageId: external_exports.string().min(1).max(500),
-  from: external_exports.string().max(500),
-  /** Recipients as the provider returned them (display-name form allowed). */
-  to: external_exports.array(external_exports.string().max(500)),
-  subject: external_exports.string().max(1e3).nullable(),
-  preview: external_exports.string().max(2e3).nullable(),
-  receivedAt: external_exports.coerce.date(),
-  unread: external_exports.boolean()
-});
-var ListInboxMessagesResponseSchema = external_exports.object({
-  address: external_exports.email(),
-  label: external_exports.string(),
-  messages: external_exports.array(ManagedInboxMessageSummarySchema)
-});
-var GetInboxMessageResponseSchema = external_exports.object({
-  address: external_exports.email(),
-  label: external_exports.string(),
-  message: ManagedInboxMessageSummarySchema.extend({
-    body: external_exports.string(),
-    truncated: external_exports.boolean(),
-    /**
-     * http(s) links extracted from the message (hrefs first, then inline
-     * text URLs). Button-style mail often carries the magic link only in
-     * `href`, which a tag-stripped body can still miss if extraction fails.
-     */
-    links: external_exports.array(external_exports.string())
-  })
-});
-
 // ../../packages/api-contracts/src/contracts/v1/inbox.ts
 var c19 = initContract();
 var inboxContract = c19.router({
@@ -32517,9 +32886,35 @@ var PrScanAnalyticsMonthSchema = external_exports.object({
   /** Same metrics as the month, split by PR author. Sorted by findings, then PRs. */
   developers: external_exports.array(PrScanAnalyticsDeveloperSchema)
 });
+var PrScanAnalyticsClassCountSchema = external_exports.object({
+  label: external_exports.string(),
+  count: external_exports.number().int().nonnegative()
+});
+var PrScanAnalyticsTimeToFixSchema = external_exports.object({
+  severity: VulnerabilitySeverity,
+  fixedCount: external_exports.number().int().nonnegative(),
+  /** Median minutes from the finding's first detection to the fixing scan; null when nothing was fixed. */
+  medianMinutes: external_exports.number().nonnegative().nullable(),
+  fixedWithinDayCount: external_exports.number().int().nonnegative()
+});
+var PrScanAnalyticsSummarySchema = external_exports.object({
+  /** First completed PR scan on a tracked PR in the window; null when none. */
+  since: external_exports.iso.datetime().nullable(),
+  prCount: external_exports.number().int().nonnegative(),
+  findingsCount: external_exports.number().int().nonnegative(),
+  criticalHighCount: external_exports.number().int().nonnegative(),
+  criticalHighFixedBeforeMergeCount: external_exports.number().int().nonnegative(),
+  /** Critical/high fixed on a PR that is still open. */
+  criticalHighFixedAwaitingMergeCount: external_exports.number().int().nonnegative(),
+  /** Critical/high by weakness class, largest first, at most five rows with "Other" last. */
+  criticalHighByClass: external_exports.array(PrScanAnalyticsClassCountSchema),
+  /** One row per severity, CRITICAL first. */
+  timeToFix: external_exports.array(PrScanAnalyticsTimeToFixSchema).length(VulnerabilitySeverityValues.length)
+});
 var PrScanAnalyticsResponseSchema = external_exports.object({
   generatedAt: external_exports.iso.datetime(),
-  months: external_exports.array(PrScanAnalyticsMonthSchema).length(12)
+  months: external_exports.array(PrScanAnalyticsMonthSchema).length(12),
+  summary: PrScanAnalyticsSummarySchema
 });
 var ProductPlanParamsSchema = external_exports.object({
   organizationId: external_exports.uuid(),
@@ -33793,6 +34188,26 @@ var pentestAttackChainContract = c29.router({
       500: ErrorResponseSchema
     }
   },
+  /**
+   * The "Publish all" control. Mirrors `pentestFindingContract.publishAllFindings`
+   * (`/findings/publications`): a collection resource of publications rather than a verb
+   * on the chain list.
+   */
+  publishAllAttackChains: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/publications",
+    pathParams: PentestAttackChainParamsSchema,
+    body: PublishAllAttackChainsRequestSchema,
+    responses: {
+      200: PublishAllAttackChainsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   unpublishAttackChain: {
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId/unpublish",
@@ -34449,6 +34864,7 @@ var pentestFindingContract = c36.router({
     body: CreatePentestFindingRequestSchema,
     responses: {
       201: PentestFindingResponseSchema,
+      // INVALID_CVSS_VECTOR / CVSS_VERSION_MISMATCH when a cvssVector is sent, or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -34624,6 +35040,7 @@ var pentestFindingContract = c36.router({
     body: UpdatePentestFindingRequestSchema,
     responses: {
       200: PentestFindingResponseSchema,
+      // INVALID_CVSS_VECTOR / CVSS_VERSION_MISMATCH when a cvssVector is sent, or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -34647,6 +35064,22 @@ var pentestFindingContract = c36.router({
       500: ErrorResponseSchema
     }
   },
+  draftMissingFindingSummaries: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/summaries/draft",
+    pathParams: PentestFindingParamsSchema,
+    body: DraftMissingFindingSummariesRequestSchema,
+    responses: {
+      200: DraftMissingFindingSummariesResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // PENTEST_CLOSED (reopen first).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   applyFindingCvss: {
     method: "PUT",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/cvss",
@@ -34654,7 +35087,8 @@ var pentestFindingContract = c36.router({
     body: ApplyFindingCvssRequestSchema,
     responses: {
       200: PentestFindingResponseSchema,
-      // INVALID_CVSS_VECTOR (unparseable vector) or schema validation.
+      // INVALID_CVSS_VECTOR (unparseable vector), CVSS_VERSION_MISMATCH (the
+      // engagement's stored vectors carry the other CVSS version), or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -34924,6 +35358,26 @@ var pentestFindingContract = c36.router({
   },
   // Note CRUD removed in PR 2 — the resolution timeline replaces the read
   // surface; resolution workflows + the operator agent write notes directly.
+  // ─── Resolution timeline ───
+  // Staff-only: rewrite the customer-visible note behind one history entry.
+  // `entryId` + `body.source` come from the entry's `editHandle` on the staff GET.
+  updateTimelineEntry: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/timeline-entries/:entryId",
+    pathParams: PentestFindingTimelineEntryParamsSchema,
+    body: UpdateResolutionTimelineEntryRequestSchema,
+    responses: {
+      200: UpdateResolutionTimelineEntryResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Non-staff caller, or the entry is customer-authored.
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // PENTEST_CLOSED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── AI parsing ───
   parseFindingMarkdown: {
     method: "POST",
@@ -35852,6 +36306,25 @@ var repositoryContract = c42.router({
       500: ErrorResponseSchema
     }
   },
+  /**
+   * Include or exclude repositories from scanning. Excluded repos stop
+   * receiving scans of every trigger type until included again; the flag is
+   * customer-owned and survives provider re-syncs.
+   */
+  setScanningInclusion: {
+    method: "PUT",
+    path: "/organizations/:organizationId/repositories/scanning-inclusion",
+    pathParams: OrgIdParamsSchema,
+    body: SetScanningInclusionRequestSchema,
+    responses: {
+      200: SetScanningInclusionResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getScanningBranchPreference: {
     method: "GET",
     path: "/organizations/:organizationId/repositories/scanning-branch/preference",
@@ -36175,11 +36648,17 @@ var StaffOrganizationPentestSummarySchema = external_exports.object({
   findingCount: external_exports.int().nonnegative(),
   startedAt: external_exports.iso.datetime().nullable(),
   endedAt: external_exports.iso.datetime().nullable(),
-  createdAt: external_exports.iso.datetime()
+  createdAt: external_exports.iso.datetime(),
+  /** Set while the engagement is curtained from every customer principal; null = visible. */
+  hiddenFromCustomerAt: external_exports.iso.datetime().nullable()
 }).strict();
 var ListStaffOrganizationPentestsResponseSchema = external_exports.array(
   StaffOrganizationPentestSummarySchema
 );
+var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_exports.object({
+  /** false hides the engagement from the customer entirely; true shows it again. */
+  visible: external_exports.boolean()
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
 var c45 = initContract();
@@ -36209,6 +36688,21 @@ var staffPentestsContract = c45.router({
       500: ErrorResponseSchema
     },
     summary: "Soft-delete a pentest from the admin console (Trace staff only)"
+  },
+  setStaffOrganizationPentestCustomerVisibility: {
+    method: "POST",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId/customer-visibility",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: SetStaffOrganizationPentestCustomerVisibilityRequestSchema,
+    responses: {
+      200: StaffOrganizationPentestSummarySchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Hide a pentest from the customer or show it again (Trace staff only)"
   }
 });
 
@@ -36733,7 +37227,10 @@ var VulnerabilityLatestFindingSchema = external_exports.object({
   classification: external_exports.enum(["vulnerability", "defense_in_depth", "context_dependent"]).nullable(),
   prerequisiteAccess: external_exports.string().nullable(),
   capabilityGain: external_exports.string().nullable(),
-  technicalSeverity: VulnerabilitySeverity.nullable()
+  technicalSeverity: VulnerabilitySeverity.nullable(),
+  // Whether the scan found an entry point that reaches the code; null when
+  // no scan assessed it (reads as reachable).
+  reachability: external_exports.enum(["reachable", "unreachable"]).nullable()
 });
 var DependencyGraphSchema = external_exports.object({
   vulnerablePackage: external_exports.string(),
@@ -37105,6 +37602,7 @@ var vulnerabilityContract = c50.router({
       402: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
@@ -37888,7 +38386,7 @@ async function requestDeviceAuthorization(clientId) {
   }
   return await response.json();
 }
-var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 async function pollForToken(clientId, deviceCode, options = {}) {
   const expiresIn = options.expiresIn ?? 300;
   let interval = options.interval ?? 5;
@@ -38573,18 +39071,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open3, close, parent) => {
+var createStyler = (open4, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open3;
+    openAll = open4;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open3;
+    openAll = parent.openAll + open4;
     closeAll = close + parent.closeAll;
   }
   return {
-    open: open3,
+    open: open4,
     close,
     openAll,
     closeAll,
@@ -39167,6 +39665,9 @@ function formatStatus(status) {
 function tsvSafe(value) {
   return (value ?? "").replace(/[\t\r\n]/g, " ");
 }
+function formulaSafe(value) {
+  return /^[=+\-@]/.test(value) ? `'${value}` : value;
+}
 
 // src/pager.ts
 function isInteractiveEnvironment() {
@@ -39281,6 +39782,21 @@ function extractRepoName(input) {
   }
   return input;
 }
+function normalizeRepoUrlForMatch(url2) {
+  let normalized = url2.trim().toLowerCase();
+  const scp = normalized.match(/^[a-z0-9._-]+@([^:/]+):(.+)$/);
+  if (scp) {
+    normalized = `${scp[1]}/${scp[2]}`;
+  } else {
+    normalized = normalized.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[a-z0-9._-]+@/, "");
+  }
+  let previous;
+  do {
+    previous = normalized;
+    normalized = normalized.replace(/\/+$/, "").replace(/\.git$/, "");
+  } while (normalized !== previous);
+  return normalized;
+}
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
 var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
 var DEFAULT_LIMIT = 30;
@@ -39288,6 +39804,8 @@ var DEFAULT_PAGE = 1;
 var MAX_LIMIT = 100;
 var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
 var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
+var SCANNING_INCLUSIONS = ["included", "excluded"];
+var SCANNING_INCLUSION_BATCH_SIZE = 500;
 function validateBranchName(branch) {
   if (branch.startsWith("-")) {
     throw new Error(`Invalid branch name: '${branch}' \u2014 branch names cannot start with a dash`);
@@ -39341,6 +39859,18 @@ function normalizeStatus(value, source) {
     `${source} must be one of: ${REPOSITORY_STATUSES.join(", ")}. Received '${value}'.`
   );
 }
+function normalizeScanningInclusion(value, source) {
+  const normalized = value.trim().toLowerCase();
+  if (SCANNING_INCLUSIONS.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${SCANNING_INCLUSIONS.join(", ")}. Received '${value}'.`
+  );
+}
+function scanningInclusionOf(repo) {
+  return repo.includedInScanning ? "included" : "excluded";
+}
 function normalizeFilterField(rawField) {
   const field = rawField.trim().toLowerCase();
   switch (field) {
@@ -39365,9 +39895,14 @@ function normalizeFilterField(rawField) {
     case "primarylanguage":
     case "primary_language":
       return "language";
+    case "scanning":
+    case "inclusion":
+    case "included_in_scanning":
+    case "includedinscanning":
+      return "scanning";
     default:
       throw new Error(
-        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language.`
+        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language, scanning.`
       );
   }
 }
@@ -39411,6 +39946,9 @@ function parseRepositoryFilterExpression(expression) {
   if (field === "status") {
     normalizeStatus(value, "--filter");
   }
+  if (field === "scanning") {
+    normalizeScanningInclusion(value, "--filter");
+  }
   return { field, operator, value };
 }
 function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly) {
@@ -39418,7 +39956,7 @@ function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly)
   const normalizedFilter = normalizeForMatching(filterValue);
   if (exactMatchOnly || operator === "exact" || operator === "not_exact") {
     const matches2 = normalizedCandidate === normalizedFilter;
-    return operator === "not_exact" ? !matches2 : matches2;
+    return operator === "not_exact" || operator === "not_contains" ? !matches2 : matches2;
   }
   const matches = normalizedCandidate.includes(normalizedFilter);
   return operator === "not_contains" ? !matches : matches;
@@ -39454,6 +39992,13 @@ function matchParsedFilter(repo, parsedFilter) {
       const language = repo.primaryLanguage ?? "";
       return doesValueMatchFilter(language, parsedFilter.value, parsedFilter.operator, false);
     }
+    case "scanning":
+      return doesValueMatchFilter(
+        scanningInclusionOf(repo),
+        parsedFilter.value,
+        parsedFilter.operator,
+        true
+      );
   }
 }
 function filterRepositories(repositories, options) {
@@ -39465,6 +40010,7 @@ function filterRepositories(repositories, options) {
   const normalizedQuery = options.query ? normalizeForMatching(options.query) : void 0;
   const normalizedDefaultBranch = options.githubDefaultBranch ? normalizeForMatching(options.githubDefaultBranch) : void 0;
   const normalizedLanguage = options.language ? normalizeForMatching(options.language) : void 0;
+  const normalizedScanning = options.scanning ? normalizeScanningInclusion(options.scanning, "--scanning") : void 0;
   return repositories.filter((repo) => {
     if (normalizedPlatform && repo.platform.toUpperCase() !== normalizedPlatform) {
       return false;
@@ -39472,6 +40018,9 @@ function filterRepositories(repositories, options) {
     if (normalizedStatus && repo.status.toUpperCase() !== normalizedStatus) {
       return false;
     }
+    if (normalizedScanning && scanningInclusionOf(repo) !== normalizedScanning) {
+      return false;
+    }
     if (normalizedDefaultBranch && !normalizeForMatching(repo.githubDefaultBranch).includes(normalizedDefaultBranch)) {
       return false;
     }
@@ -39544,7 +40093,9 @@ function paginateResults(items, options) {
   };
 }
 function printRepositoriesTsv(repositories) {
-  console.log("repositoryUrl	platform	status	githubDefaultBranch	scanningBranch	language");
+  console.log(
+    "repositoryUrl	platform	status	githubDefaultBranch	scanningBranch	language	scanning"
+  );
   for (const repo of repositories) {
     console.log(
       [
@@ -39553,18 +40104,20 @@ function printRepositoriesTsv(repositories) {
         tsvSafe(repo.status),
         tsvSafe(repo.githubDefaultBranch),
         tsvSafe(repo.scanningBranch ?? ""),
-        tsvSafe(repo.primaryLanguage)
+        tsvSafe(repo.primaryLanguage),
+        scanningInclusionOf(repo)
       ].join("	")
     );
   }
 }
 function buildRepositoriesTable(repositories) {
-  const headers = ["Repository URL", "Platform", "Status"];
+  const headers = ["Repository URL", "Platform", "Status", "Scanning"];
   const rows = repositories.map(
     (repo) => [
       stripAnsi(String(repo.repositoryUrl)),
       stripAnsi(String(repo.platform)).toUpperCase(),
-      repo.status === "CONNECTED" ? "connected" : "disconnected"
+      repo.status === "CONNECTED" ? "connected" : "disconnected",
+      scanningInclusionOf(repo)
     ]
   );
   const colWidths = headers.map(
@@ -39693,13 +40246,27 @@ async function maybeRefreshCloneTokenSessionForOrganization(organizationId, list
   }
   return refreshForOrganization(workosOrganizationId);
 }
+function resolveScanningFlag(options) {
+  if (options.included && options.excluded) {
+    throw new Error("Pass only one of --included / --excluded.");
+  }
+  if (options.included) {
+    return "included";
+  }
+  if (options.excluded) {
+    return "excluded";
+  }
+  return void 0;
+}
 function toRepositoryListFilterOptions(options) {
+  const scanning = resolveScanningFlag(options);
   return {
     ...options.platform ? { platform: options.platform } : {},
     ...options.status ? { status: options.status } : {},
     ...options.query ? { query: options.query } : {},
     ...options.defaultBranch ? { githubDefaultBranch: options.defaultBranch } : {},
     ...options.language ? { language: options.language } : {},
+    ...scanning ? { scanning } : {},
     ...options.filter.length > 0 ? { filters: options.filter } : {}
   };
 }
@@ -39712,9 +40279,9 @@ function addRepositoryFilterOptions(command) {
     "--status <status>",
     "Filter by status (CONNECTED, DISCONNECTED)",
     (value) => value.toUpperCase()
-  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option(
+  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option("--included", "Only repositories included in scanning").option("--excluded", "Only repositories excluded from scanning").option(
     "-f, --filter <expression>",
-    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED",
+    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, scanning=excluded",
     collectFilterExpression,
     []
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
@@ -39742,6 +40309,14 @@ async function runRepositoryListCommand(options) {
     }
     return;
   }
+  let filterOptions;
+  try {
+    filterOptions = toRepositoryListFilterOptions(options);
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
+    console.error(`Invalid repository filter: ${message}`);
+    process.exit(1);
+  }
   const organizationId = await resolveOrganizationId();
   if (options.dependency) {
     await runDependencyFilter(organizationId, {
@@ -39765,14 +40340,14 @@ async function runRepositoryListCommand(options) {
     process.exit(1);
   }
   try {
-    filteredRepositories = filterRepositories(result.body, toRepositoryListFilterOptions(options));
+    filteredRepositories = filterRepositories(result.body, filterOptions);
   } catch (error48) {
     const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
     console.error(`Invalid repository filter: ${message}`);
     process.exit(1);
   }
   if (filteredRepositories.length === 0) {
-    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.filter.length > 0) {
+    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.included || options.excluded || options.filter.length > 0) {
       console.log("No repositories found matching the provided filters.");
       return;
     }
@@ -39906,6 +40481,8 @@ Examples:
   tracecli repo list --output json | jq '.[].repositoryUrl'
   tracecli repo list --output tsv | cut -f1
   tracecli repo list --filter "language:typescript" --limit 10
+  tracecli repo list --excluded
+  tracecli repo list --query payments --included --output json
   tracecli repo list --dependency lodash@4.17.21
   tracecli repo list --web`
   ).action(async (options) => {
@@ -39923,6 +40500,7 @@ Examples:
   tracecli repo filter --page 2 --limit 30
   tracecli repo filter --all
   tracecli repo filter --language typescript --limit 10
+  tracecli repo filter --filter "scanning=excluded"
   tracecli repo filter --output json | jq '.[].repositoryUrl'
   tracecli repo filter --output tsv | cut -f1
   tracecli repo filter --web`
@@ -40285,12 +40863,158 @@ Examples:
     await runSetScanningBranchCommand(repositoryUrl, options);
   });
 }
+function resolveRepositoryReferences(repositories, references) {
+  const byId = /* @__PURE__ */ new Map();
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const repo of repositories) {
+    byId.set(repo.repositoryId.toLowerCase(), repo);
+    byUrl.set(normalizeRepoUrlForMatch(repo.repositoryUrl), repo);
+  }
+  const matched = /* @__PURE__ */ new Map();
+  const unresolved = [];
+  for (const reference of references) {
+    const trimmed = reference.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    const repo = byId.get(trimmed.toLowerCase()) ?? byUrl.get(normalizeRepoUrlForMatch(resolveRepoUrl(trimmed)));
+    if (!repo) {
+      unresolved.push(trimmed);
+      continue;
+    }
+    if (!matched.has(repo.repositoryId)) {
+      matched.set(repo.repositoryId, repo);
+    }
+  }
+  return { matched: [...matched.values()], unresolved };
+}
+function scanningInclusionVerb(includedInScanning) {
+  return includedInScanning ? { past: "Included", noun: "included in scanning" } : { past: "Excluded", noun: "excluded from scanning" };
+}
+async function runSetScanningInclusionCommand(references, includedInScanning, options) {
+  const organizationId = await resolveOrganizationId();
+  const listResult = await authenticatedRequest(
+    (client) => client.repository.listRepositories({ params: { organizationId } })
+  );
+  if (listResult.status === 401) {
+    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    process.exit(1);
+  }
+  if (listResult.status !== 200) {
+    console.error(`Failed to list repositories (status ${listResult.status}).`);
+    process.exit(1);
+  }
+  const { matched, unresolved } = resolveRepositoryReferences(listResult.body, references);
+  if (unresolved.length > 0) {
+    console.error(
+      colorError(
+        `${unresolved.length === 1 ? "Repository" : "Repositories"} not found in this organization: ${unresolved.join(", ")}`
+      )
+    );
+    console.error(
+      "Pass a repository ID, URL, or owner/repo shorthand. Run `tracecli repo list` to see connected repositories."
+    );
+    process.exit(1);
+  }
+  if (matched.length === 0) {
+    console.error(colorError("No repositories given."));
+    process.exit(1);
+  }
+  const outcomes = matched.map((repo) => ({
+    repositoryId: repo.repositoryId,
+    repositoryUrl: repo.repositoryUrl,
+    previouslyIncludedInScanning: repo.includedInScanning
+  }));
+  const ids = matched.map((repo) => repo.repositoryId);
+  let updatedCount = 0;
+  const notFoundRepositoryIds = [];
+  const verb = scanningInclusionVerb(includedInScanning);
+  for (let offset = 0; offset < ids.length; offset += SCANNING_INCLUSION_BATCH_SIZE) {
+    const result = await authenticatedRequest(
+      (client) => client.repository.setScanningInclusion({
+        params: { organizationId },
+        body: {
+          repositoryIds: ids.slice(offset, offset + SCANNING_INCLUSION_BATCH_SIZE),
+          includedInScanning
+        }
+      })
+    );
+    if (result.status === 200) {
+      updatedCount += result.body.updatedCount;
+      notFoundRepositoryIds.push(...result.body.notFoundRepositoryIds);
+      continue;
+    }
+    const committedSuffix = offset > 0 ? ` ${updatedCount} of ${ids.length} repositories were already updated.` : "";
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    } else if (result.status === 403) {
+      console.error(
+        colorError(
+          `You don't have permission to change repository scanning in this organization (analyst or admin role required).${committedSuffix}`
+        )
+      );
+    } else {
+      const message = extractErrorMessage(result.body);
+      console.error(
+        colorError(
+          `Failed to update repository scanning (status ${result.status})${message ? `: ${message}` : "."}${committedSuffix}`
+        )
+      );
+    }
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    console.log(
+      JSON.stringify(
+        { includedInScanning, updatedCount, notFoundRepositoryIds, repositories: outcomes },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const notFound = new Set(notFoundRepositoryIds);
+  for (const outcome of outcomes) {
+    if (notFound.has(outcome.repositoryId)) {
+      console.log(
+        `${colorWarningPrefix("Skipped")} ${outcome.repositoryUrl}: no longer connected to this organization`
+      );
+    } else if (outcome.previouslyIncludedInScanning === includedInScanning) {
+      console.log(`Already ${verb.noun}: ${outcome.repositoryUrl}`);
+    } else {
+      console.log(`${colorSuccess(verb.past)} ${outcome.repositoryUrl}`);
+    }
+  }
+  const changedCount = outcomes.filter(
+    (outcome) => !notFound.has(outcome.repositoryId) && outcome.previouslyIncludedInScanning !== includedInScanning
+  ).length;
+  console.log(
+    `${changedCount} of ${outcomes.length} ${outcomes.length === 1 ? "repository" : "repositories"} changed to ${verb.noun}.${includedInScanning ? "" : " Excluded repositories are skipped by every scan until you include them again."}`
+  );
+}
+function createScanningInclusionCommand(includedInScanning) {
+  const name = includedInScanning ? "include" : "exclude";
+  const description = includedInScanning ? "Include repositories in scanning" : "Exclude repositories from scanning (no scans of any kind run until included again)";
+  return new Command(name).description(description).argument("<repository...>", "Repository ID, URL, or owner/repo shorthand (repeatable)").option("-o, --output <format>", "Output format: table (default), json", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli repo ${name} acme/api
+  tracecli repo ${name} https://github.com/acme/api https://bitbucket.org/acme/worker
+  tracecli repo ${name} 3f1c6c2e-9b7a-4a6f-8f1d-2d4e5a6b7c8d --output json
+  tracecli repo list --query legacy --output json | jq -r '.[].repositoryUrl' | xargs tracecli repo ${name}`
+  ).action(async (repositories, options) => {
+    await runSetScanningInclusionCommand(repositories, includedInScanning, options);
+  });
+}
 function createRepoCommand() {
   const repo = new Command("repo").description("Manage repositories");
   repo.addCommand(createListCommand());
   repo.addCommand(createFilterCommand());
   repo.addCommand(createCloneCommand());
   repo.addCommand(createSetScanningBranchCommand());
+  repo.addCommand(createScanningInclusionCommand(true));
+  repo.addCommand(createScanningInclusionCommand(false));
   return repo;
 }
 
@@ -40399,21 +41123,6 @@ function validateCreateTypeUrl(type, url2) {
   }
   return null;
 }
-function normalizeRepoUrlForMatch(url2) {
-  let normalized = url2.trim().toLowerCase();
-  const scp = normalized.match(/^[a-z0-9._-]+@([^:/]+):(.+)$/);
-  if (scp) {
-    normalized = `${scp[1]}/${scp[2]}`;
-  } else {
-    normalized = normalized.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[a-z0-9._-]+@/, "");
-  }
-  let previous;
-  do {
-    previous = normalized;
-    normalized = normalized.replace(/\/+$/, "").replace(/\.git$/, "");
-  } while (normalized !== previous);
-  return normalized;
-}
 function buildCreateApplicationBody(input) {
   return {
     name: input.name,
@@ -43367,6 +44076,9 @@ function repoDisplayName(repositoryUrl) {
     return repositoryUrl;
   }
 }
+function repoLabel(repo) {
+  return sanitizeDisplay(repo.displayName ?? repoDisplayName(repo.repositoryUrl));
+}
 function countedRows(totals) {
   const b = totals.buckets;
   return [
@@ -43423,7 +44135,7 @@ function renderCodeSizeTable(codeSize, options) {
   lines.push(
     ...padValues(
       shown.map((repo) => ({
-        label: repoDisplayName(repo.repositoryUrl),
+        label: repoLabel(repo),
         value: repo.billableSloc ?? 0
       }))
     )
@@ -43438,7 +44150,8 @@ function renderCodeSizeTsv(codeSize) {
   return [
     "repository	billableSloc",
     ...codeSize.repositories.map(
-      (repo) => `${repoDisplayName(repo.repositoryUrl)}	${repo.billableSloc === null ? "" : repo.billableSloc}`
+      // Upload names are customer-authored, and TSV lands in spreadsheets.
+      (repo) => `${formulaSafe(repoLabel(repo))}	${repo.billableSloc === null ? "" : repo.billableSloc}`
     )
   ];
 }
@@ -45425,7 +46138,7 @@ function collectAdditionalUrl(value, previous) {
 function buildCreateEnvironmentBody(input) {
   return {
     name: input.name,
-    primaryUrl: input.primaryUrl,
+    ...input.primaryUrl !== void 0 ? { primaryUrl: input.primaryUrl } : {},
     ...input.additionalUrls !== void 0 && input.additionalUrls.length > 0 ? { additionalUrls: input.additionalUrls } : {},
     ...input.description !== void 0 ? { description: input.description } : {},
     ...input.isProduction !== void 0 ? { isProduction: input.isProduction } : {}
@@ -45909,13 +46622,20 @@ async function runDelete4(environmentId, options) {
   console.log(colorSuccess(`Deleted environment ${environmentId}`));
 }
 function createCreateCommand4() {
-  return new Command("create").description("Create an environment for an application").argument("<name>", "Environment name (lowercase letters/digits/dashes)").requiredOption("--app <applicationId>", "Parent application UUID").requiredOption("--url <url>", "Primary URL for the environment").option("--additional-url <url>", "Extra probe URL (repeatable)", collectAdditionalUrl).option("--description <text>", "Description").option("--production", "Mark as the production environment").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  return new Command("create").description("Create an environment for an application").argument("<name>", "Environment name (lowercase letters/digits/dashes)").requiredOption("--app <applicationId>", "Parent application UUID").option(
+    "--url <url>",
+    "Primary URL for the environment (web and API applications only; omit for CLI and desktop)"
+  ).option("--additional-url <url>", "Extra probe URL (repeatable)", collectAdditionalUrl).option("--description <text>", "Description").option("--production", "Mark as the production environment").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
+A web or API application requires --url. A CLI or desktop application is a
+credential context with no network target and must omit it.
+
 Examples:
   tracecli environment create staging --app <appId> --url https://staging.acme.com
   tracecli environment create production --app <appId> --url https://acme.com --production
-  tracecli environment create production --app <appId> --url https://app.acme.com --additional-url https://api.acme.com`
+  tracecli environment create production --app <appId> --url https://app.acme.com --additional-url https://api.acme.com
+  tracecli environment create pentest-sandbox --app <cliAppId>`
   ).action(async (name, options) => {
     await runCreate4(name, options);
   });
@@ -46304,14 +47024,839 @@ async function runCreateFinding(options) {
   });
 }
 function createCreateFindingCommand() {
-  return new Command("create").description("Create a pentest finding from a contractor write-up (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <text>", "Finding title").option("--description <text>", "Finding description").option("--description-file <path>", "Read description from a file").option("--severity <severity>", `Severity (${SEVERITY_LIST})`).option("--category <text>", "Finding category (e.g. Broken Access Control)").option("--cwe <id>", "CWE identifier (repeatable)", collectCwe).option("--cvss-vector <vector>", "CVSS v3 vector string").option("--cvss-score <n>", "CVSS base score (0\u201310)").option("--owasp <category>", "OWASP category").option("--poc <text>", "Proof of concept").option("--poc-file <path>", "Read proof of concept from a file").option("--remediation <text>", "Remediation guidance").option("--remediation-file <path>", "Read remediation from a file").option("--file <path>", "JSON object of finding fields; flags override").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+  return new Command("create").description("Create a pentest finding from a contractor write-up (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <text>", "Finding title").option("--description <text>", "Finding description").option("--description-file <path>", "Read description from a file").option("--severity <severity>", `Severity (${SEVERITY_LIST})`).option("--category <text>", "Finding category (e.g. Broken Access Control)").option("--cwe <id>", "CWE identifier (repeatable)", collectCwe).option(
+    "--cvss-vector <vector>",
+    "CVSS base vector (CVSS:3.1/... or CVSS:4.0/...); the score is derived server-side"
+  ).option("--cvss-score <n>", "Ignored: the score is derived from --cvss-vector").option("--owasp <category>", "OWASP category").option("--poc <text>", "Proof of concept").option("--poc-file <path>", "Read proof of concept from a file").option("--remediation <text>", "Remediation guidance").option("--remediation-file <path>", "Read remediation from a file").option("--file <path>", "JSON object of finding fields; flags override").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
     await runCreateFinding(options);
   });
 }
 
-// src/pentest/evidence.ts
-import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+// src/pentest/deliverables.ts
+import { open as open2, rename, rm, stat } from "fs/promises";
+import { basename as basename3, join as join6, resolve } from "path";
+
+// src/upload/prepare.ts
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync3 } from "fs";
+import { open } from "fs/promises";
 import { basename as basename2 } from "path";
+var CodeUploadPrepareError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadPrepareError";
+  }
+};
+var KIND_BY_INPUT = {
+  source: "SOURCE_ARCHIVE",
+  code: "SOURCE_ARCHIVE",
+  "source-archive": "SOURCE_ARCHIVE",
+  source_archive: "SOURCE_ARCHIVE",
+  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
+  apk: "ANDROID_APK",
+  android: "ANDROID_APK",
+  "android-apk": "ANDROID_APK",
+  android_apk: "ANDROID_APK",
+  ANDROID_APK: "ANDROID_APK",
+  ipa: "IOS_IPA",
+  ios: "IOS_IPA",
+  "ios-ipa": "IOS_IPA",
+  ios_ipa: "IOS_IPA",
+  IOS_IPA: "IOS_IPA"
+};
+function normalizeArtifactKind(input) {
+  const trimmed = input.trim();
+  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
+}
+function inferArtifactKindFromFilename(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
+  if (lower.endsWith(".apk")) return "ANDROID_APK";
+  if (lower.endsWith(".ipa")) return "IOS_IPA";
+  return null;
+}
+function requiredExtensionForKind(kind) {
+  if (kind === "ANDROID_APK") return ".apk";
+  if (kind === "IOS_IPA") return ".ipa";
+  return ".zip";
+}
+function defaultDisplayName(originalFilename) {
+  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base.slice(0, 200) || "source";
+}
+function formatArchiveBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) {
+    const kb = bytes / 1024;
+    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
+  }
+  if (bytes < 1024 * 1024 * 1024) {
+    const mb = bytes / (1024 * 1024);
+    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
+  }
+  const gb = bytes / (1024 * 1024 * 1024);
+  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
+}
+function archiveTooLargeMessage() {
+  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
+}
+async function hashFileSha256(filePath) {
+  const hash2 = createHash("sha256");
+  const stream = createReadStream(filePath);
+  for await (const chunk of stream) {
+    hash2.update(chunk);
+  }
+  return hash2.digest("hex");
+}
+async function readFileSlice(filePath, start, endExclusive) {
+  const length = endExclusive - start;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
+    throw new Error(
+      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
+    );
+  }
+  const buffer = Buffer.alloc(length);
+  const handle = await open(filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    if (bytesRead !== length) {
+      throw new Error(
+        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
+      );
+    }
+    return buffer;
+  } finally {
+    await handle.close();
+  }
+}
+function assertPreparedMatchesUpload(upload, prepared) {
+  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
+    throw new CodeUploadPrepareError(
+      "The file does not match the interrupted upload (size or SHA-256 differs)."
+    );
+  }
+}
+async function prepareUploadFile(filePath, options = {}) {
+  let sizeBytes;
+  try {
+    const stats = statSync3(filePath);
+    if (!stats.isFile()) {
+      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
+    }
+    sizeBytes = stats.size;
+  } catch (error48) {
+    if (error48 instanceof CodeUploadPrepareError) throw error48;
+    throw new CodeUploadPrepareError("Cannot read that file.");
+  }
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
+    throw new CodeUploadPrepareError("The file is empty.");
+  }
+  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
+    throw new CodeUploadPrepareError(archiveTooLargeMessage());
+  }
+  const originalFilename = basename2(filePath);
+  const inferred = inferArtifactKindFromFilename(originalFilename);
+  const artifactKind = options.artifactKind ?? inferred;
+  if (artifactKind == null) {
+    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
+  }
+  const expected = requiredExtensionForKind(artifactKind);
+  if (!originalFilename.toLowerCase().endsWith(expected)) {
+    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
+    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
+  }
+  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
+  if (displayName.length < 1 || displayName.length > 200) {
+    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
+  }
+  return {
+    path: filePath,
+    displayName,
+    originalFilename,
+    sizeBytes,
+    archiveSha256: await hashFileSha256(filePath),
+    artifactKind
+  };
+}
+
+// src/pentest/status-update.ts
+var PENTEST_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|pt-\d+|\d+)$/i;
+var FINDING_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|ptf-\d+|\d+)$/i;
+var MAX_NOTE_LENGTH = 1e4;
+function parseStatusUpdateTarget(raw) {
+  const normalized = raw.trim().toUpperCase().replace(/[\s-]+/g, "_");
+  if (normalized === "IN_REVIEW" || normalized === "REVIEW") {
+    return {
+      error: "IN_REVIEW is not a finding status. Use IN_PROGRESS while fixing, then REMEDIATED when the fix is ready for retest."
+    };
+  }
+  if (normalized === "IN_PROGRESS" || normalized === "REMEDIATED") {
+    return normalized;
+  }
+  return {
+    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use IN_PROGRESS or REMEDIATED.`
+  };
+}
+function isPentestIdentifier(value) {
+  return PENTEST_IDENTIFIER_PATTERN.test(value);
+}
+function isFindingIdentifier(value) {
+  return FINDING_IDENTIFIER_PATTERN.test(value);
+}
+function failStatusUpdate(status, body, viaApiKey) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403 && viaApiKey) {
+    console.error(
+      colorError(
+        `${message ?? "Request failed (status 403)."}
+API keys can update finding status once Trace enables finding automation for your organization. Ask Trace to turn it on, or run this with \`tracecli auth login\`.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 409 && errorCode === "FINDING_STALE") {
+    console.error(
+      colorError(message ?? "The finding changed while this update was in flight. Retry it.")
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "Pentest or finding not found."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "PENTEST_CLOSED") {
+      console.error(
+        colorError(message ?? "Closed pentests must be reopened before updating findings.")
+      );
+    } else if (errorCode === "FINDING_TRANSITION_NOT_ALLOWED") {
+      console.error(
+        colorError(
+          message ?? "That status change is not allowed from the finding's current status."
+        )
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 400 || status === 403) {
+    console.error(colorError(message ?? `Request failed (status ${status}).`));
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Failed to update finding status (status ${status})${message ? `: ${message}` : "."}`
+    )
+  );
+  process.exit(1);
+}
+async function runStatusUpdate(options) {
+  if (options.output !== "text" && options.output !== "json") {
+    console.error(
+      colorError(`Invalid --output '${sanitizeDisplay(options.output)}'. Use text or json.`)
+    );
+    process.exit(1);
+  }
+  const target = parseStatusUpdateTarget(options.status);
+  if (typeof target !== "string") {
+    console.error(colorError(target.error));
+    process.exit(1);
+  }
+  if (!isPentestIdentifier(options.pentest)) {
+    console.error(
+      colorError(
+        `Invalid pentest identifier '${sanitizeDisplay(options.pentest)}'. Use a display ID (e.g. PT-3) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  if (!isFindingIdentifier(options.finding)) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(options.finding)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  const note = options.note?.trim();
+  if (note !== void 0 && note.length === 0) {
+    console.error(colorError("--note cannot be empty."));
+    process.exit(1);
+  }
+  if (note !== void 0 && note.length > MAX_NOTE_LENGTH) {
+    console.error(
+      colorError(`--note is ${note.length} characters; the limit is ${MAX_NOTE_LENGTH}.`)
+    );
+    process.exit(1);
+  }
+  if (note !== void 0 && target === "IN_PROGRESS") {
+    console.error(
+      colorError("--note is only used when reporting remediation (--status REMEDIATED).")
+    );
+    process.exit(1);
+  }
+  const viaApiKey = requireAuth().kind === "api_key";
+  const organizationId = await resolveOrganizationId();
+  const params = {
+    organizationId,
+    pentestId: options.pentest,
+    pentestFindingId: options.finding
+  };
+  const result = viaApiKey ? await authenticatedRequest(
+    (client) => client.pentestFinding.automationStatusUpdate({
+      params,
+      body: { status: target, ...note !== void 0 ? { note } : {} }
+    })
+  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
+    (client) => client.pentestFinding.startProgress({ params, body: {} })
+  ) : await authenticatedRequest(
+    (client) => client.pentestFinding.reportRemediation({
+      params,
+      body: note !== void 0 ? { note } : {}
+    })
+  );
+  if (result.status !== 200) {
+    failStatusUpdate(result.status, result.body, viaApiKey);
+  }
+  if (options.output === "json") {
+    console.log(JSON.stringify(result.body, null, 2));
+    return;
+  }
+  const displayId = result.body.displayId;
+  const status = sanitizeDisplay(result.body.status);
+  console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
+}
+function createStatusUpdateCommand() {
+  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
+    "--status <status>",
+    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
+  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
+can mark a finding in progress when it starts the fix, then remediated when the
+fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
+sending REMEDIATED) keeps it out of the retest queue.
+
+IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
+OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+
+A signed-in session (\`tracecli auth login\`) attributes the change to you. A
+Trace API key works too, once Trace enables finding automation for your
+organization: those writes are recorded as \`api-key:<key name>\` and show up as
+yours in the finding's history.
+
+Examples:
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
+  tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
+    --note "Fixed in PR 412" --output json`
+  ).action(async (options) => {
+    await runStatusUpdate(options);
+  });
+}
+
+// src/pentest/deliverables.ts
+var PentestDeliverableDownloadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PentestDeliverableDownloadError";
+  }
+};
+function safeDeliverableFilename(documentId, extension, fallbackStem) {
+  const stripped = Array.from(basename3(documentId.replace(/\\/g, "/")), (char) => {
+    const code = char.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127 ? "_" : char;
+  }).join("").trim();
+  const stem = stripped.length === 0 || stripped === "." || stripped === ".." ? fallbackStem : stripped;
+  return stem.toLowerCase().endsWith(extension) ? stem : `${stem}${extension}`;
+}
+function reportFileName(report, artifact) {
+  if (artifact === "docx") {
+    return safeDeliverableFilename(report.documentId, ".docx", "pentest-report");
+  }
+  const extension = report.downloadFormat === "bundle" ? ".zip" : ".pdf";
+  return safeDeliverableFilename(report.documentId, extension, "pentest-report");
+}
+function attestationFileName(attestation) {
+  return safeDeliverableFilename(attestation.documentId, ".pdf", "letter-of-attestation");
+}
+async function resolveDeliverableDestination(fileName, outOption) {
+  if (outOption === void 0) return resolve(process.cwd(), fileName);
+  const target = resolve(outOption);
+  try {
+    const info = await stat(target);
+    if (info.isDirectory()) return join6(target, fileName);
+  } catch {
+  }
+  return target;
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downloadDeliverableToFile(downloadUrl, destination, options = {}) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const partialPath = `${destination}.part`;
+  let response;
+  try {
+    response = await fetchImpl(downloadUrl, { method: "GET", redirect: "manual" });
+  } catch (error48) {
+    const detail = error48 instanceof Error ? error48.message : "network error";
+    throw new PentestDeliverableDownloadError(`Download from storage failed: ${detail}.`);
+  }
+  if (!response.ok || response.body === null) {
+    if (response.body !== null) await response.body.cancel();
+    throw new PentestDeliverableDownloadError(
+      `Storage answered HTTP ${response.status} instead of the document. Retry; the download link may have expired.`
+    );
+  }
+  const contentLength = response.headers.get("content-length");
+  let totalBytes = null;
+  if (contentLength !== null) {
+    const declared = Number(contentLength);
+    if (!Number.isSafeInteger(declared) || declared < 0) {
+      await response.body.cancel();
+      throw new PentestDeliverableDownloadError(
+        `Storage declared an unreadable Content-Length ('${contentLength}').`
+      );
+    }
+    totalBytes = declared;
+  }
+  await rm(partialPath, { force: true });
+  const file2 = await open2(partialPath, "wx");
+  const reader = response.body.getReader();
+  let downloadedBytes = 0;
+  options.onProgress?.({ downloadedBytes, totalBytes });
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      downloadedBytes += chunk.value.byteLength;
+      if (totalBytes !== null && downloadedBytes > totalBytes) {
+        await reader.cancel();
+        throw new PentestDeliverableDownloadError(
+          `Storage sent more than the ${totalBytes} bytes it declared.`
+        );
+      }
+      await writeAll(file2, chunk.value);
+      options.onProgress?.({ downloadedBytes, totalBytes });
+    }
+    await file2.close();
+    if (totalBytes !== null && downloadedBytes !== totalBytes) {
+      throw new PentestDeliverableDownloadError(
+        `Download ended after ${downloadedBytes} of ${totalBytes} bytes.`
+      );
+    }
+    if (downloadedBytes === 0) {
+      throw new PentestDeliverableDownloadError("Storage returned an empty document.");
+    }
+    await rename(partialPath, destination);
+    return { bytes: downloadedBytes };
+  } catch (error48) {
+    await file2.close().catch(() => void 0);
+    await rm(partialPath, { force: true });
+    if (error48 instanceof PentestDeliverableDownloadError) throw error48;
+    const detail = error48 instanceof Error ? error48.message : "unknown error";
+    throw new PentestDeliverableDownloadError(`Download from storage failed: ${detail}.`);
+  }
+}
+async function writeAll(file2, bytes) {
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
+    if (bytesWritten === 0) {
+      throw new PentestDeliverableDownloadError("Writing the document to disk stalled.");
+    }
+    offset += bytesWritten;
+  }
+}
+var DELIVERABLE_LABEL = {
+  report: "report",
+  attestation: "letter of attestation"
+};
+function requirePentestIdentifier(value) {
+  if (!isPentestIdentifier(value)) {
+    console.error(
+      colorError(`Invalid pentest identifier '${value}'. Use a display ID (e.g. PT-3) or UUID.`)
+    );
+    process.exit(1);
+  }
+}
+function failDeliverable(status, body, deliverable, pentestIdentifier, action) {
+  const { message, errorCode } = readErrorFields(body);
+  const label = DELIVERABLE_LABEL[deliverable];
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        message ?? `You do not have permission to ${action === "list" ? "view" : "download"} ${label}s for this organization.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    if (message === "Report not found") {
+      console.error(
+        colorError(
+          `No report has been shared for pentest ${pentestIdentifier} yet. Trace publishes it to your dashboard when the engagement's report is ready.`
+        )
+      );
+      process.exit(1);
+    }
+    if (message === "Attestation not found") {
+      console.error(
+        colorError(
+          `That letter of attestation is not available for pentest ${pentestIdentifier}. Run \`tracecli pentest attestation list ${pentestIdentifier}\` to see the letters shared with you.`
+        )
+      );
+      process.exit(1);
+    }
+    console.error(
+      colorError(
+        `Pentest '${pentestIdentifier}' not found. Verify the ID with \`tracecli pentest list\`.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "DOCX_NOT_RENDERED") {
+      console.error(
+        colorError(
+          "No Word document is available for this report. Drop --docx to download the PDF."
+        )
+      );
+      process.exit(1);
+    }
+    console.error(colorError(message ?? `Conflict (status ${status}).`));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Failed to ${action} ${label}${action === "list" ? "s" : ""} (status ${status})${message ? `: ${message}` : "."}`
+    )
+  );
+  process.exit(1);
+}
+function writeDownloadProgress(progress3) {
+  if (!process.stderr.isTTY) return;
+  const downloaded = formatArchiveBytes(progress3.downloadedBytes);
+  if (progress3.totalBytes === null || progress3.totalBytes === 0) {
+    process.stderr.write(`\rDownloading ${downloaded}`);
+    return;
+  }
+  const pct = Math.floor(progress3.downloadedBytes / progress3.totalBytes * 100);
+  process.stderr.write(
+    `\rDownloading ${pct}% (${downloaded} / ${formatArchiveBytes(progress3.totalBytes)})`
+  );
+}
+function finishProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+async function saveDeliverable(downloadUrl, fileName, options) {
+  const destination = await resolveDeliverableDestination(fileName, options.out);
+  if (!options.force && await pathExists(destination)) {
+    console.error(
+      colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "table") {
+    console.error(`Downloading ${sanitizeDisplay(fileName)} to ${destination}`);
+  }
+  try {
+    const { bytes } = await downloadDeliverableToFile(downloadUrl, destination, {
+      onProgress: writeDownloadProgress
+    });
+    finishProgress();
+    return { destination, bytes };
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
+    console.error(colorError(detail));
+    process.exit(1);
+  }
+}
+async function runReportDownload(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  const artifact = options.docx ? "docx" : "primary";
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.pentestReportPdf.downloadCustomer({
+      params: { organizationId, pentestId: pentestIdentifier },
+      query: {
+        disposition: "attachment",
+        ...artifact === "docx" ? { artifact: "docx" } : {}
+      }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "report", pentestIdentifier, "download");
+  }
+  const { report, downloadUrl } = result.body;
+  const fileName = reportFileName(report, artifact);
+  const { destination, bytes } = await saveDeliverable(downloadUrl, fileName, {
+    ...options.out !== void 0 ? { out: options.out } : {},
+    ...options.force !== void 0 ? { force: options.force } : {},
+    output
+  });
+  if (output === "json") {
+    console.log(JSON.stringify({ report, artifact, path: destination, sizeBytes: bytes }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["documentId", "version", "artifact", "path", "sizeBytes"].join("	"));
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(report.documentId)),
+        tsvSafe(sanitizeDisplay(report.version)),
+        artifact,
+        tsvSafe(destination),
+        String(bytes)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(report.documentId)} (${sanitizeDisplay(report.version)}) to ${destination} (${formatArchiveBytes(bytes)}).`
+    )
+  );
+}
+function createReportDownloadCommand() {
+  return new Command("download").description("Download the pentest report shared with your organization").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("--docx", "Download the Word document instead of the PDF (when your report ships one)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Downloads the report Trace has published for the engagement: the issued version
+when one exists, otherwise the current shared draft. The file is named after the
+report's document ID (for example TR-PT-2026-03-ACME.pdf). Organizations on
+a partner report template receive a zip carrying the PDF, the Word document, the
+markdown report, and evidence files.
+
+Works with a browser session from \`tracecli auth login\` or a Trace API key
+(TRACE_API_KEY), so it can run unattended in CI.
+
+Examples:
+  tracecli pentest report download PT-3
+  tracecli pentest report download PT-3 --out ./reports/
+  tracecli pentest report download PT-3 --out ./acme-q3.pdf --force
+  tracecli pentest report download PT-3 --docx
+  tracecli pentest report download PT-3 --output json | jq '.path'`
+  ).action(async (pentestId, options) => {
+    await runReportDownload(pentestId, options);
+  });
+}
+function createReportCommand() {
+  const report = new Command("report").description("Download the pentest report");
+  report.addCommand(createReportDownloadCommand());
+  return report;
+}
+function sortAttestationsNewestFirst(attestations) {
+  return [...attestations].sort((a2, b) => {
+    const delta = new Date(b.createdAt).getTime() - new Date(a2.createdAt).getTime();
+    return delta !== 0 ? delta : a2.attestationId.localeCompare(b.attestationId);
+  });
+}
+function renderAttestationLines(attestation) {
+  const counts = attestation.severityCounts;
+  return [
+    `  ${sanitizeDisplay(attestation.documentId)} (${sanitizeDisplay(attestation.version)}, ${sanitizeDisplay(attestation.classification)})`,
+    `          Issued: ${formatDate(attestation.issuedDate)} | Findings: ${attestation.totalFindings} (C${counts.critical} H${counts.high} M${counts.medium} L${counts.low} I${counts.info}) | ${formatArchiveBytes(attestation.fileSizeBytes)}`,
+    `          ID: ${attestation.attestationId}`,
+    ""
+  ];
+}
+var ATTESTATION_TSV_HEADER = [
+  "attestationId",
+  "documentId",
+  "version",
+  "classification",
+  "issuedDate",
+  "totalFindings",
+  "fileSizeBytes",
+  "createdAt"
+].join("	");
+function attestationTsvRow(attestation) {
+  return [
+    attestation.attestationId,
+    tsvSafe(sanitizeDisplay(attestation.documentId)),
+    tsvSafe(sanitizeDisplay(attestation.version)),
+    tsvSafe(sanitizeDisplay(attestation.classification)),
+    attestation.issuedDate,
+    String(attestation.totalFindings),
+    String(attestation.fileSizeBytes),
+    toIso(attestation.createdAt)
+  ].join("	");
+}
+async function fetchAttestations(organizationId, pentestIdentifier) {
+  const result = await authenticatedRequest(
+    (client) => client.pentestAttestation.listCustomerAttestations({
+      params: { organizationId, pentestId: pentestIdentifier }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "attestation", pentestIdentifier, "list");
+  }
+  return sortAttestationsNewestFirst(result.body.attestations);
+}
+async function runAttestationList(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  const organizationId = await resolveOrganizationId();
+  const attestations = await fetchAttestations(organizationId, pentestIdentifier);
+  if (output === "json") {
+    console.log(JSON.stringify(attestations, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(ATTESTATION_TSV_HEADER);
+    for (const attestation of attestations) {
+      console.log(attestationTsvRow(attestation));
+    }
+    return;
+  }
+  if (attestations.length === 0) {
+    console.log(`No letters of attestation have been shared for pentest ${pentestIdentifier}.`);
+    return;
+  }
+  const header = `Found ${attestations.length} letter${attestations.length === 1 ? "" : "s"} of attestation (newest first):`;
+  await runInteractivePager({
+    items: attestations,
+    header,
+    renderItem: (attestation) => renderAttestationLines(attestation),
+    disabled: options.pager === false
+  });
+}
+function createAttestationListCommand() {
+  return new Command("list").description("List the letters of attestation shared for a pentest").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive arrow-key pager for table output").addHelpText(
+    "after",
+    `
+Works with a browser session from \`tracecli auth login\` or a Trace API key
+(TRACE_API_KEY).
+
+Examples:
+  tracecli pentest attestation list PT-3
+  tracecli pentest attestation list PT-3 --output json | jq '.[0].attestationId'
+  tracecli pentest attestation list PT-3 --output tsv | cut -f1,2`
+  ).action(async (pentestId, options) => {
+    await runAttestationList(pentestId, options);
+  });
+}
+async function runAttestationDownload(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  if (options.attestation !== void 0 && !isUuid(options.attestation)) {
+    console.error(
+      colorError(
+        `Invalid --attestation '${options.attestation}'. Pass the UUID shown by \`tracecli pentest attestation list ${pentestIdentifier}\`.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  let attestationId = options.attestation;
+  if (attestationId === void 0) {
+    const attestations = await fetchAttestations(organizationId, pentestIdentifier);
+    const newest = attestations[0];
+    if (newest === void 0) {
+      console.error(
+        colorError(
+          `No letters of attestation have been shared for pentest ${pentestIdentifier} yet.`
+        )
+      );
+      process.exit(1);
+    }
+    if (attestations.length > 1 && output === "table") {
+      console.error(
+        `Downloading the newest of ${attestations.length} letters (${sanitizeDisplay(newest.documentId)}). Pass --attestation <id> for another.`
+      );
+    }
+    attestationId = newest.attestationId;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.pentestAttestation.downloadCustomerAttestation({
+      params: { organizationId, pentestId: pentestIdentifier, attestationId },
+      query: { disposition: "attachment" }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "attestation", pentestIdentifier, "download");
+  }
+  const { attestation, downloadUrl } = result.body;
+  const fileName = attestationFileName(attestation);
+  const { destination, bytes } = await saveDeliverable(downloadUrl, fileName, {
+    ...options.out !== void 0 ? { out: options.out } : {},
+    ...options.force !== void 0 ? { force: options.force } : {},
+    output
+  });
+  if (output === "json") {
+    console.log(JSON.stringify({ attestation, path: destination, sizeBytes: bytes }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["attestationId", "documentId", "version", "path", "sizeBytes"].join("	"));
+    console.log(
+      [
+        attestation.attestationId,
+        tsvSafe(sanitizeDisplay(attestation.documentId)),
+        tsvSafe(sanitizeDisplay(attestation.version)),
+        tsvSafe(destination),
+        String(bytes)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(attestation.documentId)} (${sanitizeDisplay(attestation.version)}) to ${destination} (${formatArchiveBytes(bytes)}).`
+    )
+  );
+}
+function createAttestationDownloadCommand() {
+  return new Command("download").description("Download a letter of attestation (newest by default)").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option(
+    "--attestation <id>",
+    "Attestation UUID from `pentest attestation list` (default: the newest letter)"
+  ).option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The file is named after the letter's document ID (for example
+TR-LOA-2026-03-ACME-1A2B3C.pdf). Works with a browser session from \`tracecli auth
+login\` or a Trace API key (TRACE_API_KEY), so it can run unattended in CI.
+
+Examples:
+  tracecli pentest attestation download PT-3
+  tracecli pentest attestation download PT-3 --out ./compliance/
+  tracecli pentest attestation download PT-3 --attestation 6f1c... --out ./loa.pdf --force
+  tracecli pentest attestation download PT-3 --output json | jq '.path'`
+  ).action(async (pentestId, options) => {
+    await runAttestationDownload(pentestId, options);
+  });
+}
+function createAttestationCommand() {
+  const attestation = new Command("attestation").alias("loa").description("List and download letters of attestation");
+  attestation.addCommand(createAttestationListCommand());
+  attestation.addCommand(createAttestationDownloadCommand());
+  return attestation;
+}
+
+// src/pentest/evidence.ts
+import { readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { basename as basename4 } from "path";
 var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
 var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
 function isSection(value) {
@@ -46373,7 +47918,7 @@ async function runAttachEvidence(options) {
   }
   let sizeBytes;
   try {
-    const stats = statSync3(options.file);
+    const stats = statSync4(options.file);
     if (!stats.isFile()) {
       console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
       process.exit(1);
@@ -46399,7 +47944,7 @@ async function runAttachEvidence(options) {
   const pentestId = await resolvePentestId(organizationId, options.pentest);
   const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
   const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename2(options.file);
+  const filename = basename4(options.file);
   const slot = await authenticatedRequest(
     (client) => client.pentestFinding.createFindingEvidenceUpload({
       params,
@@ -46485,193 +48030,13 @@ Examples:
   });
 }
 
-// src/pentest/status-update.ts
-var PENTEST_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|pt-\d+|\d+)$/i;
-var FINDING_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|ptf-\d+|\d+)$/i;
-var MAX_NOTE_LENGTH = 1e4;
-function parseStatusUpdateTarget(raw) {
-  const normalized = raw.trim().toUpperCase().replace(/[\s-]+/g, "_");
-  if (normalized === "IN_REVIEW" || normalized === "REVIEW") {
-    return {
-      error: "IN_REVIEW is not a finding status. Use IN_PROGRESS while fixing, then REMEDIATED when the fix is ready for retest."
-    };
-  }
-  if (normalized === "IN_PROGRESS" || normalized === "REMEDIATED") {
-    return normalized;
-  }
-  return {
-    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use IN_PROGRESS or REMEDIATED.`
-  };
-}
-function isPentestIdentifier(value) {
-  return PENTEST_IDENTIFIER_PATTERN.test(value);
-}
-function isFindingIdentifier(value) {
-  return FINDING_IDENTIFIER_PATTERN.test(value);
-}
-function failStatusUpdate(status, body, viaApiKey) {
-  const { message, errorCode } = readErrorFields(body);
-  if (status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (status === 403 && viaApiKey) {
-    console.error(
-      colorError(
-        `${message ?? "Request failed (status 403)."}
-API keys can update finding status once Trace enables finding automation for your organization. Ask Trace to turn it on, or run this with \`tracecli auth login\`.`
-      )
-    );
-    process.exit(1);
-  }
-  if (status === 409 && errorCode === "FINDING_STALE") {
-    console.error(
-      colorError(message ?? "The finding changed while this update was in flight. Retry it.")
-    );
-    process.exit(1);
-  }
-  if (status === 404) {
-    console.error(colorError(message ?? "Pentest or finding not found."));
-    process.exit(1);
-  }
-  if (status === 409) {
-    if (errorCode === "PENTEST_CLOSED") {
-      console.error(
-        colorError(message ?? "Closed pentests must be reopened before updating findings.")
-      );
-    } else if (errorCode === "FINDING_TRANSITION_NOT_ALLOWED") {
-      console.error(
-        colorError(
-          message ?? "That status change is not allowed from the finding's current status."
-        )
-      );
-    } else {
-      console.error(colorError(message ?? "Conflict (status 409)."));
-    }
-    process.exit(1);
-  }
-  if (status === 400 || status === 403) {
-    console.error(colorError(message ?? `Request failed (status ${status}).`));
-    process.exit(1);
-  }
-  console.error(
-    colorError(
-      `Failed to update finding status (status ${status})${message ? `: ${message}` : "."}`
-    )
-  );
-  process.exit(1);
-}
-async function runStatusUpdate(options) {
-  if (options.output !== "text" && options.output !== "json") {
-    console.error(
-      colorError(`Invalid --output '${sanitizeDisplay(options.output)}'. Use text or json.`)
-    );
-    process.exit(1);
-  }
-  const target = parseStatusUpdateTarget(options.status);
-  if (typeof target !== "string") {
-    console.error(colorError(target.error));
-    process.exit(1);
-  }
-  if (!isPentestIdentifier(options.pentest)) {
-    console.error(
-      colorError(
-        `Invalid pentest identifier '${sanitizeDisplay(options.pentest)}'. Use a display ID (e.g. PT-3) or UUID.`
-      )
-    );
-    process.exit(1);
-  }
-  if (!isFindingIdentifier(options.finding)) {
-    console.error(
-      colorError(
-        `Invalid finding identifier '${sanitizeDisplay(options.finding)}'. Use a finding number (e.g. PTF-7) or UUID.`
-      )
-    );
-    process.exit(1);
-  }
-  const note = options.note?.trim();
-  if (note !== void 0 && note.length === 0) {
-    console.error(colorError("--note cannot be empty."));
-    process.exit(1);
-  }
-  if (note !== void 0 && note.length > MAX_NOTE_LENGTH) {
-    console.error(
-      colorError(`--note is ${note.length} characters; the limit is ${MAX_NOTE_LENGTH}.`)
-    );
-    process.exit(1);
-  }
-  if (note !== void 0 && target === "IN_PROGRESS") {
-    console.error(
-      colorError("--note is only used when reporting remediation (--status REMEDIATED).")
-    );
-    process.exit(1);
-  }
-  const viaApiKey = requireAuth().kind === "api_key";
-  const organizationId = await resolveOrganizationId();
-  const params = {
-    organizationId,
-    pentestId: options.pentest,
-    pentestFindingId: options.finding
-  };
-  const result = viaApiKey ? await authenticatedRequest(
-    (client) => client.pentestFinding.automationStatusUpdate({
-      params,
-      body: { status: target, ...note !== void 0 ? { note } : {} }
-    })
-  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
-    (client) => client.pentestFinding.startProgress({ params, body: {} })
-  ) : await authenticatedRequest(
-    (client) => client.pentestFinding.reportRemediation({
-      params,
-      body: note !== void 0 ? { note } : {}
-    })
-  );
-  if (result.status !== 200) {
-    failStatusUpdate(result.status, result.body, viaApiKey);
-  }
-  if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
-    return;
-  }
-  const displayId = result.body.displayId;
-  const status = sanitizeDisplay(result.body.status);
-  console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
-}
-function createStatusUpdateCommand() {
-  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
-    "--status <status>",
-    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
-  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
-    "after",
-    `
-Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
-can mark a finding in progress when it starts the fix, then remediated when the
-fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
-sending REMEDIATED) keeps it out of the retest queue.
-
-IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN.
-
-A signed-in session (\`tracecli auth login\`) attributes the change to you. A
-Trace API key works too, once Trace enables finding automation for your
-organization: those writes are recorded as \`api-key:<key name>\` and show up as
-yours in the finding's history.
-
-Examples:
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
-  tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
-    --note "Fixed in PR 412" --output json`
-  ).action(async (options) => {
-    await runStatusUpdate(options);
-  });
-}
-
 // src/pentest/get-finding.ts
 var OUTPUT_FORMATS2 = ["text", "json"];
 function isOutputFormat2(value) {
   return OUTPUT_FORMATS2.includes(value);
 }
 var PROSE_SECTIONS = [
+  { key: "summary", heading: "Summary" },
   { key: "description", heading: "Description" },
   { key: "impact", heading: "Impact" },
   { key: "attackScenario", heading: "Attack Scenario" },
@@ -47776,12 +49141,14 @@ function createPentestCommand() {
   pentest.addCommand(createUpdateCommand4());
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
+  pentest.addCommand(createReportCommand());
+  pentest.addCommand(createAttestationCommand());
   return pentest;
 }
 
 // src/update/commands.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
 var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -47790,7 +49157,7 @@ var DISABLE_UPDATE_NOTIFIER_ENV = "TRACECLI_DISABLE_UPDATE_NOTIFIER";
 var REGISTRY_URL_ENV = "TRACECLI_NPM_REGISTRY_URL";
 var noticePrinted = false;
 function getUpdateCheckCachePath() {
-  return join6(getTraceDir(), UPDATE_CACHE_FILE);
+  return join7(getTraceDir(), UPDATE_CACHE_FILE);
 }
 function readUpdateCheckCache() {
   const cachePath = getUpdateCheckCachePath();
@@ -48164,153 +49531,8 @@ Examples:
 
 // src/upload/download.ts
 import { createHash as createHash2 } from "crypto";
-import { open as open2, rename, rm, stat } from "fs/promises";
-import { basename as basename4, join as join7, resolve } from "path";
-
-// src/upload/prepare.ts
-import { createHash } from "crypto";
-import { createReadStream, statSync as statSync4 } from "fs";
-import { open } from "fs/promises";
-import { basename as basename3 } from "path";
-var CodeUploadPrepareError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CodeUploadPrepareError";
-  }
-};
-var KIND_BY_INPUT = {
-  source: "SOURCE_ARCHIVE",
-  code: "SOURCE_ARCHIVE",
-  "source-archive": "SOURCE_ARCHIVE",
-  source_archive: "SOURCE_ARCHIVE",
-  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
-  apk: "ANDROID_APK",
-  android: "ANDROID_APK",
-  "android-apk": "ANDROID_APK",
-  android_apk: "ANDROID_APK",
-  ANDROID_APK: "ANDROID_APK",
-  ipa: "IOS_IPA",
-  ios: "IOS_IPA",
-  "ios-ipa": "IOS_IPA",
-  ios_ipa: "IOS_IPA",
-  IOS_IPA: "IOS_IPA"
-};
-function normalizeArtifactKind(input) {
-  const trimmed = input.trim();
-  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
-}
-function inferArtifactKindFromFilename(filename) {
-  const lower = filename.toLowerCase();
-  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
-  if (lower.endsWith(".apk")) return "ANDROID_APK";
-  if (lower.endsWith(".ipa")) return "IOS_IPA";
-  return null;
-}
-function requiredExtensionForKind(kind) {
-  if (kind === "ANDROID_APK") return ".apk";
-  if (kind === "IOS_IPA") return ".ipa";
-  return ".zip";
-}
-function defaultDisplayName(originalFilename) {
-  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
-  return base.slice(0, 200) || "source";
-}
-function formatArchiveBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) {
-    const kb = bytes / 1024;
-    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
-  }
-  if (bytes < 1024 * 1024 * 1024) {
-    const mb = bytes / (1024 * 1024);
-    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
-  }
-  const gb = bytes / (1024 * 1024 * 1024);
-  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
-}
-function archiveTooLargeMessage() {
-  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
-}
-async function hashFileSha256(filePath) {
-  const hash2 = createHash("sha256");
-  const stream = createReadStream(filePath);
-  for await (const chunk of stream) {
-    hash2.update(chunk);
-  }
-  return hash2.digest("hex");
-}
-async function readFileSlice(filePath, start, endExclusive) {
-  const length = endExclusive - start;
-  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
-    throw new Error(
-      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
-    );
-  }
-  const buffer = Buffer.alloc(length);
-  const handle = await open(filePath, "r");
-  try {
-    const { bytesRead } = await handle.read(buffer, 0, length, start);
-    if (bytesRead !== length) {
-      throw new Error(
-        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
-      );
-    }
-    return buffer;
-  } finally {
-    await handle.close();
-  }
-}
-function assertPreparedMatchesUpload(upload, prepared) {
-  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
-    throw new CodeUploadPrepareError(
-      "The file does not match the interrupted upload (size or SHA-256 differs)."
-    );
-  }
-}
-async function prepareUploadFile(filePath, options = {}) {
-  let sizeBytes;
-  try {
-    const stats = statSync4(filePath);
-    if (!stats.isFile()) {
-      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
-    }
-    sizeBytes = stats.size;
-  } catch (error48) {
-    if (error48 instanceof CodeUploadPrepareError) throw error48;
-    throw new CodeUploadPrepareError("Cannot read that file.");
-  }
-  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
-    throw new CodeUploadPrepareError("The file is empty.");
-  }
-  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
-    throw new CodeUploadPrepareError(archiveTooLargeMessage());
-  }
-  const originalFilename = basename3(filePath);
-  const inferred = inferArtifactKindFromFilename(originalFilename);
-  const artifactKind = options.artifactKind ?? inferred;
-  if (artifactKind == null) {
-    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
-  }
-  const expected = requiredExtensionForKind(artifactKind);
-  if (!originalFilename.toLowerCase().endsWith(expected)) {
-    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
-    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
-  }
-  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
-  if (displayName.length < 1 || displayName.length > 200) {
-    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
-  }
-  return {
-    path: filePath,
-    displayName,
-    originalFilename,
-    sizeBytes,
-    archiveSha256: await hashFileSha256(filePath),
-    artifactKind
-  };
-}
-
-// src/upload/download.ts
+import { open as open3, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
+import { basename as basename5, join as join8, resolve as resolve2 } from "path";
 var CodeUploadDownloadError = class extends Error {
   constructor(message) {
     super(message);
@@ -48320,7 +49542,7 @@ var CodeUploadDownloadError = class extends Error {
 function safeDownloadFilename(upload) {
   const extension = requiredExtensionForKind(upload.artifactKind);
   const fallback = `app${extension}`;
-  const stripped = Array.from(basename4(upload.originalFilename.replace(/\\/g, "/")), (char) => {
+  const stripped = Array.from(basename5(upload.originalFilename.replace(/\\/g, "/")), (char) => {
     const code = char.codePointAt(0) ?? 0;
     return code <= 31 || code === 127 ? "_" : char;
   }).join("").trim();
@@ -48329,18 +49551,18 @@ function safeDownloadFilename(upload) {
 }
 async function resolveDownloadDestination(upload, outOption) {
   const filename = safeDownloadFilename(upload);
-  if (outOption === void 0) return resolve(process.cwd(), filename);
-  const target = resolve(outOption);
+  if (outOption === void 0) return resolve2(process.cwd(), filename);
+  const target = resolve2(outOption);
   try {
-    const info = await stat(target);
-    if (info.isDirectory()) return join7(target, filename);
+    const info = await stat2(target);
+    if (info.isDirectory()) return join8(target, filename);
   } catch {
   }
   return target;
 }
-async function pathExists(path) {
+async function pathExists2(path) {
   try {
-    await stat(path);
+    await stat2(path);
     return true;
   } catch {
     return false;
@@ -48372,8 +49594,8 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
       );
     }
   }
-  await rm(partialPath, { force: true });
-  const file2 = await open2(partialPath, "wx");
+  await rm2(partialPath, { force: true });
+  const file2 = await open3(partialPath, "wx");
   const hash2 = createHash2("sha256");
   const reader = response.body.getReader();
   let downloadedBytes = 0;
@@ -48390,7 +49612,7 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
         );
       }
       hash2.update(chunk.value);
-      await writeAll(file2, chunk.value);
+      await writeAll2(file2, chunk.value);
       options.onProgress?.(progress(downloadedBytes, upload.sizeBytes));
     }
     await file2.close();
@@ -48405,10 +49627,10 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
         "Downloaded bytes do not match the SHA-256 recorded at upload time."
       );
     }
-    await rename(partialPath, destination);
+    await rename2(partialPath, destination);
   } catch (error48) {
     await file2.close().catch(() => void 0);
-    await rm(partialPath, { force: true });
+    await rm2(partialPath, { force: true });
     if (error48 instanceof CodeUploadDownloadError) throw error48;
     const detail = error48 instanceof Error ? error48.message : "unknown error";
     throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
@@ -48421,7 +49643,7 @@ function progress(downloadedBytes, totalBytes) {
     fraction: totalBytes === 0 ? 1 : downloadedBytes / totalBytes
   };
 }
-async function writeAll(file2, bytes) {
+async function writeAll2(file2, bytes) {
   let offset = 0;
   while (offset < bytes.byteLength) {
     const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
@@ -48557,13 +49779,13 @@ function progress2(uploadedBytes, totalBytes) {
   };
 }
 function defaultWait(milliseconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
 }
 
 // src/upload/commands.ts
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
 var DEFAULT_RUNTIME = {
-  wait: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
+  wait: (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)),
   pollIntervalMs: 3e3,
   fetch: (input, init) => globalThis.fetch(input, init)
 };
@@ -48819,14 +50041,14 @@ function writeProgress(progress3) {
     `\rUploading ${pct}% (${formatArchiveBytes(progress3.uploadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
-function writeDownloadProgress(progress3) {
+function writeDownloadProgress2(progress3) {
   if (!process.stderr.isTTY) return;
   const pct = Math.floor(progress3.fraction * 100);
   process.stderr.write(
     `\rDownloading ${pct}% (${formatArchiveBytes(progress3.downloadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
-function finishProgress() {
+function finishProgress2() {
   if (process.stderr.isTTY) process.stderr.write("\n");
 }
 async function listUploads(organizationId, query = {}) {
@@ -48956,9 +50178,9 @@ async function runTransfer(filePath, options, runtime) {
         refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
       }
     );
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
     console.error(colorError(detail));
     console.error(resumeHint(codeUploadId, filePath));
@@ -49071,9 +50293,9 @@ async function runResume(codeUploadIdArg, filePath, options, runtime) {
         refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
       }
     );
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
     console.error(colorError(detail));
     console.error(resumeHint(codeUploadId, filePath));
@@ -49151,7 +50373,7 @@ async function runDownload(codeUploadIdArg, options, runtime) {
   }
   const { upload, downloadUrl } = result.body;
   const destination = await resolveDownloadDestination(upload, options.out);
-  if (!options.force && await pathExists(destination)) {
+  if (!options.force && await pathExists2(destination)) {
     console.error(
       colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
     );
@@ -49165,11 +50387,11 @@ async function runDownload(codeUploadIdArg, options, runtime) {
   try {
     await downloadCodeUploadToFile(upload, downloadUrl, destination, {
       fetch: runtime.fetch,
-      onProgress: writeDownloadProgress
+      onProgress: writeDownloadProgress2
     });
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
     console.error(colorError(detail));
     process.exit(1);