securewithtrace 0.44.0 → 0.45.1

package/dist/index.js

@@ -22640,7 +22640,11 @@ var agentSessionContract = c2.router({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/agent-task.api.ts
-var AGENT_TASK_TYPES = ["ENGAGEMENT_BRIEF", "VERIFY_APPLICATION_SETUP"];
+var AGENT_TASK_TYPES = [
+  "ENGAGEMENT_BRIEF",
+  "VERIFY_APPLICATION_SETUP",
+  "TRIAGE_DISTILL"
+];
 var AgentTaskTypeSchema = external_exports.enum(AGENT_TASK_TYPES);
 var TRIGGERABLE_AGENT_TASK_TYPES = ["ENGAGEMENT_BRIEF"];
 var TriggerableAgentTaskTypeSchema = external_exports.enum(TRIGGERABLE_AGENT_TASK_TYPES);
@@ -22701,6 +22705,7 @@ var AgentTaskResponseSchema = external_exports.object({
   status: AgentTaskStatusSchema,
   subjectPentestId: external_exports.uuid().nullable(),
   subjectApplicationId: external_exports.uuid().nullable(),
+  subjectVulnerabilityId: external_exports.uuid().nullable(),
   capabilities: external_exports.array(external_exports.string()),
   /**
    * Null until the worker claims the task and records what it actually ran —
@@ -23178,10 +23183,22 @@ var RepositoryResponseSchema = external_exports.object({
   primaryLanguage: external_exports.string().nullable().optional(),
   /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
   prScansEnabled: external_exports.boolean(),
+  /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
+  includedInScanning: external_exports.boolean(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
 var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var SetScanningInclusionRequestSchema = external_exports.object({
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(500),
+  includedInScanning: external_exports.boolean()
+});
+var SetScanningInclusionResponseSchema = external_exports.object({
+  /** Rows whose flag now matches the request (already-matching rows count). */
+  updatedCount: external_exports.number().int().min(0),
+  /** IDs from the request that are not repositories of this organization. */
+  notFoundRepositoryIds: external_exports.array(external_exports.uuid())
+});
 var SetPrScansEnabledRequestSchema = external_exports.object({
   enabled: external_exports.boolean()
 });
@@ -23666,6 +23683,7 @@ var ReportPdfResponseSchema = external_exports.object({
 var GetReportPdfResponseSchema = external_exports.object({
   report: ReportPdfResponseSchema.nullable()
 });
+var CvssVersionSchema = external_exports.enum(["3.1", "4.0"]);
 var ReportCanvasFindingSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   displayId: external_exports.int().min(1),
@@ -23819,6 +23837,12 @@ var ReportCanvasResponseSchema = external_exports.object({
    * project the default (true) — the value the first render will use. */
   includeRemediationTimeline: external_exports.boolean(),
   findings: external_exports.array(ReportCanvasFindingSchema),
+  /** The CVSS version this engagement scores with (its stored vectors, else the
+   * producer default). The editor renders this version's metric grid; the api
+   * rejects the other version on every write, so no finding can differ from it.
+   * Optional for the same reason as `boundApplications` above; consumers default
+   * it to the producer default, which is what an api that predates it scored with. */
+  cvssVersion: CvssVersionSchema.optional(),
   // Counts reuse the module-local Severity/Status counts + totalFindings trio.
   liveSeverityCounts: SeverityCountsSchema,
   liveStatusCounts: StatusCountsSchema,
@@ -24017,6 +24041,11 @@ var IssuedReportSnapshotSchema = external_exports.object({
      * parses those rows for the changelog diff — a required field would throw
      * there and break issuing a new version of any pre-feature report. */
     testType: PentestTestType.optional(),
+    /** The CVSS version the engagement was scored with at issuance: the archival
+     * record of which version the delivered PDF names when its rendered findings
+     * carry no vector to read it from. Optional because every pre-feature snapshot
+     * lacks it, and those were all issued under 3.1. */
+    cvssVersion: CvssVersionSchema.optional(),
     /** Types of the applications bound at issuance: the archival record of which
      * OWASP families the delivered PDF named. Optional for the same reason as
      * `testType` above: a pre-feature snapshot has no value, and
@@ -24813,8 +24842,11 @@ var FindingProseSchema = FindingRewriteJsonSchema.pick({
   remediation: true,
   verification: true
 });
+var FindingProsePatchSchema = FindingProseSchema.partial().extend({
+  summary: FindingRewriteJsonSchema.shape.summary.unwrap().optional()
+});
 var ApplyFindingProseRequestSchema = external_exports.object({
-  prose: FindingProseSchema,
+  prose: FindingProsePatchSchema,
   /**
    * Optimistic precondition — the finding's `updatedAt` at edit-open. A mismatch
    * means a concurrent writer (staff / report agent / retest) moved the row →
@@ -24836,7 +24868,9 @@ var CreatePentestFindingRequestSchema = external_exports.object({
   category: external_exports.string().min(1).max(200),
   status: PentestFindingStatus.optional(),
   cweIds: external_exports.array(external_exports.string()).optional(),
+  /** `CVSS:3.1/…` or `CVSS:4.0/…`; scored server-side and checked against the engagement's version. */
   cvssVector: external_exports.string().max(200).optional(),
+  /** Accepted for compatibility and ignored: the score is always derived from `cvssVector`. */
   cvssScore: external_exports.number().min(0).max(10).optional(),
   owaspCategory: external_exports.string().max(200).optional(),
   proofOfConcept: external_exports.string().max(5e4).optional(),
@@ -24860,7 +24894,9 @@ var UpdatePentestFindingRequestSchema = external_exports.object({
   category: external_exports.string().min(1).max(200).optional(),
   status: PentestFindingStatus.optional(),
   cweIds: external_exports.array(external_exports.string()).optional(),
+  /** `CVSS:3.1/…` or `CVSS:4.0/…` (scored server-side, version-checked), or null to clear both columns. */
   cvssVector: external_exports.string().max(200).nullable().optional(),
+  /** Accepted for compatibility and ignored: the score is always derived from `cvssVector`. */
   cvssScore: external_exports.number().min(0).max(10).nullable().optional(),
   owaspCategory: external_exports.string().max(200).nullable().optional(),
   proofOfConcept: external_exports.string().max(5e4).nullable().optional(),
@@ -25268,6 +25304,12 @@ var PentestResponseSchema = external_exports.object({
   perHypothesisBudgetCapUsd: external_exports.number(),
   startedAt: external_exports.coerce.date().nullable(),
   endedAt: external_exports.coerce.date().nullable(),
+  /**
+   * Set while staff have curtained the engagement from every customer
+   * principal; null = the customer can open it. `.optional()` for the same
+   * rolling-deploy reason as `applications` above.
+   */
+  hiddenFromCustomerAt: external_exports.coerce.date().nullable().optional(),
   createdById: external_exports.uuid(),
   createdByName: external_exports.string(),
   createdAt: external_exports.coerce.date(),
@@ -25699,6 +25741,27 @@ var PasskeySecretSchema = external_exports.object({
   /** largeBlob extension payload, base64. */
   largeBlob: external_exports.string().max(8192).optional()
 }).strict();
+var CredentialPasskeySummarySchema = external_exports.object({
+  credentialPasskeyId: external_exports.uuid(),
+  /** Relying party id: the hostname the passkey answers for. */
+  rpId: external_exports.string().min(1).max(253),
+  /**
+   * The user name the site set at creation, read from the envelope. Null when the
+   * site set none, or when `unreadable` is true.
+   */
+  userName: external_exports.string().max(320).nullable(),
+  /**
+   * The envelope decrypted but did not parse as a passkey document: a permanent
+   * state, and the agent skips this row too. A decrypt failure (KMS, a bad auth tag)
+   * is not this flag; it fails the read, as every other envelope read does.
+   */
+  unreadable: external_exports.boolean(),
+  // Coerced, not `z.date()`: the web parses this out of the wire body with
+  // safeParse, where the value is a string.
+  createdAt: external_exports.coerce.date(),
+  /** Moves only when the signature counter moved, the one observable sign of a use. */
+  lastAssertedAt: external_exports.coerce.date().nullable()
+}).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
 var MFA_CAPABLE_CREDENTIAL_TYPES = ["USERNAME_PASSWORD", "MAGIC_AUTH"];
@@ -26252,12 +26315,14 @@ var RecordValidationResultRequestSchema = external_exports.object({
    */
   owaspCategory: external_exports.string().min(1).max(120).nullable().optional(),
   /**
-   * Agent-assigned CVSS v3.1 base vector for the demonstrated impact
-   * (PROVEN-only). The api derives and persists the canonical vector + base
-   * score AND the finding severity (from the score's band) server-side; an
-   * unparseable explicit vector is rejected (400). The score is NEVER
-   * client-supplied. Absent → both cvss columns null and severity falls back
-   * to the agent's `severity` field (informational findings carry no vector).
+   * Agent-assigned CVSS base vector (`CVSS:3.1/…` or `CVSS:4.0/…`) for the
+   * demonstrated impact (PROVEN-only). The api derives and persists the
+   * canonical vector + base score AND the finding severity (from the score's
+   * band) server-side; an unparseable explicit vector is rejected (400
+   * INVALID_CVSS_VECTOR), and so is a vector of the other version than the
+   * engagement's stored vectors (400 CVSS_VERSION_MISMATCH). The score is
+   * NEVER client-supplied. Absent → both cvss columns null and severity falls
+   * back to the agent's `severity` field (informational findings carry no vector).
    */
   cvssVector: external_exports.string().min(1).max(120).nullable().optional(),
   /**
@@ -27839,6 +27904,7 @@ var agentSessionInternalContract = c4.router({
     body: OperatorApplyFindingCvssRequestSchema,
     responses: {
       200: OperatorFindingReadSchema,
+      // INVALID_CVSS_VECTOR or CVSS_VERSION_MISMATCH (see the staff applyFindingCvss route).
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -29865,11 +29931,12 @@ var CodeSizeLanguageTallySchema = external_exports.object({
   files: external_exports.number().int().nonnegative(),
   code: external_exports.number().int().nonnegative()
 });
-var CodeSizePlatformValues = ["GITHUB", "BITBUCKET"];
+var CodeSizePlatformValues = ["GITHUB", "BITBUCKET", "UPLOAD"];
 var CodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
   platform: external_exports.enum(CodeSizePlatformValues),
+  displayName: external_exports.string(),
   /** Billable SLOC of the current resolved branch. null = not measured yet. */
   billableSloc: external_exports.number().int().nonnegative().nullable()
 });
@@ -29881,7 +29948,8 @@ var CodeSizeBucketsSchema = external_exports.object({
   vendored_generated: CodeSizeBucketTallySchema
 });
 var OrganizationCodeSizeResponseSchema = external_exports.object({
-  /** All CONNECTED GitHub/Bitbucket repos. Server-sorted: measured first by
+  /** All CONNECTED GitHub/Bitbucket repos plus READY source uploads.
+   *  Server-sorted: measured first by
    *  billableSloc desc (ties repositoryUrl asc), then unmeasured by
    *  repositoryUrl asc — clients render as-is (spec-pr-2 §3.3). */
   repositories: external_exports.array(CodeSizeRepositorySchema),
@@ -29902,7 +29970,9 @@ var StaffCodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
   platform: external_exports.enum(CodeSizePlatformValues),
-  /** Resolved branch the measurement is keyed on (scanningBranch ?? default). */
+  displayName: external_exports.string(),
+  /** Resolved branch the measurement is keyed on (scanningBranch ?? default;
+   *  `snapshot` for uploads). */
   branch: external_exports.string(),
   /** null = no successful measurement for the current resolved branch. */
   billableSloc: external_exports.number().int().nonnegative().nullable(),
@@ -29920,7 +29990,8 @@ var StaffOrganizationCodeSizeResponseSchema = external_exports.object({
   totals: external_exports.object({
     billableSloc: external_exports.number().int().nonnegative(),
     rawLines: external_exports.number().int().nonnegative(),
-    /** Connected GitHub/Bitbucket repos — the re-measure `all` scope size. */
+    /** Connected GitHub/Bitbucket repos plus READY source uploads: the
+     *  re-measure `all` scope size. */
     repositoryCount: external_exports.number().int().nonnegative(),
     /** Repos with a measurement for their current resolved branch. */
     measuredCount: external_exports.number().int().nonnegative(),
@@ -30211,6 +30282,9 @@ var CredentialIdParamsSchema = OrgIdParamsSchema.extend({
   environmentId: external_exports.uuid(),
   credentialId: external_exports.uuid()
 });
+var CredentialPasskeyIdParamsSchema = CredentialIdParamsSchema.extend({
+  credentialPasskeyId: external_exports.uuid()
+});
 var EnvironmentCredentialsParamsSchema = OrgIdParamsSchema.extend({
   environmentId: external_exports.uuid()
 });
@@ -30369,7 +30443,12 @@ var CredentialResponseSchema = external_exports.object({
    * parameters only — the seed lives in its own KMS envelope on the row and
    * has no reveal endpoint at all (see the reveal union below).
    */
-  mfa: CredentialMfaSummarySchema.nullable()
+  mfa: CredentialMfaSummarySchema.nullable(),
+  /**
+   * Passkeys an agent created on this account, oldest first. Always present; empty
+   * for every credential type that cannot hold one. Summaries only.
+   */
+  passkeys: external_exports.array(CredentialPasskeySummarySchema)
 }).strict();
 var ListCredentialsResponseSchema = external_exports.array(CredentialResponseSchema);
 var UpdateCredentialRequestSchema = external_exports.object({
@@ -30592,6 +30671,27 @@ var credentialContract = c13.router({
       500: ErrorResponseSchema
     }
   },
+  // Remove ONE passkey Trace holds for the account. Not idempotent: the id names a
+  // row, and a second call 404s like deleteCredential. Allowed mid-engagement like
+  // clearCredentialMfa, and for the same reason: the customer decides what Trace
+  // holds on their account. A session already armed keeps the key in Chrome's
+  // memory until that browser closes, but cannot recreate the row (a counter tick
+  // carries no key, a rejected tick is never re-sent, and a fresh arm reads the
+  // store), so the removal sticks. Trace's copy only: the site keeps its own
+  // registration of the public key until the customer removes it there.
+  deleteCredentialPasskey: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/passkeys/:credentialPasskeyId",
+    pathParams: CredentialPasskeyIdParamsSchema,
+    responses: {
+      // The refreshed credential, so the dashboard's row state comes from the api.
+      200: CredentialResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   deleteCredential: {
     method: "DELETE",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId",
@@ -31082,6 +31182,11 @@ var EngagementCardsSchema = external_exports.object({
   statusChangesViaPrComment: external_exports.number().int(),
   botCommentsPosted: external_exports.number().int(),
   structuralReplies: external_exports.number().int(),
+  /**
+   * Always 0. Its only source is the `issue_comment` webhook, which GitHub
+   * does not deliver to any Trace app (GITHUB_APP_PERMISSIONS.md §Issue
+   * comment). Read a reply figure as `structuralReplies` alone.
+   */
   heuristicReplies: external_exports.number().int(),
   /** structuralReplies / max(1, botCommentsPosted), clamped to [0, 1]. */
   replyRate: external_exports.number().min(0).max(1)
@@ -34759,6 +34864,7 @@ var pentestFindingContract = c36.router({
     body: CreatePentestFindingRequestSchema,
     responses: {
       201: PentestFindingResponseSchema,
+      // INVALID_CVSS_VECTOR / CVSS_VERSION_MISMATCH when a cvssVector is sent, or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -34934,6 +35040,7 @@ var pentestFindingContract = c36.router({
     body: UpdatePentestFindingRequestSchema,
     responses: {
       200: PentestFindingResponseSchema,
+      // INVALID_CVSS_VECTOR / CVSS_VERSION_MISMATCH when a cvssVector is sent, or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -34980,7 +35087,8 @@ var pentestFindingContract = c36.router({
     body: ApplyFindingCvssRequestSchema,
     responses: {
       200: PentestFindingResponseSchema,
-      // INVALID_CVSS_VECTOR (unparseable vector) or schema validation.
+      // INVALID_CVSS_VECTOR (unparseable vector), CVSS_VERSION_MISMATCH (the
+      // engagement's stored vectors carry the other CVSS version), or schema validation.
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
@@ -36198,6 +36306,25 @@ var repositoryContract = c42.router({
       500: ErrorResponseSchema
     }
   },
+  /**
+   * Include or exclude repositories from scanning. Excluded repos stop
+   * receiving scans of every trigger type until included again; the flag is
+   * customer-owned and survives provider re-syncs.
+   */
+  setScanningInclusion: {
+    method: "PUT",
+    path: "/organizations/:organizationId/repositories/scanning-inclusion",
+    pathParams: OrgIdParamsSchema,
+    body: SetScanningInclusionRequestSchema,
+    responses: {
+      200: SetScanningInclusionResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getScanningBranchPreference: {
     method: "GET",
     path: "/organizations/:organizationId/repositories/scanning-branch/preference",
@@ -36521,11 +36648,17 @@ var StaffOrganizationPentestSummarySchema = external_exports.object({
   findingCount: external_exports.int().nonnegative(),
   startedAt: external_exports.iso.datetime().nullable(),
   endedAt: external_exports.iso.datetime().nullable(),
-  createdAt: external_exports.iso.datetime()
+  createdAt: external_exports.iso.datetime(),
+  /** Set while the engagement is curtained from every customer principal; null = visible. */
+  hiddenFromCustomerAt: external_exports.iso.datetime().nullable()
 }).strict();
 var ListStaffOrganizationPentestsResponseSchema = external_exports.array(
   StaffOrganizationPentestSummarySchema
 );
+var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_exports.object({
+  /** false hides the engagement from the customer entirely; true shows it again. */
+  visible: external_exports.boolean()
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
 var c45 = initContract();
@@ -36555,6 +36688,21 @@ var staffPentestsContract = c45.router({
       500: ErrorResponseSchema
     },
     summary: "Soft-delete a pentest from the admin console (Trace staff only)"
+  },
+  setStaffOrganizationPentestCustomerVisibility: {
+    method: "POST",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId/customer-visibility",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: SetStaffOrganizationPentestCustomerVisibilityRequestSchema,
+    responses: {
+      200: StaffOrganizationPentestSummarySchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Hide a pentest from the customer or show it again (Trace staff only)"
   }
 });
 
@@ -37079,7 +37227,10 @@ var VulnerabilityLatestFindingSchema = external_exports.object({
   classification: external_exports.enum(["vulnerability", "defense_in_depth", "context_dependent"]).nullable(),
   prerequisiteAccess: external_exports.string().nullable(),
   capabilityGain: external_exports.string().nullable(),
-  technicalSeverity: VulnerabilitySeverity.nullable()
+  technicalSeverity: VulnerabilitySeverity.nullable(),
+  // Whether the scan found an entry point that reaches the code; null when
+  // no scan assessed it (reads as reachable).
+  reachability: external_exports.enum(["reachable", "unreachable"]).nullable()
 });
 var DependencyGraphSchema = external_exports.object({
   vulnerablePackage: external_exports.string(),
@@ -37451,6 +37602,7 @@ var vulnerabilityContract = c50.router({
       402: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
@@ -38234,7 +38386,7 @@ async function requestDeviceAuthorization(clientId) {
   }
   return await response.json();
 }
-var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+var sleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 async function pollForToken(clientId, deviceCode, options = {}) {
   const expiresIn = options.expiresIn ?? 300;
   let interval = options.interval ?? 5;
@@ -38919,18 +39071,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open3, close, parent) => {
+var createStyler = (open4, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open3;
+    openAll = open4;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open3;
+    openAll = parent.openAll + open4;
     closeAll = close + parent.closeAll;
   }
   return {
-    open: open3,
+    open: open4,
     close,
     openAll,
     closeAll,
@@ -39507,12 +39659,19 @@ var SEVERITY_ORDER = {
   LOW: 3,
   INFORMATIONAL: 4
 };
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
 function formatStatus(status) {
   return status.toLowerCase().replace(/_/g, " ");
 }
 function tsvSafe(value) {
   return (value ?? "").replace(/[\t\r\n]/g, " ");
 }
+function formulaSafe(value) {
+  return /^[=+\-@]/.test(value) ? `'${value}` : value;
+}
 
 // src/pager.ts
 function isInteractiveEnvironment() {
@@ -39627,6 +39786,21 @@ function extractRepoName(input) {
   }
   return input;
 }
+function normalizeRepoUrlForMatch(url2) {
+  let normalized = url2.trim().toLowerCase();
+  const scp = normalized.match(/^[a-z0-9._-]+@([^:/]+):(.+)$/);
+  if (scp) {
+    normalized = `${scp[1]}/${scp[2]}`;
+  } else {
+    normalized = normalized.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[a-z0-9._-]+@/, "");
+  }
+  let previous;
+  do {
+    previous = normalized;
+    normalized = normalized.replace(/\/+$/, "").replace(/\.git$/, "");
+  } while (normalized !== previous);
+  return normalized;
+}
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
 var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
 var DEFAULT_LIMIT = 30;
@@ -39634,6 +39808,8 @@ var DEFAULT_PAGE = 1;
 var MAX_LIMIT = 100;
 var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
 var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
+var SCANNING_INCLUSIONS = ["included", "excluded"];
+var SCANNING_INCLUSION_BATCH_SIZE = 500;
 function validateBranchName(branch) {
   if (branch.startsWith("-")) {
     throw new Error(`Invalid branch name: '${branch}' \u2014 branch names cannot start with a dash`);
@@ -39687,6 +39863,18 @@ function normalizeStatus(value, source) {
     `${source} must be one of: ${REPOSITORY_STATUSES.join(", ")}. Received '${value}'.`
   );
 }
+function normalizeScanningInclusion(value, source) {
+  const normalized = value.trim().toLowerCase();
+  if (SCANNING_INCLUSIONS.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${SCANNING_INCLUSIONS.join(", ")}. Received '${value}'.`
+  );
+}
+function scanningInclusionOf(repo) {
+  return repo.includedInScanning ? "included" : "excluded";
+}
 function normalizeFilterField(rawField) {
   const field = rawField.trim().toLowerCase();
   switch (field) {
@@ -39711,9 +39899,14 @@ function normalizeFilterField(rawField) {
     case "primarylanguage":
     case "primary_language":
       return "language";
+    case "scanning":
+    case "inclusion":
+    case "included_in_scanning":
+    case "includedinscanning":
+      return "scanning";
     default:
       throw new Error(
-        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language.`
+        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language, scanning.`
       );
   }
 }
@@ -39757,6 +39950,9 @@ function parseRepositoryFilterExpression(expression) {
   if (field === "status") {
     normalizeStatus(value, "--filter");
   }
+  if (field === "scanning") {
+    normalizeScanningInclusion(value, "--filter");
+  }
   return { field, operator, value };
 }
 function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly) {
@@ -39764,7 +39960,7 @@ function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly)
   const normalizedFilter = normalizeForMatching(filterValue);
   if (exactMatchOnly || operator === "exact" || operator === "not_exact") {
     const matches2 = normalizedCandidate === normalizedFilter;
-    return operator === "not_exact" ? !matches2 : matches2;
+    return operator === "not_exact" || operator === "not_contains" ? !matches2 : matches2;
   }
   const matches = normalizedCandidate.includes(normalizedFilter);
   return operator === "not_contains" ? !matches : matches;
@@ -39800,6 +39996,13 @@ function matchParsedFilter(repo, parsedFilter) {
       const language = repo.primaryLanguage ?? "";
       return doesValueMatchFilter(language, parsedFilter.value, parsedFilter.operator, false);
     }
+    case "scanning":
+      return doesValueMatchFilter(
+        scanningInclusionOf(repo),
+        parsedFilter.value,
+        parsedFilter.operator,
+        true
+      );
   }
 }
 function filterRepositories(repositories, options) {
@@ -39811,6 +40014,7 @@ function filterRepositories(repositories, options) {
   const normalizedQuery = options.query ? normalizeForMatching(options.query) : void 0;
   const normalizedDefaultBranch = options.githubDefaultBranch ? normalizeForMatching(options.githubDefaultBranch) : void 0;
   const normalizedLanguage = options.language ? normalizeForMatching(options.language) : void 0;
+  const normalizedScanning = options.scanning ? normalizeScanningInclusion(options.scanning, "--scanning") : void 0;
   return repositories.filter((repo) => {
     if (normalizedPlatform && repo.platform.toUpperCase() !== normalizedPlatform) {
       return false;
@@ -39818,6 +40022,9 @@ function filterRepositories(repositories, options) {
     if (normalizedStatus && repo.status.toUpperCase() !== normalizedStatus) {
       return false;
     }
+    if (normalizedScanning && scanningInclusionOf(repo) !== normalizedScanning) {
+      return false;
+    }
     if (normalizedDefaultBranch && !normalizeForMatching(repo.githubDefaultBranch).includes(normalizedDefaultBranch)) {
       return false;
     }
@@ -39890,7 +40097,9 @@ function paginateResults(items, options) {
   };
 }
 function printRepositoriesTsv(repositories) {
-  console.log("repositoryUrl	platform	status	githubDefaultBranch	scanningBranch	language");
+  console.log(
+    "repositoryUrl	platform	status	githubDefaultBranch	scanningBranch	language	scanning"
+  );
   for (const repo of repositories) {
     console.log(
       [
@@ -39899,18 +40108,20 @@ function printRepositoriesTsv(repositories) {
         tsvSafe(repo.status),
         tsvSafe(repo.githubDefaultBranch),
         tsvSafe(repo.scanningBranch ?? ""),
-        tsvSafe(repo.primaryLanguage)
+        tsvSafe(repo.primaryLanguage),
+        scanningInclusionOf(repo)
       ].join("	")
     );
   }
 }
 function buildRepositoriesTable(repositories) {
-  const headers = ["Repository URL", "Platform", "Status"];
+  const headers = ["Repository URL", "Platform", "Status", "Scanning"];
   const rows = repositories.map(
     (repo) => [
       stripAnsi(String(repo.repositoryUrl)),
       stripAnsi(String(repo.platform)).toUpperCase(),
-      repo.status === "CONNECTED" ? "connected" : "disconnected"
+      repo.status === "CONNECTED" ? "connected" : "disconnected",
+      scanningInclusionOf(repo)
     ]
   );
   const colWidths = headers.map(
@@ -40039,13 +40250,27 @@ async function maybeRefreshCloneTokenSessionForOrganization(organizationId, list
   }
   return refreshForOrganization(workosOrganizationId);
 }
+function resolveScanningFlag(options) {
+  if (options.included && options.excluded) {
+    throw new Error("Pass only one of --included / --excluded.");
+  }
+  if (options.included) {
+    return "included";
+  }
+  if (options.excluded) {
+    return "excluded";
+  }
+  return void 0;
+}
 function toRepositoryListFilterOptions(options) {
+  const scanning = resolveScanningFlag(options);
   return {
     ...options.platform ? { platform: options.platform } : {},
     ...options.status ? { status: options.status } : {},
     ...options.query ? { query: options.query } : {},
     ...options.defaultBranch ? { githubDefaultBranch: options.defaultBranch } : {},
     ...options.language ? { language: options.language } : {},
+    ...scanning ? { scanning } : {},
     ...options.filter.length > 0 ? { filters: options.filter } : {}
   };
 }
@@ -40058,9 +40283,9 @@ function addRepositoryFilterOptions(command) {
     "--status <status>",
     "Filter by status (CONNECTED, DISCONNECTED)",
     (value) => value.toUpperCase()
-  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option(
+  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option("--included", "Only repositories included in scanning").option("--excluded", "Only repositories excluded from scanning").option(
     "-f, --filter <expression>",
-    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED",
+    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, scanning=excluded",
     collectFilterExpression,
     []
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
@@ -40088,6 +40313,14 @@ async function runRepositoryListCommand(options) {
     }
     return;
   }
+  let filterOptions;
+  try {
+    filterOptions = toRepositoryListFilterOptions(options);
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
+    console.error(`Invalid repository filter: ${message}`);
+    process.exit(1);
+  }
   const organizationId = await resolveOrganizationId();
   if (options.dependency) {
     await runDependencyFilter(organizationId, {
@@ -40111,14 +40344,14 @@ async function runRepositoryListCommand(options) {
     process.exit(1);
   }
   try {
-    filteredRepositories = filterRepositories(result.body, toRepositoryListFilterOptions(options));
+    filteredRepositories = filterRepositories(result.body, filterOptions);
   } catch (error48) {
     const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
     console.error(`Invalid repository filter: ${message}`);
     process.exit(1);
   }
   if (filteredRepositories.length === 0) {
-    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.filter.length > 0) {
+    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.included || options.excluded || options.filter.length > 0) {
       console.log("No repositories found matching the provided filters.");
       return;
     }
@@ -40137,7 +40370,7 @@ async function runRepositoryListCommand(options) {
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(displayedRepositories, null, 2));
+    printJson(displayedRepositories);
     return;
   }
   if (options.output === "tsv") {
@@ -40221,7 +40454,7 @@ async function runDependencyFilter(organizationId, options) {
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(displayedRepos, null, 2));
+    printJson(displayedRepos);
     return;
   }
   if (options.output === "tsv") {
@@ -40252,6 +40485,8 @@ Examples:
   tracecli repo list --output json | jq '.[].repositoryUrl'
   tracecli repo list --output tsv | cut -f1
   tracecli repo list --filter "language:typescript" --limit 10
+  tracecli repo list --excluded
+  tracecli repo list --query payments --included --output json
   tracecli repo list --dependency lodash@4.17.21
   tracecli repo list --web`
   ).action(async (options) => {
@@ -40269,6 +40504,7 @@ Examples:
   tracecli repo filter --page 2 --limit 30
   tracecli repo filter --all
   tracecli repo filter --language typescript --limit 10
+  tracecli repo filter --filter "scanning=excluded"
   tracecli repo filter --output json | jq '.[].repositoryUrl'
   tracecli repo filter --output tsv | cut -f1
   tracecli repo filter --web`
@@ -40550,7 +40786,7 @@ async function runSetScanningBranchCommand(repoUrl, options) {
     }
     const urlById = new Map(listResult2.body.map((r2) => [r2.repositoryId, r2.repositoryUrl]));
     if (options.output === "json") {
-      console.log(JSON.stringify(allResults, null, 2));
+      printJson(allResults);
       return;
     }
     console.log("repositoryUrl	status	relabeledCount	error");
@@ -40631,12 +40867,152 @@ Examples:
     await runSetScanningBranchCommand(repositoryUrl, options);
   });
 }
+function resolveRepositoryReferences(repositories, references) {
+  const byId = /* @__PURE__ */ new Map();
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const repo of repositories) {
+    byId.set(repo.repositoryId.toLowerCase(), repo);
+    byUrl.set(normalizeRepoUrlForMatch(repo.repositoryUrl), repo);
+  }
+  const matched = /* @__PURE__ */ new Map();
+  const unresolved = [];
+  for (const reference of references) {
+    const trimmed = reference.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    const repo = byId.get(trimmed.toLowerCase()) ?? byUrl.get(normalizeRepoUrlForMatch(resolveRepoUrl(trimmed)));
+    if (!repo) {
+      unresolved.push(trimmed);
+      continue;
+    }
+    if (!matched.has(repo.repositoryId)) {
+      matched.set(repo.repositoryId, repo);
+    }
+  }
+  return { matched: [...matched.values()], unresolved };
+}
+function scanningInclusionVerb(includedInScanning) {
+  return includedInScanning ? { past: "Included", noun: "included in scanning" } : { past: "Excluded", noun: "excluded from scanning" };
+}
+async function runSetScanningInclusionCommand(references, includedInScanning, options) {
+  const organizationId = await resolveOrganizationId();
+  const listResult = await authenticatedRequest(
+    (client) => client.repository.listRepositories({ params: { organizationId } })
+  );
+  if (listResult.status === 401) {
+    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    process.exit(1);
+  }
+  if (listResult.status !== 200) {
+    console.error(`Failed to list repositories (status ${listResult.status}).`);
+    process.exit(1);
+  }
+  const { matched, unresolved } = resolveRepositoryReferences(listResult.body, references);
+  if (unresolved.length > 0) {
+    console.error(
+      colorError(
+        `${unresolved.length === 1 ? "Repository" : "Repositories"} not found in this organization: ${unresolved.join(", ")}`
+      )
+    );
+    console.error(
+      "Pass a repository ID, URL, or owner/repo shorthand. Run `tracecli repo list` to see connected repositories."
+    );
+    process.exit(1);
+  }
+  if (matched.length === 0) {
+    console.error(colorError("No repositories given."));
+    process.exit(1);
+  }
+  const outcomes = matched.map((repo) => ({
+    repositoryId: repo.repositoryId,
+    repositoryUrl: repo.repositoryUrl,
+    previouslyIncludedInScanning: repo.includedInScanning
+  }));
+  const ids = matched.map((repo) => repo.repositoryId);
+  let updatedCount = 0;
+  const notFoundRepositoryIds = [];
+  const verb = scanningInclusionVerb(includedInScanning);
+  for (let offset = 0; offset < ids.length; offset += SCANNING_INCLUSION_BATCH_SIZE) {
+    const result = await authenticatedRequest(
+      (client) => client.repository.setScanningInclusion({
+        params: { organizationId },
+        body: {
+          repositoryIds: ids.slice(offset, offset + SCANNING_INCLUSION_BATCH_SIZE),
+          includedInScanning
+        }
+      })
+    );
+    if (result.status === 200) {
+      updatedCount += result.body.updatedCount;
+      notFoundRepositoryIds.push(...result.body.notFoundRepositoryIds);
+      continue;
+    }
+    const committedSuffix = offset > 0 ? ` ${updatedCount} of ${ids.length} repositories were already updated.` : "";
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    } else if (result.status === 403) {
+      console.error(
+        colorError(
+          `You don't have permission to change repository scanning in this organization (analyst or admin role required).${committedSuffix}`
+        )
+      );
+    } else {
+      const message = extractErrorMessage(result.body);
+      console.error(
+        colorError(
+          `Failed to update repository scanning (status ${result.status})${message ? `: ${message}` : "."}${committedSuffix}`
+        )
+      );
+    }
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    printJson({ includedInScanning, updatedCount, notFoundRepositoryIds, repositories: outcomes });
+    return;
+  }
+  const notFound = new Set(notFoundRepositoryIds);
+  for (const outcome of outcomes) {
+    if (notFound.has(outcome.repositoryId)) {
+      console.log(
+        `${colorWarningPrefix("Skipped")} ${outcome.repositoryUrl}: no longer connected to this organization`
+      );
+    } else if (outcome.previouslyIncludedInScanning === includedInScanning) {
+      console.log(`Already ${verb.noun}: ${outcome.repositoryUrl}`);
+    } else {
+      console.log(`${colorSuccess(verb.past)} ${outcome.repositoryUrl}`);
+    }
+  }
+  const changedCount = outcomes.filter(
+    (outcome) => !notFound.has(outcome.repositoryId) && outcome.previouslyIncludedInScanning !== includedInScanning
+  ).length;
+  console.log(
+    `${changedCount} of ${outcomes.length} ${outcomes.length === 1 ? "repository" : "repositories"} changed to ${verb.noun}.${includedInScanning ? "" : " Excluded repositories are skipped by every scan until you include them again."}`
+  );
+}
+function createScanningInclusionCommand(includedInScanning) {
+  const name = includedInScanning ? "include" : "exclude";
+  const description = includedInScanning ? "Include repositories in scanning" : "Exclude repositories from scanning (no scans of any kind run until included again)";
+  return new Command(name).description(description).argument("<repository...>", "Repository ID, URL, or owner/repo shorthand (repeatable)").option("-o, --output <format>", "Output format: table (default), json", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli repo ${name} acme/api
+  tracecli repo ${name} https://github.com/acme/api https://bitbucket.org/acme/worker
+  tracecli repo ${name} 3f1c6c2e-9b7a-4a6f-8f1d-2d4e5a6b7c8d --output json
+  tracecli repo list --query legacy --output json | jq -r '.[].repositoryUrl' | xargs tracecli repo ${name}`
+  ).action(async (repositories, options) => {
+    await runSetScanningInclusionCommand(repositories, includedInScanning, options);
+  });
+}
 function createRepoCommand() {
   const repo = new Command("repo").description("Manage repositories");
   repo.addCommand(createListCommand());
   repo.addCommand(createFilterCommand());
   repo.addCommand(createCloneCommand());
   repo.addCommand(createSetScanningBranchCommand());
+  repo.addCommand(createScanningInclusionCommand(true));
+  repo.addCommand(createScanningInclusionCommand(false));
   return repo;
 }
 
@@ -40745,21 +41121,6 @@ function validateCreateTypeUrl(type, url2) {
   }
   return null;
 }
-function normalizeRepoUrlForMatch(url2) {
-  let normalized = url2.trim().toLowerCase();
-  const scp = normalized.match(/^[a-z0-9._-]+@([^:/]+):(.+)$/);
-  if (scp) {
-    normalized = `${scp[1]}/${scp[2]}`;
-  } else {
-    normalized = normalized.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[a-z0-9._-]+@/, "");
-  }
-  let previous;
-  do {
-    previous = normalized;
-    normalized = normalized.replace(/\/+$/, "").replace(/\.git$/, "");
-  } while (normalized !== previous);
-  return normalized;
-}
 function buildCreateApplicationBody(input) {
   return {
     name: input.name,
@@ -40963,7 +41324,7 @@ function printApplicationRepositoriesTsv(links) {
 }
 function outputApplication(app, output) {
   if (output === "json") {
-    console.log(JSON.stringify(app, null, 2));
+    printJson(app);
     return;
   }
   if (output === "tsv") {
@@ -41048,7 +41409,7 @@ async function runList(options) {
   }
   const apps = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(apps, null, 2));
+    printJson(apps);
     return;
   }
   if (output === "tsv") {
@@ -41097,7 +41458,7 @@ async function runRepos(applicationId, options) {
   }
   const links = sortApplicationRepositoryLinks(result.body);
   if (output === "json") {
-    console.log(JSON.stringify(links, null, 2));
+    printJson(links);
     return;
   }
   if (output === "tsv") {
@@ -42802,7 +43163,7 @@ async function uploadLogo(organizationId, variant, file2) {
 }
 function outputOrganization(org, output, derived) {
   if (output === "json") {
-    console.log(JSON.stringify(org, null, 2));
+    printJson(org);
     return;
   }
   if (output === "tsv") {
@@ -43334,7 +43695,7 @@ Examples:
       }
     }
     if (options.output === "json") {
-      console.log(JSON.stringify(info, null, 2));
+      printJson(info);
       if (!info.loggedIn) {
         process.exitCode = 1;
       }
@@ -43473,7 +43834,7 @@ Examples:
       );
       const items = options.limit !== void 0 ? filteredItems.slice(0, options.limit) : filteredItems;
       if (options.output === "json") {
-        console.log(JSON.stringify(items, null, 2));
+        printJson(items);
         return;
       }
       if (options.output === "tsv") {
@@ -43549,16 +43910,10 @@ Examples:
     const active = organizationContext.activeOrganization;
     const source = organizationContext.selectedOrganizationId === active.organizationId ? "selected" : "default";
     if (options.output === "json") {
-      console.log(
-        JSON.stringify(
-          {
-            ...active,
-            source
-          },
-          null,
-          2
-        )
-      );
+      printJson({
+        ...active,
+        source
+      });
       return;
     }
     if (options.output === "tsv") {
@@ -43713,6 +44068,9 @@ function repoDisplayName(repositoryUrl) {
     return repositoryUrl;
   }
 }
+function repoLabel(repo) {
+  return sanitizeDisplay(repo.displayName ?? repoDisplayName(repo.repositoryUrl));
+}
 function countedRows(totals) {
   const b = totals.buckets;
   return [
@@ -43769,7 +44127,7 @@ function renderCodeSizeTable(codeSize, options) {
   lines.push(
     ...padValues(
       shown.map((repo) => ({
-        label: repoDisplayName(repo.repositoryUrl),
+        label: repoLabel(repo),
         value: repo.billableSloc ?? 0
       }))
     )
@@ -43784,7 +44142,8 @@ function renderCodeSizeTsv(codeSize) {
   return [
     "repository	billableSloc",
     ...codeSize.repositories.map(
-      (repo) => `${repoDisplayName(repo.repositoryUrl)}	${repo.billableSloc === null ? "" : repo.billableSloc}`
+      // Upload names are customer-authored, and TSV lands in spreadsheets.
+      (repo) => `${formulaSafe(repoLabel(repo))}	${repo.billableSloc === null ? "" : repo.billableSloc}`
     )
   ];
 }
@@ -43874,7 +44233,7 @@ Examples:
     }
     const codeSize = result.body;
     if (options.output === "json") {
-      console.log(JSON.stringify(codeSize, null, 2));
+      printJson(codeSize);
       return;
     }
     if (options.output === "tsv") {
@@ -44527,7 +44886,7 @@ function parseEmailSince(value) {
 }
 function outputInbox(inbox, output) {
   if (output === "json") {
-    console.log(JSON.stringify(inbox, null, 2));
+    printJson(inbox);
     return;
   }
   if (output === "tsv") {
@@ -44572,7 +44931,7 @@ async function runList2(options) {
   }
   const { inboxes, quota } = result.body;
   if (output === "json") {
-    console.log(JSON.stringify({ inboxes, quota }, null, 2));
+    printJson({ inboxes, quota });
     return;
   }
   if (output === "tsv") {
@@ -44658,7 +45017,7 @@ async function runEmails(label, options) {
   }
   const { address, messages } = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -44694,7 +45053,7 @@ async function runEmail(label, messageId, options) {
     failReadOp2("read email", result.status, result.body, label);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -45204,7 +45563,7 @@ function buildCredentialsTable(creds) {
 }
 function outputCredential(cred, output) {
   if (output === "json") {
-    console.log(JSON.stringify(cred, null, 2));
+    printJson(cred);
     return;
   }
   if (output === "tsv") {
@@ -45404,7 +45763,7 @@ async function runList3(options) {
   }
   const creds = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(creds, null, 2));
+    printJson(creds);
     return;
   }
   if (output === "tsv") {
@@ -45605,7 +45964,7 @@ async function runMfaCode(credentialId, options) {
     failMfaOp("generate a code for", result.status, result.body, credentialId);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -45988,7 +46347,7 @@ function buildEnvironmentsTable(envs) {
 }
 function outputEnvironment(env2, output) {
   if (output === "json") {
-    console.log(JSON.stringify(env2, null, 2));
+    printJson(env2);
     return;
   }
   if (output === "tsv") {
@@ -46110,7 +46469,7 @@ async function runListAcrossOrganization(output, pager) {
     createOrgEnvironmentRequests(organizationId)
   );
   if (output === "json") {
-    console.log(JSON.stringify(envs, null, 2));
+    printJson(envs);
     return;
   }
   if (output === "tsv") {
@@ -46150,7 +46509,7 @@ async function runList4(options) {
   }
   const envs = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(envs, null, 2));
+    printJson(envs);
     return;
   }
   if (output === "tsv") {
@@ -46644,7 +47003,7 @@ async function runCreateFinding(options) {
     failCreateFinding(result.status, result.body, options.pentest);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   printCreatedFinding({
@@ -46657,185 +47016,159 @@ async function runCreateFinding(options) {
   });
 }
 function createCreateFindingCommand() {
-  return new Command("create").description("Create a pentest finding from a contractor write-up (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <text>", "Finding title").option("--description <text>", "Finding description").option("--description-file <path>", "Read description from a file").option("--severity <severity>", `Severity (${SEVERITY_LIST})`).option("--category <text>", "Finding category (e.g. Broken Access Control)").option("--cwe <id>", "CWE identifier (repeatable)", collectCwe).option("--cvss-vector <vector>", "CVSS v3 vector string").option("--cvss-score <n>", "CVSS base score (0\u201310)").option("--owasp <category>", "OWASP category").option("--poc <text>", "Proof of concept").option("--poc-file <path>", "Read proof of concept from a file").option("--remediation <text>", "Remediation guidance").option("--remediation-file <path>", "Read remediation from a file").option("--file <path>", "JSON object of finding fields; flags override").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+  return new Command("create").description("Create a pentest finding from a contractor write-up (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <text>", "Finding title").option("--description <text>", "Finding description").option("--description-file <path>", "Read description from a file").option("--severity <severity>", `Severity (${SEVERITY_LIST})`).option("--category <text>", "Finding category (e.g. Broken Access Control)").option("--cwe <id>", "CWE identifier (repeatable)", collectCwe).option(
+    "--cvss-vector <vector>",
+    "CVSS base vector (CVSS:3.1/... or CVSS:4.0/...); the score is derived server-side"
+  ).option("--cvss-score <n>", "Ignored: the score is derived from --cvss-vector").option("--owasp <category>", "OWASP category").option("--poc <text>", "Proof of concept").option("--poc-file <path>", "Read proof of concept from a file").option("--remediation <text>", "Remediation guidance").option("--remediation-file <path>", "Read remediation from a file").option("--file <path>", "JSON object of finding fields; flags override").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
     await runCreateFinding(options);
   });
 }
 
-// src/pentest/evidence.ts
-import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+// src/pentest/deliverables.ts
+import { open as open2, rename, rm, stat } from "fs/promises";
+import { basename as basename3, join as join6, resolve } from "path";
+
+// src/upload/prepare.ts
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync3 } from "fs";
+import { open } from "fs/promises";
 import { basename as basename2 } from "path";
-var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
-var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
-function isSection(value) {
-  return ValidationEvidenceSectionValues.includes(value);
+var CodeUploadPrepareError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadPrepareError";
+  }
+};
+var KIND_BY_INPUT = {
+  source: "SOURCE_ARCHIVE",
+  code: "SOURCE_ARCHIVE",
+  "source-archive": "SOURCE_ARCHIVE",
+  source_archive: "SOURCE_ARCHIVE",
+  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
+  apk: "ANDROID_APK",
+  android: "ANDROID_APK",
+  "android-apk": "ANDROID_APK",
+  android_apk: "ANDROID_APK",
+  ANDROID_APK: "ANDROID_APK",
+  ipa: "IOS_IPA",
+  ios: "IOS_IPA",
+  "ios-ipa": "IOS_IPA",
+  ios_ipa: "IOS_IPA",
+  IOS_IPA: "IOS_IPA"
+};
+function normalizeArtifactKind(input) {
+  const trimmed = input.trim();
+  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
 }
-function isKind(value) {
-  return PentestExploitArtifactKindValues.includes(value);
+function inferArtifactKindFromFilename(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
+  if (lower.endsWith(".apk")) return "ANDROID_APK";
+  if (lower.endsWith(".ipa")) return "IOS_IPA";
+  return null;
 }
-function formatBytes2(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+function requiredExtensionForKind(kind) {
+  if (kind === "ANDROID_APK") return ".apk";
+  if (kind === "IOS_IPA") return ".ipa";
+  return ".zip";
 }
-async function resolveFindingId(organizationId, pentestId, identifier) {
-  if (isUuid(identifier)) {
-    return identifier;
+function defaultDisplayName(originalFilename) {
+  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base.slice(0, 200) || "source";
+}
+function formatArchiveBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) {
+    const kb = bytes / 1024;
+    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
   }
-  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
-  if (!numericMatch?.[1]) {
-    console.error(
-      colorError(
-        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
-      )
-    );
-    process.exit(1);
-  }
-  const displayId = Number.parseInt(numericMatch[1], 10);
-  const result = await authenticatedRequest(
-    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
-  );
-  if (result.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
+  if (bytes < 1024 * 1024 * 1024) {
+    const mb = bytes / (1024 * 1024);
+    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
   }
-  if (result.status !== 200) {
-    console.error(colorError(`Failed to list findings (status ${result.status}).`));
-    process.exit(1);
+  const gb = bytes / (1024 * 1024 * 1024);
+  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
+}
+function archiveTooLargeMessage() {
+  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
+}
+async function hashFileSha256(filePath) {
+  const hash2 = createHash("sha256");
+  const stream = createReadStream(filePath);
+  for await (const chunk of stream) {
+    hash2.update(chunk);
   }
-  const match = result.body.find((f) => f.displayId === displayId);
-  if (!match || !("pentestFindingId" in match)) {
-    console.error(
-      colorError(
-        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
-      )
+  return hash2.digest("hex");
+}
+async function readFileSlice(filePath, start, endExclusive) {
+  const length = endExclusive - start;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
+    throw new Error(
+      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
     );
-    process.exit(1);
   }
-  return match.pentestFindingId;
-}
-async function runAttachEvidence(options) {
-  if (options.section !== void 0 && !isSection(options.section)) {
-    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
-    console.error(`Valid sections: ${SECTION_LIST}`);
-    process.exit(1);
+  const buffer = Buffer.alloc(length);
+  const handle = await open(filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    if (bytesRead !== length) {
+      throw new Error(
+        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
+      );
+    }
+    return buffer;
+  } finally {
+    await handle.close();
   }
-  if (options.kind !== void 0 && !isKind(options.kind)) {
-    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
-    console.error(`Valid kinds: ${KIND_LIST}`);
-    process.exit(1);
+}
+function assertPreparedMatchesUpload(upload, prepared) {
+  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
+    throw new CodeUploadPrepareError(
+      "The file does not match the interrupted upload (size or SHA-256 differs)."
+    );
   }
+}
+async function prepareUploadFile(filePath, options = {}) {
   let sizeBytes;
   try {
-    const stats = statSync3(options.file);
+    const stats = statSync3(filePath);
     if (!stats.isFile()) {
-      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
-      process.exit(1);
+      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
     }
     sizeBytes = stats.size;
-  } catch {
-    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
-    process.exit(1);
-  }
-  if (sizeBytes === 0) {
-    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
-    process.exit(1);
-  }
-  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
-    console.error(
-      colorError(
-        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
-      )
-    );
-    process.exit(1);
-  }
-  const organizationId = await resolveOrganizationId();
-  const pentestId = await resolvePentestId(organizationId, options.pentest);
-  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
-  const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename2(options.file);
-  const slot = await authenticatedRequest(
-    (client) => client.pentestFinding.createFindingEvidenceUpload({
-      params,
-      body: { filename, sizeBytes }
-    })
-  );
-  if (slot.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (slot.status !== 201) {
-    const { message } = readErrorFields(slot.body);
-    console.error(
-      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
-    );
-    process.exit(1);
+  } catch (error48) {
+    if (error48 instanceof CodeUploadPrepareError) throw error48;
+    throw new CodeUploadPrepareError("Cannot read that file.");
   }
-  const body = readFileSync6(options.file);
-  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
-  if (!put.ok) {
-    console.error(
-      colorError(
-        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
-      )
-    );
-    process.exit(1);
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
+    throw new CodeUploadPrepareError("The file is empty.");
   }
-  const attached = await authenticatedRequest(
-    (client) => client.pentestFinding.attachFindingEvidence({
-      params,
-      body: {
-        key: slot.body.key,
-        ...options.caption !== void 0 ? { caption: options.caption } : {},
-        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
-        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
-        ...options.customerFacing ? { customerFacing: true } : {}
-      }
-    })
-  );
-  if (attached.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
+  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
+    throw new CodeUploadPrepareError(archiveTooLargeMessage());
   }
-  if (attached.status !== 201) {
-    const { message } = readErrorFields(attached.body);
-    console.error(
-      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
-    );
-    process.exit(1);
+  const originalFilename = basename2(filePath);
+  const inferred = inferArtifactKindFromFilename(originalFilename);
+  const artifactKind = options.artifactKind ?? inferred;
+  if (artifactKind == null) {
+    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
   }
-  if (options.output === "json") {
-    console.log(JSON.stringify(attached.body, null, 2));
-    return;
+  const expected = requiredExtensionForKind(artifactKind);
+  if (!originalFilename.toLowerCase().endsWith(expected)) {
+    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
+    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
   }
-  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
-  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
-  console.log(
-    colorSuccess(
-      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
-    )
-  );
-  console.log(`  artifact ${attached.body.artifactId}`);
-  if (attached.body.kind === "HAR") {
-    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
-  } else if (!attached.body.customerFacing) {
-    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
+  if (displayName.length < 1 || displayName.length > 200) {
+    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
   }
-}
-function createAttachEvidenceCommand() {
-  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
-    "after",
-    `
-The file uploads straight to storage, so recordings of any reasonable size work.
-Videos and HAR captures always land staff-internal \u2014 publish a video with the
-toggle in the staff console's evidence panel after reviewing it for redaction.
-
-Examples:
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
-    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
-    --caption "Full member roster returned to a non-member" --customer-facing --output json`
-  ).action(async (options) => {
-    await runAttachEvidence(options);
-  });
+  return {
+    path: filePath,
+    displayName,
+    originalFilename,
+    sizeBytes,
+    archiveSha256: await hashFileSha256(filePath),
+    artifactKind
+  };
 }
 
 // src/pentest/status-update.ts
@@ -46958,64 +47291,734 @@ async function runStatusUpdate(options) {
     );
     process.exit(1);
   }
-  const viaApiKey = requireAuth().kind === "api_key";
-  const organizationId = await resolveOrganizationId();
-  const params = {
-    organizationId,
-    pentestId: options.pentest,
-    pentestFindingId: options.finding
-  };
-  const result = viaApiKey ? await authenticatedRequest(
-    (client) => client.pentestFinding.automationStatusUpdate({
-      params,
-      body: { status: target, ...note !== void 0 ? { note } : {} }
-    })
-  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
-    (client) => client.pentestFinding.startProgress({ params, body: {} })
-  ) : await authenticatedRequest(
-    (client) => client.pentestFinding.reportRemediation({
+  const viaApiKey = requireAuth().kind === "api_key";
+  const organizationId = await resolveOrganizationId();
+  const params = {
+    organizationId,
+    pentestId: options.pentest,
+    pentestFindingId: options.finding
+  };
+  const result = viaApiKey ? await authenticatedRequest(
+    (client) => client.pentestFinding.automationStatusUpdate({
+      params,
+      body: { status: target, ...note !== void 0 ? { note } : {} }
+    })
+  ) : target === "IN_PROGRESS" ? await authenticatedRequest(
+    (client) => client.pentestFinding.startProgress({ params, body: {} })
+  ) : await authenticatedRequest(
+    (client) => client.pentestFinding.reportRemediation({
+      params,
+      body: note !== void 0 ? { note } : {}
+    })
+  );
+  if (result.status !== 200) {
+    failStatusUpdate(result.status, result.body, viaApiKey);
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const displayId = result.body.displayId;
+  const status = sanitizeDisplay(result.body.status);
+  console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
+}
+function createStatusUpdateCommand() {
+  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
+    "--status <status>",
+    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
+  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
+can mark a finding in progress when it starts the fix, then remediated when the
+fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
+sending REMEDIATED) keeps it out of the retest queue.
+
+IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
+OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+
+A signed-in session (\`tracecli auth login\`) attributes the change to you. A
+Trace API key works too, once Trace enables finding automation for your
+organization: those writes are recorded as \`api-key:<key name>\` and show up as
+yours in the finding's history.
+
+Examples:
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
+  tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
+    --note "Fixed in PR 412" --output json`
+  ).action(async (options) => {
+    await runStatusUpdate(options);
+  });
+}
+
+// src/pentest/deliverables.ts
+var PentestDeliverableDownloadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PentestDeliverableDownloadError";
+  }
+};
+function safeDeliverableFilename(documentId, extension, fallbackStem) {
+  const stripped = Array.from(basename3(documentId.replace(/\\/g, "/")), (char) => {
+    const code = char.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127 ? "_" : char;
+  }).join("").trim();
+  const stem = stripped.length === 0 || stripped === "." || stripped === ".." ? fallbackStem : stripped;
+  return stem.toLowerCase().endsWith(extension) ? stem : `${stem}${extension}`;
+}
+function reportFileName(report, artifact) {
+  if (artifact === "docx") {
+    return safeDeliverableFilename(report.documentId, ".docx", "pentest-report");
+  }
+  const extension = report.downloadFormat === "bundle" ? ".zip" : ".pdf";
+  return safeDeliverableFilename(report.documentId, extension, "pentest-report");
+}
+function attestationFileName(attestation) {
+  return safeDeliverableFilename(attestation.documentId, ".pdf", "letter-of-attestation");
+}
+async function resolveDeliverableDestination(fileName, outOption) {
+  if (outOption === void 0) return resolve(process.cwd(), fileName);
+  const target = resolve(outOption);
+  try {
+    const info = await stat(target);
+    if (info.isDirectory()) return join6(target, fileName);
+  } catch {
+  }
+  return target;
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downloadDeliverableToFile(downloadUrl, destination, options = {}) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const partialPath = `${destination}.part`;
+  let response;
+  try {
+    response = await fetchImpl(downloadUrl, { method: "GET", redirect: "manual" });
+  } catch (error48) {
+    const detail = error48 instanceof Error ? error48.message : "network error";
+    throw new PentestDeliverableDownloadError(`Download from storage failed: ${detail}.`);
+  }
+  if (!response.ok || response.body === null) {
+    if (response.body !== null) await response.body.cancel();
+    throw new PentestDeliverableDownloadError(
+      `Storage answered HTTP ${response.status} instead of the document. Retry; the download link may have expired.`
+    );
+  }
+  const contentLength = response.headers.get("content-length");
+  let totalBytes = null;
+  if (contentLength !== null) {
+    const declared = Number(contentLength);
+    if (!Number.isSafeInteger(declared) || declared < 0) {
+      await response.body.cancel();
+      throw new PentestDeliverableDownloadError(
+        `Storage declared an unreadable Content-Length ('${contentLength}').`
+      );
+    }
+    totalBytes = declared;
+  }
+  await rm(partialPath, { force: true });
+  const file2 = await open2(partialPath, "wx");
+  const reader = response.body.getReader();
+  let downloadedBytes = 0;
+  options.onProgress?.({ downloadedBytes, totalBytes });
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      downloadedBytes += chunk.value.byteLength;
+      if (totalBytes !== null && downloadedBytes > totalBytes) {
+        await reader.cancel();
+        throw new PentestDeliverableDownloadError(
+          `Storage sent more than the ${totalBytes} bytes it declared.`
+        );
+      }
+      await writeAll(file2, chunk.value);
+      options.onProgress?.({ downloadedBytes, totalBytes });
+    }
+    await file2.close();
+    if (totalBytes !== null && downloadedBytes !== totalBytes) {
+      throw new PentestDeliverableDownloadError(
+        `Download ended after ${downloadedBytes} of ${totalBytes} bytes.`
+      );
+    }
+    if (downloadedBytes === 0) {
+      throw new PentestDeliverableDownloadError("Storage returned an empty document.");
+    }
+    await rename(partialPath, destination);
+    return { bytes: downloadedBytes };
+  } catch (error48) {
+    await file2.close().catch(() => void 0);
+    await rm(partialPath, { force: true });
+    if (error48 instanceof PentestDeliverableDownloadError) throw error48;
+    const detail = error48 instanceof Error ? error48.message : "unknown error";
+    throw new PentestDeliverableDownloadError(`Download from storage failed: ${detail}.`);
+  }
+}
+async function writeAll(file2, bytes) {
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
+    if (bytesWritten === 0) {
+      throw new PentestDeliverableDownloadError("Writing the document to disk stalled.");
+    }
+    offset += bytesWritten;
+  }
+}
+var DELIVERABLE_LABEL = {
+  report: "report",
+  attestation: "letter of attestation"
+};
+function requirePentestIdentifier(value) {
+  if (!isPentestIdentifier(value)) {
+    console.error(
+      colorError(`Invalid pentest identifier '${value}'. Use a display ID (e.g. PT-3) or UUID.`)
+    );
+    process.exit(1);
+  }
+}
+function failDeliverable(status, body, deliverable, pentestIdentifier, action) {
+  const { message, errorCode } = readErrorFields(body);
+  const label = DELIVERABLE_LABEL[deliverable];
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        message ?? `You do not have permission to ${action === "list" ? "view" : "download"} ${label}s for this organization.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    if (message === "Report not found") {
+      console.error(
+        colorError(
+          `No report has been shared for pentest ${pentestIdentifier} yet. Trace publishes it to your dashboard when the engagement's report is ready.`
+        )
+      );
+      process.exit(1);
+    }
+    if (message === "Attestation not found") {
+      console.error(
+        colorError(
+          `That letter of attestation is not available for pentest ${pentestIdentifier}. Run \`tracecli pentest attestation list ${pentestIdentifier}\` to see the letters shared with you.`
+        )
+      );
+      process.exit(1);
+    }
+    console.error(
+      colorError(
+        `Pentest '${pentestIdentifier}' not found. Verify the ID with \`tracecli pentest list\`.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "DOCX_NOT_RENDERED") {
+      console.error(
+        colorError(
+          "No Word document is available for this report. Drop --docx to download the PDF."
+        )
+      );
+      process.exit(1);
+    }
+    console.error(colorError(message ?? `Conflict (status ${status}).`));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Failed to ${action} ${label}${action === "list" ? "s" : ""} (status ${status})${message ? `: ${message}` : "."}`
+    )
+  );
+  process.exit(1);
+}
+function writeDownloadProgress(progress3) {
+  if (!process.stderr.isTTY) return;
+  const downloaded = formatArchiveBytes(progress3.downloadedBytes);
+  if (progress3.totalBytes === null || progress3.totalBytes === 0) {
+    process.stderr.write(`\rDownloading ${downloaded}`);
+    return;
+  }
+  const pct = Math.floor(progress3.downloadedBytes / progress3.totalBytes * 100);
+  process.stderr.write(
+    `\rDownloading ${pct}% (${downloaded} / ${formatArchiveBytes(progress3.totalBytes)})`
+  );
+}
+function finishProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+async function saveDeliverable(downloadUrl, fileName, options) {
+  const destination = await resolveDeliverableDestination(fileName, options.out);
+  if (!options.force && await pathExists(destination)) {
+    console.error(
+      colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "table") {
+    console.error(`Downloading ${sanitizeDisplay(fileName)} to ${destination}`);
+  }
+  try {
+    const { bytes } = await downloadDeliverableToFile(downloadUrl, destination, {
+      onProgress: writeDownloadProgress
+    });
+    finishProgress();
+    return { destination, bytes };
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
+    console.error(colorError(detail));
+    process.exit(1);
+  }
+}
+async function runReportDownload(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  const artifact = options.docx ? "docx" : "primary";
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.pentestReportPdf.downloadCustomer({
+      params: { organizationId, pentestId: pentestIdentifier },
+      query: {
+        disposition: "attachment",
+        ...artifact === "docx" ? { artifact: "docx" } : {}
+      }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "report", pentestIdentifier, "download");
+  }
+  const { report, downloadUrl } = result.body;
+  const fileName = reportFileName(report, artifact);
+  const { destination, bytes } = await saveDeliverable(downloadUrl, fileName, {
+    ...options.out !== void 0 ? { out: options.out } : {},
+    ...options.force !== void 0 ? { force: options.force } : {},
+    output
+  });
+  if (output === "json") {
+    printJson({ report, artifact, path: destination, sizeBytes: bytes });
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["documentId", "version", "artifact", "path", "sizeBytes"].join("	"));
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(report.documentId)),
+        tsvSafe(sanitizeDisplay(report.version)),
+        artifact,
+        tsvSafe(destination),
+        String(bytes)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(report.documentId)} (${sanitizeDisplay(report.version)}) to ${destination} (${formatArchiveBytes(bytes)}).`
+    )
+  );
+}
+function createReportDownloadCommand() {
+  return new Command("download").description("Download the pentest report shared with your organization").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("--docx", "Download the Word document instead of the PDF (when your report ships one)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Downloads the report Trace has published for the engagement: the issued version
+when one exists, otherwise the current shared draft. The file is named after the
+report's document ID (for example TR-PT-2026-03-ACME.pdf). Organizations on
+a partner report template receive a zip carrying the PDF, the Word document, the
+markdown report, and evidence files.
+
+Works with a browser session from \`tracecli auth login\` or a Trace API key
+(TRACE_API_KEY), so it can run unattended in CI.
+
+Examples:
+  tracecli pentest report download PT-3
+  tracecli pentest report download PT-3 --out ./reports/
+  tracecli pentest report download PT-3 --out ./acme-q3.pdf --force
+  tracecli pentest report download PT-3 --docx
+  tracecli pentest report download PT-3 --output json | jq '.path'`
+  ).action(async (pentestId, options) => {
+    await runReportDownload(pentestId, options);
+  });
+}
+function createReportCommand() {
+  const report = new Command("report").description("Download the pentest report");
+  report.addCommand(createReportDownloadCommand());
+  return report;
+}
+function sortAttestationsNewestFirst(attestations) {
+  return [...attestations].sort((a2, b) => {
+    const delta = new Date(b.createdAt).getTime() - new Date(a2.createdAt).getTime();
+    return delta !== 0 ? delta : a2.attestationId.localeCompare(b.attestationId);
+  });
+}
+function renderAttestationLines(attestation) {
+  const counts = attestation.severityCounts;
+  return [
+    `  ${sanitizeDisplay(attestation.documentId)} (${sanitizeDisplay(attestation.version)}, ${sanitizeDisplay(attestation.classification)})`,
+    `          Issued: ${formatDate(attestation.issuedDate)} | Findings: ${attestation.totalFindings} (C${counts.critical} H${counts.high} M${counts.medium} L${counts.low} I${counts.info}) | ${formatArchiveBytes(attestation.fileSizeBytes)}`,
+    `          ID: ${attestation.attestationId}`,
+    ""
+  ];
+}
+var ATTESTATION_TSV_HEADER = [
+  "attestationId",
+  "documentId",
+  "version",
+  "classification",
+  "issuedDate",
+  "totalFindings",
+  "fileSizeBytes",
+  "createdAt"
+].join("	");
+function attestationTsvRow(attestation) {
+  return [
+    attestation.attestationId,
+    tsvSafe(sanitizeDisplay(attestation.documentId)),
+    tsvSafe(sanitizeDisplay(attestation.version)),
+    tsvSafe(sanitizeDisplay(attestation.classification)),
+    attestation.issuedDate,
+    String(attestation.totalFindings),
+    String(attestation.fileSizeBytes),
+    toIso(attestation.createdAt)
+  ].join("	");
+}
+async function fetchAttestations(organizationId, pentestIdentifier) {
+  const result = await authenticatedRequest(
+    (client) => client.pentestAttestation.listCustomerAttestations({
+      params: { organizationId, pentestId: pentestIdentifier }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "attestation", pentestIdentifier, "list");
+  }
+  return sortAttestationsNewestFirst(result.body.attestations);
+}
+async function runAttestationList(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  const organizationId = await resolveOrganizationId();
+  const attestations = await fetchAttestations(organizationId, pentestIdentifier);
+  if (output === "json") {
+    printJson(attestations);
+    return;
+  }
+  if (output === "tsv") {
+    console.log(ATTESTATION_TSV_HEADER);
+    for (const attestation of attestations) {
+      console.log(attestationTsvRow(attestation));
+    }
+    return;
+  }
+  if (attestations.length === 0) {
+    console.log(`No letters of attestation have been shared for pentest ${pentestIdentifier}.`);
+    return;
+  }
+  const header = `Found ${attestations.length} letter${attestations.length === 1 ? "" : "s"} of attestation (newest first):`;
+  await runInteractivePager({
+    items: attestations,
+    header,
+    renderItem: (attestation) => renderAttestationLines(attestation),
+    disabled: options.pager === false
+  });
+}
+function createAttestationListCommand() {
+  return new Command("list").description("List the letters of attestation shared for a pentest").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive arrow-key pager for table output").addHelpText(
+    "after",
+    `
+Works with a browser session from \`tracecli auth login\` or a Trace API key
+(TRACE_API_KEY).
+
+Examples:
+  tracecli pentest attestation list PT-3
+  tracecli pentest attestation list PT-3 --output json | jq '.[0].attestationId'
+  tracecli pentest attestation list PT-3 --output tsv | cut -f1,2`
+  ).action(async (pentestId, options) => {
+    await runAttestationList(pentestId, options);
+  });
+}
+async function runAttestationDownload(pentestIdentifier, options) {
+  const output = parseOutput(options.output);
+  requirePentestIdentifier(pentestIdentifier);
+  if (options.attestation !== void 0 && !isUuid(options.attestation)) {
+    console.error(
+      colorError(
+        `Invalid --attestation '${options.attestation}'. Pass the UUID shown by \`tracecli pentest attestation list ${pentestIdentifier}\`.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  let attestationId = options.attestation;
+  if (attestationId === void 0) {
+    const attestations = await fetchAttestations(organizationId, pentestIdentifier);
+    const newest = attestations[0];
+    if (newest === void 0) {
+      console.error(
+        colorError(
+          `No letters of attestation have been shared for pentest ${pentestIdentifier} yet.`
+        )
+      );
+      process.exit(1);
+    }
+    if (attestations.length > 1 && output === "table") {
+      console.error(
+        `Downloading the newest of ${attestations.length} letters (${sanitizeDisplay(newest.documentId)}). Pass --attestation <id> for another.`
+      );
+    }
+    attestationId = newest.attestationId;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.pentestAttestation.downloadCustomerAttestation({
+      params: { organizationId, pentestId: pentestIdentifier, attestationId },
+      query: { disposition: "attachment" }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDeliverable(result.status, result.body, "attestation", pentestIdentifier, "download");
+  }
+  const { attestation, downloadUrl } = result.body;
+  const fileName = attestationFileName(attestation);
+  const { destination, bytes } = await saveDeliverable(downloadUrl, fileName, {
+    ...options.out !== void 0 ? { out: options.out } : {},
+    ...options.force !== void 0 ? { force: options.force } : {},
+    output
+  });
+  if (output === "json") {
+    printJson({ attestation, path: destination, sizeBytes: bytes });
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["attestationId", "documentId", "version", "path", "sizeBytes"].join("	"));
+    console.log(
+      [
+        attestation.attestationId,
+        tsvSafe(sanitizeDisplay(attestation.documentId)),
+        tsvSafe(sanitizeDisplay(attestation.version)),
+        tsvSafe(destination),
+        String(bytes)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(attestation.documentId)} (${sanitizeDisplay(attestation.version)}) to ${destination} (${formatArchiveBytes(bytes)}).`
+    )
+  );
+}
+function createAttestationDownloadCommand() {
+  return new Command("download").description("Download a letter of attestation (newest by default)").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option(
+    "--attestation <id>",
+    "Attestation UUID from `pentest attestation list` (default: the newest letter)"
+  ).option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The file is named after the letter's document ID (for example
+TR-LOA-2026-03-ACME-1A2B3C.pdf). Works with a browser session from \`tracecli auth
+login\` or a Trace API key (TRACE_API_KEY), so it can run unattended in CI.
+
+Examples:
+  tracecli pentest attestation download PT-3
+  tracecli pentest attestation download PT-3 --out ./compliance/
+  tracecli pentest attestation download PT-3 --attestation 6f1c... --out ./loa.pdf --force
+  tracecli pentest attestation download PT-3 --output json | jq '.path'`
+  ).action(async (pentestId, options) => {
+    await runAttestationDownload(pentestId, options);
+  });
+}
+function createAttestationCommand() {
+  const attestation = new Command("attestation").alias("loa").description("List and download letters of attestation");
+  attestation.addCommand(createAttestationListCommand());
+  attestation.addCommand(createAttestationDownloadCommand());
+  return attestation;
+}
+
+// src/pentest/evidence.ts
+import { readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { basename as basename4 } from "path";
+var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
+var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
+function isSection(value) {
+  return ValidationEvidenceSectionValues.includes(value);
+}
+function isKind(value) {
+  return PentestExploitArtifactKindValues.includes(value);
+}
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function resolveFindingId(organizationId, pentestId, identifier) {
+  if (isUuid(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list findings (status ${result.status}).`));
+    process.exit(1);
+  }
+  const match = result.body.find((f) => f.displayId === displayId);
+  if (!match || !("pentestFindingId" in match)) {
+    console.error(
+      colorError(
+        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
+      )
+    );
+    process.exit(1);
+  }
+  return match.pentestFindingId;
+}
+async function runAttachEvidence(options) {
+  if (options.section !== void 0 && !isSection(options.section)) {
+    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
+    console.error(`Valid sections: ${SECTION_LIST}`);
+    process.exit(1);
+  }
+  if (options.kind !== void 0 && !isKind(options.kind)) {
+    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
+    console.error(`Valid kinds: ${KIND_LIST}`);
+    process.exit(1);
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync4(options.file);
+    if (!stats.isFile()) {
+      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
+      process.exit(1);
+    }
+    sizeBytes = stats.size;
+  } catch {
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
+    process.exit(1);
+  }
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
+    process.exit(1);
+  }
+  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
+    console.error(
+      colorError(
+        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+  const params = { organizationId, pentestId, pentestFindingId };
+  const filename = basename4(options.file);
+  const slot = await authenticatedRequest(
+    (client) => client.pentestFinding.createFindingEvidenceUpload({
+      params,
+      body: { filename, sizeBytes }
+    })
+  );
+  if (slot.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (slot.status !== 201) {
+    const { message } = readErrorFields(slot.body);
+    console.error(
+      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
+    );
+    process.exit(1);
+  }
+  const body = readFileSync6(options.file);
+  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  const attached = await authenticatedRequest(
+    (client) => client.pentestFinding.attachFindingEvidence({
       params,
-      body: note !== void 0 ? { note } : {}
+      body: {
+        key: slot.body.key,
+        ...options.caption !== void 0 ? { caption: options.caption } : {},
+        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
+        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
+        ...options.customerFacing ? { customerFacing: true } : {}
+      }
     })
   );
-  if (result.status !== 200) {
-    failStatusUpdate(result.status, result.body, viaApiKey);
+  if (attached.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (attached.status !== 201) {
+    const { message } = readErrorFields(attached.body);
+    console.error(
+      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
+    );
+    process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(attached.body);
     return;
   }
-  const displayId = result.body.displayId;
-  const status = sanitizeDisplay(result.body.status);
-  console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
+  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
+  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
+  console.log(
+    colorSuccess(
+      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+    )
+  );
+  console.log(`  artifact ${attached.body.artifactId}`);
+  if (attached.body.kind === "HAR") {
+    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
+  } else if (!attached.body.customerFacing) {
+    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  }
 }
-function createStatusUpdateCommand() {
-  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
-    "--status <status>",
-    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
-  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+function createAttachEvidenceCommand() {
+  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
     "after",
     `
-Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
-can mark a finding in progress when it starts the fix, then remediated when the
-fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
-sending REMEDIATED) keeps it out of the retest queue.
-
-IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN.
-
-A signed-in session (\`tracecli auth login\`) attributes the change to you. A
-Trace API key works too, once Trace enables finding automation for your
-organization: those writes are recorded as \`api-key:<key name>\` and show up as
-yours in the finding's history.
+The file uploads straight to storage, so recordings of any reasonable size work.
+Videos and HAR captures always land staff-internal \u2014 publish a video with the
+toggle in the staff console's evidence panel after reviewing it for redaction.
 
 Examples:
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
-  tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
-    --note "Fixed in PR 412" --output json`
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
+    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
+    --caption "Full member roster returned to a non-member" --customer-facing --output json`
   ).action(async (options) => {
-    await runStatusUpdate(options);
+    await runAttachEvidence(options);
   });
 }
 
@@ -47136,7 +48139,7 @@ async function runGetFinding(options) {
     failGetFinding(result.status, result.body);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   process.stdout.write(formatFindingMarkdown(result.body));
@@ -47377,7 +48380,7 @@ Examples:
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(pentests, null, 2));
+        printJson(pentests);
         return;
       }
       if (isTsv) {
@@ -47526,7 +48529,7 @@ Re-run with: tracecli pentest findings list --pentest ${options.pentest} --detai
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(findings, null, 2));
+        printJson(findings);
         return;
       }
       if (isTsv) {
@@ -47619,7 +48622,7 @@ async function runFindingsDetailPull(organizationId, options) {
     }
     return { findings: result.body.findings, total: result.body.total };
   }, options);
-  console.log(JSON.stringify(matching, null, 2));
+  printJson(matching);
 }
 function renderPentestFindingLines(finding) {
   const sev = formatFindingSeverity(finding.severity);
@@ -47780,7 +48783,7 @@ function printPentestUpdateTsv(pt) {
 }
 function outputPentestUpdate(pt, output) {
   if (output === "json") {
-    console.log(JSON.stringify(pt, null, 2));
+    printJson(pt);
     return;
   }
   if (output === "tsv") {
@@ -48130,12 +49133,14 @@ function createPentestCommand() {
   pentest.addCommand(createUpdateCommand4());
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
+  pentest.addCommand(createReportCommand());
+  pentest.addCommand(createAttestationCommand());
   return pentest;
 }
 
 // src/update/commands.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
 var UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -48144,7 +49149,7 @@ var DISABLE_UPDATE_NOTIFIER_ENV = "TRACECLI_DISABLE_UPDATE_NOTIFIER";
 var REGISTRY_URL_ENV = "TRACECLI_NPM_REGISTRY_URL";
 var noticePrinted = false;
 function getUpdateCheckCachePath() {
-  return join6(getTraceDir(), UPDATE_CACHE_FILE);
+  return join7(getTraceDir(), UPDATE_CACHE_FILE);
 }
 function readUpdateCheckCache() {
   const cachePath = getUpdateCheckCachePath();
@@ -48518,153 +49523,8 @@ Examples:
 
 // src/upload/download.ts
 import { createHash as createHash2 } from "crypto";
-import { open as open2, rename, rm, stat } from "fs/promises";
-import { basename as basename4, join as join7, resolve } from "path";
-
-// src/upload/prepare.ts
-import { createHash } from "crypto";
-import { createReadStream, statSync as statSync4 } from "fs";
-import { open } from "fs/promises";
-import { basename as basename3 } from "path";
-var CodeUploadPrepareError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CodeUploadPrepareError";
-  }
-};
-var KIND_BY_INPUT = {
-  source: "SOURCE_ARCHIVE",
-  code: "SOURCE_ARCHIVE",
-  "source-archive": "SOURCE_ARCHIVE",
-  source_archive: "SOURCE_ARCHIVE",
-  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
-  apk: "ANDROID_APK",
-  android: "ANDROID_APK",
-  "android-apk": "ANDROID_APK",
-  android_apk: "ANDROID_APK",
-  ANDROID_APK: "ANDROID_APK",
-  ipa: "IOS_IPA",
-  ios: "IOS_IPA",
-  "ios-ipa": "IOS_IPA",
-  ios_ipa: "IOS_IPA",
-  IOS_IPA: "IOS_IPA"
-};
-function normalizeArtifactKind(input) {
-  const trimmed = input.trim();
-  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
-}
-function inferArtifactKindFromFilename(filename) {
-  const lower = filename.toLowerCase();
-  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
-  if (lower.endsWith(".apk")) return "ANDROID_APK";
-  if (lower.endsWith(".ipa")) return "IOS_IPA";
-  return null;
-}
-function requiredExtensionForKind(kind) {
-  if (kind === "ANDROID_APK") return ".apk";
-  if (kind === "IOS_IPA") return ".ipa";
-  return ".zip";
-}
-function defaultDisplayName(originalFilename) {
-  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
-  return base.slice(0, 200) || "source";
-}
-function formatArchiveBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) {
-    const kb = bytes / 1024;
-    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
-  }
-  if (bytes < 1024 * 1024 * 1024) {
-    const mb = bytes / (1024 * 1024);
-    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
-  }
-  const gb = bytes / (1024 * 1024 * 1024);
-  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
-}
-function archiveTooLargeMessage() {
-  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
-}
-async function hashFileSha256(filePath) {
-  const hash2 = createHash("sha256");
-  const stream = createReadStream(filePath);
-  for await (const chunk of stream) {
-    hash2.update(chunk);
-  }
-  return hash2.digest("hex");
-}
-async function readFileSlice(filePath, start, endExclusive) {
-  const length = endExclusive - start;
-  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
-    throw new Error(
-      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
-    );
-  }
-  const buffer = Buffer.alloc(length);
-  const handle = await open(filePath, "r");
-  try {
-    const { bytesRead } = await handle.read(buffer, 0, length, start);
-    if (bytesRead !== length) {
-      throw new Error(
-        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
-      );
-    }
-    return buffer;
-  } finally {
-    await handle.close();
-  }
-}
-function assertPreparedMatchesUpload(upload, prepared) {
-  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
-    throw new CodeUploadPrepareError(
-      "The file does not match the interrupted upload (size or SHA-256 differs)."
-    );
-  }
-}
-async function prepareUploadFile(filePath, options = {}) {
-  let sizeBytes;
-  try {
-    const stats = statSync4(filePath);
-    if (!stats.isFile()) {
-      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
-    }
-    sizeBytes = stats.size;
-  } catch (error48) {
-    if (error48 instanceof CodeUploadPrepareError) throw error48;
-    throw new CodeUploadPrepareError("Cannot read that file.");
-  }
-  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
-    throw new CodeUploadPrepareError("The file is empty.");
-  }
-  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
-    throw new CodeUploadPrepareError(archiveTooLargeMessage());
-  }
-  const originalFilename = basename3(filePath);
-  const inferred = inferArtifactKindFromFilename(originalFilename);
-  const artifactKind = options.artifactKind ?? inferred;
-  if (artifactKind == null) {
-    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
-  }
-  const expected = requiredExtensionForKind(artifactKind);
-  if (!originalFilename.toLowerCase().endsWith(expected)) {
-    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
-    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
-  }
-  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
-  if (displayName.length < 1 || displayName.length > 200) {
-    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
-  }
-  return {
-    path: filePath,
-    displayName,
-    originalFilename,
-    sizeBytes,
-    archiveSha256: await hashFileSha256(filePath),
-    artifactKind
-  };
-}
-
-// src/upload/download.ts
+import { open as open3, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
+import { basename as basename5, join as join8, resolve as resolve2 } from "path";
 var CodeUploadDownloadError = class extends Error {
   constructor(message) {
     super(message);
@@ -48674,7 +49534,7 @@ var CodeUploadDownloadError = class extends Error {
 function safeDownloadFilename(upload) {
   const extension = requiredExtensionForKind(upload.artifactKind);
   const fallback = `app${extension}`;
-  const stripped = Array.from(basename4(upload.originalFilename.replace(/\\/g, "/")), (char) => {
+  const stripped = Array.from(basename5(upload.originalFilename.replace(/\\/g, "/")), (char) => {
     const code = char.codePointAt(0) ?? 0;
     return code <= 31 || code === 127 ? "_" : char;
   }).join("").trim();
@@ -48683,18 +49543,18 @@ function safeDownloadFilename(upload) {
 }
 async function resolveDownloadDestination(upload, outOption) {
   const filename = safeDownloadFilename(upload);
-  if (outOption === void 0) return resolve(process.cwd(), filename);
-  const target = resolve(outOption);
+  if (outOption === void 0) return resolve2(process.cwd(), filename);
+  const target = resolve2(outOption);
   try {
-    const info = await stat(target);
-    if (info.isDirectory()) return join7(target, filename);
+    const info = await stat2(target);
+    if (info.isDirectory()) return join8(target, filename);
   } catch {
   }
   return target;
 }
-async function pathExists(path) {
+async function pathExists2(path) {
   try {
-    await stat(path);
+    await stat2(path);
     return true;
   } catch {
     return false;
@@ -48726,8 +49586,8 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
       );
     }
   }
-  await rm(partialPath, { force: true });
-  const file2 = await open2(partialPath, "wx");
+  await rm2(partialPath, { force: true });
+  const file2 = await open3(partialPath, "wx");
   const hash2 = createHash2("sha256");
   const reader = response.body.getReader();
   let downloadedBytes = 0;
@@ -48744,7 +49604,7 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
         );
       }
       hash2.update(chunk.value);
-      await writeAll(file2, chunk.value);
+      await writeAll2(file2, chunk.value);
       options.onProgress?.(progress(downloadedBytes, upload.sizeBytes));
     }
     await file2.close();
@@ -48759,10 +49619,10 @@ async function downloadCodeUploadToFile(upload, downloadUrl, destination, option
         "Downloaded bytes do not match the SHA-256 recorded at upload time."
       );
     }
-    await rename(partialPath, destination);
+    await rename2(partialPath, destination);
   } catch (error48) {
     await file2.close().catch(() => void 0);
-    await rm(partialPath, { force: true });
+    await rm2(partialPath, { force: true });
     if (error48 instanceof CodeUploadDownloadError) throw error48;
     const detail = error48 instanceof Error ? error48.message : "unknown error";
     throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
@@ -48775,7 +49635,7 @@ function progress(downloadedBytes, totalBytes) {
     fraction: totalBytes === 0 ? 1 : downloadedBytes / totalBytes
   };
 }
-async function writeAll(file2, bytes) {
+async function writeAll2(file2, bytes) {
   let offset = 0;
   while (offset < bytes.byteLength) {
     const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
@@ -48911,13 +49771,13 @@ function progress2(uploadedBytes, totalBytes) {
   };
 }
 function defaultWait(milliseconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
 }
 
 // src/upload/commands.ts
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
 var DEFAULT_RUNTIME = {
-  wait: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
+  wait: (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds)),
   pollIntervalMs: 3e3,
   fetch: (input, init) => globalThis.fetch(input, init)
 };
@@ -49157,7 +50017,7 @@ function printUploadsTsv(uploads) {
 }
 function outputUpload(upload, output) {
   if (output === "json") {
-    console.log(JSON.stringify(upload, null, 2));
+    printJson(upload);
     return;
   }
   if (output === "tsv") {
@@ -49173,14 +50033,14 @@ function writeProgress(progress3) {
     `\rUploading ${pct}% (${formatArchiveBytes(progress3.uploadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
-function writeDownloadProgress(progress3) {
+function writeDownloadProgress2(progress3) {
   if (!process.stderr.isTTY) return;
   const pct = Math.floor(progress3.fraction * 100);
   process.stderr.write(
     `\rDownloading ${pct}% (${formatArchiveBytes(progress3.downloadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
-function finishProgress() {
+function finishProgress2() {
   if (process.stderr.isTTY) process.stderr.write("\n");
 }
 async function listUploads(organizationId, query = {}) {
@@ -49310,9 +50170,9 @@ async function runTransfer(filePath, options, runtime) {
         refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
       }
     );
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
     console.error(colorError(detail));
     console.error(resumeHint(codeUploadId, filePath));
@@ -49425,9 +50285,9 @@ async function runResume(codeUploadIdArg, filePath, options, runtime) {
         refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
       }
     );
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
     console.error(colorError(detail));
     console.error(resumeHint(codeUploadId, filePath));
@@ -49465,7 +50325,7 @@ async function runList5(options) {
     ...applicationId !== void 0 ? { applicationId } : {}
   });
   if (output === "json") {
-    console.log(JSON.stringify({ uploads }, null, 2));
+    printJson({ uploads });
     return;
   }
   if (output === "tsv") {
@@ -49505,7 +50365,7 @@ async function runDownload(codeUploadIdArg, options, runtime) {
   }
   const { upload, downloadUrl } = result.body;
   const destination = await resolveDownloadDestination(upload, options.out);
-  if (!options.force && await pathExists(destination)) {
+  if (!options.force && await pathExists2(destination)) {
     console.error(
       colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
     );
@@ -49519,28 +50379,22 @@ async function runDownload(codeUploadIdArg, options, runtime) {
   try {
     await downloadCodeUploadToFile(upload, downloadUrl, destination, {
       fetch: runtime.fetch,
-      onProgress: writeDownloadProgress
+      onProgress: writeDownloadProgress2
     });
-    finishProgress();
+    finishProgress2();
   } catch (error48) {
-    finishProgress();
+    finishProgress2();
     const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
     console.error(colorError(detail));
     process.exit(1);
   }
   if (output === "json") {
-    console.log(
-      JSON.stringify(
-        {
-          upload,
-          path: destination,
-          sizeBytes: upload.sizeBytes,
-          archiveSha256: upload.archiveSha256
-        },
-        null,
-        2
-      )
-    );
+    printJson({
+      upload,
+      path: destination,
+      sizeBytes: upload.sizeBytes,
+      archiveSha256: upload.archiveSha256
+    });
     return;
   }
   if (output === "tsv") {
@@ -49618,7 +50472,7 @@ async function runLink(options) {
     failWriteOp5("link", result.status, result.body);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -49965,7 +50819,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
       process.exit(1);
     }
     if (options.output === "json") {
-      console.log(JSON.stringify(result.body, null, 2));
+      printJson(result.body);
       return;
     }
     if (options.output === "tsv") {
@@ -50089,7 +50943,7 @@ Examples:
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(items, null, 2));
+        printJson(items);
       } else if (isTsv) {
         printVulnerabilitiesTsv(items);
       } else {