securewithtrace 0.45.0 → 0.46.0

package/dist/index.js

@@ -3695,6 +3695,7 @@ var PENTEST_FINDING_STATUS_VALUES = [
   "REMEDIATED",
   "VERIFIED_FIXED",
   "VERIFIED_OPEN",
+  "PARTIALLY_FIXED",
   "ACCEPTED_WITH_CONTROLS",
   "DISMISSED"
 ];
@@ -6292,7 +6293,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c62) => c62 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c65) => c65 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16336,9 +16337,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c62 = inst._zod.bag;
-  inst.minDate = c62.minimum ? new Date(c62.minimum) : null;
-  inst.maxDate = c62.maximum ? new Date(c62.maximum) : null;
+  const c65 = inst._zod.bag;
+  inst.minDate = c65.minimum ? new Date(c65.minimum) : null;
+  inst.maxDate = c65.maximum ? new Date(c65.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -22162,6 +22163,8 @@ var AgentSessionFailureReasonValues = [
   "INTERNAL"
 ];
 var AgentSessionFailureReason = external_exports.enum(AgentSessionFailureReasonValues);
+var AgentSessionLaunchTargetValues = ["ECS", "LOCAL"];
+var AgentSessionLaunchTarget = external_exports.enum(AgentSessionLaunchTargetValues);
 var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC", "OPENAI"];
 var AgentSessionProvider = external_exports.enum(AgentSessionProviderValues);
 var AgentSessionEventKindValues = [
@@ -22194,6 +22197,9 @@ var MAX_AGENT_SESSION_OBJECTIVE_CHARS = 32e3;
 var CreateAgentSessionCommonSchema = external_exports.object({
   provider: AgentSessionProvider.optional(),
   model: external_exports.string().min(1).max(200).optional(),
+  /** LOCAL leaves the launch for the caller to claim (`claimLocalLaunch`) instead of
+   *  submitting a Fargate task. Staff tooling only; the dashboard never sends it. */
+  launchTarget: AgentSessionLaunchTarget.optional(),
   maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional(),
   maxWallClockMin: external_exports.number().int().positive().max(24 * 60).optional()
 });
@@ -22280,7 +22286,25 @@ var ResumeAgentSessionRequestSchema = external_exports.object({
   /** Budget raise — required to leave WAITING_ON_STAFF(BUDGET_EXHAUSTED). Same
    *  lifetime ceiling as create: a raise past it is not expressible, which is why
    *  the create cap had to move for the engagement-wide validator. */
-  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional()
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional(),
+  /** Move the session between the Fargate path and a staff-claimed local host. Omitted
+   *  keeps the row's current target. */
+  launchTarget: AgentSessionLaunchTarget.optional()
+});
+var ClaimLocalLaunchResponseSchema = external_exports.object({
+  agentSessionId: external_exports.uuid(),
+  runAttemptId: external_exports.uuid(),
+  runVersion: external_exports.number().int().positive(),
+  /** The host image this environment's task definition runs (`<repo>:<assetHash>` in the
+   *  environment's ECR). Null when the environment has no deployed image (the local stack). */
+  imageUri: external_exports.string().nullable(),
+  /** The full container env contract: the same keys the ECS launch passes as container
+   *  overrides (`AGENT_SESSION_*` plus the credential env). Carries the run token, so it is
+   *  returned once and never logged. */
+  env: external_exports.record(external_exports.string(), external_exports.string())
+});
+var LocalHostImageResponseSchema = external_exports.object({
+  imageUri: external_exports.string().nullable()
 });
 var ListAgentSessionEventsQuerySchema = external_exports.object({
   /** Return events with seq > sinceSeq (poll cursor). */
@@ -22315,6 +22339,10 @@ var AgentSessionSummarySchema = external_exports.object({
   launchedAt: external_exports.coerce.date().nullable(),
   lastActivityAt: external_exports.coerce.date().nullable(),
   completedAt: external_exports.coerce.date().nullable(),
+  launchTarget: AgentSessionLaunchTarget,
+  /** Null while parked, and on a LOCAL row until its launch is claimed: LAUNCHING with this
+   *  null on a LOCAL row is "awaiting claim". */
+  taskSubmittedAt: external_exports.coerce.date().nullable(),
   createdById: external_exports.uuid(),
   createdAt: external_exports.coerce.date(),
   updatedAt: external_exports.coerce.date()
@@ -22618,6 +22646,43 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  // The host image this environment's agent-session task definition runs. Reads
+  // config, mints nothing: it exists so a staff CLI can pull the image BEFORE it
+  // creates or resumes a LOCAL session, keeping the boot deadline off the pull.
+  getLocalHostImage: {
+    method: "GET",
+    path: "/organizations/:organizationId/agent-sessions/local-host-image",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: LocalHostImageResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Claim a LOCAL session's launch: mints the run token and returns the container
+  // env the ECS launch would have passed as overrides. Single-shot (a second
+  // claim is 409): two containers must never hold valid tokens for one run.
+  // Verified staff only: the response carries the token and the org's
+  // customer credential env.
+  claimLocalLaunch: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/local-launch",
+    pathParams: AgentSessionIdParamsSchema,
+    body: null,
+    responses: {
+      200: ClaimLocalLaunchResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // LAUNCH_TARGET_NOT_LOCAL (an ECS row) or LOCAL_LAUNCH_NOT_PENDING (already
+      // claimed, parked, or terminal).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // LOCAL_LAUNCH_UNCONFIGURED: this environment has no public host api URL.
+      503: ErrorResponseSchema
+    }
+  },
   // Staff "Review": advance a VALIDATION pentest VALIDATION_RUNNING →
   // AWAITING_VALIDATION_REVIEW WITHOUT terminating the session (it stays
   // IDLE/resumable for a customer-feedback follow-up). Distinct from stop, which
@@ -22858,6 +22923,145 @@ var ListAgentTasksQuerySchema = external_exports.object({
 });
 var ListAgentTasksResponseSchema = external_exports.array(AgentTaskResponseSchema);
 
+// ../../packages/api-contracts/src/schemas/api/v1/code-upload.api.ts
+var CODE_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
+var CODE_UPLOAD_PART_SIZE_BYTES = 10 * 1024 * 1024;
+var CodeUploadStatusValues = [
+  "UPLOADING",
+  "FINALIZING",
+  "SCANNING",
+  "VALIDATING",
+  "READY",
+  "REJECTED",
+  "DELETING",
+  "FAILED"
+];
+var CodeUploadMalwareScanResultValues = [
+  "NO_THREATS_FOUND",
+  "THREATS_FOUND",
+  "UNSUPPORTED",
+  "ACCESS_DENIED",
+  "FAILED"
+];
+var CodeUploadRejectionReasonValues = [
+  "MALWARE_DETECTED",
+  "MALWARE_SCAN_UNSUPPORTED",
+  "MALWARE_SCAN_UNAVAILABLE",
+  "INVALID_ARCHIVE",
+  "INTEGRITY_MISMATCH"
+];
+var CodeUploadArtifactKindValues = ["SOURCE_ARCHIVE", "ANDROID_APK", "IOS_IPA"];
+function isApplicationBuildArtifactKind(kind) {
+  return kind === "ANDROID_APK" || kind === "IOS_IPA";
+}
+var CodeUploadIdParamsSchema = OrgIdParamsSchema.extend({
+  codeUploadId: external_exports.uuid()
+});
+var ListCodeUploadsQuerySchema = external_exports.object({
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).optional(),
+  applicationId: external_exports.uuid().optional()
+}).strict();
+var InitializeCodeUploadRequestSchema = external_exports.object({
+  displayName: external_exports.string().trim().min(1).max(200),
+  originalFilename: external_exports.string().trim().min(1).max(255),
+  sizeBytes: external_exports.number().int().min(1).max(CODE_UPLOAD_MAX_BYTES),
+  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Defaulted so a pre-this-release client that omitted the field still
+  // initializes a source ZIP during a mixed-version rollout.
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
+  applicationId: external_exports.uuid().optional()
+}).strict().superRefine((data, ctx) => {
+  const filename = data.originalFilename.toLowerCase();
+  if (isApplicationBuildArtifactKind(data.artifactKind)) {
+    const extension = data.artifactKind === "ANDROID_APK" ? ".apk" : ".ipa";
+    if (!filename.endsWith(extension)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["originalFilename"],
+        message: `originalFilename must end in ${extension}`
+      });
+    }
+    if (data.applicationId == null) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["applicationId"],
+        message: "A build upload must target a mobile application."
+      });
+    }
+    return;
+  }
+  if (!filename.endsWith(".zip")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["originalFilename"],
+      message: "originalFilename must end in .zip"
+    });
+  }
+  if (data.applicationId != null) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["applicationId"],
+      message: "Source archives are linked to an application after they are ready."
+    });
+  }
+});
+var LinkedCodeUploadApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string()
+});
+var CodeUploadSchema = external_exports.object({
+  codeUploadId: external_exports.uuid(),
+  repositoryId: external_exports.uuid(),
+  displayName: external_exports.string(),
+  originalFilename: external_exports.string(),
+  sizeBytes: external_exports.number().int().positive(),
+  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  status: external_exports.enum(CodeUploadStatusValues),
+  malwareScanResult: external_exports.enum(CodeUploadMalwareScanResultValues).nullable(),
+  rejectionReason: external_exports.enum(CodeUploadRejectionReasonValues).nullable(),
+  // Defaulted so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject source-upload rows that omit the field.
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
+  applicationId: external_exports.uuid().nullable().default(null),
+  // z.coerce.date(), not z.date(): web server actions safeParse the raw
+  // ts-rest JSON body, where these arrive as ISO strings.
+  scanningStartedAt: external_exports.coerce.date().nullable(),
+  readyAt: external_exports.coerce.date().nullable(),
+  createdAt: external_exports.coerce.date(),
+  linkedApplications: external_exports.array(LinkedCodeUploadApplicationSchema)
+});
+var CodeUploadPartUrlSchema = external_exports.object({
+  partNumber: external_exports.number().int().positive(),
+  uploadUrl: external_exports.url()
+});
+var UploadedCodeUploadPartSchema = external_exports.object({
+  partNumber: external_exports.number().int().positive(),
+  sizeBytes: external_exports.number().int().positive()
+});
+var CodeUploadMultipartSchema = external_exports.object({
+  partSizeBytes: external_exports.literal(CODE_UPLOAD_PART_SIZE_BYTES),
+  parts: external_exports.array(CodeUploadPartUrlSchema),
+  expiresAt: external_exports.coerce.date()
+});
+var InitializeCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  multipart: CodeUploadMultipartSchema
+});
+var ResumeCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  multipart: CodeUploadMultipartSchema.extend({
+    uploadedParts: external_exports.array(UploadedCodeUploadPartSchema)
+  })
+});
+var ListCodeUploadsResponseSchema = external_exports.object({
+  uploads: external_exports.array(CodeUploadSchema)
+});
+var DownloadCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/inbox.api.ts
 var InboxLabelSchema = external_exports.string().regex(
   /^[a-z][a-z0-9-]{0,39}$/,
@@ -22930,6 +23134,87 @@ var GetInboxMessageResponseSchema = external_exports.object({
   })
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/payment-card.api.ts
+var PAYMENT_CARD_NOTES_MAX = 2e3;
+function passesLuhn(digits) {
+  if (!/^\d+$/.test(digits)) return false;
+  let sum = 0;
+  let double = false;
+  for (let i2 = digits.length - 1; i2 >= 0; i2--) {
+    let d = digits.charCodeAt(i2) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var PaymentCardIdParamsSchema = external_exports.object({
+  paymentCardId: external_exports.uuid()
+});
+var PaymentCardBillingAddressSchema = external_exports.object({
+  line1: external_exports.string().min(1).max(200),
+  line2: external_exports.string().max(200).optional(),
+  city: external_exports.string().min(1).max(100),
+  region: external_exports.string().max(100).optional(),
+  postalCode: external_exports.string().min(1).max(20),
+  /** ISO 3166-1 alpha-2, upper-cased by the service. */
+  country: external_exports.string().regex(/^[A-Za-z]{2}$/, "Country is a two-letter code, like US.")
+}).strict();
+var CardNumberSchema = external_exports.string().regex(/^\d{12,19}$/, "Card number must be 12 to 19 digits.").refine(passesLuhn, { message: "Card number fails its check digit." });
+var CardCvcSchema = external_exports.string().regex(/^\d{3,4}$/, "CVC must be 3 or 4 digits.");
+var CardExpMonthSchema = external_exports.number().int().min(1).max(12);
+var CardExpYearSchema = external_exports.number().int().min(2026).max(2100);
+var PaymentCardResponseSchema = external_exports.object({
+  paymentCardId: external_exports.uuid(),
+  label: external_exports.string(),
+  last4: external_exports.string(),
+  expMonth: external_exports.number().int(),
+  expYear: external_exports.number().int(),
+  cardholderName: external_exports.string(),
+  billingAddress: PaymentCardBillingAddressSchema,
+  notes: external_exports.string(),
+  active: external_exports.boolean(),
+  /** Expiry month is before the current UTC month; the gate treats such a card as absent. */
+  expired: external_exports.boolean(),
+  /** Purchases with status AUTHORIZED or COMPLETED, across every engagement. */
+  purchaseCount: external_exports.number().int(),
+  /** Sum of those purchases' amounts, USD. Answers "how close to the issuer limit". */
+  committedUsd: external_exports.number(),
+  /**
+   * False once ANY purchase row references the card, whatever its status: the
+   * FK is Restrict, so delete would be refused. The UI offers Turn off instead.
+   */
+  deletable: external_exports.boolean(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+}).strict();
+var ListPaymentCardsResponseSchema = external_exports.array(PaymentCardResponseSchema);
+var CreatePaymentCardRequestSchema = external_exports.object({
+  label: external_exports.string().min(1).max(200),
+  number: CardNumberSchema,
+  cvc: CardCvcSchema,
+  expMonth: CardExpMonthSchema,
+  expYear: CardExpYearSchema,
+  cardholderName: external_exports.string().min(1).max(200),
+  billingAddress: PaymentCardBillingAddressSchema,
+  notes: external_exports.string().max(PAYMENT_CARD_NOTES_MAX).optional(),
+  /**
+   * Defaults true. Creating an active card deactivates the current active card
+   * in the same transaction.
+   */
+  active: external_exports.boolean().optional()
+}).strict();
+var UpdatePaymentCardRequestSchema = external_exports.object({
+  label: external_exports.string().min(1).max(200).optional(),
+  cardholderName: external_exports.string().min(1).max(200).optional(),
+  billingAddress: PaymentCardBillingAddressSchema.optional(),
+  notes: external_exports.string().max(PAYMENT_CARD_NOTES_MAX).optional(),
+  active: external_exports.boolean().optional()
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-attack-chain.api.ts
 var PentestAttackChainParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -23185,6 +23470,8 @@ var RepositoryResponseSchema = external_exports.object({
   prScansEnabled: external_exports.boolean(),
   /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
   includedInScanning: external_exports.boolean(),
+  /** Host archive flag mirrored from the provider. */
+  isArchived: external_exports.boolean(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
@@ -23715,6 +24002,10 @@ var ReportCanvasFindingSchema = external_exports.object({
    */
   description: external_exports.string(),
   proofOfConcept: external_exports.string().nullable(),
+  /** Customer-visible acceptance rationale a RAW-rendered ACCEPTED_WITH_CONTROLS
+   * finding shows under Compensating Controls; null otherwise. Optional while the
+   * web and API roll independently. */
+  acceptanceRationale: external_exports.string().nullable().optional(),
   // Per-finding prose staleness (precise — keyed to the finding's own columns).
   proseConfirmed: external_exports.boolean(),
   statusFramingStale: external_exports.boolean(),
@@ -23974,6 +24265,9 @@ var IssuedFindingSnapshotSchema = external_exports.object({
   description: external_exports.string(),
   proofOfConcept: external_exports.string().nullable(),
   remediation: external_exports.string().nullable(),
+  /** Compensating Controls text of a RAW-rendered ACCEPTED_WITH_CONTROLS finding;
+   * null otherwise. Optional so pre-feature issue snapshots remain parseable. */
+  acceptanceRationale: external_exports.string().nullable().optional(),
   repositories: external_exports.array(
     external_exports.object({
       repositoryName: external_exports.string(),
@@ -25003,12 +25297,22 @@ var StartProgressPentestFindingRequestSchema = external_exports.object({});
 var ReportRemediationPentestFindingRequestSchema = external_exports.object({
   note: external_exports.string().trim().min(1).max(1e4).optional()
 });
-var AutomationFindingTransitionSchema = external_exports.enum(["IN_PROGRESS", "REMEDIATED"]);
+var AcceptCustomerPentestFindingRequestSchema = external_exports.object({
+  rationale: external_exports.string().trim().min(1).max(1e4)
+});
+var AutomationFindingTransitionSchema = external_exports.enum([
+  "IN_PROGRESS",
+  "REMEDIATED",
+  "ACCEPTED_WITH_CONTROLS"
+]);
 var AutomationStatusUpdateRequestSchema = external_exports.object({
   status: AutomationFindingTransitionSchema,
   note: external_exports.string().trim().min(1).max(1e4).optional()
-}).refine((value) => value.note === void 0 || value.status === "REMEDIATED", {
-  message: "note is only accepted when reporting remediation (status REMEDIATED)",
+}).refine((value) => value.note === void 0 || value.status !== "IN_PROGRESS", {
+  message: "note is not accepted when starting progress (status IN_PROGRESS)",
+  path: ["note"]
+}).refine((value) => value.note !== void 0 || value.status !== "ACCEPTED_WITH_CONTROLS", {
+  message: "note is required when accepting a finding (status ACCEPTED_WITH_CONTROLS)",
   path: ["note"]
 });
 var ReopenPentestFindingTargetStatusSchema = external_exports.enum(["OPEN", "IN_PROGRESS"]);
@@ -25025,10 +25329,11 @@ var retestVerificationOnlyOnFixed = (value, ctx) => {
     });
   }
 };
+var PENTEST_FINDING_RETEST_VERIFICATION_MAX_LENGTH = 8e3;
 var CreatePentestFindingRetestRequestSchema = external_exports.object({
   outcome: ManualRetestOutcome,
   notes: external_exports.string().trim().min(1).max(1e4),
-  verification: external_exports.string().trim().min(1).max(8e3).optional()
+  verification: external_exports.string().trim().min(1).max(PENTEST_FINDING_RETEST_VERIFICATION_MAX_LENGTH).optional()
 });
 var CreatePentestFindingRetestBodySchema = CreatePentestFindingRetestRequestSchema.superRefine(retestVerificationOnlyOnFixed);
 var CreatePentestFindingNoteRequestSchema = external_exports.object({
@@ -25224,6 +25529,46 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
   manualFindingIds: HypothesisSourceIdsSchema.optional()
 }).strict().optional();
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-purchase.api.ts
+var PurchaseStatusValues = ["AUTHORIZED", "COMPLETED", "DECLINED", "VOIDED"];
+var PurchaseStatus = external_exports.enum(PurchaseStatusValues);
+var PurchaseOutcomeValues = ["COMPLETED", "DECLINED"];
+var PurchaseOutcome = external_exports.enum(PurchaseOutcomeValues);
+var PentestPurchaseParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: PentestIdOrDisplayIdSchema
+});
+var PentestPurchaseIdParamsSchema = PentestPurchaseParamsSchema.extend({
+  purchaseId: external_exports.uuid()
+});
+var PentestPurchaseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  agentSessionId: external_exports.uuid(),
+  agentSessionType: AgentSessionType,
+  paymentCardLabel: external_exports.string(),
+  paymentCardLast4: external_exports.string(),
+  amountUsd: external_exports.number(),
+  merchant: external_exports.string(),
+  purpose: external_exports.string(),
+  status: PurchaseStatus,
+  voidedAt: external_exports.coerce.date().nullable(),
+  voidedByLabel: external_exports.string().nullable(),
+  voidReason: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+}).strict();
+var ListPentestPurchasesResponseSchema = external_exports.object({
+  capUsd: external_exports.number(),
+  /** Every AUTHORIZED and COMPLETED amount, summed in cents. */
+  committedUsd: external_exports.number(),
+  /** `capUsd - committedUsd`, never below 0 (a cap lowered under the committed sum). */
+  remainingUsd: external_exports.number(),
+  /** Newest first. */
+  purchases: external_exports.array(PentestPurchaseSchema)
+}).strict();
+var VoidPentestPurchaseRequestSchema = external_exports.object({
+  reason: external_exports.string().trim().min(1).max(1e3)
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -25243,6 +25588,10 @@ var CustomerPentestStatusValues = [
   "PAUSED"
 ];
 var CustomerPentestStatus = external_exports.enum(CustomerPentestStatusValues);
+var PentestFindingStatusCountShape = Object.fromEntries(
+  PentestFindingStatusValues.map((status) => [status, external_exports.number().default(0)])
+);
+var PentestFindingStatusCountsByStatusSchema = external_exports.object(PentestFindingStatusCountShape).catchall(external_exports.number());
 var BoundPentestApplicationSchema = external_exports.object({
   applicationId: external_exports.uuid(),
   name: external_exports.string(),
@@ -25302,6 +25651,12 @@ var PentestResponseSchema = external_exports.object({
   hypothesisBudgetCapUsd: external_exports.number(),
   validationBudgetCapUsd: external_exports.number(),
   perHypothesisBudgetCapUsd: external_exports.number(),
+  /**
+   * Per-engagement purchase allowance (USD; 0 = purchasing off). `.optional()`
+   * for the rolling-deploy reason `testType` states above: the staff panel
+   * renders the row read-only when an older API omits it.
+   */
+  purchaseCapUsd: external_exports.number().optional(),
   startedAt: external_exports.coerce.date().nullable(),
   endedAt: external_exports.coerce.date().nullable(),
   /**
@@ -25317,7 +25672,7 @@ var PentestResponseSchema = external_exports.object({
   findingCounts: external_exports.object({
     total: external_exports.number(),
     bySeverity: external_exports.record(PentestFindingSeverity, external_exports.number()),
-    byStatus: external_exports.record(PentestFindingStatus, external_exports.number())
+    byStatus: PentestFindingStatusCountsByStatusSchema
   })
 });
 var ListPentestsResponseSchema = external_exports.array(PentestResponseSchema);
@@ -25373,7 +25728,7 @@ var CustomerPentestShellResponseSchema = external_exports.object({
   findingCounts: external_exports.object({
     total: external_exports.number(),
     bySeverity: external_exports.record(PentestFindingSeverity, external_exports.number()),
-    byStatus: external_exports.record(PentestFindingStatus, external_exports.number())
+    byStatus: PentestFindingStatusCountsByStatusSchema
   })
 });
 var ListCustomerPentestShellsResponseSchema = external_exports.array(CustomerPentestShellResponseSchema);
@@ -25498,7 +25853,8 @@ var CreatePentestRequestSchema = external_exports.object({
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory).max(20).optional(),
   hypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   validationBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
-  perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional()
+  perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
+  purchaseCapUsd: external_exports.number().min(0).max(1e5).optional()
 });
 var UpdatePentestRequestSchema = external_exports.object({
   title: external_exports.string().min(1).max(500).optional(),
@@ -25529,6 +25885,7 @@ var UpdatePentestRequestSchema = external_exports.object({
   hypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   validationBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
+  purchaseCapUsd: external_exports.number().min(0).max(1e5).optional(),
   lifecycleReason: external_exports.string().trim().min(1).max(2e3).optional()
 });
 var BindPentestApplicationRequestSchema = external_exports.object({
@@ -25643,13 +26000,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c62, i2) => {
-    const d = c62.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c65, i2) => {
+    const d = c65.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c62.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c65.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -25876,6 +26233,7 @@ var DesktopTargetStatusValues = [
   "TERMINATED",
   "FAILED"
 ];
+var DesktopTargetPlatformValues = ["WINDOWS", "MACOS"];
 var DesktopActionStatusValues = [
   "PENDING",
   "CLAIMED",
@@ -26796,6 +27154,103 @@ var AgentSessionSshPrivateKeyResponseSchema = external_exports.object({
    */
   secret: SshPrivateKeySecretSchema
 });
+var AgentSessionAndroidBuildSchema = CodeUploadSchema.pick({
+  codeUploadId: true,
+  displayName: true,
+  originalFilename: true,
+  archiveSha256: true,
+  status: true,
+  malwareScanResult: true
+}).extend({
+  applicationId: external_exports.uuid(),
+  applicationName: external_exports.string(),
+  sizeBytes: external_exports.number().int().positive().max(CODE_UPLOAD_MAX_BYTES),
+  createdAt: external_exports.iso.datetime()
+});
+var AgentSessionListAndroidBuildsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  afterCodeUploadId: external_exports.uuid().optional()
+});
+var AgentSessionListAndroidBuildsResponseSchema = external_exports.object({
+  builds: external_exports.array(AgentSessionAndroidBuildSchema).max(50),
+  nextAfterCodeUploadId: external_exports.uuid().nullable()
+});
+var AgentSessionGetAndroidBuildRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  codeUploadId: external_exports.uuid()
+});
+var AgentSessionAndroidBuildGrantSchema = AgentSessionAndroidBuildSchema.pick({
+  codeUploadId: true,
+  applicationId: true,
+  archiveSha256: true,
+  sizeBytes: true
+}).extend({
+  downloadUrl: external_exports.url(),
+  urlExpiresAt: external_exports.iso.datetime()
+});
+var AgentSessionListTestIntegrationsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative()
+});
+var AgentSessionListTestIntegrationsResponseSchema = external_exports.object({
+  /** Every Trace test integration by label, ascending. Empty when none exist. */
+  labels: external_exports.array(external_exports.string())
+});
+var AgentSessionGetTestIntegrationRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  label: external_exports.string().min(1).max(200)
+});
+var AgentSessionTestIntegrationResponseSchema = external_exports.object({
+  testIntegrationId: external_exports.uuid(),
+  label: external_exports.string(),
+  /** Staff-written, non-secret access instructions. */
+  notes: external_exports.string(),
+  /** Verbatim as stored: the host seeds its redactor with these exact bytes. */
+  apiKey: external_exports.string().optional(),
+  login: external_exports.object({ username: external_exports.string(), password: external_exports.string() }).optional()
+});
+var AgentSessionRequestPaymentCardRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Minted by the host per tool call; reused across that call's HTTP retries. */
+  requestKey: external_exports.uuid(),
+  /** USD, two decimals: what the agent expects the merchant to charge. */
+  amountUsd: external_exports.number().positive().max(1e4).multipleOf(0.01),
+  merchant: external_exports.string().min(1).max(200),
+  purpose: external_exports.string().min(1).max(1e3)
+});
+var AgentSessionPaymentCardResponseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  /** True when this response replays an authorization an earlier attempt already committed. */
+  replayed: external_exports.boolean(),
+  paymentCardId: external_exports.uuid(),
+  label: external_exports.string(),
+  last4: external_exports.string(),
+  expMonth: external_exports.number().int(),
+  expYear: external_exports.number().int(),
+  cardholderName: external_exports.string(),
+  billingAddress: PaymentCardBillingAddressSchema,
+  /** Staff-written, non-secret: the billing email to give, what the issuer declines. */
+  notes: external_exports.string(),
+  /** Cap minus every AUTHORIZED and COMPLETED amount for this pentest, this one included. */
+  remainingUsd: external_exports.number(),
+  capUsd: external_exports.number(),
+  /** Verbatim as stored: the host seeds its redactor with these exact bytes. */
+  number: external_exports.string(),
+  cvc: external_exports.string()
+});
+var AgentSessionReportPurchaseOutcomeRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  purchaseId: external_exports.uuid(),
+  outcome: PurchaseOutcome
+});
+var AgentSessionPurchaseOutcomeResponseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  /** The row's status after the call. */
+  status: PurchaseStatus,
+  /** True when the row already carried this outcome (a retried report). */
+  replayed: external_exports.boolean(),
+  remainingUsd: external_exports.number(),
+  capUsd: external_exports.number()
+});
 var AgentSessionPasskeySchema = external_exports.object({
   /** Relying party id (a hostname). */
   rpId: external_exports.string().min(1).max(253),
@@ -27203,8 +27658,9 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
 });
 var RequestDesktopTargetRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
-  /** Only Windows exists; a literal keeps the macOS follow-on additive. */
-  platform: external_exports.literal("WINDOWS")
+  /** A MACOS request is also gated on the session's pinned toolset (the api's
+   *  `DESKTOP_MACOS_CAPABLE_TOOLSETS`); the schema alone does not authorize it. */
+  platform: external_exports.enum(DesktopTargetPlatformValues)
 });
 var DesktopCredentialRefSchema = external_exports.object({
   credentialId: external_exports.uuid(),
@@ -27231,7 +27687,11 @@ var DesktopTargetStatusRequestSchema = external_exports.object({
 });
 var DesktopTargetStatusResponseSchema = external_exports.object({
   status: external_exports.enum(DesktopTargetStatusValues),
-  failureReason: external_exports.string().nullable()
+  failureReason: external_exports.string().nullable(),
+  /** How the host learns the platform of a target it did not request in this
+   *  process (a resumed session): the key chords, job paths and recording rules
+   *  it applies all depend on it. */
+  platform: external_exports.enum(DesktopTargetPlatformValues)
 });
 var DESKTOP_ACTION_MAX_WAIT_MS = 9e4;
 var EnqueueDesktopActionRequestSchema = external_exports.object({
@@ -27688,6 +28148,112 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  listAndroidBuilds: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/android-builds/list",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListAndroidBuildsRequestSchema,
+    responses: {
+      200: AgentSessionListAndroidBuildsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getAndroidBuild: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/android-builds/get",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetAndroidBuildRequestSchema,
+    responses: {
+      200: AgentSessionAndroidBuildGrantSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      422: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      503: ErrorResponseSchema
+    }
+  },
+  // get_test_integration, no name: every Trace test integration by label. Gated on the
+  // session type (403 for a type that receives none) and on the run still being live.
+  listTestIntegrations: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integrations",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListTestIntegrationsRequestSchema,
+    responses: {
+      200: AgentSessionListTestIntegrationsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // get_test_integration, with a name: that integration's notes and decrypted facets.
+  // Same gates as the list. A label that matches no integration is a 404 whose message
+  // names the available labels, which are Trace data, not customer data.
+  getTestIntegration: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integration",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetTestIntegrationRequestSchema,
+    responses: {
+      200: AgentSessionTestIntegrationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // request_payment_card: declare a purchase against the engagement's cap and, when
+  // it fits, receive the active card's facets. 402 PURCHASE_CAP_EXCEEDED carries
+  // `details: { remainingUsd, capUsd }`; 403 when the run's pinned toolset is not
+  // purchase-capable; 409 RUN_REVOKED, PAYMENT_CARD_UNAVAILABLE (no active card, or
+  // the active card is expired or changed since a replayed request), or
+  // ENGAGEMENT_ENDED (the engagement was cancelled or closed while the session ran).
+  requestPaymentCard: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/payment-card",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionRequestPaymentCardRequestSchema,
+    responses: {
+      200: AgentSessionPaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      402: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // report_purchase_outcome: COMPLETED or DECLINED for a purchase this session
+  // authorized. 403 when the run's pinned toolset is not purchase-capable; 404
+  // 404 (no code) for any purchase this session did not make; 409 RUN_REVOKED,
+  // or PURCHASE_OUTCOME_CONFLICT with `details: { status }` when the row was already
+  // reported differently or staff voided it. A repeated identical report replays.
+  reportPurchaseOutcome: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/purchase-outcome",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionReportPurchaseOutcomeRequestSchema,
+    responses: {
+      200: AgentSessionPurchaseOutcomeResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // provision_passkey, read half: every passkey Trace holds for one of the run's
   // accounts, decrypted, so the host can load them into the virtual authenticator
   // it arms on the agent's browser. Same resolution and ownership gate as
@@ -29966,6 +30532,19 @@ var OrganizationCodeSizeResponseSchema = external_exports.object({
     languageCount: external_exports.number().int().nonnegative()
   })
 });
+var CodeSizeRecalculateResponseSchema = external_exports.object({
+  /** Repos the request covered. */
+  requested: external_exports.number().int().nonnegative(),
+  /** Messages the queue accepted. Lower than `requested` is a partial send,
+   *  reported rather than masked. */
+  enqueued: external_exports.number().int().nonnegative()
+});
+var CodeSizeRecalculateLimitedResponseSchema = ErrorResponseSchema.extend({
+  /** Recalculates allowed per org in any 24 hours. */
+  limit: external_exports.number().int().positive(),
+  /** When the oldest request in the window ages out and frees a slot. */
+  retryAt: external_exports.iso.datetime()
+});
 var StaffCodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
@@ -30009,7 +30588,11 @@ var StaffCodeSizeRemeasureResponseSchema = external_exports.object({
   requested: external_exports.number().int().nonnegative(),
   /** Messages SQS accepted. Lower than `requested` means a partial send —
    *  reported rather than masked (the panel states this number). */
-  enqueued: external_exports.number().int().nonnegative()
+  enqueued: external_exports.number().int().nonnegative(),
+  /** Repos re-read from GitHub (default branch, archive state) before the
+   *  scope was selected. Null when no refresh ran: scope `unmeasured`, or no
+   *  GitHub App credentials on this environment. */
+  refreshedRepoCount: external_exports.number().int().nonnegative().nullable()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/code-size.ts
@@ -30027,6 +30610,23 @@ var codeSizeContract = c11.router({
       500: ErrorResponseSchema
     }
   },
+  // Customer Recalculate (MANAGE_INTEGRATED_REPOSITORIES). Enqueue-only.
+  recalculateOrganizationCodeSize: {
+    method: "POST",
+    path: "/organizations/:organizationId/code-size/recalculate",
+    pathParams: OrgIdParamsSchema,
+    body: c11.noBody(),
+    responses: {
+      200: CodeSizeRecalculateResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: CodeSizeRecalculateLimitedResponseSchema,
+      500: ErrorResponseSchema,
+      // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
+      503: ErrorResponseSchema
+    }
+  },
   // Staff-only: per-repo measurement freshness for the admin Controls panel.
   getStaffOrganizationCodeSize: {
     method: "GET",
@@ -30053,151 +30653,15 @@ var codeSizeContract = c11.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema,
+      // Scope `all` could not refresh repository state from GitHub; nothing
+      // was re-measured.
+      502: ErrorResponseSchema,
       // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
       503: ErrorResponseSchema
     }
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/code-upload.api.ts
-var CODE_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
-var CODE_UPLOAD_PART_SIZE_BYTES = 10 * 1024 * 1024;
-var CodeUploadStatusValues = [
-  "UPLOADING",
-  "FINALIZING",
-  "SCANNING",
-  "VALIDATING",
-  "READY",
-  "REJECTED",
-  "DELETING",
-  "FAILED"
-];
-var CodeUploadMalwareScanResultValues = [
-  "NO_THREATS_FOUND",
-  "THREATS_FOUND",
-  "UNSUPPORTED",
-  "ACCESS_DENIED",
-  "FAILED"
-];
-var CodeUploadRejectionReasonValues = [
-  "MALWARE_DETECTED",
-  "MALWARE_SCAN_UNSUPPORTED",
-  "MALWARE_SCAN_UNAVAILABLE",
-  "INVALID_ARCHIVE",
-  "INTEGRITY_MISMATCH"
-];
-var CodeUploadArtifactKindValues = ["SOURCE_ARCHIVE", "ANDROID_APK", "IOS_IPA"];
-function isApplicationBuildArtifactKind(kind) {
-  return kind === "ANDROID_APK" || kind === "IOS_IPA";
-}
-var CodeUploadIdParamsSchema = OrgIdParamsSchema.extend({
-  codeUploadId: external_exports.uuid()
-});
-var ListCodeUploadsQuerySchema = external_exports.object({
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).optional(),
-  applicationId: external_exports.uuid().optional()
-}).strict();
-var InitializeCodeUploadRequestSchema = external_exports.object({
-  displayName: external_exports.string().trim().min(1).max(200),
-  originalFilename: external_exports.string().trim().min(1).max(255),
-  sizeBytes: external_exports.number().int().min(1).max(CODE_UPLOAD_MAX_BYTES),
-  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Defaulted so a pre-this-release client that omitted the field still
-  // initializes a source ZIP during a mixed-version rollout.
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
-  applicationId: external_exports.uuid().optional()
-}).strict().superRefine((data, ctx) => {
-  const filename = data.originalFilename.toLowerCase();
-  if (isApplicationBuildArtifactKind(data.artifactKind)) {
-    const extension = data.artifactKind === "ANDROID_APK" ? ".apk" : ".ipa";
-    if (!filename.endsWith(extension)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["originalFilename"],
-        message: `originalFilename must end in ${extension}`
-      });
-    }
-    if (data.applicationId == null) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["applicationId"],
-        message: "A build upload must target a mobile application."
-      });
-    }
-    return;
-  }
-  if (!filename.endsWith(".zip")) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["originalFilename"],
-      message: "originalFilename must end in .zip"
-    });
-  }
-  if (data.applicationId != null) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["applicationId"],
-      message: "Source archives are linked to an application after they are ready."
-    });
-  }
-});
-var LinkedCodeUploadApplicationSchema = external_exports.object({
-  applicationId: external_exports.uuid(),
-  name: external_exports.string()
-});
-var CodeUploadSchema = external_exports.object({
-  codeUploadId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  displayName: external_exports.string(),
-  originalFilename: external_exports.string(),
-  sizeBytes: external_exports.number().int().positive(),
-  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  status: external_exports.enum(CodeUploadStatusValues),
-  malwareScanResult: external_exports.enum(CodeUploadMalwareScanResultValues).nullable(),
-  rejectionReason: external_exports.enum(CodeUploadRejectionReasonValues).nullable(),
-  // Defaulted so a new client reading a pre-this-release API during a rolling
-  // deploy doesn't reject source-upload rows that omit the field.
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
-  applicationId: external_exports.uuid().nullable().default(null),
-  // z.coerce.date(), not z.date(): web server actions safeParse the raw
-  // ts-rest JSON body, where these arrive as ISO strings.
-  scanningStartedAt: external_exports.coerce.date().nullable(),
-  readyAt: external_exports.coerce.date().nullable(),
-  createdAt: external_exports.coerce.date(),
-  linkedApplications: external_exports.array(LinkedCodeUploadApplicationSchema)
-});
-var CodeUploadPartUrlSchema = external_exports.object({
-  partNumber: external_exports.number().int().positive(),
-  uploadUrl: external_exports.url()
-});
-var UploadedCodeUploadPartSchema = external_exports.object({
-  partNumber: external_exports.number().int().positive(),
-  sizeBytes: external_exports.number().int().positive()
-});
-var CodeUploadMultipartSchema = external_exports.object({
-  partSizeBytes: external_exports.literal(CODE_UPLOAD_PART_SIZE_BYTES),
-  parts: external_exports.array(CodeUploadPartUrlSchema),
-  expiresAt: external_exports.coerce.date()
-});
-var InitializeCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  multipart: CodeUploadMultipartSchema
-});
-var ResumeCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  multipart: CodeUploadMultipartSchema.extend({
-    uploadedParts: external_exports.array(UploadedCodeUploadPartSchema)
-  })
-});
-var ListCodeUploadsResponseSchema = external_exports.object({
-  uploads: external_exports.array(CodeUploadSchema)
-});
-var DownloadCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  downloadUrl: external_exports.url(),
-  expiresAt: external_exports.coerce.date()
-});
-
 // ../../packages/api-contracts/src/contracts/v1/code-upload.ts
 var c12 = initContract();
 var commonErrors = {
@@ -31399,7 +31863,9 @@ var environmentContract = c17.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // 409 — environment target is frozen by a non-terminal pentest
-      // (errorCode ENVIRONMENT_TARGET_FROZEN_BY_PENTEST).
+      // (errorCode ENVIRONMENT_TARGET_FROZEN_BY_PENTEST), or a live pentest
+      // still links the environment (errorCode ENVIRONMENT_IN_USE_BY_PENTEST,
+      // details.pentestDisplayIds names the holders).
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -31579,7 +32045,9 @@ var GitHubRepoSchema = external_exports.object({
   private: external_exports.boolean(),
   htmlUrl: external_exports.string().url(),
   githubDefaultBranch: external_exports.string(),
-  language: external_exports.string().nullable()
+  language: external_exports.string().nullable(),
+  /** Archived on GitHub. Archived repos stay listed; archiving excludes them once. */
+  archived: external_exports.boolean()
 });
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
@@ -32870,9 +33338,10 @@ var PrScanAnalyticsDeveloperSchema = external_exports.object({
   criticalHighFixedCount: external_exports.number().int().nonnegative(),
   falsePositiveCount: external_exports.number().int().nonnegative()
 });
+var PrScanAnalyticsMonthKeySchema = external_exports.string().regex(/^[1-9]\d{3}-(0[1-9]|1[0-2])$/);
 var PrScanAnalyticsMonthSchema = external_exports.object({
   /** UTC calendar month, `YYYY-MM`. */
-  month: external_exports.string().regex(/^\d{4}-\d{2}$/),
+  month: PrScanAnalyticsMonthKeySchema,
   prCount: external_exports.number().int().nonnegative(),
   developerCount: external_exports.number().int().nonnegative(),
   findingsCount: external_exports.number().int().nonnegative(),
@@ -32911,28 +33380,92 @@ var PrScanAnalyticsSummarySchema = external_exports.object({
   /** One row per severity, CRITICAL first. */
   timeToFix: external_exports.array(PrScanAnalyticsTimeToFixSchema).length(VulnerabilitySeverityValues.length)
 });
+var PrScanAnalyticsFindingSchema = external_exports.object({
+  vulnerabilityId: external_exports.uuid(),
+  title: external_exports.string(),
+  severity: VulnerabilitySeverity,
+  status: VulnerabilityStatus,
+  /** The PR the finding was first detected on; its review comment lives there. */
+  pullRequestNumber: external_exports.number().int().positive().nullable()
+});
+var PrScanAnalyticsFindingsQuerySchema = external_exports.object({
+  category: external_exports.string().min(1).max(100),
+  asOf: external_exports.iso.datetime(),
+  afterStatus: VulnerabilityStatus.optional(),
+  afterSeverity: VulnerabilitySeverity.optional(),
+  afterCreatedAt: external_exports.iso.datetime().optional(),
+  afterVulnerabilityId: external_exports.uuid().optional()
+}).refine(
+  ({ afterStatus, afterSeverity, afterCreatedAt, afterVulnerabilityId }) => {
+    const provided = [afterStatus, afterSeverity, afterCreatedAt, afterVulnerabilityId].filter(
+      (field) => field !== void 0
+    ).length;
+    return provided === 0 || provided === 4;
+  },
+  { message: "Provide all four cursor fields or none", path: ["afterCreatedAt"] }
+);
+var PrScanAnalyticsFindingsResponseSchema = external_exports.object({
+  /** Open first (then In progress, Fixed, Archived, False positive, Dismissed), most severe first within a status, then newest. */
+  findings: external_exports.array(PrScanAnalyticsFindingSchema).max(25),
+  total: external_exports.number().int().nonnegative(),
+  nextCursor: external_exports.object({
+    status: VulnerabilityStatus,
+    severity: VulnerabilitySeverity,
+    firstDetectedAt: external_exports.iso.datetime(),
+    vulnerabilityId: external_exports.uuid()
+  }).nullable()
+});
+var PrScanAnalyticsFindingCommentParamsSchema = external_exports.object({
+  organizationId: external_exports.uuid(),
+  vulnerabilityId: external_exports.uuid()
+});
+var PrScanAnalyticsFindingCommentResponseSchema = external_exports.object({
+  url: external_exports.url(),
+  target: external_exports.enum(["comment", "pull_request"])
+});
+var PrScanAnalyticsTotalsSchema = external_exports.object({
+  prCount: external_exports.number().int().nonnegative(),
+  findingsCount: external_exports.number().int().nonnegative(),
+  criticalHighCount: external_exports.number().int().nonnegative(),
+  remediatedCount: external_exports.number().int().nonnegative(),
+  byClass: external_exports.array(PrScanAnalyticsClassCountSchema)
+});
 var PrScanAnalyticsResponseSchema = external_exports.object({
   generatedAt: external_exports.iso.datetime(),
   months: external_exports.array(PrScanAnalyticsMonthSchema).length(12),
-  summary: PrScanAnalyticsSummarySchema
+  summary: PrScanAnalyticsSummarySchema,
+  totals: PrScanAnalyticsTotalsSchema.optional()
 });
 var ProductPlanParamsSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   product: external_exports.enum(ProductValues)
 });
+var ProseSpellingValues = ["US", "UK"];
+var ProseSpellingSchema = external_exports.enum(ProseSpellingValues);
 var ReferrerSchema = external_exports.object({
   referrerId: external_exports.uuid(),
   name: external_exports.string(),
   slug: external_exports.string(),
-  reportTemplate: PentestReportTemplateSchema
+  reportTemplate: PentestReportTemplateSchema,
+  /** Spelling the agents write customer-facing prose in for this partner's orgs. */
+  proseSpelling: ProseSpellingSchema
+});
+var ReferrerParamsSchema = external_exports.object({
+  referrerId: external_exports.uuid()
+});
+var UpdateReferrerRequestSchema = external_exports.object({
+  proseSpelling: ProseSpellingSchema
 });
+var UpdateReferrerResponseSchema = ReferrerSchema;
 var ListReferrersResponseSchema = external_exports.object({
   referrers: external_exports.array(ReferrerSchema)
 });
 var CreateReferrerRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(2, "Partner name must be at least 2 characters").max(100, "Partner name must be 100 characters or fewer"),
   /** Report template for orgs this partner refers. Defaults to TRACE. */
-  reportTemplate: PentestReportTemplateSchema.optional()
+  reportTemplate: PentestReportTemplateSchema.optional(),
+  /** Prose spelling for orgs this partner refers. Defaults to US. */
+  proseSpelling: ProseSpellingSchema.optional()
 });
 var CreateReferrerResponseSchema = ReferrerSchema;
 var SetOrganizationReferrerRequestSchema = external_exports.object({
@@ -32993,9 +33526,14 @@ var CreatePrReviewerSubscriptionRequestSchema = external_exports.object({
   /** Calendar day the subscription starts, `YYYY-MM-DD`, UTC. Today or in the past. */
   startDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/)
 });
+var BillingCollectionMethodValues = ["charge_automatically", "send_invoice"];
 var PrReviewerSubscriptionResponseSchema = external_exports.object({
   subscriptionId: external_exports.string(),
   status: external_exports.string(),
+  /** Optional for rolling-deploy tolerance: an older API omits the key. */
+  collectionMethod: external_exports.enum(BillingCollectionMethodValues).optional(),
+  /** The customer opted into autopay but the saved card didn't pay the first invoice, so it was emailed. */
+  firstChargeDeclined: external_exports.boolean().optional(),
   invoice: external_exports.object({
     id: external_exports.string(),
     status: external_exports.string(),
@@ -33044,6 +33582,33 @@ var BillingSubscriptionSchema = external_exports.object({
   currentPeriodEnd: external_exports.date().nullable(),
   cancelAtPeriodEnd: external_exports.boolean()
 });
+var BillingPaymentMethodSchema = external_exports.object({
+  /** Stripe PaymentMethod type, e.g. `card` or `us_bank_account`. */
+  type: external_exports.string(),
+  /** Card network or bank name, when Stripe exposes one. */
+  brand: external_exports.string().nullable(),
+  last4: external_exports.string().nullable(),
+  expMonth: external_exports.number().int().nullable(),
+  expYear: external_exports.number().int().nullable()
+});
+var BillingAutopayStateValues = ["off", "card_only", "on"];
+var BillingAutopaySchema = external_exports.object({
+  state: external_exports.enum(BillingAutopayStateValues),
+  /** The customer's default card; null when state is `off`. */
+  paymentMethod: BillingPaymentMethodSchema.nullable(),
+  /**
+   * Open PR reviewer invoices that enabling autopay charges right away, once
+   * the admin confirms them. Enabling charges these ids and no others.
+   */
+  chargeOnEnable: external_exports.object({
+    invoiceIds: external_exports.array(external_exports.string()).min(1),
+    invoiceCount: external_exports.number().int().positive(),
+    amountCents: external_exports.number().int().positive(),
+    currency: external_exports.string(),
+    /** At least one was already charged and declined, rather than never attempted. */
+    declined: external_exports.boolean()
+  }).nullable()
+});
 var OrganizationBillingSchema = external_exports.object({
   prReviewerBillingRequired: external_exports.boolean(),
   hasStripeCustomer: external_exports.boolean(),
@@ -33053,11 +33618,44 @@ var OrganizationBillingSchema = external_exports.object({
   /** Optional for rolling-deploy tolerance. */
   subscription: BillingSubscriptionSchema.nullable().optional(),
   /** Optional for rolling-deploy tolerance: an older API omits the key. */
-  paymentDue: BillingPaymentDueSchema.nullable().optional()
+  paymentDue: BillingPaymentDueSchema.nullable().optional(),
+  /**
+   * Null when there's no Stripe customer, or the card lookup failed (the row is
+   * hidden rather than offering setup over a card that may exist). Optional for
+   * rolling-deploy tolerance.
+   */
+  autopay: BillingAutopaySchema.nullable().optional()
 });
 var BillingPortalResponseSchema = external_exports.object({
   url: external_exports.url()
 });
+var STRIPE_CHECKOUT_SESSION_ID_PATTERN = /^cs_(test|live)_[A-Za-z0-9]+$/;
+var EnableAutopayRequestSchema = external_exports.object({
+  /**
+   * Checkout session (setup mode) the admin just completed. Omitted when the
+   * customer already has a default card on file and only the opt-in and the
+   * PR reviewer subscriptions need to switch.
+   */
+  checkoutSessionId: external_exports.string().regex(STRIPE_CHECKOUT_SESSION_ID_PATTERN).optional(),
+  /**
+   * Card-on-file path: the open invoices the admin confirmed charging. Ignored
+   * with a Checkout session, which carries its own confirmation.
+   */
+  confirmedInvoiceIds: external_exports.array(external_exports.string().regex(/^in_[A-Za-z0-9]+$/)).max(15).optional()
+});
+var CreateAutopaySetupSessionRequestSchema = external_exports.object({
+  /** Open invoices the admin confirmed; the Checkout return charges these and no others. */
+  confirmedInvoiceIds: external_exports.array(external_exports.string().regex(/^in_[A-Za-z0-9]+$/)).max(15)
+});
+var EnableAutopayResponseSchema = external_exports.object({
+  paymentMethod: BillingPaymentMethodSchema,
+  /** PR reviewer subscriptions moved to charge the customer's default card. */
+  subscriptionsUpdated: external_exports.number().int(),
+  /** Open PR reviewer invoices Stripe confirmed as paid. */
+  openInvoicesPaid: external_exports.number().int(),
+  /** Open PR reviewer invoices the card didn't pay; they stay open for manual payment. */
+  openInvoicesDeclined: external_exports.number().int()
+});
 var ListOrganizationsResponseSchema = external_exports.array(OrganizationResponseSchema);
 var StaffOrganizationSummarySchema = external_exports.object({
   organizationId: external_exports.uuid(),
@@ -33280,6 +33878,22 @@ var organizationContract = c27.router({
       500: ErrorResponseSchema
     }
   },
+  // Staff-only: change a partner's prose spelling. Reaches sessions launched
+  // after the change; running sessions keep the header they started with.
+  updateReferrer: {
+    method: "PATCH",
+    path: "/referrers/:referrerId",
+    pathParams: ReferrerParamsSchema,
+    body: UpdateReferrerRequestSchema,
+    responses: {
+      200: UpdateReferrerResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Staff-only: set (or clear with null) the org's referral partner.
   // Drives "Trace x <partner>" co-branding on pentest report covers.
   setOrganizationReferrer: {
@@ -33443,6 +34057,42 @@ var organizationContract = c27.router({
       500: ErrorResponseSchema
     }
   },
+  // Signed-in admins only: mint a Stripe Checkout session (setup mode, cards)
+  // that collects the autopay card. Stripe returns to the web's redemption route.
+  createAutopaySetupSession: {
+    method: "POST",
+    path: "/organizations/:organizationId/billing/autopay/session",
+    pathParams: OrgIdParamsSchema,
+    body: CreateAutopaySetupSessionRequestSchema,
+    responses: {
+      200: BillingPortalResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Signed-in admins only: make the collected card the customer default, opt the
+  // customer in, move live PR reviewer subscriptions onto it, and charge their
+  // open invoices. The web confirms the charge before calling.
+  enableAutopay: {
+    method: "POST",
+    path: "/organizations/:organizationId/billing/autopay",
+    pathParams: OrgIdParamsSchema,
+    body: EnableAutopayRequestSchema,
+    responses: {
+      200: EnableAutopayResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Member-readable: the caller's own org SCANNING plan + spend, for the
   // customer trial-credits meter. Scoped by requireOrgAccess (no staff gate).
   getScanUsage: {
@@ -33460,6 +34110,34 @@ var organizationContract = c27.router({
   // Member-readable: last 12 UTC months of PR scanner usage (unique PRs,
   // developers, PR-first-detected findings + remediations). Gated by
   // requireOrgAccess + VIEW_RESULTS + AUTO_PR_SCANS.
+  getPrScanAnalyticsFindings: {
+    method: "GET",
+    path: "/organizations/:organizationId/pr-scan-analytics/findings",
+    pathParams: OrgIdParamsSchema,
+    query: PrScanAnalyticsFindingsQuerySchema,
+    responses: {
+      200: PrScanAnalyticsFindingsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Resolves a finding's PR review comment on GitHub (by the hidden
+  // vulnerability marker) so the analytics row can link straight to it.
+  getPrScanAnalyticsFindingComment: {
+    method: "GET",
+    path: "/organizations/:organizationId/pr-scan-analytics/findings/:vulnerabilityId/comment",
+    pathParams: PrScanAnalyticsFindingCommentParamsSchema,
+    responses: {
+      200: PrScanAnalyticsFindingCommentResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getPrScanAnalytics: {
     method: "GET",
     path: "/organizations/:organizationId/pr-scan-analytics",
@@ -33504,6 +34182,65 @@ var organizationContract = c27.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/payment-card.ts
+var c28 = initContract();
+var paymentCardContract = c28.router({
+  listPaymentCards: {
+    method: "GET",
+    path: "/staff/payment-cards",
+    responses: {
+      200: ListPaymentCardsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createPaymentCard: {
+    method: "POST",
+    path: "/staff/payment-cards",
+    body: CreatePaymentCardRequestSchema,
+    responses: {
+      201: PaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      // PAYMENT_CARD_EXPIRED, or a contract failure
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PAYMENT_CARD_LABEL_TAKEN, PAYMENT_CARD_ACTIVE_CONFLICT
+      500: ErrorResponseSchema
+    }
+  },
+  updatePaymentCard: {
+    method: "PATCH",
+    path: "/staff/payment-cards/:paymentCardId",
+    pathParams: PaymentCardIdParamsSchema,
+    body: UpdatePaymentCardRequestSchema,
+    responses: {
+      200: PaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deletePaymentCard: {
+    method: "DELETE",
+    path: "/staff/payment-cards/:paymentCardId",
+    pathParams: PaymentCardIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PAYMENT_CARD_HAS_PURCHASES
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-cost-rollup.api.ts
 var PentestCostRollupResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
@@ -33796,8 +34533,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c28 = initContract();
-var pentestContract = c28.router({
+var c29 = initContract();
+var pentestContract = c29.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -34107,8 +34844,8 @@ var pentestContract = c28.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attack-chain.ts
-var c29 = initContract();
-var pentestAttackChainContract = c29.router({
+var c30 = initContract();
+var pentestAttackChainContract = c30.router({
   listAttackChains: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains",
@@ -34227,7 +34964,7 @@ var pentestAttackChainContract = c29.router({
     method: "DELETE",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId",
     pathParams: PentestAttackChainIdParamsSchema,
-    body: c29.noBody(),
+    body: c30.noBody(),
     responses: {
       200: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -34388,8 +35125,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c30 = initContract();
-var pentestAttestationContract = c30.router({
+var c31 = initContract();
+var pentestAttestationContract = c31.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -34532,8 +35269,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c31 = initContract();
-var pentestAuditLogContract = c31.router({
+var c32 = initContract();
+var pentestAuditLogContract = c32.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -34580,8 +35317,8 @@ var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
-var c32 = initContract();
-var pentestAuthorizedDomainContract = c32.router({
+var c33 = initContract();
+var pentestAuthorizedDomainContract = c33.router({
   getPentestAuthorizedScope: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
@@ -34635,8 +35372,8 @@ var PentestEgressResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-egress.ts
-var c33 = initContract();
-var pentestEgressContract = c33.router({
+var c34 = initContract();
+var pentestEgressContract = c34.router({
   getPentestEgress: {
     method: "GET",
     path: "/staff/pentest-egress",
@@ -34675,8 +35412,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c34 = initContract();
-var pentestEngagementExclusionContract = c34.router({
+var c35 = initContract();
+var pentestEngagementExclusionContract = c35.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -34740,8 +35477,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c35 = initContract();
-var pentestEnvironmentContract = c35.router({
+var c36 = initContract();
+var pentestEnvironmentContract = c36.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -34790,8 +35527,8 @@ var pentestEnvironmentContract = c35.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c36 = initContract();
-var pentestFindingContract = c36.router({
+var c37 = initContract();
+var pentestFindingContract = c37.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -35213,6 +35950,26 @@ var pentestFindingContract = c36.router({
       500: ErrorResponseSchema
     }
   },
+  // Customer accepts the finding → ACCEPTED_WITH_CONTROLS without a dispute or a
+  // staff decision. Human principals here; an API key sends the same transition
+  // through `automationStatusUpdate` with status ACCEPTED_WITH_CONTROLS.
+  accept: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/accept",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: AcceptCustomerPentestFindingRequestSchema,
+    responses: {
+      200: CustomerPentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // FINDING_TRANSITION_NOT_ALLOWED (bad source status / dispute pending),
+      // FINDING_STALE (concurrent write), or PENTEST_CLOSED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Automation lifecycle transition (API keys) ───
   // A separate route rather than a widened `start-progress` / `report-remediation`:
   // those stay human-only, and everything that makes a machine-driven write
@@ -35423,8 +36180,8 @@ var pentestFindingContract = c36.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c37 = initContract();
-var pentestHypothesisContract = c37.router({
+var c38 = initContract();
+var pentestHypothesisContract = c38.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -35579,8 +36336,8 @@ var DownloadPentestIntakeDocumentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-intake-document.ts
-var c38 = initContract();
-var pentestIntakeDocumentContract = c38.router({
+var c39 = initContract();
+var pentestIntakeDocumentContract = c39.router({
   listDocuments: {
     method: "GET",
     path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
@@ -35666,8 +36423,8 @@ var pentestIntakeDocumentContract = c38.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c39 = initContract();
-var pentestManualFindingContract = c39.router({
+var c40 = initContract();
+var pentestManualFindingContract = c40.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -35753,9 +36510,42 @@ var pentestManualFindingContract = c39.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/pentest-purchase.ts
+var c41 = initContract();
+var pentestPurchaseContract = c41.router({
+  listPurchases: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/purchases",
+    pathParams: PentestPurchaseParamsSchema,
+    responses: {
+      200: ListPentestPurchasesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  voidPurchase: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/purchases/:purchaseId/void",
+    pathParams: PentestPurchaseIdParamsSchema,
+    body: VoidPentestPurchaseRequestSchema,
+    responses: {
+      200: PentestPurchaseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PURCHASE_NOT_VOIDABLE, details: { status }
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c40 = initContract();
-var pentestReportPdfContract = c40.router({
+var c42 = initContract();
+var pentestReportPdfContract = c42.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -35848,7 +36638,7 @@ var pentestReportPdfContract = c40.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c40.noBody(),
+    body: c42.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -36046,8 +36836,8 @@ var pentestReportPdfContract = c40.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c41 = initContract();
-var pentestValidationContract = c41.router({
+var c43 = initContract();
+var pentestValidationContract = c43.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -36155,8 +36945,8 @@ var pentestValidationContract = c41.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c42 = initContract();
-var repositoryContract = c42.router({
+var c44 = initContract();
+var repositoryContract = c44.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -36361,7 +37151,7 @@ var repositoryContract = c42.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c42.noBody(),
+    body: c44.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -36495,8 +37285,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c43 = initContract();
-var scanContract = c43.router({
+var c45 = initContract();
+var scanContract = c45.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -36617,8 +37407,8 @@ var StaffPentestStatsResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentest-stats.ts
-var c44 = initContract();
-var staffPentestStatsContract = c44.router({
+var c46 = initContract();
+var staffPentestStatsContract = c46.router({
   getStaffPentestStats: {
     method: "GET",
     path: "/staff/pentest-stats",
@@ -36661,8 +37451,8 @@ var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_export
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
-var c45 = initContract();
-var staffPentestsContract = c45.router({
+var c47 = initContract();
+var staffPentestsContract = c47.router({
   listStaffOrganizationPentests: {
     method: "GET",
     path: "/organizations/:organizationId/staff/pentests",
@@ -36813,8 +37603,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c46 = initContract();
-var staffQueueContract = c46.router({
+var c48 = initContract();
+var staffQueueContract = c48.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -36833,12 +37623,6 @@ var NOTES_MAX = 2e3;
 var TestIntegrationIdParamsSchema = external_exports.object({
   testIntegrationId: external_exports.uuid()
 });
-var PentestTestIntegrationsParamsSchema = OrgIdParamsSchema.extend({
-  pentestId: external_exports.uuid()
-});
-var PentestTestIntegrationIdParamsSchema = PentestTestIntegrationsParamsSchema.extend({
-  testIntegrationId: external_exports.uuid()
-});
 var TestIntegrationResponseSchema = external_exports.object({
   testIntegrationId: external_exports.uuid(),
   label: external_exports.string(),
@@ -36846,20 +37630,14 @@ var TestIntegrationResponseSchema = external_exports.object({
   notes: external_exports.string(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date(),
-  /** How many pentests this fixture is attached to — blast-radius context. */
-  attachedPentestCount: external_exports.number().int()
+  /**
+   * The second factor's NON-secret parameters, or null when the integration has
+   * none (or its stored parameters are unreadable). The setup key is never
+   * returned by any route.
+   */
+  mfa: CredentialMfaSummarySchema.nullable()
 }).strict();
 var ListTestIntegrationsResponseSchema = external_exports.array(TestIntegrationResponseSchema);
-var PentestTestIntegrationResponseSchema = external_exports.object({
-  testIntegrationId: external_exports.uuid(),
-  label: external_exports.string(),
-  notes: external_exports.string(),
-  attachedById: external_exports.uuid(),
-  attachedAt: external_exports.date()
-}).strict();
-var ListPentestTestIntegrationsResponseSchema = external_exports.array(
-  PentestTestIntegrationResponseSchema
-);
 var TestIntegrationLoginSchema = external_exports.object({
   username: external_exports.string().min(1).max(512),
   password: external_exports.string().min(1).max(1024)
@@ -36879,13 +37657,10 @@ var UpdateTestIntegrationRequestSchema = external_exports.object({
   apiKey: external_exports.string().min(1).max(4096).optional(),
   login: TestIntegrationLoginSchema.optional()
 }).strict();
-var AttachTestIntegrationRequestSchema = external_exports.object({
-  testIntegrationId: external_exports.uuid()
-}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c47 = initContract();
-var testIntegrationContract = c47.router({
+var c49 = initContract();
+var testIntegrationContract = c49.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -36938,39 +37713,50 @@ var testIntegrationContract = c47.router({
       500: ErrorResponseSchema
     }
   },
-  // -- Attach edges (org-scoped, staff-only) --------------------------------
-  listPentestTestIntegrations: {
-    method: "GET",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations",
-    pathParams: PentestTestIntegrationsParamsSchema,
+  // -- Second factor (org-less, verified staff) ------------------------------
+  // The same three routes as a customer credential's MFA (credential.ts), for
+  // the same reasons: PUT carries the whole factor so re-sending is idempotent;
+  // the code is a POST so it never sits in an access log or a cacheable read;
+  // DELETE is idempotent. Agents never reach these: they get codes through
+  // get_totp_code on the run-token channel, and never write a factor here.
+  setTestIntegrationMfa: {
+    method: "PUT",
+    path: "/staff/test-integrations/:testIntegrationId/mfa",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: SetCredentialMfaRequestSchema,
     responses: {
-      200: ListPentestTestIntegrationsResponseSchema,
+      // Never echoes the setup key: the integration shape, whose `mfa` carries
+      // the derived non-secret parameters.
+      200: TestIntegrationResponseSchema,
+      400: ErrorResponseSchema,
+      // CREDENTIAL_MFA_SETUP_KEY_INVALID
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  attachTestIntegration: {
+  generateTestIntegrationMfaCode: {
     method: "POST",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations",
-    pathParams: PentestTestIntegrationsParamsSchema,
-    body: AttachTestIntegrationRequestSchema,
+    path: "/staff/test-integrations/:testIntegrationId/mfa/code",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: c49.noBody(),
     responses: {
-      201: PentestTestIntegrationResponseSchema,
+      200: CredentialMfaCodeResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
-      // pentest or fixture not found
+      422: ErrorResponseSchema,
+      // CREDENTIAL_MFA_NOT_ENROLLED
       500: ErrorResponseSchema
     }
   },
-  detachTestIntegration: {
+  clearTestIntegrationMfa: {
     method: "DELETE",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations/:testIntegrationId",
-    pathParams: PentestTestIntegrationIdParamsSchema,
+    path: "/staff/test-integrations/:testIntegrationId/mfa",
+    pathParams: TestIntegrationIdParamsSchema,
     responses: {
-      204: DeleteResponseSchema,
+      200: TestIntegrationResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -37017,8 +37803,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c48 = initContract();
-var userContract = c48.router({
+var c50 = initContract();
+var userContract = c50.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -37133,8 +37919,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c49 = initContract();
-var vantaIntegrationContract = c49.router({
+var c51 = initContract();
+var vantaIntegrationContract = c51.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -37476,8 +38262,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c50 = initContract();
-var vulnerabilityContract = c50.router({
+var c52 = initContract();
+var vulnerabilityContract = c52.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -37702,8 +38488,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c51 = initContract();
-var vulnerabilityNoteContract = c51.router({
+var c53 = initContract();
+var vulnerabilityNoteContract = c53.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -37884,8 +38670,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c52 = initContract();
-var webhookSettingsContract = c52.router({
+var c54 = initContract();
+var webhookSettingsContract = c54.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -38023,8 +38809,8 @@ var webhookSettingsContract = c52.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c53 = initContract();
-var v1Contract = c53.router(
+var c55 = initContract();
+var v1Contract = c55.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -38074,6 +38860,8 @@ var v1Contract = c53.router(
     inviteLink: inviteLinkContract,
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
+    paymentCard: paymentCardContract,
+    pentestPurchase: pentestPurchaseContract,
     pentestEgress: pentestEgressContract,
     staffPentestStats: staffPentestStatsContract,
     staffPentests: staffPentestsContract,
@@ -38085,19 +38873,60 @@ var v1Contract = c53.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c54 = initContract();
-var contract = c54.router({
+var c56 = initContract();
+var contract = c56.router({
   v1: v1Contract
 });
 
+// ../../packages/api-contracts/src/contracts/v1/desktop-host-internal.ts
+var c57 = initContract();
+var MAX_VMS_PER_SYNC = 16;
+var DesktopHostSyncRequestSchema = external_exports.object({
+  /** Integer protocol the runner speaks. Below the api's minimum, the host gets
+   *  no new targets but keeps serving the ones it holds. */
+  protocolVersion: external_exports.number().int().min(1),
+  runnerVersion: external_exports.string().min(1).max(200),
+  /** Target ids with a VM on disk OR being created right now. */
+  presentVmIds: external_exports.array(external_exports.uuid()).max(MAX_VMS_PER_SYNC)
+});
+var DesktopHostSyncTargetSchema = external_exports.object({
+  desktopTargetId: external_exports.uuid(),
+  status: external_exports.enum(["PROVISIONING", "READY"]),
+  runVersion: external_exports.number().int().min(0),
+  runToken: external_exports.string().min(1),
+  /** Epoch millis the host deletes the VM by, whatever the api says later. */
+  localDeadlineMs: external_exports.number().int().positive(),
+  heartbeatSec: external_exports.number().int().positive()
+});
+var DesktopHostSyncResponseSchema = external_exports.object({
+  syncIntervalMs: external_exports.number().int().positive(),
+  /** This host's PROVISIONING and READY targets. Any VM the runner holds for an
+   *  id not listed here is deleted. */
+  targets: external_exports.array(DesktopHostSyncTargetSchema).max(MAX_VMS_PER_SYNC)
+});
+var desktopHostInternalContract = c57.router({
+  sync: {
+    method: "POST",
+    path: "/internal/v1/desktop-hosts/sync",
+    body: DesktopHostSyncRequestSchema,
+    responses: {
+      200: DesktopHostSyncResponseSchema,
+      400: ErrorResponseSchema,
+      // Bad, expired or revoked host token, or a decommissioned host.
+      401: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/github-webhook.api.ts
 var GitHubWebhookResponseSchema = external_exports.object({
   ok: external_exports.boolean()
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c55 = initContract();
-var githubWebhookContract = c55.router(
+var c58 = initContract();
+var githubWebhookContract = c58.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38115,7 +38944,7 @@ var githubWebhookContract = c55.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c55.router(
+var githubReadonlyWebhookContract = c58.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38135,9 +38964,9 @@ var githubReadonlyWebhookContract = c55.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c56 = initContract();
+var c59 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c56.router(
+var linearWebhookContract = c59.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38157,7 +38986,7 @@ var linearWebhookContract = c56.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c57 = initContract();
+var c60 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -38186,7 +39015,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c57.router(
+var forgeBitbucketContract = c60.router(
   {
     lifecycle: {
       method: "POST",
@@ -38233,8 +39062,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c58 = initContract();
-var healthContract = c58.router({
+var c61 = initContract();
+var healthContract = c61.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -38246,8 +39075,8 @@ var healthContract = c58.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c59 = initContract();
-var vulnerabilityShareContract = c59.router(
+var c62 = initContract();
+var vulnerabilityShareContract = c62.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -38334,8 +39163,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c60 = initContract();
-var prVulnerabilityContract = c60.router(
+var c63 = initContract();
+var prVulnerabilityContract = c63.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -39659,6 +40488,10 @@ var SEVERITY_ORDER = {
   LOW: 3,
   INFORMATIONAL: 4
 };
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
 function formatStatus(status) {
   return status.toLowerCase().replace(/_/g, " ");
 }
@@ -40366,7 +41199,7 @@ async function runRepositoryListCommand(options) {
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(displayedRepositories, null, 2));
+    printJson(displayedRepositories);
     return;
   }
   if (options.output === "tsv") {
@@ -40450,7 +41283,7 @@ async function runDependencyFilter(organizationId, options) {
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(displayedRepos, null, 2));
+    printJson(displayedRepos);
     return;
   }
   if (options.output === "tsv") {
@@ -40782,7 +41615,7 @@ async function runSetScanningBranchCommand(repoUrl, options) {
     }
     const urlById = new Map(listResult2.body.map((r2) => [r2.repositoryId, r2.repositoryUrl]));
     if (options.output === "json") {
-      console.log(JSON.stringify(allResults, null, 2));
+      printJson(allResults);
       return;
     }
     console.log("repositoryUrl	status	relabeledCount	error");
@@ -40964,13 +41797,7 @@ async function runSetScanningInclusionCommand(references, includedInScanning, op
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(
-      JSON.stringify(
-        { includedInScanning, updatedCount, notFoundRepositoryIds, repositories: outcomes },
-        null,
-        2
-      )
-    );
+    printJson({ includedInScanning, updatedCount, notFoundRepositoryIds, repositories: outcomes });
     return;
   }
   const notFound = new Set(notFoundRepositoryIds);
@@ -41255,12 +42082,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c62) => c62.type.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c65) => c65.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.name.padEnd(nameWidth)}  ${c62.type.padEnd(typeWidth)}  ${c62.repos.padStart(5)}  ${c62.url}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.name.padEnd(nameWidth)}  ${c65.type.padEnd(typeWidth)}  ${c65.repos.padStart(5)}  ${c65.url}`
   );
   return { header, rows };
 }
@@ -41280,12 +42107,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c62) => c62.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c62) => c62.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c62) => c62.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c65) => c65.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c65) => c65.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c65) => c65.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.scan.padEnd(4)}  ${c62.role.padEnd(roleWidth)}  ${c62.path.padEnd(pathWidth)}  ${c62.status}`
+    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.scan.padEnd(4)}  ${c65.role.padEnd(roleWidth)}  ${c65.path.padEnd(pathWidth)}  ${c65.status}`
   );
   return { header, rows };
 }
@@ -41326,7 +42153,7 @@ function printApplicationRepositoriesTsv(links) {
 }
 function outputApplication(app, output) {
   if (output === "json") {
-    console.log(JSON.stringify(app, null, 2));
+    printJson(app);
     return;
   }
   if (output === "tsv") {
@@ -41411,7 +42238,7 @@ async function runList(options) {
   }
   const apps = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(apps, null, 2));
+    printJson(apps);
     return;
   }
   if (output === "tsv") {
@@ -41460,7 +42287,7 @@ async function runRepos(applicationId, options) {
   }
   const links = sortApplicationRepositoryLinks(result.body);
   if (output === "json") {
-    console.log(JSON.stringify(links, null, 2));
+    printJson(links);
     return;
   }
   if (output === "tsv") {
@@ -42070,8 +42897,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c62, i2, m2) => {
-    const d = n3 ? n3(c62, i2) : c62;
+`).map((c65, i2, m2) => {
+    const d = n3 ? n3(c65, i2) : c65;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -42569,14 +43396,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c62 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c65 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c62 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c62 ? 1 : 0);
+  d && g++, c65 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c65 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -42597,14 +43424,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c62 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c65 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c62 && x.push(M), x;
+  return c65 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -42623,15 +43450,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c62 = this.value ? a2 : s;
+`, c65 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c62)}`;
+          return `${o2}${r2}${styleText2("dim", c65)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c62)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c65)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -42779,13 +43606,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c62 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c65 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c62}
+${u4}  ${styleText2("yellow", this.error)}${c65}
 `;
       }
       case "submit": {
@@ -42813,7 +43640,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c62}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c62}
+${r2}${c65}
 `;
       }
     }
@@ -42828,7 +43655,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c62 = this.userInputWithCursor, i2 = this.masked;
+`, c65 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -42848,7 +43675,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c62}
+        return `${o2}${s}${c65}
 ${n3}
 `;
       }
@@ -42864,7 +43691,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c61 = (t2, o2) => t2.includes(`
+var c64 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -42875,15 +43702,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c61(s, (i2) => styleText2("dim", i2))}`;
+        return `${c64(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c61(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c64(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -43165,7 +43992,7 @@ async function uploadLogo(organizationId, variant, file2) {
 }
 function outputOrganization(org, output, derived) {
   if (output === "json") {
-    console.log(JSON.stringify(org, null, 2));
+    printJson(org);
     return;
   }
   if (output === "tsv") {
@@ -43697,7 +44524,7 @@ Examples:
       }
     }
     if (options.output === "json") {
-      console.log(JSON.stringify(info, null, 2));
+      printJson(info);
       if (!info.loggedIn) {
         process.exitCode = 1;
       }
@@ -43836,7 +44663,7 @@ Examples:
       );
       const items = options.limit !== void 0 ? filteredItems.slice(0, options.limit) : filteredItems;
       if (options.output === "json") {
-        console.log(JSON.stringify(items, null, 2));
+        printJson(items);
         return;
       }
       if (options.output === "tsv") {
@@ -43912,16 +44739,10 @@ Examples:
     const active = organizationContext.activeOrganization;
     const source = organizationContext.selectedOrganizationId === active.organizationId ? "selected" : "default";
     if (options.output === "json") {
-      console.log(
-        JSON.stringify(
-          {
-            ...active,
-            source
-          },
-          null,
-          2
-        )
-      );
+      printJson({
+        ...active,
+        source
+      });
       return;
     }
     if (options.output === "tsv") {
@@ -44221,7 +45042,7 @@ Examples:
     }
     const { organizationId, slug } = resolution.organization;
     if (options.web) {
-      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/github`;
+      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/source-code`;
       const opened = await openBrowser(url2);
       if (!opened) {
         console.log(`Open in browser: ${url2}`);
@@ -44241,7 +45062,7 @@ Examples:
     }
     const codeSize = result.body;
     if (options.output === "json") {
-      console.log(JSON.stringify(codeSize, null, 2));
+      printJson(codeSize);
       return;
     }
     if (options.output === "tsv") {
@@ -44267,7 +45088,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c62) => !c62._hidden).map((c62) => extractCommandTree(c62));
+  const subcommands = cmd.commands.filter((c65) => !c65._hidden).map((c65) => extractCommandTree(c65));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -44333,7 +45154,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c62) => c62.name);
+  const subcommandNames = tree.subcommands.map((c65) => c65.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -44748,9 +45569,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c62) => c62.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c65) => c65.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c62) => `${c62.address.padEnd(addressWidth)}  ${c62.label}`);
+  const rows = cells.map((c65) => `${c65.address.padEnd(addressWidth)}  ${c65.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -44774,14 +45595,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c62) => c62.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c62) => c62.from.length));
-  const toWidth = Math.max(2, ...cells.map((c62) => c62.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c62) => c62.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c65) => c65.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c65) => c65.from.length));
+  const toWidth = Math.max(2, ...cells.map((c65) => c65.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c65) => c65.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.received.padEnd(receivedWidth)}  ${c62.from.padEnd(fromWidth)}  ${c62.to.padEnd(toWidth)}  ${c62.subject.padEnd(subjectWidth)}  ${c62.unread}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.received.padEnd(receivedWidth)}  ${c65.from.padEnd(fromWidth)}  ${c65.to.padEnd(toWidth)}  ${c65.subject.padEnd(subjectWidth)}  ${c65.unread}`
   );
   return { header, rows };
 }
@@ -44894,7 +45715,7 @@ function parseEmailSince(value) {
 }
 function outputInbox(inbox, output) {
   if (output === "json") {
-    console.log(JSON.stringify(inbox, null, 2));
+    printJson(inbox);
     return;
   }
   if (output === "tsv") {
@@ -44939,7 +45760,7 @@ async function runList2(options) {
   }
   const { inboxes, quota } = result.body;
   if (output === "json") {
-    console.log(JSON.stringify({ inboxes, quota }, null, 2));
+    printJson({ inboxes, quota });
     return;
   }
   if (output === "tsv") {
@@ -45025,7 +45846,7 @@ async function runEmails(label, options) {
   }
   const { address, messages } = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -45061,7 +45882,7 @@ async function runEmail(label, messageId, options) {
     failReadOp2("read email", result.status, result.body, label);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -45556,22 +46377,22 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c62) => ({
-    id: c62.credentialId,
-    label: sanitizeDisplay(c62.label),
-    type: c62.credentialType
+  const cells = creds.map((c65) => ({
+    id: c65.credentialId,
+    label: sanitizeDisplay(c65.label),
+    type: c65.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c62) => c62.label.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c65) => c65.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.label.padEnd(labelWidth)}  ${c62.type}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.label.padEnd(labelWidth)}  ${c65.type}`
   );
   return { header, rows };
 }
 function outputCredential(cred, output) {
   if (output === "json") {
-    console.log(JSON.stringify(cred, null, 2));
+    printJson(cred);
     return;
   }
   if (output === "tsv") {
@@ -45771,7 +46592,7 @@ async function runList3(options) {
   }
   const creds = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(creds, null, 2));
+    printJson(creds);
     return;
   }
   if (output === "tsv") {
@@ -45972,7 +46793,7 @@ async function runMfaCode(credentialId, options) {
     failMfaOp("generate a code for", result.status, result.body, credentialId);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -46210,6 +47031,12 @@ function failWriteOp4(action, status, body, notFoundLabel) {
           message ?? "This environment is frozen by an active pentest and cannot be changed."
         )
       );
+    } else if (errorCode === "ENVIRONMENT_IN_USE_BY_PENTEST") {
+      console.error(
+        colorError(
+          message ?? "A pentest still uses this environment. Remove it from the engagement first."
+        )
+      );
     } else {
       console.error(colorError(message ?? "Conflict (status 409)."));
     }
@@ -46329,14 +47156,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c62) => c62.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c65) => c65.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c62) => c62.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c65) => c65.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c62) => `${padLeading(c62.leading)}  ${c62.name.padEnd(nameWidth)}  ${c62.prod.padEnd(4)}  ${c62.url}`
+      (c65) => `${padLeading(c65.leading)}  ${c65.name.padEnd(nameWidth)}  ${c65.prod.padEnd(4)}  ${c65.url}`
     )
   };
 }
@@ -46355,7 +47182,7 @@ function buildEnvironmentsTable(envs) {
 }
 function outputEnvironment(env2, output) {
   if (output === "json") {
-    console.log(JSON.stringify(env2, null, 2));
+    printJson(env2);
     return;
   }
   if (output === "tsv") {
@@ -46477,7 +47304,7 @@ async function runListAcrossOrganization(output, pager) {
     createOrgEnvironmentRequests(organizationId)
   );
   if (output === "json") {
-    console.log(JSON.stringify(envs, null, 2));
+    printJson(envs);
     return;
   }
   if (output === "tsv") {
@@ -46517,7 +47344,7 @@ async function runList4(options) {
   }
   const envs = result.body;
   if (output === "json") {
-    console.log(JSON.stringify(envs, null, 2));
+    printJson(envs);
     return;
   }
   if (output === "tsv") {
@@ -47011,7 +47838,7 @@ async function runCreateFinding(options) {
     failCreateFinding(result.status, result.body, options.pentest);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   printCreatedFinding({
@@ -47180,6 +48007,12 @@ async function prepareUploadFile(filePath, options = {}) {
 }
 
 // src/pentest/status-update.ts
+var STATUS_UPDATE_TARGETS = [
+  "IN_PROGRESS",
+  "REMEDIATED",
+  "ACCEPTED_WITH_CONTROLS"
+];
+var STATUS_UPDATE_TARGET_LIST = STATUS_UPDATE_TARGETS.join(", ");
 var PENTEST_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|pt-\d+|\d+)$/i;
 var FINDING_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|ptf-\d+|\d+)$/i;
 var MAX_NOTE_LENGTH = 1e4;
@@ -47190,11 +48023,15 @@ function parseStatusUpdateTarget(raw) {
       error: "IN_REVIEW is not a finding status. Use IN_PROGRESS while fixing, then REMEDIATED when the fix is ready for retest."
     };
   }
-  if (normalized === "IN_PROGRESS" || normalized === "REMEDIATED") {
-    return normalized;
+  if (normalized === "ACCEPTED" || normalized === "ACCEPT") {
+    return "ACCEPTED_WITH_CONTROLS";
+  }
+  const target = STATUS_UPDATE_TARGETS.find((candidate) => candidate === normalized);
+  if (target !== void 0) {
+    return target;
   }
   return {
-    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use IN_PROGRESS or REMEDIATED.`
+    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use ${STATUS_UPDATE_TARGET_LIST}.`
   };
 }
 function isPentestIdentifier(value) {
@@ -47203,6 +48040,17 @@ function isPentestIdentifier(value) {
 function isFindingIdentifier(value) {
   return FINDING_IDENTIFIER_PATTERN.test(value);
 }
+function requireAcceptRationale(note) {
+  if (note === void 0) {
+    console.error(
+      colorError(
+        "--note is required when accepting a finding: say why the risk is acceptable or which controls cover it."
+      )
+    );
+    process.exit(1);
+  }
+  return note;
+}
 function failStatusUpdate(status, body, viaApiKey) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
@@ -47295,10 +48143,13 @@ async function runStatusUpdate(options) {
   }
   if (note !== void 0 && target === "IN_PROGRESS") {
     console.error(
-      colorError("--note is only used when reporting remediation (--status REMEDIATED).")
+      colorError(
+        "--note is only used when reporting remediation or accepting (--status REMEDIATED or ACCEPTED_WITH_CONTROLS)."
+      )
     );
     process.exit(1);
   }
+  const rationale = target === "ACCEPTED_WITH_CONTROLS" ? requireAcceptRationale(note) : null;
   const viaApiKey = requireAuth().kind === "api_key";
   const organizationId = await resolveOrganizationId();
   const params = {
@@ -47311,6 +48162,8 @@ async function runStatusUpdate(options) {
       params,
       body: { status: target, ...note !== void 0 ? { note } : {} }
     })
+  ) : rationale !== null ? await authenticatedRequest(
+    (client) => client.pentestFinding.accept({ params, body: { rationale } })
   ) : target === "IN_PROGRESS" ? await authenticatedRequest(
     (client) => client.pentestFinding.startProgress({ params, body: {} })
   ) : await authenticatedRequest(
@@ -47323,7 +48176,7 @@ async function runStatusUpdate(options) {
     failStatusUpdate(result.status, result.body, viaApiKey);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   const displayId = result.body.displayId;
@@ -47331,19 +48184,24 @@ async function runStatusUpdate(options) {
   console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
 }
 function createStatusUpdateCommand() {
-  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
+  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS, REMEDIATED, or ACCEPTED_WITH_CONTROLS").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
     "--status <status>",
-    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
-  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "IN_PROGRESS (start work), REMEDIATED (ready for retest), or ACCEPTED_WITH_CONTROLS (accept the risk)"
+  ).option(
+    "--note <text>",
+    "Context when reporting remediation; the required rationale when accepting"
+  ).option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
     "after",
     `
 Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
 can mark a finding in progress when it starts the fix, then remediated when the
 fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
-sending REMEDIATED) keeps it out of the retest queue.
+sending REMEDIATED) keeps it out of the retest queue. ACCEPTED_WITH_CONTROLS
+(also spelled ACCEPTED) closes the finding as an accepted risk with no Trace
+review; --note carries the rationale and is required.
 
-IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+IN_PROGRESS is allowed from OPEN, VERIFIED_OPEN, or PARTIALLY_FIXED. REMEDIATED and
+ACCEPTED_WITH_CONTROLS are allowed from OPEN, IN_PROGRESS, VERIFIED_OPEN, or PARTIALLY_FIXED.
 
 A signed-in session (\`tracecli auth login\`) attributes the change to you. A
 Trace API key works too, once Trace enables finding automation for your
@@ -47354,7 +48212,9 @@ Examples:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
   tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
-    --note "Fixed in PR 412" --output json`
+    --note "Fixed in PR 412" --output json
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status ACCEPTED \\
+    --note "Internal-only endpoint behind SSO; residual risk accepted"`
   ).action(async (options) => {
     await runStatusUpdate(options);
   });
@@ -47616,7 +48476,7 @@ async function runReportDownload(pentestIdentifier, options) {
     output
   });
   if (output === "json") {
-    console.log(JSON.stringify({ report, artifact, path: destination, sizeBytes: bytes }, null, 2));
+    printJson({ report, artifact, path: destination, sizeBytes: bytes });
     return;
   }
   if (output === "tsv") {
@@ -47720,7 +48580,7 @@ async function runAttestationList(pentestIdentifier, options) {
   const organizationId = await resolveOrganizationId();
   const attestations = await fetchAttestations(organizationId, pentestIdentifier);
   if (output === "json") {
-    console.log(JSON.stringify(attestations, null, 2));
+    printJson(attestations);
     return;
   }
   if (output === "tsv") {
@@ -47805,7 +48665,7 @@ async function runAttestationDownload(pentestIdentifier, options) {
     output
   });
   if (output === "json") {
-    console.log(JSON.stringify({ attestation, path: destination, sizeBytes: bytes }, null, 2));
+    printJson({ attestation, path: destination, sizeBytes: bytes });
     return;
   }
   if (output === "tsv") {
@@ -47994,7 +48854,7 @@ async function runAttachEvidence(options) {
     process.exit(1);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(attached.body, null, 2));
+    printJson(attached.body);
     return;
   }
   const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
@@ -48147,7 +49007,7 @@ async function runGetFinding(options) {
     failGetFinding(result.status, result.body);
   }
   if (options.output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   process.stdout.write(formatFindingMarkdown(result.body));
@@ -48388,7 +49248,7 @@ Examples:
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(pentests, null, 2));
+        printJson(pentests);
         return;
       }
       if (isTsv) {
@@ -48439,7 +49299,7 @@ function createFindingsListCommand() {
     (value) => value.toUpperCase()
   ).option(
     "--status <status>",
-    "Filter by status (OPEN, IN_PROGRESS, CONTESTED, REMEDIATED, VERIFIED_FIXED, VERIFIED_OPEN, ACCEPTED_WITH_CONTROLS, DISMISSED)",
+    `Filter by status (${PentestFindingStatusValues.join(", ")})`,
     (value) => value.toUpperCase()
   ).option(
     "-L, --limit <n>",
@@ -48471,7 +49331,9 @@ Full detail, for feeding an agent that fixes the findings:
 
 Then mark work as it happens:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED`
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status ACCEPTED \\
+    --note "Internal-only endpoint behind SSO; residual risk accepted"`
   ).action(
     async (options) => {
       if (options.detail && options.output !== "json") {
@@ -48537,7 +49399,7 @@ Re-run with: tracecli pentest findings list --pentest ${options.pentest} --detai
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(findings, null, 2));
+        printJson(findings);
         return;
       }
       if (isTsv) {
@@ -48630,7 +49492,7 @@ async function runFindingsDetailPull(organizationId, options) {
     }
     return { findings: result.body.findings, total: result.body.total };
   }, options);
-  console.log(JSON.stringify(matching, null, 2));
+  printJson(matching);
 }
 function renderPentestFindingLines(finding) {
   const sev = formatFindingSeverity(finding.severity);
@@ -48791,7 +49653,7 @@ function printPentestUpdateTsv(pt) {
 }
 function outputPentestUpdate(pt, output) {
   if (output === "json") {
-    console.log(JSON.stringify(pt, null, 2));
+    printJson(pt);
     return;
   }
   if (output === "tsv") {
@@ -49956,13 +50818,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c62) => c62.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c62) => c62.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c62) => c62.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c65) => c65.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c65) => c65.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c65) => c65.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.kind.padEnd(kindWidth)}  ${c62.status.padEnd(statusWidth)}  ${c62.size.padEnd(sizeWidth)}  ${c62.id}`
+    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.kind.padEnd(kindWidth)}  ${c65.status.padEnd(statusWidth)}  ${c65.size.padEnd(sizeWidth)}  ${c65.id}`
   );
   return { header, rows };
 }
@@ -50025,7 +50887,7 @@ function printUploadsTsv(uploads) {
 }
 function outputUpload(upload, output) {
   if (output === "json") {
-    console.log(JSON.stringify(upload, null, 2));
+    printJson(upload);
     return;
   }
   if (output === "tsv") {
@@ -50320,7 +51182,7 @@ async function runList5(options) {
   const output = parseOutput(options.output);
   if (options.web) {
     const slug = await resolveOrganizationSlug();
-    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/sources`;
+    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/source-code/upload`;
     const opened = await openBrowser(url2);
     if (!opened) console.log(url2);
     return;
@@ -50333,7 +51195,7 @@ async function runList5(options) {
     ...applicationId !== void 0 ? { applicationId } : {}
   });
   if (output === "json") {
-    console.log(JSON.stringify({ uploads }, null, 2));
+    printJson({ uploads });
     return;
   }
   if (output === "tsv") {
@@ -50397,18 +51259,12 @@ async function runDownload(codeUploadIdArg, options, runtime) {
     process.exit(1);
   }
   if (output === "json") {
-    console.log(
-      JSON.stringify(
-        {
-          upload,
-          path: destination,
-          sizeBytes: upload.sizeBytes,
-          archiveSha256: upload.archiveSha256
-        },
-        null,
-        2
-      )
-    );
+    printJson({
+      upload,
+      path: destination,
+      sizeBytes: upload.sizeBytes,
+      archiveSha256: upload.archiveSha256
+    });
     return;
   }
   if (output === "tsv") {
@@ -50486,7 +51342,7 @@ async function runLink(options) {
     failWriteOp5("link", result.status, result.body);
   }
   if (output === "json") {
-    console.log(JSON.stringify(result.body, null, 2));
+    printJson(result.body);
     return;
   }
   if (output === "tsv") {
@@ -50833,7 +51689,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
       process.exit(1);
     }
     if (options.output === "json") {
-      console.log(JSON.stringify(result.body, null, 2));
+      printJson(result.body);
       return;
     }
     if (options.output === "tsv") {
@@ -50957,7 +51813,7 @@ Examples:
         return;
       }
       if (isJson) {
-        console.log(JSON.stringify(items, null, 2));
+        printJson(items);
       } else if (isTsv) {
         printVulnerabilitiesTsv(items);
       } else {