securewithtrace 0.45.1 → 0.47.0

package/dist/index.js

@@ -3695,6 +3695,7 @@ var PENTEST_FINDING_STATUS_VALUES = [
   "REMEDIATED",
   "VERIFIED_FIXED",
   "VERIFIED_OPEN",
+  "PARTIALLY_FIXED",
   "ACCEPTED_WITH_CONTROLS",
   "DISMISSED"
 ];
@@ -6292,7 +6293,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c62) => c62 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c65) => c65 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16336,9 +16337,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c62 = inst._zod.bag;
-  inst.minDate = c62.minimum ? new Date(c62.minimum) : null;
-  inst.maxDate = c62.maximum ? new Date(c62.maximum) : null;
+  const c65 = inst._zod.bag;
+  inst.minDate = c65.minimum ? new Date(c65.minimum) : null;
+  inst.maxDate = c65.maximum ? new Date(c65.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -22162,6 +22163,8 @@ var AgentSessionFailureReasonValues = [
   "INTERNAL"
 ];
 var AgentSessionFailureReason = external_exports.enum(AgentSessionFailureReasonValues);
+var AgentSessionLaunchTargetValues = ["ECS", "LOCAL"];
+var AgentSessionLaunchTarget = external_exports.enum(AgentSessionLaunchTargetValues);
 var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC", "OPENAI"];
 var AgentSessionProvider = external_exports.enum(AgentSessionProviderValues);
 var AgentSessionEventKindValues = [
@@ -22194,6 +22197,9 @@ var MAX_AGENT_SESSION_OBJECTIVE_CHARS = 32e3;
 var CreateAgentSessionCommonSchema = external_exports.object({
   provider: AgentSessionProvider.optional(),
   model: external_exports.string().min(1).max(200).optional(),
+  /** LOCAL leaves the launch for the caller to claim (`claimLocalLaunch`) instead of
+   *  submitting a Fargate task. Staff tooling only; the dashboard never sends it. */
+  launchTarget: AgentSessionLaunchTarget.optional(),
   maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional(),
   maxWallClockMin: external_exports.number().int().positive().max(24 * 60).optional()
 });
@@ -22280,7 +22286,25 @@ var ResumeAgentSessionRequestSchema = external_exports.object({
   /** Budget raise — required to leave WAITING_ON_STAFF(BUDGET_EXHAUSTED). Same
    *  lifetime ceiling as create: a raise past it is not expressible, which is why
    *  the create cap had to move for the engagement-wide validator. */
-  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional()
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD).optional(),
+  /** Move the session between the Fargate path and a staff-claimed local host. Omitted
+   *  keeps the row's current target. */
+  launchTarget: AgentSessionLaunchTarget.optional()
+});
+var ClaimLocalLaunchResponseSchema = external_exports.object({
+  agentSessionId: external_exports.uuid(),
+  runAttemptId: external_exports.uuid(),
+  runVersion: external_exports.number().int().positive(),
+  /** The host image this environment's task definition runs (`<repo>:<assetHash>` in the
+   *  environment's ECR). Null when the environment has no deployed image (the local stack). */
+  imageUri: external_exports.string().nullable(),
+  /** The full container env contract: the same keys the ECS launch passes as container
+   *  overrides (`AGENT_SESSION_*` plus the credential env). Carries the run token, so it is
+   *  returned once and never logged. */
+  env: external_exports.record(external_exports.string(), external_exports.string())
+});
+var LocalHostImageResponseSchema = external_exports.object({
+  imageUri: external_exports.string().nullable()
 });
 var ListAgentSessionEventsQuerySchema = external_exports.object({
   /** Return events with seq > sinceSeq (poll cursor). */
@@ -22315,6 +22339,10 @@ var AgentSessionSummarySchema = external_exports.object({
   launchedAt: external_exports.coerce.date().nullable(),
   lastActivityAt: external_exports.coerce.date().nullable(),
   completedAt: external_exports.coerce.date().nullable(),
+  launchTarget: AgentSessionLaunchTarget,
+  /** Null while parked, and on a LOCAL row until its launch is claimed: LAUNCHING with this
+   *  null on a LOCAL row is "awaiting claim". */
+  taskSubmittedAt: external_exports.coerce.date().nullable(),
   createdById: external_exports.uuid(),
   createdAt: external_exports.coerce.date(),
   updatedAt: external_exports.coerce.date()
@@ -22618,6 +22646,43 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  // The host image this environment's agent-session task definition runs. Reads
+  // config, mints nothing: it exists so a staff CLI can pull the image BEFORE it
+  // creates or resumes a LOCAL session, keeping the boot deadline off the pull.
+  getLocalHostImage: {
+    method: "GET",
+    path: "/organizations/:organizationId/agent-sessions/local-host-image",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: LocalHostImageResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Claim a LOCAL session's launch: mints the run token and returns the container
+  // env the ECS launch would have passed as overrides. Single-shot (a second
+  // claim is 409): two containers must never hold valid tokens for one run.
+  // Verified staff only: the response carries the token and the org's
+  // customer credential env.
+  claimLocalLaunch: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/local-launch",
+    pathParams: AgentSessionIdParamsSchema,
+    body: null,
+    responses: {
+      200: ClaimLocalLaunchResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // LAUNCH_TARGET_NOT_LOCAL (an ECS row) or LOCAL_LAUNCH_NOT_PENDING (already
+      // claimed, parked, or terminal).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      // LOCAL_LAUNCH_UNCONFIGURED: this environment has no public host api URL.
+      503: ErrorResponseSchema
+    }
+  },
   // Staff "Review": advance a VALIDATION pentest VALIDATION_RUNNING →
   // AWAITING_VALIDATION_REVIEW WITHOUT terminating the session (it stays
   // IDLE/resumable for a customer-feedback follow-up). Distinct from stop, which
@@ -22858,6 +22923,145 @@ var ListAgentTasksQuerySchema = external_exports.object({
 });
 var ListAgentTasksResponseSchema = external_exports.array(AgentTaskResponseSchema);
 
+// ../../packages/api-contracts/src/schemas/api/v1/code-upload.api.ts
+var CODE_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
+var CODE_UPLOAD_PART_SIZE_BYTES = 10 * 1024 * 1024;
+var CodeUploadStatusValues = [
+  "UPLOADING",
+  "FINALIZING",
+  "SCANNING",
+  "VALIDATING",
+  "READY",
+  "REJECTED",
+  "DELETING",
+  "FAILED"
+];
+var CodeUploadMalwareScanResultValues = [
+  "NO_THREATS_FOUND",
+  "THREATS_FOUND",
+  "UNSUPPORTED",
+  "ACCESS_DENIED",
+  "FAILED"
+];
+var CodeUploadRejectionReasonValues = [
+  "MALWARE_DETECTED",
+  "MALWARE_SCAN_UNSUPPORTED",
+  "MALWARE_SCAN_UNAVAILABLE",
+  "INVALID_ARCHIVE",
+  "INTEGRITY_MISMATCH"
+];
+var CodeUploadArtifactKindValues = ["SOURCE_ARCHIVE", "ANDROID_APK", "IOS_IPA"];
+function isApplicationBuildArtifactKind(kind) {
+  return kind === "ANDROID_APK" || kind === "IOS_IPA";
+}
+var CodeUploadIdParamsSchema = OrgIdParamsSchema.extend({
+  codeUploadId: external_exports.uuid()
+});
+var ListCodeUploadsQuerySchema = external_exports.object({
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).optional(),
+  applicationId: external_exports.uuid().optional()
+}).strict();
+var InitializeCodeUploadRequestSchema = external_exports.object({
+  displayName: external_exports.string().trim().min(1).max(200),
+  originalFilename: external_exports.string().trim().min(1).max(255),
+  sizeBytes: external_exports.number().int().min(1).max(CODE_UPLOAD_MAX_BYTES),
+  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // Defaulted so a pre-this-release client that omitted the field still
+  // initializes a source ZIP during a mixed-version rollout.
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
+  applicationId: external_exports.uuid().optional()
+}).strict().superRefine((data, ctx) => {
+  const filename = data.originalFilename.toLowerCase();
+  if (isApplicationBuildArtifactKind(data.artifactKind)) {
+    const extension = data.artifactKind === "ANDROID_APK" ? ".apk" : ".ipa";
+    if (!filename.endsWith(extension)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["originalFilename"],
+        message: `originalFilename must end in ${extension}`
+      });
+    }
+    if (data.applicationId == null) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["applicationId"],
+        message: "A build upload must target a mobile application."
+      });
+    }
+    return;
+  }
+  if (!filename.endsWith(".zip")) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["originalFilename"],
+      message: "originalFilename must end in .zip"
+    });
+  }
+  if (data.applicationId != null) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["applicationId"],
+      message: "Source archives are linked to an application after they are ready."
+    });
+  }
+});
+var LinkedCodeUploadApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string()
+});
+var CodeUploadSchema = external_exports.object({
+  codeUploadId: external_exports.uuid(),
+  repositoryId: external_exports.uuid(),
+  displayName: external_exports.string(),
+  originalFilename: external_exports.string(),
+  sizeBytes: external_exports.number().int().positive(),
+  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  status: external_exports.enum(CodeUploadStatusValues),
+  malwareScanResult: external_exports.enum(CodeUploadMalwareScanResultValues).nullable(),
+  rejectionReason: external_exports.enum(CodeUploadRejectionReasonValues).nullable(),
+  // Defaulted so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject source-upload rows that omit the field.
+  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
+  applicationId: external_exports.uuid().nullable().default(null),
+  // z.coerce.date(), not z.date(): web server actions safeParse the raw
+  // ts-rest JSON body, where these arrive as ISO strings.
+  scanningStartedAt: external_exports.coerce.date().nullable(),
+  readyAt: external_exports.coerce.date().nullable(),
+  createdAt: external_exports.coerce.date(),
+  linkedApplications: external_exports.array(LinkedCodeUploadApplicationSchema)
+});
+var CodeUploadPartUrlSchema = external_exports.object({
+  partNumber: external_exports.number().int().positive(),
+  uploadUrl: external_exports.url()
+});
+var UploadedCodeUploadPartSchema = external_exports.object({
+  partNumber: external_exports.number().int().positive(),
+  sizeBytes: external_exports.number().int().positive()
+});
+var CodeUploadMultipartSchema = external_exports.object({
+  partSizeBytes: external_exports.literal(CODE_UPLOAD_PART_SIZE_BYTES),
+  parts: external_exports.array(CodeUploadPartUrlSchema),
+  expiresAt: external_exports.coerce.date()
+});
+var InitializeCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  multipart: CodeUploadMultipartSchema
+});
+var ResumeCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  multipart: CodeUploadMultipartSchema.extend({
+    uploadedParts: external_exports.array(UploadedCodeUploadPartSchema)
+  })
+});
+var ListCodeUploadsResponseSchema = external_exports.object({
+  uploads: external_exports.array(CodeUploadSchema)
+});
+var DownloadCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/inbox.api.ts
 var InboxLabelSchema = external_exports.string().regex(
   /^[a-z][a-z0-9-]{0,39}$/,
@@ -22930,6 +23134,87 @@ var GetInboxMessageResponseSchema = external_exports.object({
   })
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/payment-card.api.ts
+var PAYMENT_CARD_NOTES_MAX = 2e3;
+function passesLuhn(digits) {
+  if (!/^\d+$/.test(digits)) return false;
+  let sum = 0;
+  let double = false;
+  for (let i2 = digits.length - 1; i2 >= 0; i2--) {
+    let d = digits.charCodeAt(i2) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var PaymentCardIdParamsSchema = external_exports.object({
+  paymentCardId: external_exports.uuid()
+});
+var PaymentCardBillingAddressSchema = external_exports.object({
+  line1: external_exports.string().min(1).max(200),
+  line2: external_exports.string().max(200).optional(),
+  city: external_exports.string().min(1).max(100),
+  region: external_exports.string().max(100).optional(),
+  postalCode: external_exports.string().min(1).max(20),
+  /** ISO 3166-1 alpha-2, upper-cased by the service. */
+  country: external_exports.string().regex(/^[A-Za-z]{2}$/, "Country is a two-letter code, like US.")
+}).strict();
+var CardNumberSchema = external_exports.string().regex(/^\d{12,19}$/, "Card number must be 12 to 19 digits.").refine(passesLuhn, { message: "Card number fails its check digit." });
+var CardCvcSchema = external_exports.string().regex(/^\d{3,4}$/, "CVC must be 3 or 4 digits.");
+var CardExpMonthSchema = external_exports.number().int().min(1).max(12);
+var CardExpYearSchema = external_exports.number().int().min(2026).max(2100);
+var PaymentCardResponseSchema = external_exports.object({
+  paymentCardId: external_exports.uuid(),
+  label: external_exports.string(),
+  last4: external_exports.string(),
+  expMonth: external_exports.number().int(),
+  expYear: external_exports.number().int(),
+  cardholderName: external_exports.string(),
+  billingAddress: PaymentCardBillingAddressSchema,
+  notes: external_exports.string(),
+  active: external_exports.boolean(),
+  /** Expiry month is before the current UTC month; the gate treats such a card as absent. */
+  expired: external_exports.boolean(),
+  /** Purchases with status AUTHORIZED or COMPLETED, across every engagement. */
+  purchaseCount: external_exports.number().int(),
+  /** Sum of those purchases' amounts, USD. Answers "how close to the issuer limit". */
+  committedUsd: external_exports.number(),
+  /**
+   * False once ANY purchase row references the card, whatever its status: the
+   * FK is Restrict, so delete would be refused. The UI offers Turn off instead.
+   */
+  deletable: external_exports.boolean(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+}).strict();
+var ListPaymentCardsResponseSchema = external_exports.array(PaymentCardResponseSchema);
+var CreatePaymentCardRequestSchema = external_exports.object({
+  label: external_exports.string().min(1).max(200),
+  number: CardNumberSchema,
+  cvc: CardCvcSchema,
+  expMonth: CardExpMonthSchema,
+  expYear: CardExpYearSchema,
+  cardholderName: external_exports.string().min(1).max(200),
+  billingAddress: PaymentCardBillingAddressSchema,
+  notes: external_exports.string().max(PAYMENT_CARD_NOTES_MAX).optional(),
+  /**
+   * Defaults true. Creating an active card deactivates the current active card
+   * in the same transaction.
+   */
+  active: external_exports.boolean().optional()
+}).strict();
+var UpdatePaymentCardRequestSchema = external_exports.object({
+  label: external_exports.string().min(1).max(200).optional(),
+  cardholderName: external_exports.string().min(1).max(200).optional(),
+  billingAddress: PaymentCardBillingAddressSchema.optional(),
+  notes: external_exports.string().max(PAYMENT_CARD_NOTES_MAX).optional(),
+  active: external_exports.boolean().optional()
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-attack-chain.api.ts
 var PentestAttackChainParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -23185,6 +23470,8 @@ var RepositoryResponseSchema = external_exports.object({
   prScansEnabled: external_exports.boolean(),
   /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
   includedInScanning: external_exports.boolean(),
+  /** Host archive flag mirrored from the provider. */
+  isArchived: external_exports.boolean(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
@@ -23715,6 +24002,10 @@ var ReportCanvasFindingSchema = external_exports.object({
    */
   description: external_exports.string(),
   proofOfConcept: external_exports.string().nullable(),
+  /** Customer-visible acceptance rationale a RAW-rendered ACCEPTED_WITH_CONTROLS
+   * finding shows under Compensating Controls; null otherwise. Optional while the
+   * web and API roll independently. */
+  acceptanceRationale: external_exports.string().nullable().optional(),
   // Per-finding prose staleness (precise — keyed to the finding's own columns).
   proseConfirmed: external_exports.boolean(),
   statusFramingStale: external_exports.boolean(),
@@ -23974,6 +24265,9 @@ var IssuedFindingSnapshotSchema = external_exports.object({
   description: external_exports.string(),
   proofOfConcept: external_exports.string().nullable(),
   remediation: external_exports.string().nullable(),
+  /** Compensating Controls text of a RAW-rendered ACCEPTED_WITH_CONTROLS finding;
+   * null otherwise. Optional so pre-feature issue snapshots remain parseable. */
+  acceptanceRationale: external_exports.string().nullable().optional(),
   repositories: external_exports.array(
     external_exports.object({
       repositoryName: external_exports.string(),
@@ -24399,6 +24693,10 @@ var PentestFindingRepositorySchema = external_exports.object({
   startLine: external_exports.number().nullable(),
   endLine: external_exports.number().nullable()
 });
+var PentestFindingApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string()
+});
 var PentestFindingResponseSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
@@ -24462,6 +24760,10 @@ var PentestFindingListItemSchema = PentestFindingResponseSchema.omit({
   attackScenario: true,
   severityConsiderations: true,
   verification: true
+}).extend({
+  // Derived by `loadFindingApplications` for the list reads only; it backs the
+  // application filter. `.default([])` keeps an API that predates it parsing.
+  applications: external_exports.array(PentestFindingApplicationSchema).default([])
 });
 var ListPentestFindingsResponseSchema = external_exports.array(PentestFindingListItemSchema);
 var OperatorFindingEvidenceSchema = external_exports.object({
@@ -24510,7 +24812,8 @@ var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
   createdByName: true,
   reportProseAt: true,
   reportProseStatus: true,
-  externalTicket: true
+  externalTicket: true,
+  applications: true
 });
 var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit({
   repositoryId: true
@@ -24792,6 +25095,30 @@ var PublishedFindingSchema = external_exports.object({
 var PublishAllFindingsResponseSchema = external_exports.object({
   published: external_exports.array(PublishedFindingSchema)
 });
+var CopyPentestFindingsRequestSchema = external_exports.object({
+  sourcePentestId: external_exports.uuid(),
+  pentestFindingIds: external_exports.array(external_exports.uuid()).min(1).max(200).optional(),
+  applicationId: external_exports.uuid().optional(),
+  /** Report the selection without writing anything. */
+  dryRun: external_exports.boolean().optional()
+}).strict().refine((body) => body.pentestFindingIds === void 0 !== (body.applicationId === void 0), {
+  message: "Provide exactly one of pentestFindingIds or applicationId."
+});
+var CopiedPentestFindingSchema = external_exports.object({
+  sourcePentestFindingId: external_exports.uuid(),
+  sourceDisplayId: external_exports.int().nullable(),
+  /** The source's status; the copy itself is always OPEN. */
+  sourceStatus: PentestFindingStatus,
+  /** The new draft's id; null on a dry run. */
+  pentestFindingId: external_exports.uuid().nullable(),
+  title: external_exports.string(),
+  severity: PentestFindingSeverity,
+  evidenceCount: external_exports.int().nonnegative()
+});
+var CopyPentestFindingsResponseSchema = external_exports.object({
+  dryRun: external_exports.boolean(),
+  findings: external_exports.array(CopiedPentestFindingSchema)
+});
 var RecoverStrandedFindingsRequestSchema = external_exports.object({
   dryRun: external_exports.boolean().optional()
 });
@@ -25003,12 +25330,22 @@ var StartProgressPentestFindingRequestSchema = external_exports.object({});
 var ReportRemediationPentestFindingRequestSchema = external_exports.object({
   note: external_exports.string().trim().min(1).max(1e4).optional()
 });
-var AutomationFindingTransitionSchema = external_exports.enum(["IN_PROGRESS", "REMEDIATED"]);
+var AcceptCustomerPentestFindingRequestSchema = external_exports.object({
+  rationale: external_exports.string().trim().min(1).max(1e4)
+});
+var AutomationFindingTransitionSchema = external_exports.enum([
+  "IN_PROGRESS",
+  "REMEDIATED",
+  "ACCEPTED_WITH_CONTROLS"
+]);
 var AutomationStatusUpdateRequestSchema = external_exports.object({
   status: AutomationFindingTransitionSchema,
   note: external_exports.string().trim().min(1).max(1e4).optional()
-}).refine((value) => value.note === void 0 || value.status === "REMEDIATED", {
-  message: "note is only accepted when reporting remediation (status REMEDIATED)",
+}).refine((value) => value.note === void 0 || value.status !== "IN_PROGRESS", {
+  message: "note is not accepted when starting progress (status IN_PROGRESS)",
+  path: ["note"]
+}).refine((value) => value.note !== void 0 || value.status !== "ACCEPTED_WITH_CONTROLS", {
+  message: "note is required when accepting a finding (status ACCEPTED_WITH_CONTROLS)",
   path: ["note"]
 });
 var ReopenPentestFindingTargetStatusSchema = external_exports.enum(["OPEN", "IN_PROGRESS"]);
@@ -25025,10 +25362,11 @@ var retestVerificationOnlyOnFixed = (value, ctx) => {
     });
   }
 };
+var PENTEST_FINDING_RETEST_VERIFICATION_MAX_LENGTH = 8e3;
 var CreatePentestFindingRetestRequestSchema = external_exports.object({
   outcome: ManualRetestOutcome,
   notes: external_exports.string().trim().min(1).max(1e4),
-  verification: external_exports.string().trim().min(1).max(8e3).optional()
+  verification: external_exports.string().trim().min(1).max(PENTEST_FINDING_RETEST_VERIFICATION_MAX_LENGTH).optional()
 });
 var CreatePentestFindingRetestBodySchema = CreatePentestFindingRetestRequestSchema.superRefine(retestVerificationOnlyOnFixed);
 var CreatePentestFindingNoteRequestSchema = external_exports.object({
@@ -25224,6 +25562,46 @@ var PromotePentestHypothesisRequestSchema = external_exports.object({
   manualFindingIds: HypothesisSourceIdsSchema.optional()
 }).strict().optional();
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-purchase.api.ts
+var PurchaseStatusValues = ["AUTHORIZED", "COMPLETED", "DECLINED", "VOIDED"];
+var PurchaseStatus = external_exports.enum(PurchaseStatusValues);
+var PurchaseOutcomeValues = ["COMPLETED", "DECLINED"];
+var PurchaseOutcome = external_exports.enum(PurchaseOutcomeValues);
+var PentestPurchaseParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: PentestIdOrDisplayIdSchema
+});
+var PentestPurchaseIdParamsSchema = PentestPurchaseParamsSchema.extend({
+  purchaseId: external_exports.uuid()
+});
+var PentestPurchaseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  agentSessionId: external_exports.uuid(),
+  agentSessionType: AgentSessionType,
+  paymentCardLabel: external_exports.string(),
+  paymentCardLast4: external_exports.string(),
+  amountUsd: external_exports.number(),
+  merchant: external_exports.string(),
+  purpose: external_exports.string(),
+  status: PurchaseStatus,
+  voidedAt: external_exports.coerce.date().nullable(),
+  voidedByLabel: external_exports.string().nullable(),
+  voidReason: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+}).strict();
+var ListPentestPurchasesResponseSchema = external_exports.object({
+  capUsd: external_exports.number(),
+  /** Every AUTHORIZED and COMPLETED amount, summed in cents. */
+  committedUsd: external_exports.number(),
+  /** `capUsd - committedUsd`, never below 0 (a cap lowered under the committed sum). */
+  remainingUsd: external_exports.number(),
+  /** Newest first. */
+  purchases: external_exports.array(PentestPurchaseSchema)
+}).strict();
+var VoidPentestPurchaseRequestSchema = external_exports.object({
+  reason: external_exports.string().trim().min(1).max(1e3)
+}).strict();
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.string().min(1)
@@ -25243,6 +25621,10 @@ var CustomerPentestStatusValues = [
   "PAUSED"
 ];
 var CustomerPentestStatus = external_exports.enum(CustomerPentestStatusValues);
+var PentestFindingStatusCountShape = Object.fromEntries(
+  PentestFindingStatusValues.map((status) => [status, external_exports.number().default(0)])
+);
+var PentestFindingStatusCountsByStatusSchema = external_exports.object(PentestFindingStatusCountShape).catchall(external_exports.number());
 var BoundPentestApplicationSchema = external_exports.object({
   applicationId: external_exports.uuid(),
   name: external_exports.string(),
@@ -25302,6 +25684,12 @@ var PentestResponseSchema = external_exports.object({
   hypothesisBudgetCapUsd: external_exports.number(),
   validationBudgetCapUsd: external_exports.number(),
   perHypothesisBudgetCapUsd: external_exports.number(),
+  /**
+   * Per-engagement purchase allowance (USD; 0 = purchasing off). `.optional()`
+   * for the rolling-deploy reason `testType` states above: the staff panel
+   * renders the row read-only when an older API omits it.
+   */
+  purchaseCapUsd: external_exports.number().optional(),
   startedAt: external_exports.coerce.date().nullable(),
   endedAt: external_exports.coerce.date().nullable(),
   /**
@@ -25317,7 +25705,7 @@ var PentestResponseSchema = external_exports.object({
   findingCounts: external_exports.object({
     total: external_exports.number(),
     bySeverity: external_exports.record(PentestFindingSeverity, external_exports.number()),
-    byStatus: external_exports.record(PentestFindingStatus, external_exports.number())
+    byStatus: PentestFindingStatusCountsByStatusSchema
   })
 });
 var ListPentestsResponseSchema = external_exports.array(PentestResponseSchema);
@@ -25373,7 +25761,7 @@ var CustomerPentestShellResponseSchema = external_exports.object({
   findingCounts: external_exports.object({
     total: external_exports.number(),
     bySeverity: external_exports.record(PentestFindingSeverity, external_exports.number()),
-    byStatus: external_exports.record(PentestFindingStatus, external_exports.number())
+    byStatus: PentestFindingStatusCountsByStatusSchema
   })
 });
 var ListCustomerPentestShellsResponseSchema = external_exports.array(CustomerPentestShellResponseSchema);
@@ -25498,7 +25886,8 @@ var CreatePentestRequestSchema = external_exports.object({
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory).max(20).optional(),
   hypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   validationBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
-  perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional()
+  perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
+  purchaseCapUsd: external_exports.number().min(0).max(1e5).optional()
 });
 var UpdatePentestRequestSchema = external_exports.object({
   title: external_exports.string().min(1).max(500).optional(),
@@ -25529,6 +25918,7 @@ var UpdatePentestRequestSchema = external_exports.object({
   hypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   validationBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
+  purchaseCapUsd: external_exports.number().min(0).max(1e5).optional(),
   lifecycleReason: external_exports.string().trim().min(1).max(2e3).optional()
 });
 var BindPentestApplicationRequestSchema = external_exports.object({
@@ -25643,13 +26033,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c62, i2) => {
-    const d = c62.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c65, i2) => {
+    const d = c65.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c62.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c65.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -25762,6 +26152,9 @@ var CredentialPasskeySummarySchema = external_exports.object({
   /** Moves only when the signature counter moved, the one observable sign of a use. */
   lastAssertedAt: external_exports.coerce.date().nullable()
 }).strict();
+var TestIntegrationPasskeySummarySchema = CredentialPasskeySummarySchema.omit({
+  credentialPasskeyId: true
+}).extend({ testIntegrationPasskeyId: external_exports.uuid() }).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
 var MFA_CAPABLE_CREDENTIAL_TYPES = ["USERNAME_PASSWORD", "MAGIC_AUTH"];
@@ -25876,6 +26269,7 @@ var DesktopTargetStatusValues = [
   "TERMINATED",
   "FAILED"
 ];
+var DesktopTargetPlatformValues = ["WINDOWS", "MACOS"];
 var DesktopActionStatusValues = [
   "PENDING",
   "CLAIMED",
@@ -26170,24 +26564,40 @@ var RecordCandidateVulnResponseSchema = external_exports.object({
   inserted: external_exports.boolean()
 });
 var ProductContextStatement = external_exports.string().min(1).max(8e3);
+var ProductEvidenceKindSchema = external_exports.enum(["docs", "source", "live"]);
+var EvidenceRefSchema = external_exports.object({
+  ref: external_exports.string().min(1).max(512),
+  why: external_exports.string().min(1).max(300)
+});
+var ProductFamilyEvidence = {
+  evidence: ProductEvidenceKindSchema.optional(),
+  refs: external_exports.array(EvidenceRefSchema).max(10).optional()
+};
 var RecordProductContextRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   payload: external_exports.object({
-    purpose: external_exports.object({ statement: ProductContextStatement }).optional(),
-    authModel: external_exports.object({ statement: ProductContextStatement }).optional(),
+    purpose: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
+    authModel: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
     techStack: external_exports.object({
       statement: ProductContextStatement,
       languages: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
       frameworks: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
-      services: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional()
+      services: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
+      ...ProductFamilyEvidence
     }).optional(),
     dataClassification: external_exports.object({
       statement: ProductContextStatement,
-      classes: external_exports.array(DataClassificationClass).min(1).max(40)
+      classes: external_exports.array(DataClassificationClass).min(1).max(40),
+      ...ProductFamilyEvidence
     }).optional(),
-    businessImpact: external_exports.object({ statement: ProductContextStatement, level: BusinessImpactLevel }).optional(),
-    deployment: external_exports.object({ statement: ProductContextStatement }).optional(),
-    architectureNotes: external_exports.array(external_exports.object({ statement: ProductContextStatement })).max(40).optional()
+    businessImpact: external_exports.object({
+      statement: ProductContextStatement,
+      level: BusinessImpactLevel,
+      ...ProductFamilyEvidence
+    }).optional(),
+    deployment: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
+    // The bare-array shape is kept for v1 payloads; each note carries its own evidence.
+    architectureNotes: external_exports.array(external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence })).max(40).optional()
   })
 });
 var RecordProductContextResponseSchema = external_exports.object({
@@ -26796,6 +27206,103 @@ var AgentSessionSshPrivateKeyResponseSchema = external_exports.object({
    */
   secret: SshPrivateKeySecretSchema
 });
+var AgentSessionAndroidBuildSchema = CodeUploadSchema.pick({
+  codeUploadId: true,
+  displayName: true,
+  originalFilename: true,
+  archiveSha256: true,
+  status: true,
+  malwareScanResult: true
+}).extend({
+  applicationId: external_exports.uuid(),
+  applicationName: external_exports.string(),
+  sizeBytes: external_exports.number().int().positive().max(CODE_UPLOAD_MAX_BYTES),
+  createdAt: external_exports.iso.datetime()
+});
+var AgentSessionListAndroidBuildsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  afterCodeUploadId: external_exports.uuid().optional()
+});
+var AgentSessionListAndroidBuildsResponseSchema = external_exports.object({
+  builds: external_exports.array(AgentSessionAndroidBuildSchema).max(50),
+  nextAfterCodeUploadId: external_exports.uuid().nullable()
+});
+var AgentSessionGetAndroidBuildRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  codeUploadId: external_exports.uuid()
+});
+var AgentSessionAndroidBuildGrantSchema = AgentSessionAndroidBuildSchema.pick({
+  codeUploadId: true,
+  applicationId: true,
+  archiveSha256: true,
+  sizeBytes: true
+}).extend({
+  downloadUrl: external_exports.url(),
+  urlExpiresAt: external_exports.iso.datetime()
+});
+var AgentSessionListTestIntegrationsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative()
+});
+var AgentSessionListTestIntegrationsResponseSchema = external_exports.object({
+  /** Every Trace test integration by label, ascending. Empty when none exist. */
+  labels: external_exports.array(external_exports.string())
+});
+var AgentSessionGetTestIntegrationRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  label: external_exports.string().min(1).max(200)
+});
+var AgentSessionTestIntegrationResponseSchema = external_exports.object({
+  testIntegrationId: external_exports.uuid(),
+  label: external_exports.string(),
+  /** Staff-written, non-secret access instructions. */
+  notes: external_exports.string(),
+  /** Verbatim as stored: the host seeds its redactor with these exact bytes. */
+  apiKey: external_exports.string().optional(),
+  login: external_exports.object({ username: external_exports.string(), password: external_exports.string() }).optional()
+});
+var AgentSessionRequestPaymentCardRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Minted by the host per tool call; reused across that call's HTTP retries. */
+  requestKey: external_exports.uuid(),
+  /** USD, two decimals: what the agent expects the merchant to charge. */
+  amountUsd: external_exports.number().positive().max(1e4).multipleOf(0.01),
+  merchant: external_exports.string().min(1).max(200),
+  purpose: external_exports.string().min(1).max(1e3)
+});
+var AgentSessionPaymentCardResponseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  /** True when this response replays an authorization an earlier attempt already committed. */
+  replayed: external_exports.boolean(),
+  paymentCardId: external_exports.uuid(),
+  label: external_exports.string(),
+  last4: external_exports.string(),
+  expMonth: external_exports.number().int(),
+  expYear: external_exports.number().int(),
+  cardholderName: external_exports.string(),
+  billingAddress: PaymentCardBillingAddressSchema,
+  /** Staff-written, non-secret: the billing email to give, what the issuer declines. */
+  notes: external_exports.string(),
+  /** Cap minus every AUTHORIZED and COMPLETED amount for this pentest, this one included. */
+  remainingUsd: external_exports.number(),
+  capUsd: external_exports.number(),
+  /** Verbatim as stored: the host seeds its redactor with these exact bytes. */
+  number: external_exports.string(),
+  cvc: external_exports.string()
+});
+var AgentSessionReportPurchaseOutcomeRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  purchaseId: external_exports.uuid(),
+  outcome: PurchaseOutcome
+});
+var AgentSessionPurchaseOutcomeResponseSchema = external_exports.object({
+  purchaseId: external_exports.uuid(),
+  /** The row's status after the call. */
+  status: PurchaseStatus,
+  /** True when the row already carried this outcome (a retried report). */
+  replayed: external_exports.boolean(),
+  remainingUsd: external_exports.number(),
+  capUsd: external_exports.number()
+});
 var AgentSessionPasskeySchema = external_exports.object({
   /** Relying party id (a hostname). */
   rpId: external_exports.string().min(1).max(253),
@@ -26823,18 +27330,54 @@ var AgentSessionStoredPasskeySchema = AgentSessionPasskeySchema.extend({
   privateKey: external_exports.string().min(1).max(4096),
   userHandle: external_exports.string().max(128)
 });
-var AgentSessionListPasskeysResponseSchema = external_exports.object({
-  credentialId: external_exports.uuid(),
-  credentialLabel: external_exports.string().max(200),
-  /** The account types a browser logs in as; the same set that can carry a second factor. */
-  credentialType: external_exports.enum(MFA_CAPABLE_CREDENTIAL_TYPES),
-  passkeys: external_exports.array(AgentSessionStoredPasskeySchema),
-  /**
-   * Stored rows whose envelope could not be read. Reported rather than swallowed so a
-   * partial list is never presented to the agent as the whole store, and rather than
-   * failing the call so the readable passkeys still load.
-   */
-  unreadable: external_exports.number().int().min(0)
+var AgentSessionIntegrationPasskeySchema = AgentSessionPasskeySchema.extend({
+  testIntegrationPasskeyId: external_exports.uuid(),
+  privateKey: external_exports.string().min(1).max(4096),
+  userHandle: external_exports.string().max(128)
+});
+var AgentSessionListPasskeysResponseSchema = external_exports.discriminatedUnion("owner", [
+  external_exports.object({
+    owner: external_exports.literal("credential"),
+    credentialId: external_exports.uuid(),
+    credentialLabel: external_exports.string().max(200),
+    /** The account types a browser logs in as; the same set that can carry a second factor. */
+    credentialType: external_exports.enum(MFA_CAPABLE_CREDENTIAL_TYPES),
+    passkeys: external_exports.array(AgentSessionStoredPasskeySchema),
+    /**
+     * Stored rows whose envelope could not be read. Reported rather than swallowed so a
+     * partial list is never presented to the agent as the whole store, and rather than
+     * failing the call so the readable passkeys still load.
+     */
+    unreadable: external_exports.number().int().min(0)
+  }),
+  external_exports.object({
+    owner: external_exports.literal("testIntegration"),
+    testIntegrationId: external_exports.uuid(),
+    /** The integration's `label`, under the field name the host already keys on. */
+    credentialLabel: external_exports.string().max(200),
+    passkeys: external_exports.array(AgentSessionIntegrationPasskeySchema),
+    unreadable: external_exports.number().int().min(0)
+  })
+]);
+var AgentSessionTestIntegrationPasskeyUseSchema = AgentSessionPasskeySchema.pick({
+  rpId: true,
+  webauthnCredentialId: true,
+  signCount: true,
+  backupEligibility: true,
+  backupState: true
+}).strict();
+var AgentSessionRecordTestIntegrationPasskeyUseRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** From the list response, never agent-supplied. */
+  testIntegrationId: external_exports.uuid(),
+  passkey: AgentSessionTestIntegrationPasskeyUseSchema
+});
+var AgentSessionRecordTestIntegrationPasskeyUseResponseSchema = external_exports.object({
+  testIntegrationPasskeyId: external_exports.uuid(),
+  /** The stored counter after the call, never lower than before. */
+  signCount: external_exports.number().int().min(0),
+  /** False when the stored counter was already at or past the reported one. */
+  counterMoved: external_exports.boolean()
 });
 var AgentSessionUpsertPasskeyRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
@@ -27203,8 +27746,9 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
 });
 var RequestDesktopTargetRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
-  /** Only Windows exists; a literal keeps the macOS follow-on additive. */
-  platform: external_exports.literal("WINDOWS")
+  /** A MACOS request is also gated on the session's pinned toolset (the api's
+   *  `DESKTOP_MACOS_CAPABLE_TOOLSETS`); the schema alone does not authorize it. */
+  platform: external_exports.enum(DesktopTargetPlatformValues)
 });
 var DesktopCredentialRefSchema = external_exports.object({
   credentialId: external_exports.uuid(),
@@ -27231,7 +27775,11 @@ var DesktopTargetStatusRequestSchema = external_exports.object({
 });
 var DesktopTargetStatusResponseSchema = external_exports.object({
   status: external_exports.enum(DesktopTargetStatusValues),
-  failureReason: external_exports.string().nullable()
+  failureReason: external_exports.string().nullable(),
+  /** How the host learns the platform of a target it did not request in this
+   *  process (a resumed session): the key chords, job paths and recording rules
+   *  it applies all depend on it. */
+  platform: external_exports.enum(DesktopTargetPlatformValues)
 });
 var DESKTOP_ACTION_MAX_WAIT_MS = 9e4;
 var EnqueueDesktopActionRequestSchema = external_exports.object({
@@ -27688,6 +28236,112 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  listAndroidBuilds: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/android-builds/list",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListAndroidBuildsRequestSchema,
+    responses: {
+      200: AgentSessionListAndroidBuildsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getAndroidBuild: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/android-builds/get",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetAndroidBuildRequestSchema,
+    responses: {
+      200: AgentSessionAndroidBuildGrantSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      422: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      503: ErrorResponseSchema
+    }
+  },
+  // get_test_integration, no name: every Trace test integration by label. Gated on the
+  // session type (403 for a type that receives none) and on the run still being live.
+  listTestIntegrations: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integrations",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionListTestIntegrationsRequestSchema,
+    responses: {
+      200: AgentSessionListTestIntegrationsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // get_test_integration, with a name: that integration's notes and decrypted facets.
+  // Same gates as the list. A label that matches no integration is a 404 whose message
+  // names the available labels, which are Trace data, not customer data.
+  getTestIntegration: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integration",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionGetTestIntegrationRequestSchema,
+    responses: {
+      200: AgentSessionTestIntegrationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // request_payment_card: declare a purchase against the engagement's cap and, when
+  // it fits, receive the active card's facets. 402 PURCHASE_CAP_EXCEEDED carries
+  // `details: { remainingUsd, capUsd }`; 403 when the run's pinned toolset is not
+  // purchase-capable; 409 RUN_REVOKED, PAYMENT_CARD_UNAVAILABLE (no active card, or
+  // the active card is expired or changed since a replayed request), or
+  // ENGAGEMENT_ENDED (the engagement was cancelled or closed while the session ran).
+  requestPaymentCard: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/payment-card",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionRequestPaymentCardRequestSchema,
+    responses: {
+      200: AgentSessionPaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      402: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // report_purchase_outcome: COMPLETED or DECLINED for a purchase this session
+  // authorized. 403 when the run's pinned toolset is not purchase-capable; 404
+  // 404 (no code) for any purchase this session did not make; 409 RUN_REVOKED,
+  // or PURCHASE_OUTCOME_CONFLICT with `details: { status }` when the row was already
+  // reported differently or staff voided it. A repeated identical report replays.
+  reportPurchaseOutcome: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/purchase-outcome",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionReportPurchaseOutcomeRequestSchema,
+    responses: {
+      200: AgentSessionPurchaseOutcomeResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // provision_passkey, read half: every passkey Trace holds for one of the run's
   // accounts, decrypted, so the host can load them into the virtual authenticator
   // it arms on the agent's browser. Same resolution and ownership gate as
@@ -27738,6 +28392,27 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  // provision_passkey, integration write half: a stored test-integration passkey's
+  // counter moved on the armed authenticator. Counter-only by shape (no key field on
+  // the body); idempotent on (testIntegrationId, rpId, webauthnCredentialId).
+  recordTestIntegrationPasskeyUse: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integration-passkeys/use",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionRecordTestIntegrationPasskeyUseRequestSchema,
+    responses: {
+      200: AgentSessionRecordTestIntegrationPasskeyUseResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Session type receives no account credentials, or may not fetch test integrations.
+      403: ErrorResponseSchema,
+      // No stored passkey with that natural key on that integration (staff deleted it).
+      404: ErrorResponseSchema,
+      // RUN_REVOKED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // renew_cloud_credentials (GCP integration PR 7): agent-invoked re-mint of the
   // ~1 h AWS/GCP recon creds. Run-token authed; org+pentest from the session row;
   // 403 for a non-credentialed session type (ADHOC/CODE_REVIEW/REPORT).
@@ -29966,6 +30641,19 @@ var OrganizationCodeSizeResponseSchema = external_exports.object({
     languageCount: external_exports.number().int().nonnegative()
   })
 });
+var CodeSizeRecalculateResponseSchema = external_exports.object({
+  /** Repos the request covered. */
+  requested: external_exports.number().int().nonnegative(),
+  /** Messages the queue accepted. Lower than `requested` is a partial send,
+   *  reported rather than masked. */
+  enqueued: external_exports.number().int().nonnegative()
+});
+var CodeSizeRecalculateLimitedResponseSchema = ErrorResponseSchema.extend({
+  /** Recalculates allowed per org in any 24 hours. */
+  limit: external_exports.number().int().positive(),
+  /** When the oldest request in the window ages out and frees a slot. */
+  retryAt: external_exports.iso.datetime()
+});
 var StaffCodeSizeRepositorySchema = external_exports.object({
   repositoryId: external_exports.uuid(),
   repositoryUrl: external_exports.url(),
@@ -30009,7 +30697,11 @@ var StaffCodeSizeRemeasureResponseSchema = external_exports.object({
   requested: external_exports.number().int().nonnegative(),
   /** Messages SQS accepted. Lower than `requested` means a partial send —
    *  reported rather than masked (the panel states this number). */
-  enqueued: external_exports.number().int().nonnegative()
+  enqueued: external_exports.number().int().nonnegative(),
+  /** Repos re-read from GitHub (default branch, archive state) before the
+   *  scope was selected. Null when no refresh ran: scope `unmeasured`, or no
+   *  GitHub App credentials on this environment. */
+  refreshedRepoCount: external_exports.number().int().nonnegative().nullable()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/code-size.ts
@@ -30027,6 +30719,23 @@ var codeSizeContract = c11.router({
       500: ErrorResponseSchema
     }
   },
+  // Customer Recalculate (MANAGE_INTEGRATED_REPOSITORIES). Enqueue-only.
+  recalculateOrganizationCodeSize: {
+    method: "POST",
+    path: "/organizations/:organizationId/code-size/recalculate",
+    pathParams: OrgIdParamsSchema,
+    body: c11.noBody(),
+    responses: {
+      200: CodeSizeRecalculateResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      429: CodeSizeRecalculateLimitedResponseSchema,
+      500: ErrorResponseSchema,
+      // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
+      503: ErrorResponseSchema
+    }
+  },
   // Staff-only: per-repo measurement freshness for the admin Controls panel.
   getStaffOrganizationCodeSize: {
     method: "GET",
@@ -30053,151 +30762,15 @@ var codeSizeContract = c11.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema,
+      // Scope `all` could not refresh repository state from GitHub; nothing
+      // was re-measured.
+      502: ErrorResponseSchema,
       // Measurement enqueueing is unconfigured (REPO_METADATA_QUEUE_URL unset).
       503: ErrorResponseSchema
     }
   }
 });
 
-// ../../packages/api-contracts/src/schemas/api/v1/code-upload.api.ts
-var CODE_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
-var CODE_UPLOAD_PART_SIZE_BYTES = 10 * 1024 * 1024;
-var CodeUploadStatusValues = [
-  "UPLOADING",
-  "FINALIZING",
-  "SCANNING",
-  "VALIDATING",
-  "READY",
-  "REJECTED",
-  "DELETING",
-  "FAILED"
-];
-var CodeUploadMalwareScanResultValues = [
-  "NO_THREATS_FOUND",
-  "THREATS_FOUND",
-  "UNSUPPORTED",
-  "ACCESS_DENIED",
-  "FAILED"
-];
-var CodeUploadRejectionReasonValues = [
-  "MALWARE_DETECTED",
-  "MALWARE_SCAN_UNSUPPORTED",
-  "MALWARE_SCAN_UNAVAILABLE",
-  "INVALID_ARCHIVE",
-  "INTEGRITY_MISMATCH"
-];
-var CodeUploadArtifactKindValues = ["SOURCE_ARCHIVE", "ANDROID_APK", "IOS_IPA"];
-function isApplicationBuildArtifactKind(kind) {
-  return kind === "ANDROID_APK" || kind === "IOS_IPA";
-}
-var CodeUploadIdParamsSchema = OrgIdParamsSchema.extend({
-  codeUploadId: external_exports.uuid()
-});
-var ListCodeUploadsQuerySchema = external_exports.object({
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).optional(),
-  applicationId: external_exports.uuid().optional()
-}).strict();
-var InitializeCodeUploadRequestSchema = external_exports.object({
-  displayName: external_exports.string().trim().min(1).max(200),
-  originalFilename: external_exports.string().trim().min(1).max(255),
-  sizeBytes: external_exports.number().int().min(1).max(CODE_UPLOAD_MAX_BYTES),
-  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  // Defaulted so a pre-this-release client that omitted the field still
-  // initializes a source ZIP during a mixed-version rollout.
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
-  applicationId: external_exports.uuid().optional()
-}).strict().superRefine((data, ctx) => {
-  const filename = data.originalFilename.toLowerCase();
-  if (isApplicationBuildArtifactKind(data.artifactKind)) {
-    const extension = data.artifactKind === "ANDROID_APK" ? ".apk" : ".ipa";
-    if (!filename.endsWith(extension)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["originalFilename"],
-        message: `originalFilename must end in ${extension}`
-      });
-    }
-    if (data.applicationId == null) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["applicationId"],
-        message: "A build upload must target a mobile application."
-      });
-    }
-    return;
-  }
-  if (!filename.endsWith(".zip")) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["originalFilename"],
-      message: "originalFilename must end in .zip"
-    });
-  }
-  if (data.applicationId != null) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["applicationId"],
-      message: "Source archives are linked to an application after they are ready."
-    });
-  }
-});
-var LinkedCodeUploadApplicationSchema = external_exports.object({
-  applicationId: external_exports.uuid(),
-  name: external_exports.string()
-});
-var CodeUploadSchema = external_exports.object({
-  codeUploadId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  displayName: external_exports.string(),
-  originalFilename: external_exports.string(),
-  sizeBytes: external_exports.number().int().positive(),
-  archiveSha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-  status: external_exports.enum(CodeUploadStatusValues),
-  malwareScanResult: external_exports.enum(CodeUploadMalwareScanResultValues).nullable(),
-  rejectionReason: external_exports.enum(CodeUploadRejectionReasonValues).nullable(),
-  // Defaulted so a new client reading a pre-this-release API during a rolling
-  // deploy doesn't reject source-upload rows that omit the field.
-  artifactKind: external_exports.enum(CodeUploadArtifactKindValues).default("SOURCE_ARCHIVE"),
-  applicationId: external_exports.uuid().nullable().default(null),
-  // z.coerce.date(), not z.date(): web server actions safeParse the raw
-  // ts-rest JSON body, where these arrive as ISO strings.
-  scanningStartedAt: external_exports.coerce.date().nullable(),
-  readyAt: external_exports.coerce.date().nullable(),
-  createdAt: external_exports.coerce.date(),
-  linkedApplications: external_exports.array(LinkedCodeUploadApplicationSchema)
-});
-var CodeUploadPartUrlSchema = external_exports.object({
-  partNumber: external_exports.number().int().positive(),
-  uploadUrl: external_exports.url()
-});
-var UploadedCodeUploadPartSchema = external_exports.object({
-  partNumber: external_exports.number().int().positive(),
-  sizeBytes: external_exports.number().int().positive()
-});
-var CodeUploadMultipartSchema = external_exports.object({
-  partSizeBytes: external_exports.literal(CODE_UPLOAD_PART_SIZE_BYTES),
-  parts: external_exports.array(CodeUploadPartUrlSchema),
-  expiresAt: external_exports.coerce.date()
-});
-var InitializeCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  multipart: CodeUploadMultipartSchema
-});
-var ResumeCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  multipart: CodeUploadMultipartSchema.extend({
-    uploadedParts: external_exports.array(UploadedCodeUploadPartSchema)
-  })
-});
-var ListCodeUploadsResponseSchema = external_exports.object({
-  uploads: external_exports.array(CodeUploadSchema)
-});
-var DownloadCodeUploadResponseSchema = external_exports.object({
-  upload: CodeUploadSchema,
-  downloadUrl: external_exports.url(),
-  expiresAt: external_exports.coerce.date()
-});
-
 // ../../packages/api-contracts/src/contracts/v1/code-upload.ts
 var c12 = initContract();
 var commonErrors = {
@@ -31399,7 +31972,9 @@ var environmentContract = c17.router({
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       // 409 — environment target is frozen by a non-terminal pentest
-      // (errorCode ENVIRONMENT_TARGET_FROZEN_BY_PENTEST).
+      // (errorCode ENVIRONMENT_TARGET_FROZEN_BY_PENTEST), or a live pentest
+      // still links the environment (errorCode ENVIRONMENT_IN_USE_BY_PENTEST,
+      // details.pentestDisplayIds names the holders).
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -31579,7 +32154,9 @@ var GitHubRepoSchema = external_exports.object({
   private: external_exports.boolean(),
   htmlUrl: external_exports.string().url(),
   githubDefaultBranch: external_exports.string(),
-  language: external_exports.string().nullable()
+  language: external_exports.string().nullable(),
+  /** Archived on GitHub. Archived repos stay listed; archiving excludes them once. */
+  archived: external_exports.boolean()
 });
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
@@ -32870,9 +33447,10 @@ var PrScanAnalyticsDeveloperSchema = external_exports.object({
   criticalHighFixedCount: external_exports.number().int().nonnegative(),
   falsePositiveCount: external_exports.number().int().nonnegative()
 });
+var PrScanAnalyticsMonthKeySchema = external_exports.string().regex(/^[1-9]\d{3}-(0[1-9]|1[0-2])$/);
 var PrScanAnalyticsMonthSchema = external_exports.object({
   /** UTC calendar month, `YYYY-MM`. */
-  month: external_exports.string().regex(/^\d{4}-\d{2}$/),
+  month: PrScanAnalyticsMonthKeySchema,
   prCount: external_exports.number().int().nonnegative(),
   developerCount: external_exports.number().int().nonnegative(),
   findingsCount: external_exports.number().int().nonnegative(),
@@ -32911,28 +33489,92 @@ var PrScanAnalyticsSummarySchema = external_exports.object({
   /** One row per severity, CRITICAL first. */
   timeToFix: external_exports.array(PrScanAnalyticsTimeToFixSchema).length(VulnerabilitySeverityValues.length)
 });
+var PrScanAnalyticsFindingSchema = external_exports.object({
+  vulnerabilityId: external_exports.uuid(),
+  title: external_exports.string(),
+  severity: VulnerabilitySeverity,
+  status: VulnerabilityStatus,
+  /** The PR the finding was first detected on; its review comment lives there. */
+  pullRequestNumber: external_exports.number().int().positive().nullable()
+});
+var PrScanAnalyticsFindingsQuerySchema = external_exports.object({
+  category: external_exports.string().min(1).max(100),
+  asOf: external_exports.iso.datetime(),
+  afterStatus: VulnerabilityStatus.optional(),
+  afterSeverity: VulnerabilitySeverity.optional(),
+  afterCreatedAt: external_exports.iso.datetime().optional(),
+  afterVulnerabilityId: external_exports.uuid().optional()
+}).refine(
+  ({ afterStatus, afterSeverity, afterCreatedAt, afterVulnerabilityId }) => {
+    const provided = [afterStatus, afterSeverity, afterCreatedAt, afterVulnerabilityId].filter(
+      (field) => field !== void 0
+    ).length;
+    return provided === 0 || provided === 4;
+  },
+  { message: "Provide all four cursor fields or none", path: ["afterCreatedAt"] }
+);
+var PrScanAnalyticsFindingsResponseSchema = external_exports.object({
+  /** Open first (then In progress, Fixed, Archived, False positive, Dismissed), most severe first within a status, then newest. */
+  findings: external_exports.array(PrScanAnalyticsFindingSchema).max(25),
+  total: external_exports.number().int().nonnegative(),
+  nextCursor: external_exports.object({
+    status: VulnerabilityStatus,
+    severity: VulnerabilitySeverity,
+    firstDetectedAt: external_exports.iso.datetime(),
+    vulnerabilityId: external_exports.uuid()
+  }).nullable()
+});
+var PrScanAnalyticsFindingCommentParamsSchema = external_exports.object({
+  organizationId: external_exports.uuid(),
+  vulnerabilityId: external_exports.uuid()
+});
+var PrScanAnalyticsFindingCommentResponseSchema = external_exports.object({
+  url: external_exports.url(),
+  target: external_exports.enum(["comment", "pull_request"])
+});
+var PrScanAnalyticsTotalsSchema = external_exports.object({
+  prCount: external_exports.number().int().nonnegative(),
+  findingsCount: external_exports.number().int().nonnegative(),
+  criticalHighCount: external_exports.number().int().nonnegative(),
+  remediatedCount: external_exports.number().int().nonnegative(),
+  byClass: external_exports.array(PrScanAnalyticsClassCountSchema)
+});
 var PrScanAnalyticsResponseSchema = external_exports.object({
   generatedAt: external_exports.iso.datetime(),
   months: external_exports.array(PrScanAnalyticsMonthSchema).length(12),
-  summary: PrScanAnalyticsSummarySchema
+  summary: PrScanAnalyticsSummarySchema,
+  totals: PrScanAnalyticsTotalsSchema.optional()
 });
 var ProductPlanParamsSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   product: external_exports.enum(ProductValues)
 });
+var ProseSpellingValues = ["US", "UK"];
+var ProseSpellingSchema = external_exports.enum(ProseSpellingValues);
 var ReferrerSchema = external_exports.object({
   referrerId: external_exports.uuid(),
   name: external_exports.string(),
   slug: external_exports.string(),
-  reportTemplate: PentestReportTemplateSchema
+  reportTemplate: PentestReportTemplateSchema,
+  /** Spelling the agents write customer-facing prose in for this partner's orgs. */
+  proseSpelling: ProseSpellingSchema
+});
+var ReferrerParamsSchema = external_exports.object({
+  referrerId: external_exports.uuid()
 });
+var UpdateReferrerRequestSchema = external_exports.object({
+  proseSpelling: ProseSpellingSchema
+});
+var UpdateReferrerResponseSchema = ReferrerSchema;
 var ListReferrersResponseSchema = external_exports.object({
   referrers: external_exports.array(ReferrerSchema)
 });
 var CreateReferrerRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(2, "Partner name must be at least 2 characters").max(100, "Partner name must be 100 characters or fewer"),
   /** Report template for orgs this partner refers. Defaults to TRACE. */
-  reportTemplate: PentestReportTemplateSchema.optional()
+  reportTemplate: PentestReportTemplateSchema.optional(),
+  /** Prose spelling for orgs this partner refers. Defaults to US. */
+  proseSpelling: ProseSpellingSchema.optional()
 });
 var CreateReferrerResponseSchema = ReferrerSchema;
 var SetOrganizationReferrerRequestSchema = external_exports.object({
@@ -32993,9 +33635,14 @@ var CreatePrReviewerSubscriptionRequestSchema = external_exports.object({
   /** Calendar day the subscription starts, `YYYY-MM-DD`, UTC. Today or in the past. */
   startDate: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/)
 });
+var BillingCollectionMethodValues = ["charge_automatically", "send_invoice"];
 var PrReviewerSubscriptionResponseSchema = external_exports.object({
   subscriptionId: external_exports.string(),
   status: external_exports.string(),
+  /** Optional for rolling-deploy tolerance: an older API omits the key. */
+  collectionMethod: external_exports.enum(BillingCollectionMethodValues).optional(),
+  /** The customer opted into autopay but the saved card didn't pay the first invoice, so it was emailed. */
+  firstChargeDeclined: external_exports.boolean().optional(),
   invoice: external_exports.object({
     id: external_exports.string(),
     status: external_exports.string(),
@@ -33044,6 +33691,33 @@ var BillingSubscriptionSchema = external_exports.object({
   currentPeriodEnd: external_exports.date().nullable(),
   cancelAtPeriodEnd: external_exports.boolean()
 });
+var BillingPaymentMethodSchema = external_exports.object({
+  /** Stripe PaymentMethod type, e.g. `card` or `us_bank_account`. */
+  type: external_exports.string(),
+  /** Card network or bank name, when Stripe exposes one. */
+  brand: external_exports.string().nullable(),
+  last4: external_exports.string().nullable(),
+  expMonth: external_exports.number().int().nullable(),
+  expYear: external_exports.number().int().nullable()
+});
+var BillingAutopayStateValues = ["off", "card_only", "on"];
+var BillingAutopaySchema = external_exports.object({
+  state: external_exports.enum(BillingAutopayStateValues),
+  /** The customer's default card; null when state is `off`. */
+  paymentMethod: BillingPaymentMethodSchema.nullable(),
+  /**
+   * Open PR reviewer invoices that enabling autopay charges right away, once
+   * the admin confirms them. Enabling charges these ids and no others.
+   */
+  chargeOnEnable: external_exports.object({
+    invoiceIds: external_exports.array(external_exports.string()).min(1),
+    invoiceCount: external_exports.number().int().positive(),
+    amountCents: external_exports.number().int().positive(),
+    currency: external_exports.string(),
+    /** At least one was already charged and declined, rather than never attempted. */
+    declined: external_exports.boolean()
+  }).nullable()
+});
 var OrganizationBillingSchema = external_exports.object({
   prReviewerBillingRequired: external_exports.boolean(),
   hasStripeCustomer: external_exports.boolean(),
@@ -33053,11 +33727,44 @@ var OrganizationBillingSchema = external_exports.object({
   /** Optional for rolling-deploy tolerance. */
   subscription: BillingSubscriptionSchema.nullable().optional(),
   /** Optional for rolling-deploy tolerance: an older API omits the key. */
-  paymentDue: BillingPaymentDueSchema.nullable().optional()
+  paymentDue: BillingPaymentDueSchema.nullable().optional(),
+  /**
+   * Null when there's no Stripe customer, or the card lookup failed (the row is
+   * hidden rather than offering setup over a card that may exist). Optional for
+   * rolling-deploy tolerance.
+   */
+  autopay: BillingAutopaySchema.nullable().optional()
 });
 var BillingPortalResponseSchema = external_exports.object({
   url: external_exports.url()
 });
+var STRIPE_CHECKOUT_SESSION_ID_PATTERN = /^cs_(test|live)_[A-Za-z0-9]+$/;
+var EnableAutopayRequestSchema = external_exports.object({
+  /**
+   * Checkout session (setup mode) the admin just completed. Omitted when the
+   * customer already has a default card on file and only the opt-in and the
+   * PR reviewer subscriptions need to switch.
+   */
+  checkoutSessionId: external_exports.string().regex(STRIPE_CHECKOUT_SESSION_ID_PATTERN).optional(),
+  /**
+   * Card-on-file path: the open invoices the admin confirmed charging. Ignored
+   * with a Checkout session, which carries its own confirmation.
+   */
+  confirmedInvoiceIds: external_exports.array(external_exports.string().regex(/^in_[A-Za-z0-9]+$/)).max(15).optional()
+});
+var CreateAutopaySetupSessionRequestSchema = external_exports.object({
+  /** Open invoices the admin confirmed; the Checkout return charges these and no others. */
+  confirmedInvoiceIds: external_exports.array(external_exports.string().regex(/^in_[A-Za-z0-9]+$/)).max(15)
+});
+var EnableAutopayResponseSchema = external_exports.object({
+  paymentMethod: BillingPaymentMethodSchema,
+  /** PR reviewer subscriptions moved to charge the customer's default card. */
+  subscriptionsUpdated: external_exports.number().int(),
+  /** Open PR reviewer invoices Stripe confirmed as paid. */
+  openInvoicesPaid: external_exports.number().int(),
+  /** Open PR reviewer invoices the card didn't pay; they stay open for manual payment. */
+  openInvoicesDeclined: external_exports.number().int()
+});
 var ListOrganizationsResponseSchema = external_exports.array(OrganizationResponseSchema);
 var StaffOrganizationSummarySchema = external_exports.object({
   organizationId: external_exports.uuid(),
@@ -33075,6 +33782,14 @@ var CreateOrganizationRequestSchema = external_exports.object({
   homepageUrl: external_exports.url("Homepage must be a full URL, like https://acme.com").max(2048).nullable().optional()
 });
 var LogoFetchOutcomeValues = ["skipped", "stored", "not_found", "failed"];
+var RenameOrganizationRequestSchema = external_exports.object({
+  name: external_exports.string().trim().min(2, "Organization name must be at least 2 characters").max(100, "Organization name must be 100 characters or fewer")
+}).strict();
+var RenameOrganizationResponseSchema = external_exports.object({
+  organizationId: external_exports.uuid(),
+  slug: external_exports.string(),
+  name: external_exports.string()
+});
 var CreateOrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   slug: external_exports.string(),
@@ -33162,6 +33877,23 @@ var organizationContract = c27.router({
     },
     summary: "Create an organization (Trace staff only)"
   },
+  // Staff-only, cross-org: renames the tenant in Trace and WorkOS together.
+  // The slug stays as it was.
+  renameOrganizationAsStaff: {
+    method: "PATCH",
+    path: "/staff/organizations/:organizationId",
+    pathParams: OrgIdParamsSchema,
+    body: RenameOrganizationRequestSchema,
+    responses: {
+      200: RenameOrganizationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Rename an organization (Trace staff only)"
+  },
   // Staff-only, cross-org: removes the tenant from Trace and WorkOS together.
   // 409 when members, repositories, or retained audit history still reference
   // the organization; those must be removed first (or cannot be, for WORM rows).
@@ -33280,6 +34012,22 @@ var organizationContract = c27.router({
       500: ErrorResponseSchema
     }
   },
+  // Staff-only: change a partner's prose spelling. Reaches sessions launched
+  // after the change; running sessions keep the header they started with.
+  updateReferrer: {
+    method: "PATCH",
+    path: "/referrers/:referrerId",
+    pathParams: ReferrerParamsSchema,
+    body: UpdateReferrerRequestSchema,
+    responses: {
+      200: UpdateReferrerResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Staff-only: set (or clear with null) the org's referral partner.
   // Drives "Trace x <partner>" co-branding on pentest report covers.
   setOrganizationReferrer: {
@@ -33443,6 +34191,42 @@ var organizationContract = c27.router({
       500: ErrorResponseSchema
     }
   },
+  // Signed-in admins only: mint a Stripe Checkout session (setup mode, cards)
+  // that collects the autopay card. Stripe returns to the web's redemption route.
+  createAutopaySetupSession: {
+    method: "POST",
+    path: "/organizations/:organizationId/billing/autopay/session",
+    pathParams: OrgIdParamsSchema,
+    body: CreateAutopaySetupSessionRequestSchema,
+    responses: {
+      200: BillingPortalResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Signed-in admins only: make the collected card the customer default, opt the
+  // customer in, move live PR reviewer subscriptions onto it, and charge their
+  // open invoices. The web confirms the charge before calling.
+  enableAutopay: {
+    method: "POST",
+    path: "/organizations/:organizationId/billing/autopay",
+    pathParams: OrgIdParamsSchema,
+    body: EnableAutopayRequestSchema,
+    responses: {
+      200: EnableAutopayResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      503: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Member-readable: the caller's own org SCANNING plan + spend, for the
   // customer trial-credits meter. Scoped by requireOrgAccess (no staff gate).
   getScanUsage: {
@@ -33460,6 +34244,34 @@ var organizationContract = c27.router({
   // Member-readable: last 12 UTC months of PR scanner usage (unique PRs,
   // developers, PR-first-detected findings + remediations). Gated by
   // requireOrgAccess + VIEW_RESULTS + AUTO_PR_SCANS.
+  getPrScanAnalyticsFindings: {
+    method: "GET",
+    path: "/organizations/:organizationId/pr-scan-analytics/findings",
+    pathParams: OrgIdParamsSchema,
+    query: PrScanAnalyticsFindingsQuerySchema,
+    responses: {
+      200: PrScanAnalyticsFindingsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Resolves a finding's PR review comment on GitHub (by the hidden
+  // vulnerability marker) so the analytics row can link straight to it.
+  getPrScanAnalyticsFindingComment: {
+    method: "GET",
+    path: "/organizations/:organizationId/pr-scan-analytics/findings/:vulnerabilityId/comment",
+    pathParams: PrScanAnalyticsFindingCommentParamsSchema,
+    responses: {
+      200: PrScanAnalyticsFindingCommentResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getPrScanAnalytics: {
     method: "GET",
     path: "/organizations/:organizationId/pr-scan-analytics",
@@ -33504,6 +34316,65 @@ var organizationContract = c27.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/payment-card.ts
+var c28 = initContract();
+var paymentCardContract = c28.router({
+  listPaymentCards: {
+    method: "GET",
+    path: "/staff/payment-cards",
+    responses: {
+      200: ListPaymentCardsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createPaymentCard: {
+    method: "POST",
+    path: "/staff/payment-cards",
+    body: CreatePaymentCardRequestSchema,
+    responses: {
+      201: PaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      // PAYMENT_CARD_EXPIRED, or a contract failure
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PAYMENT_CARD_LABEL_TAKEN, PAYMENT_CARD_ACTIVE_CONFLICT
+      500: ErrorResponseSchema
+    }
+  },
+  updatePaymentCard: {
+    method: "PATCH",
+    path: "/staff/payment-cards/:paymentCardId",
+    pathParams: PaymentCardIdParamsSchema,
+    body: UpdatePaymentCardRequestSchema,
+    responses: {
+      200: PaymentCardResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deletePaymentCard: {
+    method: "DELETE",
+    path: "/staff/payment-cards/:paymentCardId",
+    pathParams: PaymentCardIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PAYMENT_CARD_HAS_PURCHASES
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-cost-rollup.api.ts
 var PentestCostRollupResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
@@ -33796,8 +34667,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c28 = initContract();
-var pentestContract = c28.router({
+var c29 = initContract();
+var pentestContract = c29.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -34107,8 +34978,8 @@ var pentestContract = c28.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attack-chain.ts
-var c29 = initContract();
-var pentestAttackChainContract = c29.router({
+var c30 = initContract();
+var pentestAttackChainContract = c30.router({
   listAttackChains: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains",
@@ -34227,7 +35098,7 @@ var pentestAttackChainContract = c29.router({
     method: "DELETE",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId",
     pathParams: PentestAttackChainIdParamsSchema,
-    body: c29.noBody(),
+    body: c30.noBody(),
     responses: {
       200: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -34388,8 +35259,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c30 = initContract();
-var pentestAttestationContract = c30.router({
+var c31 = initContract();
+var pentestAttestationContract = c31.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -34532,8 +35403,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c31 = initContract();
-var pentestAuditLogContract = c31.router({
+var c32 = initContract();
+var pentestAuditLogContract = c32.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -34580,8 +35451,8 @@ var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
-var c32 = initContract();
-var pentestAuthorizedDomainContract = c32.router({
+var c33 = initContract();
+var pentestAuthorizedDomainContract = c33.router({
   getPentestAuthorizedScope: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
@@ -34635,8 +35506,8 @@ var PentestEgressResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-egress.ts
-var c33 = initContract();
-var pentestEgressContract = c33.router({
+var c34 = initContract();
+var pentestEgressContract = c34.router({
   getPentestEgress: {
     method: "GET",
     path: "/staff/pentest-egress",
@@ -34675,8 +35546,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c34 = initContract();
-var pentestEngagementExclusionContract = c34.router({
+var c35 = initContract();
+var pentestEngagementExclusionContract = c35.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -34740,8 +35611,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c35 = initContract();
-var pentestEnvironmentContract = c35.router({
+var c36 = initContract();
+var pentestEnvironmentContract = c36.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -34790,8 +35661,8 @@ var pentestEnvironmentContract = c35.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c36 = initContract();
-var pentestFindingContract = c36.router({
+var c37 = initContract();
+var pentestFindingContract = c37.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -35019,6 +35890,23 @@ var pentestFindingContract = c36.router({
       500: ErrorResponseSchema
     }
   },
+  // Staff-only. `:pentestId` is the target; the source is in the body.
+  copyFindings: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/copies",
+    pathParams: PentestFindingParamsSchema,
+    body: CopyPentestFindingsRequestSchema,
+    responses: {
+      200: CopyPentestFindingsResponseSchema,
+      201: CopyPentestFindingsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   recoverStrandedFindings: {
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/recover-stranded",
@@ -35213,6 +36101,26 @@ var pentestFindingContract = c36.router({
       500: ErrorResponseSchema
     }
   },
+  // Customer accepts the finding → ACCEPTED_WITH_CONTROLS without a dispute or a
+  // staff decision. Human principals here; an API key sends the same transition
+  // through `automationStatusUpdate` with status ACCEPTED_WITH_CONTROLS.
+  accept: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/accept",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: AcceptCustomerPentestFindingRequestSchema,
+    responses: {
+      200: CustomerPentestFindingResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // FINDING_TRANSITION_NOT_ALLOWED (bad source status / dispute pending),
+      // FINDING_STALE (concurrent write), or PENTEST_CLOSED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // ─── Automation lifecycle transition (API keys) ───
   // A separate route rather than a widened `start-progress` / `report-remediation`:
   // those stay human-only, and everything that makes a machine-driven write
@@ -35423,8 +36331,8 @@ var pentestFindingContract = c36.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c37 = initContract();
-var pentestHypothesisContract = c37.router({
+var c38 = initContract();
+var pentestHypothesisContract = c38.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -35579,8 +36487,8 @@ var DownloadPentestIntakeDocumentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-intake-document.ts
-var c38 = initContract();
-var pentestIntakeDocumentContract = c38.router({
+var c39 = initContract();
+var pentestIntakeDocumentContract = c39.router({
   listDocuments: {
     method: "GET",
     path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
@@ -35666,8 +36574,8 @@ var pentestIntakeDocumentContract = c38.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c39 = initContract();
-var pentestManualFindingContract = c39.router({
+var c40 = initContract();
+var pentestManualFindingContract = c40.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -35753,9 +36661,42 @@ var pentestManualFindingContract = c39.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/pentest-purchase.ts
+var c41 = initContract();
+var pentestPurchaseContract = c41.router({
+  listPurchases: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/purchases",
+    pathParams: PentestPurchaseParamsSchema,
+    responses: {
+      200: ListPentestPurchasesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  voidPurchase: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/purchases/:purchaseId/void",
+    pathParams: PentestPurchaseIdParamsSchema,
+    body: VoidPentestPurchaseRequestSchema,
+    responses: {
+      200: PentestPurchaseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // PURCHASE_NOT_VOIDABLE, details: { status }
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c40 = initContract();
-var pentestReportPdfContract = c40.router({
+var c42 = initContract();
+var pentestReportPdfContract = c42.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -35848,7 +36789,7 @@ var pentestReportPdfContract = c40.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c40.noBody(),
+    body: c42.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -36046,8 +36987,8 @@ var pentestReportPdfContract = c40.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c41 = initContract();
-var pentestValidationContract = c41.router({
+var c43 = initContract();
+var pentestValidationContract = c43.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -36155,8 +37096,8 @@ var pentestValidationContract = c41.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c42 = initContract();
-var repositoryContract = c42.router({
+var c44 = initContract();
+var repositoryContract = c44.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -36361,7 +37302,7 @@ var repositoryContract = c42.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c42.noBody(),
+    body: c44.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -36495,8 +37436,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c43 = initContract();
-var scanContract = c43.router({
+var c45 = initContract();
+var scanContract = c45.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -36617,8 +37558,8 @@ var StaffPentestStatsResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentest-stats.ts
-var c44 = initContract();
-var staffPentestStatsContract = c44.router({
+var c46 = initContract();
+var staffPentestStatsContract = c46.router({
   getStaffPentestStats: {
     method: "GET",
     path: "/staff/pentest-stats",
@@ -36659,10 +37600,13 @@ var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_export
   /** false hides the engagement from the customer entirely; true shows it again. */
   visible: external_exports.boolean()
 }).strict();
+var RenameStaffOrganizationPentestRequestSchema = external_exports.object({
+  title: external_exports.string().trim().min(1, "Title is required").max(500, "Title must be 500 characters or fewer")
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
-var c45 = initContract();
-var staffPentestsContract = c45.router({
+var c47 = initContract();
+var staffPentestsContract = c47.router({
   listStaffOrganizationPentests: {
     method: "GET",
     path: "/organizations/:organizationId/staff/pentests",
@@ -36689,6 +37633,22 @@ var staffPentestsContract = c45.router({
     },
     summary: "Soft-delete a pentest from the admin console (Trace staff only)"
   },
+  renameStaffOrganizationPentest: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: RenameStaffOrganizationPentestRequestSchema,
+    responses: {
+      200: StaffOrganizationPentestSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Rename a pentest from the admin console (Trace staff only)"
+  },
   setStaffOrganizationPentestCustomerVisibility: {
     method: "POST",
     path: "/organizations/:organizationId/staff/pentests/:pentestId/customer-visibility",
@@ -36813,8 +37773,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c46 = initContract();
-var staffQueueContract = c46.router({
+var c48 = initContract();
+var staffQueueContract = c48.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -36833,11 +37793,8 @@ var NOTES_MAX = 2e3;
 var TestIntegrationIdParamsSchema = external_exports.object({
   testIntegrationId: external_exports.uuid()
 });
-var PentestTestIntegrationsParamsSchema = OrgIdParamsSchema.extend({
-  pentestId: external_exports.uuid()
-});
-var PentestTestIntegrationIdParamsSchema = PentestTestIntegrationsParamsSchema.extend({
-  testIntegrationId: external_exports.uuid()
+var TestIntegrationPasskeyIdParamsSchema = TestIntegrationIdParamsSchema.extend({
+  testIntegrationPasskeyId: external_exports.uuid()
 });
 var TestIntegrationResponseSchema = external_exports.object({
   testIntegrationId: external_exports.uuid(),
@@ -36846,20 +37803,20 @@ var TestIntegrationResponseSchema = external_exports.object({
   notes: external_exports.string(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date(),
-  /** How many pentests this fixture is attached to — blast-radius context. */
-  attachedPentestCount: external_exports.number().int()
+  /**
+   * The second factor's NON-secret parameters, or null when the integration has
+   * none (or its stored parameters are unreadable). The setup key is never
+   * returned by any route.
+   */
+  mfa: CredentialMfaSummarySchema.nullable(),
+  /** Passkeys staff stored for the integration's account. A count only: nothing here is decrypted. */
+  passkeyCount: external_exports.number().int().min(0)
 }).strict();
 var ListTestIntegrationsResponseSchema = external_exports.array(TestIntegrationResponseSchema);
-var PentestTestIntegrationResponseSchema = external_exports.object({
-  testIntegrationId: external_exports.uuid(),
-  label: external_exports.string(),
-  notes: external_exports.string(),
-  attachedById: external_exports.uuid(),
-  attachedAt: external_exports.date()
+var TestIntegrationPasskeyImportSchema = AgentSessionPasskeySchema.required({
+  privateKey: true,
+  userHandle: true
 }).strict();
-var ListPentestTestIntegrationsResponseSchema = external_exports.array(
-  PentestTestIntegrationResponseSchema
-);
 var TestIntegrationLoginSchema = external_exports.object({
   username: external_exports.string().min(1).max(512),
   password: external_exports.string().min(1).max(1024)
@@ -36879,13 +37836,10 @@ var UpdateTestIntegrationRequestSchema = external_exports.object({
   apiKey: external_exports.string().min(1).max(4096).optional(),
   login: TestIntegrationLoginSchema.optional()
 }).strict();
-var AttachTestIntegrationRequestSchema = external_exports.object({
-  testIntegrationId: external_exports.uuid()
-}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c47 = initContract();
-var testIntegrationContract = c47.router({
+var c49 = initContract();
+var testIntegrationContract = c49.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -36938,37 +37892,96 @@ var testIntegrationContract = c47.router({
       500: ErrorResponseSchema
     }
   },
-  // -- Attach edges (org-scoped, staff-only) --------------------------------
-  listPentestTestIntegrations: {
-    method: "GET",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations",
-    pathParams: PentestTestIntegrationsParamsSchema,
+  // -- Second factor (org-less, verified staff) ------------------------------
+  // The same three routes as a customer credential's MFA (credential.ts), for
+  // the same reasons: PUT carries the whole factor so re-sending is idempotent;
+  // the code is a POST so it never sits in an access log or a cacheable read;
+  // DELETE is idempotent. Agents never reach these: they get codes through
+  // get_totp_code on the run-token channel, and never write a factor here.
+  setTestIntegrationMfa: {
+    method: "PUT",
+    path: "/staff/test-integrations/:testIntegrationId/mfa",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: SetCredentialMfaRequestSchema,
     responses: {
-      200: ListPentestTestIntegrationsResponseSchema,
+      // Never echoes the setup key: the integration shape, whose `mfa` carries
+      // the derived non-secret parameters.
+      200: TestIntegrationResponseSchema,
+      400: ErrorResponseSchema,
+      // CREDENTIAL_MFA_SETUP_KEY_INVALID
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
   },
-  attachTestIntegration: {
+  generateTestIntegrationMfaCode: {
     method: "POST",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations",
-    pathParams: PentestTestIntegrationsParamsSchema,
-    body: AttachTestIntegrationRequestSchema,
+    path: "/staff/test-integrations/:testIntegrationId/mfa/code",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: c49.noBody(),
+    responses: {
+      200: CredentialMfaCodeResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      422: ErrorResponseSchema,
+      // CREDENTIAL_MFA_NOT_ENROLLED
+      500: ErrorResponseSchema
+    }
+  },
+  clearTestIntegrationMfa: {
+    method: "DELETE",
+    path: "/staff/test-integrations/:testIntegrationId/mfa",
+    pathParams: TestIntegrationIdParamsSchema,
+    responses: {
+      200: TestIntegrationResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // -- Passkeys (org-less, verified staff) -----------------------------------
+  // Staff enroll a passkey on the integration's account with the capture script
+  // and import the captured file here. Agents never reach these routes; the agent
+  // read path is provision_passkey on the run-token channel. A stored key signs in
+  // as a Trace-owned account, so every route takes the MFA routes' verified-staff
+  // bar. Import is never an upsert: a duplicate is a mistake to surface.
+  importTestIntegrationPasskey: {
+    method: "POST",
+    path: "/staff/test-integrations/:testIntegrationId/passkeys",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: TestIntegrationPasskeyImportSchema,
+    responses: {
+      201: TestIntegrationPasskeySummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // TEST_INTEGRATION_PASSKEY_EXISTS
+      500: ErrorResponseSchema
+    }
+  },
+  listTestIntegrationPasskeys: {
+    method: "GET",
+    path: "/staff/test-integrations/:testIntegrationId/passkeys",
+    pathParams: TestIntegrationIdParamsSchema,
     responses: {
-      201: PentestTestIntegrationResponseSchema,
+      200: external_exports.array(TestIntegrationPasskeySummarySchema),
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
-      // pentest or fixture not found
       500: ErrorResponseSchema
     }
   },
-  detachTestIntegration: {
+  // Not idempotent: the id names a specific row, and a second delete should say it
+  // is gone. The passkey on the site's side stays.
+  deleteTestIntegrationPasskey: {
     method: "DELETE",
-    path: "/organizations/:organizationId/staff/pentests/:pentestId/test-integrations/:testIntegrationId",
-    pathParams: PentestTestIntegrationIdParamsSchema,
+    path: "/staff/test-integrations/:testIntegrationId/passkeys/:testIntegrationPasskeyId",
+    pathParams: TestIntegrationPasskeyIdParamsSchema,
     responses: {
       204: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -37017,8 +38030,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c48 = initContract();
-var userContract = c48.router({
+var c50 = initContract();
+var userContract = c50.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -37133,8 +38146,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c49 = initContract();
-var vantaIntegrationContract = c49.router({
+var c51 = initContract();
+var vantaIntegrationContract = c51.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -37476,8 +38489,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c50 = initContract();
-var vulnerabilityContract = c50.router({
+var c52 = initContract();
+var vulnerabilityContract = c52.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -37702,8 +38715,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c51 = initContract();
-var vulnerabilityNoteContract = c51.router({
+var c53 = initContract();
+var vulnerabilityNoteContract = c53.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -37884,8 +38897,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c52 = initContract();
-var webhookSettingsContract = c52.router({
+var c54 = initContract();
+var webhookSettingsContract = c54.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -38023,8 +39036,8 @@ var webhookSettingsContract = c52.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c53 = initContract();
-var v1Contract = c53.router(
+var c55 = initContract();
+var v1Contract = c55.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -38074,6 +39087,8 @@ var v1Contract = c53.router(
     inviteLink: inviteLinkContract,
     engagement: engagementContract,
     testIntegration: testIntegrationContract,
+    paymentCard: paymentCardContract,
+    pentestPurchase: pentestPurchaseContract,
     pentestEgress: pentestEgressContract,
     staffPentestStats: staffPentestStatsContract,
     staffPentests: staffPentestsContract,
@@ -38085,19 +39100,60 @@ var v1Contract = c53.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c54 = initContract();
-var contract = c54.router({
+var c56 = initContract();
+var contract = c56.router({
   v1: v1Contract
 });
 
+// ../../packages/api-contracts/src/contracts/v1/desktop-host-internal.ts
+var c57 = initContract();
+var MAX_VMS_PER_SYNC = 16;
+var DesktopHostSyncRequestSchema = external_exports.object({
+  /** Integer protocol the runner speaks. Below the api's minimum, the host gets
+   *  no new targets but keeps serving the ones it holds. */
+  protocolVersion: external_exports.number().int().min(1),
+  runnerVersion: external_exports.string().min(1).max(200),
+  /** Target ids with a VM on disk OR being created right now. */
+  presentVmIds: external_exports.array(external_exports.uuid()).max(MAX_VMS_PER_SYNC)
+});
+var DesktopHostSyncTargetSchema = external_exports.object({
+  desktopTargetId: external_exports.uuid(),
+  status: external_exports.enum(["PROVISIONING", "READY"]),
+  runVersion: external_exports.number().int().min(0),
+  runToken: external_exports.string().min(1),
+  /** Epoch millis the host deletes the VM by, whatever the api says later. */
+  localDeadlineMs: external_exports.number().int().positive(),
+  heartbeatSec: external_exports.number().int().positive()
+});
+var DesktopHostSyncResponseSchema = external_exports.object({
+  syncIntervalMs: external_exports.number().int().positive(),
+  /** This host's PROVISIONING and READY targets. Any VM the runner holds for an
+   *  id not listed here is deleted. */
+  targets: external_exports.array(DesktopHostSyncTargetSchema).max(MAX_VMS_PER_SYNC)
+});
+var desktopHostInternalContract = c57.router({
+  sync: {
+    method: "POST",
+    path: "/internal/v1/desktop-hosts/sync",
+    body: DesktopHostSyncRequestSchema,
+    responses: {
+      200: DesktopHostSyncResponseSchema,
+      400: ErrorResponseSchema,
+      // Bad, expired or revoked host token, or a decommissioned host.
+      401: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/github-webhook.api.ts
 var GitHubWebhookResponseSchema = external_exports.object({
   ok: external_exports.boolean()
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c55 = initContract();
-var githubWebhookContract = c55.router(
+var c58 = initContract();
+var githubWebhookContract = c58.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38115,7 +39171,7 @@ var githubWebhookContract = c55.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c55.router(
+var githubReadonlyWebhookContract = c58.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38135,9 +39191,9 @@ var githubReadonlyWebhookContract = c55.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c56 = initContract();
+var c59 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c56.router(
+var linearWebhookContract = c59.router(
   {
     handleWebhook: {
       method: "POST",
@@ -38157,7 +39213,7 @@ var linearWebhookContract = c56.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c57 = initContract();
+var c60 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -38186,7 +39242,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c57.router(
+var forgeBitbucketContract = c60.router(
   {
     lifecycle: {
       method: "POST",
@@ -38233,8 +39289,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c58 = initContract();
-var healthContract = c58.router({
+var c61 = initContract();
+var healthContract = c61.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -38246,8 +39302,8 @@ var healthContract = c58.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c59 = initContract();
-var vulnerabilityShareContract = c59.router(
+var c62 = initContract();
+var vulnerabilityShareContract = c62.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -38334,8 +39390,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c60 = initContract();
-var prVulnerabilityContract = c60.router(
+var c63 = initContract();
+var prVulnerabilityContract = c63.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -41079,22 +42135,30 @@ function toIso(value) {
   return Number.isNaN(date5.getTime()) ? String(value) : date5.toISOString();
 }
 async function confirmDeletion(description, skip) {
-  if (skip) {
+  return confirmAction(`Delete ${description}?`, { skip, verb: "delete" });
+}
+async function confirmAction(question, options) {
+  if (options.skip) {
     return true;
   }
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    console.error(colorError("Refusing to delete without --yes in a non-interactive shell."));
+    console.error(
+      colorError(`Refusing to ${options.verb} without --yes in a non-interactive shell.`)
+    );
     process.exit(1);
   }
   const readline = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await readline.question(`Delete ${description}? [y/N] `);
+    const answer = await readline.question(`${question} [y/N] `);
     const normalized = answer.trim().toLowerCase();
     return normalized === "y" || normalized === "yes";
   } finally {
     readline.close();
   }
 }
+function collectRepeatable(value, previous) {
+  return [...previous ?? [], value];
+}
 
 // src/application/commands.ts
 var APPLICATION_TYPE_BY_INPUT = {
@@ -41253,12 +42317,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c62) => c62.type.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c65) => c65.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.name.padEnd(nameWidth)}  ${c62.type.padEnd(typeWidth)}  ${c62.repos.padStart(5)}  ${c62.url}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.name.padEnd(nameWidth)}  ${c65.type.padEnd(typeWidth)}  ${c65.repos.padStart(5)}  ${c65.url}`
   );
   return { header, rows };
 }
@@ -41278,12 +42342,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c62) => c62.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c62) => c62.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c62) => c62.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c65) => c65.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c65) => c65.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c65) => c65.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.scan.padEnd(4)}  ${c62.role.padEnd(roleWidth)}  ${c62.path.padEnd(pathWidth)}  ${c62.status}`
+    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.scan.padEnd(4)}  ${c65.role.padEnd(roleWidth)}  ${c65.path.padEnd(pathWidth)}  ${c65.status}`
   );
   return { header, rows };
 }
@@ -42068,8 +43132,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c62, i2, m2) => {
-    const d = n3 ? n3(c62, i2) : c62;
+`).map((c65, i2, m2) => {
+    const d = n3 ? n3(c65, i2) : c65;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -42567,14 +43631,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c62 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c65 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c62 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c62 ? 1 : 0);
+  d && g++, c65 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c65 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -42595,14 +43659,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c62 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c62 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c65 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c62 && x.push(M), x;
+  return c65 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -42621,15 +43685,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c62 = this.value ? a2 : s;
+`, c65 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c62)}`;
+          return `${o2}${r2}${styleText2("dim", c65)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c62)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c65)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -42777,13 +43841,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c62 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c65 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c62}
+${u4}  ${styleText2("yellow", this.error)}${c65}
 `;
       }
       case "submit": {
@@ -42811,7 +43875,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c62}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c62}
+${r2}${c65}
 `;
       }
     }
@@ -42826,7 +43890,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c62 = this.userInputWithCursor, i2 = this.masked;
+`, c65 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -42846,7 +43910,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c62}
+        return `${o2}${s}${c65}
 ${n3}
 `;
       }
@@ -42862,7 +43926,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c61 = (t2, o2) => t2.includes(`
+var c64 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -42873,15 +43937,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c61(s, (i2) => styleText2("dim", i2))}`;
+        return `${c64(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c61(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c64(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c61(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -44213,7 +45277,7 @@ Examples:
     }
     const { organizationId, slug } = resolution.organization;
     if (options.web) {
-      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/github`;
+      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/source-code`;
       const opened = await openBrowser(url2);
       if (!opened) {
         console.log(`Open in browser: ${url2}`);
@@ -44259,7 +45323,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c62) => !c62._hidden).map((c62) => extractCommandTree(c62));
+  const subcommands = cmd.commands.filter((c65) => !c65._hidden).map((c65) => extractCommandTree(c65));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -44325,7 +45389,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c62) => c62.name);
+  const subcommandNames = tree.subcommands.map((c65) => c65.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -44740,9 +45804,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c62) => c62.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c65) => c65.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c62) => `${c62.address.padEnd(addressWidth)}  ${c62.label}`);
+  const rows = cells.map((c65) => `${c65.address.padEnd(addressWidth)}  ${c65.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -44766,14 +45830,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c62) => c62.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c62) => c62.from.length));
-  const toWidth = Math.max(2, ...cells.map((c62) => c62.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c62) => c62.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c65) => c65.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c65) => c65.from.length));
+  const toWidth = Math.max(2, ...cells.map((c65) => c65.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c65) => c65.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.received.padEnd(receivedWidth)}  ${c62.from.padEnd(fromWidth)}  ${c62.to.padEnd(toWidth)}  ${c62.subject.padEnd(subjectWidth)}  ${c62.unread}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.received.padEnd(receivedWidth)}  ${c65.from.padEnd(fromWidth)}  ${c65.to.padEnd(toWidth)}  ${c65.subject.padEnd(subjectWidth)}  ${c65.unread}`
   );
   return { header, rows };
 }
@@ -45548,16 +46612,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c62) => ({
-    id: c62.credentialId,
-    label: sanitizeDisplay(c62.label),
-    type: c62.credentialType
+  const cells = creds.map((c65) => ({
+    id: c65.credentialId,
+    label: sanitizeDisplay(c65.label),
+    type: c65.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c62) => c62.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c62) => c62.label.length));
+  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c65) => c65.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c62) => `${c62.id.padEnd(idWidth)}  ${c62.label.padEnd(labelWidth)}  ${c62.type}`
+    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.label.padEnd(labelWidth)}  ${c65.type}`
   );
   return { header, rows };
 }
@@ -46202,6 +47266,12 @@ function failWriteOp4(action, status, body, notFoundLabel) {
           message ?? "This environment is frozen by an active pentest and cannot be changed."
         )
       );
+    } else if (errorCode === "ENVIRONMENT_IN_USE_BY_PENTEST") {
+      console.error(
+        colorError(
+          message ?? "A pentest still uses this environment. Remove it from the engagement first."
+        )
+      );
     } else {
       console.error(colorError(message ?? "Conflict (status 409)."));
     }
@@ -46321,14 +47391,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c62) => c62.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c65) => c65.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c62) => c62.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c65) => c65.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c62) => `${padLeading(c62.leading)}  ${c62.name.padEnd(nameWidth)}  ${c62.prod.padEnd(4)}  ${c62.url}`
+      (c65) => `${padLeading(c65.leading)}  ${c65.name.padEnd(nameWidth)}  ${c65.prod.padEnd(4)}  ${c65.url}`
     )
   };
 }
@@ -46709,11 +47779,46 @@ var CLI_VERSION = packageMetadata.version;
 // src/pentest/commands.ts
 import { readFileSync as readFileSync7 } from "fs";
 
-// src/pentest/create-finding.ts
+// src/pentest/evidence.ts
 import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { basename as basename2 } from "path";
 
 // src/pentest/resolve.ts
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveApplicationId(organizationId, identifier) {
+  if (UUID_PATTERN2.test(identifier)) {
+    return identifier;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.listApplications({ params: { organizationId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list applications (status ${result.status}).`));
+    process.exit(1);
+  }
+  const wanted = identifier.trim().toLowerCase();
+  const matches = result.body.filter((app) => app.name.trim().toLowerCase() === wanted);
+  if (matches.length === 1 && matches[0]) {
+    return matches[0].applicationId;
+  }
+  if (matches.length > 1) {
+    console.error(
+      colorError(
+        `Application name '${sanitizeDisplay(identifier)}' is ambiguous. Pass the application ID instead (\`tracecli app list\`).`
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Application '${sanitizeDisplay(identifier)}' not found. Run \`tracecli app list\` to see available applications.`
+    )
+  );
+  process.exit(1);
+}
 async function resolvePentestId(organizationId, identifier) {
   if (UUID_PATTERN2.test(identifier)) {
     return identifier;
@@ -46750,7 +47855,306 @@ Run \`tracecli pentest list\` to see available pentests.`
   return pentest.pentestId;
 }
 
+// src/pentest/evidence.ts
+var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
+var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
+function isSection(value) {
+  return ValidationEvidenceSectionValues.includes(value);
+}
+function isKind(value) {
+  return PentestExploitArtifactKindValues.includes(value);
+}
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function resolveFindingId(organizationId, pentestId, identifier) {
+  if (isUuid(identifier)) {
+    return identifier;
+  }
+  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
+  }
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list findings (status ${result.status}).`));
+    process.exit(1);
+  }
+  const match = result.body.find((f) => f.displayId === displayId);
+  if (!match || !("pentestFindingId" in match)) {
+    console.error(
+      colorError(
+        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
+      )
+    );
+    process.exit(1);
+  }
+  return match.pentestFindingId;
+}
+async function runAttachEvidence(options) {
+  if (options.section !== void 0 && !isSection(options.section)) {
+    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
+    console.error(`Valid sections: ${SECTION_LIST}`);
+    process.exit(1);
+  }
+  if (options.kind !== void 0 && !isKind(options.kind)) {
+    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
+    console.error(`Valid kinds: ${KIND_LIST}`);
+    process.exit(1);
+  }
+  let sizeBytes;
+  try {
+    const stats = statSync2(options.file);
+    if (!stats.isFile()) {
+      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
+      process.exit(1);
+    }
+    sizeBytes = stats.size;
+  } catch {
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
+    process.exit(1);
+  }
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
+    process.exit(1);
+  }
+  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
+    console.error(
+      colorError(
+        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+  const params = { organizationId, pentestId, pentestFindingId };
+  const filename = basename2(options.file);
+  const slot = await authenticatedRequest(
+    (client) => client.pentestFinding.createFindingEvidenceUpload({
+      params,
+      body: { filename, sizeBytes }
+    })
+  );
+  if (slot.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (slot.status !== 201) {
+    const { message } = readErrorFields(slot.body);
+    console.error(
+      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
+    );
+    process.exit(1);
+  }
+  const body = readFileSync5(options.file);
+  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  const attached = await authenticatedRequest(
+    (client) => client.pentestFinding.attachFindingEvidence({
+      params,
+      body: {
+        key: slot.body.key,
+        ...options.caption !== void 0 ? { caption: options.caption } : {},
+        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
+        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
+        ...options.customerFacing ? { customerFacing: true } : {}
+      }
+    })
+  );
+  if (attached.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (attached.status !== 201) {
+    const { message } = readErrorFields(attached.body);
+    console.error(
+      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    printJson(attached.body);
+    return;
+  }
+  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
+  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
+  console.log(
+    colorSuccess(
+      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+    )
+  );
+  console.log(`  artifact ${attached.body.artifactId}`);
+  if (attached.body.kind === "HAR") {
+    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
+  } else if (!attached.body.customerFacing) {
+    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  }
+}
+function createAttachEvidenceCommand() {
+  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+The file uploads straight to storage, so recordings of any reasonable size work.
+Videos and HAR captures always land staff-internal \u2014 publish a video with the
+toggle in the staff console's evidence panel after reviewing it for redaction.
+
+Examples:
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
+    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
+    --caption "Full member roster returned to a non-member" --customer-facing --output json`
+  ).action(async (options) => {
+    await runAttachEvidence(options);
+  });
+}
+
+// src/pentest/copy-findings.ts
+function validateSelection(options) {
+  const hasApplication = options.application !== void 0;
+  const hasFindings = options.finding !== void 0 && options.finding.length > 0;
+  if (hasApplication === hasFindings) {
+    return {
+      error: "Pass exactly one of --application <id|name> or --finding <id> (repeatable)."
+    };
+  }
+  return null;
+}
+function failCopy(status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only Trace staff can copy pentest findings. Sign in with a staff account via `tracecli auth login`."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "Pentest, application, or finding not found."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(
+        errorCode === "PENTEST_CLOSED" ? message ?? "Closed pentests must be reopened before copying findings into them." : message ?? "Conflict (status 409)."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to copy findings (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function formatCopiedFinding(finding) {
+  const source = finding.sourceDisplayId === null ? "draft" : `PTF-${finding.sourceDisplayId}`;
+  const status = sanitizeDisplay(finding.sourceStatus).toLowerCase().replace(/_/g, " ");
+  const evidence = `${finding.evidenceCount} exhibit${finding.evidenceCount === 1 ? "" : "s"}`;
+  const target = finding.pentestFindingId === null ? "" : ` -> ${finding.pentestFindingId}`;
+  return `  [${sanitizeDisplay(finding.severity)}] ${sanitizeDisplay(finding.title)}  (${source}, ${status}, ${evidence})${target}`;
+}
+async function copyFindings(options) {
+  const selection = validateSelection(options);
+  if (selection) {
+    console.error(colorError(selection.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const sourcePentestId = await resolvePentestId(organizationId, options.from);
+  const targetPentestId = await resolvePentestId(organizationId, options.to);
+  const dryRun = options.dryRun ?? false;
+  const body = options.application !== void 0 ? {
+    sourcePentestId,
+    applicationId: await resolveApplicationId(organizationId, options.application),
+    dryRun
+  } : {
+    sourcePentestId,
+    pentestFindingIds: await Promise.all(
+      (options.finding ?? []).map(
+        (id) => resolveFindingId(organizationId, sourcePentestId, id)
+      )
+    ),
+    dryRun
+  };
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.copyFindings({
+      params: { organizationId, pentestId: targetPentestId },
+      body
+    })
+  );
+  if (result.status !== CREATED_STATUS && result.status !== SUCCESS_STATUS) {
+    failCopy(result.status, result.body);
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const { findings } = result.body;
+  if (findings.length === 0) {
+    console.log("No findings matched the selection. Nothing copied.");
+    return;
+  }
+  const exhibits = findings.reduce((n3, f) => n3 + f.evidenceCount, 0);
+  const summary = `${findings.length} finding${findings.length === 1 ? "" : "s"} with ${exhibits} exhibit${exhibits === 1 ? "" : "s"}`;
+  console.log(
+    result.body.dryRun ? `Dry run: ${summary} would be copied from ${sanitizeDisplay(options.from)} to ${sanitizeDisplay(options.to)}.` : colorSuccess(
+      `Copied ${summary} from ${sanitizeDisplay(options.from)} to ${sanitizeDisplay(options.to)}.`
+    )
+  );
+  for (const finding of findings) {
+    console.log(formatCopiedFinding(finding));
+  }
+  if (!result.body.dryRun) {
+    console.log(
+      `The copies are unpublished drafts. Run \`tracecli pentest findings publish --pentest ${sanitizeDisplay(options.to)} --all\` to number them and show them to the customer.`
+    );
+  }
+}
+function createCopyFindingsCommand() {
+  return new Command("copy").description(
+    "Copy findings (with prose and evidence) from one pentest into another as unpublished drafts (staff)"
+  ).requiredOption("--from <id>", "Source pentest display ID (e.g. PT-1) or UUID").requiredOption("--to <id>", "Target pentest display ID (e.g. PT-2) or UUID").option(
+    "--application <id|name>",
+    "Copy every source finding that cites a repository linked to this application"
+  ).option(
+    "--finding <id>",
+    "Source finding number (e.g. PTF-7) or UUID (repeatable)",
+    collectRepeatable
+  ).option("--dry-run", "Show what would be copied without writing anything").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await copyFindings(options);
+  });
+}
+
 // src/pentest/create-finding.ts
+import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
 var SEVERITY_LIST = PentestFindingSeverityValues.join(", ");
 function collectCwe(value, previous) {
   return [...previous ?? [], value];
@@ -46789,14 +48193,14 @@ function parseCreateFindingJsonFile(raw, sourceLabel) {
 }
 function readUtf8File(path, flag) {
   try {
-    const stats = statSync2(path);
+    const stats = statSync3(path);
     if (!stats.isFile()) {
       return { error: `${flag} '${sanitizeDisplay(path)}' is not a regular file.` };
     }
   } catch {
     return { error: `Cannot read ${flag} '${sanitizeDisplay(path)}'.` };
   }
-  const text = readFileSync5(path, "utf8");
+  const text = readFileSync6(path, "utf8");
   if (text.trim().length === 0) {
     return { error: `${flag} '${sanitizeDisplay(path)}' is empty.` };
   }
@@ -47024,15 +48428,139 @@ function createCreateFindingCommand() {
   });
 }
 
+// src/pentest/staff-errors.ts
+function failStaffPentestWrite(action, status, body, options = {}) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    const staffGuard = message === void 0 || /only trace staff/i.test(message);
+    console.error(
+      colorError(
+        staffGuard ? `Only Trace staff can ${action}. Sign in with a staff account via \`tracecli auth login\`.` : `Cannot ${action}: ${message}`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(options.notFound ?? message ?? "Not found."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(
+        errorCode === "PENTEST_CLOSED" ? options.closed ?? message ?? "Closed pentests must be reopened first." : message ?? "Conflict (status 409)."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+
+// src/pentest/create-pentest.ts
+var TEST_TYPE_LIST = PentestTestTypeValues.join(", ");
+function parseTestType(raw) {
+  const parsed = PentestTestType.safeParse(raw.trim().toUpperCase().replace(/-/g, "_"));
+  if (parsed.success) {
+    return parsed.data;
+  }
+  return { error: `Invalid --test-type '${sanitizeDisplay(raw)}'. Use one of: ${TEST_TYPE_LIST}.` };
+}
+async function createPentest(options) {
+  const title = options.title.trim();
+  if (title.length === 0) {
+    console.error(colorError("--title cannot be empty."));
+    process.exit(1);
+  }
+  let testType;
+  if (options.testType !== void 0) {
+    const parsed = parseTestType(options.testType);
+    if (typeof parsed !== "string") {
+      console.error(colorError(parsed.error));
+      process.exit(1);
+    }
+    testType = parsed;
+  }
+  const organizationId = await resolveOrganizationId();
+  const primaryApplicationId = options.application === void 0 ? void 0 : await resolveApplicationId(organizationId, options.application);
+  const created = await authenticatedRequest(
+    (client) => client.pentest.createPentest({
+      params: { organizationId },
+      body: {
+        title,
+        ...options.description !== void 0 ? { description: options.description } : {},
+        ...primaryApplicationId !== void 0 ? { primaryApplicationId } : {},
+        ...testType !== void 0 ? { testType } : {}
+      }
+    })
+  );
+  if (created.status !== CREATED_STATUS) {
+    failStaffPentestWrite("create pentests", created.status, created.body);
+  }
+  const pentest = created.body;
+  let hiddenFromCustomerAt = null;
+  if (options.hidden) {
+    const remedy = `Created pentest PT-${pentest.displayId} (${pentest.pentestId}) but could not hide it, so the customer can see it. Run \`tracecli pentest visibility PT-${pentest.displayId} --hidden\`.`;
+    let hidden;
+    try {
+      hidden = await hidePentest(organizationId, pentest.pentestId);
+    } catch (error48) {
+      console.error(
+        colorError(`${remedy} (${error48 instanceof Error ? error48.message : String(error48)})`)
+      );
+      process.exit(1);
+    }
+    if (hidden.status !== SUCCESS_STATUS) {
+      console.error(colorError(`${remedy} (status ${hidden.status})`));
+      process.exit(1);
+    }
+    hiddenFromCustomerAt = hidden.body.hiddenFromCustomerAt;
+  }
+  if (options.output === "json") {
+    printJson({ ...pentest, hiddenFromCustomerAt });
+    return;
+  }
+  console.log(colorSuccess(`Created pentest PT-${pentest.displayId} (${pentest.pentestId})`));
+  console.log(`  ${sanitizeDisplay(pentest.title)}`);
+  const applications = (pentest.applications ?? []).map((app) => sanitizeDisplay(app.name));
+  if (applications.length > 0) {
+    console.log(`  Application: ${applications.join(", ")}`);
+  }
+  console.log(
+    hiddenFromCustomerAt === null ? "  Visible to the customer. Findings stay unpublished until you publish them." : `  Hidden from the customer until you run \`tracecli pentest visibility PT-${pentest.displayId} --visible\`.`
+  );
+}
+function hidePentest(organizationId, pentestId) {
+  return authenticatedRequest(
+    (client) => client.staffPentests.setStaffOrganizationPentestCustomerVisibility({
+      params: { organizationId, pentestId },
+      body: { visible: false }
+    })
+  );
+}
+function createCreatePentestCommand() {
+  return new Command("create").description("Create a pentest (staff)").requiredOption("--title <text>", "Engagement title").option("--application <id|name>", "Application under test (bound as the primary application)").option("--test-type <type>", `Declared test type (${TEST_TYPE_LIST}); default WHITE_BOX`).option("--description <text>", "Engagement description").option("--hidden", "Hide the pentest from the customer until you make it visible").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await createPentest(options);
+  });
+}
+
 // src/pentest/deliverables.ts
 import { open as open2, rename, rm, stat } from "fs/promises";
-import { basename as basename3, join as join6, resolve } from "path";
+import { basename as basename4, join as join6, resolve } from "path";
 
 // src/upload/prepare.ts
 import { createHash } from "crypto";
-import { createReadStream, statSync as statSync3 } from "fs";
+import { createReadStream, statSync as statSync4 } from "fs";
 import { open } from "fs/promises";
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 var CodeUploadPrepareError = class extends Error {
   constructor(message) {
     super(message);
@@ -47131,7 +48659,7 @@ function assertPreparedMatchesUpload(upload, prepared) {
 async function prepareUploadFile(filePath, options = {}) {
   let sizeBytes;
   try {
-    const stats = statSync3(filePath);
+    const stats = statSync4(filePath);
     if (!stats.isFile()) {
       throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
     }
@@ -47146,7 +48674,7 @@ async function prepareUploadFile(filePath, options = {}) {
   if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
     throw new CodeUploadPrepareError(archiveTooLargeMessage());
   }
-  const originalFilename = basename2(filePath);
+  const originalFilename = basename3(filePath);
   const inferred = inferArtifactKindFromFilename(originalFilename);
   const artifactKind = options.artifactKind ?? inferred;
   if (artifactKind == null) {
@@ -47172,6 +48700,12 @@ async function prepareUploadFile(filePath, options = {}) {
 }
 
 // src/pentest/status-update.ts
+var STATUS_UPDATE_TARGETS = [
+  "IN_PROGRESS",
+  "REMEDIATED",
+  "ACCEPTED_WITH_CONTROLS"
+];
+var STATUS_UPDATE_TARGET_LIST = STATUS_UPDATE_TARGETS.join(", ");
 var PENTEST_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|pt-\d+|\d+)$/i;
 var FINDING_IDENTIFIER_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|ptf-\d+|\d+)$/i;
 var MAX_NOTE_LENGTH = 1e4;
@@ -47182,11 +48716,15 @@ function parseStatusUpdateTarget(raw) {
       error: "IN_REVIEW is not a finding status. Use IN_PROGRESS while fixing, then REMEDIATED when the fix is ready for retest."
     };
   }
-  if (normalized === "IN_PROGRESS" || normalized === "REMEDIATED") {
-    return normalized;
+  if (normalized === "ACCEPTED" || normalized === "ACCEPT") {
+    return "ACCEPTED_WITH_CONTROLS";
+  }
+  const target = STATUS_UPDATE_TARGETS.find((candidate) => candidate === normalized);
+  if (target !== void 0) {
+    return target;
   }
   return {
-    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use IN_PROGRESS or REMEDIATED.`
+    error: `Invalid --status '${sanitizeDisplay(raw)}'. Use ${STATUS_UPDATE_TARGET_LIST}.`
   };
 }
 function isPentestIdentifier(value) {
@@ -47195,6 +48733,17 @@ function isPentestIdentifier(value) {
 function isFindingIdentifier(value) {
   return FINDING_IDENTIFIER_PATTERN.test(value);
 }
+function requireAcceptRationale(note) {
+  if (note === void 0) {
+    console.error(
+      colorError(
+        "--note is required when accepting a finding: say why the risk is acceptable or which controls cover it."
+      )
+    );
+    process.exit(1);
+  }
+  return note;
+}
 function failStatusUpdate(status, body, viaApiKey) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
@@ -47287,10 +48836,13 @@ async function runStatusUpdate(options) {
   }
   if (note !== void 0 && target === "IN_PROGRESS") {
     console.error(
-      colorError("--note is only used when reporting remediation (--status REMEDIATED).")
+      colorError(
+        "--note is only used when reporting remediation or accepting (--status REMEDIATED or ACCEPTED_WITH_CONTROLS)."
+      )
     );
     process.exit(1);
   }
+  const rationale = target === "ACCEPTED_WITH_CONTROLS" ? requireAcceptRationale(note) : null;
   const viaApiKey = requireAuth().kind === "api_key";
   const organizationId = await resolveOrganizationId();
   const params = {
@@ -47303,6 +48855,8 @@ async function runStatusUpdate(options) {
       params,
       body: { status: target, ...note !== void 0 ? { note } : {} }
     })
+  ) : rationale !== null ? await authenticatedRequest(
+    (client) => client.pentestFinding.accept({ params, body: { rationale } })
   ) : target === "IN_PROGRESS" ? await authenticatedRequest(
     (client) => client.pentestFinding.startProgress({ params, body: {} })
   ) : await authenticatedRequest(
@@ -47323,19 +48877,24 @@ async function runStatusUpdate(options) {
   console.log(colorSuccess(`PTF-${displayId} is now ${status}`));
 }
 function createStatusUpdateCommand() {
-  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS or REMEDIATED").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
+  return new Command("status-update").description("Move a pentest finding to IN_PROGRESS, REMEDIATED, or ACCEPTED_WITH_CONTROLS").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption(
     "--status <status>",
-    "IN_PROGRESS (start work) or REMEDIATED (ready for retest)"
-  ).option("--note <text>", "Optional context when reporting remediation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "IN_PROGRESS (start work), REMEDIATED (ready for retest), or ACCEPTED_WITH_CONTROLS (accept the risk)"
+  ).option(
+    "--note <text>",
+    "Context when reporting remediation; the required rationale when accepting"
+  ).option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
     "after",
     `
 Customer-facing status writes \u2014 the same transitions as the dashboard. An agent
 can mark a finding in progress when it starts the fix, then remediated when the
 fix is ready for Trace to re-test. Leaving the finding IN_PROGRESS (and not
-sending REMEDIATED) keeps it out of the retest queue.
+sending REMEDIATED) keeps it out of the retest queue. ACCEPTED_WITH_CONTROLS
+(also spelled ACCEPTED) closes the finding as an accepted risk with no Trace
+review; --note carries the rationale and is required.
 
-IN_PROGRESS is allowed from OPEN or VERIFIED_OPEN. REMEDIATED is allowed from
-OPEN, IN_PROGRESS, or VERIFIED_OPEN.
+IN_PROGRESS is allowed from OPEN, VERIFIED_OPEN, or PARTIALLY_FIXED. REMEDIATED and
+ACCEPTED_WITH_CONTROLS are allowed from OPEN, IN_PROGRESS, VERIFIED_OPEN, or PARTIALLY_FIXED.
 
 A signed-in session (\`tracecli auth login\`) attributes the change to you. A
 Trace API key works too, once Trace enables finding automation for your
@@ -47346,7 +48905,9 @@ Examples:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
   tracecli pentest findings status-update --pentest PT-3 --finding PTF-7 --status REMEDIATED
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED \\
-    --note "Fixed in PR 412" --output json`
+    --note "Fixed in PR 412" --output json
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status ACCEPTED \\
+    --note "Internal-only endpoint behind SSO; residual risk accepted"`
   ).action(async (options) => {
     await runStatusUpdate(options);
   });
@@ -47360,7 +48921,7 @@ var PentestDeliverableDownloadError = class extends Error {
   }
 };
 function safeDeliverableFilename(documentId, extension, fallbackStem) {
-  const stripped = Array.from(basename3(documentId.replace(/\\/g, "/")), (char) => {
+  const stripped = Array.from(basename4(documentId.replace(/\\/g, "/")), (char) => {
     const code = char.codePointAt(0) ?? 0;
     return code <= 31 || code === 127 ? "_" : char;
   }).join("").trim();
@@ -47846,182 +49407,6 @@ function createAttestationCommand() {
   return attestation;
 }
 
-// src/pentest/evidence.ts
-import { readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename4 } from "path";
-var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
-var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
-function isSection(value) {
-  return ValidationEvidenceSectionValues.includes(value);
-}
-function isKind(value) {
-  return PentestExploitArtifactKindValues.includes(value);
-}
-function formatBytes2(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-}
-async function resolveFindingId(organizationId, pentestId, identifier) {
-  if (isUuid(identifier)) {
-    return identifier;
-  }
-  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
-  if (!numericMatch?.[1]) {
-    console.error(
-      colorError(
-        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
-      )
-    );
-    process.exit(1);
-  }
-  const displayId = Number.parseInt(numericMatch[1], 10);
-  const result = await authenticatedRequest(
-    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
-  );
-  if (result.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (result.status !== 200) {
-    console.error(colorError(`Failed to list findings (status ${result.status}).`));
-    process.exit(1);
-  }
-  const match = result.body.find((f) => f.displayId === displayId);
-  if (!match || !("pentestFindingId" in match)) {
-    console.error(
-      colorError(
-        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
-      )
-    );
-    process.exit(1);
-  }
-  return match.pentestFindingId;
-}
-async function runAttachEvidence(options) {
-  if (options.section !== void 0 && !isSection(options.section)) {
-    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
-    console.error(`Valid sections: ${SECTION_LIST}`);
-    process.exit(1);
-  }
-  if (options.kind !== void 0 && !isKind(options.kind)) {
-    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
-    console.error(`Valid kinds: ${KIND_LIST}`);
-    process.exit(1);
-  }
-  let sizeBytes;
-  try {
-    const stats = statSync4(options.file);
-    if (!stats.isFile()) {
-      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
-      process.exit(1);
-    }
-    sizeBytes = stats.size;
-  } catch {
-    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
-    process.exit(1);
-  }
-  if (sizeBytes === 0) {
-    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
-    process.exit(1);
-  }
-  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
-    console.error(
-      colorError(
-        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
-      )
-    );
-    process.exit(1);
-  }
-  const organizationId = await resolveOrganizationId();
-  const pentestId = await resolvePentestId(organizationId, options.pentest);
-  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
-  const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename4(options.file);
-  const slot = await authenticatedRequest(
-    (client) => client.pentestFinding.createFindingEvidenceUpload({
-      params,
-      body: { filename, sizeBytes }
-    })
-  );
-  if (slot.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (slot.status !== 201) {
-    const { message } = readErrorFields(slot.body);
-    console.error(
-      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
-    );
-    process.exit(1);
-  }
-  const body = readFileSync6(options.file);
-  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
-  if (!put.ok) {
-    console.error(
-      colorError(
-        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
-      )
-    );
-    process.exit(1);
-  }
-  const attached = await authenticatedRequest(
-    (client) => client.pentestFinding.attachFindingEvidence({
-      params,
-      body: {
-        key: slot.body.key,
-        ...options.caption !== void 0 ? { caption: options.caption } : {},
-        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
-        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
-        ...options.customerFacing ? { customerFacing: true } : {}
-      }
-    })
-  );
-  if (attached.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (attached.status !== 201) {
-    const { message } = readErrorFields(attached.body);
-    console.error(
-      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
-    );
-    process.exit(1);
-  }
-  if (options.output === "json") {
-    printJson(attached.body);
-    return;
-  }
-  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
-  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
-  console.log(
-    colorSuccess(
-      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
-    )
-  );
-  console.log(`  artifact ${attached.body.artifactId}`);
-  if (attached.body.kind === "HAR") {
-    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
-  } else if (!attached.body.customerFacing) {
-    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
-  }
-}
-function createAttachEvidenceCommand() {
-  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
-    "after",
-    `
-The file uploads straight to storage, so recordings of any reasonable size work.
-Videos and HAR captures always land staff-internal \u2014 publish a video with the
-toggle in the staff console's evidence panel after reviewing it for redaction.
-
-Examples:
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
-    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
-    --caption "Full member roster returned to a non-member" --customer-facing --output json`
-  ).action(async (options) => {
-    await runAttachEvidence(options);
-  });
-}
-
 // src/pentest/get-finding.ts
 var OUTPUT_FORMATS2 = ["text", "json"];
 function isOutputFormat2(value) {
@@ -48043,7 +49428,9 @@ function sanitizeMarkdown(value) {
 }
 function formatFindingMarkdown(finding) {
   const lines = [];
-  lines.push(`# PTF-${finding.displayId}: ${sanitizeDisplay(finding.title)}`);
+  const unpublished = "publishedAt" in finding && finding.publishedAt === null;
+  const label = finding.displayId === null ? "Draft" : `PTF-${finding.displayId}${unpublished ? " (unpublished)" : ""}`;
+  lines.push(`# ${label}: ${sanitizeDisplay(finding.title)}`);
   lines.push("");
   lines.push(`- Severity: ${sanitizeDisplay(finding.severity)}`);
   lines.push(`- Status: ${sanitizeDisplay(finding.status)}`);
@@ -48102,6 +49489,18 @@ function failGetFinding(status, body) {
   );
   process.exit(1);
 }
+function readStaffFinding(organizationId, pentestId, pentestFindingId) {
+  return authenticatedRequest(
+    (client) => client.pentestFinding.getFinding({ params: { organizationId, pentestId, pentestFindingId } })
+  );
+}
+function readCustomerFinding(organizationId, pentestId, pentestFindingId) {
+  return authenticatedRequest(
+    (client) => client.pentestFinding.getCustomerFinding({
+      params: { organizationId, pentestId, pentestFindingId }
+    })
+  );
+}
 async function runGetFinding(options) {
   if (!isOutputFormat2(options.output)) {
     console.error(
@@ -48126,15 +49525,16 @@ async function runGetFinding(options) {
     process.exit(1);
   }
   const organizationId = await resolveOrganizationId();
-  const result = await authenticatedRequest(
-    (client) => client.pentestFinding.getCustomerFinding({
-      params: {
-        organizationId,
-        pentestId: options.pentest,
-        pentestFindingId: options.finding
-      }
-    })
-  );
+  const me = requireAuth().kind === "user" ? await authenticatedRequestSafe((client) => client.user.getMyContext()) : null;
+  const isStaff = me !== null && me.status === 200 && me.body.user.isStaff;
+  let result;
+  if (isStaff) {
+    const pentestId = await resolvePentestId(organizationId, options.pentest);
+    const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+    result = await readStaffFinding(organizationId, pentestId, pentestFindingId);
+  } else {
+    result = await readCustomerFinding(organizationId, options.pentest, options.finding);
+  }
   if (result.status !== 200) {
     failGetFinding(result.status, result.body);
   }
@@ -48163,6 +49563,185 @@ Examples:
   });
 }
 
+// src/pentest/publish-findings.ts
+var MAX_PUBLISH_BATCH = 200;
+function validatePublishSelection(options) {
+  const all = options.all === true;
+  const some = options.finding !== void 0 && options.finding.length > 0;
+  if (all === some) {
+    return { error: "Pass exactly one of --all or --finding <uuid> (repeatable)." };
+  }
+  return null;
+}
+function isPublishableDraft(finding) {
+  return finding.publishedAt === null && finding.status !== "DISMISSED";
+}
+function formatCandidate(finding) {
+  return `  [${sanitizeDisplay(finding.severity)}] ${sanitizeDisplay(finding.title)}`;
+}
+function draftsOutrankedBy(selected, all) {
+  const rank = (severity) => SEVERITY_ORDER[severity] ?? Number.MAX_SAFE_INTEGER;
+  const selectedIds = new Set(selected.map((f) => f.pentestFindingId));
+  const leastSevereSelected = Math.max(...selected.map((f) => rank(f.severity)));
+  return all.filter(
+    (f) => !selectedIds.has(f.pentestFindingId) && isPublishableDraft(f) && // A numbered row that was unpublished keeps its number on republish, so it
+    // cannot be pushed out of order by anything published before it.
+    f.displayId === null && rank(f.severity) <= leastSevereSelected
+  ).sort((a2, b) => rank(a2.severity) - rank(b.severity));
+}
+async function publishFindings(options) {
+  const selection = validatePublishSelection(options);
+  if (selection) {
+    console.error(colorError(selection.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestResult = await authenticatedRequest(
+    (client) => client.pentest.getPentest({ params: { organizationId, pentestId } })
+  );
+  if (pentestResult.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("read the pentest", pentestResult.status, pentestResult.body, {
+      notFound: `Pentest '${sanitizeDisplay(options.pentest)}' not found. Verify the ID with \`tracecli pentest list\`.`
+    });
+  }
+  const pentest = pentestResult.body;
+  const label = `PT-${pentest.displayId}`;
+  const listResult = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (listResult.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list the findings", listResult.status, listResult.body);
+  }
+  const findings = listResult.body;
+  const byId = new Map(findings.map((f) => [f.pentestFindingId, f]));
+  const drafts = findings.filter(isPublishableDraft);
+  let candidates;
+  if (options.all) {
+    candidates = drafts;
+  } else {
+    const draftById = new Map(drafts.map((f) => [f.pentestFindingId, f]));
+    candidates = (options.finding ?? []).map((id) => {
+      const found = draftById.get(id.toLowerCase());
+      if (!found) {
+        const known = byId.get(id.toLowerCase());
+        console.error(
+          colorError(
+            known ? `${sanitizeDisplay(id)} is ${known.publishedAt === null ? "dismissed" : "already published"} in ${label}, so it cannot be published.` : `${sanitizeDisplay(id)} is not an unpublished draft in ${label}. Drafts have no number yet; pass the UUID from \`tracecli pentest findings list --pentest ${label} --output json\`.`
+          )
+        );
+        process.exit(1);
+      }
+      return found;
+    });
+  }
+  if (candidates.length === 0) {
+    if (options.output === "json") {
+      printJson({ published: [] });
+    } else {
+      console.log(
+        `Nothing to publish in ${label}: every non-dismissed finding is already published.`
+      );
+    }
+    return;
+  }
+  if (candidates.length > MAX_PUBLISH_BATCH) {
+    console.error(
+      colorError(
+        `${candidates.length} findings exceed the ${MAX_PUBLISH_BATCH} a single publish accepts. Publish from the staff pentest console for a set this large.`
+      )
+    );
+    process.exit(1);
+  }
+  if (!options.all && options.outOfOrder !== true) {
+    const leftBehind = draftsOutrankedBy(candidates, findings);
+    if (leftBehind.length > 0) {
+      console.error(
+        colorError(
+          `Publishing these now would number them ahead of ${leftBehind.length} unpublished finding${leftBehind.length === 1 ? "" : "s"} of equal or higher severity, and PTF numbers follow severity only when the set is published together:`
+        )
+      );
+      for (const finding of leftBehind) {
+        console.error(formatCandidate(finding));
+      }
+      console.error(
+        colorError(
+          "Use --all to publish them together, or --out-of-order to accept this numbering."
+        )
+      );
+      process.exit(1);
+    }
+  }
+  const hidden = "hiddenFromCustomerAt" in pentest && pentest.hiddenFromCustomerAt != null;
+  if (options.output !== "json" || !options.yes) {
+    console.log(
+      `${candidates.length} finding${candidates.length === 1 ? "" : "s"} will be numbered and shown to the customer in ${label}:`
+    );
+    for (const finding of candidates) {
+      console.log(formatCandidate(finding));
+    }
+    if (hidden) {
+      console.log(
+        colorWarning(
+          `${label} is hidden from the customer, so nothing becomes visible until you run \`tracecli pentest visibility ${label} --visible\`.`
+        )
+      );
+    }
+  }
+  const confirmed = await confirmAction("Publish to the customer?", {
+    skip: options.yes === true,
+    verb: "publish"
+  });
+  if (!confirmed) {
+    console.log("Nothing published.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.publishAllFindings({
+      params: { organizationId, pentestId },
+      // Always the previewed ids, never the server's default set: a draft that lands
+      // between the preview and the answer must not ride along unseen.
+      body: { pentestFindingIds: candidates.map((f) => f.pentestFindingId) }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("publish findings", result.status, result.body, {
+      closed: "Closed pentests must be reopened before publishing findings."
+    });
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const published = result.body.published;
+  console.log(
+    colorSuccess(
+      `Published ${published.length} finding${published.length === 1 ? "" : "s"} in ${label}.`
+    )
+  );
+  for (const entry of published) {
+    const finding = byId.get(entry.pentestFindingId);
+    console.log(
+      `  PTF-${entry.displayId}  ${finding ? sanitizeDisplay(finding.title) : entry.pentestFindingId}`
+    );
+  }
+  if (hidden) {
+    console.log(
+      colorWarning(
+        `${label} is still hidden from the customer. Run \`tracecli pentest visibility ${label} --visible\` when you are ready.`
+      )
+    );
+  }
+}
+function createPublishFindingsCommand() {
+  return new Command("publish").description("Number unpublished findings and show them to the customer (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--all", "Publish every unpublished, non-dismissed finding").option("--finding <uuid>", "Draft finding UUID to publish (repeatable)", collectRepeatable).option("-y, --yes", "Skip the confirmation prompt").option(
+    "--out-of-order",
+    "With --finding: accept numbering ahead of equal-or-higher-severity drafts left unpublished"
+  ).option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await publishFindings(options);
+  });
+}
+
 // src/pentest/questionnaire.ts
 function buildUpsertQuestionnaireBody(answers) {
   if (answers === null) {
@@ -48274,6 +49853,56 @@ function surfaceSelectOptions() {
   }));
 }
 
+// src/pentest/visibility.ts
+function resolveVisibilityChoice(options) {
+  const hidden = options.hidden === true;
+  const visible = options.visible === true;
+  if (hidden === visible) {
+    return { error: "Pass exactly one of --hidden or --visible." };
+  }
+  return { visible };
+}
+async function setVisibility(pentestIdentifier, options) {
+  const choice = resolveVisibilityChoice(options);
+  if ("error" in choice) {
+    console.error(colorError(choice.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
+  const result = await authenticatedRequest(
+    (client) => client.staffPentests.setStaffOrganizationPentestCustomerVisibility({
+      params: { organizationId, pentestId },
+      body: { visible: choice.visible }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("change pentest visibility", result.status, result.body, {
+      notFound: `Pentest '${sanitizeDisplay(pentestIdentifier)}' not found. Verify the ID with \`tracecli pentest list\`.`
+    });
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const label = `PT-${result.body.displayId}`;
+  console.log(
+    colorSuccess(
+      result.body.hiddenFromCustomerAt === null ? `${label} is visible to the customer.` : `${label} is hidden from the customer.`
+    )
+  );
+  if (result.body.hiddenFromCustomerAt === null) {
+    console.log("  Published findings, reports, and attestations show in their dashboard again.");
+  } else {
+    console.log("  The customer no longer sees this pentest anywhere; staff views are unchanged.");
+  }
+}
+function createVisibilityCommand() {
+  return new Command("visibility").description("Hide a pentest from the customer or make it visible again (staff)").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--hidden", "Hide the pentest from the customer").option("--visible", "Make the pentest visible to the customer").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (pentestId, options) => {
+    await setVisibility(pentestId, options);
+  });
+}
+
 // src/pentest/commands.ts
 var DEFAULT_LIMIT2 = 30;
 var MAX_LIMIT2 = 100;
@@ -48431,7 +50060,7 @@ function createFindingsListCommand() {
     (value) => value.toUpperCase()
   ).option(
     "--status <status>",
-    "Filter by status (OPEN, IN_PROGRESS, CONTESTED, REMEDIATED, VERIFIED_FIXED, VERIFIED_OPEN, ACCEPTED_WITH_CONTROLS, DISMISSED)",
+    `Filter by status (${PentestFindingStatusValues.join(", ")})`,
     (value) => value.toUpperCase()
   ).option(
     "-L, --limit <n>",
@@ -48463,7 +50092,9 @@ Full detail, for feeding an agent that fixes the findings:
 
 Then mark work as it happens:
   tracecli pentest findings status-update --pentest PT-3 --finding 7 --status IN_PROGRESS
-  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED`
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status REMEDIATED
+  tracecli pentest findings status-update --pentest PT-3 --finding 7 --status ACCEPTED \\
+    --note "Internal-only endpoint behind SSO; residual risk accepted"`
   ).action(
     async (options) => {
       if (options.detail && options.output !== "json") {
@@ -48648,6 +50279,8 @@ function createFindingsCommand() {
   findings.addCommand(createStatusUpdateCommand());
   findings.addCommand(createAttachEvidenceCommand());
   findings.addCommand(createCreateFindingCommand(), { hidden: true });
+  findings.addCommand(createCopyFindingsCommand(), { hidden: true });
+  findings.addCommand(createPublishFindingsCommand(), { hidden: true });
   return findings;
 }
 var PRIORITY_SET = new Set(CustomerPriorityCategoryValues);
@@ -49131,6 +50764,8 @@ function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand6());
   pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createCreatePentestCommand(), { hidden: true });
+  pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
   pentest.addCommand(createReportCommand());
@@ -49138,8 +50773,251 @@ function createPentestCommand() {
   return pentest;
 }
 
+// src/test-integration/passkeys.ts
+import { readFileSync as readFileSync8, unlinkSync } from "fs";
+
+// src/test-integration/resolve.ts
+async function resolveTestIntegrationId(label) {
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrations()
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list test integrations", result.status, result.body);
+  }
+  const match = result.body.find((integration) => integration.label === label);
+  if (match === void 0) {
+    console.error(
+      colorError(
+        `No test integration named '${sanitizeDisplay(label)}'. Names are exact; the console's Test integrations page lists them.`
+      )
+    );
+    process.exit(1);
+  }
+  return match.testIntegrationId;
+}
+
+// src/test-integration/passkeys.ts
+function parseKeyFile(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: "The key file is not JSON." };
+  }
+  if (Array.isArray(parsed)) {
+    return {
+      error: "The key file holds an array. Import takes one passkey per file: write the one entry you mean to import as a single object."
+    };
+  }
+  const result = TestIntegrationPasskeyImportSchema.safeParse(parsed);
+  if (!result.success) {
+    const paths = result.error.issues.map((issue2) => issue2.path.map(String).join(".") || "(root)").filter((path, index, all) => all.indexOf(path) === index);
+    return {
+      error: `The key file is not a captured passkey. Problem fields: ${paths.join(", ")}.`
+    };
+  }
+  return { passkey: result.data };
+}
+function describePasskey(passkey) {
+  const user = passkey.userName ?? void 0;
+  return user === void 0 || user.length === 0 ? `the ${sanitizeDisplay(passkey.rpId)} passkey` : `the ${sanitizeDisplay(passkey.rpId)} passkey for ${sanitizeDisplay(user)}`;
+}
+function importSuccessLine(input) {
+  const head = `Imported ${describePasskey(input.passkey)} into ${sanitizeDisplay(input.label)} (id ${input.id}).`;
+  return input.deleted ? `${head} Deleted the key file ${input.path}.` : `${head} Kept ${input.path}. It holds the private key, so delete it once every environment you need has it, or pass --delete-file on the last import.`;
+}
+function deleteSuccessLine(input) {
+  return `Deleted ${describePasskey(input.passkey)} from ${sanitizeDisplay(input.label)}. The site still lists it on the account, so remove it there too, and do it now if the key may have leaked.`;
+}
+async function importPasskey(label, options) {
+  let raw;
+  try {
+    raw = readFileSync8(options.file, "utf8");
+  } catch {
+    console.error(colorError(`Cannot read the key file ${options.file}.`));
+    process.exit(1);
+  }
+  const parsed = parseKeyFile(raw);
+  if ("error" in parsed) {
+    console.error(colorError(parsed.error));
+    process.exit(1);
+  }
+  const { passkey } = parsed;
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  if (options.output !== "json") {
+    console.log(`Integration  ${sanitizeDisplay(label)}`);
+    console.log(`Site         ${sanitizeDisplay(passkey.rpId)}`);
+    console.log(
+      `User         ${passkey.userName ? sanitizeDisplay(passkey.userName) : colorMuted("(none in file)")}`
+    );
+    console.log(`Counter      ${passkey.signCount}`);
+  }
+  const confirmed = await confirmAction(`Import this passkey into ${sanitizeDisplay(label)}?`, {
+    skip: options.yes === true,
+    verb: "import"
+  });
+  if (!confirmed) {
+    console.log("Nothing imported.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.importTestIntegrationPasskey({
+      params: { testIntegrationId },
+      body: passkey
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    if (result.status === 409) {
+      const { message } = readErrorFields(result.body);
+      console.error(colorError(message ?? "This passkey is already stored on the integration."));
+      console.error(`The key file ${options.file} was kept.`);
+      process.exit(1);
+    }
+    failStaffPentestWrite("import a passkey", result.status, result.body, {
+      notFound: `No test integration named '${sanitizeDisplay(label)}'.`
+    });
+  }
+  let deleted = false;
+  if (options.deleteFile === true) {
+    unlinkSync(options.file);
+    deleted = true;
+  }
+  if (options.output === "json") {
+    printJson({ ...result.body, keyFile: deleted ? null : options.file });
+    return;
+  }
+  console.log(
+    colorSuccess(
+      importSuccessLine({
+        passkey,
+        label,
+        id: result.body.testIntegrationPasskeyId,
+        path: options.file,
+        deleted
+      })
+    )
+  );
+}
+async function listPasskeys(label, options) {
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrationPasskeys({ params: { testIntegrationId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list passkeys", result.status, result.body);
+  }
+  const rows = result.body;
+  if (options.output === "json") {
+    printJson(rows);
+    return;
+  }
+  if (options.output === "tsv") {
+    console.log("id	site	user	imported	lastUsed");
+    for (const row of rows) {
+      console.log(
+        [
+          row.testIntegrationPasskeyId,
+          row.rpId,
+          userColumn(row),
+          toIso(row.createdAt),
+          row.lastAssertedAt === null ? "" : toIso(row.lastAssertedAt)
+        ].join("	")
+      );
+    }
+    return;
+  }
+  if (rows.length === 0) {
+    console.log(`No passkeys stored for ${sanitizeDisplay(label)}.`);
+    return;
+  }
+  for (const row of rows) {
+    console.log(
+      `${row.testIntegrationPasskeyId}  ${sanitizeDisplay(row.rpId)}  ${userColumn(row)}  imported ${toIso(row.createdAt)}  last used ${row.lastAssertedAt === null ? "never" : toIso(row.lastAssertedAt)}`
+    );
+  }
+}
+function userColumn(row) {
+  if (row.unreadable) return "unreadable";
+  return row.userName === null ? "" : sanitizeDisplay(row.userName);
+}
+async function deletePasskey(label, passkeyId, options) {
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  const listed = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrationPasskeys({ params: { testIntegrationId } })
+  );
+  if (listed.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list passkeys", listed.status, listed.body);
+  }
+  const row = listed.body.find(
+    (r2) => r2.testIntegrationPasskeyId === passkeyId
+  );
+  if (row === void 0) {
+    console.error(
+      colorError(
+        `No passkey with id ${sanitizeDisplay(passkeyId)} is stored on ${sanitizeDisplay(label)}. Run \`tracecli test-integration passkeys list ${sanitizeDisplay(label)}\`.`
+      )
+    );
+    process.exit(1);
+  }
+  const confirmed = await confirmAction(
+    `Delete ${describePasskey(row)} from ${sanitizeDisplay(label)}?`,
+    { skip: options.yes === true, verb: "delete" }
+  );
+  if (!confirmed) {
+    console.log("Nothing deleted.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.deleteTestIntegrationPasskey({
+      params: { testIntegrationId, testIntegrationPasskeyId: passkeyId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failStaffPentestWrite("delete a passkey", result.status, result.body, {
+      notFound: `No passkey with id ${sanitizeDisplay(passkeyId)} is stored on ${sanitizeDisplay(label)}.`
+    });
+  }
+  if (options.output === "json") {
+    printJson({ deleted: passkeyId });
+    return;
+  }
+  console.log(colorSuccess(deleteSuccessLine({ passkey: row, label })));
+}
+function createPasskeysCommand() {
+  const passkeys = new Command("passkeys").description(
+    "Passkeys stored on a test integration (staff)"
+  );
+  passkeys.addCommand(
+    new Command("import").description("Store a passkey the capture script wrote (staff)").argument("<label>", "The test integration name, exactly as the console shows it").requiredOption("--file <path>", "The captured key file (one passkey)").option("--delete-file", "Delete the key file after a successful import").option("-y, --yes", "Skip the confirmation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (label, options) => {
+      await importPasskey(label, options);
+    })
+  );
+  passkeys.addCommand(
+    new Command("list").description("List a test integration's stored passkeys (staff)").argument("<label>", "The test integration name").option("-o, --output <format>", "Output format: text, json, tsv (default: text)", "text").action(async (label, options) => {
+      await listPasskeys(label, options);
+    })
+  );
+  passkeys.addCommand(
+    new Command("delete").description("Remove one stored passkey from a test integration (staff)").argument("<label>", "The test integration name").argument("<passkeyId>", "The passkey id from `passkeys list`").option("-y, --yes", "Skip the confirmation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(
+      async (label, passkeyId, options) => {
+        await deletePasskey(label, passkeyId, options);
+      }
+    )
+  );
+  return passkeys;
+}
+
+// src/test-integration/commands.ts
+function createTestIntegrationCommand() {
+  const group = new Command("test-integration").description(
+    "Trace-owned test integrations (staff)"
+  );
+  group.addCommand(createPasskeysCommand());
+  return group;
+}
+
 // src/update/commands.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -49157,7 +51035,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync8(cachePath, "utf-8");
+    const rawCache = readFileSync9(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -49948,13 +51826,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c62) => c62.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c62) => c62.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c62) => c62.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c62) => c62.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c65) => c65.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c65) => c65.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c65) => c65.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c62) => `${c62.name.padEnd(nameWidth)}  ${c62.kind.padEnd(kindWidth)}  ${c62.status.padEnd(statusWidth)}  ${c62.size.padEnd(sizeWidth)}  ${c62.id}`
+    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.kind.padEnd(kindWidth)}  ${c65.status.padEnd(statusWidth)}  ${c65.size.padEnd(sizeWidth)}  ${c65.id}`
   );
   return { header, rows };
 }
@@ -50312,7 +52190,7 @@ async function runList5(options) {
   const output = parseOutput(options.output);
   if (options.web) {
     const slug = await resolveOrganizationSlug();
-    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/sources`;
+    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/source-code/upload`;
     const opened = await openBrowser(url2);
     if (!opened) console.log(url2);
     return;
@@ -50988,6 +52866,7 @@ program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());
+program2.addCommand(createTestIntegrationCommand(), { hidden: true });
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());
 await program2.parseAsync();