securewithtrace 0.46.0 → 0.47.0

package/dist/index.js

@@ -24693,6 +24693,10 @@ var PentestFindingRepositorySchema = external_exports.object({
   startLine: external_exports.number().nullable(),
   endLine: external_exports.number().nullable()
 });
+var PentestFindingApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string()
+});
 var PentestFindingResponseSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
@@ -24756,6 +24760,10 @@ var PentestFindingListItemSchema = PentestFindingResponseSchema.omit({
   attackScenario: true,
   severityConsiderations: true,
   verification: true
+}).extend({
+  // Derived by `loadFindingApplications` for the list reads only; it backs the
+  // application filter. `.default([])` keeps an API that predates it parsing.
+  applications: external_exports.array(PentestFindingApplicationSchema).default([])
 });
 var ListPentestFindingsResponseSchema = external_exports.array(PentestFindingListItemSchema);
 var OperatorFindingEvidenceSchema = external_exports.object({
@@ -24804,7 +24812,8 @@ var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
   createdByName: true,
   reportProseAt: true,
   reportProseStatus: true,
-  externalTicket: true
+  externalTicket: true,
+  applications: true
 });
 var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit({
   repositoryId: true
@@ -25086,6 +25095,30 @@ var PublishedFindingSchema = external_exports.object({
 var PublishAllFindingsResponseSchema = external_exports.object({
   published: external_exports.array(PublishedFindingSchema)
 });
+var CopyPentestFindingsRequestSchema = external_exports.object({
+  sourcePentestId: external_exports.uuid(),
+  pentestFindingIds: external_exports.array(external_exports.uuid()).min(1).max(200).optional(),
+  applicationId: external_exports.uuid().optional(),
+  /** Report the selection without writing anything. */
+  dryRun: external_exports.boolean().optional()
+}).strict().refine((body) => body.pentestFindingIds === void 0 !== (body.applicationId === void 0), {
+  message: "Provide exactly one of pentestFindingIds or applicationId."
+});
+var CopiedPentestFindingSchema = external_exports.object({
+  sourcePentestFindingId: external_exports.uuid(),
+  sourceDisplayId: external_exports.int().nullable(),
+  /** The source's status; the copy itself is always OPEN. */
+  sourceStatus: PentestFindingStatus,
+  /** The new draft's id; null on a dry run. */
+  pentestFindingId: external_exports.uuid().nullable(),
+  title: external_exports.string(),
+  severity: PentestFindingSeverity,
+  evidenceCount: external_exports.int().nonnegative()
+});
+var CopyPentestFindingsResponseSchema = external_exports.object({
+  dryRun: external_exports.boolean(),
+  findings: external_exports.array(CopiedPentestFindingSchema)
+});
 var RecoverStrandedFindingsRequestSchema = external_exports.object({
   dryRun: external_exports.boolean().optional()
 });
@@ -26119,6 +26152,9 @@ var CredentialPasskeySummarySchema = external_exports.object({
   /** Moves only when the signature counter moved, the one observable sign of a use. */
   lastAssertedAt: external_exports.coerce.date().nullable()
 }).strict();
+var TestIntegrationPasskeySummarySchema = CredentialPasskeySummarySchema.omit({
+  credentialPasskeyId: true
+}).extend({ testIntegrationPasskeyId: external_exports.uuid() }).strict();
 var CredentialMfaKindValues = ["TOTP"];
 var CredentialMfaKind = external_exports.enum(CredentialMfaKindValues);
 var MFA_CAPABLE_CREDENTIAL_TYPES = ["USERNAME_PASSWORD", "MAGIC_AUTH"];
@@ -26528,24 +26564,40 @@ var RecordCandidateVulnResponseSchema = external_exports.object({
   inserted: external_exports.boolean()
 });
 var ProductContextStatement = external_exports.string().min(1).max(8e3);
+var ProductEvidenceKindSchema = external_exports.enum(["docs", "source", "live"]);
+var EvidenceRefSchema = external_exports.object({
+  ref: external_exports.string().min(1).max(512),
+  why: external_exports.string().min(1).max(300)
+});
+var ProductFamilyEvidence = {
+  evidence: ProductEvidenceKindSchema.optional(),
+  refs: external_exports.array(EvidenceRefSchema).max(10).optional()
+};
 var RecordProductContextRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
   payload: external_exports.object({
-    purpose: external_exports.object({ statement: ProductContextStatement }).optional(),
-    authModel: external_exports.object({ statement: ProductContextStatement }).optional(),
+    purpose: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
+    authModel: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
     techStack: external_exports.object({
       statement: ProductContextStatement,
       languages: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
       frameworks: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
-      services: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional()
+      services: external_exports.array(external_exports.string().min(1).max(80)).max(50).optional(),
+      ...ProductFamilyEvidence
     }).optional(),
     dataClassification: external_exports.object({
       statement: ProductContextStatement,
-      classes: external_exports.array(DataClassificationClass).min(1).max(40)
+      classes: external_exports.array(DataClassificationClass).min(1).max(40),
+      ...ProductFamilyEvidence
+    }).optional(),
+    businessImpact: external_exports.object({
+      statement: ProductContextStatement,
+      level: BusinessImpactLevel,
+      ...ProductFamilyEvidence
     }).optional(),
-    businessImpact: external_exports.object({ statement: ProductContextStatement, level: BusinessImpactLevel }).optional(),
-    deployment: external_exports.object({ statement: ProductContextStatement }).optional(),
-    architectureNotes: external_exports.array(external_exports.object({ statement: ProductContextStatement })).max(40).optional()
+    deployment: external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence }).optional(),
+    // The bare-array shape is kept for v1 payloads; each note carries its own evidence.
+    architectureNotes: external_exports.array(external_exports.object({ statement: ProductContextStatement, ...ProductFamilyEvidence })).max(40).optional()
   })
 });
 var RecordProductContextResponseSchema = external_exports.object({
@@ -27278,18 +27330,54 @@ var AgentSessionStoredPasskeySchema = AgentSessionPasskeySchema.extend({
   privateKey: external_exports.string().min(1).max(4096),
   userHandle: external_exports.string().max(128)
 });
-var AgentSessionListPasskeysResponseSchema = external_exports.object({
-  credentialId: external_exports.uuid(),
-  credentialLabel: external_exports.string().max(200),
-  /** The account types a browser logs in as; the same set that can carry a second factor. */
-  credentialType: external_exports.enum(MFA_CAPABLE_CREDENTIAL_TYPES),
-  passkeys: external_exports.array(AgentSessionStoredPasskeySchema),
-  /**
-   * Stored rows whose envelope could not be read. Reported rather than swallowed so a
-   * partial list is never presented to the agent as the whole store, and rather than
-   * failing the call so the readable passkeys still load.
-   */
-  unreadable: external_exports.number().int().min(0)
+var AgentSessionIntegrationPasskeySchema = AgentSessionPasskeySchema.extend({
+  testIntegrationPasskeyId: external_exports.uuid(),
+  privateKey: external_exports.string().min(1).max(4096),
+  userHandle: external_exports.string().max(128)
+});
+var AgentSessionListPasskeysResponseSchema = external_exports.discriminatedUnion("owner", [
+  external_exports.object({
+    owner: external_exports.literal("credential"),
+    credentialId: external_exports.uuid(),
+    credentialLabel: external_exports.string().max(200),
+    /** The account types a browser logs in as; the same set that can carry a second factor. */
+    credentialType: external_exports.enum(MFA_CAPABLE_CREDENTIAL_TYPES),
+    passkeys: external_exports.array(AgentSessionStoredPasskeySchema),
+    /**
+     * Stored rows whose envelope could not be read. Reported rather than swallowed so a
+     * partial list is never presented to the agent as the whole store, and rather than
+     * failing the call so the readable passkeys still load.
+     */
+    unreadable: external_exports.number().int().min(0)
+  }),
+  external_exports.object({
+    owner: external_exports.literal("testIntegration"),
+    testIntegrationId: external_exports.uuid(),
+    /** The integration's `label`, under the field name the host already keys on. */
+    credentialLabel: external_exports.string().max(200),
+    passkeys: external_exports.array(AgentSessionIntegrationPasskeySchema),
+    unreadable: external_exports.number().int().min(0)
+  })
+]);
+var AgentSessionTestIntegrationPasskeyUseSchema = AgentSessionPasskeySchema.pick({
+  rpId: true,
+  webauthnCredentialId: true,
+  signCount: true,
+  backupEligibility: true,
+  backupState: true
+}).strict();
+var AgentSessionRecordTestIntegrationPasskeyUseRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** From the list response, never agent-supplied. */
+  testIntegrationId: external_exports.uuid(),
+  passkey: AgentSessionTestIntegrationPasskeyUseSchema
+});
+var AgentSessionRecordTestIntegrationPasskeyUseResponseSchema = external_exports.object({
+  testIntegrationPasskeyId: external_exports.uuid(),
+  /** The stored counter after the call, never lower than before. */
+  signCount: external_exports.number().int().min(0),
+  /** False when the stored counter was already at or past the reported one. */
+  counterMoved: external_exports.boolean()
 });
 var AgentSessionUpsertPasskeyRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative(),
@@ -28304,6 +28392,27 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  // provision_passkey, integration write half: a stored test-integration passkey's
+  // counter moved on the armed authenticator. Counter-only by shape (no key field on
+  // the body); idempotent on (testIntegrationId, rpId, webauthnCredentialId).
+  recordTestIntegrationPasskeyUse: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/test-integration-passkeys/use",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: AgentSessionRecordTestIntegrationPasskeyUseRequestSchema,
+    responses: {
+      200: AgentSessionRecordTestIntegrationPasskeyUseResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Session type receives no account credentials, or may not fetch test integrations.
+      403: ErrorResponseSchema,
+      // No stored passkey with that natural key on that integration (staff deleted it).
+      404: ErrorResponseSchema,
+      // RUN_REVOKED.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // renew_cloud_credentials (GCP integration PR 7): agent-invoked re-mint of the
   // ~1 h AWS/GCP recon creds. Run-token authed; org+pentest from the session row;
   // 403 for a non-credentialed session type (ADHOC/CODE_REVIEW/REPORT).
@@ -33673,6 +33782,14 @@ var CreateOrganizationRequestSchema = external_exports.object({
   homepageUrl: external_exports.url("Homepage must be a full URL, like https://acme.com").max(2048).nullable().optional()
 });
 var LogoFetchOutcomeValues = ["skipped", "stored", "not_found", "failed"];
+var RenameOrganizationRequestSchema = external_exports.object({
+  name: external_exports.string().trim().min(2, "Organization name must be at least 2 characters").max(100, "Organization name must be 100 characters or fewer")
+}).strict();
+var RenameOrganizationResponseSchema = external_exports.object({
+  organizationId: external_exports.uuid(),
+  slug: external_exports.string(),
+  name: external_exports.string()
+});
 var CreateOrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
   slug: external_exports.string(),
@@ -33760,6 +33877,23 @@ var organizationContract = c27.router({
     },
     summary: "Create an organization (Trace staff only)"
   },
+  // Staff-only, cross-org: renames the tenant in Trace and WorkOS together.
+  // The slug stays as it was.
+  renameOrganizationAsStaff: {
+    method: "PATCH",
+    path: "/staff/organizations/:organizationId",
+    pathParams: OrgIdParamsSchema,
+    body: RenameOrganizationRequestSchema,
+    responses: {
+      200: RenameOrganizationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Rename an organization (Trace staff only)"
+  },
   // Staff-only, cross-org: removes the tenant from Trace and WorkOS together.
   // 409 when members, repositories, or retained audit history still reference
   // the organization; those must be removed first (or cannot be, for WORM rows).
@@ -35756,6 +35890,23 @@ var pentestFindingContract = c37.router({
       500: ErrorResponseSchema
     }
   },
+  // Staff-only. `:pentestId` is the target; the source is in the body.
+  copyFindings: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/copies",
+    pathParams: PentestFindingParamsSchema,
+    body: CopyPentestFindingsRequestSchema,
+    responses: {
+      200: CopyPentestFindingsResponseSchema,
+      201: CopyPentestFindingsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   recoverStrandedFindings: {
     method: "POST",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/recover-stranded",
@@ -37449,6 +37600,9 @@ var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_export
   /** false hides the engagement from the customer entirely; true shows it again. */
   visible: external_exports.boolean()
 }).strict();
+var RenameStaffOrganizationPentestRequestSchema = external_exports.object({
+  title: external_exports.string().trim().min(1, "Title is required").max(500, "Title must be 500 characters or fewer")
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
 var c47 = initContract();
@@ -37479,6 +37633,22 @@ var staffPentestsContract = c47.router({
     },
     summary: "Soft-delete a pentest from the admin console (Trace staff only)"
   },
+  renameStaffOrganizationPentest: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: RenameStaffOrganizationPentestRequestSchema,
+    responses: {
+      200: StaffOrganizationPentestSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Rename a pentest from the admin console (Trace staff only)"
+  },
   setStaffOrganizationPentestCustomerVisibility: {
     method: "POST",
     path: "/organizations/:organizationId/staff/pentests/:pentestId/customer-visibility",
@@ -37623,6 +37793,9 @@ var NOTES_MAX = 2e3;
 var TestIntegrationIdParamsSchema = external_exports.object({
   testIntegrationId: external_exports.uuid()
 });
+var TestIntegrationPasskeyIdParamsSchema = TestIntegrationIdParamsSchema.extend({
+  testIntegrationPasskeyId: external_exports.uuid()
+});
 var TestIntegrationResponseSchema = external_exports.object({
   testIntegrationId: external_exports.uuid(),
   label: external_exports.string(),
@@ -37635,9 +37808,15 @@ var TestIntegrationResponseSchema = external_exports.object({
    * none (or its stored parameters are unreadable). The setup key is never
    * returned by any route.
    */
-  mfa: CredentialMfaSummarySchema.nullable()
+  mfa: CredentialMfaSummarySchema.nullable(),
+  /** Passkeys staff stored for the integration's account. A count only: nothing here is decrypted. */
+  passkeyCount: external_exports.number().int().min(0)
 }).strict();
 var ListTestIntegrationsResponseSchema = external_exports.array(TestIntegrationResponseSchema);
+var TestIntegrationPasskeyImportSchema = AgentSessionPasskeySchema.required({
+  privateKey: true,
+  userHandle: true
+}).strict();
 var TestIntegrationLoginSchema = external_exports.object({
   username: external_exports.string().min(1).max(512),
   password: external_exports.string().min(1).max(1024)
@@ -37762,6 +37941,54 @@ var testIntegrationContract = c49.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  // -- Passkeys (org-less, verified staff) -----------------------------------
+  // Staff enroll a passkey on the integration's account with the capture script
+  // and import the captured file here. Agents never reach these routes; the agent
+  // read path is provision_passkey on the run-token channel. A stored key signs in
+  // as a Trace-owned account, so every route takes the MFA routes' verified-staff
+  // bar. Import is never an upsert: a duplicate is a mistake to surface.
+  importTestIntegrationPasskey: {
+    method: "POST",
+    path: "/staff/test-integrations/:testIntegrationId/passkeys",
+    pathParams: TestIntegrationIdParamsSchema,
+    body: TestIntegrationPasskeyImportSchema,
+    responses: {
+      201: TestIntegrationPasskeySummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      // TEST_INTEGRATION_PASSKEY_EXISTS
+      500: ErrorResponseSchema
+    }
+  },
+  listTestIntegrationPasskeys: {
+    method: "GET",
+    path: "/staff/test-integrations/:testIntegrationId/passkeys",
+    pathParams: TestIntegrationIdParamsSchema,
+    responses: {
+      200: external_exports.array(TestIntegrationPasskeySummarySchema),
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Not idempotent: the id names a specific row, and a second delete should say it
+  // is gone. The passkey on the site's side stays.
+  deleteTestIntegrationPasskey: {
+    method: "DELETE",
+    path: "/staff/test-integrations/:testIntegrationId/passkeys/:testIntegrationPasskeyId",
+    pathParams: TestIntegrationPasskeyIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
@@ -41908,22 +42135,30 @@ function toIso(value) {
   return Number.isNaN(date5.getTime()) ? String(value) : date5.toISOString();
 }
 async function confirmDeletion(description, skip) {
-  if (skip) {
+  return confirmAction(`Delete ${description}?`, { skip, verb: "delete" });
+}
+async function confirmAction(question, options) {
+  if (options.skip) {
     return true;
   }
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    console.error(colorError("Refusing to delete without --yes in a non-interactive shell."));
+    console.error(
+      colorError(`Refusing to ${options.verb} without --yes in a non-interactive shell.`)
+    );
     process.exit(1);
   }
   const readline = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await readline.question(`Delete ${description}? [y/N] `);
+    const answer = await readline.question(`${question} [y/N] `);
     const normalized = answer.trim().toLowerCase();
     return normalized === "y" || normalized === "yes";
   } finally {
     readline.close();
   }
 }
+function collectRepeatable(value, previous) {
+  return [...previous ?? [], value];
+}
 
 // src/application/commands.ts
 var APPLICATION_TYPE_BY_INPUT = {
@@ -47544,11 +47779,46 @@ var CLI_VERSION = packageMetadata.version;
 // src/pentest/commands.ts
 import { readFileSync as readFileSync7 } from "fs";
 
-// src/pentest/create-finding.ts
+// src/pentest/evidence.ts
 import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { basename as basename2 } from "path";
 
 // src/pentest/resolve.ts
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveApplicationId(organizationId, identifier) {
+  if (UUID_PATTERN2.test(identifier)) {
+    return identifier;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.listApplications({ params: { organizationId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list applications (status ${result.status}).`));
+    process.exit(1);
+  }
+  const wanted = identifier.trim().toLowerCase();
+  const matches = result.body.filter((app) => app.name.trim().toLowerCase() === wanted);
+  if (matches.length === 1 && matches[0]) {
+    return matches[0].applicationId;
+  }
+  if (matches.length > 1) {
+    console.error(
+      colorError(
+        `Application name '${sanitizeDisplay(identifier)}' is ambiguous. Pass the application ID instead (\`tracecli app list\`).`
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Application '${sanitizeDisplay(identifier)}' not found. Run \`tracecli app list\` to see available applications.`
+    )
+  );
+  process.exit(1);
+}
 async function resolvePentestId(organizationId, identifier) {
   if (UUID_PATTERN2.test(identifier)) {
     return identifier;
@@ -47585,61 +47855,360 @@ Run \`tracecli pentest list\` to see available pentests.`
   return pentest.pentestId;
 }
 
-// src/pentest/create-finding.ts
-var SEVERITY_LIST = PentestFindingSeverityValues.join(", ");
-function collectCwe(value, previous) {
-  return [...previous ?? [], value];
+// src/pentest/evidence.ts
+var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
+var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
+function isSection(value) {
+  return ValidationEvidenceSectionValues.includes(value);
 }
-function parseSeverity(raw) {
-  const parsed = PentestFindingSeverity.safeParse(raw.trim().toUpperCase());
-  if (parsed.success) {
-    return parsed.data;
-  }
-  return {
-    error: `Invalid --severity '${sanitizeDisplay(raw)}'. Use one of: ${SEVERITY_LIST}.`
-  };
+function isKind(value) {
+  return PentestExploitArtifactKindValues.includes(value);
 }
-function parseCvssScore(raw) {
-  const score = Number(raw);
-  if (!Number.isFinite(score) || score < 0 || score > 10) {
-    return {
-      error: `Invalid --cvss-score '${sanitizeDisplay(raw)}'. Expected a number between 0 and 10.`
-    };
-  }
-  return score;
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
-function parseCreateFindingJsonFile(raw, sourceLabel) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { error: `Invalid JSON in ${sourceLabel}.` };
+async function resolveFindingId(organizationId, pentestId, identifier) {
+  if (isUuid(identifier)) {
+    return identifier;
   }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return {
-      error: `${sourceLabel} must be a JSON object of finding fields (not an array or null).`
-    };
+  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
+  if (!numericMatch?.[1]) {
+    console.error(
+      colorError(
+        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
+      )
+    );
+    process.exit(1);
   }
-  return { data: parsed };
+  const displayId = Number.parseInt(numericMatch[1], 10);
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (result.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to list findings (status ${result.status}).`));
+    process.exit(1);
+  }
+  const match = result.body.find((f) => f.displayId === displayId);
+  if (!match || !("pentestFindingId" in match)) {
+    console.error(
+      colorError(
+        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
+      )
+    );
+    process.exit(1);
+  }
+  return match.pentestFindingId;
 }
-function readUtf8File(path, flag) {
+async function runAttachEvidence(options) {
+  if (options.section !== void 0 && !isSection(options.section)) {
+    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
+    console.error(`Valid sections: ${SECTION_LIST}`);
+    process.exit(1);
+  }
+  if (options.kind !== void 0 && !isKind(options.kind)) {
+    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
+    console.error(`Valid kinds: ${KIND_LIST}`);
+    process.exit(1);
+  }
+  let sizeBytes;
   try {
-    const stats = statSync2(path);
+    const stats = statSync2(options.file);
     if (!stats.isFile()) {
-      return { error: `${flag} '${sanitizeDisplay(path)}' is not a regular file.` };
+      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
+      process.exit(1);
     }
+    sizeBytes = stats.size;
   } catch {
-    return { error: `Cannot read ${flag} '${sanitizeDisplay(path)}'.` };
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
+    process.exit(1);
   }
-  const text = readFileSync5(path, "utf8");
-  if (text.trim().length === 0) {
-    return { error: `${flag} '${sanitizeDisplay(path)}' is empty.` };
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
+    process.exit(1);
   }
-  return { text };
-}
-function exclusivePair(value, fileValue, flag) {
-  if (value !== void 0 && fileValue !== void 0) {
-    return { error: `Pass only one of --${flag} / --${flag}-file.` };
+  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
+    console.error(
+      colorError(
+        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+  const params = { organizationId, pentestId, pentestFindingId };
+  const filename = basename2(options.file);
+  const slot = await authenticatedRequest(
+    (client) => client.pentestFinding.createFindingEvidenceUpload({
+      params,
+      body: { filename, sizeBytes }
+    })
+  );
+  if (slot.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (slot.status !== 201) {
+    const { message } = readErrorFields(slot.body);
+    console.error(
+      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
+    );
+    process.exit(1);
+  }
+  const body = readFileSync5(options.file);
+  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  const attached = await authenticatedRequest(
+    (client) => client.pentestFinding.attachFindingEvidence({
+      params,
+      body: {
+        key: slot.body.key,
+        ...options.caption !== void 0 ? { caption: options.caption } : {},
+        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
+        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
+        ...options.customerFacing ? { customerFacing: true } : {}
+      }
+    })
+  );
+  if (attached.status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (attached.status !== 201) {
+    const { message } = readErrorFields(attached.body);
+    console.error(
+      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
+    );
+    process.exit(1);
+  }
+  if (options.output === "json") {
+    printJson(attached.body);
+    return;
+  }
+  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
+  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
+  console.log(
+    colorSuccess(
+      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
+    )
+  );
+  console.log(`  artifact ${attached.body.artifactId}`);
+  if (attached.body.kind === "HAR") {
+    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
+  } else if (!attached.body.customerFacing) {
+    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
+  }
+}
+function createAttachEvidenceCommand() {
+  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+The file uploads straight to storage, so recordings of any reasonable size work.
+Videos and HAR captures always land staff-internal \u2014 publish a video with the
+toggle in the staff console's evidence panel after reviewing it for redaction.
+
+Examples:
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
+    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
+  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
+    --caption "Full member roster returned to a non-member" --customer-facing --output json`
+  ).action(async (options) => {
+    await runAttachEvidence(options);
+  });
+}
+
+// src/pentest/copy-findings.ts
+function validateSelection(options) {
+  const hasApplication = options.application !== void 0;
+  const hasFindings = options.finding !== void 0 && options.finding.length > 0;
+  if (hasApplication === hasFindings) {
+    return {
+      error: "Pass exactly one of --application <id|name> or --finding <id> (repeatable)."
+    };
+  }
+  return null;
+}
+function failCopy(status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only Trace staff can copy pentest findings. Sign in with a staff account via `tracecli auth login`."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "Pentest, application, or finding not found."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(
+        errorCode === "PENTEST_CLOSED" ? message ?? "Closed pentests must be reopened before copying findings into them." : message ?? "Conflict (status 409)."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to copy findings (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function formatCopiedFinding(finding) {
+  const source = finding.sourceDisplayId === null ? "draft" : `PTF-${finding.sourceDisplayId}`;
+  const status = sanitizeDisplay(finding.sourceStatus).toLowerCase().replace(/_/g, " ");
+  const evidence = `${finding.evidenceCount} exhibit${finding.evidenceCount === 1 ? "" : "s"}`;
+  const target = finding.pentestFindingId === null ? "" : ` -> ${finding.pentestFindingId}`;
+  return `  [${sanitizeDisplay(finding.severity)}] ${sanitizeDisplay(finding.title)}  (${source}, ${status}, ${evidence})${target}`;
+}
+async function copyFindings(options) {
+  const selection = validateSelection(options);
+  if (selection) {
+    console.error(colorError(selection.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const sourcePentestId = await resolvePentestId(organizationId, options.from);
+  const targetPentestId = await resolvePentestId(organizationId, options.to);
+  const dryRun = options.dryRun ?? false;
+  const body = options.application !== void 0 ? {
+    sourcePentestId,
+    applicationId: await resolveApplicationId(organizationId, options.application),
+    dryRun
+  } : {
+    sourcePentestId,
+    pentestFindingIds: await Promise.all(
+      (options.finding ?? []).map(
+        (id) => resolveFindingId(organizationId, sourcePentestId, id)
+      )
+    ),
+    dryRun
+  };
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.copyFindings({
+      params: { organizationId, pentestId: targetPentestId },
+      body
+    })
+  );
+  if (result.status !== CREATED_STATUS && result.status !== SUCCESS_STATUS) {
+    failCopy(result.status, result.body);
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const { findings } = result.body;
+  if (findings.length === 0) {
+    console.log("No findings matched the selection. Nothing copied.");
+    return;
+  }
+  const exhibits = findings.reduce((n3, f) => n3 + f.evidenceCount, 0);
+  const summary = `${findings.length} finding${findings.length === 1 ? "" : "s"} with ${exhibits} exhibit${exhibits === 1 ? "" : "s"}`;
+  console.log(
+    result.body.dryRun ? `Dry run: ${summary} would be copied from ${sanitizeDisplay(options.from)} to ${sanitizeDisplay(options.to)}.` : colorSuccess(
+      `Copied ${summary} from ${sanitizeDisplay(options.from)} to ${sanitizeDisplay(options.to)}.`
+    )
+  );
+  for (const finding of findings) {
+    console.log(formatCopiedFinding(finding));
+  }
+  if (!result.body.dryRun) {
+    console.log(
+      `The copies are unpublished drafts. Run \`tracecli pentest findings publish --pentest ${sanitizeDisplay(options.to)} --all\` to number them and show them to the customer.`
+    );
+  }
+}
+function createCopyFindingsCommand() {
+  return new Command("copy").description(
+    "Copy findings (with prose and evidence) from one pentest into another as unpublished drafts (staff)"
+  ).requiredOption("--from <id>", "Source pentest display ID (e.g. PT-1) or UUID").requiredOption("--to <id>", "Target pentest display ID (e.g. PT-2) or UUID").option(
+    "--application <id|name>",
+    "Copy every source finding that cites a repository linked to this application"
+  ).option(
+    "--finding <id>",
+    "Source finding number (e.g. PTF-7) or UUID (repeatable)",
+    collectRepeatable
+  ).option("--dry-run", "Show what would be copied without writing anything").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await copyFindings(options);
+  });
+}
+
+// src/pentest/create-finding.ts
+import { readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+var SEVERITY_LIST = PentestFindingSeverityValues.join(", ");
+function collectCwe(value, previous) {
+  return [...previous ?? [], value];
+}
+function parseSeverity(raw) {
+  const parsed = PentestFindingSeverity.safeParse(raw.trim().toUpperCase());
+  if (parsed.success) {
+    return parsed.data;
+  }
+  return {
+    error: `Invalid --severity '${sanitizeDisplay(raw)}'. Use one of: ${SEVERITY_LIST}.`
+  };
+}
+function parseCvssScore(raw) {
+  const score = Number(raw);
+  if (!Number.isFinite(score) || score < 0 || score > 10) {
+    return {
+      error: `Invalid --cvss-score '${sanitizeDisplay(raw)}'. Expected a number between 0 and 10.`
+    };
+  }
+  return score;
+}
+function parseCreateFindingJsonFile(raw, sourceLabel) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: `Invalid JSON in ${sourceLabel}.` };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {
+      error: `${sourceLabel} must be a JSON object of finding fields (not an array or null).`
+    };
+  }
+  return { data: parsed };
+}
+function readUtf8File(path, flag) {
+  try {
+    const stats = statSync3(path);
+    if (!stats.isFile()) {
+      return { error: `${flag} '${sanitizeDisplay(path)}' is not a regular file.` };
+    }
+  } catch {
+    return { error: `Cannot read ${flag} '${sanitizeDisplay(path)}'.` };
+  }
+  const text = readFileSync6(path, "utf8");
+  if (text.trim().length === 0) {
+    return { error: `${flag} '${sanitizeDisplay(path)}' is empty.` };
+  }
+  return { text };
+}
+function exclusivePair(value, fileValue, flag) {
+  if (value !== void 0 && fileValue !== void 0) {
+    return { error: `Pass only one of --${flag} / --${flag}-file.` };
   }
   return { value: fileValue ?? value };
 }
@@ -47859,15 +48428,139 @@ function createCreateFindingCommand() {
   });
 }
 
+// src/pentest/staff-errors.ts
+function failStaffPentestWrite(action, status, body, options = {}) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    const staffGuard = message === void 0 || /only trace staff/i.test(message);
+    console.error(
+      colorError(
+        staffGuard ? `Only Trace staff can ${action}. Sign in with a staff account via \`tracecli auth login\`.` : `Cannot ${action}: ${message}`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(options.notFound ?? message ?? "Not found."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(
+        errorCode === "PENTEST_CLOSED" ? options.closed ?? message ?? "Closed pentests must be reopened first." : message ?? "Conflict (status 409)."
+      )
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+
+// src/pentest/create-pentest.ts
+var TEST_TYPE_LIST = PentestTestTypeValues.join(", ");
+function parseTestType(raw) {
+  const parsed = PentestTestType.safeParse(raw.trim().toUpperCase().replace(/-/g, "_"));
+  if (parsed.success) {
+    return parsed.data;
+  }
+  return { error: `Invalid --test-type '${sanitizeDisplay(raw)}'. Use one of: ${TEST_TYPE_LIST}.` };
+}
+async function createPentest(options) {
+  const title = options.title.trim();
+  if (title.length === 0) {
+    console.error(colorError("--title cannot be empty."));
+    process.exit(1);
+  }
+  let testType;
+  if (options.testType !== void 0) {
+    const parsed = parseTestType(options.testType);
+    if (typeof parsed !== "string") {
+      console.error(colorError(parsed.error));
+      process.exit(1);
+    }
+    testType = parsed;
+  }
+  const organizationId = await resolveOrganizationId();
+  const primaryApplicationId = options.application === void 0 ? void 0 : await resolveApplicationId(organizationId, options.application);
+  const created = await authenticatedRequest(
+    (client) => client.pentest.createPentest({
+      params: { organizationId },
+      body: {
+        title,
+        ...options.description !== void 0 ? { description: options.description } : {},
+        ...primaryApplicationId !== void 0 ? { primaryApplicationId } : {},
+        ...testType !== void 0 ? { testType } : {}
+      }
+    })
+  );
+  if (created.status !== CREATED_STATUS) {
+    failStaffPentestWrite("create pentests", created.status, created.body);
+  }
+  const pentest = created.body;
+  let hiddenFromCustomerAt = null;
+  if (options.hidden) {
+    const remedy = `Created pentest PT-${pentest.displayId} (${pentest.pentestId}) but could not hide it, so the customer can see it. Run \`tracecli pentest visibility PT-${pentest.displayId} --hidden\`.`;
+    let hidden;
+    try {
+      hidden = await hidePentest(organizationId, pentest.pentestId);
+    } catch (error48) {
+      console.error(
+        colorError(`${remedy} (${error48 instanceof Error ? error48.message : String(error48)})`)
+      );
+      process.exit(1);
+    }
+    if (hidden.status !== SUCCESS_STATUS) {
+      console.error(colorError(`${remedy} (status ${hidden.status})`));
+      process.exit(1);
+    }
+    hiddenFromCustomerAt = hidden.body.hiddenFromCustomerAt;
+  }
+  if (options.output === "json") {
+    printJson({ ...pentest, hiddenFromCustomerAt });
+    return;
+  }
+  console.log(colorSuccess(`Created pentest PT-${pentest.displayId} (${pentest.pentestId})`));
+  console.log(`  ${sanitizeDisplay(pentest.title)}`);
+  const applications = (pentest.applications ?? []).map((app) => sanitizeDisplay(app.name));
+  if (applications.length > 0) {
+    console.log(`  Application: ${applications.join(", ")}`);
+  }
+  console.log(
+    hiddenFromCustomerAt === null ? "  Visible to the customer. Findings stay unpublished until you publish them." : `  Hidden from the customer until you run \`tracecli pentest visibility PT-${pentest.displayId} --visible\`.`
+  );
+}
+function hidePentest(organizationId, pentestId) {
+  return authenticatedRequest(
+    (client) => client.staffPentests.setStaffOrganizationPentestCustomerVisibility({
+      params: { organizationId, pentestId },
+      body: { visible: false }
+    })
+  );
+}
+function createCreatePentestCommand() {
+  return new Command("create").description("Create a pentest (staff)").requiredOption("--title <text>", "Engagement title").option("--application <id|name>", "Application under test (bound as the primary application)").option("--test-type <type>", `Declared test type (${TEST_TYPE_LIST}); default WHITE_BOX`).option("--description <text>", "Engagement description").option("--hidden", "Hide the pentest from the customer until you make it visible").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await createPentest(options);
+  });
+}
+
 // src/pentest/deliverables.ts
 import { open as open2, rename, rm, stat } from "fs/promises";
-import { basename as basename3, join as join6, resolve } from "path";
+import { basename as basename4, join as join6, resolve } from "path";
 
 // src/upload/prepare.ts
 import { createHash } from "crypto";
-import { createReadStream, statSync as statSync3 } from "fs";
+import { createReadStream, statSync as statSync4 } from "fs";
 import { open } from "fs/promises";
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 var CodeUploadPrepareError = class extends Error {
   constructor(message) {
     super(message);
@@ -47966,7 +48659,7 @@ function assertPreparedMatchesUpload(upload, prepared) {
 async function prepareUploadFile(filePath, options = {}) {
   let sizeBytes;
   try {
-    const stats = statSync3(filePath);
+    const stats = statSync4(filePath);
     if (!stats.isFile()) {
       throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
     }
@@ -47981,7 +48674,7 @@ async function prepareUploadFile(filePath, options = {}) {
   if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
     throw new CodeUploadPrepareError(archiveTooLargeMessage());
   }
-  const originalFilename = basename2(filePath);
+  const originalFilename = basename3(filePath);
   const inferred = inferArtifactKindFromFilename(originalFilename);
   const artifactKind = options.artifactKind ?? inferred;
   if (artifactKind == null) {
@@ -48228,7 +48921,7 @@ var PentestDeliverableDownloadError = class extends Error {
   }
 };
 function safeDeliverableFilename(documentId, extension, fallbackStem) {
-  const stripped = Array.from(basename3(documentId.replace(/\\/g, "/")), (char) => {
+  const stripped = Array.from(basename4(documentId.replace(/\\/g, "/")), (char) => {
     const code = char.codePointAt(0) ?? 0;
     return code <= 31 || code === 127 ? "_" : char;
   }).join("").trim();
@@ -48704,191 +49397,15 @@ Examples:
   tracecli pentest attestation download PT-3 --attestation 6f1c... --out ./loa.pdf --force
   tracecli pentest attestation download PT-3 --output json | jq '.path'`
   ).action(async (pentestId, options) => {
-    await runAttestationDownload(pentestId, options);
-  });
-}
-function createAttestationCommand() {
-  const attestation = new Command("attestation").alias("loa").description("List and download letters of attestation");
-  attestation.addCommand(createAttestationListCommand());
-  attestation.addCommand(createAttestationDownloadCommand());
-  return attestation;
-}
-
-// src/pentest/evidence.ts
-import { readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename4 } from "path";
-var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
-var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
-function isSection(value) {
-  return ValidationEvidenceSectionValues.includes(value);
-}
-function isKind(value) {
-  return PentestExploitArtifactKindValues.includes(value);
-}
-function formatBytes2(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-}
-async function resolveFindingId(organizationId, pentestId, identifier) {
-  if (isUuid(identifier)) {
-    return identifier;
-  }
-  const numericMatch = identifier.match(/^(?:PTF-)?(\d+)$/i);
-  if (!numericMatch?.[1]) {
-    console.error(
-      colorError(
-        `Invalid finding identifier '${sanitizeDisplay(identifier)}'. Use a finding number (e.g. PTF-7) or UUID.`
-      )
-    );
-    process.exit(1);
-  }
-  const displayId = Number.parseInt(numericMatch[1], 10);
-  const result = await authenticatedRequest(
-    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
-  );
-  if (result.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (result.status !== 200) {
-    console.error(colorError(`Failed to list findings (status ${result.status}).`));
-    process.exit(1);
-  }
-  const match = result.body.find((f) => f.displayId === displayId);
-  if (!match || !("pentestFindingId" in match)) {
-    console.error(
-      colorError(
-        `No finding PTF-${displayId} in this pentest. Unpublished findings have no number yet \u2014 pass the finding UUID instead (\`tracecli pentest findings list --pentest <id> --output json\`).`
-      )
-    );
-    process.exit(1);
-  }
-  return match.pentestFindingId;
-}
-async function runAttachEvidence(options) {
-  if (options.section !== void 0 && !isSection(options.section)) {
-    console.error(colorError(`Invalid --section '${sanitizeDisplay(options.section)}'.`));
-    console.error(`Valid sections: ${SECTION_LIST}`);
-    process.exit(1);
-  }
-  if (options.kind !== void 0 && !isKind(options.kind)) {
-    console.error(colorError(`Invalid --kind '${sanitizeDisplay(options.kind)}'.`));
-    console.error(`Valid kinds: ${KIND_LIST}`);
-    process.exit(1);
-  }
-  let sizeBytes;
-  try {
-    const stats = statSync4(options.file);
-    if (!stats.isFile()) {
-      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
-      process.exit(1);
-    }
-    sizeBytes = stats.size;
-  } catch {
-    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
-    process.exit(1);
-  }
-  if (sizeBytes === 0) {
-    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
-    process.exit(1);
-  }
-  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
-    console.error(
-      colorError(
-        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
-      )
-    );
-    process.exit(1);
-  }
-  const organizationId = await resolveOrganizationId();
-  const pentestId = await resolvePentestId(organizationId, options.pentest);
-  const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
-  const params = { organizationId, pentestId, pentestFindingId };
-  const filename = basename4(options.file);
-  const slot = await authenticatedRequest(
-    (client) => client.pentestFinding.createFindingEvidenceUpload({
-      params,
-      body: { filename, sizeBytes }
-    })
-  );
-  if (slot.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (slot.status !== 201) {
-    const { message } = readErrorFields(slot.body);
-    console.error(
-      colorError(message ?? `Failed to start the evidence upload (status ${slot.status}).`)
-    );
-    process.exit(1);
-  }
-  const body = readFileSync6(options.file);
-  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
-  if (!put.ok) {
-    console.error(
-      colorError(
-        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
-      )
-    );
-    process.exit(1);
-  }
-  const attached = await authenticatedRequest(
-    (client) => client.pentestFinding.attachFindingEvidence({
-      params,
-      body: {
-        key: slot.body.key,
-        ...options.caption !== void 0 ? { caption: options.caption } : {},
-        ...options.section !== void 0 && isSection(options.section) ? { section: options.section } : {},
-        ...options.kind !== void 0 && isKind(options.kind) ? { kind: options.kind } : {},
-        ...options.customerFacing ? { customerFacing: true } : {}
-      }
-    })
-  );
-  if (attached.status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (attached.status !== 201) {
-    const { message } = readErrorFields(attached.body);
-    console.error(
-      colorError(message ?? `Failed to attach the evidence (status ${attached.status}).`)
-    );
-    process.exit(1);
-  }
-  if (options.output === "json") {
-    printJson(attached.body);
-    return;
-  }
-  const visibility = attached.body.customerFacing ? "customer-facing" : "staff-internal";
-  const placement = attached.body.section ? ` \xB7 ${attached.body.section}` : "";
-  console.log(
-    colorSuccess(
-      `Attached ${attached.body.kind} \xB7 ${formatBytes2(attached.body.sizeBytes)} \xB7 ${visibility}${placement}`
-    )
-  );
-  console.log(`  artifact ${attached.body.artifactId}`);
-  if (attached.body.kind === "HAR") {
-    console.log("  HAR captures stay internal \u2014 they can carry a live session token.");
-  } else if (!attached.body.customerFacing) {
-    console.log("  Publish it from the finding\u2019s evidence panel in the staff console.");
-  }
-}
-function createAttachEvidenceCommand() {
-  return new Command("attach-evidence").description("Attach a screenshot, recording, or capture to a pentest finding (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--finding <id>", "Finding number (e.g. PTF-7) or UUID").requiredOption("--file <path>", "Path to the evidence file").option("--caption <text>", "What the exhibit shows; rendered as its label").option("--section <section>", `Report section it backs (${SECTION_LIST})`).option("--kind <kind>", `Override the derived exhibit kind (${KIND_LIST})`).option("--customer-facing", "Publish to the customer (not allowed for HAR or video)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
-    "after",
-    `
-The file uploads straight to storage, so recordings of any reasonable size work.
-Videos and HAR captures always land staff-internal \u2014 publish a video with the
-toggle in the staff console's evidence panel after reviewing it for redaction.
-
-Examples:
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./poc.png
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding PTF-7 --file ./poc.mov \\
-    --caption "Cookie survives logout, replayed 40s later" --section proofOfConcept
-  tracecli pentest findings attach-evidence --pentest PT-3 --finding 7 --file ./roster.json \\
-    --caption "Full member roster returned to a non-member" --customer-facing --output json`
-  ).action(async (options) => {
-    await runAttachEvidence(options);
+    await runAttestationDownload(pentestId, options);
   });
 }
+function createAttestationCommand() {
+  const attestation = new Command("attestation").alias("loa").description("List and download letters of attestation");
+  attestation.addCommand(createAttestationListCommand());
+  attestation.addCommand(createAttestationDownloadCommand());
+  return attestation;
+}
 
 // src/pentest/get-finding.ts
 var OUTPUT_FORMATS2 = ["text", "json"];
@@ -48911,7 +49428,9 @@ function sanitizeMarkdown(value) {
 }
 function formatFindingMarkdown(finding) {
   const lines = [];
-  lines.push(`# PTF-${finding.displayId}: ${sanitizeDisplay(finding.title)}`);
+  const unpublished = "publishedAt" in finding && finding.publishedAt === null;
+  const label = finding.displayId === null ? "Draft" : `PTF-${finding.displayId}${unpublished ? " (unpublished)" : ""}`;
+  lines.push(`# ${label}: ${sanitizeDisplay(finding.title)}`);
   lines.push("");
   lines.push(`- Severity: ${sanitizeDisplay(finding.severity)}`);
   lines.push(`- Status: ${sanitizeDisplay(finding.status)}`);
@@ -48970,6 +49489,18 @@ function failGetFinding(status, body) {
   );
   process.exit(1);
 }
+function readStaffFinding(organizationId, pentestId, pentestFindingId) {
+  return authenticatedRequest(
+    (client) => client.pentestFinding.getFinding({ params: { organizationId, pentestId, pentestFindingId } })
+  );
+}
+function readCustomerFinding(organizationId, pentestId, pentestFindingId) {
+  return authenticatedRequest(
+    (client) => client.pentestFinding.getCustomerFinding({
+      params: { organizationId, pentestId, pentestFindingId }
+    })
+  );
+}
 async function runGetFinding(options) {
   if (!isOutputFormat2(options.output)) {
     console.error(
@@ -48994,15 +49525,16 @@ async function runGetFinding(options) {
     process.exit(1);
   }
   const organizationId = await resolveOrganizationId();
-  const result = await authenticatedRequest(
-    (client) => client.pentestFinding.getCustomerFinding({
-      params: {
-        organizationId,
-        pentestId: options.pentest,
-        pentestFindingId: options.finding
-      }
-    })
-  );
+  const me = requireAuth().kind === "user" ? await authenticatedRequestSafe((client) => client.user.getMyContext()) : null;
+  const isStaff = me !== null && me.status === 200 && me.body.user.isStaff;
+  let result;
+  if (isStaff) {
+    const pentestId = await resolvePentestId(organizationId, options.pentest);
+    const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
+    result = await readStaffFinding(organizationId, pentestId, pentestFindingId);
+  } else {
+    result = await readCustomerFinding(organizationId, options.pentest, options.finding);
+  }
   if (result.status !== 200) {
     failGetFinding(result.status, result.body);
   }
@@ -49031,6 +49563,185 @@ Examples:
   });
 }
 
+// src/pentest/publish-findings.ts
+var MAX_PUBLISH_BATCH = 200;
+function validatePublishSelection(options) {
+  const all = options.all === true;
+  const some = options.finding !== void 0 && options.finding.length > 0;
+  if (all === some) {
+    return { error: "Pass exactly one of --all or --finding <uuid> (repeatable)." };
+  }
+  return null;
+}
+function isPublishableDraft(finding) {
+  return finding.publishedAt === null && finding.status !== "DISMISSED";
+}
+function formatCandidate(finding) {
+  return `  [${sanitizeDisplay(finding.severity)}] ${sanitizeDisplay(finding.title)}`;
+}
+function draftsOutrankedBy(selected, all) {
+  const rank = (severity) => SEVERITY_ORDER[severity] ?? Number.MAX_SAFE_INTEGER;
+  const selectedIds = new Set(selected.map((f) => f.pentestFindingId));
+  const leastSevereSelected = Math.max(...selected.map((f) => rank(f.severity)));
+  return all.filter(
+    (f) => !selectedIds.has(f.pentestFindingId) && isPublishableDraft(f) && // A numbered row that was unpublished keeps its number on republish, so it
+    // cannot be pushed out of order by anything published before it.
+    f.displayId === null && rank(f.severity) <= leastSevereSelected
+  ).sort((a2, b) => rank(a2.severity) - rank(b.severity));
+}
+async function publishFindings(options) {
+  const selection = validatePublishSelection(options);
+  if (selection) {
+    console.error(colorError(selection.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const pentestResult = await authenticatedRequest(
+    (client) => client.pentest.getPentest({ params: { organizationId, pentestId } })
+  );
+  if (pentestResult.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("read the pentest", pentestResult.status, pentestResult.body, {
+      notFound: `Pentest '${sanitizeDisplay(options.pentest)}' not found. Verify the ID with \`tracecli pentest list\`.`
+    });
+  }
+  const pentest = pentestResult.body;
+  const label = `PT-${pentest.displayId}`;
+  const listResult = await authenticatedRequest(
+    (client) => client.pentestFinding.listFindings({ params: { organizationId, pentestId } })
+  );
+  if (listResult.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list the findings", listResult.status, listResult.body);
+  }
+  const findings = listResult.body;
+  const byId = new Map(findings.map((f) => [f.pentestFindingId, f]));
+  const drafts = findings.filter(isPublishableDraft);
+  let candidates;
+  if (options.all) {
+    candidates = drafts;
+  } else {
+    const draftById = new Map(drafts.map((f) => [f.pentestFindingId, f]));
+    candidates = (options.finding ?? []).map((id) => {
+      const found = draftById.get(id.toLowerCase());
+      if (!found) {
+        const known = byId.get(id.toLowerCase());
+        console.error(
+          colorError(
+            known ? `${sanitizeDisplay(id)} is ${known.publishedAt === null ? "dismissed" : "already published"} in ${label}, so it cannot be published.` : `${sanitizeDisplay(id)} is not an unpublished draft in ${label}. Drafts have no number yet; pass the UUID from \`tracecli pentest findings list --pentest ${label} --output json\`.`
+          )
+        );
+        process.exit(1);
+      }
+      return found;
+    });
+  }
+  if (candidates.length === 0) {
+    if (options.output === "json") {
+      printJson({ published: [] });
+    } else {
+      console.log(
+        `Nothing to publish in ${label}: every non-dismissed finding is already published.`
+      );
+    }
+    return;
+  }
+  if (candidates.length > MAX_PUBLISH_BATCH) {
+    console.error(
+      colorError(
+        `${candidates.length} findings exceed the ${MAX_PUBLISH_BATCH} a single publish accepts. Publish from the staff pentest console for a set this large.`
+      )
+    );
+    process.exit(1);
+  }
+  if (!options.all && options.outOfOrder !== true) {
+    const leftBehind = draftsOutrankedBy(candidates, findings);
+    if (leftBehind.length > 0) {
+      console.error(
+        colorError(
+          `Publishing these now would number them ahead of ${leftBehind.length} unpublished finding${leftBehind.length === 1 ? "" : "s"} of equal or higher severity, and PTF numbers follow severity only when the set is published together:`
+        )
+      );
+      for (const finding of leftBehind) {
+        console.error(formatCandidate(finding));
+      }
+      console.error(
+        colorError(
+          "Use --all to publish them together, or --out-of-order to accept this numbering."
+        )
+      );
+      process.exit(1);
+    }
+  }
+  const hidden = "hiddenFromCustomerAt" in pentest && pentest.hiddenFromCustomerAt != null;
+  if (options.output !== "json" || !options.yes) {
+    console.log(
+      `${candidates.length} finding${candidates.length === 1 ? "" : "s"} will be numbered and shown to the customer in ${label}:`
+    );
+    for (const finding of candidates) {
+      console.log(formatCandidate(finding));
+    }
+    if (hidden) {
+      console.log(
+        colorWarning(
+          `${label} is hidden from the customer, so nothing becomes visible until you run \`tracecli pentest visibility ${label} --visible\`.`
+        )
+      );
+    }
+  }
+  const confirmed = await confirmAction("Publish to the customer?", {
+    skip: options.yes === true,
+    verb: "publish"
+  });
+  if (!confirmed) {
+    console.log("Nothing published.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.pentestFinding.publishAllFindings({
+      params: { organizationId, pentestId },
+      // Always the previewed ids, never the server's default set: a draft that lands
+      // between the preview and the answer must not ride along unseen.
+      body: { pentestFindingIds: candidates.map((f) => f.pentestFindingId) }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("publish findings", result.status, result.body, {
+      closed: "Closed pentests must be reopened before publishing findings."
+    });
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const published = result.body.published;
+  console.log(
+    colorSuccess(
+      `Published ${published.length} finding${published.length === 1 ? "" : "s"} in ${label}.`
+    )
+  );
+  for (const entry of published) {
+    const finding = byId.get(entry.pentestFindingId);
+    console.log(
+      `  PTF-${entry.displayId}  ${finding ? sanitizeDisplay(finding.title) : entry.pentestFindingId}`
+    );
+  }
+  if (hidden) {
+    console.log(
+      colorWarning(
+        `${label} is still hidden from the customer. Run \`tracecli pentest visibility ${label} --visible\` when you are ready.`
+      )
+    );
+  }
+}
+function createPublishFindingsCommand() {
+  return new Command("publish").description("Number unpublished findings and show them to the customer (staff)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--all", "Publish every unpublished, non-dismissed finding").option("--finding <uuid>", "Draft finding UUID to publish (repeatable)", collectRepeatable).option("-y, --yes", "Skip the confirmation prompt").option(
+    "--out-of-order",
+    "With --finding: accept numbering ahead of equal-or-higher-severity drafts left unpublished"
+  ).option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (options) => {
+    await publishFindings(options);
+  });
+}
+
 // src/pentest/questionnaire.ts
 function buildUpsertQuestionnaireBody(answers) {
   if (answers === null) {
@@ -49142,6 +49853,56 @@ function surfaceSelectOptions() {
   }));
 }
 
+// src/pentest/visibility.ts
+function resolveVisibilityChoice(options) {
+  const hidden = options.hidden === true;
+  const visible = options.visible === true;
+  if (hidden === visible) {
+    return { error: "Pass exactly one of --hidden or --visible." };
+  }
+  return { visible };
+}
+async function setVisibility(pentestIdentifier, options) {
+  const choice = resolveVisibilityChoice(options);
+  if ("error" in choice) {
+    console.error(colorError(choice.error));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
+  const result = await authenticatedRequest(
+    (client) => client.staffPentests.setStaffOrganizationPentestCustomerVisibility({
+      params: { organizationId, pentestId },
+      body: { visible: choice.visible }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("change pentest visibility", result.status, result.body, {
+      notFound: `Pentest '${sanitizeDisplay(pentestIdentifier)}' not found. Verify the ID with \`tracecli pentest list\`.`
+    });
+  }
+  if (options.output === "json") {
+    printJson(result.body);
+    return;
+  }
+  const label = `PT-${result.body.displayId}`;
+  console.log(
+    colorSuccess(
+      result.body.hiddenFromCustomerAt === null ? `${label} is visible to the customer.` : `${label} is hidden from the customer.`
+    )
+  );
+  if (result.body.hiddenFromCustomerAt === null) {
+    console.log("  Published findings, reports, and attestations show in their dashboard again.");
+  } else {
+    console.log("  The customer no longer sees this pentest anywhere; staff views are unchanged.");
+  }
+}
+function createVisibilityCommand() {
+  return new Command("visibility").description("Hide a pentest from the customer or make it visible again (staff)").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--hidden", "Hide the pentest from the customer").option("--visible", "Make the pentest visible to the customer").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (pentestId, options) => {
+    await setVisibility(pentestId, options);
+  });
+}
+
 // src/pentest/commands.ts
 var DEFAULT_LIMIT2 = 30;
 var MAX_LIMIT2 = 100;
@@ -49518,6 +50279,8 @@ function createFindingsCommand() {
   findings.addCommand(createStatusUpdateCommand());
   findings.addCommand(createAttachEvidenceCommand());
   findings.addCommand(createCreateFindingCommand(), { hidden: true });
+  findings.addCommand(createCopyFindingsCommand(), { hidden: true });
+  findings.addCommand(createPublishFindingsCommand(), { hidden: true });
   return findings;
 }
 var PRIORITY_SET = new Set(CustomerPriorityCategoryValues);
@@ -50001,6 +50764,8 @@ function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand6());
   pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createCreatePentestCommand(), { hidden: true });
+  pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
   pentest.addCommand(createFindingsCommand());
   pentest.addCommand(createReportCommand());
@@ -50008,8 +50773,251 @@ function createPentestCommand() {
   return pentest;
 }
 
+// src/test-integration/passkeys.ts
+import { readFileSync as readFileSync8, unlinkSync } from "fs";
+
+// src/test-integration/resolve.ts
+async function resolveTestIntegrationId(label) {
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrations()
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list test integrations", result.status, result.body);
+  }
+  const match = result.body.find((integration) => integration.label === label);
+  if (match === void 0) {
+    console.error(
+      colorError(
+        `No test integration named '${sanitizeDisplay(label)}'. Names are exact; the console's Test integrations page lists them.`
+      )
+    );
+    process.exit(1);
+  }
+  return match.testIntegrationId;
+}
+
+// src/test-integration/passkeys.ts
+function parseKeyFile(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: "The key file is not JSON." };
+  }
+  if (Array.isArray(parsed)) {
+    return {
+      error: "The key file holds an array. Import takes one passkey per file: write the one entry you mean to import as a single object."
+    };
+  }
+  const result = TestIntegrationPasskeyImportSchema.safeParse(parsed);
+  if (!result.success) {
+    const paths = result.error.issues.map((issue2) => issue2.path.map(String).join(".") || "(root)").filter((path, index, all) => all.indexOf(path) === index);
+    return {
+      error: `The key file is not a captured passkey. Problem fields: ${paths.join(", ")}.`
+    };
+  }
+  return { passkey: result.data };
+}
+function describePasskey(passkey) {
+  const user = passkey.userName ?? void 0;
+  return user === void 0 || user.length === 0 ? `the ${sanitizeDisplay(passkey.rpId)} passkey` : `the ${sanitizeDisplay(passkey.rpId)} passkey for ${sanitizeDisplay(user)}`;
+}
+function importSuccessLine(input) {
+  const head = `Imported ${describePasskey(input.passkey)} into ${sanitizeDisplay(input.label)} (id ${input.id}).`;
+  return input.deleted ? `${head} Deleted the key file ${input.path}.` : `${head} Kept ${input.path}. It holds the private key, so delete it once every environment you need has it, or pass --delete-file on the last import.`;
+}
+function deleteSuccessLine(input) {
+  return `Deleted ${describePasskey(input.passkey)} from ${sanitizeDisplay(input.label)}. The site still lists it on the account, so remove it there too, and do it now if the key may have leaked.`;
+}
+async function importPasskey(label, options) {
+  let raw;
+  try {
+    raw = readFileSync8(options.file, "utf8");
+  } catch {
+    console.error(colorError(`Cannot read the key file ${options.file}.`));
+    process.exit(1);
+  }
+  const parsed = parseKeyFile(raw);
+  if ("error" in parsed) {
+    console.error(colorError(parsed.error));
+    process.exit(1);
+  }
+  const { passkey } = parsed;
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  if (options.output !== "json") {
+    console.log(`Integration  ${sanitizeDisplay(label)}`);
+    console.log(`Site         ${sanitizeDisplay(passkey.rpId)}`);
+    console.log(
+      `User         ${passkey.userName ? sanitizeDisplay(passkey.userName) : colorMuted("(none in file)")}`
+    );
+    console.log(`Counter      ${passkey.signCount}`);
+  }
+  const confirmed = await confirmAction(`Import this passkey into ${sanitizeDisplay(label)}?`, {
+    skip: options.yes === true,
+    verb: "import"
+  });
+  if (!confirmed) {
+    console.log("Nothing imported.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.importTestIntegrationPasskey({
+      params: { testIntegrationId },
+      body: passkey
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    if (result.status === 409) {
+      const { message } = readErrorFields(result.body);
+      console.error(colorError(message ?? "This passkey is already stored on the integration."));
+      console.error(`The key file ${options.file} was kept.`);
+      process.exit(1);
+    }
+    failStaffPentestWrite("import a passkey", result.status, result.body, {
+      notFound: `No test integration named '${sanitizeDisplay(label)}'.`
+    });
+  }
+  let deleted = false;
+  if (options.deleteFile === true) {
+    unlinkSync(options.file);
+    deleted = true;
+  }
+  if (options.output === "json") {
+    printJson({ ...result.body, keyFile: deleted ? null : options.file });
+    return;
+  }
+  console.log(
+    colorSuccess(
+      importSuccessLine({
+        passkey,
+        label,
+        id: result.body.testIntegrationPasskeyId,
+        path: options.file,
+        deleted
+      })
+    )
+  );
+}
+async function listPasskeys(label, options) {
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrationPasskeys({ params: { testIntegrationId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list passkeys", result.status, result.body);
+  }
+  const rows = result.body;
+  if (options.output === "json") {
+    printJson(rows);
+    return;
+  }
+  if (options.output === "tsv") {
+    console.log("id	site	user	imported	lastUsed");
+    for (const row of rows) {
+      console.log(
+        [
+          row.testIntegrationPasskeyId,
+          row.rpId,
+          userColumn(row),
+          toIso(row.createdAt),
+          row.lastAssertedAt === null ? "" : toIso(row.lastAssertedAt)
+        ].join("	")
+      );
+    }
+    return;
+  }
+  if (rows.length === 0) {
+    console.log(`No passkeys stored for ${sanitizeDisplay(label)}.`);
+    return;
+  }
+  for (const row of rows) {
+    console.log(
+      `${row.testIntegrationPasskeyId}  ${sanitizeDisplay(row.rpId)}  ${userColumn(row)}  imported ${toIso(row.createdAt)}  last used ${row.lastAssertedAt === null ? "never" : toIso(row.lastAssertedAt)}`
+    );
+  }
+}
+function userColumn(row) {
+  if (row.unreadable) return "unreadable";
+  return row.userName === null ? "" : sanitizeDisplay(row.userName);
+}
+async function deletePasskey(label, passkeyId, options) {
+  const testIntegrationId = await resolveTestIntegrationId(label);
+  const listed = await authenticatedRequest(
+    (client) => client.testIntegration.listTestIntegrationPasskeys({ params: { testIntegrationId } })
+  );
+  if (listed.status !== SUCCESS_STATUS) {
+    failStaffPentestWrite("list passkeys", listed.status, listed.body);
+  }
+  const row = listed.body.find(
+    (r2) => r2.testIntegrationPasskeyId === passkeyId
+  );
+  if (row === void 0) {
+    console.error(
+      colorError(
+        `No passkey with id ${sanitizeDisplay(passkeyId)} is stored on ${sanitizeDisplay(label)}. Run \`tracecli test-integration passkeys list ${sanitizeDisplay(label)}\`.`
+      )
+    );
+    process.exit(1);
+  }
+  const confirmed = await confirmAction(
+    `Delete ${describePasskey(row)} from ${sanitizeDisplay(label)}?`,
+    { skip: options.yes === true, verb: "delete" }
+  );
+  if (!confirmed) {
+    console.log("Nothing deleted.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.testIntegration.deleteTestIntegrationPasskey({
+      params: { testIntegrationId, testIntegrationPasskeyId: passkeyId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failStaffPentestWrite("delete a passkey", result.status, result.body, {
+      notFound: `No passkey with id ${sanitizeDisplay(passkeyId)} is stored on ${sanitizeDisplay(label)}.`
+    });
+  }
+  if (options.output === "json") {
+    printJson({ deleted: passkeyId });
+    return;
+  }
+  console.log(colorSuccess(deleteSuccessLine({ passkey: row, label })));
+}
+function createPasskeysCommand() {
+  const passkeys = new Command("passkeys").description(
+    "Passkeys stored on a test integration (staff)"
+  );
+  passkeys.addCommand(
+    new Command("import").description("Store a passkey the capture script wrote (staff)").argument("<label>", "The test integration name, exactly as the console shows it").requiredOption("--file <path>", "The captured key file (one passkey)").option("--delete-file", "Delete the key file after a successful import").option("-y, --yes", "Skip the confirmation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(async (label, options) => {
+      await importPasskey(label, options);
+    })
+  );
+  passkeys.addCommand(
+    new Command("list").description("List a test integration's stored passkeys (staff)").argument("<label>", "The test integration name").option("-o, --output <format>", "Output format: text, json, tsv (default: text)", "text").action(async (label, options) => {
+      await listPasskeys(label, options);
+    })
+  );
+  passkeys.addCommand(
+    new Command("delete").description("Remove one stored passkey from a test integration (staff)").argument("<label>", "The test integration name").argument("<passkeyId>", "The passkey id from `passkeys list`").option("-y, --yes", "Skip the confirmation").option("-o, --output <format>", "Output format: text, json (default: text)", "text").action(
+      async (label, passkeyId, options) => {
+        await deletePasskey(label, passkeyId, options);
+      }
+    )
+  );
+  return passkeys;
+}
+
+// src/test-integration/commands.ts
+function createTestIntegrationCommand() {
+  const group = new Command("test-integration").description(
+    "Trace-owned test integrations (staff)"
+  );
+  group.addCommand(createPasskeysCommand());
+  return group;
+}
+
 // src/update/commands.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface4 } from "readline/promises";
 var UPDATE_CACHE_FILE = "update-check.json";
@@ -50027,7 +51035,7 @@ function readUpdateCheckCache() {
     return null;
   }
   try {
-    const rawCache = readFileSync8(cachePath, "utf-8");
+    const rawCache = readFileSync9(cachePath, "utf-8");
     const parsed = JSON.parse(rawCache);
     if (typeof parsed !== "object" || parsed === null) {
       return null;
@@ -51858,6 +52866,7 @@ program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());
+program2.addCommand(createTestIntegrationCommand(), { hidden: true });
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());
 await program2.parseAsync();