securewithtrace 0.47.0 → 0.48.0

package/dist/index.js

@@ -3700,6 +3700,60 @@ var PENTEST_FINDING_STATUS_VALUES = [
   "DISMISSED"
 ];
 
+// ../../packages/core/src/agent-session/versions.ts
+var OOB_PROFILE_SUCCESSIONS = [
+  {
+    successor: { promptVersion: "validation-v11", toolsetVersion: "validation-tools-v7" },
+    predecessor: { promptVersion: "validation-v10", toolsetVersion: "validation-tools-v6" }
+  },
+  {
+    successor: { promptVersion: "operator-v7", toolsetVersion: "operator-tools-v5" },
+    predecessor: { promptVersion: "operator-v6", toolsetVersion: "operator-tools-v4" }
+  },
+  {
+    successor: { promptVersion: "operator-openai-v7", toolsetVersion: "operator-openai-tools-v6" },
+    predecessor: {
+      promptVersion: "operator-openai-v6",
+      toolsetVersion: "operator-openai-tools-v5"
+    }
+  },
+  {
+    successor: { promptVersion: "retest-v7", toolsetVersion: "retest-tools-v5" },
+    predecessor: { promptVersion: "retest-v6", toolsetVersion: "retest-tools-v4" }
+  },
+  {
+    successor: { promptVersion: "assessment-v10", toolsetVersion: "assessment-tools-v7" },
+    predecessor: { promptVersion: "assessment-v9", toolsetVersion: "assessment-tools-v6" }
+  },
+  {
+    successor: { promptVersion: "assessment-v10-desktop", toolsetVersion: "assessment-tools-v7" },
+    predecessor: { promptVersion: "assessment-v9-desktop", toolsetVersion: "assessment-tools-v6" }
+  },
+  {
+    successor: {
+      promptVersion: "assessment-openai-v7",
+      toolsetVersion: "assessment-openai-tools-v6"
+    },
+    predecessor: {
+      promptVersion: "assessment-openai-v6",
+      toolsetVersion: "assessment-openai-tools-v5"
+    }
+  },
+  {
+    successor: {
+      promptVersion: "assessment-openai-v7-desktop",
+      toolsetVersion: "assessment-openai-tools-v6"
+    },
+    predecessor: {
+      promptVersion: "assessment-openai-v6-desktop",
+      toolsetVersion: "assessment-openai-tools-v5"
+    }
+  }
+];
+var OOB_CAPABLE_TOOLSETS = new Set(
+  OOB_PROFILE_SUCCESSIONS.map(({ successor }) => successor.toolsetVersion)
+);
+
 // ../../node_modules/.bun/zod@4.3.6/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -4931,8 +4985,8 @@ function cleanEnum(obj) {
     return Number.isNaN(Number.parseInt(k, 10));
   }).map((el) => el[1]);
 }
-function base64ToUint8Array(base643) {
-  const binaryString = atob(base643);
+function base64ToUint8Array(base644) {
+  const binaryString = atob(base644);
   const bytes = new Uint8Array(binaryString.length);
   for (let i2 = 0; i2 < binaryString.length; i2++) {
     bytes[i2] = binaryString.charCodeAt(i2);
@@ -4947,9 +5001,9 @@ function uint8ArrayToBase64(bytes) {
   return btoa(binaryString);
 }
 function base64urlToUint8Array(base64url3) {
-  const base643 = base64url3.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = "=".repeat((4 - base643.length % 4) % 4);
-  return base64ToUint8Array(base643 + padding);
+  const base644 = base64url3.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - base644.length % 4) % 4);
+  return base64ToUint8Array(base644 + padding);
 }
 function uint8ArrayToBase64url(bytes) {
   return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -6293,8 +6347,8 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c65) => c65 === "-" ? "+" : "/");
-  const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
+  const base644 = data.replace(/[-_]/g, (c69) => c69 === "-" ? "+" : "/");
+  const padded = base644.padEnd(Math.ceil(base644.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
 var $ZodBase64URL = /* @__PURE__ */ $constructor("$ZodBase64URL", (inst, def) => {
@@ -16337,9 +16391,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c65 = inst._zod.bag;
-  inst.minDate = c65.minimum ? new Date(c65.minimum) : null;
-  inst.maxDate = c65.maximum ? new Date(c65.maximum) : null;
+  const c69 = inst._zod.bag;
+  inst.minDate = c69.minimum ? new Date(c69.minimum) : null;
+  inst.maxDate = c69.maximum ? new Date(c69.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate, params);
@@ -22003,7 +22057,9 @@ var PentestEditEntityValues = [
   // `apps/web` hard-parses audit responses through it, so a new value reaching an old
   // web build fails `ListPentestAuditLogResponseSchema.parse` and takes out the whole
   // staff audit list. The generic `enumLabel` renderer downstream does not save it.
-  "PENTEST_ATTACK_CHAIN"
+  "PENTEST_ATTACK_CHAIN",
+  "APPLICATION_SURFACE_FEATURE",
+  "APPLICATION_SURFACE_MAP"
 ];
 var PentestEditEntity = external_exports.enum(PentestEditEntityValues);
 var PentestEditActionValues = [
@@ -22014,7 +22070,9 @@ var PentestEditActionValues = [
   "RESTORE",
   "STAGE_TRANSITION",
   "PENTEST_SCAN_RERUN",
-  "DELIVER"
+  "DELIVER",
+  "RETIRE",
+  "MERGE"
 ];
 var PentestEditAction = external_exports.enum(PentestEditActionValues);
 var PentestAuditActorTypeValues = ["USER", "SYSTEM", "AGENT", "API_KEY", "STAFF"];
@@ -22492,7 +22550,18 @@ var OperatorPentestContextSchema = external_exports.object({
       label: external_exports.string(),
       credentialType: external_exports.string()
     })
-  )
+  ),
+  /**
+   * The engagement's staff-defined finding tags, name-sorted. The operator
+   * classifies findings with `set_finding_tags` by NAME from this list. Optional
+   * for the same host raw-cast reason as `applications`.
+   */
+  tags: external_exports.array(
+    external_exports.object({
+      name: external_exports.string(),
+      description: external_exports.string().nullable()
+    })
+  ).optional()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/agent-session.ts
@@ -22923,6 +22992,402 @@ var ListAgentTasksQuerySchema = external_exports.object({
 });
 var ListAgentTasksResponseSchema = external_exports.array(AgentTaskResponseSchema);
 
+// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
+var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
+var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
+var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
+  repositoryId: external_exports.uuid()
+});
+var CreateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var UpdateRepositoryRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.url().optional(),
+  platform: external_exports.enum(PlatformValues).optional(),
+  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
+  status: external_exports.enum(RepositoryStatusValues).optional()
+});
+var RepositoryResponseSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryUrl: external_exports.url(),
+  platform: external_exports.enum(PlatformValues),
+  status: external_exports.enum(RepositoryStatusValues),
+  githubDefaultBranch: external_exports.string(),
+  scanningBranch: external_exports.string().nullable(),
+  primaryLanguage: external_exports.string().nullable().optional(),
+  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
+  prScansEnabled: external_exports.boolean(),
+  /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
+  includedInScanning: external_exports.boolean(),
+  /** Host archive flag mirrored from the provider. */
+  isArchived: external_exports.boolean(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
+var SetScanningInclusionRequestSchema = external_exports.object({
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(500),
+  includedInScanning: external_exports.boolean()
+});
+var SetScanningInclusionResponseSchema = external_exports.object({
+  /** Rows whose flag now matches the request (already-matching rows count). */
+  updatedCount: external_exports.number().int().min(0),
+  /** IDs from the request that are not repositories of this organization. */
+  notFoundRepositoryIds: external_exports.array(external_exports.uuid())
+});
+var SetPrScansEnabledRequestSchema = external_exports.object({
+  enabled: external_exports.boolean()
+});
+var StaffRepositoryPrScanSettingSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
+  fullName: external_exports.string().nullable(),
+  repositoryUrl: external_exports.url(),
+  /** The staff-set opt-in arm of the gate. */
+  prScansEnabled: external_exports.boolean(),
+  /**
+   * The implicit arm: a completed FULL SAST scan exists for this repo (any
+   * branch). With the org capability granted, either arm open means PR scans run.
+   */
+  hasSastBaseline: external_exports.boolean()
+});
+var StaffPrScanSettingsResponseSchema = external_exports.object({
+  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
+  orgHasAutoPrScans: external_exports.boolean(),
+  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
+});
+var CloneTokenRequestSchema = external_exports.object({
+  repositoryUrl: external_exports.string().url()
+});
+var CloneTokenResponseSchema = external_exports.object({
+  token: external_exports.string(),
+  expiresAt: external_exports.string().datetime(),
+  // Git username scheme to pair with this token. GitHub installation tokens
+  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
+  // for back-compat with CLIs that predate Bitbucket support and hardcode
+  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
+  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
+});
+var ScanningBranchHistoryEntrySchema = external_exports.object({
+  historyId: external_exports.uuid(),
+  branch: external_exports.string(),
+  configuredAt: external_exports.date(),
+  replacedAt: external_exports.date(),
+  configuredByUserId: external_exports.uuid().nullable()
+});
+var ScanningBranchStateSchema = external_exports.object({
+  scanningBranch: external_exports.string().nullable(),
+  githubDefaultBranch: external_exports.string(),
+  history: external_exports.array(ScanningBranchHistoryEntrySchema)
+});
+var SetScanningBranchRequestSchema = external_exports.object({
+  branch: external_exports.string().min(1).max(255),
+  migrateOpenVulnerabilities: external_exports.boolean(),
+  /**
+   * Optional compare-and-swap guard. When provided, the switch only commits
+   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
+   * `null` means "expect this repo to still be unconfigured."
+   */
+  expectedCurrentBranch: external_exports.string().nullable().optional()
+});
+var SetScanningBranchResponseSchema = external_exports.object({
+  previousBranch: external_exports.string().nullable(),
+  newBranch: external_exports.string(),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0),
+  /** Null when previousBranch was null (initial configuration). */
+  historyId: external_exports.uuid().nullable()
+});
+var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
+  external_exports.object({ kind: external_exports.literal("github-default") })
+]);
+var BulkSetScanningBranchRequestSchema = external_exports.object({
+  branch: BulkSetScanningBranchBranchSchema,
+  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
+  migrateOpenVulnerabilities: external_exports.boolean()
+});
+var BulkSetScanningBranchResultStatusValues = [
+  "switched",
+  "branch-missing-on-github",
+  "forbidden",
+  "already-on-branch",
+  "not-found",
+  "error"
+];
+var BulkSetScanningBranchResultSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
+  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
+  historyId: external_exports.uuid().nullable().optional(),
+  errorMessage: external_exports.string().optional()
+});
+var BulkSetScanningBranchResponseSchema = external_exports.object({
+  results: external_exports.array(BulkSetScanningBranchResultSchema)
+});
+var ScanningBranchPreferenceSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.boolean()
+});
+var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
+  autoConfigureScanningBranch: external_exports.literal(true),
+  /** Repos the sweep configured to their default-branch mirror. */
+  configuredCount: external_exports.number().int().min(0),
+  /**
+   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
+   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
+   */
+  skippedCount: external_exports.number().int().min(0)
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
+var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
+var APPLICATION_NOTES_MAX_CHARS = 2e3;
+var ApplicationRepositoryRoleValues = [
+  "FRONTEND",
+  "BACKEND_API",
+  "AUTH_SERVICE",
+  "WORKER_JOB_SERVICE",
+  "SHARED_PACKAGE_SDK",
+  "INFRASTRUCTURE_IAC",
+  "MOBILE_CLIENT",
+  "MONOREPO",
+  "OTHER"
+];
+var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
+  applicationId: external_exports.uuid()
+});
+var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
+  applicationRepositoryId: external_exports.uuid()
+});
+var ApplicationRepositorySummarySchema = external_exports.object({
+  applicationRepositoryId: external_exports.uuid().nullable(),
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  repositoryId: external_exports.uuid(),
+  repositoryName: external_exports.string(),
+  repositoryUrl: external_exports.string(),
+  repositoryStatus: external_exports.enum(RepositoryStatusValues),
+  htmlUrl: external_exports.string().nullable(),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
+var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
+  // First of `roles` (enum order), or null when unspecified. Kept so a new
+  // client reading a pre-this-release API during a rolling deploy still parses.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
+  // Source of truth. Defaulted empty so a new client reading a pre-this-release
+  // API that omitted the field doesn't reject the row; the client then falls
+  // back to wrapping `role`.
+  roles: ApplicationRepositoryRolesSchema.default([]),
+  roleLabel: external_exports.string().max(120).nullable(),
+  repositoryPath: external_exports.string().max(500).nullable(),
+  scanEnabled: external_exports.boolean()
+});
+var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
+  ApplicationRepositoryLinkResponseSchema
+);
+var ApplicationResponseSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  name: external_exports.string(),
+  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
+  // never emitted `type` parses cleanly (existing apps are semantically WEB),
+  // so a new frontend reading an old API during a mixed-version rollout doesn't
+  // reject application rows.
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.string().nullable(),
+  // Customer-authored free-text context, any type ("Advanced → Notes").
+  notes: external_exports.string().nullable(),
+  helpCenterUrl: external_exports.string().nullable(),
+  documentationUrl: external_exports.string().nullable(),
+  repositories: external_exports.array(ApplicationRepositorySummarySchema),
+  // Registrable domains RECON is authorized to discover subdomains under. The
+  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
+  // (like `type`) so a new client reading a pre-this-release API during a rolling
+  // deploy doesn't reject application rows that predate the field.
+  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
+  // reading a pre-this-release API during a rolling deploy doesn't reject rows
+  // that omit the field. The raw S3 key is never on the wire.
+  screenshotUrl: external_exports.url().nullable().default(null),
+  // Defaulted null so a new client reading a pre-this-release API during a
+  // rolling deploy doesn't reject application rows that omit the field.
+  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
+  createdAt: external_exports.date(),
+  updatedAt: external_exports.date()
+});
+var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
+var CreateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200),
+  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
+  repositoryId: external_exports.uuid().optional(),
+  repositoryPath: external_exports.string().max(500).optional(),
+  helpCenterUrl: external_exports.url().max(2048).optional(),
+  documentationUrl: external_exports.url().max(2048).optional()
+}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
+  path: ["applicationUrl"],
+  message: "A web or API application requires an application URL."
+}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
+  path: ["applicationUrl"],
+  message: "Only web or API applications can have an application URL."
+});
+var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  repositoryId: external_exports.uuid(),
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
+  // Legacy single-role write. Ignored when `roles` is also sent.
+  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
+  roles: ApplicationRepositoryRolesSchema.optional(),
+  roleLabel: external_exports.string().max(120).nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  scanEnabled: external_exports.boolean().optional()
+}).strict();
+var UpdateApplicationRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(200).optional(),
+  applicationUrl: external_exports.url().max(2048).optional(),
+  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
+  repositoryId: external_exports.uuid().nullable().optional(),
+  repositoryPath: external_exports.string().max(500).nullable().optional(),
+  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
+  documentationUrl: external_exports.url().max(2048).nullable().optional()
+}).strict();
+
+// ../../packages/api-contracts/src/schemas/api/v1/product-evidence.api.ts
+var ProductEvidenceKindSchema = external_exports.enum(["docs", "source", "live"]);
+var EvidenceRefSchema = external_exports.object({
+  ref: external_exports.string().min(1).max(512),
+  why: external_exports.string().min(1).max(300)
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/application-surface-map.api.ts
+var SURFACE_FEATURE_ROLES_MAX = 20;
+var SURFACE_FEATURE_ENDPOINTS_MAX = 60;
+var SURFACE_FEATURE_NAME_MAX_CHARS = 120;
+var SURFACE_FEATURE_SUMMARY_MAX_CHARS = 600;
+var SURFACE_ROLE_NAME_MAX_CHARS = 60;
+var SURFACE_ROLE_DESCRIPTION_MAX_CHARS = 200;
+var SURFACE_ENDPOINT_LABEL_MAX_CHARS = 200;
+var SURFACE_SOURCE_NOTE_MAX_CHARS = 300;
+var SurfaceRoleSchema = external_exports.object({
+  name: external_exports.string().min(1).max(SURFACE_ROLE_NAME_MAX_CHARS),
+  description: external_exports.string().min(1).max(SURFACE_ROLE_DESCRIPTION_MAX_CHARS).optional()
+});
+var SurfaceEndpointKindSchema = external_exports.enum(["http", "ipc", "deeplink", "other"]);
+var SurfaceEndpointSchema = external_exports.object({
+  kind: SurfaceEndpointKindSchema,
+  /** A path, a route, a command, a screen. */
+  label: external_exports.string().min(1).max(SURFACE_ENDPOINT_LABEL_MAX_CHARS),
+  method: external_exports.string().min(1).max(10).optional()
+});
+var SurfaceSourceEntrySchema = external_exports.object({
+  kind: external_exports.enum(["docs", "source", "live", "staff", "system"]),
+  verdict: external_exports.enum(["observed", "removed"]),
+  agentSessionId: external_exports.uuid().optional(),
+  staffLabel: external_exports.string().min(1).max(320).optional(),
+  /** A staff reason, an agent removal reason, or "not seen in 2 full runs". */
+  note: external_exports.string().min(1).max(SURFACE_SOURCE_NOTE_MAX_CHARS).optional(),
+  refs: external_exports.array(EvidenceRefSchema).max(10),
+  at: external_exports.iso.datetime()
+});
+var SurfaceFeatureRetiredReasonSchema = external_exports.enum([
+  "OBSERVED_REMOVED",
+  "UNOBSERVED",
+  "STAFF"
+]);
+var SurfaceMapParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: PentestIdOrDisplayIdSchema
+});
+var SurfaceFeatureIdParamsSchema = SurfaceMapParamsSchema.extend({
+  featureId: external_exports.uuid()
+});
+var SurfaceFeatureSchema = external_exports.object({
+  featureId: external_exports.uuid(),
+  applicationId: external_exports.uuid(),
+  slug: external_exports.string(),
+  name: external_exports.string(),
+  summary: external_exports.string(),
+  nameEditedByLabel: external_exports.string().nullable(),
+  roles: external_exports.array(SurfaceRoleSchema),
+  endpoints: external_exports.array(SurfaceEndpointSchema),
+  sources: external_exports.array(SurfaceSourceEntrySchema),
+  /** A field whose stored JSON failed its parse is named here; the field renders as unreadable. */
+  unparseableFields: external_exports.array(external_exports.enum(["roles", "endpoints", "sources"])),
+  /** Active, and a `removed` entry younger than 30 days: something said it was gone and it stands. */
+  disputed: external_exports.boolean(),
+  /** Active, and not observed since the latest FULL run on this application started. */
+  unconfirmedByLatestFullRun: external_exports.boolean(),
+  firstRecordedAt: external_exports.coerce.date(),
+  lastRecordedAt: external_exports.coerce.date(),
+  lastObservedAt: external_exports.coerce.date(),
+  retired: external_exports.object({
+    at: external_exports.coerce.date(),
+    reason: SurfaceFeatureRetiredReasonSchema,
+    byLabel: external_exports.string().nullable(),
+    note: external_exports.string().nullable(),
+    mergedInto: external_exports.object({ featureId: external_exports.uuid(), name: external_exports.string() }).nullable()
+  }).nullable()
+});
+var SurfaceMapLatestProductReconSchema = external_exports.object({
+  agentSessionId: external_exports.uuid(),
+  status: AgentSessionStatus,
+  promptVersion: external_exports.string(),
+  /** Whether that prompt version writes the feature map at all (v3 onward). */
+  recordsFeatures: external_exports.boolean(),
+  createdAt: external_exports.coerce.date(),
+  completedAt: external_exports.coerce.date().nullable(),
+  /** Whether that session wrote at least one feature (any outcome but rejected). */
+  wroteFeatures: external_exports.boolean()
+});
+var SurfaceMapApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string(),
+  type: external_exports.enum(ApplicationTypeValues),
+  ordinal: external_exports.number().int(),
+  /** Whether this application type has a FULL run definition, so unconfirmed rows can retire. */
+  fullRunsApply: external_exports.boolean(),
+  /** The latest PRODUCT_RECON session on this lens, any version and any status; the empty states read it. */
+  latestProductRecon: SurfaceMapLatestProductReconSchema.nullable(),
+  /** Latest session on this lens the retirement pass counted as FULL. */
+  lastFullRunAt: external_exports.coerce.date().nullable(),
+  features: external_exports.array(SurfaceFeatureSchema)
+});
+var SurfaceMapResponseSchema = external_exports.object({
+  applications: external_exports.array(SurfaceMapApplicationSchema)
+});
+var AddSurfaceFeatureRequestSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string().min(1).max(SURFACE_FEATURE_NAME_MAX_CHARS),
+  summary: external_exports.string().min(1).max(SURFACE_FEATURE_SUMMARY_MAX_CHARS)
+});
+var RenameSurfaceFeatureRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(SURFACE_FEATURE_NAME_MAX_CHARS).optional(),
+  summary: external_exports.string().min(1).max(SURFACE_FEATURE_SUMMARY_MAX_CHARS).optional(),
+  /** Clear the staff hold so product recon's next write may reword the feature again. */
+  releaseToAgent: external_exports.literal(true).optional()
+}).refine((v) => v.name !== void 0 || v.summary !== void 0 || v.releaseToAgent === true, {
+  message: "name, summary, or releaseToAgent is required"
+});
+var RetireSurfaceFeatureRequestSchema = external_exports.object({
+  reason: external_exports.string().min(1).max(SURFACE_SOURCE_NOTE_MAX_CHARS)
+});
+var MergeSurfaceFeatureRequestSchema = external_exports.object({
+  intoFeatureId: external_exports.uuid()
+});
+var SurfaceFeatureConflictDetailsSchema = external_exports.object({
+  existing: external_exports.object({ featureId: external_exports.uuid(), name: external_exports.string(), retired: external_exports.boolean() })
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/code-upload.api.ts
 var CODE_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
 var CODE_UPLOAD_PART_SIZE_BYTES = 10 * 1024 * 1024;
@@ -23439,277 +23904,6 @@ var LinearTicketContextResponseSchema = external_exports.object({
 var AttestationClassificationValues = ["PUBLIC", "CONFIDENTIAL"];
 var AttestationClassification = external_exports.enum(AttestationClassificationValues);
 
-// ../../packages/api-contracts/src/schemas/api/v1/repository.api.ts
-var PlatformValues = ["GITHUB", "GITLAB", "BITBUCKET", "UPLOAD"];
-var RepositoryStatusValues = ["CONNECTED", "DISCONNECTED"];
-var RepositoryIdParamsSchema = OrgIdParamsSchema.extend({
-  repositoryId: external_exports.uuid()
-});
-var CreateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var UpdateRepositoryRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.url().optional(),
-  platform: external_exports.enum(PlatformValues).optional(),
-  githubDefaultBranch: external_exports.string().min(1).max(255).optional(),
-  status: external_exports.enum(RepositoryStatusValues).optional()
-});
-var RepositoryResponseSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryUrl: external_exports.url(),
-  platform: external_exports.enum(PlatformValues),
-  status: external_exports.enum(RepositoryStatusValues),
-  githubDefaultBranch: external_exports.string(),
-  scanningBranch: external_exports.string().nullable(),
-  primaryLanguage: external_exports.string().nullable().optional(),
-  /** Staff-set opt-in: automated PR scans run on this repo even without a FULL SAST baseline. */
-  prScansEnabled: external_exports.boolean(),
-  /** Customer-set gate: false = no scans of any kind run for this repo until it is included again. */
-  includedInScanning: external_exports.boolean(),
-  /** Host archive flag mirrored from the provider. */
-  isArchived: external_exports.boolean(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListRepositoriesResponseSchema = external_exports.array(RepositoryResponseSchema);
-var SetScanningInclusionRequestSchema = external_exports.object({
-  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(500),
-  includedInScanning: external_exports.boolean()
-});
-var SetScanningInclusionResponseSchema = external_exports.object({
-  /** Rows whose flag now matches the request (already-matching rows count). */
-  updatedCount: external_exports.number().int().min(0),
-  /** IDs from the request that are not repositories of this organization. */
-  notFoundRepositoryIds: external_exports.array(external_exports.uuid())
-});
-var SetPrScansEnabledRequestSchema = external_exports.object({
-  enabled: external_exports.boolean()
-});
-var StaffRepositoryPrScanSettingSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  /** GitHub owner/name when synced; null for rows created before the sync backfill. */
-  fullName: external_exports.string().nullable(),
-  repositoryUrl: external_exports.url(),
-  /** The staff-set opt-in arm of the gate. */
-  prScansEnabled: external_exports.boolean(),
-  /**
-   * The implicit arm: a completed FULL SAST scan exists for this repo (any
-   * branch). With the org capability granted, either arm open means PR scans run.
-   */
-  hasSastBaseline: external_exports.boolean()
-});
-var StaffPrScanSettingsResponseSchema = external_exports.object({
-  /** Org-level gate: without AUTO_PR_SCANS the per-repo switches are inert. */
-  orgHasAutoPrScans: external_exports.boolean(),
-  repositories: external_exports.array(StaffRepositoryPrScanSettingSchema)
-});
-var CloneTokenRequestSchema = external_exports.object({
-  repositoryUrl: external_exports.string().url()
-});
-var CloneTokenResponseSchema = external_exports.object({
-  token: external_exports.string(),
-  expiresAt: external_exports.string().datetime(),
-  // Git username scheme to pair with this token. GitHub installation tokens
-  // use `x-access-token`; Bitbucket app tokens use `x-token-auth`. Optional
-  // for back-compat with CLIs that predate Bitbucket support and hardcode
-  // `x-access-token` (the correct value for the GitHub-only flow they gate on).
-  username: external_exports.enum(["x-access-token", "x-token-auth"]).optional()
-});
-var ScanningBranchHistoryEntrySchema = external_exports.object({
-  historyId: external_exports.uuid(),
-  branch: external_exports.string(),
-  configuredAt: external_exports.date(),
-  replacedAt: external_exports.date(),
-  configuredByUserId: external_exports.uuid().nullable()
-});
-var ScanningBranchStateSchema = external_exports.object({
-  scanningBranch: external_exports.string().nullable(),
-  githubDefaultBranch: external_exports.string(),
-  history: external_exports.array(ScanningBranchHistoryEntrySchema)
-});
-var SetScanningBranchRequestSchema = external_exports.object({
-  branch: external_exports.string().min(1).max(255),
-  migrateOpenVulnerabilities: external_exports.boolean(),
-  /**
-   * Optional compare-and-swap guard. When provided, the switch only commits
-   * if the repo's current `scanningBranch` matches. Mismatch → HTTP 409.
-   * `null` means "expect this repo to still be unconfigured."
-   */
-  expectedCurrentBranch: external_exports.string().nullable().optional()
-});
-var SetScanningBranchResponseSchema = external_exports.object({
-  previousBranch: external_exports.string().nullable(),
-  newBranch: external_exports.string(),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0),
-  /** Null when previousBranch was null (initial configuration). */
-  historyId: external_exports.uuid().nullable()
-});
-var BulkSetScanningBranchBranchSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({ kind: external_exports.literal("literal"), value: external_exports.string().min(1).max(255) }),
-  external_exports.object({ kind: external_exports.literal("github-default") })
-]);
-var BulkSetScanningBranchRequestSchema = external_exports.object({
-  branch: BulkSetScanningBranchBranchSchema,
-  repositoryIds: external_exports.array(external_exports.uuid()).min(1).max(100),
-  migrateOpenVulnerabilities: external_exports.boolean()
-});
-var BulkSetScanningBranchResultStatusValues = [
-  "switched",
-  "branch-missing-on-github",
-  "forbidden",
-  "already-on-branch",
-  "not-found",
-  "error"
-];
-var BulkSetScanningBranchResultSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  status: external_exports.enum(BulkSetScanningBranchResultStatusValues),
-  relabeledVulnerabilityCount: external_exports.number().int().min(0).optional(),
-  historyId: external_exports.uuid().nullable().optional(),
-  errorMessage: external_exports.string().optional()
-});
-var BulkSetScanningBranchResponseSchema = external_exports.object({
-  results: external_exports.array(BulkSetScanningBranchResultSchema)
-});
-var ScanningBranchPreferenceSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.boolean()
-});
-var ConfirmScanningBranchDefaultsResponseSchema = external_exports.object({
-  autoConfigureScanningBranch: external_exports.literal(true),
-  /** Repos the sweep configured to their default-branch mirror. */
-  configuredCount: external_exports.number().int().min(0),
-  /**
-   * Rows skipped by the sweep's domain guards (empty or >255-char mirror).
-   * They stay NULL and keep the "waiting on a scanning branch" banner alive.
-   */
-  skippedCount: external_exports.number().int().min(0)
-});
-
-// ../../packages/api-contracts/src/schemas/api/v1/application.api.ts
-var ApplicationTypeValues = ["WEB", "CLI", "MOBILE", "DESKTOP", "API_SERVICE"];
-var APPLICATION_NOTES_MAX_CHARS = 2e3;
-var ApplicationRepositoryRoleValues = [
-  "FRONTEND",
-  "BACKEND_API",
-  "AUTH_SERVICE",
-  "WORKER_JOB_SERVICE",
-  "SHARED_PACKAGE_SDK",
-  "INFRASTRUCTURE_IAC",
-  "MOBILE_CLIENT",
-  "MONOREPO",
-  "OTHER"
-];
-var ApplicationIdParamsSchema = OrgIdParamsSchema.extend({
-  applicationId: external_exports.uuid()
-});
-var ApplicationRepositoryIdParamsSchema = ApplicationIdParamsSchema.extend({
-  applicationRepositoryId: external_exports.uuid()
-});
-var ApplicationRepositorySummarySchema = external_exports.object({
-  applicationRepositoryId: external_exports.uuid().nullable(),
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  repositoryId: external_exports.uuid(),
-  repositoryName: external_exports.string(),
-  repositoryUrl: external_exports.string(),
-  repositoryStatus: external_exports.enum(RepositoryStatusValues),
-  htmlUrl: external_exports.string().nullable(),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ApplicationRepositoryRolesSchema = external_exports.array(external_exports.enum(ApplicationRepositoryRoleValues)).max(ApplicationRepositoryRoleValues.length);
-var ApplicationRepositoryLinkResponseSchema = ApplicationRepositorySummarySchema.extend({
-  // First of `roles` (enum order), or null when unspecified. Kept so a new
-  // client reading a pre-this-release API during a rolling deploy still parses.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable(),
-  // Source of truth. Defaulted empty so a new client reading a pre-this-release
-  // API that omitted the field doesn't reject the row; the client then falls
-  // back to wrapping `role`.
-  roles: ApplicationRepositoryRolesSchema.default([]),
-  roleLabel: external_exports.string().max(120).nullable(),
-  repositoryPath: external_exports.string().max(500).nullable(),
-  scanEnabled: external_exports.boolean()
-});
-var ListApplicationRepositoryLinksResponseSchema = external_exports.array(
-  ApplicationRepositoryLinkResponseSchema
-);
-var ApplicationResponseSchema = external_exports.object({
-  applicationId: external_exports.uuid(),
-  organizationId: external_exports.uuid(),
-  name: external_exports.string(),
-  // `.default('WEB')` keeps responses backward-compatible: a pre-P1.3 API that
-  // never emitted `type` parses cleanly (existing apps are semantically WEB),
-  // so a new frontend reading an old API during a mixed-version rollout doesn't
-  // reject application rows.
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.string().nullable(),
-  // Customer-authored free-text context, any type ("Advanced → Notes").
-  notes: external_exports.string().nullable(),
-  helpCenterUrl: external_exports.string().nullable(),
-  documentationUrl: external_exports.string().nullable(),
-  repositories: external_exports.array(ApplicationRepositorySummarySchema),
-  // Registrable domains RECON is authorized to discover subdomains under. The
-  // Environments-tab panel hydrates from this payload (no client GET). Defaulted
-  // (like `type`) so a new client reading a pre-this-release API during a rolling
-  // deploy doesn't reject application rows that predate the field.
-  // Signed S3 URL for the Overview screenshot. Defaulted null so a new client
-  // reading a pre-this-release API during a rolling deploy doesn't reject rows
-  // that omit the field. The raw S3 key is never on the wire.
-  screenshotUrl: external_exports.url().nullable().default(null),
-  // Defaulted null so a new client reading a pre-this-release API during a
-  // rolling deploy doesn't reject application rows that omit the field.
-  credentialsNudgeDismissedAt: external_exports.date().nullable().default(null),
-  createdAt: external_exports.date(),
-  updatedAt: external_exports.date()
-});
-var ListApplicationsResponseSchema = external_exports.array(ApplicationResponseSchema);
-var CreateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200),
-  type: external_exports.enum(ApplicationTypeValues).default("WEB"),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).optional(),
-  repositoryId: external_exports.uuid().optional(),
-  repositoryPath: external_exports.string().max(500).optional(),
-  helpCenterUrl: external_exports.url().max(2048).optional(),
-  documentationUrl: external_exports.url().max(2048).optional()
-}).strict().refine((data) => !isUrlBearingApplicationType(data.type) || data.applicationUrl != null, {
-  path: ["applicationUrl"],
-  message: "A web or API application requires an application URL."
-}).refine((data) => isUrlBearingApplicationType(data.type) || data.applicationUrl == null, {
-  path: ["applicationUrl"],
-  message: "Only web or API applications can have an application URL."
-});
-var CreateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  repositoryId: external_exports.uuid(),
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRepositoryLinkRequestSchema = external_exports.object({
-  // Legacy single-role write. Ignored when `roles` is also sent.
-  role: external_exports.enum(ApplicationRepositoryRoleValues).nullable().optional(),
-  roles: ApplicationRepositoryRolesSchema.optional(),
-  roleLabel: external_exports.string().max(120).nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  scanEnabled: external_exports.boolean().optional()
-}).strict();
-var UpdateApplicationRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(200).optional(),
-  applicationUrl: external_exports.url().max(2048).optional(),
-  notes: external_exports.string().max(APPLICATION_NOTES_MAX_CHARS).nullable().optional(),
-  repositoryId: external_exports.uuid().nullable().optional(),
-  repositoryPath: external_exports.string().max(500).nullable().optional(),
-  helpCenterUrl: external_exports.url().max(2048).nullable().optional(),
-  documentationUrl: external_exports.url().max(2048).nullable().optional()
-}).strict();
-
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-report-pdf.api.ts
 var ReportPdfPentestParamsSchema = OrgIdParamsSchema.extend({
   pentestId: external_exports.uuid()
@@ -24422,6 +24616,250 @@ var ListReportIssuesResponseSchema = external_exports.object({
   issues: external_exports.array(ReportIssueSchema)
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-tag.api.ts
+var PENTEST_TAG_NAME_MAX_CHARS = 40;
+var PENTEST_TAG_DESCRIPTION_MAX_CHARS = 500;
+var PENTEST_TAGS_PER_PENTEST_MAX = 50;
+var PentestTagsParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: external_exports.string().min(1)
+});
+var PentestTagIdParamsSchema = PentestTagsParamsSchema.extend({
+  pentestTagId: external_exports.uuid()
+});
+var tagName = external_exports.string().trim().min(1).max(PENTEST_TAG_NAME_MAX_CHARS);
+var tagDescription = external_exports.string().trim().max(PENTEST_TAG_DESCRIPTION_MAX_CHARS);
+var PentestTagResponseSchema = external_exports.object({
+  pentestTagId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  name: external_exports.string(),
+  description: external_exports.string().nullable(),
+  /** How many findings on the engagement currently wear the tag (drafts included on staff reads). */
+  findingCount: external_exports.number().int().nonnegative(),
+  createdById: external_exports.uuid(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var ListPentestTagsResponseSchema = external_exports.array(PentestTagResponseSchema);
+var CreatePentestTagRequestSchema = external_exports.object({
+  name: tagName,
+  description: tagDescription.optional()
+}).strict();
+var UpdatePentestTagRequestSchema = external_exports.object({
+  name: tagName.optional(),
+  /** Null clears the description. */
+  description: tagDescription.nullable().optional()
+}).strict();
+var PentestFindingTagSchema = external_exports.object({
+  pentestTagId: external_exports.uuid(),
+  name: external_exports.string()
+});
+var SetPentestFindingTagsRequestSchema = external_exports.object({
+  pentestTagIds: external_exports.array(external_exports.uuid()).max(PENTEST_TAGS_PER_PENTEST_MAX)
+}).strict();
+
+// ../../packages/api-contracts/src/schemas/domain/oob.schema.ts
+var OOB_MAX_BODY_BYTES = 1048576;
+var OOB_MAX_RESPONSE_BYTES = 65536;
+var OOB_MAX_ENVELOPE_BYTES = 2097152;
+var OobListenerStatusValues = ["ACTIVE", "CLOSED"];
+var OobCaptureStatusValues = ["PENDING", "COMPLETE", "FAILED"];
+var OobListenerHealthValues = ["PROBING", "READY", "FAILED"];
+var OobProtocolValues = ["HTTP", "HTTPS"];
+var OobProbeResultValues = ["PENDING", "VERIFIED", "FAILED"];
+var OobListenerStatusSchema = external_exports.enum(OobListenerStatusValues);
+var OobCaptureStatusSchema = external_exports.enum(OobCaptureStatusValues);
+var OobListenerHealthSchema = external_exports.enum(OobListenerHealthValues);
+var OobProtocolSchema = external_exports.enum(OobProtocolValues);
+var OobProbeResultSchema = external_exports.enum(OobProbeResultValues);
+var OobSha256Schema = external_exports.string().regex(/^[0-9a-f]{64}$/);
+var OobSequenceSchema = external_exports.string().regex(/^(0|[1-9][0-9]*)$/);
+var base643 = external_exports.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+var OobHeaderSchema = external_exports.strictObject({ name: external_exports.string(), value: external_exports.string() });
+var OobMultimapSchema = external_exports.unknown().transform((input, context) => {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    context.addIssue({ code: "custom", message: "Expected a map of string arrays." });
+    return external_exports.NEVER;
+  }
+  const entries = Object.entries(input);
+  const parsedEntries = [];
+  for (const [key, value] of entries) {
+    const parsed = external_exports.array(external_exports.string()).safeParse(value);
+    if (!parsed.success) {
+      context.addIssue({ code: "custom", path: [key], message: "Expected an array of strings." });
+      return external_exports.NEVER;
+    }
+    parsedEntries.push([key, parsed.data]);
+  }
+  return Object.fromEntries(parsedEntries);
+});
+var forbiddenResponseHeaders = /* @__PURE__ */ new Set([
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "keep-alive",
+  "te",
+  "trailer",
+  "upgrade",
+  "proxy-authenticate",
+  "proxy-authorization"
+]);
+var OobResponseSchema = external_exports.strictObject({
+  status: external_exports.number().int().min(200).max(599),
+  headers: external_exports.array(OobHeaderSchema).max(32),
+  bodyBase64: base643.max(Math.ceil(OOB_MAX_RESPONSE_BYTES / 3) * 4)
+}).superRefine((response, context) => {
+  const bytes = response.bodyBase64.length * 3 / 4 - (response.bodyBase64.endsWith("==") ? 2 : response.bodyBase64.endsWith("=") ? 1 : 0);
+  if (bytes > OOB_MAX_RESPONSE_BYTES)
+    context.addIssue({
+      code: "custom",
+      path: ["bodyBase64"],
+      message: "Response body exceeds 65536 bytes."
+    });
+  if ([204, 205, 304].includes(response.status) && bytes !== 0)
+    context.addIssue({
+      code: "custom",
+      path: ["bodyBase64"],
+      message: "This response status requires an empty body."
+    });
+  let headerBytes = 0;
+  response.headers.forEach((header, index) => {
+    headerBytes += new TextEncoder().encode(`${header.name}: ${header.value}\r
+`).length;
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(header.name) || forbiddenResponseHeaders.has(header.name.toLowerCase()) || /[^\t\x20-\x7e\x80-\xff]/.test(header.value))
+      context.addIssue({
+        code: "custom",
+        path: ["headers", index],
+        message: "Response header name or value is unsupported."
+      });
+    if (header.name.toLowerCase() === "location") {
+      try {
+        const url2 = new URL(header.value);
+        if (!["http:", "https:"].includes(url2.protocol)) throw new Error("scheme");
+      } catch {
+        context.addIssue({
+          code: "custom",
+          path: ["headers", index],
+          message: "Location must be an HTTP or HTTPS URL."
+        });
+      }
+    }
+  });
+  if (headerBytes > 8192)
+    context.addIssue({
+      code: "custom",
+      path: ["headers"],
+      message: "Response headers exceed 8192 bytes."
+    });
+});
+var OobPersistenceRequestSchema = external_exports.discriminatedUnion("action", [
+  external_exports.strictObject({
+    action: external_exports.literal("admit"),
+    publicToken: external_exports.string().regex(/^[a-z0-9]{32,64}$/),
+    protocol: OobProtocolSchema,
+    method: external_exports.string().regex(/^[A-Z]{1,20}$/),
+    sourceIp: external_exports.union([external_exports.ipv4(), external_exports.ipv6()]),
+    bodyBytes: external_exports.number().int().min(0).max(OOB_MAX_BODY_BYTES),
+    bodySha256: OobSha256Schema,
+    probeNonceHash: OobSha256Schema.nullable()
+  }),
+  external_exports.strictObject({
+    action: external_exports.literal("complete"),
+    captureId: external_exports.uuid(),
+    admissionCapability: external_exports.uuid(),
+    envelopeSha256: OobSha256Schema,
+    envelopeBytes: external_exports.number().int().min(1).max(OOB_MAX_ENVELOPE_BYTES)
+  }),
+  external_exports.strictObject({
+    action: external_exports.literal("fail"),
+    captureId: external_exports.uuid(),
+    admissionCapability: external_exports.uuid(),
+    failureCode: external_exports.enum(["PUT_REJECTED", "PUT_AMBIGUOUS", "COMMIT_FAILED"])
+  })
+]);
+var OobAdmissionSchema = external_exports.strictObject({
+  captureId: external_exports.uuid(),
+  listenerId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  admissionCapability: external_exports.uuid(),
+  admittedAt: external_exports.iso.datetime({ offset: true }),
+  objectKey: external_exports.string().regex(/^oob\/[0-9a-f-]+\/[0-9a-f-]+\/[0-9a-f-]+\/[0-9a-f-]+\.json$/),
+  probeAttemptId: external_exports.uuid().nullable(),
+  isSystemProbe: external_exports.boolean(),
+  responseVersion: external_exports.number().int().positive(),
+  response: OobResponseSchema
+});
+var OobAdmissionResultSchema = external_exports.union([
+  OobAdmissionSchema,
+  external_exports.strictObject({ error: external_exports.enum(["UNKNOWN", "CLOSED", "QUOTA", "UNKNOWN_PROBE"]) })
+]);
+var OobAdmissionInspectionSchema = external_exports.strictObject({
+  captureId: external_exports.uuid(),
+  listenerId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  objectKey: external_exports.string(),
+  bodyBytes: external_exports.number().int().min(0).max(OOB_MAX_BODY_BYTES),
+  bodySha256: OobSha256Schema,
+  status: OobCaptureStatusSchema,
+  admittedAt: external_exports.iso.datetime({ offset: true }),
+  protocol: OobProtocolSchema,
+  probeAttemptId: external_exports.uuid().nullable(),
+  isSystemProbe: external_exports.boolean(),
+  responseVersion: external_exports.number().int().positive()
+});
+var OobPersistenceResultSchema = external_exports.union([
+  OobAdmissionResultSchema,
+  external_exports.strictObject({ captureSeq: OobSequenceSchema }),
+  external_exports.strictObject({ status: OobCaptureStatusSchema })
+]);
+var OobEnvelopeSchema = external_exports.strictObject({
+  version: external_exports.literal(1),
+  captureId: external_exports.uuid(),
+  listenerId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  admittedAt: external_exports.iso.datetime({ offset: true }),
+  protocol: OobProtocolSchema,
+  sourceIp: external_exports.union([external_exports.ipv4(), external_exports.ipv6()]),
+  probeAttemptId: external_exports.uuid().nullable(),
+  isSystemProbe: external_exports.boolean(),
+  method: external_exports.string().regex(/^[A-Z]{1,20}$/),
+  rawTarget: external_exports.string().max(65536),
+  rawHeaders: external_exports.array(OobHeaderSchema).max(512),
+  headers: OobMultimapSchema,
+  query: OobMultimapSchema,
+  bodyBase64: base643.max(Math.ceil(OOB_MAX_BODY_BYTES / 3) * 4),
+  bodyBytes: external_exports.number().int().min(0).max(OOB_MAX_BODY_BYTES),
+  bodySha256: OobSha256Schema,
+  responseVersion: external_exports.number().int().positive(),
+  plannedResponse: OobResponseSchema,
+  fidelity: external_exports.literal("collector-observed")
+}).superRefine((envelope, context) => {
+  const bytes = envelope.bodyBase64.length * 3 / 4 - (envelope.bodyBase64.endsWith("==") ? 2 : envelope.bodyBase64.endsWith("=") ? 1 : 0);
+  if (bytes !== envelope.bodyBytes)
+    context.addIssue({
+      code: "custom",
+      path: ["bodyBytes"],
+      message: "Captured body length differs from its encoded bytes."
+    });
+  if (envelope.isSystemProbe !== (envelope.probeAttemptId !== null))
+    context.addIssue({
+      code: "custom",
+      path: ["isSystemProbe"],
+      message: "Probe classification differs from the registered attempt identity."
+    });
+});
+var OobSourceEvidenceSchema = external_exports.strictObject({
+  captureId: external_exports.uuid(),
+  listenerId: external_exports.uuid(),
+  admittedAt: external_exports.iso.datetime({ offset: true }),
+  envelopeSha256: OobSha256Schema,
+  protocol: OobProtocolSchema,
+  fidelity: external_exports.literal("collector-observed")
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-validation.api.ts
 var PentestValidationParamsSchema = OrgIdParamsSchema.extend({
   pentestId: PentestIdOrDisplayIdSchema
@@ -24539,6 +24977,8 @@ var PentestToolRunResponseSchema = external_exports.object({
 });
 var PentestExploitArtifactMetadataResponseSchema = external_exports.object({
   artifactId: external_exports.uuid(),
+  sourceOobCaptureId: external_exports.uuid().nullable().optional(),
+  sourceOobCapture: OobSourceEvidenceSchema.nullable().optional(),
   organizationId: external_exports.uuid(),
   pentestId: external_exports.uuid(),
   attemptId: external_exports.uuid().nullable(),
@@ -24748,7 +25188,11 @@ var PentestFindingResponseSchema = external_exports.object({
   // operator schemas omit it (agents don't act on tickets). `.default(null)` keeps
   // the field input-optional (legacy fixtures / producers that predate it parse
   // clean) while the OUTPUT type stays `ExternalTicketSummary | null`.
-  externalTicket: ExternalTicketSummarySchema.nullable().default(null)
+  externalTicket: ExternalTicketSummarySchema.nullable().default(null),
+  // Staff-defined engagement tags on the finding, name-sorted. On every read
+  // (list, detail, customer, operator) so the table filter and the chips render
+  // from the row. `.default([])` for the same rolling-deploy reason as above.
+  tags: external_exports.array(PentestFindingTagSchema).default([])
 });
 var PentestFindingListItemSchema = PentestFindingResponseSchema.omit({
   summary: true,
@@ -26033,13 +26477,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c65, i2) => {
-    const d = c65.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c69, i2) => {
+    const d = c69.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c65.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c69.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -26242,20 +26686,72 @@ var c3 = initContract();
 var DesktopTargetInternalParamsSchema = external_exports.object({
   desktopTargetId: external_exports.uuid()
 });
+var DesktopTargetTransportSchema = external_exports.object({
+  /** The session sshd's ed25519 host public key, OpenSSH one-line form. */
+  sshHostPublicKey: external_exports.string().max(400).regex(/^ssh-ed25519 AAAA[0-9A-Za-z+/]+=*$/),
+  /** The public address the host observed for itself; also the device's egress. */
+  host: external_exports.union([external_exports.ipv4(), external_exports.ipv6()]),
+  port: external_exports.number().int().min(1).max(65535)
+});
 var DesktopTargetRegisterRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
   agentVersion: external_exports.string().min(1).max(64),
-  osVersion: external_exports.string().min(1).max(200)
+  osVersion: external_exports.string().min(1).max(200),
+  transport: DesktopTargetTransportSchema.optional()
 });
 var DesktopTargetRegisterResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
+var DesktopEmulatorProfileValues = ["INSPECTION", "BASELINE"];
+var DesktopTargetHostHealthSchema = external_exports.object({
+  emulators: external_exports.array(
+    external_exports.object({
+      serial: external_exports.string().min(1).max(32),
+      profile: external_exports.enum(DesktopEmulatorProfileValues),
+      booted: external_exports.boolean(),
+      adbResponsive: external_exports.boolean()
+    })
+  ).max(4),
+  captureCanaryOk: external_exports.boolean(),
+  metadataDenied: external_exports.boolean()
+});
 var DesktopTargetHeartbeatRequestSchema = external_exports.object({
-  runVersion: external_exports.number().int().min(0)
+  runVersion: external_exports.number().int().min(0),
+  health: DesktopTargetHostHealthSchema.optional()
+});
+var DesktopTargetLeaseSchema = external_exports.object({
+  desktopTargetId: external_exports.uuid(),
+  runVersion: external_exports.number().int().min(0),
+  /** The owning session, or null for a staff-provisioned target. */
+  agentSessionId: external_exports.uuid().nullable(),
+  agentSessionRunVersion: external_exports.number().int().min(0).nullable(),
+  expiresAtMs: external_exports.number().int().positive()
 });
 var DesktopTargetHeartbeatResponseSchema = external_exports.object({
-  revoked: external_exports.boolean()
+  revoked: external_exports.boolean(),
+  /**
+   * Null or absent means "admit nothing": the host closes session connections
+   * and refuses new ones. A Windows rig ignores this field.
+   */
+  lease: DesktopTargetLeaseSchema.nullable().optional()
+});
+var DesktopBootFailureStageValues = [
+  "SDK",
+  "EMULATOR_BOOT",
+  "ROOT_POLICY",
+  "ABI",
+  "METADATA_DENIAL",
+  "CAPTURE_CANARY",
+  "TRANSPORT",
+  "DEADLINE"
+];
+var DesktopTargetBootFailureRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().min(0),
+  stage: external_exports.enum(DesktopBootFailureStageValues),
+  /** Shape only: exit code, expected-vs-observed class. Never guest output. */
+  details: external_exports.string().max(500)
 });
+var DesktopTargetBootFailureResponseSchema = external_exports.object({ ok: external_exports.literal(true) });
 var DESKTOP_CLAIM_MAX_WAIT_MS = 25e3;
 var DesktopTargetClaimRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
@@ -26269,7 +26765,8 @@ var DesktopTargetStatusValues = [
   "TERMINATED",
   "FAILED"
 ];
-var DesktopTargetPlatformValues = ["WINDOWS", "MACOS"];
+var DesktopTargetPlatformValues = ["WINDOWS", "MACOS", "ANDROID"];
+var SessionRequestableDesktopPlatformValues = ["WINDOWS", "MACOS"];
 var DesktopActionStatusValues = [
   "PENDING",
   "CLAIMED",
@@ -26362,6 +26859,21 @@ var desktopTargetInternalContract = c3.router({
       500: ErrorResponseSchema
     }
   },
+  reportBootFailure: {
+    method: "POST",
+    path: "/internal/v1/desktop-targets/:desktopTargetId/boot-failure",
+    pathParams: DesktopTargetInternalParamsSchema,
+    body: DesktopTargetBootFailureRequestSchema,
+    responses: {
+      200: DesktopTargetBootFailureResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // Not PROVISIONING, or runVersion mismatch: a stale boot cannot fail a
+      // later run's row.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   claimAction: {
     method: "POST",
     path: "/internal/v1/desktop-targets/:desktopTargetId/actions/claim",
@@ -26564,11 +27076,6 @@ var RecordCandidateVulnResponseSchema = external_exports.object({
   inserted: external_exports.boolean()
 });
 var ProductContextStatement = external_exports.string().min(1).max(8e3);
-var ProductEvidenceKindSchema = external_exports.enum(["docs", "source", "live"]);
-var EvidenceRefSchema = external_exports.object({
-  ref: external_exports.string().min(1).max(512),
-  why: external_exports.string().min(1).max(300)
-});
 var ProductFamilyEvidence = {
   evidence: ProductEvidenceKindSchema.optional(),
   refs: external_exports.array(EvidenceRefSchema).max(10).optional()
@@ -26606,6 +27113,95 @@ var RecordProductContextResponseSchema = external_exports.object({
   disputed: external_exports.number().int().nonnegative(),
   rejected: external_exports.number().int().nonnegative()
 });
+var SURFACE_FEATURE_SLUG_MAX_CHARS_WIRE = 64;
+var SURFACE_FEATURES_PER_CALL_MAX = 40;
+var SURFACE_RETIREMENTS_PER_CALL_MAX = 20;
+var SurfaceFeatureSlug = external_exports.string().min(1).max(SURFACE_FEATURE_SLUG_MAX_CHARS_WIRE);
+var RecordSurfaceFeaturesRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  features: external_exports.array(
+    external_exports.object({
+      slug: SurfaceFeatureSlug,
+      name: external_exports.string().min(1).max(120),
+      summary: external_exports.string().min(1).max(600),
+      roles: external_exports.array(SurfaceRoleSchema).max(SURFACE_FEATURE_ROLES_MAX).optional(),
+      endpoints: external_exports.array(SurfaceEndpointSchema).max(SURFACE_FEATURE_ENDPOINTS_MAX).optional(),
+      evidence: ProductEvidenceKindSchema,
+      refs: external_exports.array(EvidenceRefSchema).min(1).max(10)
+    })
+  ).max(SURFACE_FEATURES_PER_CALL_MAX),
+  retired: external_exports.array(
+    external_exports.object({
+      slug: SurfaceFeatureSlug,
+      reason: external_exports.string().min(1).max(SURFACE_SOURCE_NOTE_MAX_CHARS),
+      /** The corpus of the refs, exactly as a feature. */
+      evidence: ProductEvidenceKindSchema,
+      refs: external_exports.array(EvidenceRefSchema).min(1).max(10)
+    })
+  ).max(SURFACE_RETIREMENTS_PER_CALL_MAX)
+});
+var SurfaceFeatureWriteOutcomeSchema = external_exports.enum([
+  "created",
+  "updated",
+  "restored",
+  "retired",
+  "rejected"
+]);
+var SurfaceFeatureRejectReasonSchema = external_exports.enum([
+  "NO_VALID_REF",
+  "SOURCE_EVIDENCE_WITHOUT_REPOSITORY",
+  "LIVE_EVIDENCE_WITHOUT_TARGET",
+  "UNKNOWN_SLUG",
+  "INVALID_SLUG",
+  "NOT_RETIRABLE"
+]);
+var RecordSurfaceFeaturesResponseSchema = external_exports.object({
+  results: external_exports.array(
+    external_exports.object({
+      /** As the api stored it: normalized, or the survivor's slug when a merged row redirected. */
+      slug: external_exports.string(),
+      outcome: SurfaceFeatureWriteOutcomeSchema,
+      reason: SurfaceFeatureRejectReasonSchema.optional()
+    })
+  ),
+  created: external_exports.number().int().nonnegative(),
+  updated: external_exports.number().int().nonnegative(),
+  restored: external_exports.number().int().nonnegative(),
+  retired: external_exports.number().int().nonnegative(),
+  rejected: external_exports.number().int().nonnegative()
+});
+var COVERAGE_CLASSES_PER_CALL_MAX = 40;
+var COVERAGE_CLASS_ID_MAX_CHARS = 64;
+var COVERAGE_CLASS_NAME_MAX_CHARS = 200;
+var COVERAGE_NOTE_MAX_CHARS = 2e3;
+var COVERAGE_MAPPINGS_MAX = 10;
+var COVERAGE_MAPPING_MAX_CHARS = 40;
+var COVERAGE_WIRE_STATUSES = [
+  "covered",
+  "partial",
+  "not_covered",
+  "not_applicable"
+];
+var COVERAGE_WIRE_RELEVANCES = ["critical", "high", "medium", "not_applicable"];
+var CoverageClassEntrySchema = external_exports.object({
+  id: external_exports.string().min(1).max(COVERAGE_CLASS_ID_MAX_CHARS),
+  name: external_exports.string().min(1).max(COVERAGE_CLASS_NAME_MAX_CHARS),
+  relevance: external_exports.enum(COVERAGE_WIRE_RELEVANCES),
+  status: external_exports.enum(COVERAGE_WIRE_STATUSES),
+  notes: external_exports.string().max(COVERAGE_NOTE_MAX_CHARS),
+  mappings: external_exports.array(external_exports.string().min(1).max(COVERAGE_MAPPING_MAX_CHARS)).max(COVERAGE_MAPPINGS_MAX).optional()
+});
+var RecordCoverageRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  /** Per-run counter the host assigns in call order, starting at 1. */
+  callSeq: external_exports.number().int().positive(),
+  classes: external_exports.array(CoverageClassEntrySchema).min(1).max(COVERAGE_CLASSES_PER_CALL_MAX)
+});
+var RecordCoverageResponseSchema = external_exports.object({
+  /** `stale`: a later call from this session already landed, so nothing changed. */
+  outcome: external_exports.enum(["replaced", "stale"]),
+  written: external_exports.number().int().nonnegative()
+});
 var ThreatModelStatement = external_exports.string().min(1).max(2e3);
 var RepoScopedThreatItem = external_exports.object({
   repoAlias: external_exports.string().min(1).max(200),
@@ -26655,6 +27251,7 @@ var ValidationResultProseSchema = external_exports.object({
 });
 var RecordValidationEvidenceItemSchema = external_exports.object({
   key: external_exports.string().min(1).max(1024),
+  sourceOobCaptureId: external_exports.uuid().optional(),
   kind: PentestExploitArtifactKind.optional(),
   caption: external_exports.string().min(1).max(500).optional(),
   section: ValidationEvidenceSection.optional(),
@@ -27477,6 +28074,12 @@ var OperatorPublishFindingRequestSchema = external_exports.object({
   pentestFindingId: external_exports.uuid(),
   expectedUpdatedAt: external_exports.coerce.date()
 });
+var OperatorSetFindingTagsRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid(),
+  tags: external_exports.array(external_exports.string().trim().min(1).max(PENTEST_TAG_NAME_MAX_CHARS)).max(PENTEST_TAGS_PER_PENTEST_MAX)
+});
 var OperatorApplyFindingCvssRequestSchema = ApplyFindingCvssRequestSchema.omit({
   rationale: true
   // the operator `reason` IS the cvss audit rationale
@@ -27508,6 +28111,7 @@ var OperatorAttachFindingEvidenceRequestSchema = external_exports.object({
   reason: operatorReason,
   pentestFindingId: external_exports.uuid(),
   key: external_exports.string().min(1).max(1024),
+  sourceOobCaptureId: external_exports.uuid().optional(),
   kind: PentestExploitArtifactKind.optional(),
   caption: external_exports.string().min(1).max(500).optional(),
   section: ValidationEvidenceSection.optional(),
@@ -27747,8 +28351,9 @@ var ReportUpdateScopeRequestSchema = external_exports.object({
 var RequestDesktopTargetRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().min(0),
   /** A MACOS request is also gated on the session's pinned toolset (the api's
-   *  `DESKTOP_MACOS_CAPABLE_TOOLSETS`); the schema alone does not authorize it. */
-  platform: external_exports.enum(DesktopTargetPlatformValues)
+   *  `DESKTOP_MACOS_CAPABLE_TOOLSETS`); the schema alone does not authorize it.
+   *  ANDROID is not offered here until the session-side transport lands. */
+  platform: external_exports.enum(SessionRequestableDesktopPlatformValues)
 });
 var DesktopCredentialRefSchema = external_exports.object({
   credentialId: external_exports.uuid(),
@@ -27953,6 +28558,38 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  recordSurfaceFeatures: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/surface-features",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: RecordSurfaceFeaturesRequestSchema,
+    responses: {
+      201: RecordSurfaceFeaturesResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // 403 = the run token's session is not a PRODUCT_RECON session (type backstop).
+      403: ErrorResponseSchema,
+      // 409 = run stale/revoked, or pentest deleted (app unresolvable).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  recordCoverage: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/coverage",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: RecordCoverageRequestSchema,
+    responses: {
+      201: RecordCoverageResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      // 403 = the run token's session is not a hunting session (CODE_REVIEW, RECON, ASSESSMENT).
+      403: ErrorResponseSchema,
+      // 409 = run stale/revoked (RUN_REVOKED), or the pentest was deleted (COVERAGE_PENTEST_GONE).
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   recordThreatModel: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/threat-model",
@@ -28572,6 +29209,21 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  setFindingTags: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/tags",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorSetFindingTagsRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      // PENTEST_TAG_UNKNOWN_NAME: a name is not one of the engagement's tags (details.knownTags).
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   applyFindingCvss: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/cvss",
@@ -29352,8 +30004,100 @@ var applicationContract = c7.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/v1/bitbucket.ts
+// ../../packages/api-contracts/src/contracts/v1/application-surface-map.ts
 var c8 = initContract();
+var applicationSurfaceMapContract = c8.router({
+  listSurfaceMap: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map",
+    pathParams: SurfaceMapParamsSchema,
+    responses: {
+      200: SurfaceMapResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  addSurfaceFeature: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map/features",
+    pathParams: SurfaceMapParamsSchema,
+    body: AddSurfaceFeatureRequestSchema,
+    responses: {
+      201: SurfaceFeatureSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // errorCode SURFACE_FEATURE_SLUG_EXISTS with `details` per SurfaceFeatureConflictDetailsSchema.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  renameSurfaceFeature: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map/features/:featureId",
+    pathParams: SurfaceFeatureIdParamsSchema,
+    body: RenameSurfaceFeatureRequestSchema,
+    responses: {
+      200: SurfaceFeatureSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  retireSurfaceFeature: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map/features/:featureId/retire",
+    pathParams: SurfaceFeatureIdParamsSchema,
+    body: RetireSurfaceFeatureRequestSchema,
+    responses: {
+      200: SurfaceFeatureSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  restoreSurfaceFeature: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map/features/:featureId/restore",
+    pathParams: SurfaceFeatureIdParamsSchema,
+    body: c8.noBody(),
+    responses: {
+      200: SurfaceFeatureSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  mergeSurfaceFeature: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/surface-map/features/:featureId/merge",
+    pathParams: SurfaceFeatureIdParamsSchema,
+    body: MergeSurfaceFeatureRequestSchema,
+    responses: {
+      // The survivor.
+      200: SurfaceFeatureSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/v1/bitbucket.ts
+var c9 = initContract();
 var BitbucketInstallationParamsSchema = external_exports.object({
   organizationId: external_exports.uuid()
 });
@@ -29388,7 +30132,7 @@ var SyncBitbucketInstallationResponseSchema = external_exports.object({
   /** Previously-connected repos absent from the workspace listing, now disconnected. */
   disconnectedRepoCount: external_exports.number().int()
 });
-var bitbucketContract = c8.router({
+var bitbucketContract = c9.router({
   claimInstallation: {
     method: "POST",
     path: "/organizations/:organizationId/bitbucket/installations/claim",
@@ -29493,8 +30237,8 @@ var ListChatSessionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/chat-session.ts
-var c9 = initContract();
-var chatSessionContract = c9.router({
+var c10 = initContract();
+var chatSessionContract = c10.router({
   createSession: {
     method: "POST",
     path: "/organizations/:organizationId/chat/sessions",
@@ -30197,8 +30941,8 @@ var ReverifyConvexDeploymentResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/cloud-integration.ts
-var c10 = initContract();
-var cloudIntegrationContract = c10.router({
+var c11 = initContract();
+var cloudIntegrationContract = c11.router({
   createAwsIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/cloud-integrations/aws",
@@ -30484,7 +31228,7 @@ var cloudIntegrationContract = c10.router({
     method: "POST",
     path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/vercel/installations/:vercelInstallationId/reverify",
     pathParams: VercelInstallationIdParamsSchema,
-    body: c10.noBody(),
+    body: c11.noBody(),
     responses: {
       200: ReverifyVercelInstallationResponseSchema,
       400: ErrorResponseSchema,
@@ -30581,7 +31325,7 @@ var cloudIntegrationContract = c10.router({
     method: "POST",
     path: "/organizations/:organizationId/cloud-integrations/:cloudIntegrationId/convex/deployments/:convexLinkedDeploymentId/reverify",
     pathParams: ConvexDeploymentIdParamsSchema,
-    body: c10.noBody(),
+    body: c11.noBody(),
     responses: {
       200: ReverifyConvexDeploymentResponseSchema,
       400: ErrorResponseSchema,
@@ -30705,8 +31449,8 @@ var StaffCodeSizeRemeasureResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/code-size.ts
-var c11 = initContract();
-var codeSizeContract = c11.router({
+var c12 = initContract();
+var codeSizeContract = c12.router({
   getOrganizationCodeSize: {
     method: "GET",
     path: "/organizations/:organizationId/code-size",
@@ -30724,7 +31468,7 @@ var codeSizeContract = c11.router({
     method: "POST",
     path: "/organizations/:organizationId/code-size/recalculate",
     pathParams: OrgIdParamsSchema,
-    body: c11.noBody(),
+    body: c12.noBody(),
     responses: {
       200: CodeSizeRecalculateResponseSchema,
       401: ErrorResponseSchema,
@@ -30772,7 +31516,7 @@ var codeSizeContract = c11.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/code-upload.ts
-var c12 = initContract();
+var c13 = initContract();
 var commonErrors = {
   400: ErrorResponseSchema,
   401: ErrorResponseSchema,
@@ -30782,7 +31526,7 @@ var commonErrors = {
   500: ErrorResponseSchema,
   503: ErrorResponseSchema
 };
-var codeUploadContract = c12.router({
+var codeUploadContract = c13.router({
   initializeCodeUpload: {
     method: "POST",
     path: "/organizations/:organizationId/code-uploads",
@@ -31072,8 +31816,8 @@ var RevealCredentialSecretResponseSchema = external_exports.discriminatedUnion("
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/credential.ts
-var c13 = initContract();
-var credentialContract = c13.router({
+var c14 = initContract();
+var credentialContract = c14.router({
   listCredentials: {
     method: "GET",
     path: "/organizations/:organizationId/environments/:environmentId/credentials",
@@ -31165,7 +31909,7 @@ var credentialContract = c13.router({
     method: "POST",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/reveal",
     pathParams: CredentialIdParamsSchema,
-    body: c13.noBody(),
+    body: c14.noBody(),
     responses: {
       200: RevealCredentialSecretResponseSchema,
       401: ErrorResponseSchema,
@@ -31218,7 +31962,7 @@ var credentialContract = c13.router({
     method: "POST",
     path: "/organizations/:organizationId/environments/:environmentId/credentials/:credentialId/mfa/code",
     pathParams: CredentialIdParamsSchema,
-    body: c13.noBody(),
+    body: c14.noBody(),
     responses: {
       200: CredentialMfaCodeResponseSchema,
       401: ErrorResponseSchema,
@@ -31480,8 +32224,8 @@ var DependencySummaryResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/dependency.ts
-var c14 = initContract();
-var dependencyContract = c14.router({
+var c15 = initContract();
+var dependencyContract = c15.router({
   /** Cross-repo dependency search. Two-phase: pg_trgm on Package, then join repos. */
   searchDependencies: {
     method: "POST",
@@ -31626,8 +32370,8 @@ var DockerScoutIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/docker-scout-integration.ts
-var c15 = initContract();
-var dockerScoutIntegrationContract = c15.router({
+var c16 = initContract();
+var dockerScoutIntegrationContract = c16.router({
   createDockerScoutIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/docker-scout-integration",
@@ -31827,12 +32571,12 @@ var EngagementResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/engagement.ts
-var c16 = initContract();
+var c17 = initContract();
 var RecordDashboardSessionRequest = external_exports.object({
   sessionId: external_exports.string().min(1).max(100)
 });
 var RecordDashboardSessionResponse = external_exports.object({});
-var engagementContract = c16.router({
+var engagementContract = c17.router({
   recordDashboardSession: {
     method: "POST",
     // `pathPrefix: '/v1'` is applied at the router level (see
@@ -31906,8 +32650,8 @@ var UpdateEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/environment.ts
-var c17 = initContract();
-var environmentContract = c17.router({
+var c18 = initContract();
+var environmentContract = c18.router({
   listEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/applications/:applicationId/environments",
@@ -32161,8 +32905,8 @@ var GitHubRepoSchema = external_exports.object({
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/github.ts
-var c18 = initContract();
-var githubContract = c18.router({
+var c19 = initContract();
+var githubContract = c19.router({
   // Tier chooser data: which app tiers this env can connect + the org's
   // entitlement default. Pure read (auth context + server config).
   getConnectOptions: {
@@ -32261,7 +33005,7 @@ var githubContract = c18.router({
     method: "POST",
     path: "/organizations/:organizationId/github/install-requests/:requestId/cancel",
     pathParams: GitHubInstallRequestParamsSchema,
-    body: c18.type(),
+    body: c19.type(),
     responses: {
       200: GitHubInstallRequestSchema,
       401: ErrorResponseSchema,
@@ -32272,7 +33016,7 @@ var githubContract = c18.router({
     }
   }
 });
-var staffGithubContract = c18.router({
+var staffGithubContract = c19.router({
   listStaffInstallations: {
     method: "GET",
     path: "/staff/github/installations",
@@ -32287,8 +33031,8 @@ var staffGithubContract = c18.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/inbox.ts
-var c19 = initContract();
-var inboxContract = c19.router({
+var c20 = initContract();
+var inboxContract = c20.router({
   listInboxes: {
     method: "GET",
     path: "/organizations/:organizationId/inboxes",
@@ -32441,8 +33185,8 @@ var AcceptInviteLinkRejectedResponseSchema = ErrorResponseSchema.extend({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/invite-link.ts
-var c20 = initContract();
-var inviteLinkContract = c20.router({
+var c21 = initContract();
+var inviteLinkContract = c21.router({
   createInviteLink: {
     method: "POST",
     path: "/organizations/:organizationId/invite-links",
@@ -32482,7 +33226,7 @@ var inviteLinkContract = c20.router({
     }
   }
 });
-var inviteLinkPublicContract = c20.router(
+var inviteLinkPublicContract = c21.router(
   {
     previewInviteLink: {
       method: "GET",
@@ -32499,7 +33243,7 @@ var inviteLinkPublicContract = c20.router(
       method: "POST",
       path: "/invite-links/:token/accept",
       pathParams: InviteLinkTokenParamsSchema,
-      body: c20.noBody(),
+      body: c21.noBody(),
       responses: {
         200: AcceptInviteLinkResponseSchema,
         400: ErrorResponseSchema,
@@ -32547,8 +33291,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c21 = initContract();
-var knowledgeBaseContract = c21.router({
+var c22 = initContract();
+var knowledgeBaseContract = c22.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -32769,8 +33513,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c22 = initContract();
-var knowledgeDocumentContract = c22.router({
+var c23 = initContract();
+var knowledgeDocumentContract = c23.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -33096,8 +33840,8 @@ var LinearMetadataResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-integration.ts
-var c23 = initContract();
-var linearIntegrationContract = c23.router({
+var c24 = initContract();
+var linearIntegrationContract = c24.router({
   getLinearIntegration: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear",
@@ -33115,7 +33859,7 @@ var linearIntegrationContract = c23.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/connect",
     pathParams: OrgIdParamsSchema,
-    body: c23.noBody(),
+    body: c24.noBody(),
     responses: {
       200: LinearConnectResponseSchema,
       401: ErrorResponseSchema,
@@ -33130,7 +33874,7 @@ var linearIntegrationContract = c23.router({
     method: "POST",
     path: "/organizations/:organizationId/integrations/linear/disconnect",
     pathParams: OrgIdParamsSchema,
-    body: c23.noBody(),
+    body: c24.noBody(),
     responses: {
       200: LinearIntegrationResponseSchema,
       401: ErrorResponseSchema,
@@ -33192,8 +33936,8 @@ var linearIntegrationContract = c23.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/linear-tickets.ts
-var c24 = initContract();
-var linearTicketContract = c24.router({
+var c25 = initContract();
+var linearTicketContract = c25.router({
   /**
    * Push one or more pentest findings to Linear as tickets. Customer-side
    * (VIEW_RESULTS + PENTEST capability); non-admins create into the org's
@@ -33297,8 +34041,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c25 = initContract();
-var llmProviderKeyContract = c25.router({
+var c26 = initContract();
+var llmProviderKeyContract = c26.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -33366,8 +34110,8 @@ var llmProviderKeyContract = c25.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/member.ts
-var c26 = initContract();
-var memberContract = c26.router({
+var c27 = initContract();
+var memberContract = c27.router({
   createInvitation: {
     method: "POST",
     path: "/organizations/:organizationId/members/invitations",
@@ -33386,6 +34130,299 @@ var memberContract = c26.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/oob-listener.api.ts
+var isoDate = external_exports.iso.datetime({ offset: true });
+var OobListenerParamsSchema = external_exports.object({ organizationId: external_exports.uuid(), pentestId: external_exports.uuid() });
+var OobListenerIdParamsSchema = OobListenerParamsSchema.extend({ listenerId: external_exports.uuid() });
+var OobCaptureIdParamsSchema = OobListenerIdParamsSchema.extend({ captureId: external_exports.uuid() });
+var OobCountsSchema = external_exports.strictObject({
+  normal: external_exports.number().int().nonnegative(),
+  probes: external_exports.number().int().nonnegative(),
+  pending: external_exports.number().int().nonnegative(),
+  failed: external_exports.number().int().nonnegative()
+});
+var OobProbeAttemptSchema = external_exports.strictObject({
+  probeAttemptId: external_exports.uuid(),
+  protocol: OobProtocolSchema,
+  responseVersion: external_exports.number().int().positive(),
+  issuedAt: isoDate,
+  expiresAt: isoDate,
+  result: OobProbeResultSchema,
+  verifiedCaptureId: external_exports.uuid().nullable(),
+  verifiedAt: isoDate.nullable(),
+  failureStage: external_exports.string().nullable()
+});
+var OobListenerSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid(),
+  organizationId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  label: external_exports.string(),
+  purpose: external_exports.string(),
+  httpUrl: external_exports.url(),
+  httpsUrl: external_exports.url(),
+  status: OobListenerStatusSchema,
+  health: OobListenerHealthSchema,
+  responseVersion: external_exports.number().int().positive(),
+  response: OobResponseSchema,
+  creatorAgentSessionId: external_exports.uuid().nullable(),
+  createdByStaffLabel: external_exports.string().nullable(),
+  creatorSessionStatus: AgentSessionStatus.nullable(),
+  canConfigure: external_exports.boolean(),
+  canProbe: external_exports.boolean(),
+  canClose: external_exports.boolean(),
+  maxCaptureCount: external_exports.number().int().positive(),
+  maxCaptureBytes: OobSequenceSchema,
+  admittedCaptureCount: external_exports.number().int().nonnegative(),
+  admittedBytes: OobSequenceSchema,
+  lastCaptureSeq: OobSequenceSchema,
+  counts: OobCountsSchema,
+  probes: external_exports.array(OobProbeAttemptSchema),
+  lastProbeAt: isoDate.nullable(),
+  lastProbeResponseVersion: external_exports.number().int().positive().nullable(),
+  createdAt: isoDate,
+  closedAt: isoDate.nullable(),
+  closedByActor: external_exports.string().nullable(),
+  closeReason: external_exports.string().nullable()
+});
+var CreateOobListenerRequestSchema = external_exports.strictObject({
+  requestKey: external_exports.string().min(1).max(128),
+  label: external_exports.string().trim().min(1).max(120),
+  purpose: external_exports.string().trim().min(1).max(1e3),
+  response: OobResponseSchema.optional()
+});
+var GetOobListenerRequestSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid().optional(),
+  pageToken: external_exports.string().max(2048).optional(),
+  limit: external_exports.number().int().min(1).max(50).optional()
+});
+var ConfigureOobListenerRequestSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid(),
+  expectedResponseVersion: external_exports.number().int().positive(),
+  response: OobResponseSchema
+});
+var StaffOobListenerQuotasSchema = external_exports.strictObject({
+  maxCaptureCount: external_exports.number().int().min(1).max(1e4),
+  maxCaptureBytes: external_exports.number().int().min(1).max(1073741824)
+});
+var StaffConfigureOobListenerRequestSchema = ConfigureOobListenerRequestSchema.omit({
+  listenerId: true
+}).extend({
+  reason: external_exports.string().trim().min(1).max(1e3),
+  quotas: StaffOobListenerQuotasSchema.optional()
+});
+var PollOobCallbacksRequestSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid(),
+  afterSequence: external_exports.string().max(2048).optional(),
+  limit: external_exports.number().int().min(1).max(50).optional(),
+  includeSystemProbes: external_exports.boolean().optional()
+});
+var GetOobCallbackRequestSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid(),
+  captureId: external_exports.uuid()
+});
+var ProbeOobListenerRequestSchema = external_exports.strictObject({ listenerId: external_exports.uuid() });
+var CloseOobListenerRequestSchema = external_exports.strictObject({
+  listenerId: external_exports.uuid(),
+  reason: external_exports.string().trim().min(1).max(1e3)
+});
+var RepairOobListenerRequestSchema = external_exports.strictObject({
+  pageToken: external_exports.string().max(2048).optional()
+});
+var CreateOobListenerResponseSchema = external_exports.strictObject({ listener: OobListenerSchema });
+var GetOobListenerResponseSchema = external_exports.strictObject({
+  listeners: external_exports.array(OobListenerSchema),
+  nextPageToken: external_exports.string().nullable()
+});
+var ConfigureOobListenerResponseSchema = CreateOobListenerResponseSchema;
+var ProbeOobListenerResponseSchema = CreateOobListenerResponseSchema;
+var CloseOobListenerResponseSchema = CreateOobListenerResponseSchema;
+var OobCallbackSchema = external_exports.strictObject({
+  captureId: external_exports.uuid(),
+  listenerId: external_exports.uuid(),
+  captureSeq: OobSequenceSchema,
+  status: external_exports.literal("COMPLETE"),
+  admittedAt: isoDate,
+  completedAt: isoDate,
+  protocol: OobProtocolSchema,
+  method: external_exports.string(),
+  sourceIp: external_exports.string(),
+  isSystemProbe: external_exports.boolean(),
+  probeAttemptId: external_exports.uuid().nullable(),
+  responseVersion: external_exports.number().int().positive(),
+  bodyBytes: external_exports.number().int().nonnegative(),
+  bodySha256: OobSha256Schema,
+  envelopeBytes: external_exports.number().int().positive(),
+  envelopeSha256: OobSha256Schema,
+  fidelity: external_exports.literal("collector-observed")
+});
+var PollOobCallbacksResponseSchema = external_exports.strictObject({
+  callbacks: external_exports.array(OobCallbackSchema),
+  nextCursor: external_exports.string(),
+  observedHighWater: OobSequenceSchema,
+  hasMore: external_exports.boolean(),
+  counts: OobCountsSchema,
+  health: OobListenerHealthSchema
+});
+var OobCallbackGrantSchema = OobCallbackSchema.extend({
+  organizationId: external_exports.uuid(),
+  pentestId: external_exports.uuid(),
+  url: external_exports.url(),
+  expiresAt: isoDate
+});
+var GetOobCallbackResponseSchema = OobCallbackGrantSchema;
+var RepairOobListenerResponseSchema = external_exports.strictObject({
+  nextPageToken: external_exports.string().nullable(),
+  repaired: external_exports.number().int().nonnegative(),
+  failed: external_exports.number().int().nonnegative(),
+  pending: external_exports.number().int().nonnegative(),
+  listener: OobListenerSchema
+});
+
+// ../../packages/api-contracts/src/contracts/v1/oob-listener.ts
+var c28 = initContract();
+var errors = {
+  400: ErrorResponseSchema,
+  401: ErrorResponseSchema,
+  402: ErrorResponseSchema,
+  403: ErrorResponseSchema,
+  404: ErrorResponseSchema,
+  409: ErrorResponseSchema,
+  500: ErrorResponseSchema,
+  503: ErrorResponseSchema
+};
+var staffPath = "/staff/orgs/:organizationId/pentests/:pentestId/oob-listeners";
+var oobListenerContract = c28.router({
+  list: {
+    method: "GET",
+    path: staffPath,
+    pathParams: OobListenerParamsSchema,
+    query: GetOobListenerRequestSchema.omit({ listenerId: true }).extend({
+      limit: external_exports.coerce.number().int().min(1).max(50).optional()
+    }),
+    responses: { 200: GetOobListenerResponseSchema, ...errors },
+    summary: "List callback listeners and retained history for a pentest"
+  },
+  create: {
+    method: "POST",
+    path: staffPath,
+    pathParams: OobListenerParamsSchema,
+    body: CreateOobListenerRequestSchema,
+    responses: { 201: CreateOobListenerResponseSchema, ...errors },
+    summary: "Create and probe a callback listener"
+  },
+  get: {
+    method: "GET",
+    path: `${staffPath}/:listenerId`,
+    pathParams: OobListenerIdParamsSchema,
+    responses: { 200: CreateOobListenerResponseSchema, ...errors },
+    summary: "Read callback listener state"
+  },
+  configure: {
+    method: "PATCH",
+    path: `${staffPath}/:listenerId`,
+    pathParams: OobListenerIdParamsSchema,
+    body: StaffConfigureOobListenerRequestSchema,
+    responses: { 200: ConfigureOobListenerResponseSchema, ...errors },
+    summary: "Change a callback listener static response"
+  },
+  poll: {
+    method: "GET",
+    path: `${staffPath}/:listenerId/callbacks`,
+    pathParams: OobListenerIdParamsSchema,
+    query: PollOobCallbacksRequestSchema.omit({ listenerId: true }).extend({
+      limit: external_exports.coerce.number().int().min(1).max(50).optional(),
+      includeSystemProbes: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"]).transform((value) => value === "true")]).optional()
+    }),
+    responses: { 200: PollOobCallbacksResponseSchema, ...errors },
+    summary: "Read committed callback metadata"
+  },
+  callback: {
+    method: "GET",
+    path: `${staffPath}/:listenerId/callbacks/:captureId`,
+    pathParams: OobCaptureIdParamsSchema,
+    responses: { 200: GetOobCallbackResponseSchema, ...errors },
+    summary: "Download the original callback evidence"
+  },
+  probe: {
+    method: "POST",
+    path: `${staffPath}/:listenerId/probe`,
+    pathParams: OobListenerIdParamsSchema,
+    body: external_exports.strictObject({}),
+    responses: { 200: ProbeOobListenerResponseSchema, ...errors },
+    summary: "Verify HTTP and HTTPS callback collection"
+  },
+  close: {
+    method: "POST",
+    path: `${staffPath}/:listenerId/close`,
+    pathParams: OobListenerIdParamsSchema,
+    body: CloseOobListenerRequestSchema.omit({ listenerId: true }),
+    responses: { 200: CloseOobListenerResponseSchema, ...errors },
+    summary: "Close a listener while retaining its captured history"
+  },
+  repair: {
+    method: "POST",
+    path: `${staffPath}/:listenerId/repair`,
+    pathParams: OobListenerIdParamsSchema,
+    body: RepairOobListenerRequestSchema,
+    responses: { 200: RepairOobListenerResponseSchema, ...errors },
+    summary: "Repair captures whose object persisted before indexing failed"
+  }
+});
+var runScope = { runVersion: external_exports.number().int().nonnegative() };
+var runParams = external_exports.strictObject({ agentSessionId: external_exports.uuid() });
+var internalPath = "/internal/v1/agent-sessions/:agentSessionId/oob";
+var agentSessionOobInternalContract = c28.router({
+  create: {
+    method: "POST",
+    path: `${internalPath}/create`,
+    pathParams: runParams,
+    body: CreateOobListenerRequestSchema.extend(runScope),
+    responses: { 201: CreateOobListenerResponseSchema, ...errors }
+  },
+  get: {
+    method: "POST",
+    path: `${internalPath}/get`,
+    pathParams: runParams,
+    body: GetOobListenerRequestSchema.extend(runScope),
+    responses: { 200: GetOobListenerResponseSchema, ...errors }
+  },
+  configure: {
+    method: "POST",
+    path: `${internalPath}/configure`,
+    pathParams: runParams,
+    body: ConfigureOobListenerRequestSchema.extend(runScope),
+    responses: { 200: ConfigureOobListenerResponseSchema, ...errors }
+  },
+  poll: {
+    method: "POST",
+    path: `${internalPath}/poll`,
+    pathParams: runParams,
+    body: PollOobCallbacksRequestSchema.extend(runScope),
+    responses: { 200: PollOobCallbacksResponseSchema, ...errors }
+  },
+  callback: {
+    method: "POST",
+    path: `${internalPath}/callback`,
+    pathParams: runParams,
+    body: GetOobCallbackRequestSchema.extend(runScope),
+    responses: { 200: GetOobCallbackResponseSchema, ...errors }
+  },
+  probe: {
+    method: "POST",
+    path: `${internalPath}/probe`,
+    pathParams: runParams,
+    body: ProbeOobListenerRequestSchema.extend(runScope),
+    responses: { 200: ProbeOobListenerResponseSchema, ...errors }
+  },
+  close: {
+    method: "POST",
+    path: `${internalPath}/close`,
+    pathParams: runParams,
+    body: CloseOobListenerRequestSchema.extend(runScope),
+    responses: { 200: CloseOobListenerResponseSchema, ...errors }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/organization.api.ts
 var OrgCapabilityValues = [
   "PENTEST",
@@ -33831,8 +34868,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c27 = initContract();
-var organizationContract = c27.router({
+var c29 = initContract();
+var organizationContract = c29.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -34301,7 +35338,7 @@ var organizationContract = c27.router({
     method: "POST",
     path: "/organizations/:organizationId/logos-from-homepage",
     pathParams: OrgIdParamsSchema,
-    body: c27.type(),
+    body: c29.type(),
     responses: {
       200: OrganizationResponseSchema,
       // 400 — no homepage set on the organization.
@@ -34317,8 +35354,8 @@ var organizationContract = c27.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/payment-card.ts
-var c28 = initContract();
-var paymentCardContract = c28.router({
+var c30 = initContract();
+var paymentCardContract = c30.router({
   listPaymentCards: {
     method: "GET",
     path: "/staff/payment-cards",
@@ -34667,8 +35704,8 @@ var ScanReuseSuggestionsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c29 = initContract();
-var pentestContract = c29.router({
+var c31 = initContract();
+var pentestContract = c31.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -34978,8 +36015,8 @@ var pentestContract = c29.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attack-chain.ts
-var c30 = initContract();
-var pentestAttackChainContract = c30.router({
+var c32 = initContract();
+var pentestAttackChainContract = c32.router({
   listAttackChains: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains",
@@ -35098,7 +36135,7 @@ var pentestAttackChainContract = c30.router({
     method: "DELETE",
     path: "/organizations/:organizationId/pentests/:pentestId/attack-chains/:attackChainId",
     pathParams: PentestAttackChainIdParamsSchema,
-    body: c30.noBody(),
+    body: c32.noBody(),
     responses: {
       200: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -35259,8 +36296,8 @@ var ReadAttestationDownloadResponseSchema = external_exports.union([
 ]);
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-attestation.ts
-var c31 = initContract();
-var pentestAttestationContract = c31.router({
+var c33 = initContract();
+var pentestAttestationContract = c33.router({
   getDefaults: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/attestations/defaults",
@@ -35403,8 +36440,8 @@ var ListPentestAuditLogResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-audit-log.ts
-var c32 = initContract();
-var pentestAuditLogContract = c32.router({
+var c34 = initContract();
+var pentestAuditLogContract = c34.router({
   listAuditLog: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/audit-log",
@@ -35451,8 +36488,8 @@ var CreatePentestAuthorizedDomainRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-authorized-domain.ts
-var c33 = initContract();
-var pentestAuthorizedDomainContract = c33.router({
+var c35 = initContract();
+var pentestAuthorizedDomainContract = c35.router({
   getPentestAuthorizedScope: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/authorized-scope",
@@ -35500,14 +36537,118 @@ var pentestAuthorizedDomainContract = c33.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/pentest-coverage.api.ts
+var CoverageTaxonomyValues = ["GENERAL", "LLM", "DESKTOP", "RECON", "OTHER"];
+var CoverageTaxonomySchema = external_exports.enum(CoverageTaxonomyValues);
+var CoverageStatusValues = [
+  "COVERED",
+  "PARTIAL",
+  "NOT_COVERED",
+  "NOT_APPLICABLE"
+];
+var CoverageStatusSchema = external_exports.enum(CoverageStatusValues);
+var CoverageRelevanceValues = ["CRITICAL", "HIGH", "MEDIUM", "NOT_APPLICABLE"];
+var CoverageRelevanceSchema = external_exports.enum(CoverageRelevanceValues);
+var CoverageFamilyValues = ["CODE_REVIEW", "RECON", "ASSESSMENT"];
+var CoverageFamilySchema = external_exports.enum(CoverageFamilyValues);
+var CoverageGridParamsSchema = OrgIdParamsSchema.extend({
+  pentestId: PentestIdOrDisplayIdSchema
+});
+var CoverageContributorSchema = external_exports.object({
+  agentSessionId: external_exports.uuid(),
+  sessionType: CoverageFamilySchema,
+  /** As this session named the class; differs from the row's name when sessions disagree. */
+  className: external_exports.string(),
+  status: CoverageStatusSchema,
+  relevance: CoverageRelevanceSchema,
+  notes: external_exports.string(),
+  mappings: external_exports.array(external_exports.string()),
+  recordedAt: external_exports.coerce.date(),
+  /** The session is still running, so its next write replaces this entry. */
+  inProgress: external_exports.boolean()
+});
+var CoverageClassRowSchema = external_exports.object({
+  /** Stable within a response and across refetches: family, taxonomy, class id, and the split name. */
+  rowKey: external_exports.string(),
+  taxonomy: CoverageTaxonomySchema,
+  classId: external_exports.string(),
+  /** The newest contributor's name. */
+  className: external_exports.string(),
+  /** Best status any contributor reached; NOT_APPLICABLE only when every contributor says so. */
+  rolledUpStatus: CoverageStatusSchema,
+  maxRelevance: CoverageRelevanceSchema,
+  /** Contributors recorded more than one status. */
+  disagreement: external_exports.boolean(),
+  /**
+   * One session sent this class id for more than one class, so the id was split by class name.
+   * Free-text ids only; canonical ids end it.
+   */
+  sharedId: external_exports.boolean(),
+  /** Newest first. */
+  contributors: external_exports.array(CoverageContributorSchema)
+});
+var CoverageFamilyBandSchema = external_exports.object({
+  family: CoverageFamilySchema,
+  rows: external_exports.array(CoverageClassRowSchema)
+});
+var CoverageGridResponseSchema = external_exports.object({
+  /** Families with at least one row, in CoverageFamilyValues order. */
+  bands: external_exports.array(CoverageFamilyBandSchema),
+  /** Rows per rolled-up status, across every band. */
+  summary: external_exports.object({
+    COVERED: external_exports.number().int().nonnegative(),
+    PARTIAL: external_exports.number().int().nonnegative(),
+    NOT_COVERED: external_exports.number().int().nonnegative(),
+    NOT_APPLICABLE: external_exports.number().int().nonnegative()
+  }),
+  /** Sessions with rows, newest recording first. */
+  sessions: external_exports.array(
+    external_exports.object({
+      agentSessionId: external_exports.uuid(),
+      sessionType: CoverageFamilySchema,
+      status: AgentSessionStatus,
+      entryCount: external_exports.number().int().nonnegative(),
+      lastRecordedAt: external_exports.coerce.date()
+    })
+  ),
+  /**
+   * Sessions that recorded coverage into their transcript before coverage moved to the
+   * database. A session resumed across that change appears here and in `sessions`.
+   */
+  legacyCoverageSessions: external_exports.array(
+    external_exports.object({
+      agentSessionId: external_exports.uuid(),
+      sessionType: CoverageFamilySchema,
+      lastRecordedAt: external_exports.coerce.date()
+    })
+  )
+});
+
+// ../../packages/api-contracts/src/contracts/v1/pentest-coverage.ts
+var c36 = initContract();
+var pentestCoverageContract = c36.router({
+  getCoverageGrid: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/coverage",
+    pathParams: CoverageGridParamsSchema,
+    responses: {
+      200: CoverageGridResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/pentest-egress.api.ts
 var PentestEgressResponseSchema = external_exports.object({
   publicIp: external_exports.string().nullable()
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-egress.ts
-var c34 = initContract();
-var pentestEgressContract = c34.router({
+var c37 = initContract();
+var pentestEgressContract = c37.router({
   getPentestEgress: {
     method: "GET",
     path: "/staff/pentest-egress",
@@ -35546,8 +36687,8 @@ var CreatePentestEngagementExclusionRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-engagement-exclusion.ts
-var c35 = initContract();
-var pentestEngagementExclusionContract = c35.router({
+var c38 = initContract();
+var pentestEngagementExclusionContract = c38.router({
   listPentestEngagementExclusions: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/engagement-exclusions",
@@ -35611,8 +36752,8 @@ var CreatePentestEnvironmentRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-environment.ts
-var c36 = initContract();
-var pentestEnvironmentContract = c36.router({
+var c39 = initContract();
+var pentestEnvironmentContract = c39.router({
   listPentestEnvironments: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/environments",
@@ -35661,8 +36802,8 @@ var pentestEnvironmentContract = c36.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c37 = initContract();
-var pentestFindingContract = c37.router({
+var c40 = initContract();
+var pentestFindingContract = c40.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -36331,8 +37472,8 @@ var pentestFindingContract = c37.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-hypothesis.ts
-var c38 = initContract();
-var pentestHypothesisContract = c38.router({
+var c41 = initContract();
+var pentestHypothesisContract = c41.router({
   listHypotheses: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/hypotheses",
@@ -36487,8 +37628,8 @@ var DownloadPentestIntakeDocumentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-intake-document.ts
-var c39 = initContract();
-var pentestIntakeDocumentContract = c39.router({
+var c42 = initContract();
+var pentestIntakeDocumentContract = c42.router({
   listDocuments: {
     method: "GET",
     path: "/organizations/:organizationId/customer-pentests/:pentestId/questionnaire/documents",
@@ -36574,8 +37715,8 @@ var pentestIntakeDocumentContract = c39.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-manual-finding.ts
-var c40 = initContract();
-var pentestManualFindingContract = c40.router({
+var c43 = initContract();
+var pentestManualFindingContract = c43.router({
   listManualFindings: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/manual-findings",
@@ -36662,8 +37803,8 @@ var pentestManualFindingContract = c40.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-purchase.ts
-var c41 = initContract();
-var pentestPurchaseContract = c41.router({
+var c44 = initContract();
+var pentestPurchaseContract = c44.router({
   listPurchases: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/purchases",
@@ -36695,8 +37836,8 @@ var pentestPurchaseContract = c41.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-report-pdf.ts
-var c42 = initContract();
-var pentestReportPdfContract = c42.router({
+var c45 = initContract();
+var pentestReportPdfContract = c45.router({
   getCurrent: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/report-pdf",
@@ -36789,7 +37930,7 @@ var pentestReportPdfContract = c42.router({
     // No body: the render always reads current DB state (cover derived via
     // deriveReportCover(), narrative/scope from the row's columns). The legacy
     // dialog payload was retired with the Generate dialog (report-session RS5).
-    body: c42.noBody(),
+    body: c45.noBody(),
     responses: {
       202: StartReportPdfGenerationTaskResponseSchema,
       400: ErrorResponseSchema,
@@ -36986,9 +38127,87 @@ var pentestReportPdfContract = c42.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/pentest-tag.ts
+var c46 = initContract();
+var pentestTagContract = c46.router({
+  listPentestTags: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/tags",
+    pathParams: PentestTagsParamsSchema,
+    responses: {
+      200: ListPentestTagsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createPentestTag: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/tags",
+    pathParams: PentestTagsParamsSchema,
+    body: CreatePentestTagRequestSchema,
+    responses: {
+      201: PentestTagResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // PENTEST_TAG_NAME_TAKEN (case-insensitive duplicate) or PENTEST_TAG_LIMIT.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updatePentestTag: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/pentests/:pentestId/tags/:pentestTagId",
+    pathParams: PentestTagIdParamsSchema,
+    body: UpdatePentestTagRequestSchema,
+    responses: {
+      200: PentestTagResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  deletePentestTag: {
+    method: "DELETE",
+    path: "/organizations/:organizationId/pentests/:pentestId/tags/:pentestTagId",
+    pathParams: PentestTagIdParamsSchema,
+    responses: {
+      204: DeleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  // Replaces the finding's tag set. Lives beside the tag routes rather than on
+  // `updateFinding` so the classification write has its own audit reason and
+  // never rides along with (or invalidates) a prose or status edit.
+  setPentestFindingTags: {
+    method: "PUT",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId/tags",
+    pathParams: PentestFindingIdParamsSchema,
+    body: SetPentestFindingTagsRequestSchema,
+    responses: {
+      200: PentestFindingResponseSchema,
+      // PENTEST_TAG_NOT_ON_ENGAGEMENT when an id belongs to another engagement or does not exist.
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/pentest-validation.ts
-var c43 = initContract();
-var pentestValidationContract = c43.router({
+var c47 = initContract();
+var pentestValidationContract = c47.router({
   listValidationRuns: {
     method: "GET",
     path: "/organizations/:organizationId/pentests/:pentestId/validation-runs",
@@ -37096,8 +38315,8 @@ var pentestValidationContract = c43.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c44 = initContract();
-var repositoryContract = c44.router({
+var c48 = initContract();
+var repositoryContract = c48.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -37302,7 +38521,7 @@ var repositoryContract = c44.router({
     method: "POST",
     path: "/organizations/:organizationId/repositories/scanning-branch/confirm-defaults",
     pathParams: OrgIdParamsSchema,
-    body: c44.noBody(),
+    body: c48.noBody(),
     responses: {
       200: ConfirmScanningBranchDefaultsResponseSchema,
       401: ErrorResponseSchema,
@@ -37436,8 +38655,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c45 = initContract();
-var scanContract = c45.router({
+var c49 = initContract();
+var scanContract = c49.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -37558,8 +38777,8 @@ var StaffPentestStatsResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentest-stats.ts
-var c46 = initContract();
-var staffPentestStatsContract = c46.router({
+var c50 = initContract();
+var staffPentestStatsContract = c50.router({
   getStaffPentestStats: {
     method: "GET",
     path: "/staff/pentest-stats",
@@ -37605,8 +38824,8 @@ var RenameStaffOrganizationPentestRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
-var c47 = initContract();
-var staffPentestsContract = c47.router({
+var c51 = initContract();
+var staffPentestsContract = c51.router({
   listStaffOrganizationPentests: {
     method: "GET",
     path: "/organizations/:organizationId/staff/pentests",
@@ -37773,8 +38992,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c48 = initContract();
-var staffQueueContract = c48.router({
+var c52 = initContract();
+var staffQueueContract = c52.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -37838,8 +39057,8 @@ var UpdateTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c49 = initContract();
-var testIntegrationContract = c49.router({
+var c53 = initContract();
+var testIntegrationContract = c53.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -37919,7 +39138,7 @@ var testIntegrationContract = c49.router({
     method: "POST",
     path: "/staff/test-integrations/:testIntegrationId/mfa/code",
     pathParams: TestIntegrationIdParamsSchema,
-    body: c49.noBody(),
+    body: c53.noBody(),
     responses: {
       200: CredentialMfaCodeResponseSchema,
       401: ErrorResponseSchema,
@@ -38030,8 +39249,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c50 = initContract();
-var userContract = c50.router({
+var c54 = initContract();
+var userContract = c54.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -38146,8 +39365,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c51 = initContract();
-var vantaIntegrationContract = c51.router({
+var c55 = initContract();
+var vantaIntegrationContract = c55.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -38231,6 +39450,7 @@ var VulnerabilityCodeSnippetSchema = external_exports.object({
   endLine: external_exports.number().nullable(),
   snippet: external_exports.string().nullable()
 });
+var FindingReachabilitySchema = external_exports.enum(["reachable", "unreachable"]);
 var VulnerabilityLatestFindingSchema = external_exports.object({
   attackVector: external_exports.string(),
   exploitScenario: external_exports.string(),
@@ -38275,6 +39495,12 @@ var VulnerabilityResponseSchema = external_exports.object({
   codeSnippet: VulnerabilityCodeSnippetSchema,
   explanation: external_exports.string().nullable(),
   latestFinding: VulnerabilityLatestFindingSchema.nullable(),
+  /**
+   * The scanning branch's latest reachability verdict; the dashboard list
+   * filters and tags by it. Null when that branch has not assessed it (reads
+   * as reachable). PR surfaces read `latestFinding.reachability` instead.
+   */
+  scanningBranchReachability: FindingReachabilitySchema.nullable(),
   dependencyGraph: DependencyGraphSchema.nullable(),
   firstDetectedAt: external_exports.coerce.date(),
   lastDetectedAt: external_exports.coerce.date(),
@@ -38314,6 +39540,11 @@ var VulnerabilityFilterRequestSchema = external_exports.object({
    * no branch set are also included to preserve pre-per-branch-labeling rows.
    */
   scanningBranchOnly: external_exports.boolean().default(false).optional(),
+  /**
+   * Restrict to one side of the reachability verdict; omit for both.
+   * `reachable` includes findings no scan assessed.
+   */
+  reachability: FindingReachabilitySchema.optional(),
   page: external_exports.number().int().min(1).default(1).optional(),
   pageSize: external_exports.number().int().min(1).max(200).default(25).optional(),
   sortBy: external_exports.enum(["severity", "status", "createdAt", "updatedAt", "title"]).default("createdAt").optional(),
@@ -38326,6 +39557,11 @@ var VulnerabilityStatusGroupSchema = external_exports.object({
 });
 var FilterVulnerabilitiesResponseSchema = external_exports.object({
   total: external_exports.number(),
+  /**
+   * Unreachable vulnerabilities that match every other filter and the search,
+   * left out because `reachability` was `reachable`. Zero otherwise.
+   */
+  hiddenUnreachableCount: external_exports.number(),
   page: external_exports.number(),
   pageSize: external_exports.number(),
   statusGroups: external_exports.array(VulnerabilityStatusGroupSchema)
@@ -38360,7 +39596,9 @@ var VulnerabilityAggregatedCountsRequestSchema = external_exports.object({
   /** Lower bound for time-series data. Only vulnerabilities created on or after this date are included in the timeSeries field. Does not affect byRepoAndSeverity or byStatusAndSeverity. */
   timeSeriesSince: external_exports.coerce.date().optional(),
   /** When provided, only include vulnerabilities belonging to this repository. */
-  repositoryId: external_exports.uuid().optional()
+  repositoryId: external_exports.uuid().optional(),
+  /** Restrict every count to one side of the reachability verdict; omit for both. */
+  reachability: FindingReachabilitySchema.optional()
 });
 var VulnerabilityAggregatedCountsResponseSchema = external_exports.object({
   byRepoAndSeverity: external_exports.array(RepoSeverityCountSchema),
@@ -38489,8 +39727,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c52 = initContract();
-var vulnerabilityContract = c52.router({
+var c56 = initContract();
+var vulnerabilityContract = c56.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -38715,8 +39953,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c53 = initContract();
-var vulnerabilityNoteContract = c53.router({
+var c57 = initContract();
+var vulnerabilityNoteContract = c57.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -38897,8 +40135,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c54 = initContract();
-var webhookSettingsContract = c54.router({
+var c58 = initContract();
+var webhookSettingsContract = c58.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -39036,8 +40274,8 @@ var webhookSettingsContract = c54.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c55 = initContract();
-var v1Contract = c55.router(
+var c59 = initContract();
+var v1Contract = c59.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -39045,6 +40283,7 @@ var v1Contract = c55.router(
     codeUpload: codeUploadContract,
     scan: scanContract,
     organization: organizationContract,
+    oobListener: oobListenerContract,
     user: userContract,
     repository: repositoryContract,
     github: githubContract,
@@ -39071,9 +40310,12 @@ var v1Contract = c55.router(
     pentestManualFinding: pentestManualFindingContract,
     pentestAuditLog: pentestAuditLogContract,
     pentestEnvironment: pentestEnvironmentContract,
+    applicationSurfaceMap: applicationSurfaceMapContract,
+    pentestCoverage: pentestCoverageContract,
     pentestEngagementExclusion: pentestEngagementExclusionContract,
     pentestAuthorizedDomain: pentestAuthorizedDomainContract,
     pentestFinding: pentestFindingContract,
+    pentestTag: pentestTagContract,
     pentestAttackChain: pentestAttackChainContract,
     pentestHypothesis: pentestHypothesisContract,
     pentestValidation: pentestValidationContract,
@@ -39100,13 +40342,13 @@ var v1Contract = c55.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c56 = initContract();
-var contract = c56.router({
+var c60 = initContract();
+var contract = c60.router({
   v1: v1Contract
 });
 
 // ../../packages/api-contracts/src/contracts/v1/desktop-host-internal.ts
-var c57 = initContract();
+var c61 = initContract();
 var MAX_VMS_PER_SYNC = 16;
 var DesktopHostSyncRequestSchema = external_exports.object({
   /** Integer protocol the runner speaks. Below the api's minimum, the host gets
@@ -39131,7 +40373,7 @@ var DesktopHostSyncResponseSchema = external_exports.object({
    *  id not listed here is deleted. */
   targets: external_exports.array(DesktopHostSyncTargetSchema).max(MAX_VMS_PER_SYNC)
 });
-var desktopHostInternalContract = c57.router({
+var desktopHostInternalContract = c61.router({
   sync: {
     method: "POST",
     path: "/internal/v1/desktop-hosts/sync",
@@ -39152,8 +40394,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c58 = initContract();
-var githubWebhookContract = c58.router(
+var c62 = initContract();
+var githubWebhookContract = c62.router(
   {
     handleWebhook: {
       method: "POST",
@@ -39171,7 +40413,7 @@ var githubWebhookContract = c58.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c58.router(
+var githubReadonlyWebhookContract = c62.router(
   {
     handleWebhook: {
       method: "POST",
@@ -39191,9 +40433,9 @@ var githubReadonlyWebhookContract = c58.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c59 = initContract();
+var c63 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c59.router(
+var linearWebhookContract = c63.router(
   {
     handleWebhook: {
       method: "POST",
@@ -39213,7 +40455,7 @@ var linearWebhookContract = c59.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c60 = initContract();
+var c64 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -39242,7 +40484,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c60.router(
+var forgeBitbucketContract = c64.router(
   {
     lifecycle: {
       method: "POST",
@@ -39289,8 +40531,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c61 = initContract();
-var healthContract = c61.router({
+var c65 = initContract();
+var healthContract = c65.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -39302,8 +40544,8 @@ var healthContract = c61.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c62 = initContract();
-var vulnerabilityShareContract = c62.router(
+var c66 = initContract();
+var vulnerabilityShareContract = c66.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -39390,8 +40632,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c63 = initContract();
-var prVulnerabilityContract = c63.router(
+var c67 = initContract();
+var prVulnerabilityContract = c67.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -42317,12 +43559,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c65) => c65.type.length));
+  const idWidth = Math.max(2, ...cells.map((c69) => c69.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c69) => c69.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c69) => c69.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.name.padEnd(nameWidth)}  ${c65.type.padEnd(typeWidth)}  ${c65.repos.padStart(5)}  ${c65.url}`
+    (c69) => `${c69.id.padEnd(idWidth)}  ${c69.name.padEnd(nameWidth)}  ${c69.type.padEnd(typeWidth)}  ${c69.repos.padStart(5)}  ${c69.url}`
   );
   return { header, rows };
 }
@@ -42342,12 +43584,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c65) => c65.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c65) => c65.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c65) => c65.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c69) => c69.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c69) => c69.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c69) => c69.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.scan.padEnd(4)}  ${c65.role.padEnd(roleWidth)}  ${c65.path.padEnd(pathWidth)}  ${c65.status}`
+    (c69) => `${c69.name.padEnd(nameWidth)}  ${c69.scan.padEnd(4)}  ${c69.role.padEnd(roleWidth)}  ${c69.path.padEnd(pathWidth)}  ${c69.status}`
   );
   return { header, rows };
 }
@@ -43132,8 +44374,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c65, i2, m2) => {
-    const d = n3 ? n3(c65, i2) : c65;
+`).map((c69, i2, m2) => {
+    const d = n3 ? n3(c69, i2) : c69;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -43631,14 +44873,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c65 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c69 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c65 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c65 ? 1 : 0);
+  d && g++, c69 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c69 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -43659,14 +44901,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c65 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c65 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c69 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c69 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c69 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c65 && x.push(M), x;
+  return c69 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -43685,15 +44927,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c65 = this.value ? a2 : s;
+`, c69 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c65)}`;
+          return `${o2}${r2}${styleText2("dim", c69)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c65)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c69)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -43841,13 +45083,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c65 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c69 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c65}
+${u4}  ${styleText2("yellow", this.error)}${c69}
 `;
       }
       case "submit": {
@@ -43875,7 +45117,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c65}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c65}
+${r2}${c69}
 `;
       }
     }
@@ -43890,7 +45132,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c65 = this.userInputWithCursor, i2 = this.masked;
+`, c69 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -43910,7 +45152,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c65}
+        return `${o2}${s}${c69}
 ${n3}
 `;
       }
@@ -43926,7 +45168,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c64 = (t2, o2) => t2.includes(`
+var c68 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -43937,15 +45179,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c68(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c64(s, (i2) => styleText2("dim", i2))}`;
+        return `${c68(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c64(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c68(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c64(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c68(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -44004,6 +45246,124 @@ ${b}
 };
 var i = `${styleText2("gray", S_BAR)}  `;
 
+// src/org/invite.ts
+var MEMBER_ROLE_SLUGS = MemberRoleSlugSchema.options;
+var DEFAULT_INVITE_ROLE = CreateMemberInvitationRequestSchema.shape.roleSlug.parse(void 0);
+var InviteEmailSchema = CreateMemberInvitationRequestSchema.shape.email;
+function planInvite(emailArg, options) {
+  const email3 = emailArg.trim();
+  if (email3.length === 0) {
+    return { error: "Email is required." };
+  }
+  if (!InviteEmailSchema.safeParse(email3).success) {
+    return { error: `'${sanitizeDisplay(email3)}' is not a valid email address.` };
+  }
+  const role = options.role.trim().toLowerCase();
+  const parsedRole = MemberRoleSlugSchema.safeParse(role);
+  if (!parsedRole.success) {
+    return {
+      error: `Invalid --role '${sanitizeDisplay(options.role)}'. Use one of: ${MEMBER_ROLE_SLUGS.join(", ")}.`
+    };
+  }
+  return { plan: { email: email3, roleSlug: parsedRole.data } };
+}
+function failInvite(status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    const hint = "Inviting members requires an organization admin or analyst signed in with `tracecli auth login` (API keys are rejected).";
+    console.error(
+      colorError(message === void 0 || message === "Insufficient permissions" ? hint : message)
+    );
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(
+      colorError(message ?? "This person is already a member or already has a pending invitation.")
+    );
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Member invitations are not available in this environment.")
+    );
+    process.exit(1);
+  }
+  if (status === 400 || status === 404 || status === 422) {
+    console.error(colorError(message ?? `Failed to send invitation (status ${status}).`));
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to send invitation (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function outputInvitation(invitation, output) {
+  if (output === "json") {
+    printJson(invitation);
+    return;
+  }
+  if (output === "tsv") {
+    console.log("invitationId	email	roleSlug");
+    console.log(
+      [
+        tsvSafe(sanitizeDisplay(invitation.invitationId)),
+        tsvSafe(formulaSafe(sanitizeDisplay(invitation.email))),
+        tsvSafe(sanitizeDisplay(invitation.roleSlug))
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Invitation sent to ${sanitizeDisplay(invitation.email)} as ${sanitizeDisplay(invitation.roleSlug)}`
+    )
+  );
+  console.log(`  Invitation ID: ${sanitizeDisplay(invitation.invitationId)}`);
+}
+async function runInvite(emailArg, options) {
+  const output = parseOutput(options.output);
+  const planned = planInvite(emailArg, options);
+  if ("error" in planned) {
+    console.error(colorError(planned.error));
+    process.exit(1);
+  }
+  const { plan } = planned;
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.member.createInvitation({
+      params: { organizationId },
+      body: { email: plan.email, roleSlug: plan.roleSlug }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failInvite(result.status, result.body);
+  }
+  outputInvitation(result.body, output);
+}
+function createOrgInviteCommand() {
+  return new Command("invite").description("Invite someone to the active organization by email").argument("<email>", "Email address to invite").option(
+    "-r, --role <role>",
+    `Role to grant: ${MEMBER_ROLE_SLUGS.join(", ")}`,
+    DEFAULT_INVITE_ROLE
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Sends the same invitation email as the dashboard's Settings > Members page.
+Requires an organization admin or analyst signed in with \`tracecli auth login\`;
+API keys are rejected. Only admins can invite someone as an admin.
+
+Examples:
+  tracecli org invite dev@acme.com
+  tracecli org invite sec@acme.com --role analyst
+  tracecli org invite cto@acme.com --role admin --output json`
+  ).action(async (email3, options) => {
+    await runInvite(email3, options);
+  });
+}
+
 // src/org/update.ts
 import { readFileSync as readFileSync2, statSync } from "fs";
 import { basename, extname } from "path";
@@ -45094,6 +46454,7 @@ function createOrgCommand() {
   org.addCommand(createOrgCurrentCommand());
   org.addCommand(createOrgSwitchCommand());
   org.addCommand(createOrgUpdateCommand());
+  org.addCommand(createOrgInviteCommand());
   return org;
 }
 function createAuthCommand() {
@@ -45323,7 +46684,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c65) => !c65._hidden).map((c65) => extractCommandTree(c65));
+  const subcommands = cmd.commands.filter((c69) => !c69._hidden).map((c69) => extractCommandTree(c69));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -45389,7 +46750,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c65) => c65.name);
+  const subcommandNames = tree.subcommands.map((c69) => c69.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -45804,9 +47165,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c65) => c65.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c69) => c69.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c65) => `${c65.address.padEnd(addressWidth)}  ${c65.label}`);
+  const rows = cells.map((c69) => `${c69.address.padEnd(addressWidth)}  ${c69.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -45830,14 +47191,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c65) => c65.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c65) => c65.from.length));
-  const toWidth = Math.max(2, ...cells.map((c65) => c65.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c65) => c65.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c69) => c69.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c69) => c69.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c69) => c69.from.length));
+  const toWidth = Math.max(2, ...cells.map((c69) => c69.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c69) => c69.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.received.padEnd(receivedWidth)}  ${c65.from.padEnd(fromWidth)}  ${c65.to.padEnd(toWidth)}  ${c65.subject.padEnd(subjectWidth)}  ${c65.unread}`
+    (c69) => `${c69.id.padEnd(idWidth)}  ${c69.received.padEnd(receivedWidth)}  ${c69.from.padEnd(fromWidth)}  ${c69.to.padEnd(toWidth)}  ${c69.subject.padEnd(subjectWidth)}  ${c69.unread}`
   );
   return { header, rows };
 }
@@ -46612,16 +47973,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c65) => ({
-    id: c65.credentialId,
-    label: sanitizeDisplay(c65.label),
-    type: c65.credentialType
+  const cells = creds.map((c69) => ({
+    id: c69.credentialId,
+    label: sanitizeDisplay(c69.label),
+    type: c69.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c65) => c65.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c65) => c65.label.length));
+  const idWidth = Math.max(2, ...cells.map((c69) => c69.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c69) => c69.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c65) => `${c65.id.padEnd(idWidth)}  ${c65.label.padEnd(labelWidth)}  ${c65.type}`
+    (c69) => `${c69.id.padEnd(idWidth)}  ${c69.label.padEnd(labelWidth)}  ${c69.type}`
   );
   return { header, rows };
 }
@@ -47391,14 +48752,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c65) => c65.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c69) => c69.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c69) => c69.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c65) => c65.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c69) => c69.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c65) => `${padLeading(c65.leading)}  ${c65.name.padEnd(nameWidth)}  ${c65.prod.padEnd(4)}  ${c65.url}`
+      (c69) => `${padLeading(c69.leading)}  ${c69.name.padEnd(nameWidth)}  ${c69.prod.padEnd(4)}  ${c69.url}`
     )
   };
 }
@@ -49441,6 +50802,10 @@ function formatFindingMarkdown(finding) {
   if (finding.owaspCategory) {
     lines.push(`- OWASP: ${sanitizeDisplay(finding.owaspCategory)}`);
   }
+  const tags = finding.tags ?? [];
+  if (tags.length > 0) {
+    lines.push(`- Tags: ${tags.map((tag) => sanitizeDisplay(tag.name)).join(", ")}`);
+  }
   if (finding.cvssScore !== null || finding.cvssVector) {
     const parts = [
       finding.cvssScore !== null ? String(finding.cvssScore) : null,
@@ -51826,13 +53191,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c65) => c65.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c65) => c65.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c65) => c65.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c65) => c65.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c69) => c69.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c69) => c69.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c69) => c69.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c69) => c69.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c65) => `${c65.name.padEnd(nameWidth)}  ${c65.kind.padEnd(kindWidth)}  ${c65.status.padEnd(statusWidth)}  ${c65.size.padEnd(sizeWidth)}  ${c65.id}`
+    (c69) => `${c69.name.padEnd(nameWidth)}  ${c69.kind.padEnd(kindWidth)}  ${c69.status.padEnd(statusWidth)}  ${c69.size.padEnd(sizeWidth)}  ${c69.id}`
   );
   return { header, rows };
 }