securewithtrace 0.49.0 → 0.50.0

package/dist/index.js

@@ -6283,7 +6283,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base644 = data.replace(/[-_]/g, (c83) => c83 === "-" ? "+" : "/");
+  const base644 = data.replace(/[-_]/g, (c84) => c84 === "-" ? "+" : "/");
   const padded = base644.padEnd(Math.ceil(base644.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16327,9 +16327,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params3) => dateProcessor(inst, ctx, json2, params3);
   inst.min = (value, params3) => inst.check(_gte(value, params3));
   inst.max = (value, params3) => inst.check(_lte(value, params3));
-  const c83 = inst._zod.bag;
-  inst.minDate = c83.minimum ? new Date(c83.minimum) : null;
-  inst.maxDate = c83.maximum ? new Date(c83.maximum) : null;
+  const c84 = inst._zod.bag;
+  inst.minDate = c84.minimum ? new Date(c84.minimum) : null;
+  inst.maxDate = c84.maximum ? new Date(c84.maximum) : null;
 });
 function date3(params3) {
   return _date(ZodDate, params3);
@@ -18329,6 +18329,8 @@ var STAFF_NOTIFICATION_TOOLSET_VERSIONS = /* @__PURE__ */ new Set([
   // API_COVERAGE_TOOLSET_VERSION and its predecessor, written out because they are declared below.
   "api-coverage-tools-v1",
   "api-coverage-tools-v2",
+  // SETUP_TOOLSET_VERSION, written out for the same reason.
+  "setup-tools-v1",
   ...STAFF_NOTIFICATION_OOB_PROFILE_SUCCESSIONS.flatMap(({ successor, predecessor }) => [
     predecessor.toolsetVersion,
     successor.toolsetVersion
@@ -18654,6 +18656,21 @@ var PENTEST_CUSTOMER_INTAKE_QUESTIONS = [
   }
 ];
 var PENTEST_CUSTOMER_INTAKE_QUESTION_COUNT = PENTEST_CUSTOMER_INTAKE_QUESTIONS.length;
+function isIntakeAnswerPresent(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  return true;
+}
+function countAnsweredIntakeQuestions(answers) {
+  if (!answers) return 0;
+  let answered = 0;
+  for (const question of PENTEST_CUSTOMER_INTAKE_QUESTIONS) {
+    const keys = question.kind === "multiSelect" ? [question.key, question.notesKey] : [question.key];
+    if (keys.some((key) => isIntakeAnswerPresent(answers[key]))) answered += 1;
+  }
+  return answered;
+}
 var INTAKE_ISSUE_CLASS_LABELS = {
   AUTHN_BYPASS: "Authn bypass",
   AUTHZ_IDOR: "Broken access control",
@@ -21924,23 +21941,23 @@ var ZodEffects = class extends ZodType2 {
     }
     if (effect.type === "transform") {
       if (ctx.common.async === false) {
-        const base2 = this._def.schema._parseSync({
+        const base3 = this._def.schema._parseSync({
           data: ctx.data,
           path: ctx.path,
           parent: ctx
         });
-        if (!isValid(base2))
-          return base2;
-        const result = effect.transform(base2.value, checkCtx);
+        if (!isValid(base3))
+          return base3;
+        const result = effect.transform(base3.value, checkCtx);
         if (result instanceof Promise) {
           throw new Error(`Asynchronous transform encountered during synchronous parse operation. Use .parseAsync instead.`);
         }
         return { status: status.value, value: result };
       } else {
-        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base2) => {
-          if (!isValid(base2))
-            return base2;
-          return Promise.resolve(effect.transform(base2.value, checkCtx)).then((result) => ({ status: status.value, value: result }));
+        return this._def.schema._parseAsync({ data: ctx.data, path: ctx.path, parent: ctx }).then((base3) => {
+          if (!isValid(base3))
+            return base3;
+          return Promise.resolve(effect.transform(base3.value, checkCtx)).then((result) => ({ status: status.value, value: result }));
         });
       }
     }
@@ -22598,8 +22615,8 @@ var initContract = () => {
   };
 };
 var insertParamsIntoPath = ({ path: path3, params: params3 }) => {
-  const pathParams2 = params3;
-  return path3.replace(/\/?:([^/?]+)\??/g, (matched, p) => pathParams2[p] ? `${matched.startsWith("/") ? "/" : ""}${pathParams2[p]}` : "");
+  const pathParams3 = params3;
+  return path3.replace(/\/?:([^/?]+)\??/g, (matched, p) => pathParams3[p] ? `${matched.startsWith("/") ? "/" : ""}${pathParams3[p]}` : "");
 };
 var convertQueryParamsToUrlString = (query, json2 = false) => {
   const queryString = json2 ? encodeQueryParamsJson(query) : encodeQueryParams(query);
@@ -23172,9 +23189,16 @@ var AgentSessionTypeValues = [
   "ASSESSMENT",
   "COORDINATOR",
   "REMEDIATION",
-  "API_COVERAGE"
+  "API_COVERAGE",
+  "SETUP"
 ];
 var AgentSessionType = external_exports.enum(AgentSessionTypeValues);
+var SetupTenantSchema = external_exports.object({
+  admin: external_exports.boolean(),
+  member: external_exports.boolean(),
+  apiKey: external_exports.boolean()
+}).strict();
+var MAX_SETUP_TENANTS = 4;
 var AgentSessionStatusValues = [
   "LAUNCHING",
   "RUNNING",
@@ -23337,6 +23361,17 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("API_COVERAGE"),
     focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional()
+  }),
+  // SETUP: sets up a PoC engagement's application, environment, exclusions and tenant
+  // accounts. `focus` carries the staff notes (which environment, rate limits, what is
+  // off-limits); `tenants` the accounts to aim for; `shareLink` the customer's logins.
+  CreateAgentSessionCommonSchema.extend({
+    type: external_exports.literal("SETUP"),
+    focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional(),
+    /** Absent = the default target, two tenants of admin + member + API key. */
+    tenants: external_exports.array(SetupTenantSchema).min(1).max(MAX_SETUP_TENANTS).optional(),
+    /** A credential share link. Stored encrypted and never returned by any read route. */
+    shareLink: external_exports.url({ protocol: /^https$/ }).max(2048).optional()
   })
 ]);
 var SendAgentSessionMessageRequestSchema = external_exports.object({
@@ -27462,7 +27497,17 @@ var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit
   repositoryId: true
 });
 var CustomerFindingPendingRetestSchema = external_exports.discriminatedUnion("state", [
-  external_exports.object({ state: external_exports.literal("QUEUED"), since: external_exports.coerce.date() }),
+  external_exports.object({
+    state: external_exports.literal("QUEUED"),
+    since: external_exports.coerce.date(),
+    /**
+     * Present only while the retest waits on a completed ticket's delay: when
+     * it becomes due. A field on QUEUED rather than its own state because prod
+     * promotes web after the API and web parses these responses, so a new
+     * variant would fail the parse in the web still serving.
+     */
+    startsAt: external_exports.coerce.date().optional()
+  }),
   external_exports.object({ state: external_exports.literal("RUNNING"), since: external_exports.coerce.date() }),
   /**
    * A mobile-only engagement whose finding has no usable build newer than its
@@ -28816,13 +28861,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c83, i2) => {
-    const d = c83.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c84, i2) => {
+    const d = c84.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c83.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c84.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -30156,7 +30201,27 @@ var AgentSessionCreateTestEmailResponseSchema = external_exports.object({
    */
   reused: external_exports.boolean()
 });
-var AgentSessionSaveTestAccountRequestSchema = external_exports.object({
+var ProvidedCredentialType = external_exports.enum(CredentialTypeValues).extract(["USERNAME_PASSWORD", "API_KEY", "BEARER_TOKEN"]);
+var AgentSessionSaveProvidedAccountRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative(),
+  provided: external_exports.literal(true),
+  /**
+   * `customer`: the customer handed it over (a share link). `created`: the agent made it, such as an
+   * API key from an admin account it signed up; it is labelled like any account the agent mints, so
+   * a black-box engagement does not read it as customer-supplied.
+   */
+  source: external_exports.enum(["customer", "created"]),
+  label: external_exports.string().min(1).max(200),
+  credentialType: ProvidedCredentialType,
+  /** USERNAME_PASSWORD only. */
+  username: external_exports.string().min(1).max(320).optional(),
+  /** The password, key or token. */
+  secret: external_exports.string().min(1).max(4096),
+  /** API_KEY only: the header that carries the key. */
+  headerName: external_exports.string().min(1).max(100).optional(),
+  targetUrl: external_exports.string().min(1).max(2048).optional()
+});
+var AgentSessionSaveMintedAccountRequestSchema = external_exports.strictObject({
   runVersion: external_exports.number().int().nonnegative(),
   /** The `label` returned by `create_test_email`. */
   label: external_exports.string().min(1).max(200),
@@ -30184,11 +30249,18 @@ var AgentSessionSaveTestAccountRequestSchema = external_exports.object({
    */
   targetUrl: external_exports.string().min(1).max(2048).optional()
 });
+var AgentSessionSaveTestAccountRequestSchema = external_exports.union([
+  AgentSessionSaveProvidedAccountRequestSchema,
+  AgentSessionSaveMintedAccountRequestSchema
+]);
 var AgentSessionSaveTestAccountResponseSchema = external_exports.object({
   /** Echoed so the agent names the account the same way afterwards. */
   label: external_exports.string().max(200),
-  /** `USERNAME_PASSWORD` when a password was supplied, else `MAGIC_AUTH`. */
-  credentialType: external_exports.enum(["USERNAME_PASSWORD", "MAGIC_AUTH"]),
+  /**
+   * Minted accounts: `USERNAME_PASSWORD` when a password was supplied, else `MAGIC_AUTH`.
+   * Provided logins: the type the agent named.
+   */
+  credentialType: external_exports.enum(["USERNAME_PASSWORD", "MAGIC_AUTH", "API_KEY", "BEARER_TOKEN"]),
   /**
    * The environment the credential landed on. Authoritative, not an echo: it is
    * how the agent learns that its `targetUrl` matched nothing and the server
@@ -30579,7 +30651,7 @@ var ParkAgentSessionRequestSchema = external_exports.object({
    * idle-lingered out (the host's only natural-completion signal); INTERRUPTED =
    * SIGTERM / stream-close / api-outage give-up / wall-clock. Meaningful only when
    * outcome === 'IDLE'. OPTIONAL for rolling-deploy tolerance: an old host omits
-   * it, and the api treats absent as non-natural (no VALIDATION auto-advance).
+   * it, and the api treats absent as non-natural (the validation run stays RUNNING).
    */
   idleReason: external_exports.enum(["COMPLETED", "INTERRUPTED"]).optional(),
   waitingReason: AgentSessionWaitingReason.optional(),
@@ -31460,7 +31532,7 @@ var agentSessionInternalContract = c4.router({
       201: RecordValidationResultResponseSchema,
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
-      // runVersion/status guard, or pentest not in VALIDATION_RUNNING.
+      // runVersion/status guard, an ended engagement, or no validation run for the session.
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
@@ -36719,6 +36791,7 @@ var LinearIntegrationStatusValues = [
   "DISCONNECTED"
 ];
 var linearEntityId2 = external_exports.string().min(1).max(64);
+var LINEAR_RETEST_DELAY_MINUTES_OPTIONS = [0, 60, 180, 720, 1440, 4320];
 var LinearIntegrationSummarySchema = external_exports.object({
   linearIntegrationId: external_exports.uuid(),
   status: external_exports.enum(LinearIntegrationStatusValues),
@@ -36728,6 +36801,12 @@ var LinearIntegrationSummarySchema = external_exports.object({
   defaultTeamId: external_exports.string().nullable(),
   defaultProjectId: external_exports.string().nullable(),
   defaultLabelIds: external_exports.array(external_exports.string()),
+  /**
+   * Optional on the wire only: prod promotes web after the API, so a web bundle
+   * can read an API that predates the field. Consumers default it. Not limited
+   * to the options so retiring one never makes a stored value unparseable.
+   */
+  retestDelayMinutes: external_exports.number().int().nonnegative().optional(),
   connectedAt: external_exports.iso.datetime(),
   connectedByName: external_exports.string().nullable(),
   /** Non-null → disconnect committed but Linear-side revocation didn't confirm; UI shows the confirm-removal banner. */
@@ -36759,6 +36838,9 @@ var UpdateLinearDefaultsRequestSchema = external_exports.object({
   defaultProjectId: linearEntityId2.nullable().optional(),
   defaultLabelIds: external_exports.array(linearEntityId2).max(10).optional()
 });
+var UpdateLinearRetestDelayRequestSchema = external_exports.object({
+  retestDelayMinutes: external_exports.literal(LINEAR_RETEST_DELAY_MINUTES_OPTIONS)
+});
 var LinearTeamSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -36845,6 +36927,27 @@ var linearIntegrationContract = c26.router({
       503: ErrorResponseSchema
     }
   },
+  /**
+   * Separate from the defaults PATCH, which revalidates the saved team against
+   * Linear on every save: this setting is ours alone and must save while Linear
+   * is unreachable or the team was archived.
+   */
+  updateLinearRetestDelay: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/integrations/linear/retest-delay",
+    pathParams: OrgIdParamsSchema,
+    body: UpdateLinearRetestDelayRequestSchema,
+    responses: {
+      200: LinearIntegrationResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      503: ErrorResponseSchema
+    }
+  },
   getLinearMetadata: {
     method: "GET",
     path: "/organizations/:organizationId/integrations/linear/metadata",
@@ -41541,6 +41644,23 @@ var pentestFindingContract = c45.router({
       500: ErrorResponseSchema
     }
   },
+  // Customer says the fix is already live for a finding whose retest waits on its
+  // ticket's delay: the retest becomes due now. No status change.
+  startScheduledRetest: {
+    method: "POST",
+    path: "/organizations/:organizationId/customer-pentests/:pentestId/findings/:pentestFindingId/start-retest",
+    pathParams: CustomerPentestFindingIdParamsSchema,
+    body: c45.noBody(),
+    responses: {
+      200: CustomerPentestFindingResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // RETEST_NOT_SCHEDULED: not REMEDIATED with a retest still waiting.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // Customer accepts the finding → ACCEPTED_WITH_CONTROLS without a dispute or a
   // staff decision. Human principals here; an API key sends the same transition
   // through `automationStatusUpdate` with status ACCEPTED_WITH_CONTROLS.
@@ -41935,6 +42055,57 @@ var PentestIntakeDocumentTypeValues = [
   "OTHER"
 ];
 var PentestIntakeDocumentTypeSchema = external_exports.enum(PentestIntakeDocumentTypeValues);
+var PENTEST_INTAKE_DOCUMENTS_QUESTION = "Do you have any relevant documents to share?";
+var PENTEST_INTAKE_DOCUMENT_TYPE_LABELS = {
+  PREVIOUS_PENTEST: "Previous pentest report",
+  ARCHITECTURE_DIAGRAM: "Architecture diagram",
+  THREAT_MODEL: "Threat model",
+  OTHER: "Other"
+};
+function guessPentestIntakeDocumentType(fileName) {
+  const name = fileName.toLowerCase();
+  if (/threat[\s_-]*model|stride|attack[\s_-]*tree|dfd/.test(name)) return "THREAT_MODEL";
+  if (/pen[\s_-]*test|pentest|penetration|security[\s_-]*assessment|vapt|findings/.test(name)) {
+    return "PREVIOUS_PENTEST";
+  }
+  if (/arch|diagram|topology|infra|system[\s_-]*design|c4|\.drawio/.test(name)) {
+    return "ARCHITECTURE_DIAGRAM";
+  }
+  return "OTHER";
+}
+var INTAKE_DOCUMENT_MIME_BY_EXTENSION = {
+  pdf: "application/pdf",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  txt: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  json: "application/json",
+  xml: "application/xml",
+  // text/yaml rather than application/yaml: readers that only accept text/* still take it.
+  yaml: "text/yaml",
+  yml: "text/yaml",
+  html: "text/html",
+  htm: "text/html",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  svg: "image/svg+xml",
+  webp: "image/webp",
+  zip: "application/zip",
+  drawio: "application/xml",
+  vsdx: "application/vnd.ms-visio.drawing"
+};
+function pentestIntakeDocumentMimeType(fileName) {
+  const dot = fileName.lastIndexOf(".");
+  const extension = dot === -1 ? "" : fileName.slice(dot + 1).toLowerCase();
+  return INTAKE_DOCUMENT_MIME_BY_EXTENSION[extension] ?? "application/octet-stream";
+}
 var MAX_PENTEST_INTAKE_DOCUMENT_BYTES = 50 * 1024 * 1024;
 var PentestIntakeDocumentIdParamsSchema = CustomerPentestIdParamsSchema.extend({
   documentId: external_exports.uuid()
@@ -46227,16 +46398,16 @@ var COVERAGE_CLASSES = [
   },
   { taxonomy: "RECON", id: "RECON-15", name: "Deployment-platform config", shortLabel: "Deploy" }
 ];
-var BY_ID = new Map(COVERAGE_CLASSES.map((c83) => [c83.id, c83]));
+var BY_ID = new Map(COVERAGE_CLASSES.map((c84) => [c84.id, c84]));
 function idsWhere(keep) {
-  return [OTHER_CLASS_ID, ...COVERAGE_CLASSES.filter(keep).map((c83) => c83.id)];
+  return [OTHER_CLASS_ID, ...COVERAGE_CLASSES.filter(keep).map((c84) => c84.id)];
 }
-var HUNTING_CLASS_IDS = idsWhere((c83) => c83.taxonomy !== "RECON");
-var RECON_CLASS_IDS = idsWhere((c83) => c83.taxonomy === "RECON");
+var HUNTING_CLASS_IDS = idsWhere((c84) => c84.taxonomy !== "RECON");
+var RECON_CLASS_IDS = idsWhere((c84) => c84.taxonomy === "RECON");
 var HUNTING_ID_SET = new Set(HUNTING_CLASS_IDS);
 var RECON_ID_SET = new Set(RECON_CLASS_IDS);
 var TAXONOMY_ORDER = new Map(CoverageTaxonomyValues.map((t2, i2) => [t2, i2]));
-var CLASS_ORDER = new Map(COVERAGE_CLASSES.map((c83, i2) => [c83.id, i2]));
+var CLASS_ORDER = new Map(COVERAGE_CLASSES.map((c84, i2) => [c84.id, i2]));
 
 // ../../packages/api-contracts/src/contracts/v1/api-coverage-internal.ts
 var c80 = initContract();
@@ -46309,6 +46480,135 @@ var apiCoverageInternalContract = c80.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/api/v1/setup-session-internal.api.ts
+var RunVersionSchema2 = external_exports.number().int().nonnegative();
+var SetupTargetType = external_exports.enum(ApplicationTypeValues).extract(["WEB", "API_SERVICE"]);
+var ReasonSchema = external_exports.string().min(1).max(500);
+var SetupVerificationStatusValues = [
+  "UNVERIFIED",
+  "PENDING",
+  "VERIFIED",
+  "FAILED",
+  "INCONCLUSIVE"
+];
+var SetupVerificationStatus = external_exports.enum(SetupVerificationStatusValues);
+var SetupAddTargetRequestSchema = external_exports.object({
+  runVersion: RunVersionSchema2,
+  reason: ReasonSchema,
+  /** The application's name in Trace. An existing org application with this name is reused. */
+  name: external_exports.string().min(1).max(200),
+  type: SetupTargetType,
+  /** The environment's login or base URL. */
+  url: external_exports.url({ protocol: /^https?$/ }).max(2048),
+  environmentName: external_exports.string().min(1).max(100),
+  isProduction: external_exports.boolean()
+});
+var SetupAddTargetResponseSchema = external_exports.object({
+  applicationName: external_exports.string(),
+  environmentName: external_exports.string(),
+  created: external_exports.object({
+    application: external_exports.boolean(),
+    environment: external_exports.boolean(),
+    binding: external_exports.boolean(),
+    selection: external_exports.boolean()
+  }),
+  /** The URL's registrable domain differs from the org website's: list it in the summary. */
+  offHomepageDomain: external_exports.boolean()
+});
+var SetupAddExclusionRequestSchema = external_exports.object({
+  runVersion: RunVersionSchema2,
+  reason: ReasonSchema,
+  expression: external_exports.string().min(1).max(500)
+});
+var SetupAddExclusionResponseSchema = external_exports.object({
+  /** false when the same exclusion was already on the engagement. */
+  created: external_exports.boolean()
+});
+var SetupUpdateEngagementRequestSchema = external_exports.object({
+  runVersion: RunVersionSchema2,
+  reason: ReasonSchema,
+  testType: PentestTestType.optional(),
+  // The same ranges the staff engagement form enforces: a rate outside them turns API coverage's
+  // sender off at launch. There is no description field: it is shown to the customer. Not
+  // nullable: setup only adds, so it can set a limit but never clear one.
+  requestRatePerSec: external_exports.number().min(REQUEST_RATE_PER_SEC_RANGE.min).max(REQUEST_RATE_PER_SEC_RANGE.max).optional(),
+  requestBurst: external_exports.number().int().min(REQUEST_BURST_RANGE.min).max(REQUEST_BURST_RANGE.max).optional()
+});
+var SetupVerifyRequestSchema = external_exports.object({
+  runVersion: RunVersionSchema2,
+  action: external_exports.enum(["start", "status"])
+});
+var SetupVerifyResponseSchema = external_exports.object({
+  applications: external_exports.array(
+    external_exports.object({
+      applicationName: external_exports.string(),
+      /** What `start` did for this application; null on `status`. */
+      launch: external_exports.enum(["STARTED", "IN_FLIGHT", "NOTHING_TO_CHECK"]).nullable(),
+      environments: external_exports.array(external_exports.object({ name: external_exports.string(), status: SetupVerificationStatus })),
+      credentials: external_exports.array(
+        external_exports.object({
+          label: external_exports.string(),
+          environmentName: external_exports.string(),
+          status: SetupVerificationStatus
+        })
+      )
+    })
+  )
+});
+var SetupShareLinkRequestSchema = external_exports.object({ runVersion: RunVersionSchema2 });
+var SetupShareLinkResponseSchema = external_exports.object({ shareLink: external_exports.string().nullable() });
+
+// ../../packages/api-contracts/src/contracts/v1/setup-session-internal.ts
+var c81 = initContract();
+var pathParams2 = external_exports.strictObject({ agentSessionId: external_exports.uuid() });
+var errors6 = {
+  400: ErrorResponseSchema,
+  401: ErrorResponseSchema,
+  403: ErrorResponseSchema,
+  404: ErrorResponseSchema,
+  409: ErrorResponseSchema,
+  500: ErrorResponseSchema,
+  503: ErrorResponseSchema
+};
+var base2 = "/internal/v1/agent-sessions/:agentSessionId/setup";
+var setupSessionInternalContract = c81.router({
+  addSetupTarget: {
+    method: "POST",
+    path: `${base2}/target`,
+    pathParams: pathParams2,
+    body: SetupAddTargetRequestSchema,
+    responses: { 200: SetupAddTargetResponseSchema, ...errors6 }
+  },
+  addSetupExclusion: {
+    method: "POST",
+    path: `${base2}/exclusion`,
+    pathParams: pathParams2,
+    body: SetupAddExclusionRequestSchema,
+    responses: { 200: SetupAddExclusionResponseSchema, ...errors6 }
+  },
+  updateSetupEngagement: {
+    method: "POST",
+    path: `${base2}/engagement`,
+    pathParams: pathParams2,
+    body: SetupUpdateEngagementRequestSchema,
+    responses: { 200: OperatorPentestContextSchema, ...errors6 }
+  },
+  verifySetup: {
+    method: "POST",
+    path: `${base2}/verify`,
+    pathParams: pathParams2,
+    body: SetupVerifyRequestSchema,
+    responses: { 200: SetupVerifyResponseSchema, ...errors6 }
+  },
+  getSetupShareLink: {
+    method: "POST",
+    path: `${base2}/share-link`,
+    pathParams: pathParams2,
+    body: SetupShareLinkRequestSchema,
+    responses: { 200: SetupShareLinkResponseSchema, ...errors6 }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/premise-check.api.ts
 var PREMISE_VERDICTS = ["supported", "contradicted", "cant_tell"];
 var EXTRACTED_PREMISE_KINDS = [
@@ -46398,8 +46698,8 @@ var ListReviewPremiseChecksResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/premise-check-internal.ts
-var c81 = initContract();
-var premiseCheckInternalContract = c81.router({
+var c82 = initContract();
+var premiseCheckInternalContract = c82.router({
   listReviewPremiseChecks: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/premise-checks/list",
@@ -48261,11 +48561,11 @@ function buildCloneTokenFailureWarning(cloneUrl, failure) {
       return `Trace returned an unexpected response while generating clone credentials for ${cloneUrl}${quotedMessage ? ` ${quotedMessage}` : ""}. ${fallbackSuffix}`;
   }
 }
-function withOptionalMessage(base2, message) {
+function withOptionalMessage(base3, message) {
   if (typeof message === "string") {
-    return { ...base2, message };
+    return { ...base3, message };
   }
-  return base2;
+  return base3;
 }
 async function listOrganizationsSafe() {
   const result = await authenticatedRequestSafe(
@@ -49083,6 +49383,13 @@ function parseOutput(value) {
   console.error(colorError(`Invalid --output '${value}'. Use table, json, or tsv.`));
   process.exit(1);
 }
+function parseTextOutput(value) {
+  if (value === "text" || value === "json") {
+    return value;
+  }
+  console.error(colorError(`Invalid --output '${sanitizeDisplay(value)}'. Use text or json.`));
+  process.exit(1);
+}
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isUuid(value) {
   return UUID_PATTERN.test(value);
@@ -49316,12 +49623,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c83) => c83.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c83) => c83.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c83) => c83.type.length));
+  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c84) => c84.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c83) => `${c83.id.padEnd(idWidth)}  ${c83.name.padEnd(nameWidth)}  ${c83.type.padEnd(typeWidth)}  ${c83.repos.padStart(5)}  ${c83.url}`
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.name.padEnd(nameWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.repos.padStart(5)}  ${c84.url}`
   );
   return { header, rows };
 }
@@ -49341,12 +49648,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c83) => c83.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c83) => c83.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c83) => c83.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c84) => c84.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c84) => c84.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c84) => c84.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c83) => `${c83.name.padEnd(nameWidth)}  ${c83.scan.padEnd(4)}  ${c83.role.padEnd(roleWidth)}  ${c83.path.padEnd(pathWidth)}  ${c83.status}`
+    (c84) => `${c84.name.padEnd(nameWidth)}  ${c84.scan.padEnd(4)}  ${c84.role.padEnd(roleWidth)}  ${c84.path.padEnd(pathWidth)}  ${c84.status}`
   );
   return { header, rows };
 }
@@ -50131,8 +50438,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c83, i2, m2) => {
-    const d = n3 ? n3(c83, i2) : c83;
+`).map((c84, i2, m2) => {
+    const d = n3 ? n3(c84, i2) : c84;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -50630,14 +50937,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c83 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c84 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c83 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c83 ? 1 : 0);
+  d && g++, c84 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c84 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -50658,14 +50965,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c83 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c83 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c83 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c84 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c84 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c84 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c83 && x.push(M), x;
+  return c84 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -50684,15 +50991,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c83 = this.value ? a2 : s;
+`, c84 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c83)}`;
+          return `${o2}${r2}${styleText2("dim", c84)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c83)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c84)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -50840,13 +51147,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c83 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c84 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c83}
+${u4}  ${styleText2("yellow", this.error)}${c84}
 `;
       }
       case "submit": {
@@ -50874,7 +51181,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c83}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c83}
+${r2}${c84}
 `;
       }
     }
@@ -50889,7 +51196,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c83 = this.userInputWithCursor, i2 = this.masked;
+`, c84 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -50909,7 +51216,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c83}
+        return `${o2}${s}${c84}
 ${n3}
 `;
       }
@@ -50925,7 +51232,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c82 = (t2, o2) => t2.includes(`
+var c83 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -50936,15 +51243,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c82(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c83(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c82(s, (i2) => styleText2("dim", i2))}`;
+        return `${c83(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c82(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c83(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c82(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c83(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -51817,7 +52124,7 @@ function buildAuthStatusInfo(credential, refreshToken, selectedOrganizationId) {
     };
   }
   const token = credential.token;
-  const base2 = {
+  const base3 = {
     loggedIn: true,
     authMethod: "user",
     expired: false,
@@ -51828,20 +52135,20 @@ function buildAuthStatusInfo(credential, refreshToken, selectedOrganizationId) {
     const parts = token.split(".");
     const payload = parts[1];
     if (!payload) {
-      return base2;
+      return base3;
     }
     const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
     const expiry = decoded.exp ? new Date(decoded.exp * 1e3) : null;
     const isExpired = expiry ? expiry < /* @__PURE__ */ new Date() : false;
     return {
-      ...base2,
+      ...base3,
       ...decoded.sub ? { userId: decoded.sub } : {},
       ...decoded.org_id ? { orgId: decoded.org_id } : {},
       ...expiry ? { expires: expiry.toISOString() } : {},
       expired: isExpired
     };
   } catch {
-    return base2;
+    return base3;
   }
 }
 function createStatusCommand() {
@@ -52441,7 +52748,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c83) => !c83._hidden).map((c83) => extractCommandTree(c83));
+  const subcommands = cmd.commands.filter((c84) => !c84._hidden).map((c84) => extractCommandTree(c84));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -52507,7 +52814,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c83) => c83.name);
+  const subcommandNames = tree.subcommands.map((c84) => c84.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -52922,9 +53229,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c83) => c83.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c84) => c84.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c83) => `${c83.address.padEnd(addressWidth)}  ${c83.label}`);
+  const rows = cells.map((c84) => `${c84.address.padEnd(addressWidth)}  ${c84.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -52948,14 +53255,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c83) => c83.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c83) => c83.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c83) => c83.from.length));
-  const toWidth = Math.max(2, ...cells.map((c83) => c83.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c83) => c83.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c84) => c84.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c84) => c84.from.length));
+  const toWidth = Math.max(2, ...cells.map((c84) => c84.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c84) => c84.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c83) => `${c83.id.padEnd(idWidth)}  ${c83.received.padEnd(receivedWidth)}  ${c83.from.padEnd(fromWidth)}  ${c83.to.padEnd(toWidth)}  ${c83.subject.padEnd(subjectWidth)}  ${c83.unread}`
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.received.padEnd(receivedWidth)}  ${c84.from.padEnd(fromWidth)}  ${c84.to.padEnd(toWidth)}  ${c84.subject.padEnd(subjectWidth)}  ${c84.unread}`
   );
   return { header, rows };
 }
@@ -53698,6 +54005,13 @@ function mfaDisplay(mfa) {
   if (mfa.algorithm !== "SHA1") parts.push(mfa.algorithm);
   return parts.join(" \xB7 ");
 }
+function sourceDisplay(place) {
+  return `${sanitizeDisplay(place.applicationName)} / ${sanitizeDisplay(place.environmentName)}`;
+}
+function linkedIntoDisplay(linkedInto) {
+  if (!linkedInto || linkedInto.length === 0) return "(none)";
+  return linkedInto.map(sourceDisplay).join(", ");
+}
 function renderCredentialDetail(cred) {
   const pad = 13;
   return [
@@ -53707,6 +54021,7 @@ function renderCredentialDetail(cred) {
     `${"Environment:".padEnd(pad)} ${cred.environmentId}`,
     `${"Auth config:".padEnd(pad)} ${authConfigDisplay(cred.authConfig)}`,
     `${"MFA:".padEnd(pad)} ${mfaDisplay(cred.mfa)}`,
+    `${"Linked into:".padEnd(pad)} ${linkedIntoDisplay(cred.linkedInto)}`,
     `${"Created:".padEnd(pad)} ${formatDate(cred.createdAt)}`
   ].join("\n");
 }
@@ -53730,16 +54045,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c83) => ({
-    id: c83.credentialId,
-    label: sanitizeDisplay(c83.label),
-    type: c83.credentialType
+  const cells = creds.map((c84) => ({
+    id: c84.credentialId,
+    label: sanitizeDisplay(c84.label),
+    type: c84.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c83) => c83.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c83) => c83.label.length));
+  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c84) => c84.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c83) => `${c83.id.padEnd(idWidth)}  ${c83.label.padEnd(labelWidth)}  ${c83.type}`
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type}`
   );
   return { header, rows };
 }
@@ -54174,6 +54489,512 @@ async function runDelete3(credentialId, options) {
   }
   console.log(colorSuccess(`Deleted credential ${credentialId}`));
 }
+function failLinkOp(op, status, body, notFoundLabel) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    const verb = op.startsWith("un") ? "unlink" : "link";
+    console.error(
+      colorError(
+        `Only an organization admin or Trace staff can ${verb} credentials, and API keys can't.`
+      )
+    );
+    if (message !== void 0) console.error(message);
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? `Not found: ${notFoundLabel}.`));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CREDENTIAL_LINK_SELF") {
+      console.error(
+        colorError(message ?? "That already belongs to this environment; nothing to link.")
+      );
+    } else if (errorCode === "CREDENTIAL_ALREADY_LINKED") {
+      console.error(colorError(message ?? "That is already linked into this environment."));
+    } else if (errorCode === "CREDENTIAL_LABEL_TAKEN") {
+      console.error(
+        colorError(
+          message ?? "This environment already shows a credential with that label. Rename one of them first."
+        )
+      );
+    } else if (errorCode === "CREDENTIAL_IN_USE") {
+      console.error(
+        colorError(message ?? "You can't unlink while a pentest using this environment is running.")
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  console.error(colorError(`Failed to ${op} (status ${status})${message ? `: ${message}` : "."}`));
+  process.exit(1);
+}
+function requireLinkId(credentialLinkId) {
+  if (!isUuid(credentialLinkId)) {
+    console.error(colorError(`Invalid credential link id '${credentialLinkId}'. Expected a UUID.`));
+    process.exit(1);
+  }
+}
+function renderCredentialLinkDetail(link) {
+  const pad = 13;
+  return [
+    `${"Link ID:".padEnd(pad)} ${link.credentialLinkId}`,
+    `${"Credential:".padEnd(pad)} ${link.credential.credentialId}`,
+    `${"Label:".padEnd(pad)} ${sanitizeDisplay(link.credential.label)}`,
+    `${"Type:".padEnd(pad)} ${link.credential.credentialType}`,
+    `${"Source:".padEnd(pad)} ${sourceDisplay(link.source)} (${link.source.environmentId})`,
+    `${"Linked into:".padEnd(pad)} ${link.environmentId}`,
+    `${"MFA:".padEnd(pad)} ${mfaDisplay(link.credential.mfa)}`,
+    `${"Linked:".padEnd(pad)} ${formatDate(link.createdAt)}`
+  ].join("\n");
+}
+function printCredentialLinksTsv(links) {
+  console.log(
+    [
+      "credentialLinkId",
+      "credentialId",
+      "label",
+      "credentialType",
+      "sourceApplication",
+      "sourceEnvironment",
+      "sourceEnvironmentId",
+      "environmentCredentialSourceId",
+      "mfa",
+      "createdAt"
+    ].join("	")
+  );
+  for (const link of links) {
+    console.log(
+      [
+        tsvSafe(link.credentialLinkId),
+        tsvSafe(link.credential.credentialId),
+        tsvSafe(sanitizeDisplay(link.credential.label)),
+        tsvSafe(link.credential.credentialType),
+        tsvSafe(sanitizeDisplay(link.source.applicationName)),
+        tsvSafe(sanitizeDisplay(link.source.environmentName)),
+        tsvSafe(link.source.environmentId),
+        tsvSafe(link.environmentCredentialSourceId ?? ""),
+        tsvSafe(link.credential.mfa ? link.credential.mfa.kind : ""),
+        tsvSafe(toIso(link.createdAt))
+      ].join("	")
+    );
+  }
+}
+function buildCredentialLinksTable(links) {
+  const cells = links.map((link) => ({
+    id: link.credentialLinkId,
+    label: sanitizeDisplay(link.credential.label),
+    type: link.credential.credentialType,
+    source: sourceDisplay(link.source),
+    via: link.environmentCredentialSourceId ? "link-all" : ""
+  }));
+  const idWidth = Math.max("LINK ID".length, ...cells.map((c84) => c84.id.length));
+  const labelWidth = Math.max("LABEL".length, ...cells.map((c84) => c84.label.length));
+  const typeWidth = Math.max("TYPE".length, ...cells.map((c84) => c84.type.length));
+  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c84) => c84.source.length));
+  const header = `${"LINK ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  ${"TYPE".padEnd(typeWidth)}  ${"SOURCE".padEnd(sourceWidth)}  VIA`;
+  const rows = cells.map(
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.source.padEnd(sourceWidth)}  ${c84.via}`.trimEnd()
+  );
+  return { header, rows };
+}
+function outputCredentialLink(link, output) {
+  if (output === "json") {
+    printJson(link);
+    return;
+  }
+  if (output === "tsv") {
+    printCredentialLinksTsv([link]);
+    return;
+  }
+  console.log(renderCredentialLinkDetail(link));
+}
+function printLinkableCredentialsTsv(creds) {
+  console.log(
+    [
+      "credentialId",
+      "label",
+      "credentialType",
+      "application",
+      "environment",
+      "environmentId",
+      "hasMfa",
+      "alreadyLinked"
+    ].join("	")
+  );
+  for (const cred of creds) {
+    console.log(
+      [
+        tsvSafe(cred.credentialId),
+        tsvSafe(sanitizeDisplay(cred.label)),
+        tsvSafe(cred.credentialType),
+        tsvSafe(sanitizeDisplay(cred.application.name)),
+        tsvSafe(sanitizeDisplay(cred.environment.name)),
+        tsvSafe(cred.environment.environmentId),
+        tsvSafe(String(cred.hasMfa)),
+        tsvSafe(String(cred.alreadyLinked))
+      ].join("	")
+    );
+  }
+}
+function buildLinkableCredentialsTable(creds) {
+  const cells = creds.map((cred) => ({
+    id: cred.credentialId,
+    label: sanitizeDisplay(cred.label),
+    type: cred.credentialType,
+    source: sourceDisplay({
+      applicationName: cred.application.name,
+      environmentName: cred.environment.name
+    }),
+    linked: cred.alreadyLinked ? "linked" : ""
+  }));
+  const idWidth = Math.max("ID".length, ...cells.map((c84) => c84.id.length));
+  const labelWidth = Math.max("LABEL".length, ...cells.map((c84) => c84.label.length));
+  const typeWidth = Math.max("TYPE".length, ...cells.map((c84) => c84.type.length));
+  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c84) => c84.source.length));
+  const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  ${"TYPE".padEnd(typeWidth)}  ${"SOURCE".padEnd(sourceWidth)}  STATUS`;
+  const rows = cells.map(
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.source.padEnd(sourceWidth)}  ${c84.linked}`.trimEnd()
+  );
+  return { header, rows };
+}
+async function runLink(credentialId, options) {
+  const output = parseOutput(options.output);
+  requireEnvId(options.env);
+  requireCredId(credentialId);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.createCredentialLink({
+      params: { organizationId, environmentId: options.env },
+      body: { credentialId }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failLinkOp("link", result.status, result.body, credentialId);
+  }
+  if (output === "table") {
+    console.log(
+      colorSuccess(
+        `Linked credential ${sanitizeDisplay(result.body.credential.label)} from ${sourceDisplay(result.body.source)}`
+      )
+    );
+  }
+  outputCredentialLink(result.body, output);
+}
+async function runUnlink(credentialLinkId, options) {
+  requireEnvId(options.env);
+  requireLinkId(credentialLinkId);
+  const confirmed = await confirmAction(
+    `Unlink credential link ${credentialLinkId} (the source credential is kept)?`,
+    { skip: options.yes, verb: "unlink" }
+  );
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.deleteCredentialLink({
+      params: { organizationId, environmentId: options.env, credentialLinkId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    if (result.status === 409 && readErrorFields(result.body).errorCode === "CREDENTIAL_LINKED_BY_RULE") {
+      await failLinkedByRule(organizationId, options.env, result.body);
+    }
+    failLinkOp("unlink", result.status, result.body, credentialLinkId);
+  }
+  console.log(colorSuccess(`Unlinked credential link ${credentialLinkId}`));
+}
+function coveringRuleId(body) {
+  if (typeof body !== "object" || body === null || !("details" in body)) return null;
+  const { details } = body;
+  if (typeof details !== "object" || details === null) return null;
+  if (!("environmentCredentialSourceId" in details)) return null;
+  const id = details.environmentCredentialSourceId;
+  return typeof id === "string" && isUuid(id) ? id : null;
+}
+async function failLinkedByRule(organizationId, environmentId, body) {
+  const { message } = readErrorFields(body);
+  console.error(
+    colorError(
+      message ?? "All of the environment this credential comes from is linked here, so it stays."
+    )
+  );
+  const ruleId = coveringRuleId(body);
+  const rules = ruleId === null ? null : await fetchCredentialSources(organizationId, environmentId);
+  const rule = rules?.find((r2) => r2.environmentCredentialSourceId === ruleId);
+  console.error(
+    rule ? `Unlink all of ${sourceDisplay(rule.source)} with: tracecli credential unlink-all ${rule.source.environmentId} --env ${environmentId}` : `See which environment with: tracecli credential links --env ${environmentId}`
+  );
+  process.exit(1);
+}
+async function fetchCredentialSources(organizationId, environmentId) {
+  const result = await authenticatedRequestSafe(
+    (client) => client.credentialLink.listCredentialSources({
+      params: { organizationId, environmentId }
+    })
+  );
+  if (result === null) return null;
+  if (result.status === SUCCESS_STATUS) return result.body;
+  if (result.status === 404) return [];
+  return null;
+}
+function credentialSourceLines(rules) {
+  return rules.map(
+    (rule) => `All of ${sourceDisplay(rule.source)} is linked here, including credentials added there later.`
+  );
+}
+async function runLinks(options) {
+  const output = parseOutput(options.output);
+  requireEnvId(options.env);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.listCredentialLinks({
+      params: { organizationId, environmentId: options.env }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp3("list credential links", result.status, result.body, options.env);
+  }
+  const links = result.body;
+  if (output === "json") {
+    printJson(links);
+    return;
+  }
+  if (output === "tsv") {
+    printCredentialLinksTsv(links);
+    return;
+  }
+  const rules = await fetchCredentialSources(organizationId, options.env);
+  if (rules === null) {
+    console.error(
+      colorError("Could not read which environments are linked whole; showing links only.")
+    );
+  }
+  const ruleLines = credentialSourceLines(rules ?? []);
+  if (links.length === 0) {
+    if (ruleLines.length > 0) {
+      for (const line of ruleLines) console.log(line);
+      console.log("No credentials from there yet.");
+      return;
+    }
+    console.log(
+      `No linked credentials. See what you can link with: tracecli credential linkable --env ${options.env}`
+    );
+    return;
+  }
+  for (const line of ruleLines) console.log(line);
+  if (ruleLines.length > 0) console.log("");
+  const { header, rows } = buildCredentialLinksTable(links);
+  await runInteractivePager({
+    items: links,
+    header,
+    renderItem: (_link, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+async function runLinkable(options) {
+  const output = parseOutput(options.output);
+  requireEnvId(options.env);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.listLinkableCredentials({
+      params: { organizationId, environmentId: options.env }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp3("list linkable credentials", result.status, result.body, options.env);
+  }
+  const creds = result.body;
+  if (output === "json") {
+    printJson(creds);
+    return;
+  }
+  if (output === "tsv") {
+    printLinkableCredentialsTsv(creds);
+    return;
+  }
+  if (creds.length === 0) {
+    console.log("No credentials elsewhere in this organization to link.");
+    return;
+  }
+  const { header, rows } = buildLinkableCredentialsTable(creds);
+  await runInteractivePager({
+    items: creds,
+    header,
+    renderItem: (_cred, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+function printLinkableEnvironmentsTsv(envs) {
+  console.log(
+    ["environmentId", "application", "environment", "credentialCount", "alreadyLinked"].join("	")
+  );
+  for (const env2 of envs) {
+    console.log(
+      [
+        tsvSafe(env2.environmentId),
+        tsvSafe(sanitizeDisplay(env2.application.name)),
+        tsvSafe(sanitizeDisplay(env2.name)),
+        tsvSafe(String(env2.credentialCount)),
+        tsvSafe(String(env2.alreadyLinked))
+      ].join("	")
+    );
+  }
+}
+function buildLinkableEnvironmentsTable(envs) {
+  const cells = envs.map((env2) => ({
+    id: env2.environmentId,
+    name: sourceDisplay({ applicationName: env2.application.name, environmentName: env2.name }),
+    count: String(env2.credentialCount),
+    linked: env2.alreadyLinked ? "linked" : ""
+  }));
+  const idWidth = Math.max("ENVIRONMENT ID".length, ...cells.map((c84) => c84.id.length));
+  const nameWidth = Math.max("ENVIRONMENT".length, ...cells.map((c84) => c84.name.length));
+  const countWidth = "CREDENTIALS".length;
+  const header = `${"ENVIRONMENT ID".padEnd(idWidth)}  ${"ENVIRONMENT".padEnd(nameWidth)}  ${"CREDENTIALS".padEnd(countWidth)}  STATUS`;
+  const rows = cells.map(
+    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.name.padEnd(nameWidth)}  ${c84.count.padEnd(countWidth)}  ${c84.linked}`.trimEnd()
+  );
+  return { header, rows };
+}
+async function runLinkableEnvironments(options) {
+  const output = parseOutput(options.output);
+  requireEnvId(options.env);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.listLinkableEnvironments({
+      params: { organizationId, environmentId: options.env }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp3("list linkable environments", result.status, result.body, options.env);
+  }
+  const envs = result.body;
+  if (output === "json") {
+    printJson(envs);
+    return;
+  }
+  if (output === "tsv") {
+    printLinkableEnvironmentsTsv(envs);
+    return;
+  }
+  if (envs.length === 0) {
+    console.log("No other environments in this organization to link.");
+    return;
+  }
+  const { header, rows } = buildLinkableEnvironmentsTable(envs);
+  await runInteractivePager({
+    items: envs,
+    header,
+    renderItem: (_env, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+function requireSourceEnvId(sourceEnvironmentId) {
+  if (!isUuid(sourceEnvironmentId)) {
+    console.error(
+      colorError(
+        `Invalid source environment id '${sourceEnvironmentId}'. Expected an environment UUID.`
+      )
+    );
+    process.exit(1);
+  }
+}
+async function runLinkAll(sourceEnvironmentId, options) {
+  const output = parseOutput(options.output);
+  requireEnvId(options.env);
+  requireSourceEnvId(sourceEnvironmentId);
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.createCredentialSource({
+      params: { organizationId, environmentId: options.env },
+      body: { sourceEnvironmentId }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failLinkOp("link all", result.status, result.body, sourceEnvironmentId);
+  }
+  const rule = result.body;
+  if (output === "json") {
+    printJson(rule);
+    return;
+  }
+  if (output === "tsv") {
+    printCredentialLinksTsv(rule.links);
+    return;
+  }
+  const pad = 13;
+  console.log(
+    colorSuccess(
+      `Linked all of ${sourceDisplay(rule.source)}. Credentials added there later show up here too.`
+    )
+  );
+  console.log(
+    [
+      `${"Source:".padEnd(pad)} ${sourceDisplay(rule.source)} (${rule.source.environmentId})`,
+      `${"Linked into:".padEnd(pad)} ${rule.environmentId}`,
+      `${"New links:".padEnd(pad)} ${rule.links.length}`
+    ].join("\n")
+  );
+}
+async function runUnlinkAll(sourceEnvironmentId, options) {
+  requireEnvId(options.env);
+  requireSourceEnvId(sourceEnvironmentId);
+  const organizationId = await resolveOrganizationId();
+  const listed = await authenticatedRequest(
+    (client) => client.credentialLink.listCredentialSources({
+      params: { organizationId, environmentId: options.env }
+    })
+  );
+  if (listed.status !== SUCCESS_STATUS) {
+    failReadOp3("look up the link-all", listed.status, listed.body, options.env);
+  }
+  const wanted = sourceEnvironmentId.toLowerCase();
+  const rule = listed.body.find((r2) => r2.source.environmentId.toLowerCase() === wanted);
+  if (!rule) {
+    console.error(
+      colorError(
+        `Nothing from ${sourceEnvironmentId} is linked whole into this environment. See what is with: tracecli credential linkable --env ${options.env} --environments`
+      )
+    );
+    process.exit(1);
+  }
+  const confirmed = await confirmAction(
+    `Unlink all of ${sourceDisplay(rule.source)} from this environment (credentials linked on their own stay)?`,
+    { skip: options.yes, verb: "unlink" }
+  );
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.credentialLink.deleteCredentialSource({
+      params: {
+        organizationId,
+        environmentId: options.env,
+        environmentCredentialSourceId: rule.environmentCredentialSourceId
+      }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failLinkOp("unlink all", result.status, result.body, rule.environmentCredentialSourceId);
+  }
+  console.log(
+    colorSuccess(
+      `Unlinked all of ${sourceDisplay(rule.source)}. Credentials linked on their own stay.`
+    )
+  );
+}
 function addSecretInputOptions(command) {
   return command.option("--secret-stdin", "Read the secret value from stdin").option("--secret-file <path>", "Read the secret value from a file").option("--secret-env <name>", "Read the secret value from an env var").option("--username-stdin", "Read the username from stdin").option("--username-file <path>", "Read the username from a file").option("--username-env <name>", "Read the username from an env var").option("--password-stdin", "Read the password from stdin").option("--password-file <path>", "Read the password from a file").option("--password-env <name>", "Read the password from an env var");
 }
@@ -54284,6 +55105,89 @@ left \u2014 if the current window is nearly over, the API waits for the next one
     await runMfaCode(credentialId, options);
   });
 }
+function createLinkCommand() {
+  return new Command("link").description("Link another application's credential into an environment").argument("<credentialId>", "UUID of the credential to link (owned by another environment)").requiredOption("--env <environmentId>", "Environment UUID to link it into").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+A link holds no secret: the linked environment sees the source credential as it
+is now, so a rotation, MFA change, or relabel on the source shows up here too.
+Edit the credential where it lives (its own --env). The label must be free in
+the target environment, and the credential must not already belong to it.
+
+Find candidates with: tracecli credential linkable --env <envId>
+To link every credential of an environment, now and as they are added, use
+link-all instead.
+
+Examples:
+  tracecli credential linkable --env <envId>
+  tracecli credential link <credentialId> --env <envId>`
+  ).action(async (credentialId, options) => {
+    await runLink(credentialId, options);
+  });
+}
+function createUnlinkCommand() {
+  return new Command("unlink").description("Remove a credential link from an environment (the source credential is kept)").argument("<credentialLinkId>", "Credential link UUID (the LINK ID from `credential links`)").requiredOption("--env <environmentId>", "Environment UUID the credential is linked into").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").addHelpText(
+    "after",
+    `
+Blocked while a pentest using this environment is running, like deleting one of
+the environment's own credentials. A credential whose whole environment is
+linked here (VIA link-all in \`credential links\`) stays until that is removed
+with \`credential unlink-all\`.`
+  ).action(async (credentialLinkId, options) => {
+    await runUnlink(credentialLinkId, options);
+  });
+}
+function createLinksCommand() {
+  return new Command("links").description(
+    "List the credentials linked into an environment from elsewhere (secrets are never shown)"
+  ).requiredOption("--env <environmentId>", "Environment UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").action(async (options) => {
+    await runLinks(options);
+  });
+}
+function createLinkableCommand() {
+  return new Command("linkable").description("List credentials elsewhere in the organization that an environment could link").requiredOption("--env <environmentId>", "Environment UUID to link into").option("--environments", "List whole environments to link-all instead of credentials").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").addHelpText(
+    "after",
+    `
+Rows already linked into this environment are marked "linked" (table) or
+alreadyLinked=true (tsv). With --environments, "linked" means all of that
+environment is linked here already.`
+  ).action(async (options) => {
+    if (options.environments) {
+      await runLinkableEnvironments(options);
+      return;
+    }
+    await runLinkable(options);
+  });
+}
+function createLinkAllCommand() {
+  return new Command("link-all").description("Link every credential of another environment, including ones added there later").argument("<sourceEnvironmentId>", "UUID of the environment whose credentials to link").requiredOption("--env <environmentId>", "Environment UUID to link them into").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Each credential shows here as a link, like \`credential link\`, and a credential
+added to the source later shows up here too. Edit them where they live. Every
+label must be free in this environment. Credentials you already linked on their
+own stay as they are.
+
+Find environments with: tracecli credential linkable --env <envId> --environments
+
+Examples:
+  tracecli credential link-all <sourceEnvId> --env <envId>
+  tracecli credential unlink-all <sourceEnvId> --env <envId>`
+  ).action(async (sourceEnvironmentId, options) => {
+    await runLinkAll(sourceEnvironmentId, options);
+  });
+}
+function createUnlinkAllCommand() {
+  return new Command("unlink-all").description("Stop linking every credential of another environment into this one").argument("<sourceEnvironmentId>", "UUID of the environment passed to link-all").requiredOption("--env <environmentId>", "Environment UUID they are linked into").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").addHelpText(
+    "after",
+    `
+Removes the links link-all made; the credentials stay in their own environment.
+Credentials you linked on their own stay linked. Blocked while a pentest using
+this environment is running.`
+  ).action(async (sourceEnvironmentId, options) => {
+    await runUnlinkAll(sourceEnvironmentId, options);
+  });
+}
 function createCredentialCommand() {
   const credential = new Command("credential").alias("cred").description("Manage environment credentials");
   credential.addCommand(createCreateCommand3());
@@ -54294,6 +55198,12 @@ function createCredentialCommand() {
   credential.addCommand(createSetMfaCommand());
   credential.addCommand(createClearMfaCommand());
   credential.addCommand(createMfaCodeCommand());
+  credential.addCommand(createLinkCommand());
+  credential.addCommand(createUnlinkCommand());
+  credential.addCommand(createLinkAllCommand());
+  credential.addCommand(createUnlinkAllCommand());
+  credential.addCommand(createLinksCommand());
+  credential.addCommand(createLinkableCommand());
   credential.addCommand(createInboxCommand(), { hidden: true });
   return credential;
 }
@@ -54509,14 +55419,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c83) => c83.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c84) => c84.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c83) => c83.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c83) => c83.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c84) => c84.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c83) => `${padLeading(c83.leading)}  ${c83.name.padEnd(nameWidth)}  ${c83.prod.padEnd(4)}  ${c83.url}`
+      (c84) => `${padLeading(c84.leading)}  ${c84.name.padEnd(nameWidth)}  ${c84.prod.padEnd(4)}  ${c84.url}`
     )
   };
 }
@@ -54898,7 +55808,6 @@ var CLI_VERSION = packageMetadata.version;
 import { readFileSync as readFileSync7 } from "fs";
 
 // src/pentest/evidence.ts
-import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 import { basename as basename2 } from "path";
 
 // src/pentest/resolve.ts
@@ -54973,6 +55882,67 @@ Run \`tracecli pentest list\` to see available pentests.`
   return pentest.pentestId;
 }
 
+// src/pentest/upload-file.ts
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function statUploadFile(path3, limit) {
+  let sizeBytes;
+  try {
+    const stats = statSync2(path3);
+    if (!stats.isFile()) {
+      console.error(colorError(`--file '${sanitizeDisplay(path3)}' is not a regular file.`));
+      process.exit(1);
+    }
+    sizeBytes = stats.size;
+  } catch {
+    console.error(colorError(`Cannot read --file '${sanitizeDisplay(path3)}'.`));
+    process.exit(1);
+  }
+  if (sizeBytes === 0) {
+    console.error(colorError(`--file '${sanitizeDisplay(path3)}' is empty.`));
+    process.exit(1);
+  }
+  if (sizeBytes > limit.bytes) {
+    console.error(
+      colorError(
+        `File is ${formatBytes2(sizeBytes)}; the limit for one ${limit.noun} is ${formatBytes2(limit.bytes)}.`
+      )
+    );
+    process.exit(1);
+  }
+  return sizeBytes;
+}
+async function putFileToPresignedUrl(uploadUrl, path3, options = {}) {
+  let put;
+  try {
+    put = await fetch(uploadUrl, {
+      method: "PUT",
+      body: new Uint8Array(readFileSync5(path3)),
+      ...options.contentType === void 0 ? {} : { headers: { "Content-Type": options.contentType } }
+    });
+  } catch (error48) {
+    const reason = error48 instanceof Error ? error48.message : "unknown error";
+    console.error(
+      colorError(
+        `Upload to storage failed: could not reach storage (${sanitizeDisplay(reason)}). Check the connection and re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+  if (!put.ok) {
+    console.error(
+      colorError(
+        `Upload to storage failed (status ${put.status}). The upload link is short-lived; re-run the command.`
+      )
+    );
+    process.exit(1);
+  }
+}
+
 // src/pentest/evidence.ts
 var SECTION_LIST = ValidationEvidenceSectionValues.join(", ");
 var KIND_LIST = PentestExploitArtifactKindValues.join(", ");
@@ -54982,11 +55952,6 @@ function isSection(value) {
 function isKind(value) {
   return PentestExploitArtifactKindValues.includes(value);
 }
-function formatBytes2(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-}
 async function resolveFindingId(organizationId, pentestId, identifier) {
   if (isUuid(identifier)) {
     return identifier;
@@ -55033,30 +55998,10 @@ async function runAttachEvidence(options) {
     console.error(`Valid kinds: ${KIND_LIST}`);
     process.exit(1);
   }
-  let sizeBytes;
-  try {
-    const stats = statSync2(options.file);
-    if (!stats.isFile()) {
-      console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is not a regular file.`));
-      process.exit(1);
-    }
-    sizeBytes = stats.size;
-  } catch {
-    console.error(colorError(`Cannot read --file '${sanitizeDisplay(options.file)}'.`));
-    process.exit(1);
-  }
-  if (sizeBytes === 0) {
-    console.error(colorError(`--file '${sanitizeDisplay(options.file)}' is empty.`));
-    process.exit(1);
-  }
-  if (sizeBytes > MAX_STAFF_EVIDENCE_UPLOAD_BYTES) {
-    console.error(
-      colorError(
-        `File is ${formatBytes2(sizeBytes)}; the limit for one exhibit is ${formatBytes2(MAX_STAFF_EVIDENCE_UPLOAD_BYTES)}.`
-      )
-    );
-    process.exit(1);
-  }
+  const sizeBytes = statUploadFile(options.file, {
+    bytes: MAX_STAFF_EVIDENCE_UPLOAD_BYTES,
+    noun: "exhibit"
+  });
   const organizationId = await resolveOrganizationId();
   const pentestId = await resolvePentestId(organizationId, options.pentest);
   const pentestFindingId = await resolveFindingId(organizationId, pentestId, options.finding);
@@ -55078,16 +56023,7 @@ async function runAttachEvidence(options) {
     );
     process.exit(1);
   }
-  const body = readFileSync5(options.file);
-  const put = await fetch(slot.body.uploadUrl, { method: "PUT", body: new Uint8Array(body) });
-  if (!put.ok) {
-    console.error(
-      colorError(
-        `Upload to storage failed (status ${put.status}). The upload link is short-lived \u2014 re-run the command.`
-      )
-    );
-    process.exit(1);
-  }
+  await putFileToPresignedUrl(slot.body.uploadUrl, options.file);
   const attached = await authenticatedRequest(
     (client) => client.pentestFinding.attachFindingEvidence({
       params: params3,
@@ -55896,8 +56832,8 @@ function requiredExtensionForKind(kind) {
   return ".zip";
 }
 function defaultDisplayName(originalFilename) {
-  const base2 = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
-  return base2.slice(0, 200) || "source";
+  const base3 = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base3.slice(0, 200) || "source";
 }
 function formatArchiveBytes(bytes) {
   if (bytes < 1024) return `${bytes} B`;
@@ -56812,6 +57748,258 @@ function createAttestationCommand() {
   return attestation;
 }
 
+// src/pentest/documents.ts
+import { basename as basename5 } from "path";
+
+// src/pentest/intake-errors.ts
+var WRITE_FORBIDDEN_MESSAGE = {
+  questionnaire: "Questionnaire writes require an organization admin (or Trace staff) signed in with a browser session. API keys are rejected.",
+  "questionnaire documents": "Questionnaire document writes require an organization admin (or Trace staff) signed in with a browser session. API keys are rejected."
+};
+function failIntakeRequest(status, body, options) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        options.action === "write" ? WRITE_FORBIDDEN_MESSAGE[options.subject] : message ?? `You do not have permission to view this ${options.subject}.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(
+      colorError(
+        options.notFound === void 0 ? message ?? "Not found." : `${options.notFound.what} not found: ${sanitizeDisplay(options.notFound.label)}.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? `Invalid ${options.subject} request (status 400).`));
+    process.exit(1);
+  }
+  if (status === 409) {
+    console.error(colorError(message ?? QUESTIONNAIRE_LOCKED_MESSAGE));
+    process.exit(1);
+  }
+  console.error(
+    colorError(
+      `Failed to ${options.action === "write" ? "save" : "load"} ${options.subject} (status ${status})${message ? `: ${message}` : "."}`
+    )
+  );
+  process.exit(1);
+}
+
+// src/pentest/documents.ts
+var TYPE_LIST = PentestIntakeDocumentTypeValues.join(", ");
+function isDocumentType(value) {
+  return PentestIntakeDocumentTypeValues.includes(value);
+}
+function renderDocumentLines(doc) {
+  const uploader = doc.uploadedByName ? ` by ${sanitizeDisplay(doc.uploadedByName)}` : "";
+  return [
+    `  ${sanitizeDisplay(doc.fileName)}`,
+    `      ${PENTEST_INTAKE_DOCUMENT_TYPE_LABELS[doc.documentType]} | ${formatBytes2(doc.fileSizeBytes)} | uploaded${uploader} on ${formatDate(doc.createdAt)}`,
+    `      id ${doc.documentId}`
+  ];
+}
+var TSV_HEADER = "documentId	documentType	fileName	fileType	fileSizeBytes	uploadedByName	createdAt";
+async function runList5(options) {
+  const output = parseOutput(options.output);
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const result = await authenticatedRequest(
+    (client) => client.pentestIntakeDocument.listDocuments({ params: { organizationId, pentestId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failIntakeRequest(result.status, result.body, {
+      subject: "questionnaire documents",
+      action: "read",
+      notFound: { what: "Pentest", label: options.pentest }
+    });
+  }
+  const { editable, documents } = result.body;
+  if (output === "json") {
+    printJson({ editable, documents });
+    return;
+  }
+  if (output === "tsv") {
+    console.log(TSV_HEADER);
+    for (const doc of documents) {
+      console.log(
+        [
+          doc.documentId,
+          doc.documentType,
+          tsvSafe(sanitizeDisplay(doc.fileName)),
+          tsvSafe(sanitizeDisplay(doc.fileType)),
+          String(doc.fileSizeBytes),
+          tsvSafe(doc.uploadedByName === null ? null : sanitizeDisplay(doc.uploadedByName)),
+          toIso(doc.createdAt)
+        ].join("	")
+      );
+    }
+    return;
+  }
+  console.log(`Editable: ${editable ? "yes" : "no"}`);
+  if (documents.length === 0) {
+    console.log("No documents attached.");
+    return;
+  }
+  console.log(`${documents.length} document${documents.length === 1 ? "" : "s"}:`);
+  for (const doc of documents) {
+    for (const line of renderDocumentLines(doc)) {
+      console.log(line);
+    }
+  }
+}
+async function runAttach(options) {
+  const output = parseTextOutput(options.output);
+  if (options.type !== void 0 && !isDocumentType(options.type)) {
+    console.error(colorError(`Invalid --type '${sanitizeDisplay(options.type)}'.`));
+    console.error(`Valid types: ${TYPE_LIST}`);
+    process.exit(1);
+  }
+  const sizeBytes = statUploadFile(options.file, {
+    bytes: MAX_PENTEST_INTAKE_DOCUMENT_BYTES,
+    noun: "document"
+  });
+  const fileName = basename5(options.file);
+  const documentType = options.type !== void 0 && isDocumentType(options.type) ? options.type : guessPentestIntakeDocumentType(fileName);
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const params3 = { organizationId, pentestId };
+  const slot = await authenticatedRequest(
+    (client) => client.pentestIntakeDocument.createUpload({
+      params: params3,
+      body: { fileName, fileSizeBytes: sizeBytes }
+    })
+  );
+  if (slot.status !== CREATED_STATUS) {
+    failIntakeRequest(slot.status, slot.body, {
+      subject: "questionnaire documents",
+      action: "write",
+      notFound: { what: "Pentest", label: options.pentest }
+    });
+  }
+  const fileType = pentestIntakeDocumentMimeType(fileName);
+  await putFileToPresignedUrl(slot.body.uploadUrl, options.file, { contentType: fileType });
+  const attached = await authenticatedRequest(
+    (client) => client.pentestIntakeDocument.attachDocument({
+      params: params3,
+      body: {
+        uploadKey: slot.body.uploadKey,
+        documentType,
+        fileName,
+        fileType
+      }
+    })
+  );
+  if (attached.status !== CREATED_STATUS) {
+    failIntakeRequest(attached.status, attached.body, {
+      subject: "questionnaire documents",
+      action: "write",
+      notFound: { what: "Pentest", label: options.pentest }
+    });
+  }
+  if (output === "json") {
+    printJson(attached.body);
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Attached ${sanitizeDisplay(attached.body.fileName)} (${PENTEST_INTAKE_DOCUMENT_TYPE_LABELS[attached.body.documentType]}, ${formatBytes2(attached.body.fileSizeBytes)})`
+    )
+  );
+  console.log(`  id ${attached.body.documentId}`);
+}
+async function runRemove(documentId, options) {
+  if (!isUuid(documentId)) {
+    console.error(
+      colorError(
+        `Invalid document ID '${sanitizeDisplay(documentId)}'. Pass the UUID from \`tracecli pentest documents list\`.`
+      )
+    );
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const pentestId = await resolvePentestId(organizationId, options.pentest);
+  const confirmed = await confirmDeletion(`document ${documentId}`, options.yes === true);
+  if (!confirmed) {
+    console.log("Cancelled.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.pentestIntakeDocument.deleteDocument({
+      params: { organizationId, pentestId, documentId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failIntakeRequest(result.status, result.body, {
+      subject: "questionnaire documents",
+      action: "write",
+      notFound: { what: "Document", label: documentId }
+    });
+  }
+  console.log(colorSuccess(`Removed document ${documentId}.`));
+}
+function createListCommand6() {
+  return new Command("list").description("List documents attached to the intake questionnaire").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli pentest documents list --pentest PT-1
+  tracecli pentest documents list --pentest PT-1 --output json`
+  ).action(async (options) => {
+    await runList5(options);
+  });
+}
+function createAttachCommand() {
+  return new Command("attach").description(
+    "Attach a document (prior report, architecture diagram, threat model) to the questionnaire"
+  ).requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").requiredOption("--file <path>", "Path to the document").option(
+    "--type <type>",
+    `Document type (${TYPE_LIST}); guessed from the file name when omitted`
+  ).option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
+    "after",
+    `
+Answers the questionnaire's "documents to share" question. Same edit window as
+the answers: allowed until testing starts. Every documents command needs a
+browser session from \`tracecli auth login\`; API keys are rejected. Attach and
+remove also need an organization admin (or Trace staff).
+Up to ${formatBytes2(MAX_PENTEST_INTAKE_DOCUMENT_BYTES)} per file.
+
+Examples:
+  tracecli pentest documents attach --pentest PT-1 --file ./threat-model.pdf
+  tracecli pentest documents attach --pentest PT-1 --file ./q3-report.pdf --type PREVIOUS_PENTEST
+  tracecli pentest documents attach --pentest PT-1 --file ./arch.png --output json`
+  ).action(async (options) => {
+    await runAttach(options);
+  });
+}
+function createRemoveCommand() {
+  return new Command("remove").description("Remove a document from the intake questionnaire").argument("<documentId>", "Document UUID (from `documents list`)").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("-y, --yes", "Skip the confirmation prompt").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli pentest documents remove 3f1c... --pentest PT-1
+  tracecli pentest documents remove 3f1c... --pentest PT-1 --yes`
+  ).action(async (documentId, options) => {
+    await runRemove(documentId, options);
+  });
+}
+function createDocumentsCommand() {
+  const documents = new Command("documents").description(
+    "Documents attached to the pentest intake questionnaire"
+  );
+  documents.addCommand(createListCommand6());
+  documents.addCommand(createAttachCommand());
+  documents.addCommand(createRemoveCommand());
+  return documents;
+}
+
 // src/pentest/get-finding.ts
 var OUTPUT_FORMATS2 = ["text", "json"];
 function isOutputFormat2(value) {
@@ -57261,7 +58449,10 @@ function parseQuestionnaireAnswersFile(raw, sourceLabel = "file") {
       error: `${sourceLabel} must contain the answers object directly, not an { answers } wrapper. The CLI wraps it for the API.`
     };
   }
-  const result = PentestCustomerIntakeAnswersSchema.safeParse(parsed);
+  const withoutNulls = Object.fromEntries(
+    Object.entries(parsed).filter(([, value]) => value !== null)
+  );
+  const result = PentestCustomerIntakeAnswersSchema.safeParse(withoutNulls);
   if (!result.success) {
     const issue2 = result.error.issues[0];
     const path3 = issue2?.path.length ? issue2.path.join(".") : "answers";
@@ -57286,6 +58477,12 @@ function applyMultiSelectIntakeAnswer(current, key, selected) {
     [key]: Array.from(new Set(selected)).sort()
   };
 }
+function mergeIntakeAnswers(base3, patch) {
+  return normalizePentestCustomerIntakeAnswers({
+    ...base3 ?? {},
+    ...patch
+  });
+}
 function formatIssueClasses(values) {
   return values.map((v) => INTAKE_ISSUE_CLASS_LABELS[v]).join(", ");
 }
@@ -57317,22 +58514,113 @@ function formatAnswerValue(key, answers) {
     }
   }
 }
+var NOT_ANSWERED = "(not answered)";
 function formatQuestionnaireShow(input) {
   const submitted = input.submitted === true;
   const editableLine = input.editable ? "yes" : input.lockedReason === "ENGAGEMENT_ENDED" ? "no (engagement has ended)" : input.lockedReason === "TESTING_STARTED" ? "no (testing has started)" : "no";
-  const lines = [`Editable: ${editableLine}`, `Submitted: ${submitted ? "yes" : "no"}`];
-  if (input.answers === null || Object.keys(input.answers).length === 0) {
-    lines.push("Answers: (none)");
-    return lines.join("\n");
-  }
-  lines.push("Answers:");
+  const answers = input.answers ?? {};
+  const lines = [
+    `Editable: ${editableLine}`,
+    `Submitted: ${submitted ? "yes" : "no"}`,
+    `Answers: ${countAnsweredIntakeQuestions(answers)} of ${PENTEST_CUSTOMER_INTAKE_QUESTION_COUNT} questions filled`
+  ];
   for (const key of PENTEST_CUSTOMER_INTAKE_ANSWER_KEYS) {
-    const value = formatAnswerValue(key, input.answers);
-    if (value === null) {
-      continue;
+    const value = formatAnswerValue(key, answers) ?? NOT_ANSWERED;
+    lines.push(`${PENTEST_CUSTOMER_INTAKE_LABELS[key]} (${key}): ${value}`);
+  }
+  return lines.join("\n");
+}
+function buildQuestionnaireExport(answers) {
+  const n3 = normalizePentestCustomerIntakeAnswers(answers ?? {});
+  const text = (value) => value === void 0 || value.trim() === "" ? null : value;
+  const list = (value) => value === void 0 || value.length === 0 ? null : [...value];
+  return {
+    issueClasses: list(n3.issueClasses),
+    issueClassesNotes: text(n3.issueClassesNotes),
+    focusAreas: text(n3.focusAreas),
+    rolesAndPermissions: text(n3.rolesAndPermissions),
+    authenticationSetup: text(n3.authenticationSetup),
+    tenantIsolationExpectation: text(n3.tenantIsolationExpectation),
+    surfaces: list(n3.surfaces),
+    surfacesNotes: text(n3.surfacesNotes),
+    thirdParties: text(n3.thirdParties),
+    sensitiveData: text(n3.sensitiveData),
+    neverTouch: text(n3.neverTouch),
+    knownRisks: text(n3.knownRisks),
+    tribalKnowledge: text(n3.tribalKnowledge)
+  };
+}
+function buildQuestionnaireRecordJson(input) {
+  const toIsoString = (value) => typeof value === "string" ? value : value.toISOString();
+  return {
+    pentestId: input.pentestId,
+    editable: input.editable,
+    lockedReason: input.lockedReason ?? null,
+    submitted: input.submittedAt != null,
+    submittedAt: input.submittedAt == null ? null : toIsoString(input.submittedAt),
+    updatedAt: toIsoString(input.updatedAt),
+    answers: buildQuestionnaireExport(input.answers)
+  };
+}
+var DOCUMENTS_ATTACH_COMMAND = "tracecli pentest documents attach --pentest <pentestId> --file <path>";
+function buildQuestionnaireCatalog() {
+  const questions = PENTEST_CUSTOMER_INTAKE_QUESTIONS.map(
+    (entry, index) => {
+      if (entry.kind === "text") {
+        return {
+          number: index + 1,
+          key: entry.key,
+          kind: "text",
+          question: entry.question,
+          helper: entry.helper ?? null,
+          options: null,
+          notes: null
+        };
+      }
+      return {
+        number: index + 1,
+        key: entry.key,
+        kind: "multiSelect",
+        question: entry.question,
+        helper: entry.helper ?? null,
+        options: entry.key === "issueClasses" ? issueClassSelectOptions() : surfaceSelectOptions(),
+        notes: { key: entry.notesKey, question: entry.notesQuestion }
+      };
+    }
+  );
+  return {
+    questions,
+    documents: {
+      question: PENTEST_INTAKE_DOCUMENTS_QUESTION,
+      command: DOCUMENTS_ATTACH_COMMAND,
+      types: PentestIntakeDocumentTypeValues.map((value) => ({
+        value,
+        label: PENTEST_INTAKE_DOCUMENT_TYPE_LABELS[value]
+      }))
+    }
+  };
+}
+function formatQuestionnaireCatalog(catalog) {
+  const lines = [];
+  for (const entry of catalog.questions) {
+    lines.push(`${entry.number}. ${entry.question}`);
+    if (entry.helper !== null) {
+      lines.push(`   ${entry.helper}`);
     }
-    lines.push(`${PENTEST_CUSTOMER_INTAKE_LABELS[key]}: ${value}`);
+    lines.push(`   key: ${entry.key} (${entry.kind === "text" ? "text" : "multi-select"})`);
+    if (entry.options !== null) {
+      lines.push(`   options: ${entry.options.map((o2) => `${o2.value} (${o2.label})`).join(", ")}`);
+    }
+    if (entry.notes !== null) {
+      lines.push(`   notes key: ${entry.notes.key} (text): ${entry.notes.question}`);
+    }
+    lines.push("");
   }
+  lines.push(`${catalog.questions.length + 1}. ${catalog.documents.question}`);
+  lines.push(`   Files, not an answers key. Attach with: ${catalog.documents.command}`);
+  lines.push(
+    `   types: ${catalog.documents.types.map((t2) => `${t2.value} (${t2.label})`).join(", ")}`
+  );
   return lines.join("\n");
 }
 function issueClassSelectOptions() {
@@ -57431,7 +58719,7 @@ function formatFindingSeverity(severity) {
       return severity;
   }
 }
-function createListCommand6() {
+function createListCommand7() {
   return new Command("list").description("List pentests for your organization").option(
     "--status <status>",
     "Filter by status (SCOPING, IN_PROGRESS, REMEDIATION, CLOSED)",
@@ -57994,46 +59282,6 @@ Examples:
     await runUpdate5(pentestId, options);
   });
 }
-function failQuestionnaire(status, body, action, notFoundLabel) {
-  const { message } = readErrorFields(body);
-  if (status === UNAUTHORIZED_STATUS2) {
-    exitAuthFailed();
-  }
-  if (status === 403) {
-    if (action === "write") {
-      console.error(
-        colorError(
-          "Questionnaire writes require an organization admin (or Trace staff) signed in with a browser session. API keys are rejected."
-        )
-      );
-    } else {
-      console.error(
-        colorError(message ?? "You do not have permission to view this questionnaire.")
-      );
-    }
-    process.exit(1);
-  }
-  if (status === 404) {
-    console.error(
-      colorError(notFoundLabel ? `Pentest not found: ${notFoundLabel}.` : message ?? "Not found.")
-    );
-    process.exit(1);
-  }
-  if (status === 400) {
-    console.error(colorError(message ?? "Invalid questionnaire answers (status 400)."));
-    process.exit(1);
-  }
-  if (status === 409) {
-    console.error(colorError(message ?? QUESTIONNAIRE_LOCKED_MESSAGE));
-    process.exit(1);
-  }
-  console.error(
-    colorError(
-      `Failed to ${action === "write" ? "save" : "load"} questionnaire (status ${status})${message ? `: ${message}` : "."}`
-    )
-  );
-  process.exit(1);
-}
 async function fetchQuestionnaire(organizationId, pentestId, notFoundLabel) {
   const result = await authenticatedRequest(
     (client) => client.pentest.getCustomerPentestQuestionnaire({
@@ -58041,7 +59289,11 @@ async function fetchQuestionnaire(organizationId, pentestId, notFoundLabel) {
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failQuestionnaire(result.status, result.body, "read", notFoundLabel);
+    failIntakeRequest(result.status, result.body, {
+      subject: "questionnaire",
+      action: "read",
+      notFound: { what: "Pentest", label: notFoundLabel }
+    });
   }
   return toQuestionnaireGetBody(result.body);
 }
@@ -58054,7 +59306,11 @@ async function putQuestionnaire(organizationId, pentestId, answers, notFoundLabe
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failQuestionnaire(result.status, result.body, "write", notFoundLabel);
+    failIntakeRequest(result.status, result.body, {
+      subject: "questionnaire",
+      action: "write",
+      notFound: { what: "Pentest", label: notFoundLabel }
+    });
   }
   return toQuestionnaireGetBody(result.body);
 }
@@ -58066,7 +59322,11 @@ async function submitQuestionnaire(organizationId, pentestId, answers, notFoundL
     })
   );
   if (result.status !== SUCCESS_STATUS) {
-    failQuestionnaire(result.status, result.body, "write", notFoundLabel);
+    failIntakeRequest(result.status, result.body, {
+      subject: "questionnaire",
+      action: "write",
+      notFound: { what: "Pentest", label: notFoundLabel }
+    });
   }
   return toQuestionnaireGetBody(result.body);
 }
@@ -58149,35 +59409,85 @@ async function promptQuestionnaireAnswers(existing) {
   }
   return working;
 }
-async function runQuestionnaire(pentestIdentifier, options) {
-  const show = options.show === true;
-  const filePath = options.file;
-  const submit = options.submit === true;
-  if (show && filePath !== void 0) {
-    console.error(colorError("Pass only one of --show / --file."));
+function resolveQuestionnaireMode(options) {
+  const exclusive = [
+    { flag: "--show", set: options.show === true },
+    { flag: "--questions", set: options.questions === true },
+    { flag: "--export", set: options.export === true },
+    { flag: "--file", set: options.file !== void 0 }
+  ];
+  const chosen = exclusive.filter((entry) => entry.set);
+  if (chosen.length > 1) {
+    console.error(colorError(`Pass only one of ${chosen.map((c84) => c84.flag).join(" / ")}.`));
+    process.exit(1);
+  }
+  const only = chosen[0];
+  if (only !== void 0 && only.flag !== "--file" && options.submit === true) {
+    console.error(colorError(`Pass only one of ${only.flag} / --submit.`));
     process.exit(1);
   }
-  if (show && submit) {
-    console.error(colorError("Pass only one of --show / --submit."));
+  if (options.merge === true && options.file === void 0) {
+    console.error(colorError("--merge needs --file <path>."));
     process.exit(1);
   }
+  if (options.show) return { kind: "show" };
+  if (options.questions) return { kind: "questions" };
+  if (options.export) return { kind: "export" };
+  if (options.file !== void 0) {
+    return { kind: "file", path: options.file, merge: options.merge === true };
+  }
+  if (options.submit) return { kind: "submit" };
+  return { kind: "interactive" };
+}
+function printQuestionnaireRecord(body, output, successLine) {
+  if (output === "json") {
+    printJson(buildQuestionnaireRecordJson(body));
+    return;
+  }
+  if (successLine !== void 0) {
+    console.log(colorSuccess(successLine));
+  }
+  console.log(formatQuestionnaireShow(questionnaireShowInput(body)));
+}
+function submittedLine(record2) {
+  return record2.editable ? "Submitted questionnaire. You can edit until testing starts." : "Submitted questionnaire.";
+}
+async function runQuestionnaire(pentestIdentifier, options) {
+  const mode = resolveQuestionnaireMode(options);
+  const output = parseTextOutput(options.output);
+  const submit = options.submit === true;
+  if (mode.kind === "questions") {
+    const catalog = buildQuestionnaireCatalog();
+    if (output === "json") {
+      printJson(catalog);
+    } else {
+      console.log(formatQuestionnaireCatalog(catalog));
+    }
+    return;
+  }
   const isInteractiveTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  if (!show && filePath === void 0 && !submit && !isInteractiveTty) {
+  if (mode.kind === "interactive" && !isInteractiveTty) {
     console.error(
       colorError(
-        "Interactive questionnaire requires a TTY. Use --show to print answers, --file <path> to upload an answers JSON object, or --submit to mark the current answers done."
+        "Interactive questionnaire requires a TTY. Without one: --questions lists every question with its answer key, --export prints the current answers as JSON (blanks as null), --file <path> --merge uploads only the keys the file sets, --show prints the saved state, --submit marks it done. --file without --merge replaces every saved answer, so keys missing or null in the file are cleared."
       )
     );
     process.exit(2);
   }
   const organizationId = await resolveOrganizationId();
   const pentestId = await resolvePentestId(organizationId, pentestIdentifier);
-  if (show) {
+  if (mode.kind === "show") {
+    const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
+    printQuestionnaireRecord(current2, output);
+    return;
+  }
+  if (mode.kind === "export") {
     const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
-    console.log(formatQuestionnaireShow(questionnaireShowInput(current2)));
+    printJson(buildQuestionnaireExport(current2.answers));
     return;
   }
-  if (filePath !== void 0) {
+  if (mode.kind === "file") {
+    const filePath = mode.path;
     let raw;
     try {
       raw = readFileSync7(filePath, "utf8");
@@ -58190,28 +59500,27 @@ async function runQuestionnaire(pentestIdentifier, options) {
       console.error(colorError(parsed.error));
       process.exit(1);
     }
-    const saved2 = submit ? await submitQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier) : await putQuestionnaire(organizationId, pentestId, parsed.answers, pentestIdentifier);
-    console.log(
-      colorSuccess(
-        submit ? "Submitted questionnaire. You can edit until testing starts." : "Saved questionnaire answers."
-      )
+    let answers = parsed.answers;
+    if (mode.merge) {
+      const current2 = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
+      answers = mergeIntakeAnswers(current2.answers, parsed.answers);
+    }
+    const saved2 = submit ? await submitQuestionnaire(organizationId, pentestId, answers, pentestIdentifier) : await putQuestionnaire(organizationId, pentestId, answers, pentestIdentifier);
+    printQuestionnaireRecord(
+      saved2,
+      output,
+      submit ? submittedLine(saved2) : "Saved questionnaire answers."
     );
-    console.log(formatQuestionnaireShow(questionnaireShowInput(saved2)));
     return;
   }
-  if (submit) {
+  if (mode.kind === "submit") {
     const submitted = await submitQuestionnaire(
       organizationId,
       pentestId,
       void 0,
       pentestIdentifier
     );
-    console.log(
-      colorSuccess(
-        submitted.editable ? "Submitted questionnaire. You can edit until testing starts." : "Submitted questionnaire."
-      )
-    );
-    console.log(formatQuestionnaireShow(questionnaireShowInput(submitted)));
+    printQuestionnaireRecord(submitted, output, submittedLine(submitted));
     return;
   }
   const current = await fetchQuestionnaire(organizationId, pentestId, pentestIdentifier);
@@ -58225,32 +59534,48 @@ async function runQuestionnaire(pentestIdentifier, options) {
   }
   const merged = await promptQuestionnaireAnswers(current.answers);
   const saved = await putQuestionnaire(organizationId, pentestId, merged, pentestIdentifier);
-  console.log(colorSuccess("Saved questionnaire answers."));
-  console.log(formatQuestionnaireShow(questionnaireShowInput(saved)));
+  printQuestionnaireRecord(saved, output, "Saved questionnaire answers.");
 }
 function createQuestionnaireCommand() {
-  return new Command("questionnaire").description("View or fill the customer pentest intake questionnaire").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--show", "Print current answers using shared labels (GET)").option(
+  return new Command("questionnaire").description("View or fill the customer pentest intake questionnaire").argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--show", "Print every question with its answer key and current answer (GET)").option(
+    "--questions",
+    "Print the question catalog: keys, kinds, option values (no auth needed)"
+  ).option("--export", "Print the current answers as JSON, every key present, blanks as null").option(
     "--file <path>",
-    "Upload answers from a JSON file (answers object only \u2014 not { answers }; whole-object replace)"
-  ).option("--submit", "Mark the questionnaire as done (still editable until testing starts)").addHelpText(
+    "Upload answers from a JSON file (the answers object itself). Replaces every saved answer: keys missing or null in the file are cleared unless you add --merge"
+  ).option(
+    "--merge",
+    "With --file: change only the keys the file sets; keep every other saved answer"
+  ).option("--submit", "Mark the questionnaire as done (still editable until testing starts)").option("-o, --output <format>", "Output format: text, json (default: text)", "text").addHelpText(
     "after",
     `
-Optional scoping questionnaire. Editable until testing starts. Reads accept a
-browser session or API key;
-writes require an organization admin (or Trace staff) signed in via \`tracecli
-auth login\` \u2014 API keys are rejected.
+Optional scoping questionnaire, editable until testing starts.
+Every mode but --questions needs a browser session from \`tracecli auth login\`;
+API keys are rejected. Writes (--file, --submit, the TTY fill) also need an
+organization admin (or Trace staff).
 
 Modes:
-  --show          GET and print key: value with shared customer-facing labels
-  --file <path>   PUT the file's answers object (CLI wraps { answers } for the API)
+  --questions     The question catalog with answer keys and option values
+  --show          GET and print every question with its key and current answer
+  --export        GET and print the answers object as JSON (all keys, null when blank)
+  --file <path>   PUT the file's answers object, replacing every saved answer;
+                  add --merge to change only the keys the file sets
   --submit        Mark as done (combine with --file or TTY fill, or alone)
   (TTY default)   load-merge-write: GET, prompt each question, confirm, PUT
 
-Non-interactive shells must pass --show, --file, or --submit (exit 2 otherwise).
+Every mode takes -o json. Non-interactive shells must pass one of the flags
+above (exit 2 otherwise).
+
+Scripted fill (what a coding agent runs):
+  tracecli pentest questionnaire PT-1 --questions
+  tracecli pentest questionnaire PT-1 --export > answers.json
+  # fill in the null values the code can answer, then
+  tracecli pentest questionnaire PT-1 --file answers.json --merge
+  tracecli pentest documents attach --pentest PT-1 --file ./threat-model.pdf
 
 Examples:
   tracecli pentest questionnaire PT-1 --show
-  tracecli pentest questionnaire PT-1 --file answers.json
+  tracecli pentest questionnaire PT-1 --show -o json
   tracecli pentest questionnaire PT-1 --file answers.json --submit
   tracecli pentest questionnaire PT-1 --submit
   tracecli pentest questionnaire PT-1`
@@ -58260,11 +59585,12 @@ Examples:
 }
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
-  pentest.addCommand(createListCommand6());
+  pentest.addCommand(createListCommand7());
   pentest.addCommand(createUpdateCommand4());
   pentest.addCommand(createCreatePentestCommand(), { hidden: true });
   pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
+  pentest.addCommand(createDocumentsCommand());
   pentest.addCommand(createFindingsCommand());
   pentest.addCommand(createHypothesesCommand(), { hidden: true });
   pentest.addCommand(createReportCommand());
@@ -58901,7 +60227,7 @@ Examples:
 // src/upload/download.ts
 import { createHash as createHash2 } from "crypto";
 import { open as open3, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
-import { basename as basename5, join as join8, resolve as resolve2 } from "path";
+import { basename as basename6, join as join8, resolve as resolve2 } from "path";
 var CodeUploadDownloadError = class extends Error {
   constructor(message) {
     super(message);
@@ -58911,7 +60237,7 @@ var CodeUploadDownloadError = class extends Error {
 function safeDownloadFilename(upload) {
   const extension = requiredExtensionForKind(upload.artifactKind);
   const fallback = `app${extension}`;
-  const stripped = Array.from(basename5(upload.originalFilename.replace(/\\/g, "/")), (char) => {
+  const stripped = Array.from(basename6(upload.originalFilename.replace(/\\/g, "/")), (char) => {
     const code = char.codePointAt(0) ?? 0;
     return code <= 31 || code === 127 ? "_" : char;
   }).join("").trim();
@@ -59326,13 +60652,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c83) => c83.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c83) => c83.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c83) => c83.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c83) => c83.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c84) => c84.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c84) => c84.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c84) => c84.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c83) => `${c83.name.padEnd(nameWidth)}  ${c83.kind.padEnd(kindWidth)}  ${c83.status.padEnd(statusWidth)}  ${c83.size.padEnd(sizeWidth)}  ${c83.id}`
+    (c84) => `${c84.name.padEnd(nameWidth)}  ${c84.kind.padEnd(kindWidth)}  ${c84.status.padEnd(statusWidth)}  ${c84.size.padEnd(sizeWidth)}  ${c84.id}`
   );
   return { header, rows };
 }
@@ -59686,7 +61012,7 @@ async function runResume(codeUploadIdArg, filePath, options, runtime) {
   }
   outputUpload(upload, output);
 }
-async function runList5(options) {
+async function runList6(options) {
   const output = parseOutput(options.output);
   if (options.web) {
     const slug = await resolveOrganizationSlug();
@@ -59819,7 +61145,7 @@ async function runDelete5(codeUploadIdArg, options) {
   }
   console.log(colorSuccess(`Deleted upload ${codeUploadId}`));
 }
-async function runLink(options) {
+async function runLink2(options) {
   const output = parseOutput(options.output);
   const applicationId = requireUuid(options.app, "--app");
   const codeUploadId = requireUuid(options.upload, "--upload");
@@ -59901,9 +61227,9 @@ Examples:
     await runBuild(file2, options, runtime);
   });
 }
-function createListCommand7() {
+function createListCommand8() {
   return new Command("list").description("List source and build uploads in the active organization").option("--kind <kind>", "Filter: source (code ZIP), apk, or ipa").option("--app <applicationId>", "Filter build uploads for one application").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").option("-w, --web", "Open the source uploads page in a browser").action(async (options) => {
-    await runList5(options);
+    await runList6(options);
   });
 }
 function createGetCommand4() {
@@ -59951,7 +61277,7 @@ function createDeleteCommand5() {
     await runDelete5(codeUploadId, options);
   });
 }
-function createLinkCommand() {
+function createLinkCommand2() {
   return new Command("link").description("Link a ready source upload to an application").requiredOption("--app <applicationId>", "Application UUID").requiredOption("--upload <codeUploadId>", "Upload UUID (must be a ready source ZIP)").option("--path <repositoryPath>", "Path within the archive").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
@@ -59961,7 +61287,7 @@ APK and IPA builds attach to an application with \`upload build --app\`.
 Examples:
   tracecli upload link --app <applicationId> --upload <codeUploadId>`
   ).action(async (options) => {
-    await runLink(options);
+    await runLink2(options);
   });
 }
 function createUploadCommand(runtime = {}) {
@@ -59969,13 +61295,13 @@ function createUploadCommand(runtime = {}) {
   const upload = new Command("upload").alias("code-upload").description("Upload source archives and mobile builds for pentest; download builds back");
   upload.addCommand(createCreateCommand5(resolved));
   upload.addCommand(createBuildCommand(resolved));
-  upload.addCommand(createListCommand7());
+  upload.addCommand(createListCommand8());
   upload.addCommand(createGetCommand4());
   upload.addCommand(createDownloadCommand(resolved));
   upload.addCommand(createResumeCommand(resolved));
   upload.addCommand(createWaitCommand(resolved));
   upload.addCommand(createDeleteCommand5());
-  upload.addCommand(createLinkCommand());
+  upload.addCommand(createLinkCommand2());
   return upload;
 }
 
@@ -60214,7 +61540,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand8() {
+function createListCommand9() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -60348,7 +61674,7 @@ Examples:
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
   vulnerabilities.addCommand(createGetCommand5());
-  vulnerabilities.addCommand(createListCommand8());
+  vulnerabilities.addCommand(createListCommand9());
   return vulnerabilities;
 }