securewithtrace 0.51.0 → 0.54.0

package/dist/index.js

@@ -3427,10 +3427,11 @@ var Permission = {
   VIEW_RESULTS: "VIEW_RESULTS",
   EXPORT_ORG_DATA: "EXPORT_ORG_DATA",
   DELETE_ORG_DATA: "DELETE_ORG_DATA",
-  MANAGE_AI_INTEGRATION: "MANAGE_AI_INTEGRATION",
+  /** Connecting and configuring third-party integrations. */
+  MANAGE_INTEGRATIONS: "MANAGE_INTEGRATIONS",
   MANAGE_INTEGRATED_REPOSITORIES: "MANAGE_INTEGRATED_REPOSITORIES",
   MANAGE_USERS: "MANAGE_USERS",
-  /** Invite or remove org members (admin + analyst). Distinct from MANAGE_USERS (admin-only API keys / role changes). */
+  /** Invite or remove org members. Distinct from MANAGE_USERS (role changes, API keys). */
   INVITE_USERS: "INVITE_USERS",
   MANAGE_ORGANIZATION: "MANAGE_ORGANIZATION",
   MANAGE_PENTESTS: "MANAGE_PENTESTS",
@@ -3440,16 +3441,15 @@ var Permission = {
 // ../../packages/core/src/auth/permissions.ts
 var ROLE_PERMISSIONS = {
   [Role.developer]: /* @__PURE__ */ new Set([Permission.RUN_SCAN, Permission.VIEW_RESULTS]),
+  // Shown as Manager: sets up and runs testing. Billing, people and API keys stay admin-only.
   [Role.analyst]: /* @__PURE__ */ new Set([
     Permission.RUN_SCAN,
     Permission.VIEW_RESULTS,
     Permission.EXPORT_ORG_DATA,
     Permission.MANAGE_INTEGRATED_REPOSITORIES,
-    Permission.MANAGE_AI_INTEGRATION,
-    Permission.INVITE_USERS
-    // MANAGE_PENTESTS removed — pentest writes now `requireStaff`
-    // (PR-0b-i M3 / D14). Constant stays in the enum for backward compat
-    // until v2 cleanup; analysts no longer get it.
+    Permission.MANAGE_INTEGRATIONS,
+    Permission.MANAGE_APPLICATIONS,
+    Permission.MANAGE_PENTESTS
   ]),
   [Role.admin]: new Set(Object.values(Permission))
 };
@@ -6283,7 +6283,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base644 = data.replace(/[-_]/g, (c84) => c84 === "-" ? "+" : "/");
+  const base644 = data.replace(/[-_]/g, (c86) => c86 === "-" ? "+" : "/");
   const padded = base644.padEnd(Math.ceil(base644.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -16327,9 +16327,9 @@ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params3) => dateProcessor(inst, ctx, json2, params3);
   inst.min = (value, params3) => inst.check(_gte(value, params3));
   inst.max = (value, params3) => inst.check(_lte(value, params3));
-  const c84 = inst._zod.bag;
-  inst.minDate = c84.minimum ? new Date(c84.minimum) : null;
-  inst.maxDate = c84.maximum ? new Date(c84.maximum) : null;
+  const c86 = inst._zod.bag;
+  inst.minDate = c86.minimum ? new Date(c86.minimum) : null;
+  inst.maxDate = c86.maximum ? new Date(c86.maximum) : null;
 });
 function date3(params3) {
   return _date(ZodDate, params3);
@@ -17460,6 +17460,7 @@ config(en_default());
 
 // ../../packages/core/src/text/prompt-sanitize.ts
 var CREDENTIAL_KEY_SOURCE = "password|secret|token|access[_ -]?token|refresh[_ -]?token|cookie|authorization|bearer|api[_ -]?key|private[_ -]?key|session|credential|(?<![A-Za-z])(?:passwd|pwd|pass)";
+var PROVIDER_KEY_SOURCE = String.raw`\bsk-[A-Za-z0-9_-]{16,}\b`;
 var HIGH_ENTROPY_RUN_SOURCE = String.raw`\b(sk-[A-Za-z0-9_-]{16,}|[A-Za-z0-9+/_=-]{40,})\b`;
 
 // ../../packages/core/src/text/evidence-redact.ts
@@ -17612,14 +17613,16 @@ var SEGMENT = new RegExp(`[A-Za-z0-9_+-]{${MIN_RUN},}`, "g");
 
 // ../../packages/core/src/agent-session/versions.ts
 var COORDINATOR_TOOLSET_VERSION = "coordinator-tools-v4";
-var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v7";
-var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v8";
+var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v9";
+var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v10";
 var OPERATOR_REVIEW_V1_PROMPT_VERSION = "operator-review-v1";
 var OPERATOR_REVIEW_V2_PROMPT_VERSION = "operator-review-v2";
 var OPERATOR_REVIEW_V3_PROMPT_VERSION = "operator-review-v3";
 var OPERATOR_REVIEW_V4_PROMPT_VERSION = "operator-review-v4";
 var OPERATOR_REVIEW_V5_PROMPT_VERSION = "operator-review-v5";
 var OPERATOR_REVIEW_V6_PROMPT_VERSION = "operator-review-v6";
+var OPERATOR_REVIEW_V7_PROMPT_VERSION = "operator-review-v7";
+var OPERATOR_REVIEW_V8_PROMPT_VERSION = "operator-review-v8";
 var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V1_PROMPT_VERSION,
   OPERATOR_REVIEW_V2_PROMPT_VERSION,
@@ -17627,6 +17630,8 @@ var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V4_PROMPT_VERSION,
   OPERATOR_REVIEW_V5_PROMPT_VERSION,
   OPERATOR_REVIEW_V6_PROMPT_VERSION,
+  OPERATOR_REVIEW_V7_PROMPT_VERSION,
+  OPERATOR_REVIEW_V8_PROMPT_VERSION,
   OPERATOR_REVIEW_PROMPT_VERSION,
   OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION
 ];
@@ -17707,7 +17712,14 @@ var ENVIRONMENT_AWARE_PROMPT_VERSIONS = /* @__PURE__ */ new Set([
   "operator-openai-v26",
   "operator-openai-v27",
   "operator-openai-v28",
-  "operator-openai-v29"
+  "operator-openai-v29",
+  // The Claude operator pins every provider launches.
+  "operator-v30",
+  "operator-v31",
+  "operator-v32",
+  "operator-v33",
+  "operator-v34",
+  "operator-v35"
 ]);
 var OOB_PROFILE_SUCCESSIONS = [
   {
@@ -18243,6 +18255,16 @@ var REVIEW_OOB_PROFILE_SUCCESSIONS = [
       toolsetVersion: "operator-tools-v10"
     }
   },
+  {
+    successor: {
+      promptVersion: OPERATOR_REVIEW_V7_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v12"
+    },
+    predecessor: {
+      promptVersion: OPERATOR_REVIEW_V8_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v10"
+    }
+  },
   {
     successor: {
       promptVersion: OPERATOR_REVIEW_PROMPT_VERSION,
@@ -18284,6 +18306,26 @@ var STAGE_RETIRED_OOB_PROFILE_SUCCESSIONS = [
     }
   }
 ];
+var ENVIRONMENT_AWARE_OPERATOR_OOB_PROFILE_SUCCESSIONS = [
+  {
+    successor: { promptVersion: "operator-v30", toolsetVersion: "operator-tools-v14" },
+    predecessor: { promptVersion: "operator-v31", toolsetVersion: "operator-tools-v15" }
+  },
+  {
+    successor: { promptVersion: "operator-v32", toolsetVersion: "operator-tools-v16" },
+    predecessor: { promptVersion: "operator-v31", toolsetVersion: "operator-tools-v15" }
+  }
+];
+var ACCOUNT_OPERATOR_OOB_PROFILE_SUCCESSIONS = [
+  {
+    successor: { promptVersion: "operator-v33", toolsetVersion: "operator-tools-v17" },
+    predecessor: { promptVersion: "operator-v34", toolsetVersion: "operator-tools-v18" }
+  },
+  {
+    successor: { promptVersion: "operator-v35", toolsetVersion: "operator-tools-v19" },
+    predecessor: { promptVersion: "operator-v34", toolsetVersion: "operator-tools-v18" }
+  }
+];
 var ALL_OOB_PROFILE_SUCCESSIONS = [
   ...OOB_PROFILE_SUCCESSIONS,
   ...STAFF_NOTIFICATION_OOB_PROFILE_SUCCESSIONS,
@@ -18301,7 +18343,9 @@ var ALL_OOB_PROFILE_SUCCESSIONS = [
   ...VALIDATION_V40_OOB_PROFILE_SUCCESSIONS,
   ...WRITER_REPRO_OOB_PROFILE_SUCCESSIONS,
   ...RETEST_REPRO_OOB_PROFILE_SUCCESSIONS,
-  ...STAGE_RETIRED_OOB_PROFILE_SUCCESSIONS
+  ...STAGE_RETIRED_OOB_PROFILE_SUCCESSIONS,
+  ...ENVIRONMENT_AWARE_OPERATOR_OOB_PROFILE_SUCCESSIONS,
+  ...ACCOUNT_OPERATOR_OOB_PROFILE_SUCCESSIONS
 ];
 var OOB_CAPABLE_TOOLSETS = new Set(
   ALL_OOB_PROFILE_SUCCESSIONS.map(({ successor }) => successor.toolsetVersion)
@@ -18326,9 +18370,10 @@ var STAFF_NOTIFICATION_TOOLSET_VERSIONS = /* @__PURE__ */ new Set([
   "report-tools-bsk-v3",
   "report-tools-v4",
   "report-tools-bsk-v4",
-  // API_COVERAGE_TOOLSET_VERSION and its predecessor, written out because they are declared below.
+  // API_COVERAGE_TOOLSET_VERSION and its predecessors, written out because they are declared below.
   "api-coverage-tools-v1",
   "api-coverage-tools-v2",
+  "api-coverage-tools-v3",
   // SETUP_TOOLSET_VERSION, written out for the same reason.
   "setup-tools-v1",
   ...STAFF_NOTIFICATION_OOB_PROFILE_SUCCESSIONS.flatMap(({ successor, predecessor }) => [
@@ -18343,6 +18388,10 @@ var STAFF_NOTIFICATION_TOOLSET_VERSIONS = /* @__PURE__ */ new Set([
     predecessor.toolsetVersion,
     successor.toolsetVersion
   ]),
+  ...ACCOUNT_OPERATOR_OOB_PROFILE_SUCCESSIONS.flatMap(({ successor, predecessor }) => [
+    predecessor.toolsetVersion,
+    successor.toolsetVersion
+  ]),
   ...FEATURE_COVERAGE_OOB_PROFILE_SUCCESSIONS.flatMap(({ successor, predecessor }) => [
     predecessor.toolsetVersion,
     successor.toolsetVersion
@@ -23294,8 +23343,8 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
     codeUploadId: AndroidBuildUnderTestSchema,
     /**
      * REVIEW launches the review session: an operator session that premise-checks every
-     * unpublished finding before its first turn and does not publish. Claude providers only
-     * (`REVIEW_PROVIDER_UNSUPPORTED`).
+     * unpublished finding before its first turn and does not publish. Its premise checks run on
+     * the session's provider.
      */
     purpose: OperatorSessionPurpose.optional()
   }),
@@ -23382,6 +23431,10 @@ var ResumeAgentSessionRequestSchema = external_exports.object({
    *  keeps the row's current target. */
   launchTarget: AgentSessionLaunchTarget.optional()
 });
+var SetAgentSessionBudgetRequestSchema = external_exports.object({
+  /** The session's new lifetime ceiling, past spend included. Must exceed recorded spend. */
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD)
+});
 var ClaimLocalLaunchResponseSchema = external_exports.object({
   agentSessionId: external_exports.uuid(),
   runAttemptId: external_exports.uuid(),
@@ -23592,6 +23645,20 @@ var OperatorPentestContextSchema = external_exports.object({
       reason: external_exports.string().nullable()
     })
   ),
+  /**
+   * Features excluded from this engagement, read at call time: an exclusion staff add after launch
+   * reaches a running session here, never through its brief. `handle` is `<ordinal>/<slug>`, as
+   * the brief's do-not-test list names it. Optional for the same host raw-cast reason as
+   * `applications`.
+   */
+  excludedFeatures: external_exports.array(
+    external_exports.object({
+      handle: external_exports.string(),
+      name: external_exports.string(),
+      reason: external_exports.string(),
+      endpoints: external_exports.array(external_exports.string())
+    })
+  ).optional(),
   // From the session's immutable repository pins (what the agent has checked out).
   repositories: external_exports.array(
     external_exports.object({
@@ -23894,6 +23961,22 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  setBudget: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/budget",
+    pathParams: AgentSessionIdParamsSchema,
+    body: SetAgentSessionBudgetRequestSchema,
+    responses: {
+      200: AgentSessionDetailSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // errorCode names the refusal; SESSION_NOT_LIVE means resume with the budget instead.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // The host image this environment's agent-session task definition runs. Reads
   // config, mints nothing: it exists so a staff CLI can pull the image BEFORE it
   // creates or resumes a LOCAL session, keeping the boot deadline off the pull.
@@ -25855,7 +25938,7 @@ var CreateLinearTicketsRequestSchema = external_exports.object({
   findingIds: external_exports.array(external_exports.string().min(1).max(64)).min(1).max(50),
   /** Single-finding requests only — a title with >1 finding is a 400. */
   title: external_exports.string().min(1).max(255).optional(),
-  /** Destination overrides — ADMIN ONLY (MANAGE_ORGANIZATION); a non-admin sending any is a 403. */
+  /** Destination overrides need MANAGE_INTEGRATIONS; anyone else sending one gets a 403. */
   teamId: linearEntityId.optional(),
   projectId: linearEntityId.nullable().optional(),
   labelIds: external_exports.array(linearEntityId).max(10).optional()
@@ -25913,9 +25996,9 @@ var LinearTicketContextResponseSchema = external_exports.object({
     labelIds: external_exports.array(external_exports.string()),
     labelNames: external_exports.array(external_exports.string())
   }).nullable(),
-  /** True only for MANAGE_ORGANIZATION callers — gates the destination picker. */
+  /** True only for MANAGE_INTEGRATIONS callers; gates the destination picker. */
   canOverrideDestination: external_exports.boolean(),
-  /** Populated only for admins (a non-admin gets the resolved defaults, not a workspace inventory). */
+  /** Populated only when canOverrideDestination; anyone else gets the resolved defaults, not a workspace inventory. */
   teams: external_exports.array(TicketContextTeam),
   projects: external_exports.array(TicketContextProject),
   labels: external_exports.array(TicketContextLabel)
@@ -28864,13 +28947,13 @@ var StorageStateSchema = external_exports.object({
   } catch {
     return;
   }
-  s.cookies.forEach((c84, i2) => {
-    const d = c84.domain.replace(/^\./, "").toLowerCase();
+  s.cookies.forEach((c86, i2) => {
+    const d = c86.domain.replace(/^\./, "").toLowerCase();
     if (d !== host && !host.endsWith(`.${d}`)) {
       ctx.addIssue({
         code: "custom",
         path: ["cookies", i2, "domain"],
-        message: `cookie domain "${c84.domain}" is not the capture origin host "${host}" or a parent domain of it`
+        message: `cookie domain "${c86.domain}" is not the capture origin host "${host}" or a parent domain of it`
       });
     }
   });
@@ -29476,7 +29559,7 @@ var AgentSessionGitSourceGrantSchema = external_exports.object({
   ref: external_exports.string().min(1).max(255),
   /** Immutable pin — the host checks out exactly this commit. */
   commitSha: external_exports.string().regex(/^[a-f0-9]{40}$/i),
-  /** Bare clone URL (no credentials — the host injects via URL userinfo). */
+  /** Bare clone URL (no credentials — the host supplies the token via GIT_ASKPASS). */
   cloneUrl: external_exports.url(),
   /**
    * Short-lived scoped read token. Never logged, never placed in any environ;
@@ -29485,9 +29568,9 @@ var AgentSessionGitSourceGrantSchema = external_exports.object({
    */
   cloneToken: external_exports.string().min(1),
   /**
-   * Git credential username for the clone. GitHub (`x-access-token`) rides URL
-   * userinfo; Bitbucket (`x-token-auth`) and GitLab (`oauth2`) ride GIT_ASKPASS
-   * (never the URL). The default keeps a pre-Bitbucket host safe — but the host
+   * Git credential username for the clone: `x-access-token` (GitHub),
+   * `x-token-auth` (Bitbucket) or `oauth2` (GitLab). The token always rides
+   * GIT_ASKPASS, never the URL. The default keeps a pre-Bitbucket host safe — but the host
    * raw-casts this response, so the load-bearing fallback is the host's
    * use-site default.
    */
@@ -30435,7 +30518,12 @@ var SessionCredentialsResponseSchema = external_exports.object({
   browserAllowedBaseUrls: external_exports.array(external_exports.string()),
   browserExclusions: external_exports.array(external_exports.string()),
   /** API_COVERAGE only; null otherwise. Range checks stay with the host's rate parser. */
-  requestRate: external_exports.object({ perSec: external_exports.number(), burst: external_exports.number() }).nullable()
+  requestRate: external_exports.object({ perSec: external_exports.number(), burst: external_exports.number() }).nullable(),
+  /**
+   * Labels of credentials the resolver could not include this time (a failed decrypt). A host
+   * refreshing mid-run keeps its previous entries for these instead of reading them as deleted.
+   */
+  skippedLabels: external_exports.array(external_exports.string()).default([])
 });
 var ConvexReconRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative()
@@ -41023,7 +41111,12 @@ var CoverageGridResponseSchema = external_exports.object({
   orphanFeatures: external_exports.array(CoverageOrphanFeatureSchema).default([]),
   unplaced: external_exports.array(CoverageUnplacedRowSchema).default([]),
   /** When the engagement started: a feature retired before it is not part of this engagement. */
-  pentestStartedAt: external_exports.coerce.date().nullable().default(null)
+  pentestStartedAt: external_exports.coerce.date().nullable().default(null),
+  /**
+   * When a closed engagement ended; null while it is open. A feature first recorded after it
+   * was never part of this engagement.
+   */
+  pentestClosedAt: external_exports.coerce.date().nullable().default(null)
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-coverage.ts
@@ -43623,6 +43716,26 @@ var SetStaffOrganizationPentestCustomerVisibilityRequestSchema = external_export
 var RenameStaffOrganizationPentestRequestSchema = external_exports.object({
   title: external_exports.string().trim().min(1, "Title is required").max(500, "Title must be 500 characters or fewer")
 }).strict();
+var SetStaffOrganizationPentestStatusRequestSchema = external_exports.object({
+  status: PentestStatus,
+  reason: external_exports.string().trim().min(1, "Reason cannot be blank").max(2e3, "Reason must be 2000 characters or fewer").optional()
+}).strict();
+var CreateStaffPocDraftRequestSchema = external_exports.object({
+  homepageUrl: external_exports.url({ protocol: /^https?$/ }).max(2048).optional()
+}).strict();
+var LaunchStaffPocSetupRequestSchema = external_exports.object({
+  notes: external_exports.string().trim().min(1).max(MAX_SETUP_NOTES_CHARS).optional()
+}).strict();
+var LaunchStaffPocSetupResponseSchema = external_exports.object({
+  agentSessionId: external_exports.uuid(),
+  /** Null when Slack is not configured in this environment. */
+  slack: external_exports.object({
+    channelId: external_exports.string(),
+    /** Null when Slack did not return the channel's name. */
+    channelName: external_exports.string().nullable(),
+    url: external_exports.url()
+  }).strict().nullable()
+}).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-pentests.ts
 var c58 = initContract();
@@ -43683,6 +43796,161 @@ var staffPentestsContract = c58.router({
       500: ErrorResponseSchema
     },
     summary: "Hide a pentest from the customer or show it again (Trace staff only)"
+  },
+  setStaffOrganizationPentestStatus: {
+    method: "POST",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId/status",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: SetStaffOrganizationPentestStatusRequestSchema,
+    responses: {
+      200: StaffOrganizationPentestSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // A lifecycle rule refused the move; the rules and their codes live in
+      // `PentestService.update`.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Set a pentest\u2019s lifecycle status from the admin console (Trace staff only)"
+  },
+  createStaffPocDraft: {
+    method: "POST",
+    path: "/organizations/:organizationId/staff/pentests/poc",
+    pathParams: OrgIdParamsSchema,
+    body: CreateStaffPocDraftRequestSchema,
+    // Error codes: StaffPocErrorCodes (staff-pentests.api.ts).
+    responses: {
+      201: StaffOrganizationPentestSummarySchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Create a hidden PoC draft engagement (Trace staff only)"
+  },
+  launchStaffPocSetup: {
+    method: "POST",
+    path: "/organizations/:organizationId/staff/pentests/:pentestId/setup-session",
+    pathParams: StaffOrganizationPentestParamsSchema,
+    body: LaunchStaffPocSetupRequestSchema,
+    // Error codes: StaffPocErrorCodes (staff-pentests.api.ts), plus the SETUP launch refusals
+    // (SETUP_REQUIRES_SCOPING, SETUP_AFTER_TESTING_STARTED) and a 429 at the session cap.
+    responses: {
+      201: LaunchStaffPocSetupResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      429: ErrorResponseSchema,
+      500: ErrorResponseSchema,
+      503: ErrorResponseSchema
+    },
+    summary: "Bind a PoC engagement's Slack and launch its SETUP session (Trace staff only)"
+  }
+});
+
+// ../../packages/api-contracts/src/schemas/api/v1/staff-products.api.ts
+var StaffProductParamsSchema = OrgIdParamsSchema.extend({
+  productGroupId: external_exports.uuid()
+});
+var StaffProductApplicationParamsSchema = OrgIdParamsSchema.extend({
+  applicationId: external_exports.uuid()
+});
+var PRODUCT_NAME_MAX_CHARS = 200;
+var ProductNameSchema = external_exports.string().trim().min(1).max(PRODUCT_NAME_MAX_CHARS);
+var StaffProductApplicationSchema = external_exports.object({
+  applicationId: external_exports.uuid(),
+  name: external_exports.string(),
+  type: external_exports.enum(ApplicationTypeValues),
+  /** Tells same-named applications apart; null for types without a URL. */
+  applicationUrl: external_exports.string().nullable(),
+  /** Applications this one uses, sorted by their name. */
+  uses: external_exports.array(external_exports.uuid())
+}).strict();
+var StaffProductSchema = external_exports.object({
+  productGroupId: external_exports.uuid(),
+  name: external_exports.string(),
+  applications: external_exports.array(StaffProductApplicationSchema)
+}).strict();
+var StaffProductsResponseSchema = external_exports.object({
+  products: external_exports.array(StaffProductSchema)
+}).strict();
+var RenameStaffProductRequestSchema = external_exports.object({ name: ProductNameSchema }).strict();
+var MoveStaffApplicationRequestSchema = external_exports.union([
+  external_exports.object({ productGroupId: external_exports.uuid() }).strict(),
+  external_exports.object({ newProductName: ProductNameSchema }).strict()
+]);
+var SetStaffApplicationDependenciesRequestSchema = external_exports.object({
+  toApplicationIds: external_exports.array(external_exports.uuid()).max(100).refine((ids) => new Set(ids).size === ids.length, {
+    message: "Application ids must be unique"
+  })
+}).strict();
+
+// ../../packages/api-contracts/src/contracts/v1/staff-products.ts
+var c59 = initContract();
+var staffProductsContract = c59.router({
+  listStaffProducts: {
+    method: "GET",
+    path: "/organizations/:organizationId/staff/products",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: StaffProductsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "List an organization\u2019s products and their applications (Trace staff only)"
+  },
+  renameStaffProduct: {
+    method: "PATCH",
+    path: "/organizations/:organizationId/staff/products/:productGroupId",
+    pathParams: StaffProductParamsSchema,
+    body: RenameStaffProductRequestSchema,
+    responses: {
+      200: StaffProductsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Rename a product (Trace staff only)"
+  },
+  moveStaffApplication: {
+    method: "PUT",
+    path: "/organizations/:organizationId/staff/applications/:applicationId/product",
+    pathParams: StaffProductApplicationParamsSchema,
+    body: MoveStaffApplicationRequestSchema,
+    responses: {
+      200: StaffProductsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Move an application into another or a new product (Trace staff only)"
+  },
+  setStaffApplicationDependencies: {
+    method: "PUT",
+    path: "/organizations/:organizationId/staff/applications/:applicationId/dependencies",
+    pathParams: StaffProductApplicationParamsSchema,
+    body: SetStaffApplicationDependenciesRequestSchema,
+    responses: {
+      200: StaffProductsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    },
+    summary: "Replace the applications an application uses (Trace staff only)"
   }
 });
 
@@ -43793,8 +44061,8 @@ var StaffQueueResponseSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/staff-queue.ts
-var c59 = initContract();
-var staffQueueContract = c59.router({
+var c60 = initContract();
+var staffQueueContract = c60.router({
   getStaffQueue: {
     method: "GET",
     path: "/staff/queue",
@@ -43858,8 +44126,8 @@ var UpdateTestIntegrationRequestSchema = external_exports.object({
 }).strict();
 
 // ../../packages/api-contracts/src/contracts/v1/test-integration.ts
-var c60 = initContract();
-var testIntegrationContract = c60.router({
+var c61 = initContract();
+var testIntegrationContract = c61.router({
   // -- Fixture CRUD (org-less, staff-only) ----------------------------------
   listTestIntegrations: {
     method: "GET",
@@ -43939,7 +44207,7 @@ var testIntegrationContract = c60.router({
     method: "POST",
     path: "/staff/test-integrations/:testIntegrationId/mfa/code",
     pathParams: TestIntegrationIdParamsSchema,
-    body: c60.noBody(),
+    body: c61.noBody(),
     responses: {
       200: CredentialMfaCodeResponseSchema,
       401: ErrorResponseSchema,
@@ -44050,8 +44318,8 @@ var MyContextResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c61 = initContract();
-var userContract = c61.router({
+var c62 = initContract();
+var userContract = c62.router({
   getStaffProfile: {
     method: "GET",
     path: "/staff/profile",
@@ -44166,8 +44434,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c62 = initContract();
-var vantaIntegrationContract = c62.router({
+var c63 = initContract();
+var vantaIntegrationContract = c63.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -44528,8 +44796,8 @@ var VerifySharedVulnerabilityEmailCodeResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c63 = initContract();
-var vulnerabilityContract = c63.router({
+var c64 = initContract();
+var vulnerabilityContract = c64.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -44754,8 +45022,8 @@ var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c64 = initContract();
-var vulnerabilityNoteContract = c64.router({
+var c65 = initContract();
+var vulnerabilityNoteContract = c65.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -44936,8 +45204,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c65 = initContract();
-var webhookSettingsContract = c65.router({
+var c66 = initContract();
+var webhookSettingsContract = c66.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -45074,9 +45342,31 @@ var webhookSettingsContract = c65.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/v1/ws.ts
+var c67 = initContract();
+var WsTicketResponseSchema = external_exports.object({
+  /** Opaque, single-use, bound to the caller and the request's organization. */
+  ticket: external_exports.string(),
+  expiresInSeconds: external_exports.number().int().positive()
+});
+var wsContract = c67.router({
+  createTicket: {
+    method: "POST",
+    path: "/ws/ticket",
+    body: c67.noBody(),
+    responses: {
+      200: WsTicketResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      503: ErrorResponseSchema
+    },
+    summary: "Mint a short-lived, single-use ticket that opens the scan-updates WebSocket"
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c66 = initContract();
-var v1Contract = c66.router(
+var c68 = initContract();
+var v1Contract = c68.router(
   {
     admin: adminContract,
     cloudIntegration: cloudIntegrationContract,
@@ -45086,6 +45376,7 @@ var v1Contract = c66.router(
     organization: organizationContract,
     oobListener: oobListenerContract,
     user: userContract,
+    ws: wsContract,
     repository: repositoryContract,
     github: githubContract,
     staffGithub: staffGithubContract,
@@ -45141,6 +45432,7 @@ var v1Contract = c66.router(
     staffPentestStats: staffPentestStatsContract,
     staffKnowledgeFacts: staffKnowledgeFactsContract,
     staffPentests: staffPentestsContract,
+    staffProducts: staffProductsContract,
     staffQueue: staffQueueContract,
     organizationDisposal: organizationDisposalContract
   },
@@ -45150,13 +45442,13 @@ var v1Contract = c66.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c67 = initContract();
-var contract = c67.router({
+var c69 = initContract();
+var contract = c69.router({
   v1: v1Contract
 });
 
 // ../../packages/api-contracts/src/contracts/v1/desktop-host-internal.ts
-var c68 = initContract();
+var c70 = initContract();
 var MAX_VMS_PER_SYNC = 16;
 var DesktopHostSyncRequestSchema = external_exports.object({
   /** Integer protocol the runner speaks. Below the api's minimum, the host gets
@@ -45181,7 +45473,7 @@ var DesktopHostSyncResponseSchema = external_exports.object({
    *  id not listed here is deleted. */
   targets: external_exports.array(DesktopHostSyncTargetSchema).max(MAX_VMS_PER_SYNC)
 });
-var desktopHostInternalContract = c68.router({
+var desktopHostInternalContract = c70.router({
   sync: {
     method: "POST",
     path: "/internal/v1/desktop-hosts/sync",
@@ -45204,7 +45496,10 @@ var OPENAI_SESSION_TYPES = [
   "RETEST",
   "REPORT",
   "RECON",
-  "API_COVERAGE"
+  "API_COVERAGE",
+  "PRODUCT_RECON",
+  "CODE_REVIEW",
+  "REMEDIATION"
 ];
 var AGENT_SESSION_MODELS = [
   {
@@ -45278,8 +45573,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c69 = initContract();
-var githubWebhookContract = c69.router(
+var c71 = initContract();
+var githubWebhookContract = c71.router(
   {
     handleWebhook: {
       method: "POST",
@@ -45297,7 +45592,7 @@ var githubWebhookContract = c69.router(
     pathPrefix: "/webhooks"
   }
 );
-var githubReadonlyWebhookContract = c69.router(
+var githubReadonlyWebhookContract = c71.router(
   {
     handleWebhook: {
       method: "POST",
@@ -45317,9 +45612,9 @@ var githubReadonlyWebhookContract = c69.router(
 );
 
 // ../../packages/api-contracts/src/contracts/webhooks/linear.ts
-var c70 = initContract();
+var c72 = initContract();
 var LinearWebhookResponseSchema = external_exports.object({ ok: external_exports.boolean() });
-var linearWebhookContract = c70.router(
+var linearWebhookContract = c72.router(
   {
     handleWebhook: {
       method: "POST",
@@ -45339,7 +45634,7 @@ var linearWebhookContract = c70.router(
 );
 
 // ../../packages/api-contracts/src/contracts/forge/bitbucket.ts
-var c71 = initContract();
+var c73 = initContract();
 var InstallEventSchema = external_exports.object({
   eventType: external_exports.enum(["avi:forge:installed:app", "avi:forge:upgraded:app"]),
   context: external_exports.object({ cloudId: external_exports.string().min(1) }).loose(),
@@ -45368,7 +45663,7 @@ var ForgePairingCodeResponseSchema = external_exports.discriminatedUnion("state"
     expiresInSeconds: external_exports.number().int()
   })
 ]);
-var forgeBitbucketContract = c71.router(
+var forgeBitbucketContract = c73.router(
   {
     lifecycle: {
       method: "POST",
@@ -45415,8 +45710,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c72 = initContract();
-var healthContract = c72.router({
+var c74 = initContract();
+var healthContract = c74.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -45428,8 +45723,8 @@ var healthContract = c72.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-share.ts
-var c73 = initContract();
-var vulnerabilityShareContract = c73.router(
+var c75 = initContract();
+var vulnerabilityShareContract = c75.router(
   {
     resolveShareLink: {
       method: "GET",
@@ -45455,7 +45750,8 @@ var vulnerabilityShareContract = c73.router(
         401: ErrorResponseSchema,
         403: ErrorResponseSchema,
         404: ErrorResponseSchema,
-        500: ErrorResponseSchema
+        500: ErrorResponseSchema,
+        503: ErrorResponseSchema
       }
     },
     verifyShareEmailCode: {
@@ -45479,8 +45775,8 @@ var vulnerabilityShareContract = c73.router(
 );
 
 // ../../packages/api-contracts/src/contracts/v1/attestation-verify.ts
-var c74 = initContract();
-var attestationVerifyContract = c74.router(
+var c76 = initContract();
+var attestationVerifyContract = c76.router(
   {
     verifyAttestation: {
       method: "GET",
@@ -45536,8 +45832,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c75 = initContract();
-var prVulnerabilityContract = c75.router(
+var c77 = initContract();
+var prVulnerabilityContract = c77.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -45701,8 +45997,8 @@ var CoordinatorSessionSearchResponseSchema = external_exports.strictObject({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/coordinator-inspection.ts
-var c76 = initContract();
-var coordinatorInspectionContract = c76.router({
+var c78 = initContract();
+var coordinatorInspectionContract = c78.router({
   sessionWindow: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/coordinator/session-window",
@@ -45744,7 +46040,7 @@ var coordinatorInspectionContract = c76.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-coordinator-internal.ts
-var c77 = initContract();
+var c79 = initContract();
 var params2 = external_exports.strictObject({ agentSessionId: external_exports.uuid() });
 var errors3 = {
   400: ErrorResponseSchema,
@@ -45757,7 +46053,7 @@ var errors3 = {
   500: ErrorResponseSchema,
   503: ErrorResponseSchema
 };
-var pentestCoordinatorInternalContract = c77.router({
+var pentestCoordinatorInternalContract = c79.router({
   state: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/coordinator/state",
@@ -46004,8 +46300,8 @@ var CoordinatorCoverageResponseSchema = external_exports.strictObject({
 );
 
 // ../../packages/api-contracts/src/contracts/v1/coordinator-domain-read.ts
-var c78 = initContract();
-var coordinatorDomainReadContract = c78.router({
+var c80 = initContract();
+var coordinatorDomainReadContract = c80.router({
   coverage: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/coordinator/coverage",
@@ -46210,7 +46506,7 @@ var CoordinatorPublicDocumentationResponseSchema = CoordinatorContextTextReadRes
 var CoordinatorCustomerDocumentResponseSchema = CoordinatorContextTextReadResponseSchema;
 
 // ../../packages/api-contracts/src/contracts/v1/coordinator-context-read.ts
-var c79 = initContract();
+var c81 = initContract();
 var errors4 = {
   400: ErrorResponseSchema,
   401: ErrorResponseSchema,
@@ -46222,7 +46518,7 @@ var errors4 = {
   500: ErrorResponseSchema,
   503: ErrorResponseSchema
 };
-var coordinatorContextReadContract = c79.router({
+var coordinatorContextReadContract = c81.router({
   contextSources: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/coordinator/context-sources",
@@ -46456,19 +46752,19 @@ var COVERAGE_CLASSES = [
   },
   { taxonomy: "RECON", id: "RECON-15", name: "Deployment-platform config", shortLabel: "Deploy" }
 ];
-var BY_ID = new Map(COVERAGE_CLASSES.map((c84) => [c84.id, c84]));
+var BY_ID = new Map(COVERAGE_CLASSES.map((c86) => [c86.id, c86]));
 function idsWhere(keep) {
-  return [OTHER_CLASS_ID, ...COVERAGE_CLASSES.filter(keep).map((c84) => c84.id)];
+  return [OTHER_CLASS_ID, ...COVERAGE_CLASSES.filter(keep).map((c86) => c86.id)];
 }
-var HUNTING_CLASS_IDS = idsWhere((c84) => c84.taxonomy !== "RECON");
-var RECON_CLASS_IDS = idsWhere((c84) => c84.taxonomy === "RECON");
+var HUNTING_CLASS_IDS = idsWhere((c86) => c86.taxonomy !== "RECON");
+var RECON_CLASS_IDS = idsWhere((c86) => c86.taxonomy === "RECON");
 var HUNTING_ID_SET = new Set(HUNTING_CLASS_IDS);
 var RECON_ID_SET = new Set(RECON_CLASS_IDS);
 var TAXONOMY_ORDER = new Map(CoverageTaxonomyValues.map((t2, i2) => [t2, i2]));
-var CLASS_ORDER = new Map(COVERAGE_CLASSES.map((c84, i2) => [c84.id, i2]));
+var CLASS_ORDER = new Map(COVERAGE_CLASSES.map((c86, i2) => [c86.id, i2]));
 
 // ../../packages/api-contracts/src/contracts/v1/api-coverage-internal.ts
-var c80 = initContract();
+var c82 = initContract();
 var pathParams = external_exports.strictObject({ agentSessionId: external_exports.uuid() });
 var errors5 = {
   400: ErrorResponseSchema,
@@ -46478,7 +46774,7 @@ var errors5 = {
   500: ErrorResponseSchema
 };
 var base = "/internal/v1/agent-sessions/:agentSessionId/api-coverage";
-var apiCoverageInternalContract = c80.router({
+var apiCoverageInternalContract = c82.router({
   upsertApiOperations: {
     method: "POST",
     path: `${base}/operations`,
@@ -46617,7 +46913,7 @@ var SetupNotesRequestSchema = external_exports.object({ runVersion: RunVersionSc
 var SetupNotesResponseSchema = external_exports.object({ notes: external_exports.string().nullable() });
 
 // ../../packages/api-contracts/src/contracts/v1/setup-session-internal.ts
-var c81 = initContract();
+var c83 = initContract();
 var pathParams2 = external_exports.strictObject({ agentSessionId: external_exports.uuid() });
 var errors6 = {
   400: ErrorResponseSchema,
@@ -46629,7 +46925,7 @@ var errors6 = {
   503: ErrorResponseSchema
 };
 var base2 = "/internal/v1/agent-sessions/:agentSessionId/setup";
-var setupSessionInternalContract = c81.router({
+var setupSessionInternalContract = c83.router({
   addSetupTarget: {
     method: "POST",
     path: `${base2}/target`,
@@ -46756,8 +47052,8 @@ var ListReviewPremiseChecksResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/premise-check-internal.ts
-var c82 = initContract();
-var premiseCheckInternalContract = c82.router({
+var c84 = initContract();
+var premiseCheckInternalContract = c84.router({
   listReviewPremiseChecks: {
     method: "POST",
     path: "/internal/v1/agent-sessions/:agentSessionId/premise-checks/list",
@@ -47581,6 +47877,7 @@ var PRODUCTION_API_URL = "https://api.securewithtrace.com";
 var UNAUTHORIZED_STATUS = 401;
 var REFRESH_AUTH_FAILURE_STATUS_CODES = /* @__PURE__ */ new Set([400, 401]);
 var MAX_REFRESH_ROTATION_RETRIES = 3;
+var TRACE_API_HOST_SUFFIX = ".securewithtrace.com";
 function getApiBaseUrl() {
   const raw = process.env["TRACE_API_URL"];
   if (!raw) {
@@ -47599,16 +47896,15 @@ function getApiBaseUrl() {
     console.error(colorWarning("Invalid TRACE_API_URL: only https:// is allowed. Using default."));
     return PRODUCTION_API_URL;
   }
-  const hostname3 = parsed.hostname;
-  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
+  if (!parsed.hostname.endsWith(TRACE_API_HOST_SUFFIX)) {
     console.error(
       colorWarning(
-        "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
+        `Ignoring TRACE_API_URL: '${parsed.hostname}' is not a Trace API host (*${TRACE_API_HOST_SUFFIX}). Using default.`
       )
     );
     return PRODUCTION_API_URL;
   }
-  return raw.replace(/\/+$/, "");
+  return `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "");
 }
 function requireAuth() {
   const credential = loadCredentialOrExit();
@@ -47692,6 +47988,60 @@ function exitHumanPrincipalRequired() {
   console.error(colorError("This command requires a human login; run `tracecli auth login`."));
   process.exit(1);
 }
+function transportErrorCode(error48) {
+  if (!(error48 instanceof Error)) {
+    return null;
+  }
+  const codeOf = (value) => {
+    if (typeof value !== "object" || value === null || !("code" in value)) {
+      return null;
+    }
+    return typeof value.code === "string" && value.code.length > 0 ? value.code : null;
+  };
+  const code = codeOf(error48) ?? codeOf(error48.cause);
+  if (code !== null) {
+    return code;
+  }
+  return error48.name === "TypeError" && /^fetch failed/i.test(error48.message) ? "FETCH_FAILED" : null;
+}
+var TRANSPORT_ERROR_HINTS = {
+  ENOTFOUND: "DNS lookup failed",
+  EAI_AGAIN: "DNS lookup timed out",
+  ECONNREFUSED: "connection refused",
+  ECONNRESET: "connection reset",
+  ETIMEDOUT: "connection timed out",
+  ConnectionRefused: "connection refused",
+  ConnectionClosed: "connection closed before a response arrived",
+  FailedToOpenSocket: "could not open a socket",
+  CERT_HAS_EXPIRED: "the server certificate has expired",
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: "the server certificate could not be verified",
+  DEPTH_ZERO_SELF_SIGNED_CERT: "the server presented a self-signed certificate",
+  FETCH_FAILED: "the request never received a response"
+};
+function unreachableApiMessage(baseUrl, code) {
+  const host = new URL(baseUrl).host;
+  const detail = TRANSPORT_ERROR_HINTS[code] ?? "the request failed";
+  return [
+    `Couldn't reach the Trace API at ${host}: ${detail} (${code}).`,
+    "Check that this machine can reach the internet. Sandboxed agents and CI runners often block",
+    `outbound network access; allow ${host} and retry.`
+  ].join("\n");
+}
+function exitUnreachableApi(code) {
+  console.error(colorError(unreachableApiMessage(getApiBaseUrl(), code)));
+  process.exit(1);
+}
+async function requestOrExit(request, token) {
+  try {
+    return await request(createClient(token));
+  } catch (error48) {
+    const code = transportErrorCode(error48);
+    if (code !== null) {
+      exitUnreachableApi(code);
+    }
+    throw error48;
+  }
+}
 function createClient(token) {
   return initClient(v1Contract, {
     baseUrl: getApiBaseUrl(),
@@ -47819,7 +48169,7 @@ async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
 }
 async function authenticatedRequest(request) {
   const credential = loadCredentialOrExit();
-  const firstResult = await request(createClient(credential.token));
+  const firstResult = await requestOrExit(request, credential.token);
   if (credential.kind === "api_key") {
     if (firstResult.status === UNAUTHORIZED_STATUS) {
       exitApiKeyUnauthorized();
@@ -47836,7 +48186,7 @@ async function authenticatedRequest(request) {
   if (!refreshedToken) {
     return firstResult;
   }
-  return request(createClient(refreshedToken));
+  return requestOrExit(request, refreshedToken);
 }
 async function authenticatedRequestSafe(request) {
   let credential;
@@ -49259,7 +49609,7 @@ function createSetScanningBranchCommand() {
   return new Command("set-scanning-branch").description("Switch the scanning branch for one or every repository in the org").argument(
     "[repositoryUrl]",
     "Repository URL (omit when using --all-repos to switch every repo)"
-  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every connected repository in the organization").option(
+  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every GitHub repository in the organization").option(
     "--migrate-open-vulns",
     "Relabel open vulnerabilities from the previous branch to the new branch"
   ).option("-o, --output <format>", "Output format: table (default), json", "table").addHelpText(
@@ -49580,6 +49930,62 @@ function resolveClearableUrl(value, clear, flag) {
   }
   return { value };
 }
+function normalizeRepositoryRole(input) {
+  const candidate = input.trim().toUpperCase().replace(/-/g, "_");
+  return ApplicationRepositoryRoleValues.find((role) => role === candidate) ?? null;
+}
+var REPOSITORY_ROLE_INPUTS = ApplicationRepositoryRoleValues.map(
+  (role) => role.toLowerCase().replace(/_/g, "-")
+);
+function parseRepositoryRoles(inputs) {
+  const picked = /* @__PURE__ */ new Set();
+  for (const input of inputs) {
+    const role = normalizeRepositoryRole(input);
+    if (role === null) {
+      return {
+        error: `Invalid --role '${input}'. Use one of: ${REPOSITORY_ROLE_INPUTS.join(", ")}.`
+      };
+    }
+    picked.add(role);
+  }
+  return { roles: ApplicationRepositoryRoleValues.filter((role) => picked.has(role)) };
+}
+function buildLinkRepositoryBody(input) {
+  return {
+    repositoryId: input.repositoryId,
+    ...input.roles !== void 0 && input.roles.length > 0 ? { roles: [...input.roles] } : {},
+    ...input.roleLabel !== void 0 ? { roleLabel: input.roleLabel } : {},
+    ...input.repositoryPath !== void 0 ? { repositoryPath: input.repositoryPath } : {},
+    ...input.scanEnabled !== void 0 ? { scanEnabled: input.scanEnabled } : {}
+  };
+}
+function buildUpdateLinkBody(input) {
+  return {
+    ...input.roles !== void 0 ? { roles: [...input.roles] } : {},
+    ...input.roleLabel !== void 0 ? { roleLabel: input.roleLabel } : {},
+    ...input.repositoryPath !== void 0 ? { repositoryPath: input.repositoryPath } : {},
+    ...input.scanEnabled !== void 0 ? { scanEnabled: input.scanEnabled } : {}
+  };
+}
+function isEmptyLinkUpdate(body) {
+  return Object.keys(body).length === 0;
+}
+function validateRoleLabel(roles, roleLabel) {
+  if (roles === void 0 || roleLabel === void 0 || roleLabel === null) {
+    return null;
+  }
+  return roles.includes("OTHER") ? null : "--role-label requires --role other.";
+}
+function findLinkForRepo(links, input) {
+  if (isUuid(input)) {
+    const id = input.toLowerCase();
+    return links.find(
+      (link) => link.applicationRepositoryId?.toLowerCase() === id || link.repositoryId.toLowerCase() === id
+    ) ?? null;
+  }
+  const target = normalizeRepoUrlForMatch(resolveRepoUrl(input));
+  return links.find((link) => normalizeRepoUrlForMatch(link.repositoryUrl) === target) ?? null;
+}
 function failWriteOp(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
@@ -49620,6 +50026,28 @@ function failWriteOp(action, status, body, notFoundLabel) {
   );
   process.exit(1);
 }
+function failLinkOp(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Repository links require an organization admin or Trace staff on a pentest-enabled organization, signed in with a browser session (API keys are rejected)."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404 || status === 409 || status === 400) {
+    console.error(colorError(message ?? `Failed to ${action} (status ${status}).`));
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} repository (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
 function failReadOp(action, status, body, notFoundLabel) {
   const { message } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
@@ -49681,12 +50109,12 @@ function buildApplicationsTable(apps) {
     repos: String(a2.repositories.length),
     url: a2.applicationUrl ? sanitizeDisplay(a2.applicationUrl) : "\u2014"
   }));
-  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
-  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
-  const typeWidth = Math.max(4, ...cells.map((c84) => c84.type.length));
+  const idWidth = Math.max(2, ...cells.map((c86) => c86.id.length));
+  const nameWidth = Math.max(4, ...cells.map((c86) => c86.name.length));
+  const typeWidth = Math.max(4, ...cells.map((c86) => c86.type.length));
   const header = `${"ID".padEnd(idWidth)}  ${"NAME".padEnd(nameWidth)}  ${"TYPE".padEnd(typeWidth)}  REPOS  URL`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.name.padEnd(nameWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.repos.padStart(5)}  ${c84.url}`
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.name.padEnd(nameWidth)}  ${c86.type.padEnd(typeWidth)}  ${c86.repos.padStart(5)}  ${c86.url}`
   );
   return { header, rows };
 }
@@ -49706,12 +50134,12 @@ function buildApplicationRepositoriesTable(links) {
     path: l2.repositoryPath ? sanitizeDisplay(l2.repositoryPath) : "\u2014",
     status: formatStatus(l2.repositoryStatus)
   }));
-  const nameWidth = Math.max(10, ...cells.map((c84) => c84.name.length));
-  const roleWidth = Math.max(4, ...cells.map((c84) => c84.role.length));
-  const pathWidth = Math.max(4, ...cells.map((c84) => c84.path.length));
+  const nameWidth = Math.max(10, ...cells.map((c86) => c86.name.length));
+  const roleWidth = Math.max(4, ...cells.map((c86) => c86.role.length));
+  const pathWidth = Math.max(4, ...cells.map((c86) => c86.path.length));
   const header = `${"REPOSITORY".padEnd(nameWidth)}  SCAN  ${"ROLE".padEnd(roleWidth)}  ${"PATH".padEnd(pathWidth)}  STATUS`;
   const rows = cells.map(
-    (c84) => `${c84.name.padEnd(nameWidth)}  ${c84.scan.padEnd(4)}  ${c84.role.padEnd(roleWidth)}  ${c84.path.padEnd(pathWidth)}  ${c84.status}`
+    (c86) => `${c86.name.padEnd(nameWidth)}  ${c86.scan.padEnd(4)}  ${c86.role.padEnd(roleWidth)}  ${c86.path.padEnd(pathWidth)}  ${c86.status}`
   );
   return { header, rows };
 }
@@ -49974,6 +50402,205 @@ async function runDelete(applicationId, options) {
   }
   console.log(colorSuccess(`Deleted application ${applicationId}`));
 }
+function renderLinkDetail(link) {
+  const pad = 11;
+  return [
+    `${"Link ID:".padEnd(pad)} ${link.applicationRepositoryId ?? "\u2014"}`,
+    `${"Repository:".padEnd(pad)} ${sanitizeDisplay(link.repositoryName)} (${link.repositoryId})`,
+    `${"URL:".padEnd(pad)} ${sanitizeDisplay(link.repositoryUrl)}`,
+    `${"Scan:".padEnd(pad)} ${link.scanEnabled ? "yes" : "no"}`,
+    `${"Role:".padEnd(pad)} ${sanitizeDisplay(formatLinkRole(link.role, link.roleLabel, link.roles))}`,
+    `${"Path:".padEnd(pad)} ${link.repositoryPath ? sanitizeDisplay(link.repositoryPath) : "\u2014"}`,
+    `${"Status:".padEnd(pad)} ${formatStatus(link.repositoryStatus)}`
+  ].join("\n");
+}
+function outputLink(link, output) {
+  if (output === "json") {
+    printJson(link);
+    return;
+  }
+  if (output === "tsv") {
+    printApplicationRepositoriesTsv([link]);
+    return;
+  }
+  console.log(renderLinkDetail(link));
+}
+function exitInvalidApplicationId(applicationId) {
+  console.error(colorError(`Invalid application id '${applicationId}'. Expected a UUID.`));
+  process.exit(1);
+}
+async function resolveExistingLink(organizationId, applicationId, repoInput) {
+  const result = await authenticatedRequest(
+    (client) => client.application.listApplicationRepositories({ params: { organizationId, applicationId } })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp("list application repositories", result.status, result.body, applicationId);
+  }
+  const link = findLinkForRepo(result.body, repoInput);
+  if (!link) {
+    console.error(
+      colorError(
+        `Repository ${repoInput} is not linked to application ${applicationId}. Run \`tracecli application repos ${applicationId}\` to see its links.`
+      )
+    );
+    process.exit(1);
+  }
+  if (link.applicationRepositoryId === null) {
+    console.error(
+      colorError(
+        `Repository ${repoInput} is linked without a link id, so it can't be changed from the CLI. Edit it in the dashboard.`
+      )
+    );
+    process.exit(1);
+  }
+  return { ...link, applicationRepositoryId: link.applicationRepositoryId };
+}
+async function runLink(applicationId, options) {
+  const output = parseOutput(options.output);
+  if (!isUuid(applicationId)) {
+    exitInvalidApplicationId(applicationId);
+  }
+  const parsedRoles = parseRepositoryRoles(options.role ?? []);
+  if ("error" in parsedRoles) {
+    console.error(colorError(parsedRoles.error));
+    process.exit(1);
+  }
+  const roles = options.role !== void 0 ? parsedRoles.roles : void 0;
+  const labelError = validateRoleLabel(roles ?? [], options.roleLabel);
+  if (labelError) {
+    console.error(colorError(labelError));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const repositoryId = await resolveRepositoryId(organizationId, options.repo);
+  const body = buildLinkRepositoryBody({
+    repositoryId,
+    roles,
+    roleLabel: options.roleLabel,
+    repositoryPath: options.repoPath,
+    // Commander defaults a lone `--no-scan` to true; only an explicit opt-out
+    // goes on the wire so the API's own default applies otherwise.
+    scanEnabled: options.scan === false ? false : void 0
+  });
+  const result = await authenticatedRequest(
+    (client) => client.application.createApplicationRepository({
+      params: { organizationId, applicationId },
+      body
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failLinkOp("link", result.status, result.body);
+  }
+  if (output === "table") {
+    console.log(
+      colorSuccess(
+        `Linked ${sanitizeDisplay(result.body.repositoryName)} to application ${applicationId}`
+      )
+    );
+  }
+  outputLink(result.body, output);
+}
+var UPDATE_LINK_FLAGS = "--role, --clear-roles, --role-label, --clear-role-label, --repo-path, --clear-repo-path, --scan, --no-scan";
+async function runUpdateLink(applicationId, options) {
+  const output = parseOutput(options.output);
+  if (!isUuid(applicationId)) {
+    exitInvalidApplicationId(applicationId);
+  }
+  if (options.role !== void 0 && options.clearRoles) {
+    console.error(colorError("Pass only one of --role / --clear-roles."));
+    process.exit(1);
+  }
+  const parsedRoles = parseRepositoryRoles(options.role ?? []);
+  if ("error" in parsedRoles) {
+    console.error(colorError(parsedRoles.error));
+    process.exit(1);
+  }
+  const roles = options.clearRoles ? [] : options.role !== void 0 ? parsedRoles.roles : void 0;
+  const roleLabel = resolveClearableOption(options.roleLabel, options.clearRoleLabel, "role-label");
+  if ("error" in roleLabel) {
+    console.error(colorError(roleLabel.error));
+    process.exit(1);
+  }
+  const repositoryPath = resolveClearableOption(
+    options.repoPath,
+    options.clearRepoPath,
+    "repo-path"
+  );
+  if ("error" in repositoryPath) {
+    console.error(colorError(repositoryPath.error));
+    process.exit(1);
+  }
+  const labelError = validateRoleLabel(roles, roleLabel.value);
+  if (labelError) {
+    console.error(colorError(labelError));
+    process.exit(1);
+  }
+  const body = buildUpdateLinkBody({
+    roles,
+    roleLabel: roleLabel.value,
+    repositoryPath: repositoryPath.value,
+    scanEnabled: options.scan
+  });
+  if (isEmptyLinkUpdate(body)) {
+    console.error(colorError(`Nothing to update. Pass at least one of ${UPDATE_LINK_FLAGS}.`));
+    process.exit(1);
+  }
+  const organizationId = await resolveOrganizationId();
+  const existing = await resolveExistingLink(organizationId, applicationId, options.repo);
+  const result = await authenticatedRequest(
+    (client) => client.application.updateApplicationRepository({
+      params: {
+        organizationId,
+        applicationId,
+        applicationRepositoryId: existing.applicationRepositoryId
+      },
+      body
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failLinkOp("update link", result.status, result.body);
+  }
+  if (output === "table") {
+    console.log(
+      colorSuccess(
+        `Updated link for ${sanitizeDisplay(result.body.repositoryName)} on application ${applicationId}`
+      )
+    );
+  }
+  outputLink(result.body, output);
+}
+async function runUnlink(applicationId, options) {
+  if (!isUuid(applicationId)) {
+    exitInvalidApplicationId(applicationId);
+  }
+  const organizationId = await resolveOrganizationId();
+  const existing = await resolveExistingLink(organizationId, applicationId, options.repo);
+  const confirmed = await confirmAction(
+    `Unlink ${sanitizeDisplay(existing.repositoryName)} from application ${applicationId}?`,
+    { skip: options.yes === true, verb: "unlink" }
+  );
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.deleteApplicationRepository({
+      params: {
+        organizationId,
+        applicationId,
+        applicationRepositoryId: existing.applicationRepositoryId
+      }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failLinkOp("unlink", result.status, result.body);
+  }
+  console.log(
+    colorSuccess(
+      `Unlinked ${sanitizeDisplay(existing.repositoryName)} from application ${applicationId}`
+    )
+  );
+}
 function createCreateCommand() {
   return new Command("create").description("Create a new application").argument("<name>", "Application name").option("--type <type>", "Application type: web, cli, mobile, desktop, api-service", "web").option("--url <url>", "Application URL (required for web/api-service)").option("--repo <id-or-url>", "Link a repository at creation (UUID, URL, or owner/repo)").option("--repo-path <path>", "Path within the linked repository").option("--help-center-url <url>", "Help center URL").option("--docs-url <url>", "Documentation URL").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
@@ -50025,6 +50652,59 @@ Examples:
     await runUpdate(applicationId, options);
   });
 }
+var ROLE_FLAG_HELP = `Repository role (repeatable): ${REPOSITORY_ROLE_INPUTS.join(", ")}`;
+function createLinkCommand() {
+  return new Command("link").description("Link a repository to an application").argument("<applicationId>", "Application UUID").requiredOption("--repo <id-or-url>", "Repository to link (UUID, URL, or owner/repo)").option("--role <role>", ROLE_FLAG_HELP, collectRepeatable).option("--role-label <label>", 'Custom label for the "other" role').option("--repo-path <path>", "Path within the repository").option("--no-scan", "Link without including the repository in scans").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+A link is scan-enabled unless --no-scan is passed. Scan-disabled links are
+skipped by scans and do not satisfy the repository precondition for starting a
+pentest.
+
+Examples:
+  tracecli application link <appId> --repo acme/store
+  tracecli application link <appId> --repo acme/store --role frontend --role backend-api
+  tracecli application link <appId> --repo acme/tools --role other --role-label "Design system"
+  tracecli application link <appId> --repo acme/monorepo --repo-path apps/web --no-scan`
+  ).action(async (applicationId, options) => {
+    await runLink(applicationId, options);
+  });
+}
+function createUpdateLinkCommand() {
+  return new Command("update-link").description("Change an existing repository link's roles, label, path, or scan state").argument("<applicationId>", "Application UUID").requiredOption(
+    "--repo <id-or-url>",
+    "Linked repository to change (repository UUID, link UUID, URL, or owner/repo)"
+  ).option("--role <role>", `${ROLE_FLAG_HELP}; replaces the current roles`, collectRepeatable).option("--clear-roles", "Remove every role from the link").option("--role-label <label>", 'Custom label for the "other" role').option("--clear-role-label", "Remove the custom role label").option("--repo-path <path>", "Path within the repository").option("--clear-repo-path", "Remove the repository path").option("--scan", "Include the repository in scans").option("--no-scan", "Exclude the repository from scans (the link stays)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The update is partial: only the flags you pass change. --role replaces the
+whole role set, so pass every role the link should keep.
+
+Examples:
+  tracecli application update-link <appId> --repo acme/store --role frontend --role backend-api
+  tracecli application update-link <appId> --repo acme/store --repo-path apps/web
+  tracecli application update-link <appId> --repo acme/store --no-scan
+  tracecli application update-link <appId> --repo <repositoryId> --scan -o json`
+  ).action(async (applicationId, options) => {
+    await runUpdateLink(applicationId, options);
+  });
+}
+function createUnlinkCommand() {
+  return new Command("unlink").description("Remove a repository link from an application").argument("<applicationId>", "Application UUID").requiredOption(
+    "--repo <id-or-url>",
+    "Linked repository to remove (repository UUID, link UUID, URL, or owner/repo)"
+  ).option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").addHelpText(
+    "after",
+    `
+Only the link is removed; the repository stays connected to the organization.
+
+Examples:
+  tracecli application unlink <appId> --repo acme/store
+  tracecli application unlink <appId> --repo <repositoryId> --yes`
+  ).action(async (applicationId, options) => {
+    await runUnlink(applicationId, options);
+  });
+}
 function createDeleteCommand() {
   return new Command("delete").description("Delete an application").argument("<applicationId>", "Application UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (applicationId, options) => {
     await runDelete(applicationId, options);
@@ -50036,6 +50716,9 @@ function createApplicationCommand() {
   application.addCommand(createListCommand2());
   application.addCommand(createGetCommand());
   application.addCommand(createReposCommand());
+  application.addCommand(createLinkCommand());
+  application.addCommand(createUpdateLinkCommand());
+  application.addCommand(createUnlinkCommand());
   application.addCommand(createUpdateCommand());
   application.addCommand(createDeleteCommand());
   return application;
@@ -50496,8 +51179,8 @@ function wrapTextWithPrefix(e, r2, o2, t2 = o2, s = o2, n3) {
     hard: true,
     trim: false
   }).split(`
-`).map((c84, i2, m2) => {
-    const d = n3 ? n3(c84, i2) : c84;
+`).map((c86, i2, m2) => {
+    const d = n3 ? n3(c86, i2) : c86;
     return i2 === 0 ? `${t2}${d}` : i2 === m2.length - 1 ? `${s}${d}` : `${o2}${d}`;
   }).join(`
 `);
@@ -50995,14 +51678,14 @@ var limitOptions = ({
     Math.min(l2 - a2 + 3, e.length - a2),
     0
   ));
-  let d = a2 < e.length && f > 0, c84 = a2 < e.length && f + a2 < e.length;
+  let d = a2 < e.length && f > 0, c86 = a2 < e.length && f + a2 < e.length;
   const W = Math.min(
     f + a2,
     e.length
   ), s = [];
   let g = 0;
-  d && g++, c84 && g++;
-  const T = f + (d ? 1 : 0), y = W - (c84 ? 1 : 0);
+  d && g++, c86 && g++;
+  const T = f + (d ? 1 : 0), y = W - (c86 ? 1 : 0);
   for (let t2 = T; t2 < y; t2++) {
     const n3 = e[t2], o2 = n3 ? w(n3, t2 === l2) : "", h2 = wrapAnsi(o2, i2, {
       hard: true,
@@ -51023,14 +51706,14 @@ var limitOptions = ({
       u4,
       true
     );
-    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c84 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c84 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c84 = true, s.splice(s.length - n3, n3));
+    d ? ({ lineCount: o2, removals: t2 } = L(), o2 > u4 && (c86 || (u4 -= 1), { lineCount: o2, removals: n3 } = E())) : (c86 || (u4 -= 1), { lineCount: o2, removals: n3 } = E(), o2 > u4 && (u4 -= 1, { lineCount: o2, removals: t2 } = L())), t2 > 0 && (d = true, s.splice(0, t2)), n3 > 0 && (c86 = true, s.splice(s.length - n3, n3));
   }
   const x = [];
   d && x.push(M);
   for (const t2 of s)
     for (const n3 of t2)
       x.push(n3);
-  return c84 && x.push(M), x;
+  return c86 && x.push(M), x;
 };
 var confirm = (i2) => {
   const a2 = i2.active ?? "Yes", s = i2.inactive ?? "No";
@@ -51049,15 +51732,15 @@ var confirm = (i2) => {
         u4
       ), o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${f}
-`, c84 = this.value ? a2 : s;
+`, c86 = this.value ? a2 : s;
       switch (this.state) {
         case "submit": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2("dim", c84)}`;
+          return `${o2}${r2}${styleText2("dim", c86)}`;
         }
         case "cancel": {
           const r2 = e ? `${styleText2("gray", S_BAR)}  ` : "";
-          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c84)}${e ? `
+          return `${o2}${r2}${styleText2(["strikethrough", "dim"], c86)}${e ? `
 ${styleText2("gray", S_BAR)}` : ""}`;
         }
         default: {
@@ -51205,13 +51888,13 @@ var multiline = (e) => new h({
 `, m2 = e.placeholder && e.placeholder.length > 0 ? (
       // biome-ignore lint/style/noNonNullAssertion: guarded by placeholder.length > 0
       styleText2("inverse", e.placeholder[0]) + styleText2("dim", e.placeholder.slice(1))
-    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c84 = e.showSubmit ? `
+    ) : styleText2(["inverse", "hidden"], "_"), a2 = this.userInput ? this.userInputWithCursor : m2, l2 = this.value ?? "", c86 = e.showSubmit ? `
   ${styleText2(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
     switch (this.state) {
       case "error": {
         const n3 = `${styleText2("yellow", S_BAR)}  `, r2 = i2 ? wrapTextWithPrefix(e.output, a2, n3, void 0) : a2, u4 = styleText2("yellow", S_BAR_END);
         return `${o2}${r2}
-${u4}  ${styleText2("yellow", this.error)}${c84}
+${u4}  ${styleText2("yellow", this.error)}${c86}
 `;
       }
       case "submit": {
@@ -51239,7 +51922,7 @@ ${u4}  ${styleText2("yellow", this.error)}${c84}
       default: {
         const n3 = i2 ? `${styleText2("cyan", S_BAR)}  ` : "", r2 = i2 ? styleText2("cyan", S_BAR_END) : "", u4 = i2 ? wrapTextWithPrefix(e.output, a2, n3) : a2;
         return `${o2}${u4}
-${r2}${c84}
+${r2}${c86}
 `;
       }
     }
@@ -51254,7 +51937,7 @@ var password = (r2) => new u$1({
   render() {
     const e = r2.withGuide ?? settings.withGuide, o2 = `${e ? `${styleText2("gray", S_BAR)}
 ` : ""}${symbol2(this.state)}  ${r2.message}
-`, c84 = this.userInputWithCursor, i2 = this.masked;
+`, c86 = this.userInputWithCursor, i2 = this.masked;
     switch (this.state) {
       case "error": {
         const s = e ? `${styleText2("yellow", S_BAR)}  ` : "", n3 = e ? `${styleText2("yellow", S_BAR_END)}  ` : "", l2 = i2 ?? "";
@@ -51274,7 +51957,7 @@ ${styleText2("gray", S_BAR)}` : ""}`;
       }
       default: {
         const s = e ? `${styleText2("cyan", S_BAR)}  ` : "", n3 = e ? styleText2("cyan", S_BAR_END) : "";
-        return `${o2}${s}${c84}
+        return `${o2}${s}${c86}
 ${n3}
 `;
       }
@@ -51290,7 +51973,7 @@ var SELECT_INSTRUCTIONS = [
   `${styleText2("dim", "\u2191/\u2193")} to navigate`,
   `${styleText2("dim", "Enter:")} confirm`
 ];
-var c83 = (t2, o2) => t2.includes(`
+var c85 = (t2, o2) => t2.includes(`
 `) ? t2.split(`
 `).map((d) => o2(d)).join(`
 `) : o2(t2);
@@ -51301,15 +51984,15 @@ var select = (t2) => {
     const s = n3.label ?? String(n3.value);
     switch (m2) {
       case "disabled":
-        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c83(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c85(s, (i2) => styleText2("gray", i2))}${n3.hint ? ` ${styleText2("dim", `(${n3.hint ?? "disabled"})`)}` : ""}`;
       case "selected":
-        return `${c83(s, (i2) => styleText2("dim", i2))}`;
+        return `${c85(s, (i2) => styleText2("dim", i2))}`;
       case "active":
         return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n3.hint ? ` ${styleText2("dim", `(${n3.hint})`)}` : ""}`;
       case "cancelled":
-        return `${c83(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
+        return `${c85(s, (i2) => styleText2(["strikethrough", "dim"], i2))}`;
       default:
-        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c83(s, (i2) => styleText2("dim", i2))}`;
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c85(s, (i2) => styleText2("dim", i2))}`;
     }
   }, d = t2.showInstructions ?? true;
   return new n$1({
@@ -51370,6 +52053,18 @@ var i = `${styleText2("gray", S_BAR)}  `;
 
 // src/org/invite.ts
 var MEMBER_ROLE_SLUGS = MemberRoleSlugSchema.options;
+var ROLE_NAMES = {
+  admin: "admin",
+  analyst: "manager",
+  developer: "developer"
+};
+var ROLE_BY_NAME = {
+  admin: "admin",
+  manager: "analyst",
+  analyst: "analyst",
+  developer: "developer"
+};
+var ROLE_CHOICES = MEMBER_ROLE_SLUGS.map((slug) => ROLE_NAMES[slug]).join(", ");
 var DEFAULT_INVITE_ROLE = CreateMemberInvitationRequestSchema.shape.roleSlug.parse(void 0);
 var InviteEmailSchema = CreateMemberInvitationRequestSchema.shape.email;
 function planInvite(emailArg, options) {
@@ -51380,14 +52075,13 @@ function planInvite(emailArg, options) {
   if (!InviteEmailSchema.safeParse(email3).success) {
     return { error: `'${sanitizeDisplay(email3)}' is not a valid email address.` };
   }
-  const role = options.role.trim().toLowerCase();
-  const parsedRole = MemberRoleSlugSchema.safeParse(role);
-  if (!parsedRole.success) {
+  const roleSlug = ROLE_BY_NAME[options.role.trim().toLowerCase()];
+  if (roleSlug === void 0) {
     return {
-      error: `Invalid --role '${sanitizeDisplay(options.role)}'. Use one of: ${MEMBER_ROLE_SLUGS.join(", ")}.`
+      error: `Invalid --role '${sanitizeDisplay(options.role)}'. Use one of: ${ROLE_CHOICES}.`
     };
   }
-  return { plan: { email: email3, roleSlug: parsedRole.data } };
+  return { plan: { email: email3, roleSlug } };
 }
 function failInvite(status, body) {
   const { message } = readErrorFields(body);
@@ -51395,7 +52089,7 @@ function failInvite(status, body) {
     exitAuthFailed();
   }
   if (status === 403) {
-    const hint = "Inviting members requires an organization admin or analyst signed in with `tracecli auth login` (API keys are rejected).";
+    const hint = "Inviting members requires an organization admin signed in with `tracecli auth login` (API keys are rejected).";
     console.error(
       colorError(message === void 0 || message === "Insufficient permissions" ? hint : message)
     );
@@ -51440,7 +52134,7 @@ function outputInvitation(invitation, output) {
   }
   console.log(
     colorSuccess(
-      `Invitation sent to ${sanitizeDisplay(invitation.email)} as ${sanitizeDisplay(invitation.roleSlug)}`
+      `Invitation sent to ${sanitizeDisplay(invitation.email)} as ${ROLE_NAMES[invitation.roleSlug]}`
     )
   );
   console.log(`  Invitation ID: ${sanitizeDisplay(invitation.invitationId)}`);
@@ -51466,20 +52160,16 @@ async function runInvite(emailArg, options) {
   outputInvitation(result.body, output);
 }
 function createOrgInviteCommand() {
-  return new Command("invite").description("Invite someone to the active organization by email").argument("<email>", "Email address to invite").option(
-    "-r, --role <role>",
-    `Role to grant: ${MEMBER_ROLE_SLUGS.join(", ")}`,
-    DEFAULT_INVITE_ROLE
-  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  return new Command("invite").description("Invite someone to the active organization by email").argument("<email>", "Email address to invite").option("-r, --role <role>", `Role to grant: ${ROLE_CHOICES}`, DEFAULT_INVITE_ROLE).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Sends the same invitation email as the dashboard's Settings > Members page.
-Requires an organization admin or analyst signed in with \`tracecli auth login\`;
-API keys are rejected. Only admins can invite someone as an admin.
+Requires an organization admin signed in with \`tracecli auth login\`;
+API keys are rejected.
 
 Examples:
   tracecli org invite dev@acme.com
-  tracecli org invite sec@acme.com --role analyst
+  tracecli org invite sec@acme.com --role manager
   tracecli org invite cto@acme.com --role admin --output json`
   ).action(async (email3, options) => {
     await runInvite(email3, options);
@@ -52806,7 +53496,7 @@ function extractCommandTree(cmd) {
     description: o2.description,
     takesValue: o2.required || o2.optional
   }));
-  const subcommands = cmd.commands.filter((c84) => !c84._hidden).map((c84) => extractCommandTree(c84));
+  const subcommands = cmd.commands.filter((c86) => !c86._hidden).map((c86) => extractCommandTree(c86));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -52872,7 +53562,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c84) => c84.name);
+  const subcommandNames = tree.subcommands.map((c86) => c86.name);
   const optionNames = tree.options.flatMap((o2) => o2.short ? [o2.long, o2.short] : [o2.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -53178,17 +53868,17 @@ function validateInboxLabel(label) {
 function buildCreateInboxBody(label) {
   return { label };
 }
+function forbiddenMessage(verb, needsEntitlement) {
+  const where = needsEntitlement ? " on a pentest-enabled organization" : "";
+  return `Only an organization admin or Manager (or Trace staff)${where} can ${verb}.`;
+}
 function failWriteOp2(action, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
   }
   if (status === 403) {
-    console.error(
-      colorError(
-        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} inboxes.`
-      )
-    );
+    console.error(colorError(forbiddenMessage(`${action} inboxes`, true)));
     process.exit(1);
   }
   if (status === 404) {
@@ -53240,7 +53930,7 @@ function failReadOp2(action, status, body, notFoundLabel) {
     exitAuthFailed();
   }
   if (status === 403) {
-    console.error(colorError("You don't have access to view inboxes in this organization."));
+    console.error(colorError(forbiddenMessage(action, action !== "list inboxes")));
     process.exit(1);
   }
   if (status === 404) {
@@ -53287,9 +53977,9 @@ function buildInboxesTable(inboxes) {
     address: sanitizeDisplay(inbox.address),
     label: sanitizeDisplay(inbox.label)
   }));
-  const addressWidth = Math.max(7, ...cells.map((c84) => c84.address.length));
+  const addressWidth = Math.max(7, ...cells.map((c86) => c86.address.length));
   const header = `${"ADDRESS".padEnd(addressWidth)}  LABEL`;
-  const rows = cells.map((c84) => `${c84.address.padEnd(addressWidth)}  ${c84.label}`);
+  const rows = cells.map((c86) => `${c86.address.padEnd(addressWidth)}  ${c86.label}`);
   return { header, rows };
 }
 function formatInboxQuota(quota) {
@@ -53313,14 +54003,14 @@ function buildInboxEmailsTable(messages) {
     subject: sanitizeDisplay(message.subject ?? ""),
     unread: message.unread ? "yes" : "no"
   }));
-  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
-  const receivedWidth = Math.max(8, ...cells.map((c84) => c84.received.length));
-  const fromWidth = Math.max(4, ...cells.map((c84) => c84.from.length));
-  const toWidth = Math.max(2, ...cells.map((c84) => c84.to.length));
-  const subjectWidth = Math.max(7, ...cells.map((c84) => c84.subject.length));
+  const idWidth = Math.max(2, ...cells.map((c86) => c86.id.length));
+  const receivedWidth = Math.max(8, ...cells.map((c86) => c86.received.length));
+  const fromWidth = Math.max(4, ...cells.map((c86) => c86.from.length));
+  const toWidth = Math.max(2, ...cells.map((c86) => c86.to.length));
+  const subjectWidth = Math.max(7, ...cells.map((c86) => c86.subject.length));
   const header = `${"ID".padEnd(idWidth)}  ${"RECEIVED".padEnd(receivedWidth)}  ${"FROM".padEnd(fromWidth)}  ${"TO".padEnd(toWidth)}  ${"SUBJECT".padEnd(subjectWidth)}  UNREAD`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.received.padEnd(receivedWidth)}  ${c84.from.padEnd(fromWidth)}  ${c84.to.padEnd(toWidth)}  ${c84.subject.padEnd(subjectWidth)}  ${c84.unread}`
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.received.padEnd(receivedWidth)}  ${c86.from.padEnd(fromWidth)}  ${c86.to.padEnd(toWidth)}  ${c86.subject.padEnd(subjectWidth)}  ${c86.unread}`
   );
   return { header, rows };
 }
@@ -53974,6 +54664,46 @@ function anySecretFlag(opts) {
 function anyPasswordFlag(opts) {
   return opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
 }
+function anyUsernameFlag(opts) {
+  return opts.usernameStdin === true || opts.usernameFile !== void 0 || opts.usernameEnv !== void 0;
+}
+function anySecretValueFlag(opts) {
+  return opts.secretStdin === true || opts.secretFile !== void 0 || opts.secretEnv !== void 0;
+}
+function withArticle(kebab) {
+  return `${/^(api|ssh)-/.test(kebab) ? "An" : "A"} ${kebab}`;
+}
+function rotateFlagProblem(type, opts) {
+  const kebab = credentialTypeKebab(type);
+  if (type === "USERNAME_PASSWORD") {
+    if (anySecretValueFlag(opts)) {
+      return `${withArticle(kebab)} credential takes --username-* and --password-*, not --secret-*.`;
+    }
+    if (!anyUsernameFlag(opts) || !anyPasswordFlag(opts)) {
+      return "Pass both --username-* and --password-*: the login is replaced as a pair.";
+    }
+    if (usesStdin(usernameOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --username-file/-env for the other.";
+    }
+    return null;
+  }
+  if (anyUsernameFlag(opts)) {
+    return `${withArticle(kebab)} credential has no username. Pass the new secret with --secret-*.`;
+  }
+  if (type === "SSH_PRIVATE_KEY") {
+    if (!anySecretValueFlag(opts)) {
+      return "Pass the key with --secret-* too: an SSH key and its passphrase are replaced together.";
+    }
+    if (usesStdin(secretOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --password-file/-env for the passphrase.";
+    }
+    return null;
+  }
+  if (anyPasswordFlag(opts)) {
+    return `${withArticle(kebab)} credential has no password. Pass the new secret with --secret-*.`;
+  }
+  return null;
+}
 function secretOpts(opts) {
   return { stdin: opts.secretStdin, file: opts.secretFile, env: opts.secretEnv };
 }
@@ -53989,7 +54719,11 @@ function failWriteOp3(action, status, body, notFoundLabel) {
     exitAuthFailed();
   }
   if (status === 403) {
-    console.error(colorError(`Only Trace staff can ${action} credentials.`));
+    console.error(
+      colorError(
+        `You can't ${action} credentials here. That needs an organization admin signed in with \`tracecli auth login\`; API keys are rejected.`
+      )
+    );
     process.exit(1);
   }
   if (status === 404) {
@@ -54103,16 +54837,16 @@ function printCredentialsTsv(creds) {
   }
 }
 function buildCredentialsTable(creds) {
-  const cells = creds.map((c84) => ({
-    id: c84.credentialId,
-    label: sanitizeDisplay(c84.label),
-    type: c84.credentialType
+  const cells = creds.map((c86) => ({
+    id: c86.credentialId,
+    label: sanitizeDisplay(c86.label),
+    type: c86.credentialType
   }));
-  const idWidth = Math.max(2, ...cells.map((c84) => c84.id.length));
-  const labelWidth = Math.max(5, ...cells.map((c84) => c84.label.length));
+  const idWidth = Math.max(2, ...cells.map((c86) => c86.id.length));
+  const labelWidth = Math.max(5, ...cells.map((c86) => c86.label.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  TYPE`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type}`
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.label.padEnd(labelWidth)}  ${c86.type}`
   );
   return { header, rows };
 }
@@ -54306,6 +55040,43 @@ async function buildCreateBody(type, label, options) {
     }
   }
 }
+async function buildRotateBody(type, options) {
+  switch (type) {
+    case "USERNAME_PASSWORD": {
+      const username = await resolveSecret("username", "username", usernameOpts(options));
+      const password2 = await resolveSecret("password", "password", passwordOpts(options));
+      return { credentialType: type, username, password: password2 };
+    }
+    case "SSH_PRIVATE_KEY": {
+      const privateKeyPem = await resolveSecret("private key PEM", "secret", secretOpts(options));
+      const passphrase = anyPasswordFlag(options) ? await resolveSecret("key passphrase", "password", passwordOpts(options)) : void 0;
+      return {
+        credentialType: type,
+        privateKeyPem,
+        ...passphrase !== void 0 ? { passphrase } : {}
+      };
+    }
+    case "SESSION_STATE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("session state capture", "secret", secretOpts(options))
+      };
+    case "MAGIC_AUTH":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("test-account email", "secret", secretOpts(options))
+      };
+    case "BEARER_TOKEN":
+    case "JWT_TOKEN":
+    case "API_KEY":
+    case "PASSPHRASE":
+    case "COOKIE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("secret value", "secret", secretOpts(options))
+      };
+  }
+}
 async function runList3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
@@ -54356,12 +55127,7 @@ async function runUpdate3(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
-  if (anySecretFlag(options)) {
-    console.error(
-      colorError("Secrets are immutable on update. Delete and recreate the credential to rotate.")
-    );
-    process.exit(1);
-  }
+  const rotating = anySecretFlag(options);
   if (options.clearAuthConfig && anyAuthFlag(options)) {
     console.error(colorError("Pass either --clear-auth-config or auth-config flags, not both."));
     process.exit(1);
@@ -54374,16 +55140,32 @@ async function runUpdate3(credentialId, options) {
   }
   const organizationId = await resolveOrganizationId();
   const params3 = { organizationId, environmentId: options.env, credentialId };
+  const current = rotating || !options.clearAuthConfig && anyAuthFlag(options) ? await authenticatedRequest((client) => client.credential.getCredential({ params: params3 })) : null;
+  if (current && current.status !== SUCCESS_STATUS) {
+    failReadOp3("get credential", current.status, current.body, credentialId);
+  }
+  let rotateBody;
+  if (current && rotating) {
+    const type = current.body.credentialType;
+    const problem = rotateFlagProblem(type, options) ?? (options.clearAuthConfig && (type === "SSH_PRIVATE_KEY" || type === "SESSION_STATE") ? `${withArticle(credentialTypeKebab(type))} credential's auth config can't be cleared, so --clear-auth-config would fail after the secret had already changed.` : null);
+    if (problem) {
+      console.error(colorError(problem));
+      process.exit(1);
+    }
+    try {
+      rotateBody = await buildRotateBody(type, options);
+    } catch (error48) {
+      if (error48 instanceof SecretInputError) {
+        console.error(colorError(error48.message));
+        process.exit(1);
+      }
+      throw error48;
+    }
+  }
   let authConfig;
   if (options.clearAuthConfig) {
     authConfig = null;
-  } else if (anyAuthFlag(options)) {
-    const current = await authenticatedRequest(
-      (client) => client.credential.getCredential({ params: params3 })
-    );
-    if (current.status !== SUCCESS_STATUS) {
-      failReadOp3("get credential", current.status, current.body, credentialId);
-    }
+  } else if (current && anyAuthFlag(options)) {
     const type = current.body.credentialType;
     const foreign = rejectForeignAuthFlags(type, options);
     if (foreign) {
@@ -54403,24 +55185,44 @@ async function runUpdate3(credentialId, options) {
     ...options.moveEnv !== void 0 ? { environmentId: options.moveEnv } : {},
     ...authConfig !== void 0 ? { authConfig } : {}
   };
-  if (Object.keys(body).length === 0) {
+  const patching = Object.keys(body).length > 0;
+  if (!rotateBody && !patching) {
     console.error(
       colorError(
-        "Nothing to update. Pass --label, --move-env, auth-config flags, or --clear-auth-config."
+        "Nothing to update. Pass --label, --move-env, auth-config flags, --clear-auth-config, or a new secret."
       )
     );
     process.exit(1);
   }
-  const result = await authenticatedRequest(
-    (client) => client.credential.updateCredential({ params: params3, body })
-  );
-  if (result.status !== SUCCESS_STATUS) {
-    failWriteOp3("update", result.status, result.body, credentialId);
+  let updated;
+  if (rotateBody) {
+    const secret = rotateBody;
+    const rotated = await authenticatedRequest(
+      (client) => client.credential.rotateCredentialSecret({ params: params3, body: secret })
+    );
+    if (rotated.status !== SUCCESS_STATUS) {
+      failWriteOp3("update", rotated.status, rotated.body, credentialId);
+    }
+    updated = rotated.body;
   }
+  if (patching) {
+    const result = await authenticatedRequest(
+      (client) => client.credential.updateCredential({ params: params3, body })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      if (rotateBody) {
+        console.error(colorError("The secret was rotated, but the other changes were not saved."));
+      }
+      failWriteOp3("update", result.status, result.body, credentialId);
+    }
+    updated = result.body;
+  }
+  if (!updated) return;
   if (output === "table") {
-    console.log(colorSuccess(`Updated credential ${sanitizeDisplay(result.body.label)}`));
+    const verb = rotateBody ? patching ? "Rotated the secret and updated" : "Rotated the secret of" : "Updated";
+    console.log(colorSuccess(`${verb} credential ${sanitizeDisplay(updated.label)}`));
   }
-  outputCredential(result.body, output);
+  outputCredential(updated, output);
 }
 function failMfaOp(action, status, body, credentialId) {
   const { message, errorCode } = readErrorFields(body);
@@ -54547,7 +55349,7 @@ async function runDelete3(credentialId, options) {
   }
   console.log(colorSuccess(`Deleted credential ${credentialId}`));
 }
-function failLinkOp(op, status, body, notFoundLabel) {
+function failLinkOp2(op, status, body, notFoundLabel) {
   const { message, errorCode } = readErrorFields(body);
   if (status === UNAUTHORIZED_STATUS2) {
     exitAuthFailed();
@@ -54654,13 +55456,13 @@ function buildCredentialLinksTable(links) {
     source: sourceDisplay(link.source),
     via: link.environmentCredentialSourceId ? "link-all" : ""
   }));
-  const idWidth = Math.max("LINK ID".length, ...cells.map((c84) => c84.id.length));
-  const labelWidth = Math.max("LABEL".length, ...cells.map((c84) => c84.label.length));
-  const typeWidth = Math.max("TYPE".length, ...cells.map((c84) => c84.type.length));
-  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c84) => c84.source.length));
+  const idWidth = Math.max("LINK ID".length, ...cells.map((c86) => c86.id.length));
+  const labelWidth = Math.max("LABEL".length, ...cells.map((c86) => c86.label.length));
+  const typeWidth = Math.max("TYPE".length, ...cells.map((c86) => c86.type.length));
+  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c86) => c86.source.length));
   const header = `${"LINK ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  ${"TYPE".padEnd(typeWidth)}  ${"SOURCE".padEnd(sourceWidth)}  VIA`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.source.padEnd(sourceWidth)}  ${c84.via}`.trimEnd()
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.label.padEnd(labelWidth)}  ${c86.type.padEnd(typeWidth)}  ${c86.source.padEnd(sourceWidth)}  ${c86.via}`.trimEnd()
   );
   return { header, rows };
 }
@@ -54714,17 +55516,17 @@ function buildLinkableCredentialsTable(creds) {
     }),
     linked: cred.alreadyLinked ? "linked" : ""
   }));
-  const idWidth = Math.max("ID".length, ...cells.map((c84) => c84.id.length));
-  const labelWidth = Math.max("LABEL".length, ...cells.map((c84) => c84.label.length));
-  const typeWidth = Math.max("TYPE".length, ...cells.map((c84) => c84.type.length));
-  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c84) => c84.source.length));
+  const idWidth = Math.max("ID".length, ...cells.map((c86) => c86.id.length));
+  const labelWidth = Math.max("LABEL".length, ...cells.map((c86) => c86.label.length));
+  const typeWidth = Math.max("TYPE".length, ...cells.map((c86) => c86.type.length));
+  const sourceWidth = Math.max("SOURCE".length, ...cells.map((c86) => c86.source.length));
   const header = `${"ID".padEnd(idWidth)}  ${"LABEL".padEnd(labelWidth)}  ${"TYPE".padEnd(typeWidth)}  ${"SOURCE".padEnd(sourceWidth)}  STATUS`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.label.padEnd(labelWidth)}  ${c84.type.padEnd(typeWidth)}  ${c84.source.padEnd(sourceWidth)}  ${c84.linked}`.trimEnd()
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.label.padEnd(labelWidth)}  ${c86.type.padEnd(typeWidth)}  ${c86.source.padEnd(sourceWidth)}  ${c86.linked}`.trimEnd()
   );
   return { header, rows };
 }
-async function runLink(credentialId, options) {
+async function runLink2(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
@@ -54736,7 +55538,7 @@ async function runLink(credentialId, options) {
     })
   );
   if (result.status !== CREATED_STATUS) {
-    failLinkOp("link", result.status, result.body, credentialId);
+    failLinkOp2("link", result.status, result.body, credentialId);
   }
   if (output === "table") {
     console.log(
@@ -54747,7 +55549,7 @@ async function runLink(credentialId, options) {
   }
   outputCredentialLink(result.body, output);
 }
-async function runUnlink(credentialLinkId, options) {
+async function runUnlink2(credentialLinkId, options) {
   requireEnvId(options.env);
   requireLinkId(credentialLinkId);
   const confirmed = await confirmAction(
@@ -54768,7 +55570,7 @@ async function runUnlink(credentialLinkId, options) {
     if (result.status === 409 && readErrorFields(result.body).errorCode === "CREDENTIAL_LINKED_BY_RULE") {
       await failLinkedByRule(organizationId, options.env, result.body);
     }
-    failLinkOp("unlink", result.status, result.body, credentialLinkId);
+    failLinkOp2("unlink", result.status, result.body, credentialLinkId);
   }
   console.log(colorSuccess(`Unlinked credential link ${credentialLinkId}`));
 }
@@ -54916,12 +55718,12 @@ function buildLinkableEnvironmentsTable(envs) {
     count: String(env2.credentialCount),
     linked: env2.alreadyLinked ? "linked" : ""
   }));
-  const idWidth = Math.max("ENVIRONMENT ID".length, ...cells.map((c84) => c84.id.length));
-  const nameWidth = Math.max("ENVIRONMENT".length, ...cells.map((c84) => c84.name.length));
+  const idWidth = Math.max("ENVIRONMENT ID".length, ...cells.map((c86) => c86.id.length));
+  const nameWidth = Math.max("ENVIRONMENT".length, ...cells.map((c86) => c86.name.length));
   const countWidth = "CREDENTIALS".length;
   const header = `${"ENVIRONMENT ID".padEnd(idWidth)}  ${"ENVIRONMENT".padEnd(nameWidth)}  ${"CREDENTIALS".padEnd(countWidth)}  STATUS`;
   const rows = cells.map(
-    (c84) => `${c84.id.padEnd(idWidth)}  ${c84.name.padEnd(nameWidth)}  ${c84.count.padEnd(countWidth)}  ${c84.linked}`.trimEnd()
+    (c86) => `${c86.id.padEnd(idWidth)}  ${c86.name.padEnd(nameWidth)}  ${c86.count.padEnd(countWidth)}  ${c86.linked}`.trimEnd()
   );
   return { header, rows };
 }
@@ -54980,7 +55782,7 @@ async function runLinkAll(sourceEnvironmentId, options) {
     })
   );
   if (result.status !== CREATED_STATUS) {
-    failLinkOp("link all", result.status, result.body, sourceEnvironmentId);
+    failLinkOp2("link all", result.status, result.body, sourceEnvironmentId);
   }
   const rule = result.body;
   if (output === "json") {
@@ -55045,7 +55847,7 @@ async function runUnlinkAll(sourceEnvironmentId, options) {
     })
   );
   if (result.status !== NO_CONTENT_STATUS) {
-    failLinkOp("unlink all", result.status, result.body, rule.environmentCredentialSourceId);
+    failLinkOp2("unlink all", result.status, result.body, rule.environmentCredentialSourceId);
   }
   console.log(
     colorSuccess(
@@ -55101,18 +55903,22 @@ function createGetCommand2() {
   });
 }
 function createUpdateCommand2() {
-  const command = new Command("update").description("Update a credential (label, environment, or auth config; secrets are immutable)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
+  const command = new Command("update").description("Update a credential (label, environment, auth config, or secret)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
   addSecretInputOptions(command);
   addAuthConfigOptions(command).addHelpText(
     "after",
     `
 Auth-config flags must match the credential's existing type (looked up automatically).
-Secrets cannot be changed here \u2014 delete and recreate to rotate.
+A secret flag rotates the secret in place: the credential keeps its ID and scan history.
+A username/password credential takes both --username-* and --password-*; an SSH key
+takes --secret-* for the key and --password-* for its passphrase, if it has one.
 
 Examples:
   tracecli credential update <id> --env <envId> --label "prod (rotated 2026-06)"
   tracecli credential update <id> --env <envId> --login-url https://acme.com/signin
-  tracecli credential update <id> --env <envId> --clear-auth-config`
+  tracecli credential update <id> --env <envId> --clear-auth-config
+  vault read -field=token secret/x | tracecli credential update <id> --env <envId> --secret-stdin
+  tracecli credential update <id> --env <envId> --username-env LOGIN_USER --password-env LOGIN_PASS`
   );
   return command.action(async (credentialId, options) => {
     await runUpdate3(credentialId, options);
@@ -55163,7 +55969,7 @@ left \u2014 if the current window is nearly over, the API waits for the next one
     await runMfaCode(credentialId, options);
   });
 }
-function createLinkCommand() {
+function createLinkCommand2() {
   return new Command("link").description("Link another application's credential into an environment").argument("<credentialId>", "UUID of the credential to link (owned by another environment)").requiredOption("--env <environmentId>", "Environment UUID to link it into").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
@@ -55180,10 +55986,10 @@ Examples:
   tracecli credential linkable --env <envId>
   tracecli credential link <credentialId> --env <envId>`
   ).action(async (credentialId, options) => {
-    await runLink(credentialId, options);
+    await runLink2(credentialId, options);
   });
 }
-function createUnlinkCommand() {
+function createUnlinkCommand2() {
   return new Command("unlink").description("Remove a credential link from an environment (the source credential is kept)").argument("<credentialLinkId>", "Credential link UUID (the LINK ID from `credential links`)").requiredOption("--env <environmentId>", "Environment UUID the credential is linked into").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").addHelpText(
     "after",
     `
@@ -55192,7 +55998,7 @@ the environment's own credentials. A credential whose whole environment is
 linked here (VIA link-all in \`credential links\`) stays until that is removed
 with \`credential unlink-all\`.`
   ).action(async (credentialLinkId, options) => {
-    await runUnlink(credentialLinkId, options);
+    await runUnlink2(credentialLinkId, options);
   });
 }
 function createLinksCommand() {
@@ -55256,8 +56062,8 @@ function createCredentialCommand() {
   credential.addCommand(createSetMfaCommand());
   credential.addCommand(createClearMfaCommand());
   credential.addCommand(createMfaCodeCommand());
-  credential.addCommand(createLinkCommand());
-  credential.addCommand(createUnlinkCommand());
+  credential.addCommand(createLinkCommand2());
+  credential.addCommand(createUnlinkCommand2());
   credential.addCommand(createLinkAllCommand());
   credential.addCommand(createUnlinkAllCommand());
   credential.addCommand(createLinksCommand());
@@ -55477,14 +56283,14 @@ function buildEnvironmentTable(envs, leading) {
     url: e.primaryUrl != null ? sanitizeDisplay(e.primaryUrl) : "\u2014"
   }));
   const leadingWidths = leading.map(
-    (column, i2) => Math.max(column.header.length, ...cells.map((c84) => c84.leading[i2]?.length ?? 0))
+    (column, i2) => Math.max(column.header.length, ...cells.map((c86) => c86.leading[i2]?.length ?? 0))
   );
-  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
+  const nameWidth = Math.max(4, ...cells.map((c86) => c86.name.length));
   const padLeading = (values) => values.map((v, i2) => v.padEnd(leadingWidths[i2] ?? 0)).join("  ");
   return {
-    header: `${padLeading(leading.map((c84) => c84.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
+    header: `${padLeading(leading.map((c86) => c86.header))}  ${"NAME".padEnd(nameWidth)}  PROD  URL`,
     rows: cells.map(
-      (c84) => `${padLeading(c84.leading)}  ${c84.name.padEnd(nameWidth)}  ${c84.prod.padEnd(4)}  ${c84.url}`
+      (c86) => `${padLeading(c86.leading)}  ${c86.name.padEnd(nameWidth)}  ${c86.prod.padEnd(4)}  ${c86.url}`
     )
   };
 }
@@ -59119,7 +59925,7 @@ function createFindingsCommand() {
   findings.addCommand(createGetFindingCommand());
   findings.addCommand(createGetFindingReproCommand());
   findings.addCommand(createStatusUpdateCommand());
-  findings.addCommand(createAttachEvidenceCommand());
+  findings.addCommand(createAttachEvidenceCommand(), { hidden: true });
   findings.addCommand(createCreateFindingCommand(), { hidden: true });
   findings.addCommand(createCopyFindingsCommand(), { hidden: true });
   findings.addCommand(createPublishFindingsCommand(), { hidden: true });
@@ -59503,7 +60309,7 @@ function resolveQuestionnaireMode(options) {
   ];
   const chosen = exclusive.filter((entry) => entry.set);
   if (chosen.length > 1) {
-    console.error(colorError(`Pass only one of ${chosen.map((c84) => c84.flag).join(" / ")}.`));
+    console.error(colorError(`Pass only one of ${chosen.map((c86) => c86.flag).join(" / ")}.`));
     process.exit(1);
   }
   const only = chosen[0];
@@ -59671,7 +60477,7 @@ Examples:
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand7());
-  pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createUpdateCommand4(), { hidden: true });
   pentest.addCommand(createCreatePentestCommand(), { hidden: true });
   pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
@@ -60737,13 +61543,13 @@ function buildUploadsTable(uploads) {
     size: formatArchiveBytes(upload.sizeBytes),
     id: upload.codeUploadId
   }));
-  const nameWidth = Math.max(4, ...cells.map((c84) => c84.name.length));
-  const kindWidth = Math.max(4, ...cells.map((c84) => c84.kind.length));
-  const statusWidth = Math.max(6, ...cells.map((c84) => c84.status.length));
-  const sizeWidth = Math.max(4, ...cells.map((c84) => c84.size.length));
+  const nameWidth = Math.max(4, ...cells.map((c86) => c86.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c86) => c86.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c86) => c86.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c86) => c86.size.length));
   const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
   const rows = cells.map(
-    (c84) => `${c84.name.padEnd(nameWidth)}  ${c84.kind.padEnd(kindWidth)}  ${c84.status.padEnd(statusWidth)}  ${c84.size.padEnd(sizeWidth)}  ${c84.id}`
+    (c86) => `${c86.name.padEnd(nameWidth)}  ${c86.kind.padEnd(kindWidth)}  ${c86.status.padEnd(statusWidth)}  ${c86.size.padEnd(sizeWidth)}  ${c86.id}`
   );
   return { header, rows };
 }
@@ -61230,7 +62036,7 @@ async function runDelete5(codeUploadIdArg, options) {
   }
   console.log(colorSuccess(`Deleted upload ${codeUploadId}`));
 }
-async function runLink2(options) {
+async function runLink3(options) {
   const output = parseOutput(options.output);
   const applicationId = requireUuid(options.app, "--app");
   const codeUploadId = requireUuid(options.upload, "--upload");
@@ -61362,7 +62168,7 @@ function createDeleteCommand5() {
     await runDelete5(codeUploadId, options);
   });
 }
-function createLinkCommand2() {
+function createLinkCommand3() {
   return new Command("link").description("Link a ready source upload to an application").requiredOption("--app <applicationId>", "Application UUID").requiredOption("--upload <codeUploadId>", "Upload UUID (must be a ready source ZIP)").option("--path <repositoryPath>", "Path within the archive").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
@@ -61372,7 +62178,7 @@ APK and IPA builds attach to an application with \`upload build --app\`.
 Examples:
   tracecli upload link --app <applicationId> --upload <codeUploadId>`
   ).action(async (options) => {
-    await runLink2(options);
+    await runLink3(options);
   });
 }
 function createUploadCommand(runtime = {}) {
@@ -61386,7 +62192,7 @@ function createUploadCommand(runtime = {}) {
   upload.addCommand(createResumeCommand(resolved));
   upload.addCommand(createWaitCommand(resolved));
   upload.addCommand(createDeleteCommand5());
-  upload.addCommand(createLinkCommand2());
+  upload.addCommand(createLinkCommand3());
   return upload;
 }
 
@@ -61405,7 +62211,7 @@ function parseVulnerabilityFilter(expression) {
   const match = expression.match(/^([^!=]+)(!=|=)(.+)$/);
   if (!match?.[1] || !match[2] || !match[3]) {
     return {
-      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. cweId=CWE-89).`
+      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. scanMode=SAST).`
     };
   }
   const field = match[1].trim();
@@ -61646,7 +62452,7 @@ function createListCommand9() {
     }
   ).option(
     "-f, --filter <expression>",
-    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: vulnerabilityType, cweId, scanMode (and any other API-supported field).",
+    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: scanMode (SAST, SCA, SECRETS, DAST), severity, status, repositoryId.",
     (value, previous) => [...previous, value],
     []
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerabilities dashboard in a browser").option("--no-pager", "Disable the interactive arrow-key pager for table output").addHelpText(
@@ -61656,8 +62462,7 @@ Examples:
   tracecli vulnerabilities list
   tracecli vulnerabilities list --severity CRITICAL --status OPEN
   tracecli vulnerabilities list --repo securewithtrace/trace --limit 50
-  tracecli vulnerabilities list --filter cweId=CWE-89
-  tracecli vulnerabilities list --filter vulnerabilityType=SAST --filter scanMode=sast
+  tracecli vulnerabilities list --filter scanMode=SECRETS
   tracecli vulnerabilities list --output json | jq '.[].title'
   tracecli vulnerabilities list --output tsv | cut -f1,7
   tracecli vulnerabilities list --no-pager
@@ -61780,7 +62585,7 @@ program2.addCommand(createEnvironmentCommand());
 program2.addCommand(createCredentialCommand());
 program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
-program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createVulnerabilitiesCommand(), { hidden: true });
 program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());