@pensar/apex 1.8.0 → 2.0.0-canary.241920ad

package/build/apps-hse35c2d.js

@@ -0,0 +1,443 @@
+#!/usr/bin/env bun
+import {
+  createApp,
+  createEndpoint,
+  deleteApp,
+  deleteEndpoint,
+  getApp,
+  getEndpoint,
+  listApps,
+  listEndpoints,
+  searchApps,
+  searchEndpoints,
+  updateApp,
+  updateEndpoint
+} from "./cli-6gge86w5.js";
+import"./cli-cbw2rmv7.js";
+import"./cli-4ez6yssj.js";
+import"./cli-0svsmc2c.js";
+import"./cli-r0s5br0a.js";
+import"./cli-demg7sj2.js";
+import"./cli-ft17f9nh.js";
+import"./cli-9fsre5pt.js";
+import"./cli-zyk3xsth.js";
+import"./cli-gtepvg8s.js";
+import"./cli-4dpc999m.js";
+import"./cli-fw5r7pfj.js";
+import"./cli-c8131c4q.js";
+import"./cli-5h1kv0v4.js";
+import"./cli-78s9w64j.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-rtbry75t.js";
+import"./cli-23xtyah8.js";
+import"./cli-k1vsv3qh.js";
+import"./cli-8rxa073f.js";
+
+// src/cli/apps.ts
+var APPLICATION_TYPES = [
+  "ui",
+  "api-service",
+  "web-application",
+  "full-stack",
+  "domain",
+  "subdomain",
+  "database",
+  "cloud-resource",
+  "storage"
+];
+var ENDPOINT_TYPES = [
+  "api-endpoint",
+  "web-endpoint",
+  "auth-endpoint",
+  "database",
+  "file-storage",
+  "asset"
+];
+function getFlag(flag, argv) {
+  const idx = argv.indexOf(flag);
+  return idx !== -1 && idx + 1 < argv.length ? argv[idx + 1] : undefined;
+}
+function getAllFlags(flag, argv) {
+  const values = [];
+  for (let i = 0;i < argv.length; i++) {
+    const next = argv[i + 1];
+    if (argv[i] === flag && next !== undefined) {
+      values.push(next);
+    }
+  }
+  return values;
+}
+function hasFlag(flag, argv) {
+  return argv.includes(flag);
+}
+function parseAppType(value) {
+  if (value === undefined)
+    return;
+  if (!APPLICATION_TYPES.includes(value)) {
+    throw new Error(`Invalid --type "${value}". Must be one of: ${APPLICATION_TYPES.join(", ")}`);
+  }
+  return value;
+}
+function parseEndpointType(value) {
+  if (value === undefined)
+    return;
+  if (!ENDPOINT_TYPES.includes(value)) {
+    throw new Error(`Invalid --type "${value}". Must be one of: ${ENDPOINT_TYPES.join(", ")}`);
+  }
+  return value;
+}
+function parseInteger(flag, value) {
+  if (value === undefined)
+    return;
+  const n = Number(value);
+  if (!Number.isFinite(n) || !Number.isInteger(n)) {
+    throw new Error(`${flag} must be an integer (got "${value}")`);
+  }
+  return n;
+}
+function parseNumber(flag, value) {
+  if (value === undefined)
+    return;
+  const n = Number(value);
+  if (!Number.isFinite(n)) {
+    throw new Error(`${flag} must be a number (got "${value}")`);
+  }
+  return n;
+}
+function showHelp() {
+  console.log(`pensar apps — Manage the workspace attack surface (apps & endpoints)
+
+All commands operate on the selected workspace (set via \`pensar login\`).
+
+Usage:
+  pensar apps                                              List apps in the workspace
+  pensar apps get <appId>                                  Show app details
+  pensar apps create [options]                             Create an app
+  pensar apps update <appId> [options]                     Update an app
+  pensar apps delete <appId>                               Delete an app
+  pensar apps endpoints <appId> [filters]                  List endpoints
+  pensar apps endpoint <endpointId>                        Show endpoint details
+  pensar apps endpoint-create <appId> [options]            Create an endpoint
+  pensar apps endpoint-update <endpointId> [options]       Update an endpoint
+  pensar apps endpoint-delete <endpointId>                 Delete an endpoint
+  pensar apps search <query> [options]                     Substring-search apps
+  pensar apps search-endpoints <query> [options]           Substring-search endpoints
+
+App fields (create requires --name and --description):
+  --name <text>                Application name
+  --description <text>         Application description
+  --type <type>                One of: ${APPLICATION_TYPES.join(", ")}
+  --framework <text>           Framework / runtime hint
+  --domain <id>                Linked domain UUID
+  --disallowed-actions <text>  Free-form disallowed actions notes
+
+List pagination (for "apps" and "endpoints <appId>"):
+  --limit <n>                  Page size (default 100, max 200)
+  --offset <n>                 Page offset (default 0)
+  Responses include { ..., hasMore, limit, offset }; iterate by
+  incrementing --offset by --limit until hasMore is false.
+
+Endpoint filters (for "endpoints"):
+  --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
+  --min-risk <score>           Minimum risk score (0–10)
+
+Search options (scoped to the workspace):
+  --app <id>                   search-endpoints only: scope to a single app
+  --type <type>                Filter by application or endpoint type
+  --min-risk <score>           Endpoint search only: minimum risk score
+  --auth-required              Endpoint search only: only auth-required endpoints
+  --no-auth-required           Endpoint search only: only public endpoints
+  --limit <n>                  Page size (default 50, max 200)
+  --offset <n>                 Page offset
+
+Endpoint fields (create requires --endpoint and --description):
+  --endpoint <text>            Endpoint path / URL / route
+  --description <text>         Endpoint description
+  --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
+  --location <text>            Source file (whitebox)
+  --start-line <n>             Start line number
+  --end-line <n>               End line number
+  --objective <text>           Repeatable: testing objective for the endpoint
+  --auth-required              Mark endpoint as authentication-required
+  --no-auth-required           Mark endpoint as not requiring auth
+  --auth-details <text>        Free-form auth details
+  --business-logic <text>      Business-logic notes
+  --threat-model <text>        Per-endpoint threat model notes
+
+Options:
+  -h, --help                   Show this help message`);
+}
+function parseAppCreateOptions(argv) {
+  const name = getFlag("--name", argv);
+  const description = getFlag("--description", argv);
+  if (!name)
+    throw new Error("--name is required");
+  if (description === undefined)
+    throw new Error("--description is required");
+  const type = parseAppType(getFlag("--type", argv));
+  const framework = getFlag("--framework", argv);
+  const domainId = getFlag("--domain", argv);
+  const disallowedActions = getFlag("--disallowed-actions", argv);
+  return {
+    name,
+    description,
+    ...type !== undefined ? { type } : {},
+    ...framework !== undefined ? { framework } : {},
+    ...domainId !== undefined ? { domainId } : {},
+    ...disallowedActions !== undefined ? { disallowedActions } : {}
+  };
+}
+function parseAppUpdateOptions(argv) {
+  const update = {};
+  const name = getFlag("--name", argv);
+  if (name !== undefined)
+    update.name = name;
+  const description = getFlag("--description", argv);
+  if (description !== undefined)
+    update.description = description;
+  const type = parseAppType(getFlag("--type", argv));
+  if (type !== undefined)
+    update.type = type;
+  const framework = getFlag("--framework", argv);
+  if (framework !== undefined)
+    update.framework = framework;
+  const domain = getFlag("--domain", argv);
+  if (domain !== undefined)
+    update.domainId = domain;
+  const disallowed = getFlag("--disallowed-actions", argv);
+  if (disallowed !== undefined)
+    update.disallowedActions = disallowed;
+  return update;
+}
+function parseAuthenticationRequiredFlag(argv) {
+  const yes = hasFlag("--auth-required", argv);
+  const no = hasFlag("--no-auth-required", argv);
+  const details = getFlag("--auth-details", argv);
+  if (!yes && !no && details === undefined)
+    return;
+  if (yes && no) {
+    throw new Error("--auth-required and --no-auth-required are mutually exclusive");
+  }
+  return {
+    required: yes,
+    ...details !== undefined ? { details } : {}
+  };
+}
+function parseEndpointCreateOptions(argv) {
+  const endpoint = getFlag("--endpoint", argv);
+  const description = getFlag("--description", argv);
+  if (!endpoint)
+    throw new Error("--endpoint is required");
+  if (description === undefined)
+    throw new Error("--description is required");
+  const type = parseEndpointType(getFlag("--type", argv));
+  const location = getFlag("--location", argv);
+  const startLineNumber = parseInteger("--start-line", getFlag("--start-line", argv));
+  const endLineNumber = parseInteger("--end-line", getFlag("--end-line", argv));
+  const objectives = getAllFlags("--objective", argv);
+  const authenticationRequired = parseAuthenticationRequiredFlag(argv);
+  const businessLogic = getFlag("--business-logic", argv);
+  const threatModel = getFlag("--threat-model", argv);
+  return {
+    endpoint,
+    description,
+    ...type !== undefined ? { type } : {},
+    ...location !== undefined ? { location } : {},
+    ...startLineNumber !== undefined ? { startLineNumber } : {},
+    ...endLineNumber !== undefined ? { endLineNumber } : {},
+    ...objectives.length > 0 ? { objectives } : {},
+    ...authenticationRequired !== undefined ? { authenticationRequired } : {},
+    ...businessLogic !== undefined ? { businessLogic } : {},
+    ...threatModel !== undefined ? { threatModel } : {}
+  };
+}
+function parseEndpointUpdateOptions(argv) {
+  const update = {};
+  const endpoint = getFlag("--endpoint", argv);
+  if (endpoint !== undefined)
+    update.endpoint = endpoint;
+  const description = getFlag("--description", argv);
+  if (description !== undefined)
+    update.description = description;
+  const type = parseEndpointType(getFlag("--type", argv));
+  if (type !== undefined)
+    update.type = type;
+  const location = getFlag("--location", argv);
+  if (location !== undefined)
+    update.location = location;
+  const startLine = parseInteger("--start-line", getFlag("--start-line", argv));
+  if (startLine !== undefined)
+    update.startLineNumber = startLine;
+  const endLine = parseInteger("--end-line", getFlag("--end-line", argv));
+  if (endLine !== undefined)
+    update.endLineNumber = endLine;
+  const objectives = getAllFlags("--objective", argv);
+  if (objectives.length > 0)
+    update.objectives = objectives;
+  const auth = parseAuthenticationRequiredFlag(argv);
+  if (auth !== undefined)
+    update.authenticationRequired = auth;
+  const businessLogic = getFlag("--business-logic", argv);
+  if (businessLogic !== undefined)
+    update.businessLogic = businessLogic;
+  const threatModel = getFlag("--threat-model", argv);
+  if (threatModel !== undefined)
+    update.threatModel = threatModel;
+  return update;
+}
+async function main() {
+  const args = process.argv.slice(2);
+  const sub = args[0];
+  if (sub === "--help" || sub === "-h" || sub === "help") {
+    showHelp();
+    return;
+  }
+  try {
+    if (sub === "get") {
+      const appId = args[1];
+      if (!appId) {
+        console.error("Error: app ID is required");
+        console.error("Usage: pensar apps get <appId>");
+        process.exit(1);
+      }
+      const app = await getApp(appId);
+      console.log(JSON.stringify(app, null, 2));
+    } else if (sub === "create") {
+      const opts = parseAppCreateOptions(args);
+      const result = await createApp(opts);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "update") {
+      const appId = args[1];
+      if (!appId) {
+        console.error("Error: app ID is required");
+        console.error("Usage: pensar apps update <appId> [options]");
+        process.exit(1);
+      }
+      const opts = parseAppUpdateOptions(args);
+      const result = await updateApp(appId, opts);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "delete") {
+      const appId = args[1];
+      if (!appId) {
+        console.error("Error: app ID is required");
+        console.error("Usage: pensar apps delete <appId>");
+        process.exit(1);
+      }
+      const result = await deleteApp(appId);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "endpoints") {
+      const appId = args[1];
+      if (!appId) {
+        console.error("Error: app ID is required");
+        console.error("Usage: pensar apps endpoints <appId> [filters]");
+        process.exit(1);
+      }
+      const type = parseEndpointType(getFlag("--type", args));
+      const minRiskScore = parseNumber("--min-risk", getFlag("--min-risk", args));
+      const limit = parseInteger("--limit", getFlag("--limit", args));
+      const offset = parseInteger("--offset", getFlag("--offset", args));
+      const filters = {
+        ...type !== undefined ? { type } : {},
+        ...minRiskScore !== undefined ? { minRiskScore } : {},
+        ...limit !== undefined ? { limit } : {},
+        ...offset !== undefined ? { offset } : {}
+      };
+      const result = await listEndpoints(appId, filters);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "endpoint") {
+      const endpointId = args[1];
+      if (!endpointId) {
+        console.error("Error: endpoint ID is required");
+        console.error("Usage: pensar apps endpoint <endpointId>");
+        process.exit(1);
+      }
+      const result = await getEndpoint(endpointId);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "endpoint-create") {
+      const appId = args[1];
+      if (!appId) {
+        console.error("Error: app ID is required");
+        console.error("Usage: pensar apps endpoint-create <appId> --endpoint E --description D");
+        process.exit(1);
+      }
+      const opts = parseEndpointCreateOptions(args);
+      const result = await createEndpoint(appId, opts);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "endpoint-update") {
+      const endpointId = args[1];
+      if (!endpointId) {
+        console.error("Error: endpoint ID is required");
+        console.error("Usage: pensar apps endpoint-update <endpointId> [options]");
+        process.exit(1);
+      }
+      const opts = parseEndpointUpdateOptions(args);
+      const result = await updateEndpoint(endpointId, opts);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "endpoint-delete") {
+      const endpointId = args[1];
+      if (!endpointId) {
+        console.error("Error: endpoint ID is required");
+        console.error("Usage: pensar apps endpoint-delete <endpointId>");
+        process.exit(1);
+      }
+      const result = await deleteEndpoint(endpointId);
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "search") {
+      const query = args[1];
+      if (!query || query.startsWith("--")) {
+        console.error("Error: search query is required");
+        console.error("Usage: pensar apps search <query> [options]");
+        process.exit(1);
+      }
+      const type = parseAppType(getFlag("--type", args));
+      const limit = parseInteger("--limit", getFlag("--limit", args));
+      const offset = parseInteger("--offset", getFlag("--offset", args));
+      const result = await searchApps(query, {
+        ...type !== undefined ? { type } : {},
+        ...limit !== undefined ? { limit } : {},
+        ...offset !== undefined ? { offset } : {}
+      });
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "search-endpoints") {
+      const query = args[1];
+      if (!query || query.startsWith("--")) {
+        console.error("Error: search query is required");
+        console.error("Usage: pensar apps search-endpoints <query> [options]");
+        process.exit(1);
+      }
+      const applicationId = getFlag("--app", args);
+      const type = parseEndpointType(getFlag("--type", args));
+      const minRiskScore = parseNumber("--min-risk", getFlag("--min-risk", args));
+      const authRequired = hasFlag("--auth-required", args) ? true : hasFlag("--no-auth-required", args) ? false : undefined;
+      const limit = parseInteger("--limit", getFlag("--limit", args));
+      const offset = parseInteger("--offset", getFlag("--offset", args));
+      const result = await searchEndpoints(query, {
+        ...applicationId !== undefined ? { applicationId } : {},
+        ...type !== undefined ? { type } : {},
+        ...minRiskScore !== undefined ? { minRiskScore } : {},
+        ...authRequired !== undefined ? { authRequired } : {},
+        ...limit !== undefined ? { limit } : {},
+        ...offset !== undefined ? { offset } : {}
+      });
+      console.log(JSON.stringify(result, null, 2));
+    } else if (!sub || sub === "list" || sub.startsWith("--")) {
+      const limit = parseInteger("--limit", getFlag("--limit", args));
+      const offset = parseInteger("--offset", getFlag("--offset", args));
+      const result = await listApps({
+        ...limit !== undefined ? { limit } : {},
+        ...offset !== undefined ? { offset } : {}
+      });
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.error(`Error: Unknown subcommand "${sub}"`);
+      showHelp();
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(`
+Error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}
+main();

package/build/{auth-dxjgy41e.js → auth-15rkvgam.js}

@@ -1,30 +1,50 @@
 #!/usr/bin/env bun
+import"./cli-6gge86w5.js";
+import"./cli-cbw2rmv7.js";
+import"./cli-4ez6yssj.js";
+import"./cli-0svsmc2c.js";
+import"./cli-r0s5br0a.js";
+import"./cli-demg7sj2.js";
+import"./cli-ft17f9nh.js";
+import"./cli-9fsre5pt.js";
+import"./cli-zyk3xsth.js";
+import"./cli-gtepvg8s.js";
+import"./cli-4dpc999m.js";
+import"./cli-fw5r7pfj.js";
+import"./cli-c8131c4q.js";
+import"./cli-5h1kv0v4.js";
 import {
   disconnect,
   fetchWorkspaces,
+  getPensarApiUrl,
+  getPensarConsoleUrl,
+  init_auth,
   isConnected,
   pollForWorkspaceCreation,
   pollLegacyToken,
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-dqt80sw3.js";
+} from "./cli-78s9w64j.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
 import {
   config,
-  getPensarApiUrl,
-  getPensarConsoleUrl
-} from "./cli-asyas1xb.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
+  init_config
+} from "./cli-rtbry75t.js";
+import"./cli-23xtyah8.js";
+import"./cli-k1vsv3qh.js";
 import {
   __require
 } from "./cli-8rxa073f.js";
 
 // src/cli/auth.ts
-import * as readline from "readline";
+import * as readline from "node:readline";
+init_auth();
+init_config();
 function openUrl(url) {
   try {
-    const { spawn } = __require("child_process");
+    const { spawn } = __require("node:child_process");
     const platform = process.platform;
     let cmd;
     if (platform === "darwin") {
@@ -59,11 +79,16 @@ Select a workspace:
   const answer = await prompt(`
 Enter number (1-${workspaces.length}): `);
   const index = parseInt(answer, 10) - 1;
-  if (isNaN(index) || index < 0 || index >= workspaces.length) {
+  if (Number.isNaN(index) || index < 0 || index >= workspaces.length) {
     console.error("Invalid selection.");
     process.exit(1);
   }
-  return workspaces[index];
+  const workspace = workspaces[index];
+  if (!workspace) {
+    console.error("Invalid selection.");
+    process.exit(1);
+  }
+  return workspace;
 }
 async function login() {
   const appConfig = await config.get();
@@ -121,10 +146,15 @@ Waiting for browser authorization...`);
       apiUrl,
       deviceCode: deviceInfo.deviceCode,
       interval: deviceInfo.interval,
-      expiresIn: deviceInfo.expiresIn
+      expiresIn: deviceInfo.expiresIn,
+      clientId: flowInfo.clientId
     });
+    const apiKey = data.apiKey;
+    if (!apiKey) {
+      throw new Error("Pensar Console did not return an API key");
+    }
     await config.update({
-      pensarAPIKey: data.apiKey,
+      pensarAPIKey: apiKey,
       gatewaySigningKey: data.signingKey ?? null
     });
     if (data.workspace) {
@@ -158,7 +188,11 @@ If the browser didn't open, visit: ${consoleUrl}/create-workspace?redirect=/cred
   }
   let workspace;
   if (workspaces.length === 1) {
-    workspace = workspaces[0];
+    const onlyWorkspace = workspaces[0];
+    if (!onlyWorkspace) {
+      throw new Error("No workspace available after workspace lookup");
+    }
+    workspace = onlyWorkspace;
   } else {
     workspace = await promptWorkspaceSelection(workspaces);
   }

package/build/authentication-b8p1afqq.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-r0s5br0a.js";
+import"./cli-9fsre5pt.js";
+import"./cli-zyk3xsth.js";
+import"./cli-gtepvg8s.js";
+import"./cli-4dpc999m.js";
+import"./cli-c8131c4q.js";
+import"./cli-5h1kv0v4.js";
+import"./cli-78s9w64j.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-rtbry75t.js";
+import"./cli-23xtyah8.js";
+import"./cli-k1vsv3qh.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-z1h2cgyg.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-4ez6yssj.js";
+import"./cli-9fsre5pt.js";
+import"./cli-zyk3xsth.js";
+import"./cli-gtepvg8s.js";
+import"./cli-4dpc999m.js";
+import"./cli-c8131c4q.js";
+import"./cli-5h1kv0v4.js";
+import"./cli-78s9w64j.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-rtbry75t.js";
+import"./cli-23xtyah8.js";
+import"./cli-k1vsv3qh.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-8ps4yvbk.js → blackboxPentest-vmtnnp5d.js}

@@ -1,24 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-vkwch0bc.js";
-import"./cli-wr7g9qcr.js";
-import"./cli-y61d9433.js";
-import"./cli-0fy9j5dw.js";
-import"./cli-k4hrygff.js";
+} from "./cli-cbw2rmv7.js";
+import"./cli-4ez6yssj.js";
+import"./cli-0svsmc2c.js";
+import"./cli-demg7sj2.js";
+import"./cli-ft17f9nh.js";
+import"./cli-9fsre5pt.js";
+import"./cli-zyk3xsth.js";
+import"./cli-gtepvg8s.js";
+import"./cli-4dpc999m.js";
 import"./cli-fw5r7pfj.js";
-import"./cli-jg7r7y5n.js";
-import"./cli-3w2syxpv.js";
-import"./cli-tp1tqn3k.js";
-import"./cli-g8t710ew.js";
-import"./cli-3y0dgy56.js";
-import"./cli-k0tckznm.js";
-import"./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
+import"./cli-c8131c4q.js";
+import"./cli-5h1kv0v4.js";
+import"./cli-78s9w64j.js";
+import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
-import"./cli-03z6pswp.js";
+import"./cli-rtbry75t.js";
+import"./cli-23xtyah8.js";
+import"./cli-k1vsv3qh.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts