@provartesting/provardx-cli 1.5.0-beta.1 → 1.5.0-beta.11

package/README.md

@@ -3,6 +3,7 @@
 [![Version](https://img.shields.io/npm/v/@provartesting/provardx-cli.svg)](https://npmjs.org/package/@provartesting/provardx-cli)
 [![Downloads/week](https://img.shields.io/npm/dw/@provartesting/provardx-cli.svg)](https://npmjs.org/package/@provartesting/provardx-cli)
 [![License](https://img.shields.io/npm/l/@provartesting/provardx-cli.svg)](https://github.com/ProvarTesting/provardx-cli/blob/main/LICENSE.md)
+[![Get Access](https://img.shields.io/badge/Quality%20Hub%20API-Get%20Access-blue)](https://aqqlrlhga7.execute-api.us-east-1.amazonaws.com/dev/auth/request-access)
 
 # What is the ProvarDX CLI?
 
@@ -10,10 +11,12 @@ The Provar DX CLI is a Salesforce CLI plugin for Provar customers who want to au
 
 # Installation, Update, and Uninstall
 
+**Requires Node.js 18–24 (LTS 22 recommended).** Node 25+ is not yet supported due to a breaking change in a transitive dependency. Check with `node --version`.
+
 Install the plugin
 
 ```sh-session
-$ sf plugins install @provartesting/provardx-cli
+$ sf plugins install @provartesting/provardx-cli@beta
 ```
 
 Update plugins
@@ -30,33 +33,56 @@ $ sf plugins uninstall @provartesting/provardx-cli
 
 # MCP Server (AI-Assisted Quality)
 
-The Provar DX CLI includes a built-in **Model Context Protocol (MCP) server** that connects AI assistants (Claude Desktop, Claude Code, Cursor) directly to your Provar project. Once connected, an AI agent can inspect your project structure, generate Page Objects and test cases, and validate every level of the test hierarchy with quality scores that match the Provar Quality Hub API.
+The Provar DX CLI includes a built-in **Model Context Protocol (MCP) server** that connects AI assistants (Claude Desktop, Claude Code, Cursor) directly to your Provar project. Once connected, an AI agent can inspect your project structure, generate Page Objects and test cases, validate every level of the test hierarchy with quality scores, and work with NitroX (Hybrid Model) component page objects for LWC, Screen Flow, Industry Components, Experience Cloud, and HTML5.
+
+Validation runs in two modes: **local only** (structural rules, no key required) or **Quality Hub API** (170+ rules, quality scoring — requires a `pv_k_` API key). Don't have an account? **[Request access](https://aqqlrlhga7.execute-api.us-east-1.amazonaws.com/dev/auth/request-access)**.
+
+## Quick setup
+
+**Requires:** Provar Automation IDE installed with an activated license.
 
 ```sh
-sf provar mcp start --allowed-paths /path/to/your/provar/project
+# 1. Install the plugin — @beta is required for MCP support
+sf plugins install @provartesting/provardx-cli@beta
+
+# 2. (Optional) Authenticate for full 170+ rule validation
+sf provar auth login
 ```
 
-📖 **See [docs/mcp.md](https://github.com/ProvarTesting/provardx-cli/blob/main/docs/mcp.md) for full setup and tool documentation.**
+**Claude Code** — run once to register the server:
 
-## License Validation
+```sh
+claude mcp add provar -s user -- sf provar mcp start --allowed-paths /path/to/your/provar/project
+```
 
-The MCP server verifies your Provar license before accepting any connections. Validation is automatic — no extra flags are required for standard usage.
+**Claude Desktop** — add to your config file and restart the app:
 
-**How it works:**
+- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
+- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
 
-1. **Auto-detection** — the server reads `~/Provar/.licenses/*.properties` (the same files written by Provar's IDE plugins). If a valid, activated license is found the server starts immediately.
-2. **Cache** — successful validations are cached at `~/Provar/.licenses/.mcp-license-cache.json` (2 h TTL). Subsequent starts within the TTL window skip the disk scan.
-3. **Grace fallback** — if the IDE license files cannot be found or read and the cache is stale (but ≤ 48 h old), the server starts with a warning on stderr using the cached result so CI pipelines are not broken by transient local file-access issues.
-4. **Fail closed** — if no valid license is detected the command exits with a non-zero exit code and a clear error message.
+```json
+{
+  "mcpServers": {
+    "provar": {
+      "command": "sf",
+      "args": ["provar", "mcp", "start", "--allowed-paths", "/path/to/your/provar/project"]
+    }
+  }
+}
+```
 
-**`NODE_ENV=test` fast-path:**
+> **Windows (Claude Desktop):** Use `sf.cmd` instead of `sf` if the server fails to start.
 
-When `NODE_ENV=test` the validation step is skipped entirely. This is intended only for the plugin's own unit-test suite.
+📖 **[docs/mcp.md](https://github.com/ProvarTesting/provardx-cli/blob/main/docs/mcp.md) — full setup, all 35+ tools, 7 MCP prompts, troubleshooting.**
 
 ---
 
 # Commands
 
+- [`sf provar auth login`](#sf-provar-auth-login)
+- [`sf provar auth rotate`](#sf-provar-auth-rotate)
+- [`sf provar auth status`](#sf-provar-auth-status)
+- [`sf provar auth clear`](#sf-provar-auth-clear)
 - [`sf provar mcp start`](#sf-provar-mcp-start)
 - [`sf provar config get`](#sf-provar-config-get)
 - [`sf provar config set`](#sf-provar-config-set)
@@ -84,6 +110,99 @@ When `NODE_ENV=test` the validation step is skipped entirely. This is intended o
 - [`sf provar manager test run report`](#sf-provar-manager-test-run-report) _(deprecated — use `sf provar quality-hub test run report`)_
 - [`sf provar manager test run abort`](#sf-provar-manager-test-run-abort) _(deprecated — use `sf provar quality-hub test run abort`)_
 
+## `sf provar auth login`
+
+Log in to Provar Quality Hub and store your API key.
+
+```
+USAGE
+  $ sf provar auth login [--url <value>]
+
+FLAGS
+  --url=<value>  Override the Quality Hub API base URL (for non-production environments).
+
+DESCRIPTION
+  Opens a browser to the Provar login page. After you authenticate, your API key is
+  stored at ~/.provar/credentials.json and used automatically by the Provar MCP tools
+  and CI/CD integrations. The key is valid for approximately 90 days.
+
+  For CI/CD pipelines (GitHub Actions, Jenkins, etc.) where a browser cannot open:
+  run sf provar auth login once on your local machine, copy the api_key value from
+  ~/.provar/credentials.json, and store it as the PROVAR_API_KEY environment variable
+  or secret in your pipeline. Rotate the secret every ~90 days when the key expires.
+
+  Don't have an account? Request access at:
+  https://aqqlrlhga7.execute-api.us-east-1.amazonaws.com/dev/auth/request-access
+
+EXAMPLES
+  Log in interactively:
+
+    $ sf provar auth login
+
+  Log in against a staging environment:
+
+    $ sf provar auth login --url https://dev.api.example.com
+```
+
+## `sf provar auth rotate`
+
+Rotate your stored API key without re-authenticating via browser.
+
+```
+USAGE
+  $ sf provar auth rotate
+
+DESCRIPTION
+  Exchanges your current pv_k_ key for a new one atomically. The old key is
+  invalidated immediately. The new key is written to ~/.provar/credentials.json.
+
+  Use this to rotate your key on a regular schedule (~every 90 days) without
+  going through the browser login flow. If your current key is already expired,
+  run sf provar auth login instead.
+
+EXAMPLES
+  Rotate the stored API key:
+
+    $ sf provar auth rotate
+```
+
+## `sf provar auth status`
+
+Show the current API key configuration and validate it against Quality Hub.
+
+```
+USAGE
+  $ sf provar auth status
+
+DESCRIPTION
+  Reports whether an API key is configured, where it came from (environment variable
+  or credentials file), and performs a live check against the Quality Hub API to
+  confirm the key is still valid.
+
+EXAMPLES
+  Check auth status:
+
+    $ sf provar auth status
+```
+
+## `sf provar auth clear`
+
+Remove the stored API key.
+
+```
+USAGE
+  $ sf provar auth clear
+
+DESCRIPTION
+  Deletes ~/.provar/credentials.json and revokes the key server-side. After clearing,
+  the MCP tools fall back to local validation mode. Has no effect if no key is stored.
+
+EXAMPLES
+  Remove the stored key:
+
+    $ sf provar auth clear
+```
+
 ## `sf provar mcp start`
 
 Start a local MCP server for Provar tools over stdio transport.
@@ -136,6 +255,11 @@ TOOLS EXPOSED
   provar.testplan.add-instance         — wire a test case into a plan suite by writing a .testinstance file
   provar.testplan.create-suite         — create a new test suite directory with .planitem inside a plan
   provar.testplan.remove-instance      — remove a .testinstance file from a plan suite
+  provar.nitrox.discover               — discover projects containing NitroX (Hybrid Model) page objects
+  provar.nitrox.read                   — read NitroX .po.json files and return parsed content
+  provar.nitrox.validate               — validate a NitroX .po.json against schema rules
+  provar.nitrox.generate               — generate a new NitroX .po.json from a component description
+  provar.nitrox.patch                  — apply a JSON merge-patch to an existing NitroX .po.json file
 
 EXAMPLES
   Start MCP server (accepts stdio connections from Claude Desktop / Cursor):

package/lib/commands/provar/auth/clear.d.ts

@@ -0,0 +1,7 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export default class SfProvarAuthClear extends SfCommand<void> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    run(): Promise<void>;
+}

package/lib/commands/provar/auth/clear.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { Messages } from '@provartesting/provardx-plugins-utils';
+import { clearCredentials, readStoredCredentials } from '../../../services/auth/credentials.js';
+import { qualityHubClient, getQualityHubBaseUrl } from '../../../services/qualityHub/client.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@provartesting/provardx-cli', 'sf.provar.auth.clear');
+export default class SfProvarAuthClear extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    async run() {
+        const stored = readStoredCredentials();
+        if (stored) {
+            const baseUrl = getQualityHubBaseUrl();
+            try {
+                await qualityHubClient.revokeKey(stored.api_key, baseUrl);
+            }
+            catch {
+                this.log('  Note: could not reach Quality Hub to revoke key server-side (offline?).');
+                this.log('  The local credentials have been removed — the key may still be valid until it expires.');
+            }
+        }
+        clearCredentials();
+        this.log('API key cleared.');
+        this.log('  Next validation will use local rules only (structural checks, no quality scoring).');
+        this.log('  To reconfigure: sf provar auth login');
+        this.log('  For CI/CD:      set the PROVAR_API_KEY environment variable.');
+    }
+}
+//# sourceMappingURL=clear.js.map

package/lib/commands/provar/auth/clear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear.js","sourceRoot":"","sources":["../../../../src/commands/provar/auth/clear.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEhG,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,6BAA6B,EAAE,sBAAsB,CAAC,CAAC;AAE9F,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,SAAe;IACrD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,KAAK,CAAC,GAAG;QACd,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;gBACtF,IAAI,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QAED,gBAAgB,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC7E,CAAC"}

package/lib/commands/provar/auth/login.d.ts

@@ -0,0 +1,10 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export default class SfProvarAuthLogin extends SfCommand<void> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    static readonly flags: {
+        url: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/lib/commands/provar/auth/login.js

@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import { Flags, SfCommand } from '@salesforce/sf-plugins-core';
+import { Messages } from '@provartesting/provardx-plugins-utils';
+import { writeCredentials } from '../../../services/auth/credentials.js';
+import { loginFlowClient } from '../../../services/auth/loginFlow.js';
+import { qualityHubClient, getQualityHubBaseUrl, QualityHubAuthError, REQUEST_ACCESS_URL, } from '../../../services/qualityHub/client.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@provartesting/provardx-cli', 'sf.provar.auth.login');
+// Production values bundled at auth handoff (2026-04-11).
+// Override via PROVAR_COGNITO_DOMAIN / PROVAR_COGNITO_CLIENT_ID for non-prod environments.
+const DEFAULT_COGNITO_DOMAIN = 'us-east-1xpfwzwmop.auth.us-east-1.amazoncognito.com';
+const DEFAULT_CLIENT_ID = '29cs1a784r4cervmth8ugbkkri';
+export default class SfProvarAuthLogin extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    static flags = {
+        url: Flags.string({
+            summary: messages.getMessage('flags.url.summary'),
+            required: false,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(SfProvarAuthLogin);
+        const cognitoDomain = process.env.PROVAR_COGNITO_DOMAIN ?? DEFAULT_COGNITO_DOMAIN;
+        const clientId = process.env.PROVAR_COGNITO_CLIENT_ID ?? DEFAULT_CLIENT_ID;
+        const baseUrl = flags.url ?? getQualityHubBaseUrl();
+        // ── Step 1: Generate PKCE pair, nonce, and state ───────────────────────
+        const { verifier, challenge } = loginFlowClient.generatePkce();
+        const nonce = loginFlowClient.generateNonce();
+        const state = loginFlowClient.generateState();
+        // ── Step 2: Find an available registered callback port ──────────────────
+        const port = await loginFlowClient.findAvailablePort();
+        const redirectUri = `http://localhost:${port}/callback`;
+        // ── Step 3: Build the Cognito authorize URL ────────────────────────────
+        const authorizeUrl = new URL(`https://${cognitoDomain}/oauth2/authorize`);
+        authorizeUrl.searchParams.set('response_type', 'code');
+        authorizeUrl.searchParams.set('client_id', clientId);
+        authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+        authorizeUrl.searchParams.set('code_challenge', challenge);
+        authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizeUrl.searchParams.set('scope', 'openid email aws.cognito.signin.user.admin');
+        authorizeUrl.searchParams.set('state', state);
+        authorizeUrl.searchParams.set('nonce', nonce);
+        // ── Step 4: Open browser and wait for callback ──────────────────────────
+        this.log('Opening browser for login...');
+        this.log(`  If the browser did not open, visit:\n  ${authorizeUrl.toString()}`);
+        loginFlowClient.openBrowser(authorizeUrl.toString());
+        this.log('\nWaiting for authentication... (Ctrl-C to cancel)');
+        const authCode = await loginFlowClient.listenForCallback(port, state);
+        // ── Step 5: Exchange code for Cognito tokens ────────────────────────────
+        const tokens = await loginFlowClient.exchangeCodeForTokens({
+            code: authCode,
+            redirectUri,
+            clientId,
+            verifier,
+            tokenEndpoint: `https://${cognitoDomain}/oauth2/token`,
+        });
+        // ── Step 6: Exchange Cognito access token for pv_k_ key ─────────────────
+        // Cognito tokens are held in memory only — discarded after this call.
+        let keyData;
+        try {
+            keyData = await qualityHubClient.exchangeTokenForKey(tokens.access_token, baseUrl);
+        }
+        catch (err) {
+            if (err instanceof QualityHubAuthError) {
+                this.error(`No Provar MCP account found for this login.\nRequest access at: ${REQUEST_ACCESS_URL}`, {
+                    exit: 1,
+                });
+            }
+            throw err;
+        }
+        // ── Step 7: Persist the pv_k_ key ──────────────────────────────────────
+        writeCredentials(keyData.api_key, keyData.prefix, 'cognito', {
+            username: keyData.username,
+            tier: keyData.tier,
+            expires_at: keyData.expires_at,
+        });
+        this.log(`\nAuthenticated as ${keyData.username} (${keyData.tier} tier)`);
+        this.log(`API key stored (prefix: ${keyData.prefix}). Valid until ${keyData.expires_at}.`);
+        this.log("  Run 'sf provar auth status' to check at any time.");
+    }
+}
+//# sourceMappingURL=login.js.map

package/lib/commands/provar/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../src/commands/provar/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAEhD,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,6BAA6B,EAAE,sBAAsB,CAAC,CAAC;AAE9F,0DAA0D;AAC1D,2FAA2F;AAC3F,MAAM,sBAAsB,GAAG,qDAAqD,CAAC;AACrF,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAEvD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,SAAe;IACrD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,CAAU,KAAK,GAAG;QAC7B,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACjD,QAAQ,EAAE,KAAK;SAChB,CAAC;KACH,CAAC;IAEK,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEtD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,sBAAsB,CAAC;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,iBAAiB,CAAC;QAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAEpD,0EAA0E;QAC1E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC;QAE9C,2EAA2E;QAC3E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;QAExD,0EAA0E;QAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,aAAa,mBAAmB,CAAC,CAAC;QAC1E,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,4CAA4C,CAAC,CAAC;QACrF,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE9C,2EAA2E;QAC3E,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,4CAA4C,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChF,eAAe,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAErD,IAAI,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtE,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC;YACzD,IAAI,EAAE,QAAQ;YACd,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,aAAa,EAAE,WAAW,aAAa,eAAe;SACvD,CAAC,CAAC;QAEH,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,mEAAmE,kBAAkB,EAAE,EAAE;oBAClG,IAAI,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,0EAA0E;QAC1E,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;YAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,2BAA2B,OAAO,CAAC,MAAM,kBAAkB,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;QAC3F,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAClE,CAAC"}

package/lib/commands/provar/auth/rotate.d.ts

@@ -0,0 +1,7 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export default class SfProvarAuthRotate extends SfCommand<void> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    run(): Promise<void>;
+}

package/lib/commands/provar/auth/rotate.js

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { Messages } from '@provartesting/provardx-plugins-utils';
+import { readStoredCredentials, writeCredentials } from '../../../services/auth/credentials.js';
+import { qualityHubClient, getQualityHubBaseUrl, QualityHubAuthError } from '../../../services/qualityHub/client.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@provartesting/provardx-cli', 'sf.provar.auth.rotate');
+export default class SfProvarAuthRotate extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    async run() {
+        const stored = readStoredCredentials();
+        if (!stored) {
+            this.error('No API key stored. Run `sf provar auth login` first.', { exit: 1 });
+        }
+        const baseUrl = getQualityHubBaseUrl();
+        try {
+            const keyData = await qualityHubClient.rotateKey(stored.api_key, baseUrl);
+            writeCredentials(keyData.api_key, keyData.prefix, 'cognito', {
+                username: keyData.username,
+                tier: keyData.tier,
+                expires_at: keyData.expires_at,
+            });
+            this.log(`API key rotated (new prefix: ${keyData.prefix}). Valid until ${keyData.expires_at}.`);
+            this.log("  Run 'sf provar auth status' to verify.");
+        }
+        catch (err) {
+            if (err instanceof QualityHubAuthError) {
+                this.error('Current key is invalid or expired — rotation requires a valid key.\nRun `sf provar auth login` to authenticate via browser and get a fresh key.', { exit: 1 });
+            }
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=rotate.js.map

package/lib/commands/provar/auth/rotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.js","sourceRoot":"","sources":["../../../../src/commands/provar/auth/rotate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAErH,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAAC;AAE/F,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,SAAe;IACtD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,KAAK,CAAC,GAAG;QACd,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,sDAAsD,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1E,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,gCAAgC,OAAO,CAAC,MAAM,kBAAkB,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CACR,iJAAiJ,EACjJ,EAAE,IAAI,EAAE,CAAC,EAAE,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC"}

package/lib/commands/provar/auth/status.d.ts

@@ -0,0 +1,7 @@
+import { SfCommand } from '@salesforce/sf-plugins-core';
+export default class SfProvarAuthStatus extends SfCommand<void> {
+    static readonly summary: string;
+    static readonly description: string;
+    static readonly examples: string[];
+    run(): Promise<void>;
+}

package/lib/commands/provar/auth/status.js

@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import { SfCommand } from '@salesforce/sf-plugins-core';
+import { Messages } from '@provartesting/provardx-plugins-utils';
+import { readStoredCredentials } from '../../../services/auth/credentials.js';
+import { qualityHubClient, getQualityHubBaseUrl, REQUEST_ACCESS_URL } from '../../../services/qualityHub/client.js';
+Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
+const messages = Messages.loadMessages('@provartesting/provardx-cli', 'sf.provar.auth.status');
+export default class SfProvarAuthStatus extends SfCommand {
+    static summary = messages.getMessage('summary');
+    static description = messages.getMessage('description');
+    static examples = messages.getMessages('examples');
+    async run() {
+        const envKey = process.env.PROVAR_API_KEY?.trim();
+        if (envKey) {
+            if (!envKey.startsWith('pv_k_')) {
+                this.log('Warning: PROVAR_API_KEY is set but invalid (does not start with "pv_k_").');
+                this.log(`  Value:    "${envKey.substring(0, 10)}..." — ignored for API calls.`);
+                this.log('  Fix: update PROVAR_API_KEY to a valid pv_k_ key from https://success.provartesting.com');
+                this.log('');
+                // Fall through to check stored credentials (matches resolveApiKey behaviour)
+            }
+            else {
+                this.log('API key configured');
+                this.log('  Source:   environment variable (PROVAR_API_KEY)');
+                this.log(`  Prefix:   ${envKey.substring(0, 12)}`);
+                this.log('');
+                this.log('  Validation mode: Quality Hub API');
+                return;
+            }
+        }
+        const stored = readStoredCredentials();
+        if (stored) {
+            // Best-effort live check — silent fallback to cached values if offline or unconfigured.
+            // Does not run for env var keys (CI environments may not have outbound access).
+            let liveValid;
+            try {
+                const live = await qualityHubClient.fetchKeyStatus(stored.api_key, getQualityHubBaseUrl());
+                liveValid = live.valid;
+                if (live.username)
+                    stored.username = live.username;
+                if (live.tier)
+                    stored.tier = live.tier;
+                if (live.expires_at)
+                    stored.expires_at = live.expires_at;
+            }
+            catch {
+                // Offline or API not yet configured — use locally cached values
+            }
+            if (liveValid === false) {
+                this.log('API key expired or revoked.');
+                this.log('  Source:   ~/.provar/credentials.json');
+                this.log(`  Prefix:   ${stored.prefix}`);
+                this.log('');
+                this.log('  Run: sf provar auth login  to refresh your key.');
+                return;
+            }
+            this.log('API key configured');
+            this.log('  Source:   ~/.provar/credentials.json');
+            this.log(`  Prefix:   ${stored.prefix}`);
+            this.log(`  Set at:   ${stored.set_at}`);
+            if (stored.username)
+                this.log(`  Account:  ${stored.username}`);
+            if (stored.tier)
+                this.log(`  Tier:     ${stored.tier}`);
+            if (stored.expires_at) {
+                this.log(`  Expires:  ${stored.expires_at}`);
+                const expiresMs = new Date(stored.expires_at).getTime();
+                if (Number.isFinite(expiresMs)) {
+                    const daysLeft = Math.ceil((expiresMs - Date.now()) / (1000 * 60 * 60 * 24));
+                    if (daysLeft <= 14 && daysLeft > 0) {
+                        this.log('');
+                        this.log(`  Warning: API key expires in ${daysLeft} day${daysLeft === 1 ? '' : 's'}.`);
+                        this.log("  Run 'sf provar auth rotate' now to avoid CI/CD disruption.");
+                    }
+                    else if (daysLeft <= 0) {
+                        this.log('');
+                        this.log('  Warning: API key has expired. Run: sf provar auth login');
+                    }
+                }
+                else {
+                    this.log('');
+                    this.log('  Warning: API key expiry timestamp is invalid.');
+                }
+            }
+            this.log('');
+            this.log('  Validation mode: Quality Hub API');
+            return;
+        }
+        this.log('No API key configured.');
+        this.log('');
+        this.log('To enable Quality Hub validation (170 rules):');
+        this.log('  Run: sf provar auth login');
+        this.log('');
+        this.log('For CI/CD: set the PROVAR_API_KEY environment variable.');
+        this.log('');
+        this.log(`No account? Request access at: ${REQUEST_ACCESS_URL}`);
+        this.log('');
+        this.log('Validation mode: local only (structural rules, no quality scoring)');
+    }
+}
+//# sourceMappingURL=status.js.map

package/lib/commands/provar/auth/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../../src/commands/provar/auth/status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAEpH,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAAC;AAE/F,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,SAAe;IACtD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,KAAK,CAAC,GAAG;QACd,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QAElD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;gBACtF,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,CAAC;gBACjF,IAAI,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;gBACrG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,6EAA6E;YAC/E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC/B,IAAI,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBAC9D,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,wFAAwF;YACxF,gFAAgF;YAChF,IAAI,SAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC3F,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;gBACvB,IAAI,IAAI,CAAC,QAAQ;oBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACnD,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvC,IAAI,IAAI,CAAC,UAAU;oBAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBACnD,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC7E,IAAI,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;wBACnC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,iCAAiC,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;wBACvF,IAAI,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;oBAC3E,CAAC;yBAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;wBACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACb,IAAI,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,kCAAkC,kBAAkB,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IACjF,CAAC"}