@teemops/cli 0.1.0 → 0.2.0

package/README.md

@@ -0,0 +1,113 @@
+# teemops CLI
+
+`@teemops/cli` is the command line for [teemops](https://teemops.com), Teem's cloud security
+scanner. People use it from a terminal, and agents and CI jobs use it to start scans, read
+findings and fail a build on a new critical. Every command prints JSON when its output is not a
+terminal, so you don't need to scrape anything.
+
+Requires Node.js 22 or later.
+
+```bash
+npm install -g @teemops/cli
+```
+
+Or run it without installing:
+
+```bash
+npx @teemops/cli help
+```
+
+## Sign in
+
+```bash
+teemops login
+```
+
+This signs you in with your Teem account. It prints a link and a code; open the link in any
+browser and enter the code. `teemops whoami` shows who you are signed in as and which
+organization you are acting in. `teemops logout` signs out.
+
+## Agents and CI
+
+An agent is an identity in your organization with its own role and credential, so it doesn't
+use a person's sign-in. An owner or administrator creates one:
+
+```bash
+teemops agents create --name ci --role auditor
+```
+
+The credential is shown once. Store it in your CI's secret store or your agent's environment
+as `TEEMOPS_TOKEN`, and every command uses it:
+
+```bash
+teemops findings list --fail-on high
+```
+
+Roles are `viewer` (read only), `auditor` (also runs scans and resolves or ignores findings) and
+`administrator` (also connects accounts and manages agents). Give an agent the smallest role that
+does its job. Billing and other owner-only actions need a person signed in as the owner. Credentials expire after 30, 90 or 365 days
+(`--expires-days`, default 90). To rotate one without downtime, add a second secret, switch
+over, then revoke the old one:
+
+```bash
+teemops agents add-secret --id <agent-id>
+```
+
+```bash
+teemops agents revoke-secret --id <agent-id> --secret-id <old-secret-id>
+```
+
+`teemops agents list` shows each agent and its secrets, and `teemops agents revoke --id <agent-id>`
+deletes an agent. Personal access tokens (`teemops tokens …`) work the same way for a person.
+
+## Common commands
+
+| Command | What it does |
+| --- | --- |
+| `teemops accounts list` | Connected cloud accounts |
+| `teemops accounts connect` | Start connecting an AWS account; returns a link for a person to open |
+| `teemops scan start --account <id> --wait` | Scan an account and wait for the result |
+| `teemops findings list` | Open findings, most severe first. Filter with `--severity`, `--account`, `--service`, `--region` |
+| `teemops findings get --id <id>` | One finding and how to fix it |
+| `teemops insights` | Health score, the factors behind it, and KPIs |
+| `teemops members list` | Your organization's members |
+| `teemops billing …` | Your plan |
+
+`teemops help` lists every command. `teemops help --json` returns the full command tree, with
+flags, environment variables and exit codes, for an agent to read.
+
+## Gating a build
+
+`--fail-on <severity>` exits with code 5 when any open finding is at or above that severity:
+
+```bash
+teemops scan start --account 123456789012 --wait && teemops findings list --fail-on critical
+```
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| 0 | Success |
+| 1 | Error, or a scan that did not succeed |
+| 2 | Usage error |
+| 3 | Not signed in, or the token was refused |
+| 4 | Not found |
+| 5 | `--fail-on` matched findings |
+| 6 | Conflict: no plan, over a plan limit, or a billing conflict |
+
+## Environment
+
+| Variable | Purpose |
+| --- | --- |
+| `TEEMOPS_TOKEN` | An agent credential or personal access token. Takes precedence over `teemops login` |
+| `TEEMOPS_API_URL` | API base URL. Default `https://api.teemops.com` |
+
+## MCP
+
+The same API is available to MCP clients at `https://api.teemops.com/mcp`, with
+`TEEMOPS_TOKEN` as the bearer token.
+
+## License
+
+GPL-3.0-only

package/dist/teemops.js

@@ -19739,6 +19739,8 @@ var MeResponse = external_exports.object({
     /** auth.teem.cloud subject. Null for an agent, which acts for the org, not a person. */
     userId: external_exports.string().nullable(),
     email: external_exports.email().nullable(),
+    /** The person's name, for "[First name]'s organization". Filled for a person with no active org; null when not known. Optional so a newer client still parses an older API. */
+    name: external_exports.string().nullable().optional(),
     /** Null when signed in but no active org yet (auth.teem.cloud sends no org claim). */
     org: external_exports.object({
       id: external_exports.string(),
@@ -19817,7 +19819,10 @@ var Account = external_exports.object({
   connectedAt: external_exports.iso.datetime(),
   /** When the next daily scan starts (UTC); null while paused or when the account has no slot yet. Defaults so a newer CLI parses an older API. */
   nextScanAt: external_exports.iso.datetime().nullable().default(null),
-  /** Why scheduled scans are off for this account: the org has no plan, or the plan covers only older accounts. */
+  /**
+   * Why scans are off for this account: the org has no plan (and the account's free scan is used or unavailable),
+   * or the plan covers only older accounts.
+   */
   scanPaused: external_exports.enum(["no_plan", "over_limit"]).nullable().default(null)
 });
 var AccountListResponse = external_exports.object({ data: external_exports.array(Account) });
@@ -19852,16 +19857,18 @@ var Finding = external_exports.object({
   provider: external_exports.enum(["aws"]),
   /** The cloud account's own id (12 digits for AWS). */
   accountId: external_exports.string(),
-  /** `global` for global services. */
-  region: external_exports.string(),
+  /** `global` for global services. `null` while the response is locked (X-11). */
+  region: external_exports.string().nullable(),
   service: external_exports.string(),
-  resourceType: external_exports.string(),
-  resourceId: external_exports.string(),
+  /** `null` while the response is locked (X-11). */
+  resourceType: external_exports.string().nullable(),
+  /** `null` while the response is locked (X-11). */
+  resourceId: external_exports.string().nullable(),
   firstSeenAt: external_exports.iso.datetime(),
   lastSeenAt: external_exports.iso.datetime(),
   resolvedAt: external_exports.iso.datetime().nullable(),
-  /** `skill` names the AR-1 remediation skill, once those exist. */
-  remediation: external_exports.object({ text: external_exports.string(), skill: external_exports.string().optional() }),
+  /** `skill` names the AR-1 remediation skill, once those exist. `null` while the response is locked (X-11). */
+  remediation: external_exports.object({ text: external_exports.string(), skill: external_exports.string().optional() }).nullable(),
   frameworks: external_exports.array(external_exports.string())
 });
 var FindingsQuery = external_exports.object({
@@ -19875,8 +19882,8 @@ var FindingsQuery = external_exports.object({
   /** Opaque, from the previous page's `nextCursor`; only valid with the same filters. */
   cursor: external_exports.string().min(1).optional()
 });
-var FindingListResponse = external_exports.object({ data: external_exports.array(Finding), nextCursor: external_exports.string().nullable() });
-var FindingResponse = external_exports.object({ data: Finding });
+var FindingListResponse = external_exports.object({ data: external_exports.array(Finding), nextCursor: external_exports.string().nullable(), locked: external_exports.boolean().default(false) });
+var FindingResponse = external_exports.object({ data: Finding, locked: external_exports.boolean().default(false) });
 
 // ../../packages/contracts/src/scans.ts
 var ScanStatus = external_exports.enum(["queued", "running", "succeeded", "partial", "failed"]);
@@ -19938,7 +19945,7 @@ var InsightsResponse = external_exports.object({
     score: external_exports.number().int().min(0).max(100).nullable(),
     band: HealthBand.nullable(),
     weights: HealthWeights,
-    factors: external_exports.array(Factor),
+    factors: external_exports.array(Factor).nullable(),
     kpis: external_exports.object({
       openNow: external_exports.number().int(),
       /** Open at the period start, reconstructed from firstSeenAt and resolvedAt. */
@@ -19951,22 +19958,21 @@ var InsightsResponse = external_exports.object({
       coverage: external_exports.number().int().min(0).max(100).nullable(),
       /** Days, to one decimal, for criticals resolved in the period; null when none were. */
       medianDaysToFixCritical: external_exports.number().nullable()
-    }),
-    frameworks: external_exports.array(FrameworkScore),
+    }).nullable(),
+    frameworks: external_exports.array(FrameworkScore).nullable(),
     /** 12 equal buckets across the period, oldest first. `end` is exclusive except for the last bucket. */
-    trend: external_exports.array(
-      external_exports.object({ start: external_exports.iso.datetime(), end: external_exports.iso.datetime(), raised: external_exports.number().int(), resolved: external_exports.number().int() })
-    ),
+    trend: external_exports.array(external_exports.object({ start: external_exports.iso.datetime(), end: external_exports.iso.datetime(), raised: external_exports.number().int(), resolved: external_exports.number().int() })).nullable(),
     /** Open now, ignoring the period, so it matches Findings. */
     openBy: external_exports.object({
       severity: external_exports.record(Severity, external_exports.number().int()),
-      service: external_exports.array(external_exports.object({ service: external_exports.string(), ...bySeverity })),
-      framework: external_exports.array(external_exports.object({ id: external_exports.string(), ...bySeverity }))
+      service: external_exports.array(external_exports.object({ service: external_exports.string(), ...bySeverity })).nullable(),
+      framework: external_exports.array(external_exports.object({ id: external_exports.string(), ...bySeverity })).nullable()
     }),
     period: InsightsPeriod,
     account: external_exports.string().nullable(),
     generatedAt: external_exports.iso.datetime()
-  })
+  }),
+  locked: external_exports.boolean().default(false)
 });
 var WeightsResponse = external_exports.object({ data: HealthWeights });
 
@@ -19994,6 +20000,12 @@ var Plan = external_exports.enum(["solo", "team", "business"]);
 var PlanOrNone = external_exports.enum(["none", ...Plan.options]);
 var BillingStatus = external_exports.enum(["none", "trialing", "active", "past_due", "ended"]);
 var Currency = external_exports.enum(["usd", "nzd", "aud"]);
+var BillingCountry = external_exports.enum(["nz", "au", "other"]);
+var COUNTRY_CURRENCIES = {
+  nz: ["nzd"],
+  au: ["aud", "usd"],
+  other: ["usd"]
+};
 var PlanLimits = external_exports.object({ users: external_exports.number().int(), cloudAccounts: external_exports.number().int() });
 var Entitlements = external_exports.object({
   plan: PlanOrNone,
@@ -20017,6 +20029,13 @@ var PlanOffer = external_exports.object({
     })
   )
 });
+var FreeScanStatus = external_exports.enum(["running", "succeeded", "partial", "expired"]);
+var FreeScan = external_exports.object({
+  status: FreeScanStatus,
+  finishedAt: external_exports.iso.datetime().nullable(),
+  /** `finishedAt` plus 14 days: when the free results are (or were) deleted unless a plan is chosen. Null while running. */
+  deletesAt: external_exports.iso.datetime().nullable()
+});
 var BillingResponse = external_exports.object({
   data: external_exports.object({
     entitlements: Entitlements,
@@ -20025,12 +20044,109 @@ var BillingResponse = external_exports.object({
     canManage: external_exports.boolean(),
     /** Whether Checkout would offer the $1, 30-day start. */
     introOffer: external_exports.boolean(),
-    plans: external_exports.array(PlanOffer)
+    plans: external_exports.array(PlanOffer),
+    /** Null until the org's free scan starts, and again if it failed (it can be retried). */
+    freeScan: FreeScan.nullable().default(null),
+    /** An owner of the org, for "Only [owner] can choose a plan". Null when none has a known email. Memberships store no name. */
+    owner: external_exports.object({ email: external_exports.email() }).nullable().default(null)
   })
 });
-var CheckoutRequest = external_exports.strictObject({ plan: Plan, currency: Currency });
+var CheckoutRequest = external_exports.strictObject({ plan: Plan, country: BillingCountry, currency: Currency }).refine((r) => COUNTRY_CURRENCIES[r.country].includes(r.currency), { message: "That currency is not available in that country", path: ["currency"] });
 var SessionUrlResponse = external_exports.object({ data: external_exports.object({ url: external_exports.url({ protocol: /^https$/ }) }) });
 
+// ../../packages/contracts/src/notifications.ts
+var SLACK_WEBHOOK_PATTERN = /^https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]+$/;
+var NotificationSettings = external_exports.object({
+  email: external_exports.object({ enabled: external_exports.boolean() }),
+  slack: external_exports.object({
+    configured: external_exports.boolean(),
+    last4: external_exports.string().nullable(),
+    /** Slack answered 404 or 410: the webhook is gone, and teemops has stopped posting until it is replaced. */
+    broken: external_exports.boolean()
+  })
+});
+var NotificationSettingsResponse = external_exports.object({ data: NotificationSettings });
+var UpdateNotificationsRequest = external_exports.object({
+  emailEnabled: external_exports.boolean().optional(),
+  slackWebhookUrl: external_exports.string().max(300).regex(SLACK_WEBHOOK_PATTERN).nullable().optional()
+});
+var TestNotificationRequest = external_exports.object({ channel: external_exports.enum(["email", "slack"]) });
+var TestNotificationResponse = external_exports.object({ data: external_exports.object({ sent: external_exports.literal(true) }) });
+
+// ../../packages/contracts/src/events.ts
+var MemberJoinedRole = external_exports.enum(["owner", "admin", "member"]);
+var OrgMemberJoinedV1 = external_exports.object({
+  orgId: external_exports.string().min(1),
+  orgName: external_exports.string(),
+  userId: external_exports.string().min(1),
+  email: external_exports.email(),
+  role: MemberJoinedRole,
+  /** Epoch milliseconds. */
+  at: external_exports.number().int().nonnegative()
+});
+var BillingSubscriptionChangedV1 = external_exports.object({
+  orgId: external_exports.string().min(1),
+  orgName: external_exports.string().nullable(),
+  /**
+   * IdP org owners as last seen by teemops. May omit owners who never signed in to teemops or whose email
+   * isn't filled yet, and may include recently demoted or removed owners. The paying owner is always
+   * covered by `stripeCustomerEmail`.
+   */
+  ownerEmails: external_exports.array(external_exports.email()),
+  status: BillingStatus,
+  plan: PlanOrNone,
+  trialEndsAt: external_exports.iso.datetime().nullable(),
+  currentPeriodEnd: external_exports.iso.datetime().nullable(),
+  stripeCustomerEmail: external_exports.email().nullable(),
+  /** The most recently opened Checkout session, not necessarily the one that was paid. */
+  checkoutSessionId: external_exports.string().nullable(),
+  /** Epoch milliseconds of the Stripe read this snapshot reflects; a consumer keeps the latest. */
+  asOf: external_exports.number().int().nonnegative()
+});
+
+// ../../packages/contracts/src/orgs.ts
+var Org = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  role: Role,
+  active: external_exports.boolean()
+});
+var OrgListResponse = external_exports.object({ data: external_exports.array(Org) });
+var OrgResponse = external_exports.object({ data: Org });
+var CreateOrgRequest = external_exports.object({ name: external_exports.string().trim().min(1).max(80) });
+var SetActiveOrgRequest = external_exports.object({ organizationId: external_exports.string().min(1).max(128) });
+var OnboardingState = external_exports.object({ hidden: external_exports.boolean() });
+var OnboardingResponse = external_exports.object({ data: OnboardingState });
+
+// ../../packages/contracts/src/members.ts
+var MemberRole = external_exports.enum(["viewer", "auditor", "administrator"]);
+var Member = external_exports.object({
+  userId: external_exports.string(),
+  name: external_exports.string().nullable(),
+  email: external_exports.string().nullable(),
+  role: Role,
+  joinedAt: external_exports.string().nullable(),
+  /** The caller. */
+  you: external_exports.boolean()
+});
+var Seats = external_exports.object({ used: external_exports.number().int().nonnegative(), limit: external_exports.number().int().nonnegative().nullable() });
+var MemberListResponse = external_exports.object({ data: external_exports.array(Member), seats: Seats.nullable() });
+var MemberResponse = external_exports.object({ data: Member });
+var UpdateMemberRequest = external_exports.object({ role: MemberRole });
+var Invitation = external_exports.object({
+  id: external_exports.string(),
+  email: external_exports.string(),
+  role: MemberRole,
+  invitedBy: external_exports.object({ userId: external_exports.string(), name: external_exports.string().nullable(), email: external_exports.string().nullable() }),
+  expiresAt: external_exports.string()
+});
+var InvitationListResponse = external_exports.object({ data: external_exports.array(Invitation) });
+var InvitationResponse = external_exports.object({ data: Invitation });
+var CreateInvitationRequest = external_exports.object({
+  email: external_exports.string().trim().toLowerCase().pipe(external_exports.email().max(254)),
+  role: MemberRole
+});
+
 // ../../packages/contracts/src/index.ts
 var ErrorBody = external_exports.object({
   error: external_exports.object({
@@ -20070,16 +20186,27 @@ var EXPIRY_MARGIN_MS = 6e4;
 var LOCK_POLL_MS = 250;
 var LOCK_WAIT_MS = 1e4;
 var LOCK_STALE_MS = 3e4;
-function authConfig(env) {
+var PRODUCTION_API = "https://api.teemops.com";
+var STAGING_AUDIENCE = "https://api-staging.teemops.com";
+var isProduction = (apiUrl) => {
+  try {
+    return new URL(apiUrl).origin === PRODUCTION_API;
+  } catch {
+    return false;
+  }
+};
+function authConfig(env, apiUrl = PRODUCTION_API) {
   return {
     issuer: (env.TEEMOPS_AUTH_ISSUER || "https://auth.teem.cloud/api/auth").replace(/\/$/, ""),
     clientId: env.TEEMOPS_CLIENT_ID ?? DEFAULT_CLI_CLIENT_ID,
-    audience: env.TEEMOPS_API_AUDIENCE || "https://api.teemops.com"
+    audience: env.TEEMOPS_API_AUDIENCE || (isProduction(apiUrl) ? PRODUCTION_API : STAGING_AUDIENCE)
   };
 }
 var Credentials = external_exports.object({
   issuer: external_exports.string(),
   clientId: external_exports.string(),
+  /** The API the tokens are for. Files saved before stages had their own audience are production's. */
+  audience: external_exports.string().default(PRODUCTION_API),
   accessToken: external_exports.string(),
   refreshToken: external_exports.string(),
   expiresAt: external_exports.string()
@@ -20183,7 +20310,7 @@ async function login(io, cfg) {
     });
     const token = TokenResponse.safeParse(res.body);
     if (res.ok && token.success) {
-      const creds = toCredentials(token.data, { issuer: cfg.issuer, clientId: cfg.clientId });
+      const creds = toCredentials(token.data, { issuer: cfg.issuer, clientId: cfg.clientId, audience: cfg.audience });
       await saveCredentials(io, creds);
       return { signedIn: true, expiresAt: creds.expiresAt };
     }
@@ -20220,6 +20347,13 @@ async function tokenSource(io, cfg) {
   if (fixed) return { token: async () => fixed, refresh: async () => null };
   let creds = await readCredentials(io);
   if (!creds) throw new CliError("unauthenticated", "Not signed in \u2014 run `teemops login` or set TEEMOPS_TOKEN", ExitCode.auth);
+  if (creds.audience !== cfg.audience) {
+    throw new CliError(
+      "wrong_stage",
+      `Signed in for ${creds.audience}, but this API takes tokens for ${cfg.audience} \u2014 run \`teemops login\` with the same API URL`,
+      ExitCode.auth
+    );
+  }
   let refreshed = false;
   const fresh = (c) => Date.parse(c.expiresAt) - Date.now() >= EXPIRY_MARGIN_MS;
   const refresh = () => withLock(io, async () => {
@@ -20312,14 +20446,17 @@ var billingCommands = {
       auth: true,
       flags: {
         plan: str("Plan: solo | team | business"),
-        currency: str("Currency: usd | nzd | aud (default usd)")
+        country: str("Where the organization is based: nz | au | other. Decides the currency and GST"),
+        currency: str("nz: nzd. au: aud (default) or usd. other: usd")
       },
       run: (ctx) => {
-        const parsed = CheckoutRequest.safeParse({ plan: ctx.flags.plan, currency: ctx.flags.currency ?? "usd" });
+        const country = BillingCountry.safeParse(ctx.flags.country);
+        const currency = ctx.flags.currency ?? (country.success ? COUNTRY_CURRENCIES[country.data][0] : void 0);
+        const parsed = CheckoutRequest.safeParse({ plan: ctx.flags.plan, country: ctx.flags.country, currency });
         if (!parsed.success) {
           const flag = String(parsed.error.issues[0]?.path[0]);
-          const options = flag === "plan" ? "solo | team | business" : Currency.options.join(" | ");
-          throw new CliError("usage", `Missing or invalid --${flag}: use ${options}`, ExitCode.usage);
+          const options = flag === "plan" ? "solo | team | business" : flag === "country" || !country.success ? BillingCountry.options.join(" | ") : `${COUNTRY_CURRENCIES[country.data].join(" | ")} with --country ${country.data}`;
+          throw new CliError("usage", `Missing or invalid --${flag === "currency" && !country.success ? "country" : flag}: use ${options}`, ExitCode.usage);
         }
         return session(ctx, "/v1/billing/checkout", parsed.data);
       },
@@ -20367,17 +20504,22 @@ function insightsArgs(flags) {
   throw new CliError("usage", `Missing or invalid --${String(parsed.error.issues[0]?.path[0] ?? "input")}`, ExitCode.usage);
 }
 var dash = (v, suffix = "") => v === null ? "\u2014" : `${v}${suffix}`;
-function renderInsights(d) {
+var LOCKED_HINT = "Results are locked. Choose a plan: teemops billing checkout --plan <solo|team|business> --country <nz|au|other>";
+var LOCKED = "locked";
+var nothing = (locked) => locked ? LOCKED : "\u2014";
+function renderInsights({ data: d, locked }) {
   const score = d.score === null ? "Not scored yet" : `${d.score}${d.band ? ` (${d.band.replace("_", " ")})` : ""}`;
   const k = d.kpis;
   return [
     plain(`Health score: ${score} \xB7 ${d.period} \xB7 ${d.account ? `account ${d.account}` : "all accounts"}`),
     "",
-    table(["FACTOR", "WEIGHT", "SCORE", "DETAIL"], d.factors.map((f) => [f.key, `${f.weight}%`, dash(f.score), f.detail])),
+    d.factors ? table(["FACTOR", "WEIGHT", "SCORE", "DETAIL"], d.factors.map((f) => [f.key, `${f.weight}%`, dash(f.score), f.detail])) : `Factors: ${LOCKED}`,
     "",
-    `Open now ${k.openNow} (was ${k.openAtStart}) \xB7 raised ${k.raised} \xB7 resolved ${k.resolved} \xB7 remediation ${dash(k.remediationRate, "%")}`,
-    `Coverage ${dash(k.coverage, "%")} \xB7 median days to fix a critical ${dash(k.medianDaysToFixCritical)}`,
-    ...d.frameworks.length === 0 ? [] : [
+    ...k ? [
+      `Open now ${k.openNow} (was ${k.openAtStart}) \xB7 raised ${k.raised} \xB7 resolved ${k.resolved} \xB7 remediation ${dash(k.remediationRate, "%")}`,
+      `Coverage ${dash(k.coverage, "%")} \xB7 median days to fix a critical ${dash(k.medianDaysToFixCritical)}`
+    ] : [`Key numbers: ${LOCKED}`, `Open by severity: ${[...SEVERITIES].reverse().map((s) => `${s} ${d.openBy.severity[s] ?? 0}`).join(" \xB7 ")}`],
+    ...!d.frameworks ? ["", `Frameworks: ${LOCKED}`] : !d.frameworks.length ? [] : [
       "",
       table(
         ["FRAMEWORK", "SCORE", "PASSING", "OPEN C/H/M/L"],
@@ -20388,7 +20530,8 @@ function renderInsights(d) {
           `${f.open.critical}/${f.open.high}/${f.open.medium}/${f.open.low}`
         ])
       )
-    ]
+    ],
+    ...locked ? ["", LOCKED_HINT] : []
   ].join("\n");
 }
 var SEVERITIES = Severity.options;
@@ -20537,7 +20680,7 @@ var commands = {
 account ${plain(d.accountRef)}` : d.status
       },
       remove: {
-        summary: "Disconnect a cloud account",
+        summary: "Disconnect a cloud account (its findings and scans are deleted after 7 days unless it is reconnected)",
         auth: true,
         flags: { id: str2("Account id from `accounts list`") },
         run: async ({ api, flags }) => {
@@ -20648,27 +20791,38 @@ ${showOnce(d.credential)}`
         render: (d) => [
           d.data.length === 0 ? "No findings match." : table(
             ["SEVERITY", "TITLE", "ACCOUNT", "REGION", "RESOURCE", "ID"],
-            d.data.map((f) => [upper(f.severity), f.title, f.accountId, f.region, `${f.resourceType} ${f.resourceId}`, f.id])
+            d.data.map((f) => [
+              upper(f.severity),
+              f.title,
+              f.accountId,
+              f.region ?? nothing(d.locked),
+              f.resourceId ? `${f.resourceType} ${f.resourceId}` : nothing(d.locked),
+              f.id
+            ])
           ),
-          ...d.nextCursor ? [`More: --cursor ${d.nextCursor}`] : []
+          ...d.nextCursor ? [`More: --cursor ${d.nextCursor}`] : [],
+          ...d.locked ? ["", LOCKED_HINT] : []
         ].join("\n")
       },
       get: {
         summary: "Show one finding with how to fix it",
         auth: true,
         flags: { id: str2("Finding id from `findings list`") },
+        envelope: true,
+        // `locked` is beside `data`.
         run: async ({ api, flags }) => {
           const parsed = FindingsGetArgs.safeParse({ id: flags.id });
           if (!parsed.success) throw new CliError("usage", "Missing --id", ExitCode.usage);
-          return FindingResponse.parse(await api(`/v1/findings/${encodeURIComponent(parsed.data.id)}`)).data;
+          return FindingResponse.parse(await api(`/v1/findings/${encodeURIComponent(parsed.data.id)}`));
         },
-        render: (f) => [
+        render: ({ data: f, locked }) => [
           `${upper(f.severity)} ${f.title}`,
-          `Resource: ${f.resourceType} ${f.resourceId} (${f.accountId}, ${f.region})`,
+          `Resource: ${f.resourceId ? `${f.resourceType} ${f.resourceId} (${f.accountId}, ${f.region})` : `${nothing(locked)} (${f.accountId})`}`,
           `Rule: ${f.ruleId}`,
           `Status: ${f.status}, first seen ${day(f.firstSeenAt)}`,
           "",
-          `Fix: ${f.remediation.text}`
+          `Fix: ${f.remediation ? f.remediation.text : nothing(locked)}`,
+          ...locked ? ["", LOCKED_HINT] : []
         ].map(plain).join("\n")
       }
     }
@@ -20680,13 +20834,34 @@ ${showOnce(d.credential)}`
       period: str2("Period: 30d | 90d | 365d (default 30d)"),
       account: str2("Cloud account id, the same value as `findings list --account` (default: all accounts)")
     },
+    envelope: true,
+    // `locked` is beside `data`.
     run: async ({ api, flags }) => {
       const args = insightsArgs(flags);
       const query = new URLSearchParams({ period: args.period ?? "30d", ...args.account ? { account: args.account } : {} });
-      return InsightsResponse.parse(await api(`/v1/insights?${query}`)).data;
+      return InsightsResponse.parse(await api(`/v1/insights?${query}`));
     },
     render: renderInsights
   },
+  members: {
+    summary: "List your organization's members",
+    subcommands: {
+      list: {
+        summary: "List members with their role and when they joined, and the seats used (owners and administrators)",
+        auth: true,
+        envelope: true,
+        // `seats` is beside `data`.
+        run: async ({ api }) => MemberListResponse.parse(await api("/v1/members")),
+        render: ({ data, seats }) => [
+          table(
+            ["NAME", "EMAIL", "ROLE", "JOINED"],
+            data.map((m) => [`${m.name ?? "\u2014"}${m.you ? " (you)" : ""}`, m.email ?? "\u2014", m.role, m.joinedAt ? day(m.joinedAt) : "\u2014"])
+          ),
+          ...seats ? ["", seats.limit === null ? `${seats.used} users` : `${seats.used} of ${seats.limit} users`] : []
+        ].join("\n")
+      }
+    }
+  },
   scan: {
     summary: "Scan a connected cloud account and wait for the result",
     subcommands: {
@@ -20793,10 +20968,10 @@ function describe3() {
       TEEMOPS_API_URL: "API base URL, default https://api.teemops.com",
       TEEMOPS_AUTH_ISSUER: "Sign-in issuer, default https://auth.teem.cloud/api/auth",
       TEEMOPS_CLIENT_ID: "Client ID of the teemops CLI at the issuer",
-      TEEMOPS_API_AUDIENCE: "Audience (resource) of tokens, default https://api.teemops.com"
+      TEEMOPS_API_AUDIENCE: "Audience (resource) of tokens. Default: https://api.teemops.com for the production API, https://api-staging.teemops.com for any other API URL"
     },
     exitCodes: ExitCode,
-    exitCodeNotes: { conflict: "409 conflict (billing commands)" },
+    exitCodeNotes: { conflict: "409 conflict: no plan, over a plan limit, or a billing conflict" },
     flags: globalFlags,
     commands: Object.fromEntries(
       Object.entries(commands).map(([k, c]) => [
@@ -20848,9 +21023,9 @@ async function main(io) {
         throw new CliError("usage", `--${k} is not valid for "${positionals.slice(0, isGroup(entry) ? 2 : 1).join(" ")}"`, ExitCode.usage);
       }
     }
-    const cfg = authConfig(io.env);
-    const tokens = command.auth ? await tokenSource(io, cfg) : null;
     const baseUrl = String(values["api-url"] || io.env.TEEMOPS_API_URL || "https://api.teemops.com").replace(/\/$/, "");
+    const cfg = authConfig(io.env, baseUrl);
+    const tokens = command.auth ? await tokenSource(io, cfg) : null;
     const api = async (path, init = {}) => {
       const send = async (token) => {
         const headers = {};
@@ -20879,7 +21054,7 @@ async function main(io) {
       const err = ErrorBody.safeParse(parsed);
       const message = err.success ? err.data.error.message : `HTTP ${res.status}`;
       const code = err.success ? err.data.error.code : "http_error";
-      const exit = res.status === 401 || res.status === 403 ? ExitCode.auth : res.status === 404 ? ExitCode.notFound : ExitCode.error;
+      const exit = res.status === 401 || res.status === 403 ? ExitCode.auth : res.status === 404 ? ExitCode.notFound : res.status === 409 ? ExitCode.conflict : ExitCode.error;
       throw new CliError(code, message, exit, res.status);
     };
     const result = await command.run({ api, flags, io, cfg });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teemops/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Agent-first CLI for teemops: cloud security scanning, findings and insights",
   "license": "GPL-3.0-only",
   "repository": {