securewithtrace 0.19.0 → 0.20.0

package/dist/index.js

@@ -25624,267 +25624,6 @@ function removeToken() {
   return removed;
 }
 
-// src/api-client.ts
-var readTokenSafe = readToken;
-var PRODUCTION_API_URL = "https://api.securewithtrace.com";
-var UNAUTHORIZED_STATUS = 401;
-function getApiBaseUrl() {
-  const raw = process.env["TRACE_API_URL"];
-  if (!raw) {
-    return PRODUCTION_API_URL;
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    console.error(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`);
-    return PRODUCTION_API_URL;
-  }
-  if (parsed.protocol !== "https:") {
-    console.error("Invalid TRACE_API_URL: only https:// is allowed. Using default.");
-    return PRODUCTION_API_URL;
-  }
-  const hostname3 = parsed.hostname;
-  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
-    console.error(
-      "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
-    );
-    return PRODUCTION_API_URL;
-  }
-  return raw.replace(/\/+$/, "");
-}
-function createClient(token) {
-  return initClient(v1Contract, {
-    baseUrl: getApiBaseUrl(),
-    baseHeaders: {
-      Authorization: `Bearer ${token}`
-    }
-  });
-}
-function getWorkosClientId() {
-  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
-  if (!clientId || clientId.trim().length === 0) {
-    return null;
-  }
-  return clientId;
-}
-async function refreshStoredAccessToken() {
-  const clientId = getWorkosClientId();
-  const refreshToken = readRefreshToken();
-  if (!clientId || !refreshToken) {
-    return null;
-  }
-  try {
-    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
-    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
-    writeTokens(tokenResponse.access_token, nextRefreshToken);
-    return tokenResponse.access_token;
-  } catch (error48) {
-    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
-      removeToken();
-    }
-    return null;
-  }
-}
-async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
-  const clientId = getWorkosClientId();
-  const refreshToken = readRefreshToken();
-  if (!clientId || !refreshToken) {
-    return false;
-  }
-  try {
-    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
-    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
-    writeTokens(tokenResponse.access_token, nextRefreshToken);
-    return true;
-  } catch (error48) {
-    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
-      removeToken();
-    }
-    return false;
-  }
-}
-async function authenticatedRequest(request) {
-  const token = readToken();
-  if (!token) {
-    console.error("Not logged in. Run `tracecli auth login` first.");
-    process.exit(1);
-  }
-  const firstResult = await request(createClient(token));
-  if (firstResult.status !== UNAUTHORIZED_STATUS) {
-    return firstResult;
-  }
-  const refreshedToken = await refreshStoredAccessToken();
-  if (!refreshedToken) {
-    return firstResult;
-  }
-  return request(createClient(refreshedToken));
-}
-async function authenticatedRequestSafe(request) {
-  const token = readTokenSafe();
-  if (!token) {
-    return null;
-  }
-  try {
-    const firstResult = await request(createClient(token));
-    if (firstResult.status !== UNAUTHORIZED_STATUS) {
-      return firstResult;
-    }
-    const refreshedToken = await refreshStoredAccessToken();
-    if (!refreshedToken) {
-      return firstResult;
-    }
-    return await request(createClient(refreshedToken));
-  } catch {
-    return null;
-  }
-}
-function extractOrganizationIdFromToken(token) {
-  if (!token || token.trim().length === 0) {
-    return null;
-  }
-  const parts = token.split(".");
-  const payload = parts[1];
-  if (!payload) {
-    return null;
-  }
-  try {
-    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
-    return typeof decoded.org_id === "string" && decoded.org_id.trim().length > 0 ? decoded.org_id : null;
-  } catch {
-    return null;
-  }
-}
-var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
-function determineActiveOrganization(organizations, selectedOrganizationId, tokenOrganizationId) {
-  if (organizations.length === 0) {
-    return null;
-  }
-  if (selectedOrganizationId && SAFE_ID_PATTERN.test(selectedOrganizationId)) {
-    const selectedOrganization = organizations.find(
-      (organization) => organization.organizationId === selectedOrganizationId
-    );
-    if (selectedOrganization) {
-      return {
-        organization: selectedOrganization,
-        source: "selected",
-        staleSelectionDetected: false
-      };
-    }
-  }
-  if (tokenOrganizationId && SAFE_ID_PATTERN.test(tokenOrganizationId)) {
-    const tokenOrganization = organizations.find(
-      (organization) => organization.organizationId === tokenOrganizationId
-    );
-    if (tokenOrganization) {
-      return {
-        organization: tokenOrganization,
-        source: "default",
-        staleSelectionDetected: selectedOrganizationId != null
-      };
-    }
-  }
-  const [fallbackOrganization] = organizations;
-  if (!fallbackOrganization) {
-    return null;
-  }
-  return {
-    organization: fallbackOrganization,
-    source: "default",
-    staleSelectionDetected: selectedOrganizationId != null
-  };
-}
-async function resolveOrganizationId(client) {
-  const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequest(
-    (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
-  );
-  if (result.status !== 200) {
-    console.error(`Failed to resolve organization (status ${result.status}).`);
-    process.exit(1);
-  }
-  const organizations = result.body;
-  const selectedOrganizationId = readSelectedOrganizationId();
-  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
-  const activeOrganization = determineActiveOrganization(
-    organizations,
-    selectedOrganizationId,
-    tokenOrganizationId
-  );
-  if (!activeOrganization) {
-    console.error("No organization found for your account.");
-    process.exit(1);
-  }
-  const id = activeOrganization.organization.organizationId;
-  if (!SAFE_ID_PATTERN.test(id)) {
-    console.error("Invalid organization ID received from API.");
-    process.exit(1);
-  }
-  if (activeOrganization.staleSelectionDetected) {
-    removeSelectedOrganizationId();
-    writeSelectedOrganizationId(id);
-    if (selectedOrganizationId) {
-      console.warn(
-        `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
-      );
-    }
-  } else if (activeOrganization.source === "default") {
-    writeSelectedOrganizationId(id);
-  }
-  return id;
-}
-async function resolveOrganizationIdSafe(client) {
-  try {
-    const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequestSafe(
-      (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
-    );
-    if (!result) {
-      return null;
-    }
-    if (result.status !== 200) {
-      return null;
-    }
-    const organizations = result.body;
-    const selectedOrganizationId = readSelectedOrganizationId();
-    const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
-    const activeOrganization = determineActiveOrganization(
-      organizations,
-      selectedOrganizationId,
-      tokenOrganizationId
-    );
-    if (!activeOrganization) {
-      return null;
-    }
-    const id = activeOrganization.organization.organizationId;
-    if (!SAFE_ID_PATTERN.test(id)) {
-      return null;
-    }
-    if (activeOrganization.staleSelectionDetected) {
-      removeSelectedOrganizationId();
-      writeSelectedOrganizationId(id);
-    } else if (activeOrganization.source === "default") {
-      writeSelectedOrganizationId(id);
-    }
-    return id;
-  } catch {
-    return null;
-  }
-}
-
-// src/format.ts
-var SEVERITY_ORDER = {
-  CRITICAL: 0,
-  HIGH: 1,
-  MEDIUM: 2,
-  LOW: 3,
-  INFORMATIONAL: 4
-};
-function formatStatus(status) {
-  return status.toLowerCase().replace("_", " ");
-}
-function tsvSafe(value) {
-  return (value ?? "").replace(/[\t\r\n]/g, " ");
-}
-
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
 var wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
@@ -26409,6 +26148,9 @@ function colorSuccess(text, colorizer = source_default) {
 function colorError(text, colorizer = source_default) {
   return colorizer.red(text);
 }
+function colorWarningPrefix(text, colorizer = source_default) {
+  return `${colorizer.yellow.bold("Warning:")} ${text}`;
+}
 function colorWarning(text, colorizer = source_default) {
   return colorizer.yellow(text);
 }
@@ -26419,6 +26161,273 @@ function colorAccentUnderline(text, colorizer = source_default) {
   return colorizer.underline.cyan(text);
 }
 
+// src/api-client.ts
+var readTokenSafe = readToken;
+var PRODUCTION_API_URL = "https://api.securewithtrace.com";
+var UNAUTHORIZED_STATUS = 401;
+function getApiBaseUrl() {
+  const raw = process.env["TRACE_API_URL"];
+  if (!raw) {
+    return PRODUCTION_API_URL;
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(
+      colorWarning(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`)
+    );
+    return PRODUCTION_API_URL;
+  }
+  if (parsed.protocol !== "https:") {
+    console.error(colorWarning("Invalid TRACE_API_URL: only https:// is allowed. Using default."));
+    return PRODUCTION_API_URL;
+  }
+  const hostname3 = parsed.hostname;
+  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
+    console.error(
+      colorWarning(
+        "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
+      )
+    );
+    return PRODUCTION_API_URL;
+  }
+  return raw.replace(/\/+$/, "");
+}
+function createClient(token) {
+  return initClient(v1Contract, {
+    baseUrl: getApiBaseUrl(),
+    baseHeaders: {
+      Authorization: `Bearer ${token}`
+    }
+  });
+}
+function getWorkosClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (!clientId || clientId.trim().length === 0) {
+    return null;
+  }
+  return clientId;
+}
+async function refreshStoredAccessToken() {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return null;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return tokenResponse.access_token;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return null;
+  }
+}
+async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return false;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return true;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return false;
+  }
+}
+async function authenticatedRequest(request) {
+  const token = readToken();
+  if (!token) {
+    console.error(colorError("Not logged in. Run `tracecli auth login` first."));
+    process.exit(1);
+  }
+  const firstResult = await request(createClient(token));
+  if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    return firstResult;
+  }
+  const refreshedToken = await refreshStoredAccessToken();
+  if (!refreshedToken) {
+    return firstResult;
+  }
+  return request(createClient(refreshedToken));
+}
+async function authenticatedRequestSafe(request) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const firstResult = await request(createClient(token));
+    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+      return firstResult;
+    }
+    const refreshedToken = await refreshStoredAccessToken();
+    if (!refreshedToken) {
+      return firstResult;
+    }
+    return await request(createClient(refreshedToken));
+  } catch {
+    return null;
+  }
+}
+function extractOrganizationIdFromToken(token) {
+  if (!token || token.trim().length === 0) {
+    return null;
+  }
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (!payload) {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    return typeof decoded.org_id === "string" && decoded.org_id.trim().length > 0 ? decoded.org_id : null;
+  } catch {
+    return null;
+  }
+}
+var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+function determineActiveOrganization(organizations, selectedOrganizationId, tokenOrganizationId) {
+  if (organizations.length === 0) {
+    return null;
+  }
+  if (selectedOrganizationId && SAFE_ID_PATTERN.test(selectedOrganizationId)) {
+    const selectedOrganization = organizations.find(
+      (organization) => organization.organizationId === selectedOrganizationId
+    );
+    if (selectedOrganization) {
+      return {
+        organization: selectedOrganization,
+        source: "selected",
+        staleSelectionDetected: false
+      };
+    }
+  }
+  if (tokenOrganizationId && SAFE_ID_PATTERN.test(tokenOrganizationId)) {
+    const tokenOrganization = organizations.find(
+      (organization) => organization.organizationId === tokenOrganizationId
+    );
+    if (tokenOrganization) {
+      return {
+        organization: tokenOrganization,
+        source: "default",
+        staleSelectionDetected: selectedOrganizationId != null
+      };
+    }
+  }
+  const [fallbackOrganization] = organizations;
+  if (!fallbackOrganization) {
+    return null;
+  }
+  return {
+    organization: fallbackOrganization,
+    source: "default",
+    staleSelectionDetected: selectedOrganizationId != null
+  };
+}
+async function resolveOrganizationId(client) {
+  const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
+  );
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to resolve organization (status ${result.status}).`));
+    process.exit(1);
+  }
+  const organizations = result.body;
+  const selectedOrganizationId = readSelectedOrganizationId();
+  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+  const activeOrganization = determineActiveOrganization(
+    organizations,
+    selectedOrganizationId,
+    tokenOrganizationId
+  );
+  if (!activeOrganization) {
+    console.error(colorError("No organization found for your account."));
+    process.exit(1);
+  }
+  const id = activeOrganization.organization.organizationId;
+  if (!SAFE_ID_PATTERN.test(id)) {
+    console.error(colorError("Invalid organization ID received from API."));
+    process.exit(1);
+  }
+  if (activeOrganization.staleSelectionDetected) {
+    removeSelectedOrganizationId();
+    writeSelectedOrganizationId(id);
+    if (selectedOrganizationId) {
+      console.warn(
+        colorWarning(
+          `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
+        )
+      );
+    }
+  } else if (activeOrganization.source === "default") {
+    writeSelectedOrganizationId(id);
+  }
+  return id;
+}
+async function resolveOrganizationIdSafe(client) {
+  try {
+    const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
+    );
+    if (!result) {
+      return null;
+    }
+    if (result.status !== 200) {
+      return null;
+    }
+    const organizations = result.body;
+    const selectedOrganizationId = readSelectedOrganizationId();
+    const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+    const activeOrganization = determineActiveOrganization(
+      organizations,
+      selectedOrganizationId,
+      tokenOrganizationId
+    );
+    if (!activeOrganization) {
+      return null;
+    }
+    const id = activeOrganization.organization.organizationId;
+    if (!SAFE_ID_PATTERN.test(id)) {
+      return null;
+    }
+    if (activeOrganization.staleSelectionDetected) {
+      removeSelectedOrganizationId();
+      writeSelectedOrganizationId(id);
+    } else if (activeOrganization.source === "default") {
+      writeSelectedOrganizationId(id);
+    }
+    return id;
+  } catch {
+    return null;
+  }
+}
+
+// src/format.ts
+var SEVERITY_ORDER = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3,
+  INFORMATIONAL: 4
+};
+function formatStatus(status) {
+  return status.toLowerCase().replace("_", " ");
+}
+function tsvSafe(value) {
+  return (value ?? "").replace(/[\t\r\n]/g, " ");
+}
+
 // src/auth/commands.ts
 function getClientId() {
   const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
@@ -28304,7 +28313,7 @@ Examples:
         installationToken = cloneTokenResult.token;
         cloneTokenFailure = cloneTokenResult.failure;
         if (cloneTokenFailure) {
-          console.warn(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure));
+          console.warn(colorWarning(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure)));
         }
       }
       const effectiveUrl = installationToken ? urlWithUsername(cloneUrl) : cloneUrl;
@@ -28336,7 +28345,9 @@ Examples:
         if (exitCode !== 0) {
           if (!installationToken && cloneTokenFailure) {
             console.error(
-              "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+              colorError(
+                "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+              )
             );
           }
           process.exit(1);
@@ -28350,11 +28361,13 @@ Examples:
           const resetExitCode = await resetProc.exited;
           if (resetExitCode !== 0) {
             console.error(
-              "Warning: failed to reset remote URL \u2014 the token username may persist in .git/config"
+              colorWarningPrefix(
+                "failed to reset remote URL \u2014 the token username may persist in .git/config"
+              )
             );
           }
         }
-        console.log(`Repository cloned into ${targetDir}`);
+        console.log(colorSuccess(`Repository cloned into ${targetDir}`));
       } finally {
         if (askPassScript) {
           rmSync2(askPassScript.replace(/\/[^/]+$/, ""), { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {