securewithtrace 0.35.0 → 0.36.0

package/dist/index.js

@@ -27177,10 +27177,11 @@ var CreateOrganizationResponseSchema = external_exports.object({
   name: external_exports.string()
 });
 var OnboardingItemValues = [
+  "INVITE_MEMBERS",
   "CONNECT_CODE",
   "CONNECT_CLOUD",
-  "CREATE_APPLICATION",
-  "INVITE_MEMBERS"
+  "FILL_QUESTIONNAIRE",
+  "CREATE_APPLICATION"
 ];
 var OnboardingItemStatusValues = ["NOT_DONE", "DONE", "DISMISSED"];
 var OnboardingChecklistItemSchema = external_exports.object({
@@ -27189,6 +27190,7 @@ var OnboardingChecklistItemSchema = external_exports.object({
 });
 var OnboardingChecklistResponseSchema = external_exports.object({
   hasProvisionedPentest: external_exports.boolean(),
+  provisionedPentestDisplayId: external_exports.number().int().nullable().optional(),
   items: external_exports.array(OnboardingChecklistItemSchema)
 });
 var OnboardingItemParamsSchema = external_exports.object({
@@ -35605,6 +35607,22 @@ import { join } from "path";
 var ACCESS_TOKEN_FILENAME = "token";
 var REFRESH_TOKEN_FILENAME = "refresh-token";
 var SELECTED_ORGANIZATION_FILENAME = "organization";
+var TRACE_API_KEY_PREFIX = "trace_sk_";
+var TRACE_API_KEY_ENV = "TRACE_API_KEY";
+var API_KEY_ID_LENGTH = 16;
+var API_KEY_SECRET_LENGTH = 22;
+var API_KEY_CHECKSUM_LENGTH = 6;
+var TRACE_API_KEY_PATTERN = new RegExp(
+  `^${TRACE_API_KEY_PREFIX}[0-9A-Za-z]{${API_KEY_ID_LENGTH}}_[0-9A-Za-z]{${API_KEY_SECRET_LENGTH}}[0-9A-Za-z]{${API_KEY_CHECKSUM_LENGTH}}$`
+);
+var InvalidTraceApiKeyError = class extends Error {
+  constructor() {
+    super(
+      `${TRACE_API_KEY_ENV} does not look like a Trace API key (expected ${TRACE_API_KEY_PREFIX}...)`
+    );
+    this.name = "InvalidTraceApiKeyError";
+  }
+};
 function resolveTraceDir() {
   const override = process.env["TRACE_CLI_AUTH_DIR"];
   if (override && override.trim().length > 0) {
@@ -35717,6 +35735,48 @@ function removeToken() {
   }
   return removed;
 }
+function getTraceApiKeyEnv() {
+  const value = process.env[TRACE_API_KEY_ENV];
+  if (value === void 0) {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function isTraceApiKeyEnvSet() {
+  return getTraceApiKeyEnv() !== null;
+}
+function isTraceApiKeyToken(token) {
+  return token.startsWith(TRACE_API_KEY_PREFIX);
+}
+function isValidTraceApiKeyShape(token) {
+  return TRACE_API_KEY_PATTERN.test(token);
+}
+function publicApiKeyId(token) {
+  const keyId = token.slice(
+    TRACE_API_KEY_PREFIX.length,
+    TRACE_API_KEY_PREFIX.length + API_KEY_ID_LENGTH
+  );
+  return `${TRACE_API_KEY_PREFIX}${keyId}`;
+}
+function resolveCredential(readStoredToken = readToken) {
+  const envKey = getTraceApiKeyEnv();
+  if (envKey !== null) {
+    if (!isValidTraceApiKeyShape(envKey)) {
+      throw new InvalidTraceApiKeyError();
+    }
+    return { token: envKey, kind: "api_key", source: "env" };
+  }
+  const token = readStoredToken();
+  if (!token) {
+    return null;
+  }
+  return {
+    token,
+    kind: isTraceApiKeyToken(token) ? "api_key" : "user",
+    source: "file"
+  };
+}
 
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -36256,7 +36316,11 @@ function colorAccentUnderline(text, colorizer = source_default) {
 }
 
 // src/api-client.ts
-var readTokenSafe = readToken;
+var HUMAN_PRINCIPAL_REQUIRED_MESSAGE = "Human principal required for this operation";
+var FORBIDDEN_STATUS = 403;
+function readTokenSafe() {
+  return resolveCredential(readToken)?.token ?? null;
+}
 var PRODUCTION_API_URL = "https://api.securewithtrace.com";
 var UNAUTHORIZED_STATUS = 401;
 var REFRESH_AUTH_FAILURE_STATUS_CODES = /* @__PURE__ */ new Set([400, 401]);
@@ -36290,6 +36354,84 @@ function getApiBaseUrl() {
   }
   return raw.replace(/\/+$/, "");
 }
+function loadCredentialOrExit() {
+  const credential = resolveCredentialOrExit();
+  if (!credential) {
+    console.error(colorError("Not logged in. Run `tracecli auth login` first."));
+    process.exit(1);
+  }
+  return credential;
+}
+function resolveCredentialOrExit() {
+  try {
+    return resolveCredential(readToken);
+  } catch (error48) {
+    if (error48 instanceof InvalidTraceApiKeyError) {
+      console.error(colorError(error48.message));
+      process.exit(1);
+    }
+    throw error48;
+  }
+}
+function jwtOrganizationId(credential) {
+  if (!credential || credential.kind !== "user") {
+    return null;
+  }
+  return extractOrganizationIdFromToken(credential.token);
+}
+function storedSelectionFor(credential) {
+  if (!credential || credential.kind === "api_key") {
+    return null;
+  }
+  return readSelectedOrganizationId();
+}
+function persistActiveOrganizationSelection(credential, activeOrganization, selectedOrganizationId, warnOnStaleSelection) {
+  if (credential?.kind === "api_key") {
+    return;
+  }
+  if (activeOrganization.staleSelectionDetected) {
+    removeSelectedOrganizationId();
+    writeSelectedOrganizationId(activeOrganization.organization.organizationId);
+    if (warnOnStaleSelection && selectedOrganizationId) {
+      console.warn(
+        colorWarning(
+          `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${activeOrganization.organization.organizationId}) instead.`
+        )
+      );
+    }
+    return;
+  }
+  if (activeOrganization.source === "default") {
+    writeSelectedOrganizationId(activeOrganization.organization.organizationId);
+  }
+}
+function responseBody(result) {
+  if (!Object.prototype.hasOwnProperty.call(result, "body")) {
+    return void 0;
+  }
+  return Reflect.get(result, "body");
+}
+function responseMessage(result) {
+  const body = responseBody(result);
+  if (typeof body !== "object" || body === null || !("message" in body)) {
+    return void 0;
+  }
+  const message = body.message;
+  return typeof message === "string" ? message : void 0;
+}
+function isHumanPrincipalRequiredResult(result) {
+  return result.status === FORBIDDEN_STATUS && responseMessage(result) === HUMAN_PRINCIPAL_REQUIRED_MESSAGE;
+}
+function exitApiKeyUnauthorized() {
+  console.error(
+    colorError("The API key is invalid, expired, or revoked. Check the dashboard's API Keys page.")
+  );
+  process.exit(1);
+}
+function exitHumanPrincipalRequired() {
+  console.error(colorError("This command requires a human login; run `tracecli auth login`."));
+  process.exit(1);
+}
 function createClient(token) {
   return initClient(v1Contract, {
     baseUrl: getApiBaseUrl(),
@@ -36371,7 +36513,7 @@ async function refreshStoredAccessToken() {
   if (!clientId || !refreshToken) {
     return null;
   }
-  const tokenOrganizationId = extractOrganizationIdFromToken(readToken()) ?? void 0;
+  const tokenOrganizationId = jwtOrganizationId(resolveCredentialOrExit()) ?? void 0;
   try {
     return persistRefreshResult(await callRefresh(clientId, refreshToken), refreshToken);
   } catch (error48) {
@@ -36416,12 +36558,17 @@ async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
   }
 }
 async function authenticatedRequest(request) {
-  const token = readToken();
-  if (!token) {
-    console.error(colorError("Not logged in. Run `tracecli auth login` first."));
-    process.exit(1);
+  const credential = loadCredentialOrExit();
+  const firstResult = await request(createClient(credential.token));
+  if (credential.kind === "api_key") {
+    if (firstResult.status === UNAUTHORIZED_STATUS) {
+      exitApiKeyUnauthorized();
+    }
+    if (isHumanPrincipalRequiredResult(firstResult)) {
+      exitHumanPrincipalRequired();
+    }
+    return firstResult;
   }
-  const firstResult = await request(createClient(token));
   if (firstResult.status !== UNAUTHORIZED_STATUS) {
     return firstResult;
   }
@@ -36432,13 +36579,22 @@ async function authenticatedRequest(request) {
   return request(createClient(refreshedToken));
 }
 async function authenticatedRequestSafe(request) {
-  const token = readTokenSafe();
-  if (!token) {
+  let credential;
+  try {
+    credential = resolveCredential(readToken);
+  } catch (error48) {
+    if (error48 instanceof InvalidTraceApiKeyError) {
+      console.error(colorError(error48.message));
+      process.exit(1);
+    }
+    throw error48;
+  }
+  if (!credential) {
     return null;
   }
   try {
-    const firstResult = await request(createClient(token));
-    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    const firstResult = await request(createClient(credential.token));
+    if (credential.kind === "api_key" || firstResult.status !== UNAUTHORIZED_STATUS) {
       return firstResult;
     }
     const refreshedToken = await refreshStoredAccessToken();
@@ -36514,8 +36670,9 @@ async function resolveOrganizationId(client) {
     process.exit(1);
   }
   const organizations = result.body;
-  const selectedOrganizationId = readSelectedOrganizationId();
-  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+  const credential = resolveCredentialOrExit();
+  const selectedOrganizationId = storedSelectionFor(credential);
+  const tokenOrganizationId = jwtOrganizationId(credential);
   const activeOrganization = determineActiveOrganization(
     organizations,
     selectedOrganizationId,
@@ -36530,19 +36687,7 @@ async function resolveOrganizationId(client) {
     console.error(colorError("Invalid organization ID received from API."));
     process.exit(1);
   }
-  if (activeOrganization.staleSelectionDetected) {
-    removeSelectedOrganizationId();
-    writeSelectedOrganizationId(id);
-    if (selectedOrganizationId) {
-      console.warn(
-        colorWarning(
-          `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
-        )
-      );
-    }
-  } else if (activeOrganization.source === "default") {
-    writeSelectedOrganizationId(id);
-  }
+  persistActiveOrganizationSelection(credential, activeOrganization, selectedOrganizationId, true);
   return id;
 }
 async function resolveOrganizationSlug() {
@@ -36558,8 +36703,9 @@ async function resolveOrganizationSlug() {
     process.exit(1);
   }
   const organizations = result.body;
-  const selectedOrganizationId = readSelectedOrganizationId();
-  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+  const credential = resolveCredentialOrExit();
+  const selectedOrganizationId = storedSelectionFor(credential);
+  const tokenOrganizationId = jwtOrganizationId(credential);
   const activeOrganization = determineActiveOrganization(
     organizations,
     selectedOrganizationId,
@@ -36583,8 +36729,9 @@ async function resolveOrganizationIdSafe(client) {
       return null;
     }
     const organizations = result.body;
-    const selectedOrganizationId = readSelectedOrganizationId();
-    const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+    const credential = resolveCredentialOrExit();
+    const selectedOrganizationId = storedSelectionFor(credential);
+    const tokenOrganizationId = jwtOrganizationId(credential);
     const activeOrganization = determineActiveOrganization(
       organizations,
       selectedOrganizationId,
@@ -36597,12 +36744,12 @@ async function resolveOrganizationIdSafe(client) {
     if (!SAFE_ID_PATTERN.test(id)) {
       return null;
     }
-    if (activeOrganization.staleSelectionDetected) {
-      removeSelectedOrganizationId();
-      writeSelectedOrganizationId(id);
-    } else if (activeOrganization.source === "default") {
-      writeSelectedOrganizationId(id);
-    }
+    persistActiveOrganizationSelection(
+      credential,
+      activeOrganization,
+      selectedOrganizationId,
+      false
+    );
     return id;
   } catch {
     return null;
@@ -37115,6 +37262,9 @@ function decodeJwtExpiration(token) {
     return null;
   }
 }
+function shouldRetryCloneTokenAfterAuthFailure(kind) {
+  return kind === "user";
+}
 function resolveLocalCloneAuthFailure() {
   const token = readTokenSafe();
   if (!token) {
@@ -37173,7 +37323,10 @@ function resolveWorkosOrganizationId(organizations, organizationId) {
   }
   return workosOrganizationId;
 }
-async function maybeRefreshCloneTokenSessionForOrganization(organizationId, listOrganizations = listOrganizationsSafe, refreshForOrganization = (workosOrganizationId) => refreshStoredAccessTokenForOrganization(workosOrganizationId)) {
+async function maybeRefreshCloneTokenSessionForOrganization(organizationId, listOrganizations = listOrganizationsSafe, refreshForOrganization = (workosOrganizationId) => refreshStoredAccessTokenForOrganization(workosOrganizationId), credentialKind = () => resolveCredential(readToken)?.kind ?? null) {
+  if (credentialKind() === "api_key") {
+    return false;
+  }
   const organizations = await listOrganizations();
   if (!organizations) {
     return false;
@@ -37479,7 +37632,7 @@ async function fetchCloneToken(repoUrl) {
         body: { repositoryUrl: repoUrl }
       })
     );
-    if (result && (result.status === 401 || result.status === 403)) {
+    if (shouldRetryCloneTokenAfterAuthFailure(resolveCredential(readToken)?.kind) && result && (result.status === 401 || result.status === 403)) {
       const refreshed = await maybeRefreshCloneTokenSessionForOrganization(organizationId);
       if (refreshed) {
         result = await authenticatedRequestSafe(
@@ -39775,6 +39928,14 @@ function matchesOrgFilter(item, filter) {
 function sanitizeForOutput(value) {
   return value.replace(/[\r\n\t]/g, " ").trim();
 }
+var API_KEY_ENV_REFUSAL = "TRACE_API_KEY is set and takes precedence over ~/.trace. Unset it to manage a device-flow session.";
+function refuseIfApiKeyEnv(action) {
+  if (!isTraceApiKeyEnvSet()) {
+    return;
+  }
+  console.error(colorError(`Cannot ${action} while TRACE_API_KEY is set. ${API_KEY_ENV_REFUSAL}`));
+  process.exit(1);
+}
 function normalizeForComparison(value) {
   return value.trim().toLowerCase();
 }
@@ -39813,7 +39974,8 @@ async function fetchOrganizationContext() {
     process.exit(1);
   }
   const organizations = result.body;
-  const selectedOrganizationId = readSelectedOrganizationId();
+  const credential = resolveCredential(readToken);
+  const selectedOrganizationId = credential?.kind === "api_key" ? null : readSelectedOrganizationId();
   const active = determineActiveOrganization(organizations, selectedOrganizationId);
   if (!active) {
     console.error("No organizations found for your account.");
@@ -39824,15 +39986,17 @@ async function fetchOrganizationContext() {
     activeSource: active.source,
     staleSelectionDetected: active.staleSelectionDetected
   });
-  if (persistencePlan.shouldRemoveStaleSelection) {
-    removeSelectedOrganizationId();
-  }
-  if (persistencePlan.shouldWriteSelection) {
-    writeSelectedOrganizationId(persistencePlan.effectiveSelectedOrganizationId);
-    if (selectedOrganizationId) {
-      console.warn(
-        `Stored organization '${selectedOrganizationId}' is unavailable. Using '${active.organization.name}' (${active.organization.organizationId}) instead.`
-      );
+  if (credential?.kind !== "api_key") {
+    if (persistencePlan.shouldRemoveStaleSelection) {
+      removeSelectedOrganizationId();
+    }
+    if (persistencePlan.shouldWriteSelection) {
+      writeSelectedOrganizationId(persistencePlan.effectiveSelectedOrganizationId);
+      if (selectedOrganizationId) {
+        console.warn(
+          `Stored organization '${selectedOrganizationId}' is unavailable. Using '${active.organization.name}' (${active.organization.organizationId}) instead.`
+        );
+      }
     }
   }
   return {
@@ -39984,6 +40148,7 @@ Examples:
   tracecli auth login
   tracecli auth logout && tracecli auth login  # re-authenticate`
   ).action(async () => {
+    refuseIfApiKeyEnv("run `tracecli auth login`");
     const existingToken = readToken();
     if (existingToken) {
       console.log(
@@ -40028,6 +40193,7 @@ Examples:
   tracecli auth logout
   tracecli auth logout --no-confirm`
   ).action(async (options) => {
+    refuseIfApiKeyEnv("run `tracecli auth logout`");
     if (options.confirm && process.stdin.isTTY && process.stdout.isTTY) {
       const readline = createInterface3({ input: process.stdin, output: process.stdout });
       try {
@@ -40053,12 +40219,45 @@ Examples:
 function findOrganizationById(organizations, activeOrgId) {
   return organizations.find((org) => org.organizationId === activeOrgId) ?? null;
 }
-function buildAuthStatusInfo(token, refreshToken, selectedOrganizationId) {
-  if (!token) {
+function applyOrganizationsToAuthStatus(info, organizations) {
+  if (info.authMethod === "api_key") {
+    const active = determineActiveOrganization(organizations, null);
+    if (!active) {
+      return;
+    }
+    info.activeOrg = active.organization.organizationId;
+    info.activeOrgName = active.organization.name;
+    info.activeOrgSlug = active.organization.slug;
+    return;
+  }
+  if (!info.activeOrg) {
+    return;
+  }
+  const match = findOrganizationById(organizations, info.activeOrg);
+  if (!match) {
+    return;
+  }
+  info.activeOrgName = match.name;
+  info.activeOrgSlug = match.slug;
+}
+function buildAuthStatusInfo(credential, refreshToken, selectedOrganizationId) {
+  if (!credential) {
     return { loggedIn: false, expired: false, hasRefreshToken: refreshToken !== null };
   }
+  if (credential.kind === "api_key") {
+    return {
+      loggedIn: true,
+      authMethod: "api_key",
+      keyId: publicApiKeyId(credential.token),
+      source: credential.source === "env" ? "TRACE_API_KEY" : "file",
+      expired: false,
+      hasRefreshToken: false
+    };
+  }
+  const token = credential.token;
   const base = {
     loggedIn: true,
+    authMethod: "user",
     expired: false,
     hasRefreshToken: refreshToken !== null,
     ...selectedOrganizationId ? { activeOrg: selectedOrganizationId } : {}
@@ -40092,20 +40291,26 @@ Examples:
   tracecli auth status --output json
   tracecli auth status --output tsv`
   ).action(async (options) => {
-    const token = readToken();
-    const refreshToken = readRefreshToken();
-    const selectedOrganizationId = readSelectedOrganizationId();
-    const info = buildAuthStatusInfo(token, refreshToken, selectedOrganizationId);
-    if (info.loggedIn && info.activeOrg) {
+    let credential;
+    try {
+      credential = resolveCredential(readToken);
+    } catch (error48) {
+      if (error48 instanceof InvalidTraceApiKeyError) {
+        console.error(colorError(error48.message));
+        process.exitCode = 1;
+        return;
+      }
+      throw error48;
+    }
+    const refreshToken = credential?.kind === "user" ? readRefreshToken() : null;
+    const selectedOrganizationId = credential?.kind === "api_key" ? null : readSelectedOrganizationId();
+    const info = buildAuthStatusInfo(credential, refreshToken, selectedOrganizationId);
+    if (info.loggedIn) {
       const result = await authenticatedRequestSafe(
         (client) => client.organization.listMyOrganizations()
       );
       if (result && result.status === 200) {
-        const match = findOrganizationById(result.body, info.activeOrg);
-        if (match) {
-          info.activeOrgName = match.name;
-          info.activeOrgSlug = match.slug;
-        }
+        applyOrganizationsToAuthStatus(info, result.body);
       }
     }
     if (options.output === "json") {
@@ -40117,11 +40322,12 @@ Examples:
     }
     if (options.output === "tsv") {
       console.log(
-        "loggedIn	expired	hasRefreshToken	userId	orgId	activeOrg	activeOrgName	activeOrgSlug"
+        "loggedIn	authMethod	expired	hasRefreshToken	userId	orgId	activeOrg	activeOrgName	activeOrgSlug"
       );
       console.log(
         [
           String(info.loggedIn),
+          info.authMethod ?? "",
           String(info.expired),
           String(info.hasRefreshToken),
           info.userId ?? "",
@@ -40142,11 +40348,20 @@ Examples:
       return;
     }
     console.log("Logged in to Trace");
-    if (info.userId) {
-      console.log(`  User ID: ${info.userId}`);
-    }
-    if (info.orgId) {
-      console.log(`  Org ID:  ${info.orgId}`);
+    if (info.authMethod === "api_key") {
+      const sourceLabel = info.source === "TRACE_API_KEY" ? "API key (TRACE_API_KEY)" : "API key (~/.trace/token)";
+      console.log(`  Auth method: ${sourceLabel}`);
+      if (info.keyId) {
+        console.log(`  Key ID:  ${info.keyId}`);
+      }
+    } else {
+      console.log("  Auth method: user session");
+      if (info.userId) {
+        console.log(`  User ID: ${info.userId}`);
+      }
+      if (info.orgId) {
+        console.log(`  Org ID:  ${info.orgId}`);
+      }
     }
     if (info.activeOrg) {
       const orgLabel = info.activeOrgName ? `${sanitizeForOutput(info.activeOrgName)}${info.activeOrgSlug ? ` (${sanitizeForOutput(info.activeOrgSlug)})` : ""} \u2014 ${info.activeOrg}` : info.activeOrg;
@@ -40355,6 +40570,7 @@ Examples:
   tracecli org switch org_01KJTJFFG497Z1C54Z07AP6NA3
   tracecli org switch engineering --web`
   ).action(async (organization, options) => {
+    refuseIfApiKeyEnv("switch organization");
     const normalizedOrganizationInput = organization?.trim() ?? "";
     if (options.web) {
       if (normalizedOrganizationInput.length > 0) {
@@ -40603,10 +40819,11 @@ Examples:
       console.error(`Failed to resolve organization (status ${listed.status}).`);
       process.exit(1);
     }
+    const credential = resolveCredential(readToken);
     const resolution = determineActiveOrganization(
       listed.body,
-      readSelectedOrganizationId(),
-      extractOrganizationIdFromToken(readToken())
+      credential?.kind === "api_key" ? null : readSelectedOrganizationId(),
+      credential?.kind === "user" ? extractOrganizationIdFromToken(credential.token) : null
     );
     if (!resolution) {
       console.error("No organization found for your account.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {