securewithtrace 0.38.0 → 0.39.0

package/README.md

@@ -10,7 +10,7 @@
 
 `tracecli` is the official CLI for Trace.
 
-Use it to authenticate, browse and filter connected repositories, clone repositories, and inspect vulnerabilities directly from the command line.
+Use it to authenticate, browse and filter connected repositories, upload source archives, clone repositories, and inspect vulnerabilities directly from the command line.
 
 ## Install
 
@@ -56,6 +56,7 @@ tracecli vulnerabilities list --severity HIGH
 - **Find repositories by dependency** with optional version filtering (`repo list --dependency`)
 - **Clone repositories** with secure token handling (`repo clone`)
 - **Provision and read Trace-hosted email inboxes** for pentest test accounts (`inbox create/list/emails/email/delete`)
+- **Upload source ZIPs** for pentest when the app is not on GitHub, or attach an APK/IPA to an existing app (`upload create`, `upload build --app`)
 - **Filter vulnerabilities** by repo, severity, and status (`vulnerabilities list`)
 - **Export results as JSON or TSV** for automation (`vulnerabilities list --output json`)
 - **Upgrade easily** with built-in update checks and `upgrade` command (`upgrade`, `self-update`)
@@ -125,6 +126,44 @@ tracecli repo clone securewithtrace/trace
 tracecli repo clone securewithtrace/trace --branch main --depth 1
 ```
 
+### Source uploads
+
+`upload create` is a source ZIP (a code upload). `upload build --app` attaches an APK or IPA to an existing application. Requires `tracecli auth login` on a pentest-enabled organization; API keys are rejected.
+
+```bash
+# Upload a source archive and wait until it is ready
+tracecli upload create ./checkout.zip --name "Checkout" --wait
+
+# List uploads
+tracecli upload list
+
+# Resume an interrupted transfer with the same file
+tracecli upload resume <codeUploadId> ./checkout.zip
+
+# Link a ready source ZIP to an application
+tracecli upload link --app <applicationId> --upload <codeUploadId>
+
+# Attach an Android build to an existing application
+tracecli upload build ./app-release.apk --app <applicationId>
+```
+
+Flags for `upload create`:
+
+| Flag | Description |
+|------|-------------|
+| `--name <displayName>` | Display name (defaults to the filename without extension) |
+| `--wait` | Wait until malware scanning finishes |
+| `--output <format>` | `table` (default), `json`, `tsv` |
+
+Flags for `upload build`:
+
+| Flag | Description |
+|------|-------------|
+| `--app <applicationId>` | Application that owns this build (required) |
+| `--name <displayName>` | Display name (defaults to the filename without extension) |
+| `--wait` | Wait until malware scanning finishes |
+| `--output <format>` | `table` (default), `json`, `tsv` |
+
 ### Vulnerabilities
 
 ```bash

package/dist/index.js

@@ -37929,18 +37929,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open, close, parent) => {
+var createStyler = (open2, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open;
+    openAll = open2;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open;
+    openAll = parent.openAll + open2;
     closeAll = close + parent.closeAll;
   }
   return {
-    open,
+    open: open2,
     close,
     openAll,
     closeAll,
@@ -39659,6 +39659,7 @@ function sanitizeDisplay(value) {
 }
 var SUCCESS_STATUS = 200;
 var CREATED_STATUS = 201;
+var ACCEPTED_STATUS = 202;
 var NO_CONTENT_STATUS = 204;
 var UNAUTHORIZED_STATUS2 = 401;
 function parseOutput(value) {
@@ -46973,6 +46974,961 @@ Examples:
   });
 }
 
+// src/upload/prepare.ts
+import { createHash } from "crypto";
+import { createReadStream, statSync as statSync3 } from "fs";
+import { open } from "fs/promises";
+import { basename as basename2 } from "path";
+var CodeUploadPrepareError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadPrepareError";
+  }
+};
+var KIND_BY_INPUT = {
+  source: "SOURCE_ARCHIVE",
+  code: "SOURCE_ARCHIVE",
+  "source-archive": "SOURCE_ARCHIVE",
+  source_archive: "SOURCE_ARCHIVE",
+  SOURCE_ARCHIVE: "SOURCE_ARCHIVE",
+  apk: "ANDROID_APK",
+  android: "ANDROID_APK",
+  "android-apk": "ANDROID_APK",
+  android_apk: "ANDROID_APK",
+  ANDROID_APK: "ANDROID_APK",
+  ipa: "IOS_IPA",
+  ios: "IOS_IPA",
+  "ios-ipa": "IOS_IPA",
+  ios_ipa: "IOS_IPA",
+  IOS_IPA: "IOS_IPA"
+};
+function normalizeArtifactKind(input) {
+  const trimmed = input.trim();
+  return KIND_BY_INPUT[trimmed] ?? KIND_BY_INPUT[trimmed.toLowerCase()] ?? null;
+}
+function inferArtifactKindFromFilename(filename) {
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".zip")) return "SOURCE_ARCHIVE";
+  if (lower.endsWith(".apk")) return "ANDROID_APK";
+  if (lower.endsWith(".ipa")) return "IOS_IPA";
+  return null;
+}
+function requiredExtensionForKind(kind) {
+  if (kind === "ANDROID_APK") return ".apk";
+  if (kind === "IOS_IPA") return ".ipa";
+  return ".zip";
+}
+function defaultDisplayName(originalFilename) {
+  const base = originalFilename.replace(/\.(zip|apk|ipa)$/i, "").trim();
+  return base.slice(0, 200) || "source";
+}
+function formatArchiveBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) {
+    const kb = bytes / 1024;
+    return `${kb.toFixed(Number.isInteger(kb) ? 0 : 1)} KB`;
+  }
+  if (bytes < 1024 * 1024 * 1024) {
+    const mb = bytes / (1024 * 1024);
+    return `${mb.toFixed(Number.isInteger(mb) ? 0 : 1)} MB`;
+  }
+  const gb = bytes / (1024 * 1024 * 1024);
+  return `${gb.toFixed(Number.isInteger(gb) ? 0 : 1)} GB`;
+}
+function archiveTooLargeMessage() {
+  return `The file must be ${formatArchiveBytes(CODE_UPLOAD_MAX_BYTES)} or smaller.`;
+}
+async function hashFileSha256(filePath) {
+  const hash2 = createHash("sha256");
+  const stream = createReadStream(filePath);
+  for await (const chunk of stream) {
+    hash2.update(chunk);
+  }
+  return hash2.digest("hex");
+}
+async function readFileSlice(filePath, start, endExclusive) {
+  const length = endExclusive - start;
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(length) || start < 0 || length < 1) {
+    throw new Error(
+      `Invalid file slice: start=${String(start)} endExclusive=${String(endExclusive)}.`
+    );
+  }
+  const buffer = Buffer.alloc(length);
+  const handle = await open(filePath, "r");
+  try {
+    const { bytesRead } = await handle.read(buffer, 0, length, start);
+    if (bytesRead !== length) {
+      throw new Error(
+        `Expected to read ${String(length)} bytes at offset ${String(start)}, got ${String(bytesRead)}.`
+      );
+    }
+    return buffer;
+  } finally {
+    await handle.close();
+  }
+}
+function assertPreparedMatchesUpload(upload, prepared) {
+  if (upload.sizeBytes !== prepared.sizeBytes || upload.archiveSha256 !== prepared.archiveSha256) {
+    throw new CodeUploadPrepareError(
+      "The file does not match the interrupted upload (size or SHA-256 differs)."
+    );
+  }
+}
+async function prepareUploadFile(filePath, options = {}) {
+  let sizeBytes;
+  try {
+    const stats = statSync3(filePath);
+    if (!stats.isFile()) {
+      throw new CodeUploadPrepareError("Path is not a regular file. Pass a .zip, .apk, or .ipa.");
+    }
+    sizeBytes = stats.size;
+  } catch (error48) {
+    if (error48 instanceof CodeUploadPrepareError) throw error48;
+    throw new CodeUploadPrepareError("Cannot read that file.");
+  }
+  if (!Number.isSafeInteger(sizeBytes) || sizeBytes < 1) {
+    throw new CodeUploadPrepareError("The file is empty.");
+  }
+  if (sizeBytes > CODE_UPLOAD_MAX_BYTES) {
+    throw new CodeUploadPrepareError(archiveTooLargeMessage());
+  }
+  const originalFilename = basename2(filePath);
+  const inferred = inferArtifactKindFromFilename(originalFilename);
+  const artifactKind = options.artifactKind ?? inferred;
+  if (artifactKind == null) {
+    throw new CodeUploadPrepareError("Pass a .zip source archive, an .apk, or an .ipa.");
+  }
+  const expected = requiredExtensionForKind(artifactKind);
+  if (!originalFilename.toLowerCase().endsWith(expected)) {
+    const label = isApplicationBuildArtifactKind(artifactKind) ? artifactKind === "ANDROID_APK" ? "Android APK" : "iOS package" : "source archive";
+    throw new CodeUploadPrepareError(`A ${label} must end in ${expected}.`);
+  }
+  const displayName = (options.displayName ?? defaultDisplayName(originalFilename)).trim();
+  if (displayName.length < 1 || displayName.length > 200) {
+    throw new CodeUploadPrepareError("Display name must be 1 to 200 characters.");
+  }
+  return {
+    path: filePath,
+    displayName,
+    originalFilename,
+    sizeBytes,
+    archiveSha256: await hashFileSha256(filePath),
+    artifactKind
+  };
+}
+
+// src/upload/multipart.ts
+var MAX_CONCURRENT_UPLOADS = 3;
+var MAX_PART_ATTEMPTS = 3;
+var MAX_URL_REFRESHES = 12;
+async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts, options = {}) {
+  assertUploadPlan(totalBytes, partSizeBytes, parts);
+  const fetchPart = options.fetch ?? globalThis.fetch;
+  const wait = options.wait ?? defaultWait;
+  let uploadedBytes = options.initialUploadedBytes ?? 0;
+  if (!Number.isSafeInteger(uploadedBytes) || uploadedBytes < 0 || uploadedBytes > totalBytes) {
+    throw new Error("Invalid multipart progress: uploaded byte count is outside the archive.");
+  }
+  options.onProgress?.(progress(uploadedBytes, totalBytes));
+  if (parts.length === 0) return;
+  const urls = new Map(parts.map((part) => [part.partNumber, part.uploadUrl]));
+  const refreshUrls = createUrlRefresher(urls, options.refreshParts);
+  let cursor3 = 0;
+  const workerCount = Math.min(MAX_CONCURRENT_UPLOADS, parts.length);
+  await Promise.all(
+    Array.from({ length: workerCount }, async () => {
+      while (cursor3 < parts.length) {
+        const part = parts[cursor3];
+        cursor3 += 1;
+        if (!part) return;
+        const start = (part.partNumber - 1) * partSizeBytes;
+        const end = Math.min(start + partSizeBytes, totalBytes);
+        const body = await readFileSlice(filePath, start, end);
+        await uploadPartWithRetry(part.partNumber, urls, body, fetchPart, wait, refreshUrls);
+        uploadedBytes += body.byteLength;
+        options.onProgress?.(progress(uploadedBytes, totalBytes));
+      }
+    })
+  );
+}
+function createUrlRefresher(urls, refreshParts) {
+  if (!refreshParts) return async () => false;
+  let inflight = null;
+  let rounds = 0;
+  return async () => {
+    if (rounds >= MAX_URL_REFRESHES) return false;
+    if (!inflight) {
+      rounds += 1;
+      inflight = (async () => {
+        const fresh = await refreshParts();
+        for (const part of fresh) {
+          assertPresignedUploadUrl(part.uploadUrl);
+          urls.set(part.partNumber, part.uploadUrl);
+        }
+      })().finally(() => {
+        inflight = null;
+      });
+    }
+    await inflight;
+    return true;
+  };
+}
+function assertUploadPlan(totalBytes, partSizeBytes, parts) {
+  if (!Number.isSafeInteger(totalBytes) || totalBytes < 1) {
+    throw new Error("Invalid multipart upload: archive size must be a positive integer.");
+  }
+  if (!Number.isSafeInteger(partSizeBytes) || partSizeBytes < 1) {
+    throw new Error("Invalid multipart upload: part size must be a positive integer.");
+  }
+  const totalParts = Math.ceil(totalBytes / partSizeBytes);
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    if (!Number.isSafeInteger(part.partNumber) || part.partNumber < 1 || part.partNumber > totalParts || seen.has(part.partNumber)) {
+      throw new Error("Invalid multipart upload: part numbers must be unique and in range.");
+    }
+    assertPresignedUploadUrl(part.uploadUrl);
+    seen.add(part.partNumber);
+  }
+}
+async function uploadPartWithRetry(partNumber, urls, body, fetchPart, wait, refreshUrls) {
+  let lastStatus = null;
+  for (let attempt = 1; attempt <= MAX_PART_ATTEMPTS; attempt += 1) {
+    const uploadUrl = urls.get(partNumber);
+    if (!uploadUrl) {
+      throw new Error(`Source upload part ${partNumber.toString()} has no upload URL.`);
+    }
+    try {
+      const response = await fetchPart(uploadUrl, {
+        method: "PUT",
+        body: new Uint8Array(body),
+        redirect: "error"
+      });
+      if (response.ok) return;
+      lastStatus = response.status;
+      if (response.status === 403 && await refreshUrls()) {
+        attempt -= 1;
+        continue;
+      }
+      if (response.status >= 400 && response.status < 500 && response.status !== 408) break;
+    } catch {
+      lastStatus = null;
+    }
+    if (attempt < MAX_PART_ATTEMPTS) {
+      await wait(250 * 2 ** (attempt - 1));
+    }
+  }
+  const statusDetail = lastStatus === null ? "network error" : `status ${lastStatus.toString()}`;
+  throw new Error(
+    `Source upload part ${partNumber.toString()} failed after retries (${statusDetail}).`
+  );
+}
+function assertPresignedUploadUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new Error("Invalid multipart upload: the API returned an invalid part URL.");
+  }
+  const localHttp = url2.protocol === "http:" && (url2.hostname === "localhost" || url2.hostname === "127.0.0.1" || url2.hostname === "host.docker.internal");
+  if (url2.protocol !== "https:" && !localHttp) {
+    throw new Error("Invalid multipart upload: part URLs must use HTTPS.");
+  }
+}
+function progress(uploadedBytes, totalBytes) {
+  return {
+    uploadedBytes,
+    totalBytes,
+    fraction: totalBytes === 0 ? 0 : Math.min(1, uploadedBytes / totalBytes)
+  };
+}
+function defaultWait(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+// src/upload/commands.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
+var DEFAULT_RUNTIME = {
+  wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  pollIntervalMs: 3e3,
+  fetch: (input, init) => globalThis.fetch(input, init)
+};
+function resolveRuntime(runtime) {
+  return {
+    wait: runtime.wait ?? DEFAULT_RUNTIME.wait,
+    pollIntervalMs: runtime.pollIntervalMs ?? DEFAULT_RUNTIME.pollIntervalMs,
+    fetch: runtime.fetch ?? DEFAULT_RUNTIME.fetch
+  };
+}
+function isTerminalCodeUploadStatus(status) {
+  return TERMINAL_STATUSES.has(status);
+}
+function requireUuid(value, label) {
+  if (!isUuid(value)) {
+    console.error(colorError(`Invalid ${label} '${sanitizeDisplay(value)}'. Expected a UUID.`));
+    process.exit(1);
+  }
+  return value;
+}
+function parseKindOption(value) {
+  if (value === void 0) return void 0;
+  const kind = normalizeArtifactKind(value);
+  if (kind == null) {
+    console.error(
+      colorError(`Invalid --kind '${sanitizeDisplay(value)}'. Use source (code ZIP), apk, or ipa.`)
+    );
+    process.exit(1);
+  }
+  return kind;
+}
+function failPrepare(error48) {
+  const message = error48 instanceof CodeUploadPrepareError ? error48.message : error48 instanceof Error ? error48.message : "Failed to prepare the file.";
+  console.error(colorError(message));
+  process.exit(1);
+}
+function failWriteOp5(action, status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        `Only an organization admin (or Trace staff) on a pentest-enabled organization can ${action} source uploads.`
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 400) {
+    console.error(colorError(message ?? "Invalid request (status 400)."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CODE_UPLOAD_NOT_READY") {
+      console.error(
+        colorError(
+          message ?? "The upload must be ready and pass malware scanning before it can be linked. Run `tracecli upload wait <id>`."
+        )
+      );
+    } else if (errorCode === "CODE_UPLOAD_NOT_SOURCE") {
+      console.error(
+        colorError(message ?? "APK and IPA uploads cannot be linked as source repositories.")
+      );
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} upload (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function failReadOp5(action, status, body) {
+  const { message } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only an organization admin (or Trace staff) on a pentest-enabled organization can view source uploads."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to ${action} (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
+function resumeHint(codeUploadId, filePath) {
+  return `Resume with: tracecli upload resume ${codeUploadId} ${filePath}`;
+}
+function buildUploadsTable(uploads) {
+  const cells = uploads.map((upload) => ({
+    name: sanitizeDisplay(upload.displayName),
+    kind: formatStatus(upload.artifactKind),
+    status: formatStatus(upload.status),
+    size: formatArchiveBytes(upload.sizeBytes),
+    id: upload.codeUploadId
+  }));
+  const nameWidth = Math.max(4, ...cells.map((c59) => c59.name.length));
+  const kindWidth = Math.max(4, ...cells.map((c59) => c59.kind.length));
+  const statusWidth = Math.max(6, ...cells.map((c59) => c59.status.length));
+  const sizeWidth = Math.max(4, ...cells.map((c59) => c59.size.length));
+  const header = `${"NAME".padEnd(nameWidth)}  ${"KIND".padEnd(kindWidth)}  ${"STATUS".padEnd(statusWidth)}  ${"SIZE".padEnd(sizeWidth)}  ID`;
+  const rows = cells.map(
+    (c59) => `${c59.name.padEnd(nameWidth)}  ${c59.kind.padEnd(kindWidth)}  ${c59.status.padEnd(statusWidth)}  ${c59.size.padEnd(sizeWidth)}  ${c59.id}`
+  );
+  return { header, rows };
+}
+function renderUploadDetail(upload) {
+  const pad = 18;
+  const linked = upload.linkedApplications.length === 0 ? "\u2014" : upload.linkedApplications.map((app) => `${sanitizeDisplay(app.name)} (${app.applicationId})`).join(", ");
+  return [
+    `${"Name:".padEnd(pad)} ${sanitizeDisplay(upload.displayName)}`,
+    `${"Filename:".padEnd(pad)} ${sanitizeDisplay(upload.originalFilename)}`,
+    `${"Kind:".padEnd(pad)} ${formatStatus(upload.artifactKind)}`,
+    `${"Status:".padEnd(pad)} ${formatStatus(upload.status)}`,
+    `${"Size:".padEnd(pad)} ${formatArchiveBytes(upload.sizeBytes)}`,
+    `${"SHA-256:".padEnd(pad)} ${upload.archiveSha256}`,
+    `${"Upload ID:".padEnd(pad)} ${upload.codeUploadId}`,
+    `${"Repository ID:".padEnd(pad)} ${upload.repositoryId}`,
+    `${"Malware:".padEnd(pad)} ${upload.malwareScanResult ? formatStatus(upload.malwareScanResult) : "\u2014"}`,
+    `${"Rejection:".padEnd(pad)} ${upload.rejectionReason ? formatStatus(upload.rejectionReason) : "\u2014"}`,
+    `${"Linked apps:".padEnd(pad)} ${linked}`,
+    `${"Created:".padEnd(pad)} ${formatDate(upload.createdAt)}`,
+    `${"Ready:".padEnd(pad)} ${formatDate(upload.readyAt)}`
+  ].join("\n");
+}
+function printUploadsTsv(uploads) {
+  console.log(
+    [
+      "codeUploadId",
+      "repositoryId",
+      "displayName",
+      "originalFilename",
+      "artifactKind",
+      "status",
+      "sizeBytes",
+      "archiveSha256",
+      "malwareScanResult",
+      "rejectionReason",
+      "applicationId",
+      "createdAt",
+      "readyAt"
+    ].join("	")
+  );
+  for (const upload of uploads) {
+    console.log(
+      [
+        tsvSafe(upload.codeUploadId),
+        tsvSafe(upload.repositoryId),
+        tsvSafe(sanitizeDisplay(upload.displayName)),
+        tsvSafe(sanitizeDisplay(upload.originalFilename)),
+        tsvSafe(upload.artifactKind),
+        tsvSafe(upload.status),
+        String(upload.sizeBytes),
+        tsvSafe(upload.archiveSha256),
+        tsvSafe(upload.malwareScanResult ?? ""),
+        tsvSafe(upload.rejectionReason ?? ""),
+        tsvSafe(upload.applicationId ?? ""),
+        tsvSafe(toIso(upload.createdAt)),
+        tsvSafe(upload.readyAt ? toIso(upload.readyAt) : "")
+      ].join("	")
+    );
+  }
+}
+function outputUpload(upload, output) {
+  if (output === "json") {
+    console.log(JSON.stringify(upload, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv([upload]);
+    return;
+  }
+  console.log(renderUploadDetail(upload));
+}
+function writeProgress(progress2) {
+  if (!process.stderr.isTTY) return;
+  const pct = Math.floor(progress2.fraction * 100);
+  process.stderr.write(
+    `\rUploading ${pct}% (${formatArchiveBytes(progress2.uploadedBytes)} / ${formatArchiveBytes(progress2.totalBytes)})`
+  );
+}
+function finishProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+async function listUploads(organizationId, query = {}) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.listCodeUploads({
+      params: { organizationId },
+      query
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failReadOp5("list uploads", result.status, result.body);
+  }
+  return result.body.uploads;
+}
+async function requireUpload(organizationId, codeUploadId, query = {}) {
+  const uploads = await listUploads(organizationId, query);
+  const match = uploads.find((upload) => upload.codeUploadId === codeUploadId);
+  if (!match) {
+    console.error(colorError(`No code upload '${codeUploadId}'.`));
+    process.exit(1);
+  }
+  return match;
+}
+async function refreshRemainingParts(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", result.status, result.body);
+  }
+  return result.body.multipart.parts;
+}
+async function completeUpload(organizationId, codeUploadId) {
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.completeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (result.status !== ACCEPTED_STATUS) {
+    failWriteOp5("complete", result.status, result.body);
+  }
+  return result.body;
+}
+async function waitForTerminal(organizationId, codeUploadId, runtime) {
+  for (; ; ) {
+    const upload = await requireUpload(organizationId, codeUploadId);
+    if (isTerminalCodeUploadStatus(upload.status)) {
+      return upload;
+    }
+    if (process.stderr.isTTY) {
+      process.stderr.write(`\rWaiting for malware scan (${formatStatus(upload.status)})...`);
+    }
+    await runtime.wait(runtime.pollIntervalMs);
+  }
+}
+function printWaitOutcome(upload, output) {
+  if (output !== "table") {
+    outputUpload(upload, output);
+    if (upload.status !== "READY") process.exit(1);
+    return;
+  }
+  if (upload.status === "READY") {
+    console.log(colorSuccess(`Upload ${upload.codeUploadId} is ready.`));
+    outputUpload(upload, output);
+    if (upload.artifactKind === "SOURCE_ARCHIVE") {
+      console.log(
+        `Link it with: tracecli upload link --app <applicationId> --upload ${upload.codeUploadId}`
+      );
+    }
+    return;
+  }
+  const reason = upload.rejectionReason ? ` (${formatStatus(upload.rejectionReason)})` : "";
+  console.error(
+    colorError(`Upload ${upload.codeUploadId} ended as ${formatStatus(upload.status)}${reason}.`)
+  );
+  outputUpload(upload, output);
+  process.exit(1);
+}
+async function runTransfer(filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath, {
+      displayName: options.name,
+      artifactKind: options.artifactKind
+    });
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const initialized = await authenticatedRequest(
+    (client) => client.codeUpload.initializeCodeUpload({
+      params: { organizationId },
+      body: {
+        displayName: prepared.displayName,
+        originalFilename: prepared.originalFilename,
+        sizeBytes: prepared.sizeBytes,
+        archiveSha256: prepared.archiveSha256,
+        artifactKind: prepared.artifactKind,
+        ...options.applicationId !== void 0 ? { applicationId: options.applicationId } : {}
+      }
+    })
+  );
+  if (initialized.status !== CREATED_STATUS) {
+    failWriteOp5("create", initialized.status, initialized.body);
+  }
+  const codeUploadId = initialized.body.upload.codeUploadId;
+  if (output === "table") {
+    console.error(
+      `Initialized upload ${codeUploadId} (${formatArchiveBytes(prepared.sizeBytes)}).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      initialized.body.multipart.partSizeBytes,
+      initialized.body.multipart.parts,
+      {
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runCreate5(filePath, options, runtime) {
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred != null && isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "That file is a mobile build, not a source archive. Attach it to an existing application with:"
+      )
+    );
+    console.error("  tracecli upload build <file> --app <applicationId>");
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      artifactKind: "SOURCE_ARCHIVE"
+    },
+    runtime
+  );
+}
+async function runBuild(filePath, options, runtime) {
+  const applicationId = requireUuid(options.app, "--app");
+  const inferred = inferArtifactKindFromFilename(filePath);
+  if (inferred == null || !isApplicationBuildArtifactKind(inferred)) {
+    console.error(
+      colorError(
+        "Build uploads are an APK or IPA attached to an existing application. For a source ZIP, use `tracecli upload create <file>`."
+      )
+    );
+    process.exit(1);
+  }
+  await runTransfer(
+    filePath,
+    {
+      ...options.name !== void 0 ? { name: options.name } : {},
+      ...options.wait !== void 0 ? { wait: options.wait } : {},
+      output: options.output,
+      applicationId,
+      artifactKind: inferred
+    },
+    runtime
+  );
+}
+async function runResume(codeUploadIdArg, filePath, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  let prepared;
+  try {
+    prepared = await prepareUploadFile(filePath);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const organizationId = await resolveOrganizationId();
+  const resumed = await authenticatedRequest(
+    (client) => client.codeUpload.resumeCodeUpload({
+      params: { organizationId, codeUploadId },
+      body: {}
+    })
+  );
+  if (resumed.status !== SUCCESS_STATUS) {
+    failWriteOp5("resume", resumed.status, resumed.body);
+  }
+  try {
+    assertPreparedMatchesUpload(resumed.body.upload, prepared);
+  } catch (error48) {
+    failPrepare(error48);
+  }
+  const uploadedBytes = resumed.body.multipart.uploadedParts.reduce(
+    (sum, part) => sum + part.sizeBytes,
+    0
+  );
+  if (output === "table") {
+    console.error(
+      `Resuming upload ${codeUploadId} (${formatArchiveBytes(uploadedBytes)} already stored).`
+    );
+  }
+  try {
+    await uploadCodeArchiveParts(
+      prepared.path,
+      prepared.sizeBytes,
+      resumed.body.multipart.partSizeBytes,
+      resumed.body.multipart.parts,
+      {
+        initialUploadedBytes: uploadedBytes,
+        fetch: runtime.fetch,
+        wait: runtime.wait,
+        onProgress: writeProgress,
+        refreshParts: () => refreshRemainingParts(organizationId, codeUploadId)
+      }
+    );
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Upload to storage failed.";
+    console.error(colorError(detail));
+    console.error(resumeHint(codeUploadId, filePath));
+    process.exit(1);
+  }
+  const completed = await completeUpload(organizationId, codeUploadId);
+  const upload = options.wait ? await waitForTerminal(organizationId, codeUploadId, runtime) : completed;
+  if (options.wait) {
+    if (process.stderr.isTTY) process.stderr.write("\n");
+    printWaitOutcome(upload, output);
+    return;
+  }
+  if (output === "table") {
+    console.log(colorSuccess(`Uploaded ${sanitizeDisplay(upload.displayName)}.`));
+    console.log(
+      `Malware scanning is in progress. Check with: tracecli upload wait ${codeUploadId}`
+    );
+  }
+  outputUpload(upload, output);
+}
+async function runList5(options) {
+  const output = parseOutput(options.output);
+  if (options.web) {
+    const slug = await resolveOrganizationSlug();
+    const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings/integrations/sources`;
+    const opened = await openBrowser(url2);
+    if (!opened) console.log(url2);
+    return;
+  }
+  const kind = parseKindOption(options.kind);
+  const applicationId = options.app !== void 0 ? requireUuid(options.app, "--app") : void 0;
+  const organizationId = await resolveOrganizationId();
+  const uploads = await listUploads(organizationId, {
+    ...kind !== void 0 ? { artifactKind: kind } : {},
+    ...applicationId !== void 0 ? { applicationId } : {}
+  });
+  if (output === "json") {
+    console.log(JSON.stringify({ uploads }, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    printUploadsTsv(uploads);
+    return;
+  }
+  if (uploads.length === 0) {
+    console.log("No source uploads found.");
+    return;
+  }
+  const { header, rows } = buildUploadsTable(uploads);
+  await runInteractivePager({
+    items: uploads,
+    header,
+    renderItem: (_upload, i2) => [rows[i2] ?? ""],
+    disabled: options.pager === false
+  });
+}
+async function runGet4(codeUploadIdArg, options) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  outputUpload(upload, output);
+}
+async function runWait(codeUploadIdArg, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const upload = await waitForTerminal(organizationId, codeUploadId, runtime);
+  if (process.stderr.isTTY) process.stderr.write("\n");
+  printWaitOutcome(upload, output);
+}
+async function runDelete5(codeUploadIdArg, options) {
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const confirmed = await confirmDeletion(`upload ${codeUploadId}`, options.yes);
+  if (!confirmed) {
+    console.log("Aborted.");
+    return;
+  }
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.deleteCodeUpload({
+      params: { organizationId, codeUploadId }
+    })
+  );
+  if (result.status !== NO_CONTENT_STATUS) {
+    failWriteOp5("delete", result.status, result.body);
+  }
+  console.log(colorSuccess(`Deleted upload ${codeUploadId}`));
+}
+async function runLink(options) {
+  const output = parseOutput(options.output);
+  const applicationId = requireUuid(options.app, "--app");
+  const codeUploadId = requireUuid(options.upload, "--upload");
+  const organizationId = await resolveOrganizationId();
+  const upload = await requireUpload(organizationId, codeUploadId);
+  if (isApplicationBuildArtifactKind(upload.artifactKind)) {
+    console.error(colorError("APK and IPA uploads cannot be linked as source repositories."));
+    process.exit(1);
+  }
+  if (upload.status !== "READY" || upload.malwareScanResult !== "NO_THREATS_FOUND") {
+    console.error(
+      colorError(
+        `Upload is ${formatStatus(upload.status)}; it must be ready and pass malware scanning before it can be linked.`
+      )
+    );
+    process.exit(1);
+  }
+  const result = await authenticatedRequest(
+    (client) => client.application.createApplicationRepository({
+      params: { organizationId, applicationId },
+      body: {
+        repositoryId: upload.repositoryId,
+        ...options.path !== void 0 ? { repositoryPath: options.path } : {}
+      }
+    })
+  );
+  if (result.status !== CREATED_STATUS) {
+    failWriteOp5("link", result.status, result.body);
+  }
+  if (output === "json") {
+    console.log(JSON.stringify(result.body, null, 2));
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["applicationId", "repositoryId", "codeUploadId"].join("	"));
+    console.log([applicationId, upload.repositoryId, codeUploadId].join("	"));
+    return;
+  }
+  console.log(
+    colorSuccess(`Linked ${sanitizeDisplay(upload.displayName)} to application ${applicationId}.`)
+  );
+}
+function createCreateCommand5(runtime) {
+  return new Command("create").alias("source").description("Upload a source ZIP as a code archive (not a mobile build)").argument("<file>", "Path to a .zip source archive").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+This is a code upload: a source ZIP that becomes an uploaded repository after
+it is ready. Link it with \`upload link\`. APK and IPA files belong on
+\`upload build --app\`, which attaches a build to an existing application.
+
+Requires a human login (\`tracecli auth login\`) on a pentest-enabled organization.
+API keys are rejected.
+
+Examples:
+  tracecli upload create ./checkout.zip
+  tracecli upload create ./checkout.zip --name "Checkout" --wait`
+  ).action(async (file2, options) => {
+    await runCreate5(file2, options, runtime);
+  });
+}
+function createBuildCommand(runtime) {
+  return new Command("build").description("Upload an APK or IPA and attach it to an existing application").argument("<file>", "Path to an .apk or .ipa").requiredOption("--app <applicationId>", "Application that owns this build").option("--name <displayName>", "Display name (defaults to the filename without extension)").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Build uploads are not source archives. They attach to --app immediately and
+cannot be linked as a repository. For a source ZIP, use \`upload create\`.
+
+Examples:
+  tracecli upload build ./app-release.apk --app <applicationId>
+  tracecli upload build ./app.ipa --app <applicationId> --name "iOS build"`
+  ).action(async (file2, options) => {
+    await runBuild(file2, options, runtime);
+  });
+}
+function createListCommand7() {
+  return new Command("list").description("List source and build uploads in the active organization").option("--kind <kind>", "Filter: source (code ZIP), apk, or ipa").option("--app <applicationId>", "Filter build uploads for one application").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("--no-pager", "Disable the interactive pager for table output").option("-w, --web", "Open the source uploads page in a browser").action(async (options) => {
+    await runList5(options);
+  });
+}
+function createGetCommand4() {
+  return new Command("get").description("Show a single upload").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runGet4(codeUploadId, options);
+  });
+}
+function createResumeCommand(runtime) {
+  return new Command("resume").description("Resume an interrupted upload with the same file").argument("<codeUploadId>", "Upload UUID from the interrupted create").argument("<file>", "The same .zip, .apk, or .ipa file").option("--wait", "Wait until malware scanning finishes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+The file must match the original size and SHA-256. Trace skips parts that
+already landed in storage.
+
+Examples:
+  tracecli upload resume <codeUploadId> ./checkout.zip`
+  ).action(async (codeUploadId, file2, options) => {
+    await runResume(codeUploadId, file2, options, runtime);
+  });
+}
+function createWaitCommand(runtime) {
+  return new Command("wait").description("Wait until an upload finishes malware scanning and validation").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
+    await runWait(codeUploadId, options, runtime);
+  });
+}
+function createDeleteCommand5() {
+  return new Command("delete").description("Delete an uploaded archive and its stored bytes").argument("<codeUploadId>", "Upload UUID").option("-y, --yes", "Skip the confirmation prompt (required in non-interactive shells)").action(async (codeUploadId, options) => {
+    await runDelete5(codeUploadId, options);
+  });
+}
+function createLinkCommand() {
+  return new Command("link").description("Link a ready source upload to an application").requiredOption("--app <applicationId>", "Application UUID").requiredOption("--upload <codeUploadId>", "Upload UUID (must be a ready source ZIP)").option("--path <repositoryPath>", "Path within the archive").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Only a READY source archive that passed malware scanning can be linked.
+APK and IPA builds attach to an application with \`upload build --app\`.
+
+Examples:
+  tracecli upload link --app <applicationId> --upload <codeUploadId>`
+  ).action(async (options) => {
+    await runLink(options);
+  });
+}
+function createUploadCommand(runtime = {}) {
+  const resolved = resolveRuntime(runtime);
+  const upload = new Command("upload").alias("code-upload").description("Upload source archives (and separately, mobile builds) for pentest");
+  upload.addCommand(createCreateCommand5(resolved));
+  upload.addCommand(createBuildCommand(resolved));
+  upload.addCommand(createListCommand7());
+  upload.addCommand(createGetCommand4());
+  upload.addCommand(createResumeCommand(resolved));
+  upload.addCommand(createWaitCommand(resolved));
+  upload.addCommand(createDeleteCommand5());
+  upload.addCommand(createLinkCommand());
+  return upload;
+}
+
 // src/vulnerabilities/commands.ts
 var DEFAULT_LIMIT3 = 30;
 var MAX_LIMIT3 = 100;
@@ -47149,7 +48105,7 @@ function printVulnerabilityDetailTsv(vulnerability) {
   ].map(sanitizeTsvField);
   console.log(cols.join("	"));
 }
-function createGetCommand4() {
+function createGetCommand5() {
   return new Command("get").description("Get a vulnerability by display ID or UUID").argument("<id>", "Vulnerability display ID (e.g. TRACE-123 or 123) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerability detail page in a browser").addHelpText(
     "after",
     `
@@ -47208,7 +48164,7 @@ Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
     printVulnerabilityDetail(result.body);
   });
 }
-function createListCommand7() {
+function createListCommand8() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
     "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW)",
@@ -47341,8 +48297,8 @@ Examples:
 }
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
-  vulnerabilities.addCommand(createGetCommand4());
-  vulnerabilities.addCommand(createListCommand7());
+  vulnerabilities.addCommand(createGetCommand5());
+  vulnerabilities.addCommand(createListCommand8());
   return vulnerabilities;
 }
 
@@ -47365,6 +48321,7 @@ program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createCodeSizeCommand());
+program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());
 program2.addCommand(createCompletionCommand(program2));
 program2.addCommand(createUpgradeCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {