@automattic/vip 4.0.9 → 4.0.11

package/dist/bin/vip-defensive-mode-configure.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeConfigureCommand = defensiveModeConfigureCommand;
+var _chalk = _interopRequireDefault(require("chalk"));
+var _enquirer = require("enquirer");
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode configure';
+const exampleUsage = 'vip @example-app.production defensive-mode configure';
+const examples = [{
+  usage: `${exampleUsage} --enabled=true --challenge-type=1`,
+  description: 'Update defensive mode configuration non-interactively (minimal required flags).'
+}, {
+  usage: `${exampleUsage} --enabled=true --challenge-type=2 --connection-threshold-absolute=5000 --connection-threshold-percentage=80`,
+  description: 'Update with explicit thresholds.'
+}];
+function parseBoolean(raw) {
+  if (raw === true || raw === false) {
+    return raw;
+  }
+  if (typeof raw !== 'string') {
+    return null;
+  }
+  const normalized = raw.trim().toLowerCase();
+  if (['true', 'yes', '1', 'on', 'enable', 'enabled'].includes(normalized)) {
+    return true;
+  }
+  if (['false', 'no', '0', 'off', 'disable', 'disabled'].includes(normalized)) {
+    return false;
+  }
+  return null;
+}
+function parsePositiveInt(raw) {
+  // A bare flag (e.g. `--challenge-type` with no value) arrives as boolean true,
+  // which Number() would silently coerce to 1.
+  if (raw === undefined || raw === null || typeof raw === 'boolean') {
+    return null;
+  }
+  if (typeof raw === 'string' && raw.trim() === '') {
+    return null;
+  }
+  const num = Number(raw);
+  if (!Number.isInteger(num) || num < 0) {
+    return null;
+  }
+  return num;
+}
+function validateFlags(opt) {
+  const errors = [];
+  const enabled = opt.enabled === undefined ? null : parseBoolean(opt.enabled);
+  if (opt.enabled !== undefined && enabled === null) {
+    errors.push(`Invalid value for --enabled: ${opt.enabled}. Expected true or false.`);
+  }
+  const challengeType = opt.challengeType === undefined ? null : parsePositiveInt(opt.challengeType);
+  if (opt.challengeType !== undefined && challengeType === null) {
+    errors.push(`Invalid value for --challenge-type: ${opt.challengeType}. Expected a non-negative integer.`);
+  }
+  const absolute = opt.connectionThresholdAbsolute === undefined ? undefined : parsePositiveInt(opt.connectionThresholdAbsolute);
+  if (opt.connectionThresholdAbsolute !== undefined && absolute === null) {
+    errors.push(`Invalid value for --connection-threshold-absolute: ${opt.connectionThresholdAbsolute}. Expected a non-negative integer.`);
+  }
+  const percentage = opt.connectionThresholdPercentage === undefined ? undefined : parsePositiveInt(opt.connectionThresholdPercentage);
+  if (opt.connectionThresholdPercentage !== undefined && percentage === null) {
+    errors.push(`Invalid value for --connection-threshold-percentage: ${opt.connectionThresholdPercentage}. Expected a non-negative integer.`);
+  }
+  return {
+    enabled,
+    challengeType,
+    absolute,
+    percentage,
+    errors
+  };
+}
+function formatSettingValue(value) {
+  return value === undefined || value === null ? '-' : String(value);
+}
+function buildSettingRows(currentConfig, {
+  enabled,
+  challengeType,
+  absolute,
+  percentage
+}) {
+  return [{
+    setting: 'Enabled',
+    current: formatSettingValue(currentConfig?.enabled),
+    proposed: formatSettingValue(enabled)
+  }, {
+    setting: 'Challenge type',
+    current: formatSettingValue(currentConfig?.challengeType),
+    proposed: formatSettingValue(challengeType)
+  }, {
+    setting: 'Connection threshold (absolute)',
+    current: formatSettingValue(currentConfig?.connectionThresholdAbsolute),
+    proposed: absolute === undefined ? '(not specified)' : formatSettingValue(absolute)
+  }, {
+    setting: 'Connection threshold (percentage)',
+    current: formatSettingValue(currentConfig?.connectionThresholdPercentage),
+    proposed: percentage === undefined ? '(not specified)' : formatSettingValue(percentage)
+  }];
+}
+async function resolveRequiredViaPrompt(missing, enabled, challengeType) {
+  const answers = await (0, _enquirer.prompt)(missing.map(flag => flag === '--enabled' ? {
+    type: 'confirm',
+    name: 'enabled',
+    message: 'Enable defensive mode?'
+  } : {
+    type: 'input',
+    name: 'challengeType',
+    message: 'Challenge type (integer):'
+  }));
+  let resolvedEnabled = enabled;
+  let resolvedChallengeType = challengeType;
+  if (resolvedEnabled === null && 'enabled' in answers) {
+    resolvedEnabled = Boolean(answers.enabled);
+  }
+  if (resolvedChallengeType === null && 'challengeType' in answers) {
+    resolvedChallengeType = parsePositiveInt(answers.challengeType);
+    if (resolvedChallengeType === null) {
+      console.error(_chalk.default.red('Challenge type must be a non-negative integer.'));
+      process.exit(1);
+    }
+  }
+  return {
+    enabled: resolvedEnabled,
+    challengeType: resolvedChallengeType
+  };
+}
+async function defensiveModeConfigureCommand(_args, opt) {
+  const interactive = (0, _cliHelpers.isInteractive)(opt);
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    interactive,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_configure_command_execute', trackingParams);
+  const {
+    enabled: rawEnabled,
+    challengeType: rawChallengeType,
+    absolute,
+    percentage,
+    errors
+  } = validateFlags(opt);
+  if (errors.length > 0) {
+    errors.forEach(msg => console.error(_chalk.default.red(msg)));
+    process.exit(1);
+  }
+  const missing = [];
+  if (rawEnabled === null) {
+    missing.push('--enabled');
+  }
+  if (rawChallengeType === null) {
+    missing.push('--challenge-type');
+  }
+  let enabled = rawEnabled;
+  let challengeType = rawChallengeType;
+  if (missing.length > 0) {
+    if (!interactive) {
+      console.error(_chalk.default.red(`Missing required flags in non-interactive mode: ${missing.join(', ')}`));
+      console.error('Re-run with all required flags, or remove --non-interactive and run on a TTY.');
+      await (0, _tracker.trackEvent)('defensive_mode_configure_command_error', {
+        ...trackingParams,
+        error: 'missing-required-flags'
+      });
+      process.exit(1);
+    }
+    ({
+      enabled,
+      challengeType
+    } = await resolveRequiredViaPrompt(missing, enabled, challengeType));
+  }
+  const input = {
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled,
+    challengeType
+  };
+  if (absolute !== undefined) {
+    input.connectionThresholdAbsolute = absolute;
+  }
+  if (percentage !== undefined) {
+    input.connectionThresholdPercentage = percentage;
+  }
+  const currentConfig = opt.env.defensiveMode?.config?.effective ?? null;
+  const settingRows = buildSettingRows(currentConfig, {
+    enabled,
+    challengeType,
+    absolute,
+    percentage
+  });
+  console.log(`Defensive mode configuration for ${_chalk.default.bold(opt.app.name)} (${(0, _format.formatEnvironment)(opt.env.type)}):`);
+  console.log((0, _format.table)(settingRows));
+
+  // Production mutations require confirmation. In non-interactive contexts this
+  // hard-errors unless --skip-confirmation is passed, so unattended/CI runs fail
+  // fast rather than silently mutating production — matching enable/disable.
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'configure', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeConfig)(input);
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'configure', opt.app.name, opt.env.type, 'configuration updated', 'update defensive mode config', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('enabled', 'Whether defensive mode should be enabled (true|false). Required.').option('challenge-type', 'Challenge type integer. Required.').option('connection-threshold-absolute', 'Absolute connection threshold that triggers defensive mode.').option('connection-threshold-percentage', 'Connection threshold percentage that triggers defensive mode.').option('non-interactive', 'Disable prompts and browser-open; fail fast if a required flag is missing.', false).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeConfigureCommand);

package/dist/bin/vip-defensive-mode-disable.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeDisableCommand = defensiveModeDisableCommand;
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode disable';
+const exampleUsage = 'vip @example-app.production defensive-mode disable';
+const examples = [{
+  usage: exampleUsage,
+  description: 'Disable defensive mode for the environment.'
+}];
+async function defensiveModeDisableCommand(_args, opt) {
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_disable_command_execute', trackingParams);
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'disable', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeStatus)({
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled: false
+  });
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'disable', opt.app.name, opt.env.type, 'disabled', 'disable defensive mode', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('non-interactive', 'Disable prompts; error if a production mutation is attempted without --skip-confirmation.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeDisableCommand);

package/dist/bin/vip-defensive-mode-enable.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.defensiveModeEnableCommand = defensiveModeEnableCommand;
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var _format = require("../lib/cli/format");
+var _api = require("../lib/defensive-mode/api");
+var _cliHelpers = require("../lib/defensive-mode/cli-helpers");
+var _input = require("../lib/envvar/input");
+var _tracker = require("../lib/tracker");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const baseUsage = 'vip defensive-mode enable';
+const exampleUsage = 'vip @example-app.production defensive-mode enable';
+const examples = [{
+  usage: exampleUsage,
+  description: 'Enable defensive mode for the environment (interactive).'
+}, {
+  usage: `${exampleUsage} --skip-confirmation`,
+  description: 'Enable defensive mode without the production confirmation prompt.'
+}];
+async function defensiveModeEnableCommand(_args, opt) {
+  const trackingParams = {
+    app_id: opt.app.id,
+    command: baseUsage,
+    env_id: opt.env.id,
+    org_id: opt.app.organization.id,
+    org_sfid: opt.app.organization.salesforceId,
+    skip_confirm: Boolean(opt.skipConfirmation)
+  };
+  await (0, _tracker.trackEvent)('defensive_mode_enable_command_execute', trackingParams);
+  await (0, _cliHelpers.guardProductionMutation)(opt, 'enable', trackingParams, _input.confirm, _tracker.trackEvent, _format.formatEnvironment);
+  const result = await (0, _api.updateDefensiveModeStatus)({
+    appId: opt.app.id,
+    envId: opt.env.id,
+    enabled: true
+  });
+  await (0, _cliHelpers.reportMutationResult)(result, trackingParams, 'enable', opt.app.name, opt.env.type, 'enabled', 'enable defensive mode', _tracker.trackEvent);
+}
+(0, _command.default)({
+  appContext: true,
+  appQuery: _api.appQuery,
+  envContext: true,
+  usage: baseUsage
+}).option('skip-confirmation', 'Skip the confirmation prompt for production envs.', false).option('non-interactive', 'Disable prompts; error if a production mutation is attempted without --skip-confirmation.', false).option('rechallenge-wait', 'When step-up verification is required non-interactively, print the URL and wait for verification on another device instead of failing fast.', false).examples(examples).argv(process.argv, defensiveModeEnableCommand);

package/dist/bin/vip-defensive-mode.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+"use strict";
+
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const usage = 'vip defensive-mode';
+const exampleUsage = 'vip @example-app.production defensive-mode';
+const examples = [{
+  usage: `${exampleUsage} enable`,
+  description: 'Enable defensive mode for the environment.'
+}, {
+  usage: `${exampleUsage} disable`,
+  description: 'Disable defensive mode for the environment.'
+}, {
+  usage: `${exampleUsage} configure --enabled=true --challenge-type=1`,
+  description: 'Update the defensive mode configuration non-interactively.'
+}];
+(0, _command.default)({
+  requiredArgs: 1,
+  usage
+}).command('enable', 'Enable defensive mode (step-up auth required).').command('disable', 'Disable defensive mode (step-up auth required).').command('configure', 'Update the defensive mode configuration (step-up auth required).').examples(examples).argv(process.argv);

package/dist/bin/vip.js

@@ -9,6 +9,7 @@ var _command = _interopRequireWildcard(require("../lib/cli/command"));
 var _config = _interopRequireDefault(require("../lib/cli/config"));
 var _internalBinLoader = require("../lib/cli/internal-bin-loader");
 var _seaDispatch = require("../lib/cli/sea-dispatch");
+var _tokenCache = _interopRequireDefault(require("../lib/rechallenge/token-cache"));
 var _token = _interopRequireDefault(require("../lib/token"));
 var _tracker = require("../lib/tracker");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
@@ -42,7 +43,7 @@ async function maybeExecuteSeaTargetCommand() {
 }
 const runCmd = async function () {
   const cmd = (0, _command.default)();
-  cmd.command('logout', 'Log out the current authenticated VIP-CLI user.').command('app', 'Interact with applications that the current authenticated VIP-CLI user has permission to access.').command('backup', 'Generate a backup of an environment.').command('cache', 'Manage page cache for an environment.').command('config', 'Manage environment configurations.').command('dev-env', 'Create and manage VIP Local Development Environments.').command('export', 'Export a copy of data associated with an environment.').command('import', 'Import media or SQL database files to an environment.').command('logs', 'Retrieve Runtime Logs from an environment.').command('search-replace', 'Search for a string in a local SQL file and replace it with a new string.').command('slowlogs', 'Retrieve MySQL slow query logs from an environment.').command('db', "Access an environment's database.").command('sync', 'Sync the database from production to a non-production environment.').command('whoami', 'Retrieve details about the current authenticated VIP-CLI user.').command('wp', 'Execute a WP-CLI command against an environment.');
+  cmd.command('logout', 'Log out the current authenticated VIP-CLI user.').command('app', 'Interact with applications that the current authenticated VIP-CLI user has permission to access.').command('backup', 'Generate a backup of an environment.').command('cache', 'Manage page cache for an environment.').command('config', 'Manage environment configurations.').command('dev-env', 'Create and manage VIP Local Development Environments.').command('export', 'Export a copy of data associated with an environment.').command('import', 'Import media or SQL database files to an environment.').command('logs', 'Retrieve Runtime Logs from an environment.').command('search-replace', 'Search for a string in a local SQL file and replace it with a new string.').command('slowlogs', 'Retrieve MySQL slow query logs from an environment.').command('db', "Access an environment's database.").command('defensive-mode', 'Manage VIP defensive mode for an environment.').command('sync', 'Sync the database from production to a non-production environment.').command('whoami', 'Retrieve details about the current authenticated VIP-CLI user.').command('wp', 'Execute a WP-CLI command against an environment.');
   await cmd.argv(process.argv);
 };
 
@@ -123,6 +124,10 @@ async function runLoginFlow() {
     throw err;
   }
 
+  // Elevated tokens are keyed by API host + scope, not by user identity. Drop any
+  // cached elevation from a previous login so it cannot carry across identities.
+  await _tokenCache.default.clearAll();
+
   // De-anonymize user for tracking
   await (0, _tracker.aliasUser)(token.id);
   await (0, _tracker.trackEvent)('login_command_token_submit_success');

package/dist/lib/api/constants.js

@@ -0,0 +1,7 @@
+"use strict";
+
+exports.__esModule = true;
+exports.PRODUCTION_API_HOST = exports.API_URL = exports.API_HOST = void 0;
+const PRODUCTION_API_HOST = exports.PRODUCTION_API_HOST = 'https://api.wpvip.com';
+const API_HOST = exports.API_HOST = process.env.API_HOST || PRODUCTION_API_HOST; // NOSONAR
+const API_URL = exports.API_URL = `${API_HOST}/graphql`;

package/dist/lib/api/feature-flags.js

@@ -5,9 +5,22 @@ exports.get = get;
 var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
 var _api = _interopRequireDefault(require("../../lib/api"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const api = (0, _api.default)({
-  silenceAuthErrors: true
-});
+// Lazy-initialize the API client so that this module can be imported during the
+// rechallenge module chain without triggering a circular-dependency crash.  The
+// cycle that existed before this change:
+//   api.ts → rechallenge/link.ts → flow.ts → tracker.ts → tracks.ts
+//   → cli/apiConfig.ts → api/feature-flags.ts → api.ts
+// By deferring construction to the first call we ensure api.ts is fully
+// evaluated before API() is invoked.
+let api = null;
+function getApi() {
+  if (!api) {
+    api = (0, _api.default)({
+      silenceAuthErrors: true
+    });
+  }
+  return api;
+}
 const isVipQuery = (0, _graphqlTag.default)`
 	query isVIP {
 		me {
@@ -16,7 +29,7 @@ const isVipQuery = (0, _graphqlTag.default)`
 	}
 `;
 function get() {
-  return api.query({
+  return getApi().query({
     query: isVipQuery,
     fetchPolicy: 'cache-first'
   });

package/dist/lib/api/http.js

@@ -4,7 +4,7 @@ exports.__esModule = true;
 exports.default = void 0;
 var _debug = _interopRequireDefault(require("debug"));
 var _undici = require("undici");
-var _api = require("../../lib/api");
+var _constants = require("./constants");
 var _env = _interopRequireDefault(require("../../lib/env"));
 var _proxyDispatcher = require("../../lib/http/proxy-dispatcher");
 var _token = _interopRequireDefault(require("../../lib/token"));
@@ -31,8 +31,8 @@ var _default = async (path, options = {}) => {
 
   // For convenience, we support just passing in the path to this function...
   // but some things (Apollo) always pass the full url
-  if (!path.startsWith(_api.API_HOST)) {
-    url = `${_api.API_HOST}${path}`;
+  if (!path.startsWith(_constants.API_HOST)) {
+    url = `${_constants.API_HOST}${path}`;
   }
   const authToken = await _token.default.get();
   const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(url);

package/dist/lib/api.js

@@ -1,7 +1,7 @@
 "use strict";
 
 exports.__esModule = true;
-exports.PRODUCTION_API_HOST = exports.API_URL = exports.API_HOST = void 0;
+exports.PRODUCTION_API_HOST = exports.API_HOST = void 0;
 exports.default = API;
 exports.disableGlobalGraphQLErrorHandling = disableGlobalGraphQLErrorHandling;
 exports.enableGlobalGraphQLErrorHandling = enableGlobalGraphQLErrorHandling;
@@ -12,12 +12,16 @@ var _retry = require("@apollo/client/link/retry");
 var _chalk = _interopRequireDefault(require("chalk"));
 var _debug = _interopRequireDefault(require("debug"));
 var _graphql = require("graphql");
+var _constants = require("./api/constants");
+exports.API_URL = _constants.API_URL;
+exports.API_HOST = _constants.API_HOST;
+exports.PRODUCTION_API_HOST = _constants.PRODUCTION_API_HOST;
 var _http = _interopRequireDefault(require("./api/http"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-// Config
-const PRODUCTION_API_HOST = exports.PRODUCTION_API_HOST = 'https://api.wpvip.com';
-const API_HOST = exports.API_HOST = process.env.API_HOST || PRODUCTION_API_HOST; // NOSONAR
-const API_URL = exports.API_URL = `${API_HOST}/graphql`;
+// Config — re-exported from ./api/constants so modules in the rechallenge tree
+// can import them without pulling in the full api.ts graph (which would create
+// a circular dependency via the rechallenge link).
+
 let globalGraphQLErrorHandlingEnabled = true;
 const RETRY_LINK_MAX_ATTEMPTS = 5;
 const RETRY_LINK_INITIAL_DELAY_MS = 1000; // 1 second
@@ -88,10 +92,10 @@ function API({
     uri: operation => {
       // to make it easier to write tests, we'll skip adding x_query for tests
       if (process.env.NODE_ENV === 'test') {
-        return API_URL;
+        return _constants.API_URL;
       }
       const operationName = operation.operationName ?? '';
-      return `${API_URL}?x_query=${encodeURIComponent(operationName)}`;
+      return `${_constants.API_URL}?x_query=${encodeURIComponent(operationName)}`;
     },
     fetch: _http.default
   });
@@ -102,8 +106,19 @@ function API({
     },
     attempts: shouldRetryRequest
   });
+
+  // Lazy-require the rechallenge link to avoid a circular-dependency issue in
+  // Jest tests.  Importing at module top-level would cause rechallenge/client.ts
+  // to be loaded during jest.setupMocks.js (via apiConfig → feature-flags →
+  // api.ts → link.ts → client.ts), preventing jest.mock('../api/http') from
+  // intercepting the http reference captured inside client.ts.  A require()
+  // call inside the function body is resolved after all mocks are registered.
+
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const linkMod = require('./rechallenge/link');
+  const createRechallengeLink = linkMod.default;
   return new _core.ApolloClient({
-    link: _core.ApolloLink.from([errorLink, retryLink, httpLink]),
+    link: _core.ApolloLink.from([errorLink, createRechallengeLink(), retryLink, httpLink]),
     cache: new _core.InMemoryCache({
       typePolicies: {
         WPSite: {

package/dist/lib/cli/internal-bin-loader.js

@@ -28,6 +28,10 @@ const internalBinLoaders = {
   'vip-config-software-update': () => import('../../bin/vip-config-software-update'),
   'vip-db': () => import('../../bin/vip-db'),
   'vip-db-phpmyadmin': () => import('../../bin/vip-db-phpmyadmin'),
+  'vip-defensive-mode': () => import('../../bin/vip-defensive-mode'),
+  'vip-defensive-mode-configure': () => import('../../bin/vip-defensive-mode-configure'),
+  'vip-defensive-mode-disable': () => import('../../bin/vip-defensive-mode-disable'),
+  'vip-defensive-mode-enable': () => import('../../bin/vip-defensive-mode-enable'),
   'vip-dev-env': () => import('../../bin/vip-dev-env'),
   'vip-dev-env-create': () => import('../../bin/vip-dev-env-create'),
   'vip-dev-env-destroy': () => import('../../bin/vip-dev-env-destroy'),

package/dist/lib/defensive-mode/api.js

@@ -0,0 +1,106 @@
+"use strict";
+
+exports.__esModule = true;
+exports.appQuery = void 0;
+exports.updateDefensiveModeConfig = updateDefensiveModeConfig;
+exports.updateDefensiveModeStatus = updateDefensiveModeStatus;
+var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
+var _api = _interopRequireDefault(require("../api"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const appQuery = exports.appQuery = `
+	id
+	name
+	typeId
+	environments {
+		id
+		appId
+		name
+		primaryDomain {
+			name
+		}
+		type
+		defensiveMode {
+			config {
+				effective {
+					enabled
+					challengeType
+					connectionThresholdAbsolute
+					connectionThresholdPercentage
+					disableAtEpoch
+					keepEnabledUnderThresholdForSeconds
+					maxRequestRate
+					priorityBypass
+				}
+				stored {
+					enabled
+					challengeType
+					connectionThresholdAbsolute
+					connectionThresholdPercentage
+				}
+			}
+		}
+	}
+	organization {
+		id
+		name
+		salesforceId
+	}
+`;
+const STATUS_MUTATION = (0, _graphqlTag.default)`
+	mutation UpdateDefensiveModeStatus($input: AppEnvironmentDefensiveModeUpdateStatusInput) {
+		updateDefensiveModeStatus(input: $input) {
+			success
+			message
+		}
+	}
+`;
+const CONFIG_MUTATION = (0, _graphqlTag.default)`
+	mutation UpdateDefensiveModeConfig($input: AppEnvironmentDefensiveModeConfigInput) {
+		updateDefensiveModeConfig(input: $input) {
+			success
+			message
+		}
+	}
+`;
+async function updateDefensiveModeStatus(input) {
+  const api = (0, _api.default)();
+  const result = await api.mutate({
+    mutation: STATUS_MUTATION,
+    variables: {
+      input: {
+        id: input.appId,
+        environmentId: input.envId,
+        enabled: input.enabled
+      }
+    }
+  });
+  if (!result.data) {
+    throw new Error('updateDefensiveModeStatus returned no data; the API may have rejected the request.');
+  }
+  return result.data.updateDefensiveModeStatus;
+}
+async function updateDefensiveModeConfig(input) {
+  const api = (0, _api.default)();
+  const mutationInput = {
+    id: input.appId,
+    environmentId: input.envId,
+    enabled: input.enabled,
+    challengeType: input.challengeType
+  };
+  if (input.connectionThresholdAbsolute !== undefined) {
+    mutationInput.connectionThresholdAbsolute = input.connectionThresholdAbsolute;
+  }
+  if (input.connectionThresholdPercentage !== undefined) {
+    mutationInput.connectionThresholdPercentage = input.connectionThresholdPercentage;
+  }
+  const result = await api.mutate({
+    mutation: CONFIG_MUTATION,
+    variables: {
+      input: mutationInput
+    }
+  });
+  if (!result.data) {
+    throw new Error('updateDefensiveModeConfig returned no data; the API may have rejected the request.');
+  }
+  return result.data.updateDefensiveModeConfig;
+}

package/dist/lib/defensive-mode/cli-helpers.js

@@ -0,0 +1,60 @@
+"use strict";
+
+exports.__esModule = true;
+exports.guardProductionMutation = guardProductionMutation;
+exports.isInteractive = isInteractive;
+exports.reportMutationResult = reportMutationResult;
+var _chalk = _interopRequireDefault(require("chalk"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+function isInteractive(opt) {
+  if (process.env.VIP_NON_INTERACTIVE === '1') {
+    return false;
+  }
+  if (opt.nonInteractive) {
+    return false;
+  }
+  return Boolean(process.stdout.isTTY);
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+/**
+ * Guards production mutations that require confirmation.
+ * Returns when the command should proceed. In non-interactive contexts without
+ * --skip-confirmation it emits an error and calls process.exit(1) directly.
+ * If the user declines the interactive prompt it calls process.exit() directly.
+ */
+async function guardProductionMutation(opt, action, trackingParams, confirmFn, trackEventFn, formatEnvironment) {
+  if (opt.skipConfirmation || opt.env.type !== 'production') {
+    return;
+  }
+  if (!isInteractive(opt)) {
+    console.error(_chalk.default.red(`Refusing to ${action} defensive mode on production without confirmation. ` + 'Pass --skip-confirmation to proceed non-interactively.'));
+    await trackEventFn(`defensive_mode_${action}_command_cancelled`, trackingParams);
+    process.exit(1);
+  }
+  const yes = await confirmFn(`${capitalize(action)} defensive mode on ${formatEnvironment(opt.env.type)} for ${opt.app.name}?`);
+  if (!yes) {
+    await trackEventFn(`defensive_mode_${action}_command_cancelled`, trackingParams);
+    console.log('Command cancelled');
+    process.exit();
+  }
+}
+
+/**
+ * Handles success/failure reporting, telemetry, and log output after a
+ * defensive-mode mutation. Exits the process on failure.
+ */
+async function reportMutationResult(result, trackingParams, action, appName, envType, successVerb, failureVerb, trackEventFn) {
+  if (!result.success) {
+    await trackEventFn(`defensive_mode_${action}_command_error`, {
+      ...trackingParams,
+      error: result.message
+    });
+    console.error(_chalk.default.red(`Failed to ${failureVerb}: ${result.message}`));
+    process.exit(1);
+  }
+  await trackEventFn(`defensive_mode_${action}_command_success`, trackingParams);
+  console.log(_chalk.default.green('✓'), `Defensive mode ${successVerb} for ${appName}.${envType} — ${result.message}`);
+}