@ciphrix/cli 0.1.0 → 0.1.1

package/README.md

@@ -164,7 +164,7 @@ one command. Installed help is authoritative. The complete generated reference i
 - Destructive and consequential actions require confirmation unless `--yes` is explicitly supplied.
 - JSON output is undecorated and suitable for programs and agents.
 - Requests time out, responses are size-limited, and local evidence uploads reject symbolic links and
-  files over 50 MiB.
+  files over 25 MiB.
 
 Please report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
 

package/dist/cli.js

@@ -305,6 +305,8 @@ export const createProgram = (io = createDefaultIO()) => {
         .requiredOption('--type <type>', 'item type: native_doc or check')
         .option('--run <id>', 'a specific run')
         .option('--search <text>', 'filter by item name')
+        .option('--page <n>', 'page number')
+        .option('--limit <n>', 'page size')
         .option('--api-url <url>', 'override the API base URL for this command')
         .option('--json', 'output raw JSON')
         .action(async (name, options) => {
@@ -314,6 +316,8 @@ export const createProgram = (io = createDefaultIO()) => {
             runId: readStringOption(options, 'run'),
             itemType: readStringOption(options, 'type') ?? 'native_doc',
             search: readStringOption(options, 'search'),
+            page: readNumberOption(options, 'page'),
+            limit: readNumberOption(options, 'limit'),
             apiUrl: readStringOption(options, 'apiUrl'),
             json: readBooleanOption(options, 'json'),
         });
@@ -454,6 +458,8 @@ export const createProgram = (io = createDefaultIO()) => {
         .description('List items that can be mapped to a clause')
         .requiredOption('--type <type>', 'item type: test or document')
         .option('--search <text>', 'filter by item name')
+        .option('--page <n>', 'page number')
+        .option('--limit <n>', 'page size')
         .option('--api-url <url>', 'override the API base URL for this command')
         .option('--json', 'output raw JSON')
         .action(async (frameworkName, clause, options) => {
@@ -463,6 +469,8 @@ export const createProgram = (io = createDefaultIO()) => {
             clause,
             itemType: readStringOption(options, 'type') ?? 'test',
             search: readStringOption(options, 'search'),
+            page: readNumberOption(options, 'page'),
+            limit: readNumberOption(options, 'limit'),
             apiUrl: readStringOption(options, 'apiUrl'),
             json: readBooleanOption(options, 'json'),
         });
@@ -523,10 +531,13 @@ export const createProgram = (io = createDefaultIO()) => {
         .command('list')
         .description('List assets with their code, status and classification')
         .option('--name <text>', 'filter by name')
-        .option('--category <value>', 'filter by category')
+        .option('--category <csv>', 'filter by category')
+        .option('--sub-category <csv>', 'filter by sub-category')
         .option('--status <csv>', 'filter by status')
-        .option('--business-impact <value>', 'filter by business impact')
-        .option('--data-classification <value>', 'filter by data classification')
+        .option('--business-impact <csv>', 'filter by business impact')
+        .option('--data-classification <csv>', 'filter by data classification')
+        .option('--source <csv>', 'filter by discovery source (provider, e.g. aws, azure, gcp)')
+        .option('--technical-owner-email <email>', 'filter by technical owner email')
         .option('--page <n>', 'page number')
         .option('--limit <n>', 'page size')
         .option('--api-url <url>', 'override the API base URL for this command')
@@ -536,9 +547,12 @@ export const createProgram = (io = createDefaultIO()) => {
             io,
             name: readStringOption(options, 'name'),
             category: readStringOption(options, 'category'),
+            subCategory: readStringOption(options, 'subCategory'),
             status: readStringOption(options, 'status'),
             businessImpact: readStringOption(options, 'businessImpact'),
             dataClassification: readStringOption(options, 'dataClassification'),
+            source: readStringOption(options, 'source'),
+            technicalOwnerEmail: readStringOption(options, 'technicalOwnerEmail'),
             page: readNumberOption(options, 'page'),
             limit: readNumberOption(options, 'limit'),
             apiUrl: readStringOption(options, 'apiUrl'),
@@ -756,7 +770,10 @@ export const createProgram = (io = createDefaultIO()) => {
         .description('Create a vendor')
         .requiredOption('--name <name>', 'vendor name')
         .option('--category <value>', 'category')
+        .option('--subcategory <value>', 'sub-category')
         .option('--criticality <value>', 'criticality')
+        .option('--data-sensitivity <value>', 'data sensitivity')
+        .option('--service-availability <value>', 'service availability')
         .option('--description <text>', 'description')
         .option('--api-url <url>', 'override the API base URL for this command')
         .option('--json', 'output raw JSON')
@@ -765,7 +782,10 @@ export const createProgram = (io = createDefaultIO()) => {
             io,
             name: readStringOption(options, 'name') ?? '',
             category: readStringOption(options, 'category'),
+            subcategory: readStringOption(options, 'subcategory'),
             criticality: readStringOption(options, 'criticality'),
+            dataSensitivity: readStringOption(options, 'dataSensitivity'),
+            serviceAvailability: readStringOption(options, 'serviceAvailability'),
             description: readStringOption(options, 'description'),
             apiUrl: readStringOption(options, 'apiUrl'),
             json: readBooleanOption(options, 'json'),
@@ -836,6 +856,7 @@ export const createProgram = (io = createDefaultIO()) => {
         .option('--domain <value>', 'filter by control domain')
         .option('--status <csv>', 'filter by status')
         .option('--applicability <value>', 'filter by applicability (in_scope|out_of_scope)')
+        .option('--owner <csv>', 'filter by owner user id')
         .option('--page <n>', 'page number')
         .option('--limit <n>', 'page size')
         .option('--api-url <url>', 'override the API base URL for this command')
@@ -847,6 +868,7 @@ export const createProgram = (io = createDefaultIO()) => {
             domain: readStringOption(options, 'domain'),
             status: readStringOption(options, 'status'),
             applicability: readStringOption(options, 'applicability'),
+            ownerId: readStringOption(options, 'owner'),
             page: readNumberOption(options, 'page'),
             limit: readNumberOption(options, 'limit'),
             apiUrl: readStringOption(options, 'apiUrl'),
@@ -914,6 +936,7 @@ export const createProgram = (io = createDefaultIO()) => {
         .option('--justification <text>', 'why the applicability changed')
         .option('--design-requirements <state>', 'not_assessed | not_needed | not_met | partial | met')
         .option('--notes <text>', 'notes (Markdown)')
+        .option('--description <text>', 'description (custom controls only)')
         .option('--rename <text>', 'new name (custom controls only)')
         .option('--yes', 'apply without prompting')
         .option('--api-url <url>', 'override the API base URL for this command')
@@ -928,6 +951,7 @@ export const createProgram = (io = createDefaultIO()) => {
             ['justification', 'justification'],
             ['designRequirements', 'designRequirements'],
             ['notes', 'notes'],
+            ['description', 'description'],
             ['rename', 'name'],
         ]) {
             const value = readStringOption(options, flag);

package/dist/commands/asset.d.ts

@@ -6,12 +6,15 @@ export interface AssetCommonOptions {
     json?: boolean | undefined;
     credentialStore?: CredentialStore | undefined;
 }
-export declare const assetListCommand: ({ io, apiUrl, json, credentialStore, name, category, status, businessImpact, dataClassification, page, limit, }: AssetCommonOptions & {
+export declare const assetListCommand: ({ io, apiUrl, json, credentialStore, name, category, subCategory, status, businessImpact, dataClassification, source, technicalOwnerEmail, page, limit, }: AssetCommonOptions & {
     name?: string | undefined;
     category?: string | undefined;
+    subCategory?: string | undefined;
     status?: string | undefined;
     businessImpact?: string | undefined;
     dataClassification?: string | undefined;
+    source?: string | undefined;
+    technicalOwnerEmail?: string | undefined;
     page?: number | undefined;
     limit?: number | undefined;
 }) => Promise<void>;

package/dist/commands/asset.js

@@ -2,22 +2,29 @@ import { applyTool } from '../actions.js';
 import { writeLine, writeNextHint, writePageFooter, writeTable, clip } from '../io.js';
 import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
 const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
-export const assetListCommand = async ({ io, apiUrl, json = false, credentialStore, name, category, status, businessImpact, dataClassification, page, limit, }) => {
+export const assetListCommand = async ({ io, apiUrl, json = false, credentialStore, name, category, subCategory, status, businessImpact, dataClassification, source, technicalOwnerEmail, page, limit, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const csv = (value) => value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
     const input = {};
     if (name)
         input.name = name;
     if (category)
-        input.category = [category];
+        input.category = csv(category);
+    if (subCategory)
+        input.subCategory = csv(subCategory);
     if (status)
-        input.status = status
-            .split(',')
-            .map((value) => value.trim())
-            .filter(Boolean);
+        input.status = csv(status);
     if (businessImpact)
-        input.businessImpact = [businessImpact];
+        input.businessImpact = csv(businessImpact);
     if (dataClassification)
-        input.dataClassification = [dataClassification];
+        input.dataClassification = csv(dataClassification);
+    if (source)
+        input.source = csv(source);
+    if (technicalOwnerEmail)
+        input.technicalOwnerEmail = technicalOwnerEmail;
     if (page)
         input.page = page;
     if (limit)

package/dist/commands/context.js

@@ -68,15 +68,17 @@ export const contextSetCommand = async ({ io, apiUrl, json = false, target, valu
     if (!questionId)
         throw new Error('A question id is required, for example business.company_size');
     const ctx = await resolveToolContext(apiUrl, credentialStore);
-    const envelope = await callTool(ctx, 'set_context_answer', {
-        store,
-        questionId,
-        value: parseValue(value),
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'set_context_answer',
+        input: { store, questionId, value: parseValue(value) },
+        fallback: 'Could not save the answer.',
     });
-    if (envelope.status !== 'ok')
-        throw new Error(errorMessage(envelope, 'Could not save the answer.'));
+    if (!result)
+        return;
     if (json) {
-        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
         return;
     }
     writeLine(io.stdout, `${io.theme.green('✓')} ${store}.${questionId} saved`);

package/dist/commands/control.d.ts

@@ -9,11 +9,12 @@ export interface ControlCommonOptions {
 export interface ControlReadOptions extends ControlCommonOptions {
     name: string;
 }
-export declare const controlListCommand: ({ io, apiUrl, json, credentialStore, search, domain, status, applicability, page, limit, }: ControlCommonOptions & {
+export declare const controlListCommand: ({ io, apiUrl, json, credentialStore, search, domain, status, applicability, ownerId, page, limit, }: ControlCommonOptions & {
     search?: string | undefined;
     domain?: string | undefined;
     status?: string | undefined;
     applicability?: string | undefined;
+    ownerId?: string | undefined;
     page?: number | undefined;
     limit?: number | undefined;
 }) => Promise<void>;

package/dist/commands/control.js

@@ -2,7 +2,7 @@ import { applyTool } from '../actions.js';
 import { writeLine, writeNextHint, writePageFooter, writeTable } from '../io.js';
 import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
 const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
-export const controlListCommand = async ({ io, apiUrl, json = false, credentialStore, search, domain, status, applicability, page, limit, }) => {
+export const controlListCommand = async ({ io, apiUrl, json = false, credentialStore, search, domain, status, applicability, ownerId, page, limit, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);
     const input = {};
     if (search)
@@ -16,6 +16,11 @@ export const controlListCommand = async ({ io, apiUrl, json = false, credentialS
             .filter(Boolean);
     if (applicability)
         input.applicability = [applicability];
+    if (ownerId)
+        input.ownerId = ownerId
+            .split(',')
+            .map((value) => value.trim())
+            .filter(Boolean);
     if (page)
         input.page = page;
     if (limit)
@@ -145,6 +150,16 @@ export const controlAvailableItemsCommand = async ({ io, name, itemType, apiUrl,
         const record = asRecord(item);
         return [text(record.name, text(record.id)), text(record.status)];
     }));
+    const total = typeof data.total === 'number' ? data.total : items.length;
+    const currentPage = typeof data.page === 'number' ? data.page : 1;
+    const pageSize = typeof data.limit === 'number' ? data.limit : 25;
+    writePageFooter(io, {
+        shown: items.length,
+        total,
+        page: currentPage,
+        limit: pageSize,
+        hasMore: data.hasMore === true || currentPage * pageSize < total,
+    });
 };
 export const controlUpdateCommand = async ({ io, name, apiUrl, json = false, yes = false, confirm, credentialStore, changes, }) => {
     if (Object.keys(changes).length === 0) {

package/dist/commands/framework.d.ts

@@ -24,9 +24,11 @@ export declare const frameworkClausesCommand: ({ io, framework, apiUrl, json, cr
 }) => Promise<void>;
 export declare const clauseGetCommand: ({ io, framework, clause, apiUrl, json, credentialStore, }: ClauseTargetOptions) => Promise<void>;
 export declare const clauseItemsCommand: ({ io, framework, clause, apiUrl, json, credentialStore, }: ClauseTargetOptions) => Promise<void>;
-export declare const clauseAvailableItemsCommand: ({ io, framework, clause, itemType, apiUrl, json, credentialStore, search, }: ClauseTargetOptions & {
+export declare const clauseAvailableItemsCommand: ({ io, framework, clause, itemType, apiUrl, json, credentialStore, search, page, limit, }: ClauseTargetOptions & {
     itemType: string;
     search?: string | undefined;
+    page?: number | undefined;
+    limit?: number | undefined;
 }) => Promise<void>;
 export declare const clauseUpdateCommand: ({ io, framework, clause, changes, apiUrl, json, yes, credentialStore, }: ClauseTargetOptions & {
     changes: Record<string, unknown>;

package/dist/commands/framework.js

@@ -1,4 +1,4 @@
-import { writeLine, writeNextHint, writeTable } from '../io.js';
+import { writeLine, writeNextHint, writePageFooter, writeTable } from '../io.js';
 import { asRecord, callTool, errorMessage, resolveToolContext, asText } from '../toolSurface.js';
 const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
 export const frameworkListCommand = async ({ io, apiUrl, json = false, credentialStore, }) => {
@@ -118,11 +118,15 @@ export const clauseItemsCommand = async ({ io, framework, clause, apiUrl, json =
         return [text(record.name, text(record.id)), text(record.itemType ?? record.type)];
     }));
 };
-export const clauseAvailableItemsCommand = async ({ io, framework, clause, itemType, apiUrl, json = false, credentialStore, search, }) => {
+export const clauseAvailableItemsCommand = async ({ io, framework, clause, itemType, apiUrl, json = false, credentialStore, search, page, limit, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);
     const input = { framework, clause, itemType };
     if (search)
         input.search = search;
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
     const envelope = await callTool(ctx, 'list_clause_items_available', input);
     if (envelope.status !== 'ok')
         throw new Error(errorMessage(envelope, 'Could not read available items.'));
@@ -130,13 +134,24 @@ export const clauseAvailableItemsCommand = async ({ io, framework, clause, itemT
         writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
         return;
     }
-    const items = asRecord(envelope.data).items;
+    const data = asRecord(envelope.data);
+    const items = data.items;
     const list = Array.isArray(items) ? items : [];
     writeLine(io.stdout, `${io.theme.bold(`Available ${itemType}s`)} ${io.theme.dim(`(${list.length})`)}`);
     for (const item of list) {
         const record = asRecord(item);
         writeLine(io.stdout, `  ${text(record.name, text(record.id))}`);
     }
+    const total = typeof data.total === 'number' ? data.total : list.length;
+    const currentPage = typeof data.page === 'number' ? data.page : 1;
+    const pageSize = typeof data.limit === 'number' ? data.limit : 25;
+    writePageFooter(io, {
+        shown: list.length,
+        total,
+        page: currentPage,
+        limit: pageSize,
+        hasMore: data.hasMore === true || currentPage * pageSize < total,
+    });
 };
 export const clauseUpdateCommand = async ({ io, framework, clause, changes, apiUrl, json = false, yes = false, credentialStore, }) => {
     const { applyTool } = await import('../actions.js');

package/dist/commands/policy.js

@@ -20,7 +20,7 @@ export const policyListCommand = async ({ io, apiUrl, json = false, name, status
     if (envelope.status !== 'ok')
         throw new Error(errorMessage(envelope, 'Could not list documents.'));
     if (json) {
-        writeLine(io.stdout, JSON.stringify(envelope, null, 2));
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
         return;
     }
     const data = asRecord(envelope.data);

package/dist/commands/test.d.ts

@@ -41,9 +41,11 @@ export interface TestAttachOptions extends TestReadOptions {
     unlink?: boolean | undefined;
 }
 export declare const testAttachCommand: ({ io, name, runId, apiUrl, json, credentialStore, itemType, itemId, uploadIds, file, unlink, }: TestAttachOptions) => Promise<void>;
-export declare const testAvailableItemsCommand: ({ io, name, runId, itemType, apiUrl, json, credentialStore, search, }: TestReadOptions & {
+export declare const testAvailableItemsCommand: ({ io, name, runId, itemType, apiUrl, json, credentialStore, search, page, limit, }: TestReadOptions & {
     itemType: string;
     search?: string | undefined;
+    page?: number | undefined;
+    limit?: number | undefined;
 }) => Promise<void>;
 export declare const testLinksCommand: ({ io, name, apiUrl, json, credentialStore, }: TestReadOptions) => Promise<void>;
 export declare const testUpdateCommand: ({ io, name, apiUrl, json, yes, confirm, credentialStore, changes, }: TestReadOptions & {

package/dist/commands/test.js

@@ -235,13 +235,17 @@ export const testAttachCommand = async ({ io, name, runId, apiUrl, json = false,
     const job = asText(data.aiTaskId);
     writeLine(io.stdout, `${io.theme.green('✓')} ${unlink ? 'unlinked' : 'linked'} ${resolvedItemType} on run ${text(data.runId)}${job ? io.theme.dim(` · job ${job}`) : ''}`);
 };
-export const testAvailableItemsCommand = async ({ io, name, runId, itemType, apiUrl, json = false, credentialStore, search, }) => {
+export const testAvailableItemsCommand = async ({ io, name, runId, itemType, apiUrl, json = false, credentialStore, search, page, limit, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);
     const input = { name, itemType };
     if (runId)
         input.runId = runId;
     if (search)
         input.search = search;
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
     const envelope = await callTool(ctx, 'list_test_items_available', input);
     if (envelope.status !== 'ok')
         throw new Error(errorMessage(envelope, 'Could not read available items.'));
@@ -264,6 +268,16 @@ export const testAvailableItemsCommand = async ({ io, name, runId, itemType, api
             text(record.status),
         ];
     }));
+    const total = typeof data.total === 'number' ? data.total : items.length;
+    const currentPage = typeof data.page === 'number' ? data.page : 1;
+    const pageSize = typeof data.limit === 'number' ? data.limit : 25;
+    writePageFooter(io, {
+        shown: items.length,
+        total,
+        page: currentPage,
+        limit: pageSize,
+        hasMore: data.hasMore === true || currentPage * pageSize < total,
+    });
 };
 export const testLinksCommand = async ({ io, name, apiUrl, json = false, credentialStore, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);

package/dist/commands/vendor.d.ts

@@ -22,10 +22,13 @@ export declare const vendorListCommand: ({ io, apiUrl, json, credentialStore, na
     limit?: number | undefined;
 }) => Promise<void>;
 export declare const vendorGetCommand: ({ io, name, apiUrl, json, credentialStore, }: VendorReadOptions) => Promise<void>;
-export declare const vendorCreateCommand: ({ io, apiUrl, json, credentialStore, name, category, criticality, description, }: VendorCommonOptions & {
+export declare const vendorCreateCommand: ({ io, apiUrl, json, credentialStore, name, category, subcategory, criticality, dataSensitivity, serviceAvailability, description, }: VendorCommonOptions & {
     name: string;
     category?: string | undefined;
+    subcategory?: string | undefined;
     criticality?: string | undefined;
+    dataSensitivity?: string | undefined;
+    serviceAvailability?: string | undefined;
     description?: string | undefined;
 }) => Promise<void>;
 export interface VendorUpdateOptions extends VendorReadOptions {

package/dist/commands/vendor.js

@@ -78,13 +78,19 @@ export const vendorGetCommand = async ({ io, name, apiUrl, json = false, credent
         writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${text(value)}`);
     }
 };
-export const vendorCreateCommand = async ({ io, apiUrl, json = false, credentialStore, name, category, criticality, description, }) => {
+export const vendorCreateCommand = async ({ io, apiUrl, json = false, credentialStore, name, category, subcategory, criticality, dataSensitivity, serviceAvailability, description, }) => {
     const ctx = await resolveToolContext(apiUrl, credentialStore);
     const input = { name };
     if (category)
         input.category = category;
+    if (subcategory)
+        input.subcategory = subcategory;
     if (criticality)
         input.criticality = criticality;
+    if (dataSensitivity)
+        input.dataSensitivity = dataSensitivity;
+    if (serviceAvailability)
+        input.serviceAvailability = serviceAvailability;
     if (description)
         input.description = description;
     const result = await applyTool({

package/dist/constants.d.ts

@@ -4,4 +4,4 @@
  */
 export declare const CLI_NAME = "ciphrix";
 export declare const CLI_TAGLINE = "Ciphrix compliance platform CLI";
-export declare const CLI_VERSION = "0.1.0";
+export declare const CLI_VERSION = "0.1.1";

package/dist/constants.js

@@ -4,4 +4,4 @@
  */
 export const CLI_NAME = 'ciphrix';
 export const CLI_TAGLINE = 'Ciphrix compliance platform CLI';
-export const CLI_VERSION = '0.1.0';
+export const CLI_VERSION = '0.1.1';

package/dist/toolSurface.d.ts

@@ -17,4 +17,12 @@ export interface CallToolOptions {
     confirmationToken?: string | undefined;
     idempotencyKey?: string | undefined;
 }
+/**
+ * The tool surface requires an idempotency key on every write and rejects a write without one. Writes
+ * must go through `applyTool`, which supplies the key and handles the preflight/confirmation contract.
+ * This set is the CLI-side mirror of the tool surface's write effects, so a write cannot be issued as a
+ * bare read-style call again. Keep it in step with the write tools the CLI exposes (ideally derived from
+ * the manifest once the CLI consumes it).
+ */
+export declare const WRITE_TOOL_NAMES: ReadonlySet<string>;
 export declare const callTool: (ctx: ToolContext, toolName: string, input: unknown, options?: CallToolOptions) => Promise<Record<string, unknown>>;

package/dist/toolSurface.js

@@ -34,7 +34,52 @@ export const resolveToolContext = async (apiUrl, store) => {
         throw new Error('Not signed in. Run `ciphrix login` first.');
     return { baseUrl, client: createApiClient(baseUrl), token: credential.token };
 };
+/**
+ * The tool surface requires an idempotency key on every write and rejects a write without one. Writes
+ * must go through `applyTool`, which supplies the key and handles the preflight/confirmation contract.
+ * This set is the CLI-side mirror of the tool surface's write effects, so a write cannot be issued as a
+ * bare read-style call again. Keep it in step with the write tools the CLI exposes (ideally derived from
+ * the manifest once the CLI consumes it).
+ */
+export const WRITE_TOOL_NAMES = new Set([
+    'set_context_answer',
+    'reset_context',
+    'create_document',
+    'edit_document_content',
+    'create_document_version',
+    'update_document',
+    'submit_document',
+    'approve_document',
+    'delete_document',
+    'create_test_run',
+    'set_test_run_status',
+    'delete_test_run',
+    'attach_run_item',
+    'update_test',
+    'delete_test',
+    'update_clause',
+    'link_clause_item',
+    'update_control',
+    'link_control_item',
+    'create_vendor',
+    'update_vendor',
+    'delete_vendor',
+    'link_vendor_file',
+    'create_risk',
+    'update_risk',
+    'delete_risk',
+    'link_risk_control',
+    'link_risk_file',
+    'set_check_enabled',
+    'create_asset',
+    'update_asset',
+    'delete_asset',
+    'set_asset_tag',
+]);
 export const callTool = async (ctx, toolName, input, options = {}) => {
+    if (WRITE_TOOL_NAMES.has(toolName) && !options.idempotencyKey) {
+        throw new Error(`Refusing to call the write tool '${toolName}' without an idempotency key. Use applyTool.`);
+    }
     const body = { input };
     if (options.confirmationToken)
         body.confirmationToken = options.confirmationToken;

package/dist/upload.d.ts

@@ -1,5 +1,5 @@
 import { type ToolContext } from './toolSurface.js';
-/** Maximum evidence file size read and staged by the CLI (50 MiB). */
+/** Maximum evidence file size read and staged by the CLI (25 MiB, matching the tool surface). */
 export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
 export interface UploadLimits {
     maxUploadBytes?: number;

package/dist/upload.js

@@ -19,8 +19,8 @@ const MIME_TYPES = {
     '.xls': 'application/vnd.ms-excel',
     '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 };
-/** Maximum evidence file size read and staged by the CLI (50 MiB). */
-export const DEFAULT_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+/** Maximum evidence file size read and staged by the CLI (25 MiB, matching the tool surface). */
+export const DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const readUploadFile = async (filePath, maxBytes) => {
     const initialStat = await lstat(filePath);
     if (initialStat.isSymbolicLink() || !initialStat.isFile()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ciphrix/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Official command-line interface for the Ciphrix compliance platform.",
   "type": "module",
   "license": "Apache-2.0",

package/skills/ciphrix/references/commands.md

@@ -340,6 +340,8 @@ Options:
   --type <type>    item type: native_doc or check
   --run <id>       a specific run
   --search <text>  filter by item name
+  --page <n>       page number
+  --limit <n>      page size
   --api-url <url>  override the API base URL for this command
   --json           output raw JSON
   -h, --help       display help for command
@@ -485,6 +487,8 @@ List items that can be mapped to a clause
 Options:
   --type <type>    item type: test or document
   --search <text>  filter by item name
+  --page <n>       page number
+  --limit <n>      page size
   --api-url <url>  override the API base URL for this command
   --json           output raw JSON
   -h, --help       display help for command
@@ -560,16 +564,20 @@ Usage: ciphrix asset list [options]
 List assets with their code, status and classification
 
 Options:
-  --name <text>                  filter by name
-  --category <value>             filter by category
-  --status <csv>                 filter by status
-  --business-impact <value>      filter by business impact
-  --data-classification <value>  filter by data classification
-  --page <n>                     page number
-  --limit <n>                    page size
-  --api-url <url>                override the API base URL for this command
-  --json                         output raw JSON
-  -h, --help                     display help for command
+  --name <text>                    filter by name
+  --category <csv>                 filter by category
+  --sub-category <csv>             filter by sub-category
+  --status <csv>                   filter by status
+  --business-impact <csv>          filter by business impact
+  --data-classification <csv>      filter by data classification
+  --source <csv>                   filter by discovery source (provider, e.g.
+                                   aws, azure, gcp)
+  --technical-owner-email <email>  filter by technical owner email
+  --page <n>                       page number
+  --limit <n>                      page size
+  --api-url <url>                  override the API base URL for this command
+  --json                           output raw JSON
+  -h, --help                       display help for command
 ```
 
 ## `ciphrix asset get`
@@ -766,13 +774,16 @@ Usage: ciphrix vendor create [options]
 Create a vendor
 
 Options:
-  --name <name>          vendor name
-  --category <value>     category
-  --criticality <value>  criticality
-  --description <text>   description
-  --api-url <url>        override the API base URL for this command
-  --json                 output raw JSON
-  -h, --help             display help for command
+  --name <name>                   vendor name
+  --category <value>              category
+  --subcategory <value>           sub-category
+  --criticality <value>           criticality
+  --data-sensitivity <value>      data sensitivity
+  --service-availability <value>  service availability
+  --description <text>            description
+  --api-url <url>                 override the API base URL for this command
+  --json                          output raw JSON
+  -h, --help                      display help for command
 ```
 
 **Effect:** Creates a vendor; the CLI prompts if the API requests confirmation.
@@ -898,6 +909,7 @@ Options:
   --domain <value>         filter by control domain
   --status <csv>           filter by status
   --applicability <value>  filter by applicability (in_scope|out_of_scope)
+  --owner <csv>            filter by owner user id
   --page <n>               page number
   --limit <n>              page size
   --api-url <url>          override the API base URL for this command
@@ -965,6 +977,7 @@ Options:
   --design-requirements <state>  not_assessed | not_needed | not_met | partial |
                                  met
   --notes <text>                 notes (Markdown)
+  --description <text>           description (custom controls only)
   --rename <text>                new name (custom controls only)
   --yes                          apply without prompting
   --api-url <url>                override the API base URL for this command