@knowttl/artium-axi 0.0.19 → 0.0.21

package/README.md

@@ -46,6 +46,7 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 | AWX | Pasted token or one-time password sign-in; optional operational writes |
 | Tenable One | Access and secret API keys; optional allow-listed business writes and export jobs |
 | Hybrid Analysis | Managed API key; investigation reads and optional allow-listed submissions, YARA mutations and consuming matches |
+| Check Point Email Security | Regional client credentials; email, event, task and exception reads, guarded writes and authenticated email/attachment saving |
 
 [Package pins](tools/package.json) and the [Falcon source pin](tools/falcon-source.json) own bundled versions; [reviewed inventories](tools/inventories) define the supported command boundary.
 
@@ -169,10 +170,20 @@ Administrators can opt in to the single read-only `security hunting query` comma
 Hunting accepts exactly one UTF-8 plain-text upload named `query.kql`, at most 64 KiB, through `artium-axi mg-axi security hunting query --file query.kql`.
 See [client input handling](docs/client-reference.md#command-surface-and-subcommands) for local file paths and upload restrictions.
 Queries must use the upstream restricted read-only KQL subset.
+Hunting parses KQL before the read-only allowlist and upstream authentication; syntax errors return positioned diagnostics without query excerpts or quoted literals.
+Parsing does not check tables, columns, types or permissions; recognized Graph 400 errors expose only the error class and line/column, while unknown error shapes remain opaque.
 The existing mg-axi role grant is required; other security commands remain unavailable.
 See [Graph credential setup](docs/tool-credentials.md#microsoft-graph) for hunting permissions and consent; tenant acceptance remains unverified.
 
+Azure Resource Graph and Log Analytics queries parse KQL before upstream authentication or requests, returning positioned syntax diagnostics and query excerpts on failure.
+Successful parsing does not validate tables, columns, functions, permissions or service-specific restrictions.
+
 Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
+NG-SIEM `search start` checks CQL structure before upstream authentication, reporting code, line, column and token class without echoing query text; function names, fields and semantics remain unchecked, and ambiguous syntax passes.
+Rejected searches preserve redacted server diagnostics, completed searches include server warnings when present, and `search start --wait` advises when the normalized filter differs.
+
+Vectra `host show` and `entity show --type host`, plus the matching raw host reads, retain every returned API field under `host`, separate from CLI metadata.
+Use `--full` on host/entity detail commands for complete returned text; secret redaction still applies, and upstream omissions cannot be restored.
 
 Vectra supports selected QUX/RUX writes for detection close/open and mark-fixed, host/account close, key assets, tags, notes (including bulk notes), assignments and outcomes, triage labels and rules, groups and membership, proxies, threat feeds, internal-network settings, syslog/Kafka, notification destinations and Match, subject to deployment support in the [reviewed inventory](tools/inventories/vectra-axi.json).
 User, role, API-client and credential administration remains blocked.
@@ -189,6 +200,7 @@ See [client input handling](docs/client-reference.md#command-surface-and-subcomm
 | Azure DevOps | Reviewed mutations with administrator `allowWrites: true`; raw `api` remains GET-only. |
 | AWX | Launch/cancel/relaunch, workflow approval/denial, project/inventory-source sync and notification tests with `allowWrites: true` and upstream `--confirm`; configuration, deletion and security writes stay blocked. |
 | Tenable One | Business writes and export-job creation with administrator `writes.allowWrites: true`, an explicit operations allow-list, native preview, `--execute`, exact `--confirm` and durable journaling; downloads and local configuration stay blocked. |
+| Check Point Email Security | Email and exception writes require administrator `writes.allowWrites: true`, exact selected operations and native preview, execute, confirmation and journal gates. Name-only event actions require their exact `event.action.<name>` scope. The six malware/URL/DLP remove/clear operations and click-time clear remain refused. Three separately selected downloads use [authenticated CLI saving](docs/client-reference.md#check-point-email-and-attachment-saving) with host-owned confirmation and independent SHA-256 verification; native download journal fields remain empty. Ordinary tool-run downloads and credential/origin overrides stay blocked. Live API contracts remain uncommissioned. |
 | Hybrid Analysis | Sandbox submissions, YARA create/update/delete, consuming hunting matches and the four reviewed archive downloads require administrator `writes.allowWrites: true`, independently selected operations, native preview, `--execute`, exact `--confirm` and durable journaling. Downloads are limited to `hash-download-bin`, `report-download-bin`, `report-download-dropped-files` and `report-download-memory`, through the [authenticated CLI verified-save path](docs/client-reference.md#hybrid-analysis-archive-saving) after the [operator prerequisites](docs/runbook.md#scope-and-prerequisites) pass. All operations default off; enabling other writes never enables downloads or grants upstream entitlement. The browser provides warnings, command guidance and metadata/save status only. Ordinary tool-run downloads, local configuration and credential/origin overrides are blocked. |
 
 Hybrid Analysis quick scans transmit the supplied sample or URL as read exceptions without a write gate; sandbox submission previews disclose that samples and reports can become visible to the community.
@@ -211,6 +223,7 @@ After an unknown write outcome, inspect state using returned guidance before ret
 | AWX job list | Token identity with job read access |
 | Tenable One card list | See [Tenable One credential permissions](docs/tool-credentials.md#tenable-one). |
 | Hybrid Analysis quota | A valid API key; resource permissions vary by key level. See [Hybrid Analysis setup](docs/tool-credentials.md#hybrid-analysis). |
+| Check Point doctor | Regional authentication and one bounded email search. See [Check Point setup and commissioning](docs/tool-credentials.md#check-point-email-security). |
 
 See [tool credentials](docs/tool-credentials.md) for dedicated identities, permissions and safe credential entry.
 Artium stores shared service credentials encrypted with AES-256-GCM and never returns saved secrets to clients.
@@ -251,9 +264,9 @@ This summary follows the [CLI help registry](src/cli/help.ts); `artium-axi --hel
 | `tools` / `tools show <tool>` | Granted enabled tools / pinned help and first call |
 | `doctor` | Server, TLS, token, version and cached health; five-second request deadlines |
 | `update` | Update the [server-downloaded client](#verified-client) |
-| `download` | Preview and explicitly verify/save administrator-selected Hybrid Analysis archives through the local CLI. Run `artium-axi download --help` for guards and warnings. |
+| `download` | Preview and explicitly verify/save administrator-selected Hybrid Analysis archives and Check Point emails/attachments through the local CLI. Run `artium-axi download --help` for guards and warnings. |
 | `setup --host <host>` | Install managed skills and optional Claude hook |
-| `<tool> <args>` | Run any of the nine managed tools above |
+| `<tool> <args>` | Run any of the ten managed tools above |
 | `--managed-session --help` | Private-pipe session protocol |
 
 `artium-axi --help falcon-axi` is local help; `artium-axi falcon-axi --help` authenticates and calls upstream.

package/bin/artium-axi.mjs

@@ -19801,8 +19801,14 @@ var transferSelectionSchema = external_exports.discriminatedUnion("operation", [
   external_exports.strictObject({ operation: external_exports.literal("hash-download-bin"), selector: sampleSha256Schema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-bin"), selector: reportIdSchema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-dropped-files"), selector: reportIdSchema, type: external_exports.literal("dropped-files") }),
-  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") })
+  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") }),
+  external_exports.strictObject({ operation: external_exports.literal("email.download"), selector: transferOwnerIdSchema, type: external_exports.enum(["email", "original"]) }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download"), selector: external_exports.string().regex(/^[A-Za-z0-9_-]{1,256}\/[A-Za-z0-9_-]{1,256}$/), type: external_exports.literal("attachment") }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download-all"), selector: transferOwnerIdSchema, type: external_exports.literal("zip") })
 ]);
+function transferTool(operation) {
+  return ["email.download", "attachment.download", "attachment.download-all"].includes(operation) ? "checkpoint-axi" : "hybrid-axi";
+}
 var transferPrepareSchema = external_exports.strictObject({ selection: transferSelectionSchema, targetDigest: sha256Schema });
 var transferIdSchema = external_exports.uuid();
 var transferScopeSchema = external_exports.strictObject({
@@ -19865,12 +19871,18 @@ var transferRoutes = {
   cancel: { method: "POST", path: "/v1/transfers/hybrid/cancel", input: transferRetrieveSchema },
   status: { method: "POST", path: "/v1/transfers/hybrid/status", input: transferRetrieveSchema, response: transferStatusSchema }
 };
+function transferRoutesFor(tool) {
+  return Object.fromEntries(Object.entries(transferRoutes).map(([name, route]) => [
+    name,
+    { ...route, path: route.path.replace("/hybrid/", tool === "checkpoint-axi" ? "/checkpoint/" : "/hybrid/") }
+  ]));
+}
 var transferAuditSchema = external_exports.strictObject({
   transfer_id: transferIdSchema,
   session_family_id: transferOwnerIdSchema,
-  transfer_operation: transferSelectionSchema.options[0].shape.operation.or(transferSelectionSchema.options[1].shape.operation).or(transferSelectionSchema.options[2].shape.operation).or(transferSelectionSchema.options[3].shape.operation),
-  artifact_type: external_exports.enum(["bin", "dropped-files", "memory"]),
-  artifact_selector: sha256Schema.or(reportIdSchema),
+  transfer_operation: external_exports.enum(transferSelectionSchema.options.map((option) => option.shape.operation.value)),
+  artifact_type: external_exports.enum(["bin", "dropped-files", "memory", "email", "original", "attachment", "zip"]),
+  artifact_selector: external_exports.string().min(1).max(513),
   requested_target_digest: sha256Schema,
   archive_bytes: external_exports.number().int().nonnegative().max(transferLimits.artifactBytes).nullable(),
   archive_sha256: sha256Schema.nullable(),
@@ -19928,7 +19940,7 @@ var meResponseSchema = external_exports.strictObject({
   sessionExpiresAt: external_exports.number().int()
 });
 var accountId = external_exports.string().min(1);
-var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi"]);
+var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi", "checkpoint-axi"]);
 var skillsResponseSchema = external_exports.strictObject({ skills: external_exports.array(external_exports.strictObject({
   name: toolSchema,
   content: external_exports.string().min(1)
@@ -20180,6 +20192,10 @@ var falconRtrSettingsSchema = external_exports.strictObject({
   ])).optional()
 });
 var nativeSettingsSchemas = {
+  "checkpoint-axi": external_exports.strictObject({ writes: external_exports.strictObject({
+    allowWrites: external_exports.boolean(),
+    operations: external_exports.array(external_exports.string().regex(/^[a-z][A-Za-z0-9_.-]{0,255}$/)).min(1).max(126)
+  }).optional() }),
   "hybrid-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string())
@@ -20748,7 +20764,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.19",
+  version: "0.0.21",
   private: true,
   license: "MIT",
   type: "module",
@@ -21236,17 +21252,18 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.7.4",
-  commit: "bca4a08c71beb415e3fabb37443aea8ad61bc08c",
-  version: "0.7.4",
+  tag: "v0.8.0",
+  commit: "4ba25f373a5c4df46506bdd0d306fa3ef205d965",
+  version: "0.8.0",
   distribution: {
-    filename: "falcon_axi-0.7.4-py3-none-any.whl",
-    sha256: "bce4cfb033fd6537eb8a518fe3286799884f6b7a5ef95faffc347ac6c336d28e",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.7.4/falcon_axi-0.7.4-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.8.0-py3-none-any.whl",
+    sha256: "8aad289fd58847cb6555f46b8e930c5904d6afda34a7b2e6965cdd60c8df06a4",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.8.0/falcon_axi-0.8.0-py3-none-any.whl/provenance"
   },
+  skillSha256: "5d5fd1cd57ff1da68e37448c93fce57236f76448ec9a10984c01ea7300c6a8e0",
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "ef29404b26da085b96ace7ba1f708e928eb40c7aa99e071807d5003a3421b0cd",
+    sha256: "9b3d42e3c00b3d302948e8937c6295bbdde9cb80384ebef253f9b8a077454909",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -22972,10 +22989,11 @@ var falcon_axi_default = {
 var vectra_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "vectra-axi",
-  version: "0.1.9",
-  integrity: "sha512-GUl24JV8lErGjZliTHcb6BcjjdpJhrzbbB8cBekKE6dM3b5ph9i9EteJHFRWUuGpnEPlVEPeu7X3l33V9DGKwQ==",
+  version: "0.1.10",
+  integrity: "sha512-X7yttDlwpQJW/j0eNox5vLf7nWlFejXjtaq90N7ezJ+ACNqEFspODrwQ/mYqbXFnqjpIugQnhSGcnaI8YNMeLw==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "e7fe728c58d41a9ddd554b15c29de281dd06c2d7e6a6b044e43d75fb001aa53d",
+  packageManifestSha256: "3f4d4e3ec1b37690087e3c8850ffd5390574e6686cafbd723fb01f83b775ea97",
+  skillSha256: "58978bfd2468e9fac8d17644df1de46768572b1cd9a719a9eec64cdcb547ff9c",
   environment: [
     {
       name: "VECTRA_AXI_CONFIG",
@@ -23275,7 +23293,7 @@ var vectra_axi_default = {
     },
     source: {
       path: "dist/src/catalogue.js",
-      sha256: "e49354f34c86cd986d9cc166fc33f3c0423ab8eaa8044621131351c8f297e834"
+      sha256: "02e2443a4b6d6aef9faae51e0c4418c0c565ac5b0f73969a34a4c33a110bfabf"
     }
   },
   flags: [
@@ -23755,7 +23773,8 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -23807,7 +23826,8 @@ var vectra_axi_default = {
         profile: "value",
         config: "value",
         type: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -25027,10 +25047,11 @@ var vectra_axi_default = {
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "az-axi",
-  version: "0.1.12",
-  integrity: "sha512-xPhoFLQ8XWjWqLR2e80apWA1pkCqQcFZ5r5V7XW+uj0zXKaO9RHfjG7gsxkrMa44jWqWLiU8ssZxWZPl6uj8KQ==",
+  version: "0.1.13",
+  integrity: "sha512-qltNokGPKFvUxFxNVf25gV2jtgw9MpxT5k6Zlbhz0b/Y5pvbc04SpORpUurDZNXE7runLZZhoBmm38qXcA3M7Q==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "2d829dc31fd552a154b439ad40c39ff8fd53b35527d8134a0dd18f4ffab09334",
+  packageManifestSha256: "dc09976ff76cdda672ba89f0a7689c39873a86a19213d46687c2a9af861d3ed2",
+  skillSha256: "8a5bc0e8866ca55add8399376784a19e81671e6d036d10815e55b3c473540080",
   environment: [
     {
       name: "AZ_AXI_CONFIG",
@@ -25289,11 +25310,11 @@ var az_axi_default = {
   tokenResourceSources: [
     {
       path: "dist/lib/registry.js",
-      sha256: "67a29a57b906ee0a17dc0bf917123308ee2d160ef43106f5d15bf73f8cb874d3"
+      sha256: "dc1eb46c43aa5232b58acfb1d174fe2728491a3a6da28fa3cca27fed79494efd"
     },
     {
       path: "dist/lib/client.js",
-      sha256: "322f09655f302f8f4292cbb6317ad192854ed412376ce9041126b25e24ed27ed"
+      sha256: "156af240155e71c051a6a2f0c4235d51acaf3633d7a249736ff3b24ed541d2b6"
     },
     {
       path: "dist/lib/principals.js",
@@ -25317,7 +25338,7 @@ var az_axi_default = {
     },
     {
       path: "dist/commands/logs.js",
-      sha256: "f3c0112c4be7a8996163d323bd9945950ab1a212eae2cc42af044388adc77199"
+      sha256: "1cfd781bd88e13ba1c70537263220c6bdd6932586e53edd6fc22fc75202bd938"
     },
     {
       path: "dist/commands/doctor.js",
@@ -29745,10 +29766,11 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.12",
-  integrity: "sha512-TBt2y2rpfn8oi4YOq95uIo43RTsV/iOc0xFa3e3YCjhqd/ZL/y2is+7W0+B5/g1sdwb95yJbcU1eqeJEzmKJ5g==",
+  version: "0.1.13",
+  integrity: "sha512-V9f/H1xISbn1ar3ARVnYvtT4NDUDRgvhCkrnQd6lqNdj1MeQjF4JESS6PA6hY3epXKrqE+g/2nCfgJV1JDmDTQ==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "e686938dd356bffe87d9884d656a139b91e7eb6d62370f6aba3b5fd14283fb45",
+  packageManifestSha256: "2357d6568740146d05a0ad67fb8e0be3c871261726d3cf110fed83e216001dc9",
+  skillSha256: "98ff12e741b04592afae76853a00f572940dee6edf0e868d2ccba04a742b24ad",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -29910,7 +29932,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       },
       {
         path: "dist/profiles.js",
@@ -29988,7 +30010,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       }
     ]
   },
@@ -42171,8 +42193,605 @@ var hybrid_axi_default = {
   ]
 };
 
+// tools/inventories/checkpoint-axi.json
+var checkpoint_axi_default = {
+  generatedBy: "scripts/checkpoint-inventory.mjs",
+  tool: "checkpoint-axi",
+  version: "0.1.0",
+  integrity: "sha512-fbwTL0lbbJwCDjR8bt431kWHSCEuBmAEzk/QNJzsVcAbve2x8Ehtz/mr/aPzJ6I/WMRQiRPFpCE2zsW/2CRHlQ==",
+  parserEvidence: "Published catalogue, fixed regional map and reviewed native parsers, write coordinator and download contracts",
+  sources: [
+    {
+      path: "dist/src/catalogue.js",
+      sha256: "59b9568b614a101e2746a8275768c238ba8eb7166185119875a40f7eac191f7a"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "11a2e7f6c8ba3fc5507aa8ca33d480337a5a64bf79c241f4ed478f512ac8fa92"
+    },
+    {
+      path: "dist/src/doctor.js",
+      sha256: "7f25c415bc59b12e6d0a6155d701c3646bd3370e0b2024a29efdbaf5e4c0ffed"
+    },
+    {
+      path: "dist/src/downloads.js",
+      sha256: "206f08ec7d978e41fe1c9c4ba744f1cf4c3f47ee909a1f761645a802371c8d6e"
+    },
+    {
+      path: "dist/src/exceptions.js",
+      sha256: "8264427dd5871a447e3e8759341251779454490a387cdca801a0e68b81265327"
+    },
+    {
+      path: "dist/src/local-commands.js",
+      sha256: "ed9c39e204d42f45ae3c5b8008bf1c719d88f8e7214168f68de4d15921e35299"
+    },
+    {
+      path: "dist/src/private-file.js",
+      sha256: "574a40223d0bba130f903eb89e2cfd2d96bf01a4df237738af993272ebee0332"
+    },
+    {
+      path: "dist/src/profiles.js",
+      sha256: "db013b041bb6302993d7045fe3bd411bbd1a3593b5b2a84a3d8411645f55d3e6"
+    },
+    {
+      path: "dist/src/reads.js",
+      sha256: "02a5478edb3d44ab51ea300095794abc69d9e4a353060af4faed0d6e4ce592a7"
+    },
+    {
+      path: "dist/src/redact.js",
+      sha256: "9793e98af5c93c09e89748e26675b2d48663904a27e3aa42655954f93025c35a"
+    },
+    {
+      path: "dist/src/regions.js",
+      sha256: "44288abe19a68fa672bc04ad167141717aed5c3a333b2420b14ee68e13abee78"
+    },
+    {
+      path: "dist/src/transport.js",
+      sha256: "7beb28cc283e876db4f6aeaf5c308280e1fce482c20c19dd9924e29985e54e56"
+    },
+    {
+      path: "dist/src/write-exceptions.js",
+      sha256: "34114e0b2a3e04462914118ba6108f6d7eb7bf38a417f1f80ec4126deff786a8"
+    },
+    {
+      path: "dist/src/write-sectools.js",
+      sha256: "c962f2180d34625c9a0be1ad468e17b3e25d93390b0efae3dec02e9ab8f1dd9e"
+    },
+    {
+      path: "dist/src/writes.js",
+      sha256: "4f683a01ab151b4b1e61588b6c3fe86f3d8a34ebdbdb1a257dc42cae21e6f5ed"
+    }
+  ],
+  credentialSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://github.com/knowttl/checkpoint-axi/axi-credential.schema.json",
+    title: "Check Point AXI credential profile",
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "region",
+      "clientId"
+    ],
+    properties: {
+      region: {
+        type: "string",
+        enum: [
+          "us",
+          "eu",
+          "ca",
+          "au",
+          "uk",
+          "uae",
+          "in"
+        ]
+      },
+      clientId: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      clientSecret: {
+        $ref: "#/$defs/secretRef",
+        "x-secret": true,
+        default: {
+          env: "CHECKPOINT_AXI_CLIENT_SECRET"
+        }
+      },
+      saas: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S",
+        default: "office365_emails"
+      },
+      scope: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      downloads: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allow"
+        ],
+        default: {
+          allow: false
+        },
+        properties: {
+          allow: {
+            type: "boolean"
+          }
+        }
+      },
+      writes: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allowWrites",
+          "operations"
+        ],
+        default: {
+          allowWrites: false,
+          operations: []
+        },
+        properties: {
+          allowWrites: {
+            type: "boolean"
+          },
+          operations: {
+            type: "array",
+            items: {
+              type: "string",
+              pattern: "^[a-z][A-Za-z0-9_.-]*$"
+            }
+          }
+        }
+      }
+    },
+    $defs: {
+      secretRef: {
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "env"
+            ],
+            properties: {
+              env: {
+                type: "string",
+                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "file"
+            ],
+            properties: {
+              file: {
+                type: "string",
+                pattern: "^(?:/|[A-Za-z]:[\\\\/])"
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  regions: {
+    us: "https://cloudinfra-gw-us.portal.checkpoint.com",
+    eu: "https://cloudinfra-gw.portal.checkpoint.com",
+    ca: "https://cloudinfra-gw.ca.portal.checkpoint.com",
+    au: "https://cloudinfra-gw.ap.portal.checkpoint.com",
+    uk: "https://cloudinfra-gw.uk.portal.checkpoint.com",
+    uae: "https://cloudinfra-gw.me.portal.checkpoint.com",
+    in: "https://cloudinfra-gw.in.portal.checkpoint.com"
+  },
+  skillSha256: "69f0754d565fc1e65163435ef698ea6dca6009470f158171cb3b4258d27c647b",
+  nativeWriteSettings: {
+    supportedOperations: [
+      "attachment.download",
+      "attachment.download-all",
+      "email.download",
+      "email.quarantine",
+      "email.restore",
+      "exception.anomaly.create",
+      "exception.anomaly.remove",
+      "exception.click-time.create",
+      "exception.click-time.remove",
+      "exception.click-time.remove-items",
+      "exception.click-time.update",
+      "exception.dlp.create",
+      "exception.dlp.update",
+      "exception.malware.create",
+      "exception.malware.update",
+      "exception.phishing-allow.create",
+      "exception.phishing-allow.remove",
+      "exception.phishing-allow.update",
+      "exception.phishing-block.create",
+      "exception.phishing-block.remove",
+      "exception.phishing-block.update",
+      "exception.spam-allow.create",
+      "exception.spam-allow.remove",
+      "exception.spam-allow.update",
+      "exception.url.create",
+      "exception.url.update"
+    ],
+    dynamicOperation: "event.action.<exact available action name>"
+  },
+  adapterBoundary: {
+    unsafeOverrides: [
+      "config",
+      "profile",
+      "origin",
+      "out"
+    ],
+    inputFileFlags: [
+      "input"
+    ],
+    blockedCommands: [
+      "profile list",
+      "config path",
+      "exception clear",
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    downloadCommands: [
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    inputs: {
+      stdin: "unsupported",
+      files: "uploaded private JSON leaves only",
+      downloads: "authenticated hosted transfers only"
+    },
+    nativeWrites: "native preview, exact operation allow-list, execute, exact confirm and durable journal; ambiguous deletes refused"
+  },
+  discovery: {
+    commands: [
+      "auth",
+      "doctor",
+      "email",
+      "event",
+      "exception",
+      "home",
+      "task"
+    ],
+    example: [
+      "email",
+      "search",
+      "--limit",
+      "1"
+    ],
+    help: "checkpoint-axi email search [--limit <n>]\nArtium manages region, client ID and secret. Writes require administrator-enabled exact operations and native preview, --execute and exact --confirm. Upload private JSON with --input. Use artium-axi download for authenticated email and attachment saving with host-owned confirmation; ordinary downloads and local configuration are blocked.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "attachment download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "attachment download-all",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "auth status",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "config path",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "doctor",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails"
+      }
+    },
+    {
+      command: "email download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        original: "Download original email without processing modifications; default false"
+      }
+    },
+    {
+      command: "email quarantine",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
+      }
+    },
+    {
+      command: "email restore",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
+      }
+    },
+    {
+      command: "email search",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails",
+        "saas-entity": "Optional SaaS entity type selector",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        filter: "JSON array of {saasAttrName, saasAttrOp, saasAttrValue} filters (guide pages 19-20)"
+      }
+    },
+    {
+      command: "email show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "event action",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique event IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order",
+        name: "Required available action name; nonempty action parameters are unverified"
+      }
+    },
+    {
+      command: "event list",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        saas: "Comma-separated SaaS overrides; default selected profile saas or office365_emails",
+        "event-types": "Comma-separated event types; default unfiltered",
+        "event-states": "Comma-separated event states; default unfiltered",
+        severities: "Comma-separated severities; default unfiltered",
+        "event-ids": "Comma-separated event IDs; default unfiltered",
+        "confidence-indicator": "Confidence indicator selector; default unfiltered",
+        description: "Description selector; default unfiltered"
+      }
+    },
+    {
+      command: "event show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "exception clear",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
+      }
+    },
+    {
+      command: "exception create",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT",
+        specific: "Malware/url/dlp only: use the documented create-specific /exceptions route; default false; included in confirmation digest"
+      }
+    },
+    {
+      command: "exception list",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item routes instead of list routes; default false",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Return up to 1000 rows within transport budgets; no server continuation parameter is documented"
+      }
+    },
+    {
+      command: "exception remove",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
+      }
+    },
+    {
+      command: "exception remove-items",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        ids: "Required 1-20 unique comma-separated click-time item IDs"
+      }
+    },
+    {
+      command: "exception show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item route instead of list route; default false"
+      }
+    },
+    {
+      command: "exception update",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT"
+      }
+    },
+    {
+      command: "home",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "profile list",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "task show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    }
+  ]
+};
+
 // src/shared/tool-manifests.ts
-var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default };
+var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default, "checkpoint-axi": checkpoint_axi_default };
 
 // node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
 var NULL_LITERAL = "null";
@@ -43540,6 +44159,7 @@ function resolveDecodeOptions(options) {
 
 // src/cli/rewrite.ts
 var managedFlags = {
+  "checkpoint-axi": checkpoint_axi_default.adapterBoundary.unsafeOverrides,
   "hybrid-axi": hybrid_axi_default.adapterBoundary.unsafeOverrides,
   "tenable-axi": tenable_axi_default.adapterBoundary.unsafeOverrides,
   "awx-axi": awx_axi_default.adapterBoundary.unsafeOverrides,
@@ -43565,6 +44185,25 @@ function rewriteDiscoveryHelp(help, tool) {
 }
 function rewriteSuggestions(output3, tool, truncated = false) {
   if (truncated) return output3;
+  if (tool === "checkpoint-axi") {
+    try {
+      const document = decode3(output3);
+      if (document.command && document.flags) return encode3({
+        ...document,
+        command: document.command.startsWith("artium-axi ") ? document.command : `artium-axi checkpoint-axi ${document.command}`,
+        flags: Object.fromEntries(Object.entries(document.flags).filter(([name]) => !checkpoint_axi_default.adapterBoundary.unsafeOverrides.includes(name.replace(/^--/, "")))),
+        examples: (document.examples ?? []).filter((example) => !/--(?:config|profile|out)\b/.test(example)).map((example) => example.replace(/^checkpoint-axi\b/, "artium-axi checkpoint-axi")),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+      if (document.bin || document.commands) return encode3({
+        bin: "artium-axi checkpoint-axi",
+        description: "Investigate Check Point Email Security with managed credentials.",
+        commands: checkpoint_axi_default.commands.filter((route) => route.effect !== "blocked").map((route) => route.command),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+    } catch {
+    }
+  }
   if (tool === "hybrid-axi") {
     try {
       const document = decode3(output3);
@@ -43728,6 +44367,10 @@ function managedFlagRanges(command, tool) {
   return ranges;
 }
 function hostedHelp(help, tool, flags, commands2) {
+  if (tool === "checkpoint-axi") {
+    help = help.split("\n").filter((line) => !/CHECKPOINT_AXI_|SecretRef|checkpoint-axi (?:config|profile)|Valid commands:/.test(line)).join("\n");
+    if (!help.trim()) help = checkpoint_axi_default.discovery.help;
+  }
   if (tool === "hybrid-axi") {
     help = help.split("\n").filter((line) => !/HYBRID_AXI_|SecretRefs|hybrid-axi (?:setup|config|profile)|--(?:config|profile|origin|output)\b/.test(line)).join("\n");
     const guidance = "Artium manages the API key and fixed origin. Submissions, YARA mutations, consuming matches and four reviewed archive downloads require independently selected administrator-enabled operations, native preview, execute, exact confirmation and journal. Quick scans transmit the supplied sample or URL. Use artium-axi download --help for authenticated one-shot CLI verified saving and live-malware warnings.";
@@ -44031,20 +44674,20 @@ var commands = {
   doctor: { usage: "artium-axi doctor", purpose: "Check the server, certificate, token, CLI version and cached tool health.", flags: [], example: "artium-axi doctor" },
   update: { usage: "artium-axi update", purpose: "Download and verify the server\u2019s client, replace this file and keep a .bak backup. npm installations must use npm install -g @knowttl/artium-axi.", flags: [], example: "artium-axi update" },
   download: {
-    usage: "artium-axi download --operation <operation> --selector <hash|report-id> --type <bin|dropped-files|memory> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
-    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive. Operations remain unavailable until adapter enablement.",
+    usage: "artium-axi download --operation <operation> --selector <selector> --type <type> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
+    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive or Check Point email/attachment. Each operation requires administrator enablement.",
     flags: [
-      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory> (required)",
-      "--selector <hash|report-id> (required)",
-      "--type <bin|dropped-files|memory> (required)",
+      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory|email.download|attachment.download|attachment.download-all> (required)",
+      "--selector <hash|report-id|entity-id|entity-id/attachment-id> (required; attachment.download uses entity-id/attachment-id)",
+      "--type <bin|dropped-files|memory|email|original|attachment|zip> (required; email.download uses email or original, attachment.download uses attachment, attachment.download-all uses zip)",
       "--destination <absolute-new-path> (required; Linux private 0700 directory, no symlink components or overwrite)",
       "--transfer <id> (required for execution; preview transfer ID)",
       "--execute (default false)",
-      "--confirm <exact-confirm> (required for execution; unchanged native preview string)",
+      "--confirm <exact-confirm> (required for execution; unchanged preview string; Check Point confirmation is host-owned)",
       "--password-stdin (default false; otherwise terminal password)",
       "--sso (default false; browser identity confirmation)",
       transferWarning,
-      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB; ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
+      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB (Check Point: 50 MiB with mandatory upstream hash); ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
     ],
     example: "artium-axi download --operation report-download-bin --selector synthetic-report --type bin --destination /controlled/artifacts/new-archive.bin --sso"
   },
@@ -44081,19 +44724,25 @@ var commands = {
   "tenable-axi": {
     usage: "artium-axi tenable-axi [<args>]",
     purpose: "Investigate Tenable One with managed API keys.",
-    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked."],
+    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked.", "Declared file flags accept - to read stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path."],
     example: "artium-axi tenable-axi card list --limit 1"
   },
   "hybrid-axi": {
     usage: "artium-axi hybrid-axi [<args>]",
     purpose: "Investigate Hybrid Analysis with a managed API key.",
-    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", transferWarning],
+    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", "--body-file - reads stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path.", transferWarning],
     example: "artium-axi hybrid-axi quota"
   },
+  "checkpoint-axi": {
+    usage: "artium-axi checkpoint-axi [<args>]",
+    purpose: "Investigate Check Point Email Security with managed regional credentials.",
+    flags: ["Writes require administrator-selected exact operations, native preview, --execute and exact --confirm. Private JSON inputs are uploaded with --input; stdin is unavailable. Downloads use artium-axi download with host-owned confirmation. Ambiguous deletes remain blocked."],
+    example: "artium-axi checkpoint-axi email search --limit 1"
+  },
   "az-axi": {
     usage: "artium-axi az-axi [<args>]",
     purpose: "Run Azure commands with your managed identity.",
-    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
+    flags: ["Arguments after az-axi are forwarded upstream, including --help.", "Query commands read non-terminal stdin to EOF only without a file, positional query or query flag. api reads stdin only without --body, --body-file or --data; method/path are not body sources. The pinned upstream accepts --body, not --data.", "Tool stdin must reach EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass --file for queries, --body or --body-file for api."],
     example: "artium-axi az-axi sub list"
   },
   "mg-axi": {
@@ -44380,9 +45029,12 @@ ${executableBlock}
 // src/cli/input.ts
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";
-async function readBounded(stream, limit) {
+async function readBounded(stream, limit, stdinAlternative) {
   const chunks = [];
   let bytes = 0;
+  const deadline = stdinAlternative === void 0 ? void 0 : setTimeout(() => {
+    stream.destroy(new ArtiumError("INVALID_INPUT", `no stdin EOF after 5 s; close stdin or pass ${stdinAlternative}`));
+  }, 5e3);
   try {
     for await (const chunk of stream) {
       const buffer = Buffer.from(chunk);
@@ -44393,6 +45045,8 @@ async function readBounded(stream, limit) {
   } catch (error62) {
     if (error62 instanceof ArtiumError) throw error62;
     throw new ArtiumError("INVALID_INPUT", "Tool input could not be read.", "Check the local input file or stdin.");
+  } finally {
+    clearTimeout(deadline);
   }
   return Buffer.concat(chunks);
 }
@@ -44402,8 +45056,8 @@ async function toolInput(tool, original) {
   const input2 = {};
   let totalFileBytes = 0;
   const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
-  if ((tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = hunting ? ["file"] : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  if ((tool === "checkpoint-axi" || tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "checkpoint-axi" ? checkpoint_axi_default.adapterBoundary.inputFileFlags : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
@@ -44411,7 +45065,7 @@ async function toolInput(tool, original) {
       const equals = args[index].indexOf("=");
       const path = equals < 0 ? args[++index] : args[index].slice(equals + 1);
       if (path === "-" && (tool === "tenable-axi" || tool === "hybrid-axi" && flag === "--body-file")) {
-        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes)).toString("utf8");
+        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes, flag)).toString("utf8");
         continue;
       }
       if (!path || path === "-") throw new ArtiumError("UNSUPPORTED_INPUT", "A file flag requires a local file path.");
@@ -44436,20 +45090,22 @@ async function toolInput(tool, original) {
     }
     const route = az_axi_default.commands.find((route2) => ["rg query", "logs query", "api"].includes(route2.handlerCommand) && route2.command.split(" ").every((word, index) => args[leading + index] === word));
     let positional = false;
+    let explicitInput = false;
     if (route) {
       for (let index = leading + route.command.split(" ").length; index < args.length; index++) {
         const token = args[index];
         if (token === "--") {
-          positional = index + 1 < args.length;
+          positional ||= index + 1 < args.length;
           break;
         }
         if (!token.startsWith("-") || token === "-") {
           positional = true;
-          break;
+          continue;
         }
         const raw = token.slice(token.startsWith("--") ? 2 : 1).split("=")[0];
         const expanded = token.startsWith("--") ? raw : route.shortFlags[raw] ?? raw;
         const name = route.flagAliases[expanded] ?? expanded;
+        if ((route.handlerCommand === "api" ? ["body", "body-file", "data"] : ["graph-query", "analytics-query"]).includes(name)) explicitInput = true;
         const kind = route.flags[name];
         if (token.includes("=") || !kind) continue;
         if (kind === "boolean") {
@@ -44462,8 +45118,8 @@ async function toolInput(tool, original) {
         }
       }
     }
-    if (tool === "az-axi" && route && !input2.files?.length && !positional && !process.stdin.isTTY) {
-      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes);
+    if (tool === "az-axi" && route && !input2.files?.length && !explicitInput && (route.handlerCommand === "api" || !positional) && !process.stdin.isTTY) {
+      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes, route.handlerCommand === "api" ? "--data (supported body flag: --body)" : "--file");
       if (stdin.length) input2.stdin = stdin.toString("utf8");
     }
   }
@@ -44846,6 +45502,7 @@ async function download(args, output3, managed2) {
     targetDigest: createHash4("sha256").update(destination).digest("hex")
   });
   if (!input2.success || !destination || flags.has("--sso") && flags.has("--password-stdin")) throw new ArtiumError("INVALID_INPUT");
+  const transferRoutes2 = transferRoutesFor(transferTool(input2.data.selection.operation));
   const execute = flags.has("--execute");
   if (execute !== flags.has("--transfer") || execute !== flags.has("--confirm")) throw new ArtiumError("INVALID_INPUT");
   let execution;
@@ -44897,7 +45554,7 @@ async function download(args, output3, managed2) {
         { "x-artium-reauth-ticket": ticket }
       );
       if (!execution) {
-        const preview = transferPreviewSchema.parse(await request(transferRoutes.prepare.path, input2.data));
+        const preview = transferPreviewSchema.parse(await request(transferRoutes2.prepare.path, input2.data));
         if (preview.targetDigest !== input2.data.targetDigest) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44914,7 +45571,7 @@ async function download(args, output3, managed2) {
       let saved = false;
       let receipt = "unconfirmed";
       try {
-        const pending = transferStatusSchema.parse(await request(transferRoutes.status.path, retrieval));
+        const pending = transferStatusSchema.parse(await request(transferRoutes2.status.path, retrieval));
         if (pending.transferId !== execution.transferId || pending.outcome !== "preview" || pending.archive !== null) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44923,11 +45580,11 @@ async function download(args, output3, managed2) {
           expiresAt: pending.expiresAt,
           saveOutcome: "unconfirmed"
         });
-        const status = transferStatusSchema.parse(await request(transferRoutes.execute.path, execution));
+        const status = transferStatusSchema.parse(await request(transferRoutes2.execute.path, execution));
         if (status.transferId !== execution.transferId || status.expiresAt !== pending.expiresAt || status.outcome !== "ready" || !status.archive) throw new ArtiumError("INVALID_RESPONSE");
         archive = status.archive;
         await client.artifact(
-          transferRoutes.retrieve.path,
+          transferRoutes2.retrieve.path,
           retrieval,
           token,
           ticket,
@@ -44937,19 +45594,19 @@ async function download(args, output3, managed2) {
         saved = true;
         await local.close();
         try {
-          await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
+          await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
           receipt = "confirmed";
         } catch {
         }
       } catch (error62) {
         if (archive && !saved) {
           try {
-            await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
+            await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
           } catch {
           }
         }
         try {
-          await request(transferRoutes.cancel.path, retrieval);
+          await request(transferRoutes2.cancel.path, retrieval);
         } catch {
         }
         throw error62;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.19",
+  "version": "0.0.21",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",