@knowttl/artium-axi 0.0.20 → 0.0.21

package/README.md

@@ -46,6 +46,7 @@ Agents keep a command-line interface with TOON discovery rather than implementin
 | AWX | Pasted token or one-time password sign-in; optional operational writes |
 | Tenable One | Access and secret API keys; optional allow-listed business writes and export jobs |
 | Hybrid Analysis | Managed API key; investigation reads and optional allow-listed submissions, YARA mutations and consuming matches |
+| Check Point Email Security | Regional client credentials; email, event, task and exception reads, guarded writes and authenticated email/attachment saving |
 
 [Package pins](tools/package.json) and the [Falcon source pin](tools/falcon-source.json) own bundled versions; [reviewed inventories](tools/inventories) define the supported command boundary.
 
@@ -199,6 +200,7 @@ See [client input handling](docs/client-reference.md#command-surface-and-subcomm
 | Azure DevOps | Reviewed mutations with administrator `allowWrites: true`; raw `api` remains GET-only. |
 | AWX | Launch/cancel/relaunch, workflow approval/denial, project/inventory-source sync and notification tests with `allowWrites: true` and upstream `--confirm`; configuration, deletion and security writes stay blocked. |
 | Tenable One | Business writes and export-job creation with administrator `writes.allowWrites: true`, an explicit operations allow-list, native preview, `--execute`, exact `--confirm` and durable journaling; downloads and local configuration stay blocked. |
+| Check Point Email Security | Email and exception writes require administrator `writes.allowWrites: true`, exact selected operations and native preview, execute, confirmation and journal gates. Name-only event actions require their exact `event.action.<name>` scope. The six malware/URL/DLP remove/clear operations and click-time clear remain refused. Three separately selected downloads use [authenticated CLI saving](docs/client-reference.md#check-point-email-and-attachment-saving) with host-owned confirmation and independent SHA-256 verification; native download journal fields remain empty. Ordinary tool-run downloads and credential/origin overrides stay blocked. Live API contracts remain uncommissioned. |
 | Hybrid Analysis | Sandbox submissions, YARA create/update/delete, consuming hunting matches and the four reviewed archive downloads require administrator `writes.allowWrites: true`, independently selected operations, native preview, `--execute`, exact `--confirm` and durable journaling. Downloads are limited to `hash-download-bin`, `report-download-bin`, `report-download-dropped-files` and `report-download-memory`, through the [authenticated CLI verified-save path](docs/client-reference.md#hybrid-analysis-archive-saving) after the [operator prerequisites](docs/runbook.md#scope-and-prerequisites) pass. All operations default off; enabling other writes never enables downloads or grants upstream entitlement. The browser provides warnings, command guidance and metadata/save status only. Ordinary tool-run downloads, local configuration and credential/origin overrides are blocked. |
 
 Hybrid Analysis quick scans transmit the supplied sample or URL as read exceptions without a write gate; sandbox submission previews disclose that samples and reports can become visible to the community.
@@ -221,6 +223,7 @@ After an unknown write outcome, inspect state using returned guidance before ret
 | AWX job list | Token identity with job read access |
 | Tenable One card list | See [Tenable One credential permissions](docs/tool-credentials.md#tenable-one). |
 | Hybrid Analysis quota | A valid API key; resource permissions vary by key level. See [Hybrid Analysis setup](docs/tool-credentials.md#hybrid-analysis). |
+| Check Point doctor | Regional authentication and one bounded email search. See [Check Point setup and commissioning](docs/tool-credentials.md#check-point-email-security). |
 
 See [tool credentials](docs/tool-credentials.md) for dedicated identities, permissions and safe credential entry.
 Artium stores shared service credentials encrypted with AES-256-GCM and never returns saved secrets to clients.
@@ -261,9 +264,9 @@ This summary follows the [CLI help registry](src/cli/help.ts); `artium-axi --hel
 | `tools` / `tools show <tool>` | Granted enabled tools / pinned help and first call |
 | `doctor` | Server, TLS, token, version and cached health; five-second request deadlines |
 | `update` | Update the [server-downloaded client](#verified-client) |
-| `download` | Preview and explicitly verify/save administrator-selected Hybrid Analysis archives through the local CLI. Run `artium-axi download --help` for guards and warnings. |
+| `download` | Preview and explicitly verify/save administrator-selected Hybrid Analysis archives and Check Point emails/attachments through the local CLI. Run `artium-axi download --help` for guards and warnings. |
 | `setup --host <host>` | Install managed skills and optional Claude hook |
-| `<tool> <args>` | Run any of the nine managed tools above |
+| `<tool> <args>` | Run any of the ten managed tools above |
 | `--managed-session --help` | Private-pipe session protocol |
 
 `artium-axi --help falcon-axi` is local help; `artium-axi falcon-axi --help` authenticates and calls upstream.

package/bin/artium-axi.mjs

@@ -19801,8 +19801,14 @@ var transferSelectionSchema = external_exports.discriminatedUnion("operation", [
   external_exports.strictObject({ operation: external_exports.literal("hash-download-bin"), selector: sampleSha256Schema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-bin"), selector: reportIdSchema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-dropped-files"), selector: reportIdSchema, type: external_exports.literal("dropped-files") }),
-  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") })
+  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") }),
+  external_exports.strictObject({ operation: external_exports.literal("email.download"), selector: transferOwnerIdSchema, type: external_exports.enum(["email", "original"]) }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download"), selector: external_exports.string().regex(/^[A-Za-z0-9_-]{1,256}\/[A-Za-z0-9_-]{1,256}$/), type: external_exports.literal("attachment") }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download-all"), selector: transferOwnerIdSchema, type: external_exports.literal("zip") })
 ]);
+function transferTool(operation) {
+  return ["email.download", "attachment.download", "attachment.download-all"].includes(operation) ? "checkpoint-axi" : "hybrid-axi";
+}
 var transferPrepareSchema = external_exports.strictObject({ selection: transferSelectionSchema, targetDigest: sha256Schema });
 var transferIdSchema = external_exports.uuid();
 var transferScopeSchema = external_exports.strictObject({
@@ -19865,12 +19871,18 @@ var transferRoutes = {
   cancel: { method: "POST", path: "/v1/transfers/hybrid/cancel", input: transferRetrieveSchema },
   status: { method: "POST", path: "/v1/transfers/hybrid/status", input: transferRetrieveSchema, response: transferStatusSchema }
 };
+function transferRoutesFor(tool) {
+  return Object.fromEntries(Object.entries(transferRoutes).map(([name, route]) => [
+    name,
+    { ...route, path: route.path.replace("/hybrid/", tool === "checkpoint-axi" ? "/checkpoint/" : "/hybrid/") }
+  ]));
+}
 var transferAuditSchema = external_exports.strictObject({
   transfer_id: transferIdSchema,
   session_family_id: transferOwnerIdSchema,
-  transfer_operation: transferSelectionSchema.options[0].shape.operation.or(transferSelectionSchema.options[1].shape.operation).or(transferSelectionSchema.options[2].shape.operation).or(transferSelectionSchema.options[3].shape.operation),
-  artifact_type: external_exports.enum(["bin", "dropped-files", "memory"]),
-  artifact_selector: sha256Schema.or(reportIdSchema),
+  transfer_operation: external_exports.enum(transferSelectionSchema.options.map((option) => option.shape.operation.value)),
+  artifact_type: external_exports.enum(["bin", "dropped-files", "memory", "email", "original", "attachment", "zip"]),
+  artifact_selector: external_exports.string().min(1).max(513),
   requested_target_digest: sha256Schema,
   archive_bytes: external_exports.number().int().nonnegative().max(transferLimits.artifactBytes).nullable(),
   archive_sha256: sha256Schema.nullable(),
@@ -19928,7 +19940,7 @@ var meResponseSchema = external_exports.strictObject({
   sessionExpiresAt: external_exports.number().int()
 });
 var accountId = external_exports.string().min(1);
-var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi"]);
+var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi", "checkpoint-axi"]);
 var skillsResponseSchema = external_exports.strictObject({ skills: external_exports.array(external_exports.strictObject({
   name: toolSchema,
   content: external_exports.string().min(1)
@@ -20180,6 +20192,10 @@ var falconRtrSettingsSchema = external_exports.strictObject({
   ])).optional()
 });
 var nativeSettingsSchemas = {
+  "checkpoint-axi": external_exports.strictObject({ writes: external_exports.strictObject({
+    allowWrites: external_exports.boolean(),
+    operations: external_exports.array(external_exports.string().regex(/^[a-z][A-Za-z0-9_.-]{0,255}$/)).min(1).max(126)
+  }).optional() }),
   "hybrid-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string())
@@ -20748,7 +20764,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.20",
+  version: "0.0.21",
   private: true,
   license: "MIT",
   type: "module",
@@ -42177,8 +42193,605 @@ var hybrid_axi_default = {
   ]
 };
 
+// tools/inventories/checkpoint-axi.json
+var checkpoint_axi_default = {
+  generatedBy: "scripts/checkpoint-inventory.mjs",
+  tool: "checkpoint-axi",
+  version: "0.1.0",
+  integrity: "sha512-fbwTL0lbbJwCDjR8bt431kWHSCEuBmAEzk/QNJzsVcAbve2x8Ehtz/mr/aPzJ6I/WMRQiRPFpCE2zsW/2CRHlQ==",
+  parserEvidence: "Published catalogue, fixed regional map and reviewed native parsers, write coordinator and download contracts",
+  sources: [
+    {
+      path: "dist/src/catalogue.js",
+      sha256: "59b9568b614a101e2746a8275768c238ba8eb7166185119875a40f7eac191f7a"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "11a2e7f6c8ba3fc5507aa8ca33d480337a5a64bf79c241f4ed478f512ac8fa92"
+    },
+    {
+      path: "dist/src/doctor.js",
+      sha256: "7f25c415bc59b12e6d0a6155d701c3646bd3370e0b2024a29efdbaf5e4c0ffed"
+    },
+    {
+      path: "dist/src/downloads.js",
+      sha256: "206f08ec7d978e41fe1c9c4ba744f1cf4c3f47ee909a1f761645a802371c8d6e"
+    },
+    {
+      path: "dist/src/exceptions.js",
+      sha256: "8264427dd5871a447e3e8759341251779454490a387cdca801a0e68b81265327"
+    },
+    {
+      path: "dist/src/local-commands.js",
+      sha256: "ed9c39e204d42f45ae3c5b8008bf1c719d88f8e7214168f68de4d15921e35299"
+    },
+    {
+      path: "dist/src/private-file.js",
+      sha256: "574a40223d0bba130f903eb89e2cfd2d96bf01a4df237738af993272ebee0332"
+    },
+    {
+      path: "dist/src/profiles.js",
+      sha256: "db013b041bb6302993d7045fe3bd411bbd1a3593b5b2a84a3d8411645f55d3e6"
+    },
+    {
+      path: "dist/src/reads.js",
+      sha256: "02a5478edb3d44ab51ea300095794abc69d9e4a353060af4faed0d6e4ce592a7"
+    },
+    {
+      path: "dist/src/redact.js",
+      sha256: "9793e98af5c93c09e89748e26675b2d48663904a27e3aa42655954f93025c35a"
+    },
+    {
+      path: "dist/src/regions.js",
+      sha256: "44288abe19a68fa672bc04ad167141717aed5c3a333b2420b14ee68e13abee78"
+    },
+    {
+      path: "dist/src/transport.js",
+      sha256: "7beb28cc283e876db4f6aeaf5c308280e1fce482c20c19dd9924e29985e54e56"
+    },
+    {
+      path: "dist/src/write-exceptions.js",
+      sha256: "34114e0b2a3e04462914118ba6108f6d7eb7bf38a417f1f80ec4126deff786a8"
+    },
+    {
+      path: "dist/src/write-sectools.js",
+      sha256: "c962f2180d34625c9a0be1ad468e17b3e25d93390b0efae3dec02e9ab8f1dd9e"
+    },
+    {
+      path: "dist/src/writes.js",
+      sha256: "4f683a01ab151b4b1e61588b6c3fe86f3d8a34ebdbdb1a257dc42cae21e6f5ed"
+    }
+  ],
+  credentialSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://github.com/knowttl/checkpoint-axi/axi-credential.schema.json",
+    title: "Check Point AXI credential profile",
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "region",
+      "clientId"
+    ],
+    properties: {
+      region: {
+        type: "string",
+        enum: [
+          "us",
+          "eu",
+          "ca",
+          "au",
+          "uk",
+          "uae",
+          "in"
+        ]
+      },
+      clientId: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      clientSecret: {
+        $ref: "#/$defs/secretRef",
+        "x-secret": true,
+        default: {
+          env: "CHECKPOINT_AXI_CLIENT_SECRET"
+        }
+      },
+      saas: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S",
+        default: "office365_emails"
+      },
+      scope: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      downloads: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allow"
+        ],
+        default: {
+          allow: false
+        },
+        properties: {
+          allow: {
+            type: "boolean"
+          }
+        }
+      },
+      writes: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allowWrites",
+          "operations"
+        ],
+        default: {
+          allowWrites: false,
+          operations: []
+        },
+        properties: {
+          allowWrites: {
+            type: "boolean"
+          },
+          operations: {
+            type: "array",
+            items: {
+              type: "string",
+              pattern: "^[a-z][A-Za-z0-9_.-]*$"
+            }
+          }
+        }
+      }
+    },
+    $defs: {
+      secretRef: {
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "env"
+            ],
+            properties: {
+              env: {
+                type: "string",
+                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "file"
+            ],
+            properties: {
+              file: {
+                type: "string",
+                pattern: "^(?:/|[A-Za-z]:[\\\\/])"
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  regions: {
+    us: "https://cloudinfra-gw-us.portal.checkpoint.com",
+    eu: "https://cloudinfra-gw.portal.checkpoint.com",
+    ca: "https://cloudinfra-gw.ca.portal.checkpoint.com",
+    au: "https://cloudinfra-gw.ap.portal.checkpoint.com",
+    uk: "https://cloudinfra-gw.uk.portal.checkpoint.com",
+    uae: "https://cloudinfra-gw.me.portal.checkpoint.com",
+    in: "https://cloudinfra-gw.in.portal.checkpoint.com"
+  },
+  skillSha256: "69f0754d565fc1e65163435ef698ea6dca6009470f158171cb3b4258d27c647b",
+  nativeWriteSettings: {
+    supportedOperations: [
+      "attachment.download",
+      "attachment.download-all",
+      "email.download",
+      "email.quarantine",
+      "email.restore",
+      "exception.anomaly.create",
+      "exception.anomaly.remove",
+      "exception.click-time.create",
+      "exception.click-time.remove",
+      "exception.click-time.remove-items",
+      "exception.click-time.update",
+      "exception.dlp.create",
+      "exception.dlp.update",
+      "exception.malware.create",
+      "exception.malware.update",
+      "exception.phishing-allow.create",
+      "exception.phishing-allow.remove",
+      "exception.phishing-allow.update",
+      "exception.phishing-block.create",
+      "exception.phishing-block.remove",
+      "exception.phishing-block.update",
+      "exception.spam-allow.create",
+      "exception.spam-allow.remove",
+      "exception.spam-allow.update",
+      "exception.url.create",
+      "exception.url.update"
+    ],
+    dynamicOperation: "event.action.<exact available action name>"
+  },
+  adapterBoundary: {
+    unsafeOverrides: [
+      "config",
+      "profile",
+      "origin",
+      "out"
+    ],
+    inputFileFlags: [
+      "input"
+    ],
+    blockedCommands: [
+      "profile list",
+      "config path",
+      "exception clear",
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    downloadCommands: [
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    inputs: {
+      stdin: "unsupported",
+      files: "uploaded private JSON leaves only",
+      downloads: "authenticated hosted transfers only"
+    },
+    nativeWrites: "native preview, exact operation allow-list, execute, exact confirm and durable journal; ambiguous deletes refused"
+  },
+  discovery: {
+    commands: [
+      "auth",
+      "doctor",
+      "email",
+      "event",
+      "exception",
+      "home",
+      "task"
+    ],
+    example: [
+      "email",
+      "search",
+      "--limit",
+      "1"
+    ],
+    help: "checkpoint-axi email search [--limit <n>]\nArtium manages region, client ID and secret. Writes require administrator-enabled exact operations and native preview, --execute and exact --confirm. Upload private JSON with --input. Use artium-axi download for authenticated email and attachment saving with host-owned confirmation; ordinary downloads and local configuration are blocked.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "attachment download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "attachment download-all",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "auth status",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "config path",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "doctor",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails"
+      }
+    },
+    {
+      command: "email download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        original: "Download original email without processing modifications; default false"
+      }
+    },
+    {
+      command: "email quarantine",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
+      }
+    },
+    {
+      command: "email restore",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
+      }
+    },
+    {
+      command: "email search",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails",
+        "saas-entity": "Optional SaaS entity type selector",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        filter: "JSON array of {saasAttrName, saasAttrOp, saasAttrValue} filters (guide pages 19-20)"
+      }
+    },
+    {
+      command: "email show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "event action",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique event IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order",
+        name: "Required available action name; nonempty action parameters are unverified"
+      }
+    },
+    {
+      command: "event list",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        saas: "Comma-separated SaaS overrides; default selected profile saas or office365_emails",
+        "event-types": "Comma-separated event types; default unfiltered",
+        "event-states": "Comma-separated event states; default unfiltered",
+        severities: "Comma-separated severities; default unfiltered",
+        "event-ids": "Comma-separated event IDs; default unfiltered",
+        "confidence-indicator": "Confidence indicator selector; default unfiltered",
+        description: "Description selector; default unfiltered"
+      }
+    },
+    {
+      command: "event show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "exception clear",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
+      }
+    },
+    {
+      command: "exception create",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT",
+        specific: "Malware/url/dlp only: use the documented create-specific /exceptions route; default false; included in confirmation digest"
+      }
+    },
+    {
+      command: "exception list",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item routes instead of list routes; default false",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Return up to 1000 rows within transport budgets; no server continuation parameter is documented"
+      }
+    },
+    {
+      command: "exception remove",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
+      }
+    },
+    {
+      command: "exception remove-items",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        ids: "Required 1-20 unique comma-separated click-time item IDs"
+      }
+    },
+    {
+      command: "exception show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item route instead of list route; default false"
+      }
+    },
+    {
+      command: "exception update",
+      effect: "write",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT"
+      }
+    },
+    {
+      command: "home",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "profile list",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    },
+    {
+      command: "task show",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
+      }
+    }
+  ]
+};
+
 // src/shared/tool-manifests.ts
-var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default };
+var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default, "checkpoint-axi": checkpoint_axi_default };
 
 // node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
 var NULL_LITERAL = "null";
@@ -43546,6 +44159,7 @@ function resolveDecodeOptions(options) {
 
 // src/cli/rewrite.ts
 var managedFlags = {
+  "checkpoint-axi": checkpoint_axi_default.adapterBoundary.unsafeOverrides,
   "hybrid-axi": hybrid_axi_default.adapterBoundary.unsafeOverrides,
   "tenable-axi": tenable_axi_default.adapterBoundary.unsafeOverrides,
   "awx-axi": awx_axi_default.adapterBoundary.unsafeOverrides,
@@ -43571,6 +44185,25 @@ function rewriteDiscoveryHelp(help, tool) {
 }
 function rewriteSuggestions(output3, tool, truncated = false) {
   if (truncated) return output3;
+  if (tool === "checkpoint-axi") {
+    try {
+      const document = decode3(output3);
+      if (document.command && document.flags) return encode3({
+        ...document,
+        command: document.command.startsWith("artium-axi ") ? document.command : `artium-axi checkpoint-axi ${document.command}`,
+        flags: Object.fromEntries(Object.entries(document.flags).filter(([name]) => !checkpoint_axi_default.adapterBoundary.unsafeOverrides.includes(name.replace(/^--/, "")))),
+        examples: (document.examples ?? []).filter((example) => !/--(?:config|profile|out)\b/.test(example)).map((example) => example.replace(/^checkpoint-axi\b/, "artium-axi checkpoint-axi")),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+      if (document.bin || document.commands) return encode3({
+        bin: "artium-axi checkpoint-axi",
+        description: "Investigate Check Point Email Security with managed credentials.",
+        commands: checkpoint_axi_default.commands.filter((route) => route.effect !== "blocked").map((route) => route.command),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+    } catch {
+    }
+  }
   if (tool === "hybrid-axi") {
     try {
       const document = decode3(output3);
@@ -43734,6 +44367,10 @@ function managedFlagRanges(command, tool) {
   return ranges;
 }
 function hostedHelp(help, tool, flags, commands2) {
+  if (tool === "checkpoint-axi") {
+    help = help.split("\n").filter((line) => !/CHECKPOINT_AXI_|SecretRef|checkpoint-axi (?:config|profile)|Valid commands:/.test(line)).join("\n");
+    if (!help.trim()) help = checkpoint_axi_default.discovery.help;
+  }
   if (tool === "hybrid-axi") {
     help = help.split("\n").filter((line) => !/HYBRID_AXI_|SecretRefs|hybrid-axi (?:setup|config|profile)|--(?:config|profile|origin|output)\b/.test(line)).join("\n");
     const guidance = "Artium manages the API key and fixed origin. Submissions, YARA mutations, consuming matches and four reviewed archive downloads require independently selected administrator-enabled operations, native preview, execute, exact confirmation and journal. Quick scans transmit the supplied sample or URL. Use artium-axi download --help for authenticated one-shot CLI verified saving and live-malware warnings.";
@@ -44037,20 +44674,20 @@ var commands = {
   doctor: { usage: "artium-axi doctor", purpose: "Check the server, certificate, token, CLI version and cached tool health.", flags: [], example: "artium-axi doctor" },
   update: { usage: "artium-axi update", purpose: "Download and verify the server\u2019s client, replace this file and keep a .bak backup. npm installations must use npm install -g @knowttl/artium-axi.", flags: [], example: "artium-axi update" },
   download: {
-    usage: "artium-axi download --operation <operation> --selector <hash|report-id> --type <bin|dropped-files|memory> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
-    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive. Operations remain unavailable until adapter enablement.",
+    usage: "artium-axi download --operation <operation> --selector <selector> --type <type> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
+    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive or Check Point email/attachment. Each operation requires administrator enablement.",
     flags: [
-      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory> (required)",
-      "--selector <hash|report-id> (required)",
-      "--type <bin|dropped-files|memory> (required)",
+      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory|email.download|attachment.download|attachment.download-all> (required)",
+      "--selector <hash|report-id|entity-id|entity-id/attachment-id> (required; attachment.download uses entity-id/attachment-id)",
+      "--type <bin|dropped-files|memory|email|original|attachment|zip> (required; email.download uses email or original, attachment.download uses attachment, attachment.download-all uses zip)",
       "--destination <absolute-new-path> (required; Linux private 0700 directory, no symlink components or overwrite)",
       "--transfer <id> (required for execution; preview transfer ID)",
       "--execute (default false)",
-      "--confirm <exact-confirm> (required for execution; unchanged native preview string)",
+      "--confirm <exact-confirm> (required for execution; unchanged preview string; Check Point confirmation is host-owned)",
       "--password-stdin (default false; otherwise terminal password)",
       "--sso (default false; browser identity confirmation)",
       transferWarning,
-      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB; ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
+      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB (Check Point: 50 MiB with mandatory upstream hash); ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
     ],
     example: "artium-axi download --operation report-download-bin --selector synthetic-report --type bin --destination /controlled/artifacts/new-archive.bin --sso"
   },
@@ -44096,6 +44733,12 @@ var commands = {
     flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", "--body-file - reads stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path.", transferWarning],
     example: "artium-axi hybrid-axi quota"
   },
+  "checkpoint-axi": {
+    usage: "artium-axi checkpoint-axi [<args>]",
+    purpose: "Investigate Check Point Email Security with managed regional credentials.",
+    flags: ["Writes require administrator-selected exact operations, native preview, --execute and exact --confirm. Private JSON inputs are uploaded with --input; stdin is unavailable. Downloads use artium-axi download with host-owned confirmation. Ambiguous deletes remain blocked."],
+    example: "artium-axi checkpoint-axi email search --limit 1"
+  },
   "az-axi": {
     usage: "artium-axi az-axi [<args>]",
     purpose: "Run Azure commands with your managed identity.",
@@ -44413,8 +45056,8 @@ async function toolInput(tool, original) {
   const input2 = {};
   let totalFileBytes = 0;
   const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
-  if ((tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = hunting ? ["file"] : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  if ((tool === "checkpoint-axi" || tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "checkpoint-axi" ? checkpoint_axi_default.adapterBoundary.inputFileFlags : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
@@ -44859,6 +45502,7 @@ async function download(args, output3, managed2) {
     targetDigest: createHash4("sha256").update(destination).digest("hex")
   });
   if (!input2.success || !destination || flags.has("--sso") && flags.has("--password-stdin")) throw new ArtiumError("INVALID_INPUT");
+  const transferRoutes2 = transferRoutesFor(transferTool(input2.data.selection.operation));
   const execute = flags.has("--execute");
   if (execute !== flags.has("--transfer") || execute !== flags.has("--confirm")) throw new ArtiumError("INVALID_INPUT");
   let execution;
@@ -44910,7 +45554,7 @@ async function download(args, output3, managed2) {
         { "x-artium-reauth-ticket": ticket }
       );
       if (!execution) {
-        const preview = transferPreviewSchema.parse(await request(transferRoutes.prepare.path, input2.data));
+        const preview = transferPreviewSchema.parse(await request(transferRoutes2.prepare.path, input2.data));
         if (preview.targetDigest !== input2.data.targetDigest) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44927,7 +45571,7 @@ async function download(args, output3, managed2) {
       let saved = false;
       let receipt = "unconfirmed";
       try {
-        const pending = transferStatusSchema.parse(await request(transferRoutes.status.path, retrieval));
+        const pending = transferStatusSchema.parse(await request(transferRoutes2.status.path, retrieval));
         if (pending.transferId !== execution.transferId || pending.outcome !== "preview" || pending.archive !== null) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44936,11 +45580,11 @@ async function download(args, output3, managed2) {
           expiresAt: pending.expiresAt,
           saveOutcome: "unconfirmed"
         });
-        const status = transferStatusSchema.parse(await request(transferRoutes.execute.path, execution));
+        const status = transferStatusSchema.parse(await request(transferRoutes2.execute.path, execution));
         if (status.transferId !== execution.transferId || status.expiresAt !== pending.expiresAt || status.outcome !== "ready" || !status.archive) throw new ArtiumError("INVALID_RESPONSE");
         archive = status.archive;
         await client.artifact(
-          transferRoutes.retrieve.path,
+          transferRoutes2.retrieve.path,
           retrieval,
           token,
           ticket,
@@ -44950,19 +45594,19 @@ async function download(args, output3, managed2) {
         saved = true;
         await local.close();
         try {
-          await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
+          await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
           receipt = "confirmed";
         } catch {
         }
       } catch (error62) {
         if (archive && !saved) {
           try {
-            await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
+            await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
           } catch {
           }
         }
         try {
-          await request(transferRoutes.cancel.path, retrieval);
+          await request(transferRoutes2.cancel.path, retrieval);
         } catch {
         }
         throw error62;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",