@knowttl/artium-axi 0.0.20 → 0.0.22

package/bin/artium-axi.mjs

@@ -19734,6 +19734,7 @@ var definitions = {
   TOOL_NOT_GRANTED: { status: 403, message: "The user has no role granting this tool.", next: "Ask the administrator to assign a role granting the tool." },
   MASTER_KEY_INVALID: { status: 503, message: "The master key is missing or invalid.", next: "Supply a 32-byte master key file or a base64 master key." },
   CREDENTIAL_INVALID: { status: 503, message: "The stored credential is invalid.", next: "Ask an administrator to check the named field, matching master key and credential JSON, then save and test again." },
+  CREDENTIAL_EXPIRED: { status: 503, message: "The GitHub credential expired or was revoked.", next: "Ask an administrator to reconnect at /admin/tools/gh-axi. Tokens are never refreshed automatically." },
   FLAG_BLOCKED: { status: 400, message: "The arguments override the managed tool boundary.", next: "Remove destination, tenant, credential or local configuration overrides." },
   CREDENTIAL_NOT_CONFIGURED: { status: 503, message: "No credential is configured for the tool.", next: "Ask an administrator to save a credential and run Test credential." },
   UPSTREAM_AUTH_FAILED: { status: 503, message: "The upstream service rejected the credential.", next: "Ask an administrator to check the provider code, identity, secret expiry and permissions, then test again." },
@@ -19775,6 +19776,1246 @@ function errorResponse(error62, requestId) {
   return { error: { code: error62.code, source: error62.source, message: error62.message, next: error62.next, requestId: error62.requestId ?? requestId } };
 }
 
+// tools/inventories/gh-axi.json
+var gh_axi_default = {
+  generatedBy: "scripts/gh-inventory.mjs",
+  tool: "gh-axi",
+  version: "0.1.44",
+  integrity: "sha512-iBH2a59aR/zQHWwMz/7ft6P6ldOBodfolFCgwoKviX8/hMkyAJ8R9hIf3BjRCWz7v11hXvuQXte7P1GQUci9tg==",
+  parserEvidence: "Hand-reviewed published dispatch switches and per-command parsers; exact writes use host preview and confirmation",
+  skillSha256: "3d01b3112442275d52cc5847cb17543c710128f4591346e77eeecc30c45e76f3",
+  sdk: {
+    version: "0.1.13",
+    integrity: "sha512-Ygh8qUN5kdwQ3ASw+BNzCKYpy5QYi18vfcEpqEOQOSrcyh6i4wChrPMtvVW0/3Sqho3xPH3CuFkP0QUma5oxxA==",
+    manifestSha256: "dbe3acffeb40dfcca73ce33f60f807bbba8cd5cec6a470b2c7f255b50e02e184"
+  },
+  gh: {
+    version: "2.101.0",
+    url: "https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_linux_amd64.tar.gz",
+    sha256: "9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8",
+    checksums: "https://github.com/cli/cli/releases/download/v2.101.0/gh_2.101.0_checksums.txt"
+  },
+  sources: [
+    {
+      path: "dist/bin/gh-axi.js",
+      sha256: "85bde76c2b7dd0c72bfb4c52a45c55177c907fa3ac08b68d83bcbc6e2343a4a8"
+    },
+    {
+      path: "dist/src/args.js",
+      sha256: "3a68da77f834d27668d0bb6645defa3884fe04edab1e6f255b7f88e9b590d6fd"
+    },
+    {
+      path: "dist/src/attach.js",
+      sha256: "37cc676365545ddc6eeddb0eb00e143c54f75e9d75e83f17108dafd17065d8eb"
+    },
+    {
+      path: "dist/src/body.js",
+      sha256: "460030cb2561e7188ca6b7aa0d441de64238d4ccc6df189ece5249b8bd4b56a6"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "546fa90992dcaad03178f9d869e5a74f2fc2859bc84443a795518e9b3c96f0e5"
+    },
+    {
+      path: "dist/src/commands/api.js",
+      sha256: "f40412051bea3b5c49c68224a5accd54b18fadada6cefab10280069506f311a1"
+    },
+    {
+      path: "dist/src/commands/discussion.js",
+      sha256: "3e806177d3bebbf2da08fafc07bccc8ca3e0dced78296dfe2d41d9d2baa50904"
+    },
+    {
+      path: "dist/src/commands/gist.js",
+      sha256: "2b80906f9860c5d6cae358f40e931b618eb9742f27567610201b967620c02683"
+    },
+    {
+      path: "dist/src/commands/home.js",
+      sha256: "15ff96c95b737444afb082f538ff55a204062a82a9179f85931015fff211ab16"
+    },
+    {
+      path: "dist/src/commands/issue.js",
+      sha256: "74a8d64041300ee24a14fc8488cd9099e919c211f7a4600b8740580115819185"
+    },
+    {
+      path: "dist/src/commands/label.js",
+      sha256: "54f6f35b114e9e965dd30602cab6fe16feb1d58b54a4062b1bbfcbea568bf896"
+    },
+    {
+      path: "dist/src/commands/pr.js",
+      sha256: "ba7d6333f08e1ebc32484f86e9017b57e37671c6e83cbd5300ee7aab4837a395"
+    },
+    {
+      path: "dist/src/commands/project.js",
+      sha256: "eb02ead1ab4828b6a5db7bd0a3f2c829e497e23a4c191ce5bd9f4003184fda9c"
+    },
+    {
+      path: "dist/src/commands/release.js",
+      sha256: "5a8bc903d81b94767cece3ab7ecb788e74803251720db79b0d6aadcf728ea738"
+    },
+    {
+      path: "dist/src/commands/repo.js",
+      sha256: "8226acc8724144767423474d181fd68edd7460d46e983b8b50c0903d0881f945"
+    },
+    {
+      path: "dist/src/commands/run.js",
+      sha256: "3e87712fa0296d561692fa635320948741c4b057f89ad4b5ee9c6ce730a933a4"
+    },
+    {
+      path: "dist/src/commands/search.js",
+      sha256: "1bf46a1673b537d9ca948800e9cd494938aa7d3f6dfd88f5b0ac75bf4ac56fbc"
+    },
+    {
+      path: "dist/src/commands/secret.js",
+      sha256: "40de397f4e9197230a548c18ede51b52f8351385e95e438f9d81b9c16999acd9"
+    },
+    {
+      path: "dist/src/commands/setup.js",
+      sha256: "028f7ef47f329e2873e84c06ced30567c01ddc8eb2e2bc174d7a1f02fa65d942"
+    },
+    {
+      path: "dist/src/commands/stack.js",
+      sha256: "ffabb16c0a7633b57e25856601708e7ed8a625d0668b9fc983e8be9840ab9fdb"
+    },
+    {
+      path: "dist/src/commands/variable.js",
+      sha256: "86355d036a38264762487647067e08ab8af8511320bb270cc38507603545c872"
+    },
+    {
+      path: "dist/src/commands/workflow.js",
+      sha256: "cf15c2416f2687ac236d1f825c1d1fa82c9ca349cd63c036814cb3744fc37962"
+    },
+    {
+      path: "dist/src/comment.js",
+      sha256: "bade28c489815a8d14d3478043c85070d915ee995289f8ce83aa0d288c1b4905"
+    },
+    {
+      path: "dist/src/context.js",
+      sha256: "4b3e45a3f1fd90e211b72c16c284809f4187d71eaa119385aef20fa7559a5610"
+    },
+    {
+      path: "dist/src/debug.js",
+      sha256: "fcf150a8eefe5f6848d7866da8bdf85bef26ffaa5ccdca7a248f05d665113320"
+    },
+    {
+      path: "dist/src/errors.js",
+      sha256: "83f11df70874ff3983c4da806f0b2f2c371c093764a81590c75eb08ecd9e6bc4"
+    },
+    {
+      path: "dist/src/fields.js",
+      sha256: "4470f2680ad5583f8de182e9db3ea43635982c08da59060fa550bb8fdc9a7fb3"
+    },
+    {
+      path: "dist/src/format.js",
+      sha256: "aa3f03c925fe809f0e083938be03668ec79837b1ecf01f7e1a00d314bded89bf"
+    },
+    {
+      path: "dist/src/gh.js",
+      sha256: "de6defe48e0258999199efd9075a9aef77056c0e4c45407cd9c1304267f24b7c"
+    },
+    {
+      path: "dist/src/gistSelector.js",
+      sha256: "0e42b44f8acb2721c1e41ca16693c089b3861351e3d379f14a9054e0eb2e8441"
+    },
+    {
+      path: "dist/src/host.js",
+      sha256: "31b33c1924fc1dfb0dd100d1ee0ab26aadd6b8110dc338bcba731360c05ce6f5"
+    },
+    {
+      path: "dist/src/secretValue.js",
+      sha256: "56b3ee3a50923a399e71a966fe6381774712ed7ec478ce0adf211ea66606d63b"
+    },
+    {
+      path: "dist/src/skill.js",
+      sha256: "96eb92d2ec2fc58178cf6e45d30f67819feaa0dda5ec72dd80eb3da316413a65"
+    },
+    {
+      path: "dist/src/stdin.js",
+      sha256: "fa82d2ff3096c71d9a3e20554c2fd70748ddd113020073fca89258e7e3560d81"
+    },
+    {
+      path: "dist/src/suggestions.js",
+      sha256: "411eed328a7edce95bb231cdcd7dda1de3e2293351fe27419a04054541a893f1"
+    },
+    {
+      path: "dist/src/toon.js",
+      sha256: "d9f6a6a757cd5166bb0be1120858c4a2c974f92ec5ea0e756135e061795a0355"
+    },
+    {
+      path: "dist/src/totals.js",
+      sha256: "a7e21c8a0ccdc70e11c8211d876d31ccc3ebe7cd3726958c5eb9a9c375784342"
+    },
+    {
+      path: "dist/src/version.js",
+      sha256: "6d3dc30d3422f2c22bb04cd5d2d29475d3dbcd3beff4fb57e2014a0d6df620c2"
+    },
+    {
+      path: "axi-sdk-js/dist/cli.js",
+      sha256: "7bda640cc33a6f5226e60b7df2ef7ea8c765431c0e89a267273993370bdd8121"
+    },
+    {
+      path: "axi-sdk-js/dist/errors.js",
+      sha256: "ae30f95f0a82cfbdb51051575ce713ad90acd8b89138c64fa26e76a8716fda4f"
+    },
+    {
+      path: "axi-sdk-js/dist/fast-path.js",
+      sha256: "a3733ac9e099d3d2f09183f1ad2977a7e9613fa3dd5a207ee5f5f838efbfa840"
+    },
+    {
+      path: "axi-sdk-js/dist/hooks.js",
+      sha256: "3bfe0ce4ec57b475cd69f63a1c9c6487317219540619534dbd583f1042fbb777"
+    },
+    {
+      path: "axi-sdk-js/dist/index.js",
+      sha256: "265f9730c582cb1e8e19dc832f3603006e52d73f22e79b62a995cec400a84b2e"
+    },
+    {
+      path: "axi-sdk-js/dist/output.js",
+      sha256: "87aea7c181989b802af98cbe895f9aae1e72d4bca039dafca6f975ff15fc482c"
+    },
+    {
+      path: "axi-sdk-js/dist/update.js",
+      sha256: "337c6ac93156d50e6ac2375ac436a7a94e87d9bd15d15d030dc060f65b6c88e4"
+    }
+  ],
+  adapterBoundary: {
+    unsafeOverrides: [
+      "hostname",
+      "watch",
+      "attach",
+      "body-file",
+      "notes-file",
+      "input",
+      "file",
+      "add",
+      "raw-field",
+      "header",
+      "admin",
+      "delete-branch",
+      "source",
+      "push",
+      "clone",
+      "remote"
+    ],
+    blockedCommands: [
+      "home",
+      "update",
+      "setup",
+      "stack",
+      "issue lock",
+      "issue unlock",
+      "pr checkout",
+      "repo clone",
+      "gist clone",
+      "run watch",
+      "run download",
+      "release download"
+    ],
+    nativeWrites: "host-classified; exact operations, preview and confirmation",
+    inputs: {
+      stdin: "gist create/edit with filename only",
+      files: "unsupported"
+    }
+  },
+  discovery: {
+    commands: [
+      "issue",
+      "pr",
+      "discussion",
+      "run",
+      "workflow",
+      "release",
+      "repo",
+      "label",
+      "gist",
+      "project",
+      "secret",
+      "variable",
+      "search",
+      "api"
+    ],
+    example: [
+      "repo",
+      "list",
+      "--limit",
+      "1"
+    ],
+    help: "gh-axi repo list [<owner>] [--limit <n>]\nManaged GitHub API access. Use -R OWNER/NAME for repository commands. Writes require an administrator-enabled exact operation, host preview and --confirm. api accepts [GET] <relative-path>; GraphQL and other methods are refused. Stdin only for gist create/edit with --filename; no files.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "issue list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        fields: "value",
+        state: "value",
+        label: "value",
+        assignee: "value",
+        author: "value",
+        milestone: "value",
+        sort: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "issue view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        comments: "boolean",
+        full: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "issue subissue list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "pr list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        fields: "value",
+        state: "value",
+        label: "value",
+        assignee: "value",
+        author: "value",
+        base: "value",
+        head: "value",
+        limit: "value",
+        draft: "boolean"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "pr view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        comments: "boolean",
+        reviews: "boolean",
+        checks: "boolean",
+        full: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "pr diff",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        full: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "pr checks",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        failed: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "discussion list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        state: "value",
+        category: "value",
+        author: "value",
+        label: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "discussion view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        limit: "value",
+        order: "value",
+        comments: "boolean",
+        full: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "run list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        fields: "value",
+        limit: "value",
+        workflow: "value",
+        branch: "value",
+        status: "value",
+        event: "value",
+        user: "value",
+        commit: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "run view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        job: "value",
+        conclusion: "value",
+        log: "boolean",
+        verbose: "boolean",
+        "log-failed": "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "workflow list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        limit: "value",
+        all: "boolean"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "workflow view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        yaml: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "release list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        limit: "value",
+        "exclude-drafts": "boolean",
+        "exclude-pre-releases": "boolean"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "release view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        full: "boolean"
+      },
+      positionals: 1,
+      repository: true
+    },
+    {
+      command: "repo view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "repo list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        limit: "value",
+        visibility: "value",
+        language: "value",
+        archived: "boolean"
+      },
+      positionals: 1,
+      repository: false
+    },
+    {
+      command: "label list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "gist list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        limit: "value",
+        fields: "value",
+        public: "boolean",
+        secret: "boolean"
+      },
+      positionals: 0,
+      repository: false
+    },
+    {
+      command: "gist view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        filename: "value",
+        full: "boolean",
+        files: "boolean"
+      },
+      positionals: 1,
+      repository: false
+    },
+    {
+      command: "project list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        limit: "value",
+        closed: "boolean"
+      },
+      positionals: 0,
+      repository: false
+    },
+    {
+      command: "project view",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value"
+      },
+      positionals: 1,
+      repository: false
+    },
+    {
+      command: "project item-list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        query: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      repository: false
+    },
+    {
+      command: "project field-list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      repository: false
+    },
+    {
+      command: "secret list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        env: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "variable list",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value"
+      },
+      positionals: 0,
+      repository: true
+    },
+    {
+      command: "search issues",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        state: "value",
+        label: "value",
+        assignee: "value",
+        author: "value",
+        sort: "value",
+        limit: "value",
+        fields: "value"
+      },
+      positionals: "variadic",
+      repository: false
+    },
+    {
+      command: "search prs",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        state: "value",
+        label: "value",
+        assignee: "value",
+        author: "value",
+        sort: "value",
+        limit: "value",
+        review: "value",
+        fields: "value",
+        draft: "boolean"
+      },
+      positionals: "variadic",
+      repository: false
+    },
+    {
+      command: "search repos",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        owner: "value",
+        language: "value",
+        stars: "value",
+        sort: "value",
+        limit: "value"
+      },
+      positionals: "variadic",
+      repository: false
+    },
+    {
+      command: "search commits",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        author: "value",
+        sort: "value",
+        limit: "value"
+      },
+      positionals: "variadic",
+      repository: false
+    },
+    {
+      command: "search code",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        owner: "value",
+        language: "value",
+        limit: "value"
+      },
+      positionals: "variadic",
+      repository: false
+    },
+    {
+      command: "api",
+      effect: "read",
+      flags: {
+        help: "boolean",
+        jq: "value",
+        template: "value",
+        paginate: "boolean",
+        full: "boolean"
+      },
+      positionals: 2,
+      repository: false
+    },
+    {
+      command: "issue create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        body: "value",
+        assignee: "value",
+        label: "value",
+        milestone: "value",
+        project: "value",
+        type: "value",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "issue edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        body: "value",
+        "add-label": "value",
+        "remove-label": "value",
+        "add-assignee": "value",
+        "remove-assignee": "value",
+        milestone: "value",
+        type: "value",
+        "no-type": "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "issue comment",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        body: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "issue close",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        reason: "value",
+        "duplicate-of": "value",
+        comment: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "issue reopen",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "pr create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        body: "value",
+        base: "value",
+        head: "value",
+        assignee: "value",
+        reviewer: "value",
+        label: "value",
+        milestone: "value",
+        project: "value",
+        draft: "boolean",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "pr edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        body: "value",
+        "add-label": "value",
+        "remove-label": "value",
+        "add-assignee": "value",
+        "remove-assignee": "value",
+        "add-reviewer": "value",
+        "remove-reviewer": "value",
+        milestone: "value",
+        base: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "pr comment",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        body: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "pr ready",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        undo: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "pr review",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        body: "value",
+        "match-head-commit": "value",
+        approve: "boolean",
+        "request-changes": "boolean",
+        comment: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "discussion comment",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        body: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "label create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        name: "value",
+        color: "value",
+        description: "value",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "label edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        name: "value",
+        color: "value",
+        description: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "collaboration"
+    },
+    {
+      command: "project item-add",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        owner: "value",
+        url: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: false,
+      tier: "collaboration"
+    },
+    {
+      command: "project item-create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        owner: "value",
+        title: "value",
+        body: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: false,
+      tier: "collaboration"
+    },
+    {
+      command: "project item-edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        owner: "value",
+        id: "value",
+        "project-id": "value",
+        "field-id": "value",
+        text: "value",
+        number: "value",
+        date: "value",
+        "single-select-option-id": "value",
+        "iteration-id": "value",
+        title: "value",
+        body: "value",
+        clear: "boolean",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: false,
+      tier: "collaboration"
+    },
+    {
+      command: "project item-archive",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        owner: "value",
+        id: "value",
+        undo: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: false,
+      tier: "collaboration"
+    },
+    {
+      command: "pr merge",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        method: "value",
+        body: "value",
+        subject: "value",
+        "match-head-commit": "value",
+        auto: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "pr update-branch",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "pr revert",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "release create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        notes: "value",
+        target: "value",
+        "discussion-category": "value",
+        "notes-start-tag": "value",
+        draft: "boolean",
+        prerelease: "boolean",
+        "generate-notes": "boolean",
+        "verify-tag": "boolean",
+        "notes-from-tag": "boolean",
+        "fail-on-no-commits": "boolean",
+        latest: "boolean-value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "release edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        title: "value",
+        notes: "value",
+        draft: "boolean-value",
+        prerelease: "boolean-value",
+        latest: "boolean-value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "workflow run",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        ref: "value",
+        field: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "workflow enable",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "workflow disable",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "run rerun",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        job: "value",
+        failed: "boolean",
+        debug: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "run cancel",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "repo create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        description: "value",
+        template: "value",
+        public: "boolean",
+        private: "boolean",
+        internal: "boolean",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: false,
+      tier: "repository"
+    },
+    {
+      command: "repo edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        description: "value",
+        "default-branch": "value",
+        "enable-issues": "value",
+        "enable-wiki": "value",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "repo fork",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "gist create",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        desc: "value",
+        filename: "value",
+        public: "boolean",
+        secret: "boolean",
+        confirm: "value"
+      },
+      positionals: 0,
+      repository: false,
+      tier: "repository"
+    },
+    {
+      command: "gist edit",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        desc: "value",
+        filename: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: false,
+      tier: "repository"
+    },
+    {
+      command: "gist rename",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        confirm: "value"
+      },
+      positionals: 3,
+      repository: false,
+      tier: "repository"
+    },
+    {
+      command: "variable set",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        body: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "issue pin",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    },
+    {
+      command: "issue transfer",
+      effect: "write",
+      flags: {
+        help: "boolean",
+        repo: "value",
+        "to-repo": "value",
+        confirm: "value"
+      },
+      positionals: 1,
+      repository: true,
+      tier: "repository"
+    }
+  ]
+};
+
 // src/shared/api.ts
 var inputLimits = {
   requestBytes: 16 * 1024 * 1024,
@@ -19801,8 +21042,14 @@ var transferSelectionSchema = external_exports.discriminatedUnion("operation", [
   external_exports.strictObject({ operation: external_exports.literal("hash-download-bin"), selector: sampleSha256Schema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-bin"), selector: reportIdSchema, type: external_exports.literal("bin") }),
   external_exports.strictObject({ operation: external_exports.literal("report-download-dropped-files"), selector: reportIdSchema, type: external_exports.literal("dropped-files") }),
-  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") })
+  external_exports.strictObject({ operation: external_exports.literal("report-download-memory"), selector: reportIdSchema, type: external_exports.literal("memory") }),
+  external_exports.strictObject({ operation: external_exports.literal("email.download"), selector: transferOwnerIdSchema, type: external_exports.enum(["email", "original"]) }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download"), selector: external_exports.string().regex(/^[A-Za-z0-9_-]{1,256}\/[A-Za-z0-9_-]{1,256}$/), type: external_exports.literal("attachment") }),
+  external_exports.strictObject({ operation: external_exports.literal("attachment.download-all"), selector: transferOwnerIdSchema, type: external_exports.literal("zip") })
 ]);
+function transferTool(operation) {
+  return ["email.download", "attachment.download", "attachment.download-all"].includes(operation) ? "checkpoint-axi" : "hybrid-axi";
+}
 var transferPrepareSchema = external_exports.strictObject({ selection: transferSelectionSchema, targetDigest: sha256Schema });
 var transferIdSchema = external_exports.uuid();
 var transferScopeSchema = external_exports.strictObject({
@@ -19865,12 +21112,18 @@ var transferRoutes = {
   cancel: { method: "POST", path: "/v1/transfers/hybrid/cancel", input: transferRetrieveSchema },
   status: { method: "POST", path: "/v1/transfers/hybrid/status", input: transferRetrieveSchema, response: transferStatusSchema }
 };
+function transferRoutesFor(tool) {
+  return Object.fromEntries(Object.entries(transferRoutes).map(([name, route]) => [
+    name,
+    { ...route, path: route.path.replace("/hybrid/", tool === "checkpoint-axi" ? "/checkpoint/" : "/hybrid/") }
+  ]));
+}
 var transferAuditSchema = external_exports.strictObject({
   transfer_id: transferIdSchema,
   session_family_id: transferOwnerIdSchema,
-  transfer_operation: transferSelectionSchema.options[0].shape.operation.or(transferSelectionSchema.options[1].shape.operation).or(transferSelectionSchema.options[2].shape.operation).or(transferSelectionSchema.options[3].shape.operation),
-  artifact_type: external_exports.enum(["bin", "dropped-files", "memory"]),
-  artifact_selector: sha256Schema.or(reportIdSchema),
+  transfer_operation: external_exports.enum(transferSelectionSchema.options.map((option) => option.shape.operation.value)),
+  artifact_type: external_exports.enum(["bin", "dropped-files", "memory", "email", "original", "attachment", "zip"]),
+  artifact_selector: external_exports.string().min(1).max(513),
   requested_target_digest: sha256Schema,
   archive_bytes: external_exports.number().int().nonnegative().max(transferLimits.artifactBytes).nullable(),
   archive_sha256: sha256Schema.nullable(),
@@ -19928,7 +21181,7 @@ var meResponseSchema = external_exports.strictObject({
   sessionExpiresAt: external_exports.number().int()
 });
 var accountId = external_exports.string().min(1);
-var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi"]);
+var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi", "awx-axi", "tenable-axi", "hybrid-axi", "checkpoint-axi", "gh-axi"]);
 var skillsResponseSchema = external_exports.strictObject({ skills: external_exports.array(external_exports.strictObject({
   name: toolSchema,
   content: external_exports.string().min(1)
@@ -20179,7 +21432,16 @@ var falconRtrSettingsSchema = external_exports.strictObject({
     "users"
   ])).optional()
 });
+var ghWriteOperations = gh_axi_default.commands.filter((route) => route.effect === "write").map((route) => route.command);
 var nativeSettingsSchemas = {
+  "gh-axi": external_exports.strictObject({ writes: external_exports.strictObject({
+    allowWrites: external_exports.boolean(),
+    operations: external_exports.array(external_exports.enum(ghWriteOperations)).min(1).max(ghWriteOperations.length)
+  }).optional() }),
+  "checkpoint-axi": external_exports.strictObject({ writes: external_exports.strictObject({
+    allowWrites: external_exports.boolean(),
+    operations: external_exports.array(external_exports.string().regex(/^[a-z][A-Za-z0-9_.-]{0,255}$/)).min(1).max(126)
+  }).optional() }),
   "hybrid-axi": external_exports.strictObject({ writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string())
@@ -20192,7 +21454,7 @@ var nativeSettingsSchemas = {
   "ldap-axi": external_exports.strictObject({}),
   "ado-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
   "mg-axi": external_exports.strictObject({
-    enabledPacks: external_exports.array(external_exports.enum(["entra", "security"])).min(1).max(2).refine((packs) => packs.includes("entra") && new Set(packs).size === packs.length).optional(),
+    enabledPacks: external_exports.array(external_exports.enum(["entra", "security", "mail"])).min(1).max(3).refine((packs) => packs.includes("entra") && new Set(packs).size === packs.length).optional(),
     preview: external_exports.boolean().optional(),
     writes: external_exports.strictObject({
       allowWrites: external_exports.boolean(),
@@ -20341,6 +21603,40 @@ var adminCertificateRoutes = {
     response: external_exports.strictObject({ removed: external_exports.literal(true) })
   }
 };
+var githubConnectionInput = external_exports.strictObject({ connectionId: external_exports.uuid() });
+var githubDeviceRoutes = {
+  start: {
+    method: "POST",
+    path: "/v1/admin/tools/gh-axi/device",
+    input: external_exports.strictObject({
+      origin: external_exports.string(),
+      expectedRevision: external_exports.number().int().nonnegative(),
+      expectedToolRevision: external_exports.number().int().positive()
+    }),
+    response: external_exports.strictObject({
+      connectionId: external_exports.uuid(),
+      userCode: external_exports.string(),
+      verificationUri: external_exports.url(),
+      expiresAt: external_exports.number().int(),
+      interval: external_exports.number().int().positive()
+    })
+  },
+  poll: {
+    method: "POST",
+    path: "/v1/admin/tools/gh-axi/device/poll",
+    input: githubConnectionInput,
+    response: external_exports.union([
+      external_exports.strictObject({ status: external_exports.literal("pending"), interval: external_exports.number().int().positive() }),
+      external_exports.strictObject({ status: external_exports.literal("connected"), credential: adminCredentialSchema })
+    ])
+  },
+  cancel: {
+    method: "POST",
+    path: "/v1/admin/tools/gh-axi/device/cancel",
+    input: githubConnectionInput,
+    response: external_exports.strictObject({ status: external_exports.literal("cancelled") })
+  }
+};
 var adminToolRoutes = {
   get: {
     method: "GET",
@@ -20748,7 +22044,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.20",
+  version: "0.0.22",
   private: true,
   license: "MIT",
   type: "module",
@@ -29750,11 +31046,11 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.13",
-  integrity: "sha512-V9f/H1xISbn1ar3ARVnYvtT4NDUDRgvhCkrnQd6lqNdj1MeQjF4JESS6PA6hY3epXKrqE+g/2nCfgJV1JDmDTQ==",
+  version: "0.1.14",
+  integrity: "sha512-XGsOHDrzAF0n8Sx57gREUuH1zysJnAzGmPt/7jm4tTF7uJl1db8oLx/E9NqSiG9mhhJXD5W36e6ucIHJO6x4AQ==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "2357d6568740146d05a0ad67fb8e0be3c871261726d3cf110fed83e216001dc9",
-  skillSha256: "98ff12e741b04592afae76853a00f572940dee6edf0e868d2ccba04a742b24ad",
+  packageManifestSha256: "b000465e5f21bdff8b6afb76e64bf2850debae765f36361977a6e6ac0f45a309",
+  skillSha256: "0954c03b28e235ac9c94e0032db2ee8f869ba11e67f11990eb8ad3c5339abdb5",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -29792,7 +31088,7 @@ var mg_axi_default = {
   environmentSources: [
     {
       path: "dist/profiles.js",
-      sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
+      sha256: "2f681aeb6e28398b3850865ff239490f74569f02a21926af97f7777fa4350b1f"
     },
     {
       path: "dist/mutations.js",
@@ -29832,7 +31128,7 @@ var mg_axi_default = {
     sources: [
       {
         path: "dist/profiles.js",
-        sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
+        sha256: "2f681aeb6e28398b3850865ff239490f74569f02a21926af97f7777fa4350b1f"
       },
       {
         path: "dist/mutations.js",
@@ -29850,7 +31146,16 @@ var mg_axi_default = {
       "doctor",
       "entra",
       "api get",
-      "security hunting query"
+      "security hunting query",
+      "mail folder list",
+      "mail folder show",
+      "mail message list",
+      "mail message show",
+      "mail attachment list",
+      "mail settings show",
+      "mail rule list",
+      "mail rule show",
+      "mail category list"
     ],
     example: [
       "entra",
@@ -29912,15 +31217,15 @@ var mg_axi_default = {
     sources: [
       {
         path: "dist/catalogue.js",
-        sha256: "b6a764b7e50c3f4c84d40dcef1290a2e6a784fe73809977d6b04c06884b7a516"
+        sha256: "d73aa0bb4411aa3da6f2345af80dbb15faac403d704992ac8c135c9d0e991fe0"
       },
       {
         path: "dist/cli.js",
-        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
+        sha256: "217e731835772f4f625811cde4733a67b43dee8f2ef5603e9058730998e1a26d"
       },
       {
         path: "dist/profiles.js",
-        sha256: "5a683251d3427b1642a3d60b5168ae56656506d12aae614ad4469dde6c6d624e"
+        sha256: "2f681aeb6e28398b3850865ff239490f74569f02a21926af97f7777fa4350b1f"
       },
       {
         path: "dist/msal-app-provider.js",
@@ -29951,8 +31256,29 @@ var mg_axi_default = {
       "doctor",
       "entra",
       "api get",
-      "security hunting query"
+      "security hunting query",
+      "mail folder list",
+      "mail folder show",
+      "mail message list",
+      "mail message show",
+      "mail attachment list",
+      "mail settings show",
+      "mail rule list",
+      "mail rule show",
+      "mail category list"
     ],
+    commandPacks: {
+      "security hunting query": "security",
+      "mail folder list": "mail",
+      "mail folder show": "mail",
+      "mail message list": "mail",
+      "mail message show": "mail",
+      "mail attachment list": "mail",
+      "mail settings show": "mail",
+      "mail rule list": "mail",
+      "mail rule show": "mail",
+      "mail category list": "mail"
+    },
     inputs: {
       stdin: "cursor - only",
       files: "security hunting query only: one UTF-8 query.kql upload, at most 64 KiB; fixed runner leaf name",
@@ -29961,7 +31287,9 @@ var mg_axi_default = {
     },
     sensitiveFlags: [
       "cursor",
+      "search",
       "filter",
+      "conversation",
       "odata",
       "conditions",
       "grant-controls",
@@ -29990,11 +31318,11 @@ var mg_axi_default = {
     parserSources: [
       {
         path: "dist/catalogue.js",
-        sha256: "b6a764b7e50c3f4c84d40dcef1290a2e6a784fe73809977d6b04c06884b7a516"
+        sha256: "d73aa0bb4411aa3da6f2345af80dbb15faac403d704992ac8c135c9d0e991fe0"
       },
       {
         path: "dist/cli.js",
-        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
+        sha256: "217e731835772f4f625811cde4733a67b43dee8f2ef5603e9058730998e1a26d"
       }
     ]
   },
@@ -30032,6 +31360,9 @@ var mg_axi_default = {
     {
       name: "assignment-id"
     },
+    {
+      name: "body"
+    },
     {
       name: "certificate-key-env"
     },
@@ -30065,6 +31396,9 @@ var mg_axi_default = {
     {
       name: "confirm"
     },
+    {
+      name: "conversation"
+    },
     {
       name: "cursor"
     },
@@ -30101,6 +31435,9 @@ var mg_axi_default = {
     {
       name: "filter"
     },
+    {
+      name: "folder"
+    },
     {
       name: "full"
     },
@@ -30110,6 +31447,9 @@ var mg_axi_default = {
     {
       name: "group"
     },
+    {
+      name: "headers"
+    },
     {
       name: "help"
     },
@@ -30122,6 +31462,9 @@ var mg_axi_default = {
     {
       name: "limit"
     },
+    {
+      name: "mailbox"
+    },
     {
       name: "member-id"
     },
@@ -30170,6 +31513,9 @@ var mg_axi_default = {
     {
       name: "scopes"
     },
+    {
+      name: "search"
+    },
     {
       name: "select"
     },
@@ -34480,70 +35826,206 @@ var mg_axi_default = {
         fields: "value",
         full: "boolean",
         cursor: "value",
-        scopes: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run task-processing-result show",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        id: "value",
+        fields: "value",
+        full: "boolean",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "entra lifecycle run task-processing-result count",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        workflow: "value",
+        run: "value",
+        scopes: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "api get",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        odata: "value",
+        cursor: "value",
+        scopes: "value",
+        limit: "value",
+        all: "boolean",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: {
+        name: "path",
+        description: "Server-relative Graph path, e.g. /users",
+        required: true
+      }
+    },
+    {
+      command: "security hunting query",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        file: "value",
+        timespan: "value",
+        limit: "value",
+        full: "boolean",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "mail attachment list",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        mailbox: "value",
+        full: "boolean",
+        fields: "value",
+        limit: "value",
+        cursor: "value",
+        id: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "mail settings show",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        mailbox: "value",
+        full: "boolean",
+        fields: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "mail rule list",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        mailbox: "value",
+        full: "boolean",
+        fields: "value",
+        limit: "value",
+        cursor: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "mail rule show",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        mailbox: "value",
+        full: "boolean",
+        fields: "value",
+        id: "value",
+        config: "value"
+      },
+      positionalInput: false
+    },
+    {
+      command: "mail category list",
+      flags: {
+        help: "boolean",
+        profile: "value",
+        "api-version": "value",
+        mailbox: "value",
+        full: "boolean",
+        fields: "value",
+        limit: "value",
+        cursor: "value",
         config: "value"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run task-processing-result show",
+      command: "mail message show",
       flags: {
         help: "boolean",
         profile: "value",
         "api-version": "value",
-        workflow: "value",
-        run: "value",
+        mailbox: "value",
         id: "value",
-        fields: "value",
+        body: "value",
+        headers: "boolean",
         full: "boolean",
-        scopes: "value",
         config: "value"
       },
       positionalInput: false
     },
     {
-      command: "entra lifecycle run task-processing-result count",
+      command: "mail message list",
       flags: {
         help: "boolean",
         profile: "value",
         "api-version": "value",
-        workflow: "value",
-        run: "value",
-        scopes: "value",
+        mailbox: "value",
+        fields: "value",
+        full: "boolean",
+        folder: "value",
+        search: "value",
+        filter: "value",
+        conversation: "value",
+        limit: "value",
+        cursor: "value",
         config: "value"
       },
       positionalInput: false
     },
     {
-      command: "api get",
+      command: "mail folder list",
       flags: {
         help: "boolean",
         profile: "value",
         "api-version": "value",
-        odata: "value",
-        cursor: "value",
-        scopes: "value",
-        limit: "value",
-        all: "boolean",
+        mailbox: "value",
+        fields: "value",
         full: "boolean",
+        limit: "value",
+        cursor: "value",
         config: "value"
       },
-      positionalInput: {
-        name: "path",
-        description: "Server-relative Graph path, e.g. /users",
-        required: true
-      }
+      positionalInput: false
     },
     {
-      command: "security hunting query",
+      command: "mail folder show",
       flags: {
         help: "boolean",
         profile: "value",
         "api-version": "value",
-        file: "value",
-        timespan: "value",
-        limit: "value",
+        mailbox: "value",
+        fields: "value",
         full: "boolean",
+        id: "value",
         config: "value"
       },
       positionalInput: false
@@ -41530,77 +43012,325 @@ var hybrid_axi_default = {
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it",
-        labs: "Select experimental Labs API; default stable"
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it",
+        labs: "Select experimental Labs API; default stable"
+      }
+    },
+    {
+      command: "auth status",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
+        profile: "Profile name; default profile precedence"
+      }
+    },
+    {
+      command: "config path",
+      effect: "blocked",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
+        profile: "Profile selector; does not affect paths"
+      }
+    },
+    {
+      command: "doctor",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
+        profile: "Profile name; default profile precedence"
+      }
+    },
+    {
+      command: "feed abuse",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it",
+        page: "Upstream page; default 1"
+      }
+    },
+    {
+      command: "feed detonation",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it"
+      }
+    },
+    {
+      command: "feed latest",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it"
+      }
+    },
+    {
+      command: "feed quick-scan",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it"
+      }
+    },
+    {
+      command: "hash file",
+      effect: "blocked",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        output: "Required new file in an existing directory; never stdout or overwrite",
+        execute: "Execute once after exact confirmation; default preview only",
+        "dry-run": "Preview only; mutually exclusive with --execute",
+        confirm: "Exact confirmation string from the preview, binding profile, ID, type and destination"
+      }
+    },
+    {
+      command: "hash search",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "Include all response fields; default false",
+        hash: "One MD5/SHA1/SHA256/SHA512; exactly one selector required",
+        "hashes-file": "Newline-separated MD5/SHA1/SHA256 file; deprecated bulk route",
+        limit: "Local row limit; default 100; --full does not change it"
+      }
+    },
+    {
+      command: "hash show",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "Include all response fields; default false",
+        labs: "Experimental Labs overview; default false",
+        limit: "Local row limit; default 100; --full does not change it"
+      }
+    },
+    {
+      command: "home",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
+        profile: "Profile name; default HYBRID_AXI_PROFILE or profile precedence"
+      }
+    },
+    {
+      command: "hunting matches",
+      effect: "write",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false",
+        execute: "Execute once; default preview only",
+        "dry-run": "Preview only; mutually exclusive with --execute",
+        confirm: "Exact preview confirmation binding profile, target and payload digest",
+        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
+        "items-count": "Maximum returned matches; default 100, range 1-1000",
+        "search-after": "Optional RFC3339 date-time; only matches created after this timestamp"
+      }
+    },
+    {
+      command: "hunting yara create",
+      effect: "write",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false",
+        execute: "Execute once; default preview only",
+        "dry-run": "Preview only; mutually exclusive with --execute",
+        confirm: "Exact preview confirmation binding profile, target and payload digest",
+        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
+        "body-file": "Required strict JSON body, at most 1 MiB; - reads stdin"
+      }
+    },
+    {
+      command: "hunting yara delete",
+      effect: "write",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false",
+        execute: "Execute once; default preview only",
+        "dry-run": "Preview only; mutually exclusive with --execute",
+        confirm: "Exact preview confirmation binding profile, target and payload digest",
+        "intent-id": "Optional unique intent ID; never reuse an unresolved intent"
+      }
+    },
+    {
+      command: "hunting yara list",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false",
+        search: "Optional text filter",
+        "threat-category": "Optional comma-separated categories",
+        status: "Optional active or paused"
+      }
+    },
+    {
+      command: "hunting yara show",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false"
+      }
+    },
+    {
+      command: "hunting yara update",
+      effect: "write",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All response fields and untruncated text; default false",
+        execute: "Execute once; default preview only",
+        "dry-run": "Preview only; mutually exclusive with --execute",
+        confirm: "Exact preview confirmation binding profile, target and payload digest",
+        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
+        "body-file": "Required strict JSON body, at most 1 MiB; - reads stdin"
       }
     },
     {
-      command: "auth status",
-      effect: "read",
+      command: "profile list",
+      effect: "blocked",
       flags: {
         help: "Show help; default false",
         config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile name; default profile precedence"
+        profile: "Profile selector; does not filter the list"
       }
     },
     {
-      command: "config path",
-      effect: "blocked",
+      command: "quick-scan file",
+      effect: "read",
       flags: {
         help: "Show help; default false",
-        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile selector; does not affect paths"
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        full: "All response fields; default false",
+        fields: "Comma-separated response fields; default compact fields",
+        comment: "Optional comment; default omitted",
+        "submit-name": "Optional submission name; default omitted",
+        file: "Required regular file, at most 250 MiB",
+        "scan-type": "Required: all, all_lookup, all_scan, lookup_ha, scan_crowdstrike_ml, scan_metadefender"
       }
     },
     {
-      command: "doctor",
+      command: "quick-scan scanners",
       effect: "read",
       flags: {
         help: "Show help; default false",
-        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile name; default profile precedence"
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        full: "All response fields; default false",
+        fields: "Comma-separated response fields; default compact fields"
       }
     },
     {
-      command: "feed abuse",
+      command: "quick-scan show",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it",
-        page: "Upstream page; default 1"
+        full: "All response fields; default false",
+        fields: "Comma-separated response fields; default compact fields"
       }
     },
     {
-      command: "feed detonation",
-      effect: "read",
+      command: "quick-scan submit",
+      effect: "write",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        execute: "Send once; default preview only",
+        "dry-run": "Preview only; incompatible with --execute",
+        confirm: "Exact confirmation from the preview; required with --execute",
+        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
+        "environment-id": "Required documented environment: 100, 110, 120, 140, 160, 200, 330, 430",
+        "action-script": "Optional: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie; default omitted",
+        "experimental-anti-evasion": "Optional experimental_anti_evasion; default omitted; explicit true or false",
+        "script-logging": "Optional script_logging; default omitted; explicit true or false",
+        "input-sample-tampering": "Optional input_sample_tampering; default omitted; explicit true or false",
+        "network-settings": "Optional: default, tor, simulated; default omitted",
+        email: "Optional email; default omitted",
+        comment: "Optional comment; default omitted",
+        "custom-date-time": "Optional YYYY-MM-DD HH:mm; default omitted",
+        "custom-cmd-line": "Optional custom_cmd_line; default omitted",
+        "custom-run-time": "Optional positive integer seconds; default omitted",
+        "submit-name": "Optional submit_name; default omitted",
+        priority: "Optional integer 1-10; default omitted (upstream 5)",
+        "document-password": "Optional document_password; default omitted",
+        "environment-variable": "Optional environment_variable; default omitted"
       }
     },
     {
-      command: "feed latest",
+      command: "quick-scan url",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
+        full: "All response fields; default false",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        comment: "Optional comment; default omitted",
+        "submit-name": "Optional submission name; default omitted",
+        url: "Required exact HTTP(S) URL without embedded credentials",
+        "scan-type": "Required: all, all_lookup, all_scan, lookup_ha, scan_crowdstrike_ml, scan_metadefender, lookup_cleandns, lookup_bforeai, scan_urlscanio, scan_scamadviser, scan_criminalip, scan_vipre"
       }
     },
     {
-      command: "feed quick-scan",
+      command: "quota",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
+        profile: "Profile name; default profile precedence"
+      }
+    },
+    {
+      command: "report children",
       effect: "read",
       flags: {
         help: "Show help; default false",
@@ -41612,12 +43342,13 @@ var hybrid_axi_default = {
       }
     },
     {
-      command: "hash file",
+      command: "report file",
       effect: "blocked",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
+        type: "Required single type: crt, pcap, json, memory-strings, xml, html, pdf, maec, stix, misp, misp-json, openioc, bin, dropped-files, memory",
         output: "Required new file in an existing directory; never stdout or overwrite",
         execute: "Execute once after exact confirmation; default preview only",
         "dry-run": "Preview only; mutually exclusive with --execute",
@@ -41625,178 +43356,200 @@ var hybrid_axi_default = {
       }
     },
     {
-      command: "hash search",
+      command: "report memory hex",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "Include all response fields; default false",
-        hash: "One MD5/SHA1/SHA256/SHA512; exactly one selector required",
-        "hashes-file": "Newline-separated MD5/SHA1/SHA256 file; deprecated bulk route",
-        limit: "Local row limit; default 100; --full does not change it"
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it",
+        filename: "Required exact memory dump filename"
       }
     },
     {
-      command: "hash show",
+      command: "report memory list",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "Include all response fields; default false",
-        labs: "Experimental Labs overview; default false",
+        full: "All fields and untruncated text; default false",
         limit: "Local row limit; default 100; --full does not change it"
       }
     },
     {
-      command: "home",
+      command: "report memory strings",
       effect: "read",
       flags: {
         help: "Show help; default false",
-        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile name; default HYBRID_AXI_PROFILE or profile precedence"
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it",
+        filename: "Required exact memory dump filename"
       }
     },
     {
-      command: "hunting matches",
-      effect: "write",
+      command: "report screenshots",
+      effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false",
-        execute: "Execute once; default preview only",
-        "dry-run": "Preview only; mutually exclusive with --execute",
-        confirm: "Exact preview confirmation binding profile, target and payload digest",
-        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
-        "items-count": "Maximum returned matches; default 100, range 1-1000",
-        "search-after": "Optional RFC3339 date-time; only matches created after this timestamp"
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it"
       }
     },
     {
-      command: "hunting yara create",
-      effect: "write",
+      command: "report show",
+      effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false",
-        execute: "Execute once; default preview only",
-        "dry-run": "Preview only; mutually exclusive with --execute",
-        confirm: "Exact preview confirmation binding profile, target and payload digest",
-        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
-        "body-file": "Required strict JSON body, at most 1 MiB; - reads stdin"
+        full: "All fields and untruncated text; default false"
       }
     },
     {
-      command: "hunting yara delete",
-      effect: "write",
+      command: "report state",
+      effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false",
-        execute: "Execute once; default preview only",
-        "dry-run": "Preview only; mutually exclusive with --execute",
-        confirm: "Exact preview confirmation binding profile, target and payload digest",
-        "intent-id": "Optional unique intent ID; never reuse an unresolved intent"
+        full: "All fields and untruncated text; default false"
       }
     },
     {
-      command: "hunting yara list",
+      command: "search results",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false",
-        search: "Optional text filter",
-        "threat-category": "Optional comma-separated categories",
-        status: "Optional active or paused"
+        full: "Include all response fields; default false"
       }
     },
     {
-      command: "hunting yara show",
+      command: "search run",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false"
+        full: "Include all response fields; default false",
+        query: "Required nonempty query",
+        size: "Results per page or async total; default 50, range 1-200",
+        page: "Synchronous page, ignored asynchronously; default 1, minimum 1",
+        "date-from": "Inclusive YYYY-MM-DD; default omitted",
+        "date-to": "Inclusive YYYY-MM-DD; default omitted"
       }
     },
     {
-      command: "hunting yara update",
-      effect: "write",
+      command: "search terms",
+      effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All response fields and untruncated text; default false",
-        execute: "Execute once; default preview only",
-        "dry-run": "Preview only; mutually exclusive with --execute",
-        confirm: "Exact preview confirmation binding profile, target and payload digest",
-        "intent-id": "Optional unique intent ID; never reuse an unresolved intent",
-        "body-file": "Required strict JSON body, at most 1 MiB; - reads stdin"
+        full: "Include all response fields; default false",
+        filename: "Optional nonempty filter; default omitted",
+        filetype: "Optional nonempty filter; default omitted",
+        "filetype-desc": "Optional nonempty filter; default omitted",
+        "env-id": "Optional nonempty filter; default omitted",
+        country: "Optional nonempty filter; default omitted",
+        verdict: "Optional nonempty filter; default omitted",
+        "av-detect": "Optional nonempty filter; default omitted",
+        "vx-family": "Optional nonempty filter; default omitted",
+        tag: "Optional nonempty filter; default omitted",
+        "date-from": "Optional nonempty filter; default omitted",
+        "date-to": "Optional nonempty filter; default omitted",
+        port: "Optional nonempty filter; default omitted",
+        host: "Optional nonempty filter; default omitted",
+        domain: "Optional nonempty filter; default omitted",
+        url: "Optional nonempty filter; default omitted",
+        "similar-to": "Optional nonempty filter; default omitted",
+        context: "Optional nonempty filter; default omitted",
+        "imp-hash": "Optional nonempty filter; default omitted",
+        ssdeep: "Optional nonempty filter; default omitted",
+        authentihash: "Optional nonempty filter; default omitted",
+        "uses-tactic": "Optional nonempty filter; default omitted",
+        "uses-technique": "Optional nonempty filter; default omitted"
       }
     },
     {
-      command: "profile list",
+      command: "setup",
       effect: "blocked",
       flags: {
         help: "Show help; default false",
         config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile selector; does not filter the list"
+        profile: "Profile selector; template uses example"
       }
     },
     {
-      command: "quick-scan file",
-      effect: "read",
+      command: "setup hooks",
+      effect: "blocked",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        full: "All response fields; default false",
-        fields: "Comma-separated response fields; default compact fields",
-        comment: "Optional comment; default omitted",
-        "submit-name": "Optional submission name; default omitted",
-        file: "Required regular file, at most 250 MiB",
-        "scan-type": "Required: all, all_lookup, all_scan, lookup_ha, scan_crowdstrike_ml, scan_metadefender"
+        help: "Show help without installing",
+        scope: "user (default) or project; Codex hooks feature is always enabled in user config"
       }
     },
     {
-      command: "quick-scan scanners",
-      effect: "read",
+      command: "submit dropped-file",
+      effect: "write",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        full: "All response fields; default false",
-        fields: "Comma-separated response fields; default compact fields"
+        execute: "Send once; default preview only",
+        "dry-run": "Preview only; incompatible with --execute",
+        confirm: "Exact confirmation from the preview; required with --execute",
+        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
+        id: "Required source job ID or sha256:environmentId",
+        "file-hash": "Required dropped-file SHA256"
       }
     },
     {
-      command: "quick-scan show",
-      effect: "read",
+      command: "submit file",
+      effect: "write",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        full: "All response fields; default false",
-        fields: "Comma-separated response fields; default compact fields"
+        execute: "Send once; default preview only",
+        "dry-run": "Preview only; incompatible with --execute",
+        confirm: "Exact confirmation from the preview; required with --execute",
+        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
+        "environment-id": "Required documented environment: 100, 110, 120, 140, 160, 200, 330, 430",
+        "action-script": "Optional: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie; default omitted",
+        "experimental-anti-evasion": "Optional experimental_anti_evasion; default omitted; explicit true or false",
+        "script-logging": "Optional script_logging; default omitted; explicit true or false",
+        "input-sample-tampering": "Optional input_sample_tampering; default omitted; explicit true or false",
+        "network-settings": "Optional: default, tor, simulated; default omitted",
+        email: "Optional email; default omitted",
+        comment: "Optional comment; default omitted",
+        "custom-date-time": "Optional YYYY-MM-DD HH:mm; default omitted",
+        "custom-cmd-line": "Optional custom_cmd_line; default omitted",
+        "custom-run-time": "Optional positive integer seconds; default omitted",
+        "submit-name": "Optional submit_name; default omitted",
+        priority: "Optional integer 1-10; default omitted (upstream 5)",
+        "document-password": "Optional document_password; default omitted",
+        "environment-variable": "Optional environment_variable; default omitted",
+        file: "Required regular file, at most 250 MiB; confirmation binds its SHA256 and size"
       }
     },
     {
-      command: "quick-scan submit",
+      command: "submit url",
       effect: "write",
       flags: {
         help: "Show help; default false",
@@ -41820,35 +43573,35 @@ var hybrid_axi_default = {
         "submit-name": "Optional submit_name; default omitted",
         priority: "Optional integer 1-10; default omitted (upstream 5)",
         "document-password": "Optional document_password; default omitted",
-        "environment-variable": "Optional environment_variable; default omitted"
+        "environment-variable": "Optional environment_variable; default omitted",
+        url: "Required exact HTTP(S) URL without embedded credentials"
       }
     },
     {
-      command: "quick-scan url",
+      command: "system action-scripts",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        full: "All response fields; default false",
         fields: "Comma-separated response fields; default compact fields",
-        comment: "Optional comment; default omitted",
-        "submit-name": "Optional submission name; default omitted",
-        url: "Required exact HTTP(S) URL without embedded credentials",
-        "scan-type": "Required: all, all_lookup, all_scan, lookup_ha, scan_crowdstrike_ml, scan_metadefender, lookup_cleandns, lookup_bforeai, scan_urlscanio, scan_scamadviser, scan_criminalip, scan_vipre"
+        full: "All fields and untruncated text; default false",
+        limit: "Local row limit; default 100; --full does not change it"
       }
     },
     {
-      command: "quota",
+      command: "system configuration",
       effect: "read",
       flags: {
         help: "Show help; default false",
-        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile name; default profile precedence"
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false"
       }
     },
     {
-      command: "report children",
+      command: "system environments",
       effect: "read",
       flags: {
         help: "Show help; default false",
@@ -41860,325 +43613,651 @@ var hybrid_axi_default = {
       }
     },
     {
-      command: "report file",
-      effect: "blocked",
+      command: "system queue-size",
+      effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
-        type: "Required single type: crt, pcap, json, memory-strings, xml, html, pdf, maec, stix, misp, misp-json, openioc, bin, dropped-files, memory",
-        output: "Required new file in an existing directory; never stdout or overwrite",
-        execute: "Execute once after exact confirmation; default preview only",
-        "dry-run": "Preview only; mutually exclusive with --execute",
-        confirm: "Exact confirmation string from the preview, binding profile, ID, type and destination"
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false"
       }
     },
     {
-      command: "report memory hex",
+      command: "system stats",
       effect: "read",
       flags: {
         help: "Show help; default false",
         config: "Config path; default platform config",
         profile: "Profile name; default profile precedence",
         fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it",
-        filename: "Required exact memory dump filename"
+        full: "All fields and untruncated text; default false"
+      }
+    },
+    {
+      command: "system total-submissions",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false"
+      }
+    },
+    {
+      command: "system version",
+      effect: "read",
+      flags: {
+        help: "Show help; default false",
+        config: "Config path; default platform config",
+        profile: "Profile name; default profile precedence",
+        fields: "Comma-separated response fields; default compact fields",
+        full: "All fields and untruncated text; default false"
+      }
+    }
+  ]
+};
+
+// tools/inventories/checkpoint-axi.json
+var checkpoint_axi_default = {
+  generatedBy: "scripts/checkpoint-inventory.mjs",
+  tool: "checkpoint-axi",
+  version: "0.1.0",
+  integrity: "sha512-fbwTL0lbbJwCDjR8bt431kWHSCEuBmAEzk/QNJzsVcAbve2x8Ehtz/mr/aPzJ6I/WMRQiRPFpCE2zsW/2CRHlQ==",
+  parserEvidence: "Published catalogue, fixed regional map and reviewed native parsers, write coordinator and download contracts",
+  sources: [
+    {
+      path: "dist/src/catalogue.js",
+      sha256: "59b9568b614a101e2746a8275768c238ba8eb7166185119875a40f7eac191f7a"
+    },
+    {
+      path: "dist/src/cli.js",
+      sha256: "11a2e7f6c8ba3fc5507aa8ca33d480337a5a64bf79c241f4ed478f512ac8fa92"
+    },
+    {
+      path: "dist/src/doctor.js",
+      sha256: "7f25c415bc59b12e6d0a6155d701c3646bd3370e0b2024a29efdbaf5e4c0ffed"
+    },
+    {
+      path: "dist/src/downloads.js",
+      sha256: "206f08ec7d978e41fe1c9c4ba744f1cf4c3f47ee909a1f761645a802371c8d6e"
+    },
+    {
+      path: "dist/src/exceptions.js",
+      sha256: "8264427dd5871a447e3e8759341251779454490a387cdca801a0e68b81265327"
+    },
+    {
+      path: "dist/src/local-commands.js",
+      sha256: "ed9c39e204d42f45ae3c5b8008bf1c719d88f8e7214168f68de4d15921e35299"
+    },
+    {
+      path: "dist/src/private-file.js",
+      sha256: "574a40223d0bba130f903eb89e2cfd2d96bf01a4df237738af993272ebee0332"
+    },
+    {
+      path: "dist/src/profiles.js",
+      sha256: "db013b041bb6302993d7045fe3bd411bbd1a3593b5b2a84a3d8411645f55d3e6"
+    },
+    {
+      path: "dist/src/reads.js",
+      sha256: "02a5478edb3d44ab51ea300095794abc69d9e4a353060af4faed0d6e4ce592a7"
+    },
+    {
+      path: "dist/src/redact.js",
+      sha256: "9793e98af5c93c09e89748e26675b2d48663904a27e3aa42655954f93025c35a"
+    },
+    {
+      path: "dist/src/regions.js",
+      sha256: "44288abe19a68fa672bc04ad167141717aed5c3a333b2420b14ee68e13abee78"
+    },
+    {
+      path: "dist/src/transport.js",
+      sha256: "7beb28cc283e876db4f6aeaf5c308280e1fce482c20c19dd9924e29985e54e56"
+    },
+    {
+      path: "dist/src/write-exceptions.js",
+      sha256: "34114e0b2a3e04462914118ba6108f6d7eb7bf38a417f1f80ec4126deff786a8"
+    },
+    {
+      path: "dist/src/write-sectools.js",
+      sha256: "c962f2180d34625c9a0be1ad468e17b3e25d93390b0efae3dec02e9ab8f1dd9e"
+    },
+    {
+      path: "dist/src/writes.js",
+      sha256: "4f683a01ab151b4b1e61588b6c3fe86f3d8a34ebdbdb1a257dc42cae21e6f5ed"
+    }
+  ],
+  credentialSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "https://github.com/knowttl/checkpoint-axi/axi-credential.schema.json",
+    title: "Check Point AXI credential profile",
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "region",
+      "clientId"
+    ],
+    properties: {
+      region: {
+        type: "string",
+        enum: [
+          "us",
+          "eu",
+          "ca",
+          "au",
+          "uk",
+          "uae",
+          "in"
+        ]
+      },
+      clientId: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      clientSecret: {
+        $ref: "#/$defs/secretRef",
+        "x-secret": true,
+        default: {
+          env: "CHECKPOINT_AXI_CLIENT_SECRET"
+        }
+      },
+      saas: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S",
+        default: "office365_emails"
+      },
+      scope: {
+        type: "string",
+        minLength: 1,
+        pattern: "\\S"
+      },
+      downloads: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allow"
+        ],
+        default: {
+          allow: false
+        },
+        properties: {
+          allow: {
+            type: "boolean"
+          }
+        }
+      },
+      writes: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "allowWrites",
+          "operations"
+        ],
+        default: {
+          allowWrites: false,
+          operations: []
+        },
+        properties: {
+          allowWrites: {
+            type: "boolean"
+          },
+          operations: {
+            type: "array",
+            items: {
+              type: "string",
+              pattern: "^[a-z][A-Za-z0-9_.-]*$"
+            }
+          }
+        }
+      }
+    },
+    $defs: {
+      secretRef: {
+        oneOf: [
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "env"
+            ],
+            properties: {
+              env: {
+                type: "string",
+                pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+              }
+            }
+          },
+          {
+            type: "object",
+            additionalProperties: false,
+            required: [
+              "file"
+            ],
+            properties: {
+              file: {
+                type: "string",
+                pattern: "^(?:/|[A-Za-z]:[\\\\/])"
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  regions: {
+    us: "https://cloudinfra-gw-us.portal.checkpoint.com",
+    eu: "https://cloudinfra-gw.portal.checkpoint.com",
+    ca: "https://cloudinfra-gw.ca.portal.checkpoint.com",
+    au: "https://cloudinfra-gw.ap.portal.checkpoint.com",
+    uk: "https://cloudinfra-gw.uk.portal.checkpoint.com",
+    uae: "https://cloudinfra-gw.me.portal.checkpoint.com",
+    in: "https://cloudinfra-gw.in.portal.checkpoint.com"
+  },
+  skillSha256: "69f0754d565fc1e65163435ef698ea6dca6009470f158171cb3b4258d27c647b",
+  nativeWriteSettings: {
+    supportedOperations: [
+      "attachment.download",
+      "attachment.download-all",
+      "email.download",
+      "email.quarantine",
+      "email.restore",
+      "exception.anomaly.create",
+      "exception.anomaly.remove",
+      "exception.click-time.create",
+      "exception.click-time.remove",
+      "exception.click-time.remove-items",
+      "exception.click-time.update",
+      "exception.dlp.create",
+      "exception.dlp.update",
+      "exception.malware.create",
+      "exception.malware.update",
+      "exception.phishing-allow.create",
+      "exception.phishing-allow.remove",
+      "exception.phishing-allow.update",
+      "exception.phishing-block.create",
+      "exception.phishing-block.remove",
+      "exception.phishing-block.update",
+      "exception.spam-allow.create",
+      "exception.spam-allow.remove",
+      "exception.spam-allow.update",
+      "exception.url.create",
+      "exception.url.update"
+    ],
+    dynamicOperation: "event.action.<exact available action name>"
+  },
+  adapterBoundary: {
+    unsafeOverrides: [
+      "config",
+      "profile",
+      "origin",
+      "out"
+    ],
+    inputFileFlags: [
+      "input"
+    ],
+    blockedCommands: [
+      "profile list",
+      "config path",
+      "exception clear",
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    downloadCommands: [
+      "email download",
+      "attachment download",
+      "attachment download-all"
+    ],
+    inputs: {
+      stdin: "unsupported",
+      files: "uploaded private JSON leaves only",
+      downloads: "authenticated hosted transfers only"
+    },
+    nativeWrites: "native preview, exact operation allow-list, execute, exact confirm and durable journal; ambiguous deletes refused"
+  },
+  discovery: {
+    commands: [
+      "auth",
+      "doctor",
+      "email",
+      "event",
+      "exception",
+      "home",
+      "task"
+    ],
+    example: [
+      "email",
+      "search",
+      "--limit",
+      "1"
+    ],
+    help: "checkpoint-axi email search [--limit <n>]\nArtium manages region, client ID and secret. Writes require administrator-enabled exact operations and native preview, --execute and exact --confirm. Upload private JSON with --input. Use artium-axi download for authenticated email and attachment saving with host-owned confirmation; ordinary downloads and local configuration are blocked.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "attachment download",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "attachment download-all",
+      effect: "blocked",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified"
+      }
+    },
+    {
+      command: "auth status",
+      effect: "read",
+      flags: {
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "report memory list",
-      effect: "read",
+      command: "config path",
+      effect: "blocked",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "report memory strings",
+      command: "doctor",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it",
-        filename: "Required exact memory dump filename"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails"
       }
     },
     {
-      command: "report screenshots",
-      effect: "read",
+      command: "email download",
+      effect: "blocked",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        help: "Show concise command help; default false",
+        out: "Required absolute new output file; mode 0600, never stdout or overwrite",
+        original: "Download original email without processing modifications; default false"
       }
     },
     {
-      command: "report show",
-      effect: "read",
+      command: "email quarantine",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
       }
     },
     {
-      command: "report state",
-      effect: "read",
+      command: "email restore",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique entity IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order"
       }
     },
     {
-      command: "search results",
+      command: "email search",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "Include all response fields; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        saas: "SaaS override; default selected profile saas or office365_emails",
+        "saas-entity": "Optional SaaS entity type selector",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        filter: "JSON array of {saasAttrName, saasAttrOp, saasAttrValue} filters (guide pages 19-20)"
       }
     },
     {
-      command: "search run",
+      command: "email show",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "Include all response fields; default false",
-        query: "Required nonempty query",
-        size: "Results per page or async total; default 50, range 1-200",
-        page: "Synchronous page, ignored asynchronously; default 1, minimum 1",
-        "date-from": "Inclusive YYYY-MM-DD; default omitted",
-        "date-to": "Inclusive YYYY-MM-DD; default omitted"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "search terms",
-      effect: "read",
+      command: "event action",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "Include all response fields; default false",
-        filename: "Optional nonempty filter; default omitted",
-        filetype: "Optional nonempty filter; default omitted",
-        "filetype-desc": "Optional nonempty filter; default omitted",
-        "env-id": "Optional nonempty filter; default omitted",
-        country: "Optional nonempty filter; default omitted",
-        verdict: "Optional nonempty filter; default omitted",
-        "av-detect": "Optional nonempty filter; default omitted",
-        "vx-family": "Optional nonempty filter; default omitted",
-        tag: "Optional nonempty filter; default omitted",
-        "date-from": "Optional nonempty filter; default omitted",
-        "date-to": "Optional nonempty filter; default omitted",
-        port: "Optional nonempty filter; default omitted",
-        host: "Optional nonempty filter; default omitted",
-        domain: "Optional nonempty filter; default omitted",
-        url: "Optional nonempty filter; default omitted",
-        "similar-to": "Optional nonempty filter; default omitted",
-        context: "Optional nonempty filter; default omitted",
-        "imp-hash": "Optional nonempty filter; default omitted",
-        ssdeep: "Optional nonempty filter; default omitted",
-        authentihash: "Optional nonempty filter; default omitted",
-        "uses-tactic": "Optional nonempty filter; default omitted",
-        "uses-technique": "Optional nonempty filter; default omitted"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        ids: "Required comma-separated unique event IDs; maximum 20",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and the comma-separated IDs in supplied order",
+        name: "Required available action name; nonempty action parameters are unverified"
       }
     },
     {
-      command: "setup",
-      effect: "blocked",
+      command: "event list",
+      effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default HYBRID_AXI_CONFIG or platform config",
-        profile: "Profile selector; template uses example"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        "start-date": "ISO timestamp with timezone; default 24 hours before end-date; maximum window 31 days",
+        "end-date": "ISO timestamp with timezone; default now",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Read up to 1000 rows / 10 HTTP requests / 60 seconds / 8 MiB; default false",
+        cursor: "Opaque continuation bound to profile, region, operation and selectors; repeat original selectors",
+        saas: "Comma-separated SaaS overrides; default selected profile saas or office365_emails",
+        "event-types": "Comma-separated event types; default unfiltered",
+        "event-states": "Comma-separated event states; default unfiltered",
+        severities: "Comma-separated severities; default unfiltered",
+        "event-ids": "Comma-separated event IDs; default unfiltered",
+        "confidence-indicator": "Confidence indicator selector; default unfiltered",
+        description: "Description selector; default unfiltered"
       }
     },
     {
-      command: "setup hooks",
-      effect: "blocked",
+      command: "event show",
+      effect: "read",
       flags: {
-        help: "Show help without installing",
-        scope: "user (default) or project; Codex hooks feature is always enabled in user config"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "submit dropped-file",
-      effect: "write",
+      command: "exception clear",
+      effect: "blocked",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        execute: "Send once; default preview only",
-        "dry-run": "Preview only; incompatible with --execute",
-        confirm: "Exact confirmation from the preview; required with --execute",
-        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
-        id: "Required source job ID or sha256:environmentId",
-        "file-hash": "Required dropped-file SHA256"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
       }
     },
     {
-      command: "submit file",
+      command: "exception create",
       effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        execute: "Send once; default preview only",
-        "dry-run": "Preview only; incompatible with --execute",
-        confirm: "Exact confirmation from the preview; required with --execute",
-        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
-        "environment-id": "Required documented environment: 100, 110, 120, 140, 160, 200, 330, 430",
-        "action-script": "Optional: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie; default omitted",
-        "experimental-anti-evasion": "Optional experimental_anti_evasion; default omitted; explicit true or false",
-        "script-logging": "Optional script_logging; default omitted; explicit true or false",
-        "input-sample-tampering": "Optional input_sample_tampering; default omitted; explicit true or false",
-        "network-settings": "Optional: default, tor, simulated; default omitted",
-        email: "Optional email; default omitted",
-        comment: "Optional comment; default omitted",
-        "custom-date-time": "Optional YYYY-MM-DD HH:mm; default omitted",
-        "custom-cmd-line": "Optional custom_cmd_line; default omitted",
-        "custom-run-time": "Optional positive integer seconds; default omitted",
-        "submit-name": "Optional submit_name; default omitted",
-        priority: "Optional integer 1-10; default omitted (upstream 5)",
-        "document-password": "Optional document_password; default omitted",
-        "environment-variable": "Optional environment_variable; default omitted",
-        file: "Required regular file, at most 250 MiB; confirmation binds its SHA256 and size"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT",
+        specific: "Malware/url/dlp only: use the documented create-specific /exceptions route; default false; included in confirmation digest"
       }
     },
     {
-      command: "submit url",
-      effect: "write",
+      command: "exception list",
+      effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        execute: "Send once; default preview only",
-        "dry-run": "Preview only; incompatible with --execute",
-        confirm: "Exact confirmation from the preview; required with --execute",
-        "intent-id": "Optional durable intent identifier; an already reserved intent is never replayed",
-        "environment-id": "Required documented environment: 100, 110, 120, 140, 160, 200, 330, 430",
-        "action-script": "Optional: default, default_maxantievasion, default_randomfiles, default_randomtheme, default_openie; default omitted",
-        "experimental-anti-evasion": "Optional experimental_anti_evasion; default omitted; explicit true or false",
-        "script-logging": "Optional script_logging; default omitted; explicit true or false",
-        "input-sample-tampering": "Optional input_sample_tampering; default omitted; explicit true or false",
-        "network-settings": "Optional: default, tor, simulated; default omitted",
-        email: "Optional email; default omitted",
-        comment: "Optional comment; default omitted",
-        "custom-date-time": "Optional YYYY-MM-DD HH:mm; default omitted",
-        "custom-cmd-line": "Optional custom_cmd_line; default omitted",
-        "custom-run-time": "Optional positive integer seconds; default omitted",
-        "submit-name": "Optional submit_name; default omitted",
-        priority: "Optional integer 1-10; default omitted (upstream 5)",
-        "document-password": "Optional document_password; default omitted",
-        "environment-variable": "Optional environment_variable; default omitted",
-        url: "Required exact HTTP(S) URL without embedded credentials"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item routes instead of list routes; default false",
+        limit: "Maximum rows; default 50, range 1-1000; cannot combine with --all",
+        all: "Return up to 1000 rows within transport budgets; no server continuation parameter is documented"
       }
     },
     {
-      command: "system action-scripts",
-      effect: "read",
+      command: "exception remove",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)"
       }
     },
     {
-      command: "system configuration",
-      effect: "read",
+      command: "exception remove-items",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        ids: "Required 1-20 unique comma-separated click-time item IDs"
       }
     },
     {
-      command: "system environments",
+      command: "exception show",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false",
-        limit: "Local row limit; default 100; --full does not change it"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        type: "Required for malware: hash,micro_hash,file_type,ppat_sender_name,allow_file_type,sender_email; url: allow-url,allow-domain,block-url,block-domain; dlp: hash,text_content,sender_email,recipient_email",
+        items: "Click-time item route instead of list route; default false"
       }
     },
     {
-      command: "system queue-size",
-      effect: "read",
+      command: "exception update",
+      effect: "write",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false",
+        execute: "Send once after all write gates; default false (preview)",
+        "dry-run": "Explicit preview; cannot combine with --execute",
+        confirm: "Exact operation followed by a space and every target from preview (payload sha256 for create and malware/url/dlp update, exception ID or comma-separated item IDs otherwise)",
+        input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT"
       }
     },
     {
-      command: "system stats",
+      command: "home",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "system total-submissions",
-      effect: "read",
+      command: "profile list",
+      effect: "blocked",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     },
     {
-      command: "system version",
+      command: "task show",
       effect: "read",
       flags: {
-        help: "Show help; default false",
-        config: "Config path; default platform config",
-        profile: "Profile name; default profile precedence",
-        fields: "Comma-separated response fields; default compact fields",
-        full: "All fields and untruncated text; default false"
+        config: "Config path; default CHECKPOINT_AXI_CONFIG or platform path",
+        profile: "Profile name; default CHECKPOINT_AXI_PROFILE, env profile, config default, or sole profile",
+        fields: "Comma-separated output fields; default all",
+        full: "Show full strings instead of 500-character previews; default false",
+        help: "Show concise command help; default false"
       }
     }
   ]
 };
 
 // src/shared/tool-manifests.ts
-var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default };
+var toolManifests = { "gh-axi": gh_axi_default, "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default, "awx-axi": awx_axi_default, "tenable-axi": tenable_axi_default, "hybrid-axi": hybrid_axi_default, "checkpoint-axi": checkpoint_axi_default };
 
 // node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
 var NULL_LITERAL = "null";
@@ -43544,8 +45623,38 @@ function resolveDecodeOptions(options) {
   };
 }
 
+// src/shared/gh-suggestions.ts
+function rewriteGhSuggestions(output3, invocation, truncated = false) {
+  if (!invocation || invocation.help || invocation.command === "api" || truncated) return output3;
+  if (invocation.command === "pr view") {
+    output3 = output3.replace(/^(  merge_state: [^\n]*?); gh-axi pr update-branch [^\n]*$/gm, "$1");
+  }
+  if (invocation.command === "release list") {
+    output3 = output3.replace(/^(count: \d+ \(showing first \d+); run `gh-axi repo view` for total count\)$/gm, "$1)");
+  }
+  return output3.replace(/(^|\n)help\[(\d+)\]:\n((?:  [^\n]*\n)*  [^\n]*)(?=\n|$)/g, (block, prefix, count, body) => {
+    const rows = body.trimEnd().split("\n");
+    if (rows.length !== Number(count)) return block;
+    const help = rows.flatMap((row) => {
+      let allowed = true;
+      const line = row.replace(/`(?:artium-axi )?gh-axi ([^`]+)`/g, (_, command) => {
+        const route = gh_axi_default.commands.find((route2) => command === route2.command || command.startsWith(route2.command + " "));
+        const flags = [...command.matchAll(/(?:^|\s)(--[a-z][a-z-]*|-R)(?==|\s|$)/g)].map((match) => match[1]);
+        if (!route || route.effect === "write" || route.command === "api" || /https?:\/\//.test(command) || flags.some((flag) => !Object.hasOwn(route.flags, flag === "-R" ? "repo" : flag.slice(2))) || route.repository && !flags.some((flag) => flag === "-R" || flag === "--repo")) allowed = false;
+        return `\`artium-axi gh-axi ${command}\``;
+      });
+      if (!allowed || /\bgh-axi\b|\bgh auth\b|\bGH_[A-Z_]+\b/.test(line.replaceAll("artium-axi gh-axi", ""))) return [];
+      return [line];
+    });
+    return help.length ? `${prefix}help[${help.length}]:
+${help.join("\n")}` : "";
+  });
+}
+
 // src/cli/rewrite.ts
 var managedFlags = {
+  "gh-axi": gh_axi_default.adapterBoundary.unsafeOverrides,
+  "checkpoint-axi": checkpoint_axi_default.adapterBoundary.unsafeOverrides,
   "hybrid-axi": hybrid_axi_default.adapterBoundary.unsafeOverrides,
   "tenable-axi": tenable_axi_default.adapterBoundary.unsafeOverrides,
   "awx-axi": awx_axi_default.adapterBoundary.unsafeOverrides,
@@ -43569,8 +45678,28 @@ function rewriteDiscoveryHelp(help, tool) {
     examples: help.examples.map((example) => hostedHelp(example, tool, flags, true))
   });
 }
-function rewriteSuggestions(output3, tool, truncated = false) {
+function rewriteSuggestions(output3, tool, truncated = false, invocation) {
   if (truncated) return output3;
+  if (tool === "gh-axi") return rewriteGhSuggestions(output3, invocation, truncated);
+  if (tool === "checkpoint-axi") {
+    try {
+      const document = decode3(output3);
+      if (document.command && document.flags) return encode3({
+        ...document,
+        command: document.command.startsWith("artium-axi ") ? document.command : `artium-axi checkpoint-axi ${document.command}`,
+        flags: Object.fromEntries(Object.entries(document.flags).filter(([name]) => !checkpoint_axi_default.adapterBoundary.unsafeOverrides.includes(name.replace(/^--/, "")))),
+        examples: (document.examples ?? []).filter((example) => !/--(?:config|profile|out)\b/.test(example)).map((example) => example.replace(/^checkpoint-axi\b/, "artium-axi checkpoint-axi")),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+      if (document.bin || document.commands) return encode3({
+        bin: "artium-axi checkpoint-axi",
+        description: "Investigate Check Point Email Security with managed credentials.",
+        commands: checkpoint_axi_default.commands.filter((route) => route.effect !== "blocked").map((route) => route.command),
+        help: [checkpoint_axi_default.discovery.help.replaceAll("checkpoint-axi ", "artium-axi checkpoint-axi ")]
+      }) + "\n";
+    } catch {
+    }
+  }
   if (tool === "hybrid-axi") {
     try {
       const document = decode3(output3);
@@ -43659,7 +45788,7 @@ function rewriteSuggestions(output3, tool, truncated = false) {
   for (const span of [...spans].reverse()) {
     const value = hostedHelp(span.value, tool, flags, /^[ \t]*(?:Command|Native operation|Examples|Usage):/m.test(span.value));
     if (value === span.value) continue;
-    output3 = output3.slice(0, span.start) + (span.quoted || ["ldap-axi", "ado-axi", "awx-axi"].includes(tool) && /[,\r\n]/.test(value) ? JSON.stringify(value) : value) + output3.slice(span.start + span.raw.length);
+    output3 = output3.slice(0, span.start) + (span.quoted || ["ldap-axi", "ado-axi", "awx-axi", "gh-axi"].includes(tool) && /[,\r\n]/.test(value) ? JSON.stringify(value) : value) + output3.slice(span.start + span.raw.length);
   }
   spans = (output3.trimStart().startsWith("{") ? jsonHelp(output3) : toonHelp(output3)).spans;
   if (spans.some((span) => /\\[`'"]/.test(span.value))) return output3;
@@ -43734,6 +45863,10 @@ function managedFlagRanges(command, tool) {
   return ranges;
 }
 function hostedHelp(help, tool, flags, commands2) {
+  if (tool === "checkpoint-axi") {
+    help = help.split("\n").filter((line) => !/CHECKPOINT_AXI_|SecretRef|checkpoint-axi (?:config|profile)|Valid commands:/.test(line)).join("\n");
+    if (!help.trim()) help = checkpoint_axi_default.discovery.help;
+  }
   if (tool === "hybrid-axi") {
     help = help.split("\n").filter((line) => !/HYBRID_AXI_|SecretRefs|hybrid-axi (?:setup|config|profile)|--(?:config|profile|origin|output)\b/.test(line)).join("\n");
     const guidance = "Artium manages the API key and fixed origin. Submissions, YARA mutations, consuming matches and four reviewed archive downloads require independently selected administrator-enabled operations, native preview, execute, exact confirmation and journal. Quick scans transmit the supplied sample or URL. Use artium-axi download --help for authenticated one-shot CLI verified saving and live-malware warnings.";
@@ -43753,6 +45886,12 @@ function hostedHelp(help, tool, flags, commands2) {
   if (tool === "falcon-axi") {
     help = help.replace(new RegExp(`^  (?:${falcon_axi_default.blockedCommands.join("|")})(?=\\s|$)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
   }
+  if (tool === "gh-axi") {
+    const guidance = "Artium manages the GitHub host and credential. Ask an Artium administrator to reconnect the GitHub credential. Use -R OWNER/NAME for repository commands. Writes require an administrator-enabled exact operation: preview, then repeat the exact request with its --confirm value. api accepts GET and relative paths only.";
+    help = help.split("\n").filter((line) => !/\bgh auth\b|\bGH_[A-Z_]+\b|gh-axi (?:update|setup|stack)|--(?:hostname|watch|attach|input|field|raw-field|header|body-file|notes-file)\b/.test(line)).join("\n");
+    if (!help.trim()) help = guidance;
+    else if (!help.includes(guidance)) help = help.trimEnd() + "\n" + guidance + "\n";
+  }
   if (tool === "ado-axi") {
     const guidance = "Artium manages the organization, profile, config and PAT. api accepts relative paths and GET only. Writes are off by default; administrators control allowWrites. No stdin or files. Use pipeline watch --timeout 50 or less.";
     if (/^(?:Usage: |(?:Run|Use) [`'"]?)?(?:artium-axi )?ado-axi api(?:\s|$)/.test(help)) {
@@ -44011,6 +46150,12 @@ async function doctor(createClient = (deadline) => new Client(process.env, void
 
 // src/cli/help.ts
 var commands = {
+  "gh-axi": {
+    usage: "artium-axi gh-axi [<args>]",
+    purpose: "Read and update GitHub data with managed credentials.",
+    flags: ["Repository commands require -R OWNER/NAME. Writes require an administrator-enabled exact operation: preview, then repeat with its --confirm value. api is GET only; deletes, secret set, merge --admin, local git, files and downloads are unavailable. Only gist create/edit with --filename accepts piped stdin."],
+    example: "artium-axi gh-axi repo list --limit 1"
+  },
   home: { usage: "artium-axi [tools [show <tool>]|whoami|login|passwd|logout|doctor|setup|update|download|<tool> <args>]", purpose: "Show your identity, roles and available tools.", flags: ["--version (default false; print the client package version and exit)"], example: "artium-axi" },
   setup: {
     usage: "artium-axi setup --host <claude|codex|opencode|pi> [--hook] [--force]",
@@ -44037,20 +46182,20 @@ var commands = {
   doctor: { usage: "artium-axi doctor", purpose: "Check the server, certificate, token, CLI version and cached tool health.", flags: [], example: "artium-axi doctor" },
   update: { usage: "artium-axi update", purpose: "Download and verify the server\u2019s client, replace this file and keep a .bak backup. npm installations must use npm install -g @knowttl/artium-axi.", flags: [], example: "artium-axi update" },
   download: {
-    usage: "artium-axi download --operation <operation> --selector <hash|report-id> --type <bin|dropped-files|memory> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
-    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive. Operations remain unavailable until adapter enablement.",
+    usage: "artium-axi download --operation <operation> --selector <selector> --type <type> --destination <absolute-new-path> [--transfer <id> --execute --confirm <exact-confirm>] [--password-stdin|--sso]",
+    purpose: "Preview or explicitly save a hosted Hybrid Analysis archive or Check Point email/attachment. Each operation requires administrator enablement.",
     flags: [
-      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory> (required)",
-      "--selector <hash|report-id> (required)",
-      "--type <bin|dropped-files|memory> (required)",
+      "--operation <hash-download-bin|report-download-bin|report-download-dropped-files|report-download-memory|email.download|attachment.download|attachment.download-all> (required)",
+      "--selector <hash|report-id|entity-id|entity-id/attachment-id> (required; attachment.download uses entity-id/attachment-id)",
+      "--type <bin|dropped-files|memory|email|original|attachment|zip> (required; email.download uses email or original, attachment.download uses attachment, attachment.download-all uses zip)",
       "--destination <absolute-new-path> (required; Linux private 0700 directory, no symlink components or overwrite)",
       "--transfer <id> (required for execution; preview transfer ID)",
       "--execute (default false)",
-      "--confirm <exact-confirm> (required for execution; unchanged native preview string)",
+      "--confirm <exact-confirm> (required for execution; unchanged preview string; Check Point confirmation is host-owned)",
       "--password-stdin (default false; otherwise terminal password)",
       "--sso (default false; browser identity confirmation)",
       transferWarning,
-      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB; ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
+      `Limit ${transferLimits.artifactBytes / 1024 ** 2} MiB (Check Point: 50 MiB with mandatory upstream hash); ${transferLimits.reservationsPerUser} reservation per user, ${transferLimits.reservations} globally, ${transferLimits.reservedBytes / 1024 ** 3} GiB total artifact capacity; absolute expiry ${transferLimits.lifetimeMs / 6e4} minutes after preview preparation, including generation and retrieval. No resume or automatic retry. Missing receipt is unconfirmed.`
     ],
     example: "artium-axi download --operation report-download-bin --selector synthetic-report --type bin --destination /controlled/artifacts/new-archive.bin --sso"
   },
@@ -44096,6 +46241,12 @@ var commands = {
     flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", "--body-file - reads stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path.", transferWarning],
     example: "artium-axi hybrid-axi quota"
   },
+  "checkpoint-axi": {
+    usage: "artium-axi checkpoint-axi [<args>]",
+    purpose: "Investigate Check Point Email Security with managed regional credentials.",
+    flags: ["Writes require administrator-selected exact operations, native preview, --execute and exact --confirm. Private JSON inputs are uploaded with --input; stdin is unavailable. Downloads use artium-axi download with host-owned confirmation. Ambiguous deletes remain blocked."],
+    example: "artium-axi checkpoint-axi email search --limit 1"
+  },
   "az-axi": {
     usage: "artium-axi az-axi [<args>]",
     purpose: "Run Azure commands with your managed identity.",
@@ -44412,9 +46563,13 @@ async function toolInput(tool, original) {
   const args = [...original];
   const input2 = {};
   let totalFileBytes = 0;
+  if (tool === "gh-axi" && ["gist create", "gist edit"].includes(args.slice(0, 2).join(" ")) && args.some((arg) => arg === "--filename" || arg.startsWith("--filename=")) && !args.some((arg) => ["--help", "-h"].includes(arg))) {
+    if (process.stdin.isTTY) throw new ArtiumError("UNSUPPORTED_INPUT", "Pipe gist content on stdin.");
+    input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes, "--filename with closed stdin")).toString("utf8");
+  }
   const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
-  if ((tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = hunting ? ["file"] : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  if ((tool === "checkpoint-axi" || tool === "az-axi" || tool === "hybrid-axi" || tool === "tenable-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "checkpoint-axi" ? checkpoint_axi_default.adapterBoundary.inputFileFlags : tool === "tenable-axi" ? tenable_axi_default.adapterBoundary.inputFileFlags : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
@@ -44859,6 +47014,7 @@ async function download(args, output3, managed2) {
     targetDigest: createHash4("sha256").update(destination).digest("hex")
   });
   if (!input2.success || !destination || flags.has("--sso") && flags.has("--password-stdin")) throw new ArtiumError("INVALID_INPUT");
+  const transferRoutes2 = transferRoutesFor(transferTool(input2.data.selection.operation));
   const execute = flags.has("--execute");
   if (execute !== flags.has("--transfer") || execute !== flags.has("--confirm")) throw new ArtiumError("INVALID_INPUT");
   let execution;
@@ -44910,7 +47066,7 @@ async function download(args, output3, managed2) {
         { "x-artium-reauth-ticket": ticket }
       );
       if (!execution) {
-        const preview = transferPreviewSchema.parse(await request(transferRoutes.prepare.path, input2.data));
+        const preview = transferPreviewSchema.parse(await request(transferRoutes2.prepare.path, input2.data));
         if (preview.targetDigest !== input2.data.targetDigest) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44927,7 +47083,7 @@ async function download(args, output3, managed2) {
       let saved = false;
       let receipt = "unconfirmed";
       try {
-        const pending = transferStatusSchema.parse(await request(transferRoutes.status.path, retrieval));
+        const pending = transferStatusSchema.parse(await request(transferRoutes2.status.path, retrieval));
         if (pending.transferId !== execution.transferId || pending.outcome !== "preview" || pending.archive !== null) throw new ArtiumError("INVALID_RESPONSE");
         announce({
           ...input2.data.selection,
@@ -44936,11 +47092,11 @@ async function download(args, output3, managed2) {
           expiresAt: pending.expiresAt,
           saveOutcome: "unconfirmed"
         });
-        const status = transferStatusSchema.parse(await request(transferRoutes.execute.path, execution));
+        const status = transferStatusSchema.parse(await request(transferRoutes2.execute.path, execution));
         if (status.transferId !== execution.transferId || status.expiresAt !== pending.expiresAt || status.outcome !== "ready" || !status.archive) throw new ArtiumError("INVALID_RESPONSE");
         archive = status.archive;
         await client.artifact(
-          transferRoutes.retrieve.path,
+          transferRoutes2.retrieve.path,
           retrieval,
           token,
           ticket,
@@ -44950,19 +47106,19 @@ async function download(args, output3, managed2) {
         saved = true;
         await local.close();
         try {
-          await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
+          await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "verified-save" });
           receipt = "confirmed";
         } catch {
         }
       } catch (error62) {
         if (archive && !saved) {
           try {
-            await request(transferRoutes.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
+            await request(transferRoutes2.receipt.path, { ...retrieval, archive, saveOutcome: "save-failed" });
           } catch {
           }
         }
         try {
-          await request(transferRoutes.cancel.path, retrieval);
+          await request(transferRoutes2.cancel.path, retrieval);
         } catch {
         }
         throw error62;