@knowttl/checkpoint-axi 0.0.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 knowttl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,4 +1,165 @@
-# @knowttl/checkpoint-axi
+# checkpoint-axi
 
-Placeholder version that reserves this package name so trusted publishing can be configured.
-Install 0.1.0 or later from https://github.com/knowttl/checkpoint-axi.
+Inspect Check Point Email Security through compact, guarded AXI commands
+
+[![npm](https://img.shields.io/npm/v/@knowttl/checkpoint-axi)](https://www.npmjs.com/package/@knowttl/checkpoint-axi) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Node](https://img.shields.io/node/v/@knowttl/checkpoint-axi)](package.json) [![Provenance](https://img.shields.io/badge/npm-provenance-blue)](https://www.npmjs.com/package/@knowttl/checkpoint-axi#provenance) [![AXI](https://img.shields.io/badge/AXI-agent%20experience-blue)](https://github.com/knowttl)
+
+[Why](#why-this-exists) | [Quickstart](#quickstart) | [Agents](#use-with-your-agent) | [Coverage](#what-it-covers) | [Safety](#safety) | [Configuration](#configuration) | [Output](#output-and-exit-codes) | [Troubleshooting](#troubleshooting) | [Contributing](#contributing) | [Security](#security) | [License](#license)
+
+## Why this exists
+
+Check Point Email Security (Harmony Email & Collaboration) exposes a large API with inconsistent examples and undocumented response shapes.
+Agents need bounded results and explicit uncertainty to avoid guessing routes or replaying disruptive actions.
+This CLI returns compact TOON, redacts secret-derived text and provides next-step hints.
+Reads have request, byte and time budgets; writes require exact permission, confirmation and durable intent.
+Live API contracts still require manual verification; offline fixtures do not establish live compatibility.
+
+## Quickstart
+
+Requires Node.js 22.12 or later.
+Install and open the local home view, which needs no credentials or network:
+
+```sh
+npm install --global @knowttl/checkpoint-axi
+checkpoint-axi
+# Or without a global install:
+npx -y @knowttl/checkpoint-axi
+```
+
+A fresh home view includes `status: not configured` and `count: 0`.
+For a read-only environment profile, supply `CHECKPOINT_AXI_CLIENT_SECRET` through your secret manager or private environment before running:
+
+```sh
+export CHECKPOINT_AXI_REGION=eu
+export CHECKPOINT_AXI_CLIENT_ID=synthetic-client
+checkpoint-axi auth status
+checkpoint-axi doctor
+checkpoint-axi email search --limit 5
+```
+
+Replace the synthetic client ID with your API client ID.
+`auth status` checks credentials locally; `doctor` authenticates and reads one search page without printing email data.
+Use [file profiles](docs/configuration.md) for named credentials and write/download permissions.
+
+## Use with your agent
+
+`checkpoint-axi-hook` is the session entry point: configure your agent's session-start hook to run it on explicit request.
+It emits local home context, grants no permissions and makes no API calls.
+There is no automatic hook installer or `setup hooks` command.
+To remove it, delete the hook entry you added in your agent configuration.
+
+For on-demand discovery, install the skill:
+
+```sh
+npx skills add knowttl/checkpoint-axi --skill checkpoint-axi
+```
+
+The skill supplies static guidance and the full command table; it grants no credentials or write permission.
+Use the hook, the skill or both; neither is required for ordinary CLI use.
+Start investigations with the compact [agent guide](docs/agent-guide.md), linked from [SKILL.md](skills/checkpoint-axi/SKILL.md).
+Use the [command reference](docs/commands.md) for the full catalogue.
+
+## What it covers
+
+<!-- command-registry:start -->
+| Group | Purpose | Access | Reference |
+|---|---|---|---|
+| attachment | Save hash-verified attachments or ZIPs to new private files | Read / local file write | [Guide](docs/downloads.md) |
+| auth | Validate local credential readiness without API calls | Local read | [Guide](docs/configuration.md) |
+| config | Show effective configuration and state paths | Local read | [Guide](docs/configuration.md) |
+| doctor | Verify authentication and one bounded search | API read | [Guide](docs/reads.md#doctor-and-transport) |
+| email | Search, inspect and download emails; preview or request quarantine/restore | Read / gated write / local file write | [Guide](docs/reads.md#email-reads) |
+| event | Inspect events and request available name-only actions | Read / gated write | [Guide](docs/writes.md#event-actions) |
+| exception | Inspect eight kinds; preview or request supported rule changes | Read / gated write | [Guide](docs/writes.md) |
+| home | Show local profile context without resolving secrets | Local read | [Guide](docs/configuration.md) |
+| profile | List named file profiles | Local read | [Guide](docs/configuration.md) |
+| task | Inspect asynchronous action status without polling | Read | [Guide](docs/reads.md#event-and-task-reads) |
+<!-- command-registry:end -->
+
+The command catalogue generates this overview and the full references.
+Run `checkpoint-axi <command> --help` for the selected command's flags.
+The [coverage ledger](docs/design.md#api-coverage-ledger) records documented routes and refused operations; it never enables execution.
+
+## Safety
+
+Read-only by default: file profiles must explicitly enable `writes.allowWrites` and each exact operation.
+Previews also require these permissions; no wildcard or environment-only profile grants writes.
+Execution requires `--execute` and the preview's exact `--confirm`, with durable redacted intent before one send.
+`CHECKPOINT_AXI_READ_ONLY=1` overrides write permission; invalid values fail closed.
+There is no `CHECKPOINT_AXI_ALLOW_*` environment gate.
+Ambiguous outcomes are never retried; reconcile using reads before requesting another action.
+Downloads separately require file-profile `downloads.allow`, a new private output file and verified SHA-256.
+Secrets use environment/file SecretRefs, never inline config values or argv; tokens stay in memory.
+Only seven fixed public regional gateways are allowed, with verified TLS and no redirects.
+See [write gates and reconciliation](docs/writes.md), [download safety](docs/downloads.md) and [profile permissions](docs/configuration.md#write-and-download-permissions).
+
+## Configuration
+
+No command writes configuration or discovers it from the current directory.
+Use `checkpoint-axi config path` to print the effective paths.
+
+| Platform | Default config | Default state directory |
+|---|---|---|
+| Linux/macOS | `~/.config/checkpoint-axi/config.json` | `~/.local/state/checkpoint-axi` |
+| Windows | `%APPDATA%\checkpoint-axi\config.json` | `%LOCALAPPDATA%\checkpoint-axi` |
+
+Config precedence: `--config`, `CHECKPOINT_AXI_CONFIG`, platform path.
+Profile precedence: `--profile`, `CHECKPOINT_AXI_PROFILE`, complete environment profile, config default, sole file profile.
+File metadata never mixes with environment-profile fields; SecretRefs may explicitly name environment variables.
+
+| Environment variable | Purpose | Default |
+|---|---|---|
+| `CHECKPOINT_AXI_CONFIG` | Config file override | Platform path |
+| `CHECKPOINT_AXI_PROFILE` | Named file profile | Selection order above |
+| `CHECKPOINT_AXI_REGION` | Environment-profile region | Required with client ID/secret |
+| `CHECKPOINT_AXI_CLIENT_ID` | Environment-profile client ID | Required with region/secret |
+| `CHECKPOINT_AXI_CLIENT_SECRET` | Environment secret source | Default SecretRef; required for env profile |
+| `CHECKPOINT_AXI_SAAS` | Environment-profile SaaS | `office365_emails` |
+| `CHECKPOINT_AXI_SCOPE` | Environment-profile download scope | Unset |
+| `CHECKPOINT_AXI_READ_ONLY` | Force read-only: `1`/`true`; `0`/`false` releases override | Unset |
+| `CHECKPOINT_AXI_WRITE_LOG` | Write journal path | State directory's `writes.log`; blank uses default |
+| `XDG_CONFIG_HOME` | Absolute config base on Linux/macOS | `~/.config` |
+| `XDG_STATE_HOME` | Absolute state base on Linux/macOS | `~/.local/state` |
+| `APPDATA` | Absolute Windows config base | `~/AppData/Roaming` |
+| `LOCALAPPDATA` | Absolute Windows state base | `~/AppData/Local` |
+
+Windows ignores XDG variables; relative base-directory overrides use platform defaults.
+SecretRefs may name additional environment variables.
+See [configuration](docs/configuration.md) for JSON, file protection, supported regions and scope handling, and the [credential schema](axi-credential.schema.json).
+
+## Output and exit codes
+
+Output, including structured errors and next-step hints, is TOON.
+Secret-derived strings are redacted before 500-character previews; `--full` restores complete strings and `--fields` selects top-level output fields where supported.
+Never replay a mutation to recover truncated output.
+Searches default to 50 rows over 24 hours; `--all` caps rows at 1000 within transport budgets.
+Inspect `complete`, `reason` and `cursor`; see [read continuation](docs/reads.md#email-reads) for page replay limitations.
+Bare `--version`, `-v` or `-V` prints the package version.
+
+| Exit | Meaning |
+|---|---|
+| 0 | Success, preview or no-op |
+| 1 | Configuration, authentication, transport or operation failure |
+| 2 | Invalid command syntax or flags (`VALIDATION_ERROR`) |
+
+## Troubleshooting
+
+| Code | Next action |
+|---|---|
+| `PROFILE_REQUIRED` | Configure a complete environment profile or a named file profile. |
+| `CONFIG_INSECURE` | Apply the [private-file permissions](docs/configuration.md) for your platform. |
+| `AUTH_SHAPE_UNVERIFIED` | Verify the undocumented token contract manually; never paste the response into chat. |
+| `ENDPOINT_UNVERIFIED` | Read the [operation limitations](docs/writes.md); the CLI refuses to guess. |
+| `OUTCOME_UNKNOWN` | Reconcile with read commands and the journal; never replay automatically. |
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for offline development checks and release mechanics, and [AGENTS.md](AGENTS.md) for repository boundaries.
+
+## Security
+
+Report vulnerabilities using [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE).

package/axi-credential.schema.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/knowttl/checkpoint-axi/axi-credential.schema.json",
+  "title": "Check Point AXI credential profile",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["region", "clientId"],
+  "properties": {
+    "region": { "type": "string", "enum": ["us", "eu", "ca", "au", "uk", "uae", "in"] },
+    "clientId": { "type": "string", "minLength": 1, "pattern": "\\S" },
+    "clientSecret": { "$ref": "#/$defs/secretRef", "x-secret": true, "default": { "env": "CHECKPOINT_AXI_CLIENT_SECRET" } },
+    "saas": { "type": "string", "minLength": 1, "pattern": "\\S", "default": "office365_emails" },
+    "scope": { "type": "string", "minLength": 1, "pattern": "\\S" },
+    "downloads": {
+      "type": "object", "additionalProperties": false, "required": ["allow"], "default": { "allow": false },
+      "properties": { "allow": { "type": "boolean" } }
+    },
+    "writes": {
+      "type": "object", "additionalProperties": false, "required": ["allowWrites", "operations"],
+      "default": { "allowWrites": false, "operations": [] },
+      "properties": {
+        "allowWrites": { "type": "boolean" },
+        "operations": { "type": "array", "items": { "type": "string", "pattern": "^[a-z][A-Za-z0-9_.-]*$" } }
+      }
+    }
+  },
+  "$defs": {
+    "secretRef": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["env"], "properties": { "env": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["file"], "properties": { "file": { "type": "string", "pattern": "^(?:/|[A-Za-z]:[\\\\/])" } } }
+      ]
+    }
+  }
+}

package/bin/checkpoint-axi-hook.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { tryFastPath } from "axi-sdk-js/fast-path";
+import { VERSION } from "./version.js";
+
+// Local context only. Hook installation is an explicit, later integration.
+if (!tryFastPath(process.argv.slice(2), { version: VERSION })) {
+  const { main } = await import("../dist/src/cli.js");
+  await main(process.argv.length === 2 ? ["home"] : process.argv.slice(2));
+}

package/bin/checkpoint-axi.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { tryFastPath } from "axi-sdk-js/fast-path";
+import { VERSION } from "./version.js";
+
+if (!tryFastPath(process.argv.slice(2), { version: VERSION })) {
+  const { main } = await import("../dist/src/cli.js");
+  await main();
+}

package/bin/version.js

@@ -0,0 +1,3 @@
+import { readFileSync } from "node:fs";
+
+export const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;

package/dist/src/catalogue.d.ts

@@ -0,0 +1,317 @@
+export declare const DESCRIPTION = "Inspect Check Point Email Security through compact, guarded AXI commands";
+export declare const SETUP_GUIDANCE = "Run checkpoint-axi config path; configure a region, clientId and clientSecret env/file SecretRef";
+export declare const catalogue: {
+    readonly "email download": {
+        readonly description: "Download an email to a new private file with profile opt-in, a 50 MiB cap and mandatory SHA-256 verification; scopes and email hash availability are unverified (guide pages 131-132)";
+        readonly flags: {
+            readonly config: string;
+            readonly profile: string;
+            readonly help: string;
+            readonly out: "Required absolute new output file; mode 0600, never stdout or overwrite";
+            readonly original: "Download original email without processing modifications; default false";
+        };
+        readonly examples: readonly ["checkpoint-axi email download <entity-id> --out /absolute/message", "checkpoint-axi email download <entity-id> --original --out /absolute/original"];
+    };
+    readonly "attachment download": {
+        readonly description: "Download one attachment to a new private file with profile opt-in, a 50 MiB cap and verified x-av-sha256; scope behavior is unverified (guide pages 133-135)";
+        readonly flags: {
+            readonly config: string;
+            readonly profile: string;
+            readonly help: string;
+            readonly out: "Required absolute new output file; mode 0600, never stdout or overwrite";
+            readonly scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified";
+        };
+        readonly examples: readonly ["checkpoint-axi attachment download <entity-id> <attachment-id> --out /absolute/attachment", "checkpoint-axi attachment download <entity-id> <attachment-id> --scope <scope> --out /absolute/attachment"];
+    };
+    readonly "attachment download-all": {
+        readonly description: "Download available attachments as a ZIP to a new private file with opt-in, a 50 MiB cap and mandatory SHA-256 verification; ZIP hash availability and scopes are unverified; HTTP 200 may contain only some attachments (guide pages 135-137)";
+        readonly flags: {
+            readonly config: string;
+            readonly profile: string;
+            readonly help: string;
+            readonly out: "Required absolute new output file; mode 0600, never stdout or overwrite";
+            readonly scope: "Optional authorized scope query; default profile scope when configured; live behavior unverified";
+        };
+        readonly examples: readonly ["checkpoint-axi attachment download-all <entity-id> --out /absolute/attachments", "checkpoint-axi attachment download-all <entity-id> --scope <scope> --out /absolute/attachments"];
+    };
+    readonly "exception create": {
+        readonly description: "Preview or create one exception of any kind; anomaly/click-time/malware/url/dlp response identities are unverified (guide pages 61-64, 75-78, 84-85, 91-93, 102-105, 113-116, 123-126)";
+        readonly flags: {
+            readonly input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT";
+            readonly specific: "Malware/url/dlp only: use the documented create-specific /exceptions route; default false; included in confirmation digest";
+            readonly execute: string;
+            readonly "dry-run": string;
+            readonly confirm: string;
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception create phishing-allow --input /absolute/rule.json", "checkpoint-axi exception create spam-allow --input /absolute/rule.json --execute --confirm 'exception.spam-allow.create sha256:<preview-digest>'"];
+    };
+    readonly "exception update": {
+        readonly description: "Preview or replace one exception; phishing/spam/click-time require an ID; malware/url/dlp identify it in --input without an ID; anomaly unsupported (guide pages 64-67, 78-81, 94-96, 105-107, 116-117, 126-127)";
+        readonly flags: {
+            readonly input: "Required absolute private JSON file containing documented requestData fields directly; fields depend on kind; update sends a replacement PUT";
+            readonly execute: string;
+            readonly "dry-run": string;
+            readonly confirm: string;
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception update phishing-block <id> --input /absolute/rule.json", "checkpoint-axi exception update spam-allow <id> --input /absolute/rule.json --execute --confirm 'exception.spam-allow.update <id>'"];
+    };
+    readonly "exception remove": {
+        readonly description: "Preview or remove one phishing/spam/anomaly/click-time exception by ID; malware/url/dlp refuse ENDPOINT_UNVERIFIED before authentication (guide pages 67-69, 81-82, 85-87, 98-99, 108-110, 119-120, 129-131)";
+        readonly flags: {
+            execute: string;
+            "dry-run": string;
+            confirm: string;
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception remove phishing-allow <id>", "checkpoint-axi exception remove spam-allow <id> --execute --confirm 'exception.spam-allow.remove <id>'"];
+    };
+    readonly "exception remove-items": {
+        readonly description: "Preview or remove 1-20 click-time items by caller-supplied IDs; existence is unverified (guide pages 97-98)";
+        readonly flags: {
+            readonly ids: "Required 1-20 unique comma-separated click-time item IDs";
+            readonly execute: string;
+            readonly "dry-run": string;
+            readonly confirm: string;
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception remove-items click-time --ids <id1>,<id2>", "checkpoint-axi exception remove-items click-time --ids <id1>,<id2> --execute --confirm 'exception.click-time.remove-items <id1>,<id2>'"];
+    };
+    readonly "exception clear": {
+        readonly description: "Refuse click-time/malware/url/dlp clear with ENDPOINT_UNVERIFIED until commissioning establishes counts and delete contracts (guide pages 87-88, 96-97, 107-110, 117-120, 128-131)";
+        readonly flags: {
+            execute: string;
+            "dry-run": string;
+            confirm: string;
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception clear click-time", "checkpoint-axi exception clear click-time --dry-run"];
+    };
+    readonly "event action": {
+        readonly description: "Preview or request a name-only event action; parameterized actions refuse ENDPOINT_UNVERIFIED pending commissioning (guide pages 35-37, 42-45)";
+        readonly flags: {
+            readonly ids: "Required comma-separated unique event IDs; maximum 20";
+            readonly name: "Required available action name; nonempty action parameters are unverified";
+            readonly execute: string;
+            readonly "dry-run": string;
+            readonly confirm: string;
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi event action --ids <id> --name dismiss", "checkpoint-axi event action --ids <id> --name dismiss --execute --confirm 'event.action.dismiss <id>'"];
+    };
+    readonly "email quarantine": {
+        readonly description: "Preview or request asynchronous email quarantine through the gated write coordinator (guide pages 28-30)";
+        readonly flags: {
+            ids: string;
+            execute: string;
+            "dry-run": string;
+            confirm: string;
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi email quarantine --ids <id>", "checkpoint-axi email quarantine --ids <id> --execute --confirm 'email.quarantine <id>'"];
+    };
+    readonly "email restore": {
+        readonly description: "Preview or request asynchronous email restore through the gated write coordinator (guide pages 28-30)";
+        readonly flags: {
+            ids: string;
+            execute: string;
+            "dry-run": string;
+            confirm: string;
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi email restore --ids <id>", "checkpoint-axi email restore --ids <id> --execute --confirm 'email.restore <id>'"];
+    };
+    readonly "exception list": {
+        readonly description: "List bounded exceptions for phishing-allow, phishing-block, spam-allow, anomaly, click-time, malware, url or dlp (guide pages 49-123)";
+        readonly flags: {
+            readonly type: string;
+            readonly items: "Click-time item routes instead of list routes; default false";
+            readonly limit: string;
+            readonly all: "Return up to 1000 rows within transport budgets; no server continuation parameter is documented";
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception list phishing-allow", "checkpoint-axi exception list malware --type hash", "checkpoint-axi exception list click-time --items --all"];
+    };
+    readonly "exception show": {
+        readonly description: "Show an exception by kind and ID/value; anomaly refuses ENDPOINT_UNVERIFIED pending commissioning (guide pages 52-123)";
+        readonly flags: {
+            readonly type: string;
+            readonly items: "Click-time item route instead of list route; default false";
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi exception show phishing-block <id>", "checkpoint-axi exception show url <value> --type allow-url", "checkpoint-axi exception show click-time <id> --items --full"];
+    };
+    readonly "event list": {
+        readonly description: "List security events with bounded scroll continuation (API guide pages 37-42)";
+        readonly flags: {
+            readonly saas: "Comma-separated SaaS overrides; default selected profile saas or office365_emails";
+            readonly "event-types": "Comma-separated event types; default unfiltered";
+            readonly "event-states": "Comma-separated event states; default unfiltered";
+            readonly severities: "Comma-separated severities; default unfiltered";
+            readonly "event-ids": "Comma-separated event IDs; default unfiltered";
+            readonly "confidence-indicator": "Confidence indicator selector; default unfiltered";
+            readonly description: "Description selector; default unfiltered";
+            readonly "start-date": string;
+            readonly "end-date": string;
+            readonly limit: string;
+            readonly all: string;
+            readonly cursor: string;
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi event list", "checkpoint-axi event list --all --event-types phishing", "checkpoint-axi event list --cursor <cursor>"];
+    };
+    readonly "event show": {
+        readonly description: "Show one event, actions taken and available actions (API guide pages 34-37)";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi event show <id>", "checkpoint-axi event show <id> --full"];
+    };
+    readonly "task show": {
+        readonly description: "Show asynchronous task status and per-action details (API guide pages 30-33)";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi task show <id>", "checkpoint-axi task show <id> --full"];
+    };
+    readonly "email search": {
+        readonly description: "Search emails with a bounded date window and scroll continuation (API guide pages 18-27)";
+        readonly flags: {
+            readonly filter: "JSON array of {saasAttrName, saasAttrOp, saasAttrValue} filters (guide pages 19-20)";
+            readonly "start-date": string;
+            readonly "end-date": string;
+            readonly limit: string;
+            readonly all: string;
+            readonly cursor: string;
+            readonly saas: "SaaS override; default selected profile saas or office365_emails";
+            readonly "saas-entity": "Optional SaaS entity type selector";
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi email search", "checkpoint-axi email search --all --saas office365_emails", "checkpoint-axi email search --cursor <cursor>"];
+    };
+    readonly "email show": {
+        readonly description: "Show one email with verdicts, actions and available actions (API guide pages 10-18)";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi email show <id>", "checkpoint-axi email show <id> --full"];
+    };
+    readonly doctor: {
+        readonly description: "Check regional API authentication and one bounded email search without printing tenant data";
+        readonly flags: {
+            readonly saas: "SaaS override; default selected profile saas or office365_emails";
+            readonly config: string;
+            readonly profile: string;
+            readonly fields: string;
+            readonly full: string;
+            readonly help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi doctor", "checkpoint-axi doctor --profile example --saas office365_emails"];
+    };
+    readonly home: {
+        readonly description: "Show local profile context without resolving secrets or making API calls";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi", "checkpoint-axi home --profile example"];
+    };
+    readonly "auth status": {
+        readonly description: "Validate the selected local profile and secret source without API calls";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi auth status", "checkpoint-axi auth status --profile example"];
+    };
+    readonly "profile list": {
+        readonly description: "List file profiles without resolving secrets; --profile does not filter this list";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi profile list", "checkpoint-axi profile list --config /example/config.json"];
+    };
+    readonly "config path": {
+        readonly description: "Show config and state paths without reading files; --profile does not affect paths";
+        readonly flags: {
+            config: string;
+            profile: string;
+            fields: string;
+            full: string;
+            help: string;
+        };
+        readonly examples: readonly ["checkpoint-axi config path", "checkpoint-axi config path --fields config"];
+    };
+};
+export declare function help(): Record<string, unknown>;