@knowttl/falcon-axi 0.0.0-stage → 1.0.0-rc.1

package/.typescript-build/native/checksums.json

@@ -0,0 +1,4 @@
+{
+    "linux-x64.node": "8d1b7e249a70165347e1c43c33ca234a0bed8f0bf44a688aa0f996be0e98afab",
+    "win32-x64.node": "ab2d7da816e0da97208e2fcd9f3b774a6591d5760e337b70bb2e1fd33cc4603d"
+}

package/.typescript-build/src/auth.js

@@ -0,0 +1,219 @@
+import { CliError, object } from "./core.js";
+import { malformed } from "./response.js";
+import { REGIONS } from "./origin.js";
+import { registerSecret } from "./render.js";
+import { requestToken } from "./transport/https.js";
+import { operation } from "./transport/operations.js";
+export function responseFailure(response, subject, token = false, member = false, operationId = "GetQueriesAlertsV2") {
+    const scopes = operation(operationId).scopes;
+    const envelope = object(response.body) ? response.body : {};
+    const meta = object(envelope.meta) ? envelope.meta : {};
+    const details = typeof meta.trace_id === "string" ? { trace_id: meta.trace_id } : {};
+    if (response.status === 400) {
+        if (operationId === "api_preempt_proxy_post_graphql")
+            throw new CliError("UPSTREAM_ERROR", `Falcon rejected falcon-axi's fixed Identity Protection query for ${subject}`, [
+                "The query does not match this tenant's Identity Protection GraphQL schema; this is a falcon-axi bug",
+                "Quote the trace_id and the command when reporting it",
+            ], details);
+        const remedy = {
+            query_accounts: ["account list", "username:'synthetic-user'"],
+            get_accounts: ["account list", "username:'synthetic-user'"],
+            GetSensorUsageWeekly: ["sensor-usage list", "period:'30'"],
+            combined_hosts: ["asset list", "entity_type:'managed'"],
+            get_hosts: ["asset list", "entity_type:'managed'"],
+            combined_applications: ["application list", "name:'Chrome'"],
+            query_logins: ["login list", "login_status:'Failed'"],
+            get_logins: ["login list", "login_status:'Failed'"],
+            queryCombinedHostGroups: ["host-group list", "group_type:'dynamic'"],
+            queryCombinedGroupMembers: [
+                "host-group members",
+                "platform_name:'Windows'",
+            ],
+            query_iot_hostsV2: ["iot list", "device_type:'Printer'"],
+            get_iot_hosts: ["iot list", "device_type:'Printer'"],
+            QuerySensorsByFilter: [
+                "identity sensor list",
+                "hostname:'SYNTH-DC-01'+status:'healthy'",
+            ],
+            GetSensorDetails: [
+                "identity sensor list",
+                "hostname:'SYNTH-DC-01'+status:'healthy'",
+            ],
+            cloud_security_assets_queries: [
+                "cloud-asset list",
+                "cloud_provider:'aws'",
+            ],
+            cloud_security_assets_entities_get: [
+                "cloud-asset list",
+                "cloud_provider:'aws'",
+            ],
+            cspm_evaluations_iom_queries: [
+                "iom list",
+                "severity:'critical'+status:'non-compliant'",
+            ],
+            cspm_evaluations_iom_entities: [
+                "iom list",
+                "severity:'critical'+status:'non-compliant'",
+            ],
+            combined_cloud_risks: [
+                "cloud-risk list",
+                "severity:'Critical'+status:'Open'",
+            ],
+            QueryVulnerabilities: ["cve list", "severity:'CRITICAL'"],
+            GetVulnerabilities: ["cve list", "severity:'CRITICAL'"],
+            getVulnerabilities: ["vuln list", "status:'open'"],
+            combinedQueryVulnerabilities: ["vuln list", "status:'open'"],
+            ReadContainerCombined: ["container list", "namespace:'production'"],
+            GetCombinedImages: ["image list", "repository:'example/service'"],
+            ReadCombinedVulnerabilities: ["image vulnerabilities", "cvss_score:>7"],
+            GetCombinedVulnerabilitiesSARIF: [
+                "serverless list",
+                "cloud_provider:'aws'",
+            ],
+            highVolumeQueryChanges: [
+                "file-change list",
+                "host.name:'SYNTHETIC-HOST'",
+            ],
+            getChanges: ["file-change list", "host.name:'SYNTHETIC-HOST'"],
+            RTR_ListAllSessions: ["rtr session list", "hostname:'SYNTHETIC-*'"],
+            RTR_ListSessions: ["rtr session list", "hostname:'SYNTHETIC-*'"],
+            RTRAuditSessions: ["rtr audit list", "created_at:>'now-7d'"],
+            indicator_search_v1: ["ioc list", "type:'domain'"],
+            indicator_get_v1: ["ioc list", "type:'domain'"],
+        };
+        const [command, example] = remedy[operationId] ??
+            (scopes.includes("Hosts:read")
+                ? ["host list", "hostname:'WIN-*'"]
+                : ["detection list", "severity_name:'High'+status:'new'"]);
+        const errors = Array.isArray(envelope.errors) ? envelope.errors : [];
+        if (errors.some((error) => object(error) &&
+            typeof error.message === "string" &&
+            /\b(fql|filter|query)\b/i.test(error.message)))
+            throw new CliError("FQL_INVALID", `the filter for ${subject} was rejected`, [
+                "FQL uses + for AND, `,` for OR, and values must be quoted",
+                `Example: \`--filter "${example}"\``,
+                `Run \`falcon-axi ${command} --help\` for the filterable fields`,
+            ]);
+        throw new CliError("UPSTREAM_ERROR", `Falcon rejected the request for ${subject}`, ["Check the flags for this command with `--help`"], details);
+    }
+    if (response.status === 401)
+        throw new CliError("AUTH_FAILED", "the Falcon credential was rejected", [
+            "The client ID or secret is wrong, or the API client was revoked",
+            ...(!token
+                ? ["Run `falcon-axi auth status` after updating the credential"]
+                : []),
+        ]);
+    if (response.status === 403) {
+        if (operation(operationId).effect === "malquery-search")
+            throw new CliError("SCOPE_DENIED", "MalQuery search is not licensed or not permitted for this API client", [
+                "Grant MalQuery:write in the Falcon console under Support and resources > API clients and keys",
+                "Falcon MalQuery licensing is required; if the scope is absent from the picker, the tenant may lack that subscription",
+                "Captain exception N4 admits only bounded exact and fuzzy pattern searches, never hunt or download",
+                "Run `falcon-axi scopes` for the matrix",
+            ], { required_scopes: [...scopes] });
+        if (operation(operationId).effect === "search-lifecycle")
+            throw new CliError("SCOPE_DENIED", `this API client is not permitted to run ${subject}`, [
+                `Grant ${scopes.join(" and ")} to the API client in the Falcon console under Support and resources > API clients and keys`,
+                "Run `falcon-axi scopes` for the matrix, including which commands need this write scope",
+            ], { required_scopes: [...scopes] });
+        if (token && member)
+            throw new CliError("TENANT_DENIED", "the selected member CID was refused for this credential", [
+                "Verify this is a valid child CID in the Falcon console and not the parent CID itself",
+                "Or retry with `--no-member-cid` to authenticate as the credential's own CID",
+            ]);
+        if (token)
+            throw new CliError("AUTH_FAILED", "the Falcon credential was refused", [
+                "The API client has no scopes granted, or is disabled",
+                "Grant `Alerts:read` (read only) in the Falcon console under Support and resources > API clients and keys",
+            ]);
+        const licences = {
+            "Assets:read": "Falcon Discover or Exposure Management",
+            "MalQuery:read": "Falcon MalQuery",
+            "Sandbox (Falcon Intelligence):read": "Falcon Intelligence (Sandbox)",
+            "Device Control Policies:read": "Falcon Device Control",
+            "Falcon FileVantage:read": "Falcon FileVantage",
+            "Threatgraph:read": "a Falcon subscription with ThreatGraph API access enabled",
+            "Real time response:read": "a Falcon subscription with Real Time Response enabled",
+            "Real time response audit:read": "a Falcon subscription with Real Time Response audit enabled",
+        };
+        throw new CliError("SCOPE_DENIED", `this API client is not permitted to read ${subject}`, [
+            `Grant ${scopes.join(" and ")} (read only) to the API client in the Falcon console under Support and resources > API clients and keys`,
+            ...scopes
+                .filter((scope) => licences[scope])
+                .map((scope) => `${scope} needs ${licences[scope]}; if the scope is absent from the picker, the tenant lacks that subscription`),
+            ...(operationId === "entities_processes"
+                ? [
+                    "Process details may be unavailable under this tenant's subscription or API client permissions",
+                ]
+                : []),
+            "A 403 can also mean the API client is disabled",
+        ], { required_scopes: [...scopes] });
+    }
+    if (response.status === 429)
+        throw new CliError("RATE_LIMITED", "Falcon rate limited this API client", [
+            "Wait for the rate limit window to reset and retry",
+            "Narrow the FQL filter or lower `--limit` to issue fewer requests",
+        ]);
+    if ([502, 503, 504].includes(response.status))
+        throw new CliError("UPSTREAM_UNAVAILABLE", "Falcon is temporarily unavailable", [
+            "Retry shortly",
+            "Quote the trace_id when opening a CrowdStrike support case",
+        ], details);
+    throw new CliError("UPSTREAM_ERROR", `Falcon could not answer the request for ${subject}`, [
+        "Retry shortly",
+        "Quote the trace_id when opening a CrowdStrike support case",
+    ], details);
+}
+export function observeRate(session, response) {
+    for (const [header, field] of [
+        ["x-ratelimit-limit", "rateLimit"],
+        ["x-ratelimit-remaining", "remaining"],
+    ]) {
+        const value = response.headers[header];
+        if (value !== undefined &&
+            /^\d+$/.test(value) &&
+            Number.isSafeInteger(Number(value)))
+            session[field] = Number(value);
+    }
+}
+export async function authenticate(credential, base, allowUnknown, signal) {
+    let response = await requestToken(base, credential, allowUnknown, signal);
+    const current = Object.keys(REGIONS).find((key) => REGIONS[key] === base);
+    const observed = response.headers["x-cs-region"];
+    const redirect = () => {
+        throw new CliError("ORIGIN_NOT_ALLOWED", "the Falcon endpoint answered with a redirect and no credential was replayed", ["Supply a verified Falcon base URL with `--region <url>`"], { invalid_component: "redirect" });
+    };
+    if ((response.status >= 300 && response.status < 400) ||
+        ([200, 201].includes(response.status) &&
+            observed &&
+            current &&
+            observed !== current)) {
+        if (!observed)
+            redirect();
+        if (!Object.hasOwn(REGIONS, observed))
+            throw new CliError("REGION_MISMATCH", `this credential belongs to Falcon region ${observed}`, [
+                `falcon-axi has no verified base URL for ${observed}`,
+                "Supply a verified full Falcon base URL with `--region <url> --allow-unknown-origin`",
+            ], { observed_region: observed });
+        const target = REGIONS[observed];
+        if (target === base)
+            redirect();
+        base = target;
+        response = await requestToken(base, credential, allowUnknown, signal);
+        if (response.status >= 300 && response.status < 400)
+            redirect();
+    }
+    if (![200, 201].includes(response.status))
+        responseFailure(response, "the Falcon token endpoint", true, Boolean(credential.memberCid));
+    if (!object(response.body) ||
+        typeof response.body.access_token !== "string" ||
+        !response.body.access_token)
+        malformed(response, "the Falcon token response carried no access token", [
+            "Retry shortly",
+        ]);
+    const token = response.body.access_token;
+    registerSecret(token);
+    const session = { token, base };
+    observeRate(session, response);
+    return session;
+}

package/.typescript-build/src/axi-credential.schema.json

@@ -0,0 +1,64 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "title": "falcon-axi credential profile",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["clientId"],
+    "properties": {
+        "rtr": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["enabled"],
+            "properties": {
+                "enabled": { "type": "boolean", "default": false },
+                "commands": {
+                    "type": "array",
+                    "items": {
+                        "enum": [
+                            "cat",
+                            "cd",
+                            "csrutil",
+                            "env",
+                            "eventlog",
+                            "filehash",
+                            "getsid",
+                            "ifconfig",
+                            "ipconfig",
+                            "ls",
+                            "mount",
+                            "netstat",
+                            "ps",
+                            "reg query",
+                            "users"
+                        ]
+                    }
+                }
+            }
+        },
+        "region": { "type": "string", "minLength": 1 },
+        "memberCid": { "type": "string", "minLength": 1 },
+        "clientId": { "type": "string", "minLength": 1 },
+        "clientSecret": {
+            "x-secret": true,
+            "default": { "env": "FALCON_AXI_CLIENT_SECRET" },
+            "oneOf": [
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["env"],
+                    "properties": {
+                        "env": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" }
+                    }
+                },
+                {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["file"],
+                    "properties": {
+                        "file": { "type": "string", "pattern": "^(?:/|[A-Za-z]:[\\\\/])" }
+                    }
+                }
+            ]
+        }
+    }
+}

package/.typescript-build/src/bin.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { tryFastPath } from "axi-sdk-js/fast-path";
+import { VERSION } from "./version.js";
+if (!tryFastPath(process.argv.slice(2), { version: VERSION })) {
+    const { main } = await import("./cli.js");
+    const exitCode = await main(process.argv.slice(2));
+    // Flush the safe result before terminating the one-shot CLI.
+    process.stdout.write("", () => process.exit(exitCode));
+}

package/.typescript-build/src/cli.js

@@ -0,0 +1,345 @@
+import { CliError } from "./core.js";
+import { configPath, writeLogPath, loadProfiles, normalizeEnvironment, resolveCredential, } from "./credentials.js";
+import { authenticate } from "./auth.js";
+import { resolveOrigin, REGIONS } from "./origin.js";
+import { render, Raw, registerMemberCid } from "./render.js";
+import { commands, DESCRIPTION } from "./metadata.js";
+import { operation } from "./transport/operations.js";
+import { parse, filterOf } from "./parser.js";
+import { investigate } from "./investigation.js";
+import { Domain, quote } from "./domain.js";
+import { inventory } from "./inventory.js";
+import { exposure } from "./exposure.js";
+import { inspection } from "./inspection.js";
+import inspectionCommands from "./inspection-commands.json" with { type: "json" };
+import { homedir } from "node:os";
+import { executableCommand, shellArgument } from "./executable.js";
+import helpText from "./help.json" with { type: "json" };
+import { VERSION } from "./version.js";
+import { search } from "./search.js";
+import { identity } from "./identity.js";
+import { malquery } from "./malquery.js";
+import searchHelp from "./search-help.json" with { type: "json" };
+import { document } from "./transport/search-authority.js";
+import { rtrRun, validateRtrInvocation } from "./rtr.js";
+import { installHooks } from "./setup.js";
+import { HOME_GUIDANCE, skillHint } from "./skill.js";
+import { readOnly } from "./rtr-policy.js";
+const description = DESCRIPTION;
+export async function main(argv, bin) {
+    if (argv.length === 1 && ["-v", "-V", "--version"].includes(argv[0])) {
+        process.stdout.write(VERSION + "\n");
+        return 0;
+    }
+    const started = performance.now();
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.once("SIGTERM", cancel);
+    process.once("SIGINT", cancel);
+    let activeFlags = new Map();
+    let memberCid;
+    let home = false;
+    let hostnameDeadline;
+    const homeHead = () => {
+        const executable = executableCommand()
+            .map((argument) => process.platform !== "win32" && argument.startsWith(homedir() + "/")
+            ? "~/" + shellArgument(argument.slice(homedir().length + 1))
+            : shellArgument(argument))
+            .join(" ");
+        return {
+            bin: bin ?? executable,
+            description,
+        };
+    };
+    const contextualHelp = (help) => {
+        const suffix = ["region", "config", "profile"]
+            .flatMap((name) => activeFlags.has(`--${name}`)
+            ? [` --${name} ${quote(activeFlags.get(`--${name}`))}`]
+            : [])
+            .join("") +
+            ["allow-unknown-origin", "no-member-cid"]
+                .filter((name) => activeFlags.has(`--${name}`))
+                .map((name) => ` --${name}`)
+                .join("");
+        const result = help.map((item) => item.replace(/`(falcon-axi .*)`/s, (_, command) => `\`${command}${suffix}\``));
+        if (memberCid && help.some((item) => /`falcon-axi /.test(item)))
+            result.push("Supply the same tenant selection used for this invocation when following these suggestions");
+        return result;
+    };
+    try {
+        const invocation = parse(argv);
+        const { command, flags } = invocation;
+        activeFlags = flags;
+        home = command.name === "home";
+        memberCid = flags.get("--member-cid");
+        if (flags.has("--help")) {
+            if (command.name === "setup") {
+                process.stdout.write(commands
+                    .filter((spec) => spec.name.startsWith("setup "))
+                    .map((spec) => spec.summary)
+                    .join("\n") + "\n");
+                return 0;
+            }
+            if (Object.hasOwn(searchHelp, command.name)) {
+                process.stdout.write(searchHelp[command.name] + "\n");
+                return 0;
+            }
+            if (Object.hasOwn(helpText, command.name)) {
+                process.stdout.write(helpText[command.name] + "\n");
+                return 0;
+            }
+            const lines = [
+                `falcon-axi ${command.name === "home" ? `${VERSION} - ${description}` : command.name}`,
+                "",
+                "Commands:",
+                ...commands
+                    .filter((spec) => command.name === "home" ||
+                    spec.name.startsWith(`${command.name} `))
+                    .map((spec) => spec.summary),
+                "",
+                "Global flags:",
+                "  --help, --region <name|url>, --allow-unknown-origin, --member-cid <cid>, --no-member-cid",
+                "  --config <path>, --profile <name>",
+                "",
+                `Regions: ${Object.keys(REGIONS).join(", ")}`,
+                ...(command.name === "home"
+                    ? [
+                        "",
+                        "RTR execution requires profile opt-in, --execute, and exact host:command --confirm (N3). It",
+                        "requires Alerts:read, Hosts:read, Vulnerabilities:read, Vulnerabilities (Falcon Intelligence):read,",
+                        "NGSIEM:read, Identity Protection Entities:read, Identity Protection Timeline:read, and",
+                        "Identity Protection Assessment:read, plus three",
+                        "write-labelled scopes: NGSIEM:write for `search start`, `search stop`, and `identity activity`, and",
+                        "Identity Protection GraphQL:write for the fixed Identity Protection query commands,",
+                        "which Falcon requires even for read-only queries, and MalQuery:write for bounded exact/fuzzy searches (N4).",
+                        "The `account`, `asset`, `application`, and `login` commands need license-gated Assets:read.",
+                        "The `indicator` commands require the license-gated Indicators (Falcon Intelligence):read scope.",
+                    ]
+                    : []),
+            ];
+            process.stdout.write(lines.join("\n") + "\n");
+            return 0;
+        }
+        const filter = filterOf(invocation);
+        if (flags.has("--region"))
+            resolveOrigin(flags.get("--region"), flags.has("--allow-unknown-origin"));
+        for (const warning of normalizeEnvironment())
+            process.stderr.write(warning + "\n");
+        if (command.name === "setup") {
+            process.stdout.write(render({
+                setup: "Install falcon-axi in a durable location before registering session integrations",
+            }, [
+                "Run `falcon-axi setup hooks` to install or repair Claude Code, Codex, and OpenCode integrations",
+                "Set FALCON_AXI_CLIENT_ID and FALCON_AXI_CLIENT_SECRET, or configure a profile with a SecretRef",
+                "Run `npx skills add knowttl/falcon-axi --skill falcon-axi` to install the agent skill separately",
+            ]));
+            return 0;
+        }
+        if (command.name === "setup hooks") {
+            process.stdout.write(render(await installHooks()));
+            return 0;
+        }
+        if (readOnly() &&
+            [
+                "search start",
+                "search stop",
+                "host usb",
+                "identity activity",
+                "malquery search",
+            ].includes(command.name))
+            throw new CliError("READ_ONLY_VIOLATION", "FALCON_AXI_READ_ONLY forbids search lifecycle changes");
+        if (command.name === "rtr run")
+            validateRtrInvocation(invocation);
+        if (command.name === "config path") {
+            process.stdout.write(render({
+                config: configPath(flags.get("--config")),
+                write_log: writeLogPath(),
+            }));
+            return 0;
+        }
+        if (command.name === "profile list") {
+            const document = await loadProfiles(flags.get("--config"));
+            process.stdout.write(render({
+                profiles: Object.keys(document.profiles),
+                default_profile: document.defaultProfile,
+            }));
+            return 0;
+        }
+        if (command.name === "scopes") {
+            const groups = new Map();
+            for (const spec of commands)
+                for (const scope of new Set([
+                    ...spec.operations.flatMap((id) => operation(id).scopes),
+                    ...([
+                        "identity list",
+                        "identity show",
+                        "identity timeline",
+                        "identity assessment",
+                    ].includes(spec.name)
+                        ? document(spec.name === "identity list"
+                            ? "identity_list"
+                            : spec.name.replace(" ", "_")).readScopes
+                        : []),
+                ])) {
+                    const names = groups.get(scope) ?? [];
+                    names.push(spec.name);
+                    groups.set(scope, names);
+                }
+            process.stdout.write(render({
+                posture: new Raw("read-only except three write-labelled scopes: NGSIEM:write for NG-SIEM search start and stop and identity activity (captain exception N1), and Identity Protection GraphQL:write for fixed read-only identity queries (captain exception N2); Real time response:read also permits guarded host execution with profile opt-in and exact confirmation (captain exception N3); MalQuery:write permits bounded exact/fuzzy pattern searches (captain exception N4)"),
+                scopes: [...groups].map(([scope, names]) => ({
+                    scope,
+                    access: scope.endsWith(":write") ? "write" : "read",
+                    commands: names.join(", "),
+                    required: names.every((name) => /^(policy|exclusion) /.test(name))
+                        ? "selected --type"
+                        : "yes",
+                })),
+                member_cid_token_scope: new Raw("unresolved (Flight Control read may be required; see design section 17.7)"),
+            }, [
+                "Grant these scopes in the Falcon console under Support and resources > API clients and keys",
+                "Grant read access only, apart from NGSIEM:write, Identity Protection GraphQL:write, and MalQuery:write; falcon-axi needs no other write scope",
+                "Identity Protection GraphQL:write is labelled write because Falcon requires it even for read-only queries; falcon-axi sends only its own fixed read queries, never caller-supplied GraphQL (captain exception N2)",
+                "Omit NGSIEM:write and `search start`, `search stop`, and `identity activity` fail with SCOPE_DENIED",
+                "Omit Identity Protection GraphQL:write and `identity list`, `identity show`, `identity timeline`, and `identity assessment` fail with SCOPE_DENIED",
+                "MalQuery:write needs Falcon MalQuery licensing and admits only bounded exact/fuzzy search under N4; hunt and sample downloads remain excluded",
+                "Assets:read is license-gated to Falcon Discover or Exposure Management; omit it and the `account`, `asset`, `application`, and `login` commands fail with SCOPE_DENIED",
+            ]));
+            return 0;
+        }
+        const credential = await resolveCredential(flags.get("--config"), flags.get("--profile"), command.name === "auth status");
+        if (flags.has("--no-member-cid"))
+            delete credential.memberCid;
+        else if (flags.has("--member-cid")) {
+            credential.memberCid = flags.get("--member-cid");
+            registerMemberCid(credential.memberCid);
+        }
+        memberCid = credential.memberCid;
+        const allowUnknown = flags.has("--allow-unknown-origin");
+        const base = resolveOrigin(flags.get("--region") ?? credential.region, allowUnknown);
+        if (command.name === "rtr run") {
+            process.removeListener("SIGTERM", cancel);
+            process.removeListener("SIGINT", cancel);
+            process.on("SIGTERM", cancel);
+            process.on("SIGINT", cancel);
+            await rtrRun(invocation, credential, base, controller.signal);
+            return 0;
+        }
+        if (flags.has("--hostname") &&
+            ["host logins", "host network"].includes(command.name))
+            hostnameDeadline = AbortSignal.timeout(Math.max(0, Math.floor(60000 - (performance.now() - started))));
+        const signal = flags.has("--wait")
+            ? AbortSignal.any([
+                controller.signal,
+                AbortSignal.timeout(Math.max(0, Math.floor(Number(flags.get("--wait")) * 1000 -
+                    (performance.now() - started)))),
+            ])
+            : hostnameDeadline
+                ? AbortSignal.any([controller.signal, hostnameDeadline])
+                : controller.signal;
+        const session = await authenticate(credential, base, allowUnknown, signal);
+        const region = Object.keys(REGIONS).find((key) => REGIONS[key] === session.base) ??
+            "an unlisted Falcon cloud";
+        const tenant = new Raw(`${region}${base !== session.base ? ` (re-targeted from ${Object.keys(REGIONS).find((key) => REGIONS[key] === base)})` : ""}${credential.memberCid ? ` member CID …${credential.memberCid.length <= 4 ? "" : credential.memberCid.slice(-4)}` : " (own CID unavailable)"}`);
+        if (command.name === "auth status") {
+            process.stdout.write(render({
+                credential_resolved: true,
+                credential_channel: credential.channel,
+                profile: credential.profile,
+                endpoint: session.base,
+                client_secret_source: credential.secretSource,
+                credential_path: credential.path,
+                tenant,
+                scopes: new Raw("read scopes, plus NGSIEM:write for `search start`, `search stop`, and `identity activity`, Identity Protection GraphQL:write for the fixed Identity Protection query commands, and MalQuery:write for bounded exact/fuzzy searches (N4)"),
+                ...(session.rateLimit !== undefined &&
+                    session.remaining !== undefined
+                    ? {
+                        rate_limit: new Raw(`${session.remaining} of ${session.rateLimit} requests remaining`),
+                    }
+                    : {}),
+            }, contextualHelp([
+                "Run `falcon-axi detection list` to read detections with this credential",
+            ])));
+            return 0;
+        }
+        const domain = new Domain(invocation, credential, session, allowUnknown, signal);
+        const result = command.name.startsWith("search ") ||
+            ["host usb", "identity activity"].includes(command.name)
+            ? await search(domain)
+            : [
+                "identity list",
+                "identity show",
+                "identity timeline",
+                "identity assessment",
+            ].includes(command.name)
+                ? await identity(domain)
+                : command.name.startsWith("malquery ")
+                    ? await malquery(domain)
+                    : inspectionCommands.some((entry) => entry.name === command.name)
+                        ? await inspection(domain, filter)
+                        : [
+                            "account",
+                            "asset",
+                            "application",
+                            "login",
+                            "iot",
+                            "host-group",
+                            "sensor-usage",
+                        ].includes(command.name.split(" ")[0]) ||
+                            command.name.startsWith("identity sensor ")
+                            ? await inventory(domain, filter)
+                            : [
+                                "vuln",
+                                "cve",
+                                "cloud-asset",
+                                "iom",
+                                "cloud-risk",
+                                "container",
+                                "image",
+                                "serverless",
+                                "shield",
+                            ].includes(command.name.split(" ")[0])
+                                ? await exposure(domain, filter)
+                                : await investigate(invocation, credential, session, filter, allowUnknown, signal);
+        if (session.rateLimit &&
+            session.remaining !== undefined &&
+            session.remaining < session.rateLimit * 0.1) {
+            const note = `${session.remaining} of ${session.rateLimit} requests remaining in this rate limit window`;
+            if (command.name.startsWith("file-change "))
+                result.help.push(note);
+            else if (result.value.count || command.name === "process tree")
+                result.value.rate_limit = new Raw(note);
+        }
+        if (command.name === "home") {
+            result.value = {
+                ...homeHead(),
+                tenant,
+                ...result.value,
+            };
+            result.help.push(...HOME_GUIDANCE, ...(argv.length === 0 ? skillHint() : []));
+        }
+        process.stdout.write(render(result.value, contextualHelp(result.help)));
+        return 0;
+    }
+    catch (error) {
+        const safe = hostnameDeadline?.aborted && !controller.signal.aborted
+            ? new CliError("WAIT_TIMEOUT", "authentication, hostname lookup and history exceeded the combined 60-second time budget", ["Retry shortly"], error instanceof CliError ? error.details : {})
+            : error instanceof CliError
+                ? error
+                : new CliError("UNKNOWN", "falcon-axi could not complete this command", ["Retry shortly"]);
+        process.stdout.write(render({
+            ...(home ? homeHead() : {}),
+            error: safe.message,
+            code: safe.code,
+            ...safe.details,
+        }, contextualHelp([
+            ...safe.help,
+            ...(home && argv.length === 0 ? skillHint() : []),
+        ])));
+        return safe.exitCode;
+    }
+    finally {
+        process.removeListener("SIGTERM", cancel);
+        process.removeListener("SIGINT", cancel);
+    }
+}