@vigilbase/cli 0.1.2 → 0.1.4

package/dist/lib/security-client.js

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+const record = z.record(z.string(), z.unknown());
+const rows = z.array(record);
+const passthrough = (shape) => z.object(shape).passthrough();
+/** Wire envelopes match One's flarehawk-ui normalizers; JSON retains evidence fields. */
+export const securityResponses = {
+    analytics: passthrough({ data: record }),
+    analyticsRows: passthrough({ data: rows }),
+    dnsSecurity: passthrough({ data: passthrough({ series: rows, top_domains: rows }) }),
+    providerEvents: passthrough({ data: rows, hasData: z.boolean(), count: z.number(), provider: z.string(), dataset: z.string(), aggregates: record.nullable() }),
+    deviceHealth: passthrough({ data: passthrough({ timeseries: rows, devices: rows }) }),
+    appTests: passthrough({ data: passthrough({ timeseries: rows, tests: rows }) }),
+    gateway: passthrough({ data: passthrough({ surface: z.enum(['dns', 'http', 'network']), timeseries: rows, top: rows, secondary: rows }) }),
+    access: passthrough({ data: passthrough({ timeseries: rows, apps: rows, users: rows, idps: rows, geo: rows }) }),
+    sessions: passthrough({ data: passthrough({ timeseries: rows, users: rows }) }),
+    devicePosture: passthrough({ data: passthrough({ checks: rows }) }),
+    accountInventory: passthrough({ data: passthrough({ connections: rows, assetDatasets: rows, logpushJobs: rows }) }),
+    accountAudit: passthrough({ data: passthrough({ summary: record, over_time: rows, top_actions: rows, top_resource_products: rows, outcomes: rows, recent_changes: rows }) }),
+    accountIngestion: passthrough({ data: passthrough({ volume: rows, by_asset: rows }) }),
+    accountPosture: passthrough({ data: passthrough({ posture: rows, heatmap: rows }) }),
+    providers: passthrough({ providers: rows }),
+    notifications: passthrough({ notifications: rows, unreadCount: z.number().int().nonnegative() }),
+    notificationSettings: passthrough({ channels: rows, preferences: record.nullish() }),
+    preferences: passthrough({ preferences: record }),
+    slackChannels: passthrough({ channels: rows }),
+    ipList: passthrough({ entries: rows }),
+    assetRemediation: passthrough({ effective: record }),
+    autonomy: passthrough({ settings: record }),
+    datasets: passthrough({ datasets: z.array(z.union([z.string(), record])) }),
+    defaultAsset: passthrough({ asset_id: z.string().uuid().nullable() }),
+    graph: passthrough({ asset_id: z.string(), domain_id: z.string(), dataset: z.string(), nodes: rows, edges: rows }),
+    availableAssets: passthrough({ assets: rows }),
+    connectionRemediation: passthrough({ cascading_default: record }),
+    logpushStatus: passthrough({ stored: record, asset: record, receipt: record, canRecreate: z.boolean(), warnings: z.array(z.string()), updatedAt: z.string() }),
+    workerStats: passthrough({ period: record, requests: record, errors: record, cpuTime: record, queue: record.nullable(), links: record, queueMetricsError: z.string().nullable(), updatedAt: z.string() }),
+    reportSettings: passthrough({ enabled: z.boolean(), delivery_day: z.string(), delivery_time_utc: z.string(), email_recipients: z.array(z.string()), include_traffic: z.boolean(), include_incidents: z.boolean(), include_top_threats: z.boolean() }),
+    alerts: passthrough({ alerts: rows }),
+    alert: passthrough({ alert: record }),
+    shareLinks: passthrough({ share_links: rows }),
+    lifecycleEmails: passthrough({ enabled: z.boolean() }),
+    broadcastEmails: passthrough({ marketingEmailEnabled: z.boolean(), releaseEmailEnabled: z.boolean(), releaseInAppEnabled: z.boolean() }),
+    applications: passthrough({ grants: rows }),
+    overview: passthrough({ overview: passthrough({ stats: record }) }),
+    incidents: passthrough({ incidents: rows, total: z.number() }),
+    incident: passthrough({ incident: record }),
+    timeline: passthrough({ events: rows, next_cursor: z.string().nullable(), degraded: z.boolean() }),
+    logs: passthrough({ logs: rows }),
+    assets: passthrough({ domains: rows }),
+    detections: passthrough({ rules: rows.optional(), detections: rows.optional() })
+        .refine((value) => value.rules !== undefined || value.detections !== undefined),
+    connections: passthrough({ connections: rows, total: z.number() }),
+    connection: passthrough({ connection: record }),
+    reports: passthrough({ reports: rows, total: z.number() }),
+    report: passthrough({ report: record }),
+    audit: passthrough({ events: rows, next_cursor: z.string().nullable() }),
+    intel: passthrough({ query: z.string(), query_type: z.enum(['ip', 'asn', 'cidr', 'ja3', 'ja4']), quota: record }),
+    quota: z.union([passthrough({ quota: record }), passthrough({ used: z.number(), remaining: z.number().nullable() })]),
+    update: z.union([
+        passthrough({ ok: z.literal(true), status: z.string() }),
+        passthrough({ success: z.literal(true), incident_id: z.string(), status: z.string() }),
+    ]),
+};
+export class SecurityClient {
+    one;
+    constructor(one) {
+        this.one = one;
+    }
+    async request(input) {
+        // Paths are generated by the command grammar. Never accept upstream URLs or tenant claims.
+        if (!/^\/[a-z0-9/-]+$/i.test(input.path) || input.path.includes('..')) {
+            throw new Error('Invalid security API path.');
+        }
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(input.query)) {
+            if (/^(customerId|customer_id|organizationId|organization_id|org_id)$/.test(key)) {
+                throw new Error('Tenant identity must use the validated customer scope.');
+            }
+            if (value !== undefined)
+                params.set(key, String(value));
+        }
+        if (input.customerId)
+            params.set('customerId', z.string().uuid().parse(input.customerId));
+        const query = params.size ? `?${params}` : '';
+        const payload = await this.one.requestJson(`/api/flarehawk${input.path}${query}`, input.body ? {
+            method: 'PATCH',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(input.body),
+        } : undefined);
+        if (payload.success === false || payload.ok === false) {
+            throw new Error('Security request was unsuccessful.');
+        }
+        const parsed = securityResponses[input.view].safeParse(payload);
+        if (!parsed.success)
+            throw new Error(`Invalid security ${input.view} response from One.`);
+        if (input.body && (payload.status !== input.body.status ||
+            (payload.incident_id !== undefined && payload.incident_id !== input.path.split('/').at(-1)))) {
+            throw new Error('Incident update response did not match the requested incident and status.');
+        }
+        if (input.view === 'intel' && (payload.query !== input.query.q || payload.query_type !== input.query.type)) {
+            throw new Error('Intel response did not match the requested lookup.');
+        }
+        if (input.view === 'providerEvents' && (payload.provider !== input.query.provider_id || payload.dataset !== input.query.dataset_id)) {
+            throw new Error('Provider events response did not match the requested provider and dataset.');
+        }
+        if (input.view === 'gateway' && payload.data.surface !== input.query.surface) {
+            throw new Error('Gateway response did not match the requested surface.');
+        }
+        return payload;
+    }
+}
+//# sourceMappingURL=security-client.js.map

package/dist/lib/security-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-client.js","sourceRoot":"","sources":["../../src/lib/security-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAChD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AAC5B,MAAM,WAAW,GAAG,CAA0B,KAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;AAExF,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxC,aAAa,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1C,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpF,cAAc,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9J,YAAY,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrF,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1I,MAAM,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChH,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,aAAa,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnE,gBAAgB,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACnH,YAAY,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5K,gBAAgB,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACtF,cAAc,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpF,SAAS,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,aAAa,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAChG,oBAAoB,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,WAAW,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IACjD,aAAa,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,gBAAgB,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpD,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3C,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,YAAY,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,KAAK,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClH,eAAe,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9C,qBAAqB,EAAE,WAAW,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACjE,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9J,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACzM,cAAc,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACrP,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrC,UAAU,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,eAAe,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACtD,eAAe,EAAE,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACxI,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3C,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACnE,SAAS,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9D,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC3C,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAClG,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;IACjF,WAAW,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,UAAU,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC/C,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxE,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;QACd,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACxD,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACvF,CAAC;CACH,CAAA;AAUD,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAExD,KAAK,CAAC,OAAO,CAAC,KAAsB;QAClC,2FAA2F;QAC3F,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,IAAI,kEAAkE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QACzF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAkB,iBAAiB,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9G,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACd,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,qBAAqB,CAAC,CAAA;QACzF,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;YACrD,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACpI,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC/F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAK,OAAO,CAAC,IAAgC,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/dist/lib/skill-fetch.d.ts

@@ -0,0 +1,7 @@
+import type { CliConfig } from './config.js';
+export declare const MAX_SKILL_BYTES: number;
+export declare function isPublicSkillAddress(address: string): boolean;
+export declare function validateSkillUrl(raw: string): URL;
+/** Resolve once, reject mixed private/public DNS, and pin the validated address to TLS. */
+export declare function fetchSkillText(config: CliConfig, raw: string): Promise<string>;
+//# sourceMappingURL=skill-fetch.d.ts.map

package/dist/lib/skill-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-fetch.d.ts","sourceRoot":"","sources":["../../src/lib/skill-fetch.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAI5C,eAAO,MAAM,eAAe,QAAa,CAAA;AAczC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CASjD;AAED,2FAA2F;AAC3F,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqDpF"}

package/dist/lib/skill-fetch.js

@@ -0,0 +1,102 @@
+import { lookup } from 'node:dns/promises';
+import { request } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { NetworkError, networkError } from './network.js';
+const SKILL_HOSTS = new Set(['vigilbase.com', 'www.vigilbase.com']);
+export const MAX_SKILL_BYTES = 256 * 1024;
+const blocked = new BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+    ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24], ['203.0.113.0', 24],
+    ['224.0.0.0', 3],
+])
+    blocked.addSubnet(address, prefix, 'ipv4');
+for (const [address, prefix] of [
+    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
+])
+    blocked.addSubnet(address, prefix, 'ipv6');
+const globalV6 = new BlockList();
+globalV6.addSubnet('2000::', 3, 'ipv6');
+export function isPublicSkillAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return !blocked.check(address, 'ipv4');
+    if (family === 6)
+        return globalV6.check(address, 'ipv6') && !blocked.check(address, 'ipv6');
+    return false;
+}
+export function validateSkillUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new NetworkError('Invalid skill documentation URL.', 'UNSAFE_SKILL_URL');
+    }
+    if (/[\u0000-\u0020\u007f-\u009f]/.test(raw) || url.protocol !== 'https:' ||
+        !SKILL_HOSTS.has(url.hostname) || url.port || url.username || url.password || url.hash || url.search ||
+        !/^\/agent-skills\/[a-z0-9-]+\.md$/.test(url.pathname)) {
+        throw new NetworkError('Skill documentation must use an approved HTTPS Vigilbase skill URL.', 'UNSAFE_SKILL_URL');
+    }
+    return url;
+}
+/** Resolve once, reject mixed private/public DNS, and pin the validated address to TLS. */
+export async function fetchSkillText(config, raw) {
+    const url = validateSkillUrl(raw);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
+    const aborted = new Promise((_resolve, reject) => {
+        controller.signal.addEventListener('abort', () => reject(new Error('Aborted')), { once: true });
+    });
+    try {
+        const addresses = await Promise.race([lookup(url.hostname, { all: true }), aborted]);
+        if (!addresses.length || addresses.some(({ address }) => !isPublicSkillAddress(address))) {
+            throw new NetworkError('Skill destination resolves to a prohibited network address.', 'UNSAFE_SKILL_ADDRESS');
+        }
+        const address = addresses[0];
+        return await Promise.race([new Promise((resolve, reject) => {
+                const req = request(url, {
+                    method: 'GET',
+                    agent: false,
+                    family: address.family,
+                    // Preserve hostname/SNI and certificate verification, but do not resolve again.
+                    lookup: (_hostname, _options, callback) => callback(null, address.address, address.family),
+                    signal: controller.signal,
+                    headers: { Accept: 'text/markdown, text/plain', 'User-Agent': config.userAgent },
+                }, (response) => {
+                    const status = response.statusCode ?? 0;
+                    // Reject every redirect, including redirects to otherwise approved hosts.
+                    if (status < 200 || status >= 300) {
+                        response.destroy();
+                        reject(new NetworkError(`Skill request failed (HTTP ${status}); redirects are not allowed.`, 'SKILL_HTTP_ERROR'));
+                        return;
+                    }
+                    let size = 0;
+                    const chunks = [];
+                    response.on('error', reject);
+                    response.on('data', (chunk) => {
+                        size += chunk.length;
+                        if (size > MAX_SKILL_BYTES) {
+                            response.destroy();
+                            reject(new NetworkError('Skill documentation exceeds the size limit.', 'RESPONSE_TOO_LARGE'));
+                            return;
+                        }
+                        chunks.push(chunk);
+                    });
+                    response.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+                });
+                req.on('error', reject);
+                req.end();
+            }), aborted]);
+    }
+    catch (error) {
+        if (error instanceof NetworkError)
+            throw error;
+        throw networkError(error, url.href, config.timeoutMs, controller.signal.aborted);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=skill-fetch.js.map

package/dist/lib/skill-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-fetch.js","sourceRoot":"","sources":["../../src/lib/skill-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEzD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAA;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAA;AACzC,MAAM,OAAO,GAAG,IAAI,SAAS,EAAE,CAAA;AAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7E,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC;IAClF,CAAC,WAAW,EAAE,CAAC,CAAC;CACR;IAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AACtD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CAC1D;IAAE,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AACtD,MAAM,QAAQ,GAAG,IAAI,SAAS,EAAE,CAAA;AAChC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;AAEvC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,YAAY,CAAC,kCAAkC,EAAE,kBAAkB,CAAC,CAAA;IAAC,CAAC;IACnH,IAAI,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACvE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM;QACpG,CAAC,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CAAC,qEAAqE,EAAE,kBAAkB,CAAC,CAAA;IACnH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB,EAAE,GAAW;IACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACpF,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,YAAY,CAAC,6DAA6D,EAAE,sBAAsB,CAAC,CAAA;QAC/G,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,CAAA;QAC7B,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;oBACvB,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,gFAAgF;oBAChF,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;oBAC1F,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE;iBACjF,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAA;oBACvC,0EAA0E;oBAC1E,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;wBAClC,QAAQ,CAAC,OAAO,EAAE,CAAA;wBAClB,MAAM,CAAC,IAAI,YAAY,CAAC,8BAA8B,MAAM,+BAA+B,EAAE,kBAAkB,CAAC,CAAC,CAAA;wBACjH,OAAM;oBACR,CAAC;oBACD,IAAI,IAAI,GAAG,CAAC,CAAA;oBACZ,MAAM,MAAM,GAAa,EAAE,CAAA;oBAC3B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;wBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;wBACpB,IAAI,IAAI,GAAG,eAAe,EAAE,CAAC;4BAC3B,QAAQ,CAAC,OAAO,EAAE,CAAA;4BAClB,MAAM,CAAC,IAAI,YAAY,CAAC,6CAA6C,EAAE,oBAAoB,CAAC,CAAC,CAAA;4BAC7F,OAAM;wBACR,CAAC;wBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACpB,CAAC,CAAC,CAAA;oBACF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC3E,CAAC,CAAC,CAAA;gBACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACvB,GAAG,CAAC,GAAG,EAAE,CAAA;YACX,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAA;QAC9C,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/lib/system-trust.d.ts

@@ -0,0 +1,8 @@
+type SystemTrustApi = {
+    getCACertificates?: (type?: 'default' | 'system') => string[];
+    setDefaultCACertificates?: (certificates: string[]) => void;
+};
+/** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
+export declare function configureSystemTrust(api?: SystemTrustApi): boolean;
+export {};
+//# sourceMappingURL=system-trust.d.ts.map

package/dist/lib/system-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-trust.d.ts","sourceRoot":"","sources":["../../src/lib/system-trust.ts"],"names":[],"mappings":"AAEA,KAAK,cAAc,GAAG;IACpB,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,KAAK,MAAM,EAAE,CAAA;IAC7D,wBAAwB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,IAAI,CAAA;CAC5D,CAAA;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,cAAoB,GAAG,OAAO,CAMvE"}

package/dist/lib/system-trust.js

@@ -0,0 +1,11 @@
+import * as tls from 'node:tls';
+/** CLI startup only: preserve bundled/extra CAs and add OS-managed trust. */
+export function configureSystemTrust(api = tls) {
+    if (!api.getCACertificates || !api.setDefaultCACertificates)
+        return false;
+    api.setDefaultCACertificates([
+        ...new Set([...api.getCACertificates('default'), ...api.getCACertificates('system')]),
+    ]);
+    return true;
+}
+//# sourceMappingURL=system-trust.js.map

package/dist/lib/system-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-trust.js","sourceRoot":"","sources":["../../src/lib/system-trust.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAO/B,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAAsB,GAAG;IAC5D,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,wBAAwB;QAAE,OAAO,KAAK,CAAA;IACzE,GAAG,CAAC,wBAAwB,CAAC;QAC3B,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;KACtF,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vigilbase/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Vigilbase CLI — security scanners, agent tools, and Vigilbase One from the terminal.",
   "keywords": [
     "vigilbase",
@@ -37,6 +37,10 @@
   "files": [
     "dist",
     "README.md",
+    "COMMANDS.md",
+    "CLOUDFLARE.md",
+    "SECURITY.md",
+    "ONE.md",
     "LICENSE"
   ],
   "publishConfig": {
@@ -56,6 +60,9 @@
     "prepublishOnly": "pnpm run build",
     "start": "node dist/bin.js",
     "test": "vitest run",
+    "check": "pnpm run lint && pnpm run test && pnpm run build && node ./scripts/smoke-local.mjs && node ./scripts/smoke-commands.mjs && node ./scripts/smoke-security.mjs",
+    "smoke:commands": "pnpm run build && node ./scripts/smoke-commands.mjs",
+    "smoke:local": "pnpm run build && node ./scripts/smoke-local.mjs",
     "smoke:e2e": "pnpm run build && node ./scripts/smoke-e2e.mjs",
     "vigilbase": "tsx src/bin.ts"
   },
@@ -64,6 +71,9 @@
     "@types/node": "^22.15.21",
     "tsx": "^4.20.3",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.9"
+    "vitest": "4.1.11"
+  },
+  "dependencies": {
+    "zod": "4.4.3"
   }
 }