@vigilbase/cli 0.1.4 → 0.2.1

package/dist/cli.js

@@ -1,11 +1,13 @@
 import { parseArgs } from 'node:util';
 import { DeviceAuthError } from './auth/index.js';
 import { VigilbaseApiError, VigilbaseClient } from './lib/client.js';
-import { createConfig } from './lib/config.js';
+import { createConfig, createLocalCommandConfig } from './lib/config.js';
 import { renderBanner, shouldShowBanner } from './lib/banner.js';
 import { createWriter, formatError } from './lib/format.js';
 import { HELP_TAGLINE, HELP_TEXT, helpForCommand } from './lib/help.js';
+import { wasRendered } from './lib/tui.js';
 import { getCommandHandler } from './commands/index.js';
+import { LocalCheckupError } from './local/cloudflare-checkup/errors.js';
 import { EXIT } from './types.js';
 import { CLI_VERSION } from './version.js';
 export { CLI_VERSION };
@@ -20,6 +22,7 @@ function parseCli(argv) {
             version: { type: 'boolean', short: 'V', default: false },
             'base-url': { type: 'string' },
             'one-url': { type: 'string' },
+            'auth-url': { type: 'string' },
             'client-id': { type: 'string' },
             timeout: { type: 'string' },
             style: { type: 'string' },
@@ -67,6 +70,14 @@ function parseCli(argv) {
             'revision': { type: 'string' },
             all: { type: 'boolean', default: false },
             light: { type: 'boolean', default: false },
+            profile: { type: 'string' },
+            'cf-auth': { type: 'string' },
+            'cf-bin': { type: 'string' },
+            out: { type: 'string' },
+            overwrite: { type: 'boolean', default: false },
+            'dry-run': { type: 'boolean', default: false },
+            'max-requests-per-5min': { type: 'string' },
+            yes: { type: 'boolean', default: false },
         },
     });
     return {
@@ -108,6 +119,7 @@ function parseCli(argv) {
             isVersion: Boolean(values.version),
             'base-url': typeof values['base-url'] === 'string' ? values['base-url'] : undefined,
             'one-url': typeof values['one-url'] === 'string' ? values['one-url'] : undefined,
+            'auth-url': typeof values['auth-url'] === 'string' ? values['auth-url'] : undefined,
             'client-id': typeof values['client-id'] === 'string' ? values['client-id'] : undefined,
             timeout: typeof values.timeout === 'string' ? values.timeout : undefined,
             style: typeof values.style === 'string' ? values.style : undefined,
@@ -126,6 +138,14 @@ function parseCli(argv) {
             tool: typeof values.tool === 'string' ? values.tool : undefined,
             limit: typeof values.limit === 'string' ? values.limit : undefined,
             'target-id': typeof values['target-id'] === 'string' ? values['target-id'] : undefined,
+            profile: typeof values.profile === 'string' ? values.profile : undefined,
+            'cf-auth': typeof values['cf-auth'] === 'string' ? values['cf-auth'] : undefined,
+            'cf-bin': typeof values['cf-bin'] === 'string' ? values['cf-bin'] : undefined,
+            out: typeof values.out === 'string' ? values.out : undefined,
+            isOverwrite: Boolean(values.overwrite),
+            isDryRun: Boolean(values['dry-run']),
+            'max-requests-per-5min': typeof values['max-requests-per-5min'] === 'string' ? values['max-requests-per-5min'] : undefined,
+            isYes: Boolean(values.yes),
         },
     };
 }
@@ -143,7 +163,8 @@ function resolveMode(jsonFlag) {
 }
 export async function runCli(options = {}) {
     const argv = options.argv ?? process.argv.slice(2);
-    const writer = createWriter(options.stdout, options.stderr);
+    const stdoutStream = options.stdout ?? process.stdout;
+    const writer = createWriter(stdoutStream, options.stderr);
     const previousEnv = process.env;
     if (options.env) {
         process.env = options.env;
@@ -152,7 +173,7 @@ export async function runCli(options = {}) {
         const parsed = parseCli(argv);
         const mode = resolveMode(parsed.values.isJson);
         if (parsed.values.isVersion || parsed.values.isHelp || !parsed.positionals.length || parsed.positionals[0] === 'help') {
-            const informational = new Set(['isJson', 'isHelp', 'isVersion', 'base-url', 'one-url', 'client-id', 'timeout']);
+            const informational = new Set(['isJson', 'isHelp', 'isVersion', 'base-url', 'one-url', 'auth-url', 'client-id', 'timeout']);
             for (const [key, value] of Object.entries(parsed.values)) {
                 if (value === undefined || value === false || informational.has(key))
                     continue;
@@ -168,6 +189,10 @@ export async function runCli(options = {}) {
             if (mode === 'json') {
                 writer.stdout(JSON.stringify({ name: '@vigilbase/cli', version: CLI_VERSION }, null, 2));
             }
+            else if (!stdoutStream.isTTY) {
+                // Pipes and files get only the version, for scripts.
+                writer.stdout(CLI_VERSION);
+            }
             else if (shouldShowBanner(mode)) {
                 writer.stdout(renderBanner({ version: CLI_VERSION, tagline: HELP_TAGLINE }));
             }
@@ -205,12 +230,16 @@ export async function runCli(options = {}) {
             }
             return EXIT.OK;
         }
-        const config = createConfig({
-            baseUrl: parsed.values['base-url'],
-            oneBaseUrl: parsed.values['one-url'],
-            clientId: parsed.values['client-id'],
-            timeoutMs: parseTimeout(parsed.values.timeout),
-        });
+        // Local checkups validate --base-url themselves (resolveSubmitOrigin) and ignore VIGILBASE_* URLs.
+        const config = command === 'local' || command === 'cloudflare-checkup'
+            ? createLocalCommandConfig(parseTimeout(parsed.values.timeout))
+            : createConfig({
+                baseUrl: parsed.values['base-url'],
+                oneBaseUrl: parsed.values['one-url'],
+                identityBaseUrl: parsed.values['auth-url'],
+                clientId: parsed.values['client-id'],
+                timeoutMs: parseTimeout(parsed.values.timeout),
+            });
         const publicClient = new VigilbaseClient(config);
         const handler = getCommandHandler(command);
         if (!handler) {
@@ -226,19 +255,21 @@ export async function runCli(options = {}) {
             publicClient,
             env: process.env,
             stdin: options.stdin,
+            stdoutStream,
+            stderrStream: options.stderr ?? process.stderr,
             loginHandler: options.loginHandler,
         });
     }
     catch (error) {
         const mode = argv.includes('--json') || argv.includes('-j') ? 'json' : 'text';
-        formatError(error, mode, writer);
+        // The terminal UI already showed it (■ and the hint) in its timeline.
+        if (mode === 'json' || !wasRendered(error))
+            formatError(error, mode, writer);
         if ((error instanceof VigilbaseApiError || error instanceof DeviceAuthError) && error.status === 429) {
             return EXIT.RATE_LIMITED;
         }
-        if (error instanceof DeviceAuthError && error.code === 'not_enabled') {
-            if (mode !== 'json') {
-                writer.stderr('Public tools remain available without login: `vigilbase list`, `vigilbase run …`');
-            }
+        if (error instanceof LocalCheckupError && error.isRateLimited) {
+            return EXIT.RATE_LIMITED;
         }
         return EXIT.ERROR;
     }
@@ -248,4 +279,3 @@ export async function runCli(options = {}) {
         }
     }
 }
-//# sourceMappingURL=cli.js.map

package/dist/commands/account.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleAccount: CommandHandler;
-//# sourceMappingURL=account.d.ts.map

package/dist/commands/account.js

@@ -184,4 +184,3 @@ export const handleAccount = async (ctx) => {
     }
     throw new Error('Usage: vigilbase account [services|org|endpoints|sessions|invites|billing] [--json]');
 };
-//# sourceMappingURL=account.js.map

package/dist/commands/auth.d.ts

@@ -3,4 +3,3 @@ export declare function readTokenFromStdin(input?: NodeJS.ReadableStream): Promi
 export declare const handleLogin: CommandHandler;
 export declare const handleLogout: CommandHandler;
 export declare const handleWhoami: CommandHandler;
-//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.js

@@ -1,4 +1,8 @@
-import { clearOneCredentials, getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from '../auth/index.js';
+import { readIdentityTokenMetadata } from '../auth/token-metadata.js';
+import { discoverAuthProvider } from '../auth/provider.js';
+import { revokeIdentityCredentials, revokeIdentityGrant, revokeSavedCredentials, withCredentialsLock } from '../auth/refresh.js';
+import { checkCredentialsLocation, clearIdentityCredentials, clearOneCredentials, hasIgnoredIdentityCredentials, readReplacedIdentityGrant, readStoredCredentials } from '../auth/store.js';
+import { getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from '../auth/index.js';
 import { VigilbaseOneClient, ONE_AUTH_REQUIRED_TOOLS } from '../lib/one-client.js';
 import { VigilbaseApiError } from '../lib/client.js';
 import { formatUserCode, isHeadlessEnvironment, openUrlInBrowser, resolveDeviceVerificationUrl, } from '../lib/open-url.js';
@@ -19,6 +23,30 @@ export async function readTokenFromStdin(input = process.stdin) {
         throw new Error('Token input must contain exactly one nonempty token.');
     return token;
 }
+/**
+ * Revoke the Identity grant a new login replaces, before the new grant exists. Identity treats a revoked refresh
+ * token presented again as reuse and ends every CLI grant of the user, so revoking after the new grant was issued
+ * could end it too. The lock is held from the read to the removal of the old file, so no concurrent command can
+ * refresh with the token in between, and no later command presents it again.
+ */
+async function retirePreviousIdentityGrant(ctx) {
+    await withCredentialsLock(ctx.config, async () => {
+        const previous = await readReplacedIdentityGrant(ctx.config);
+        // After a refresh with an uncertain result the token may be rotated already; presenting it trips the same check.
+        if (!previous || previous.refreshPending)
+            return;
+        try {
+            await revokeIdentityGrant(ctx.config, previous);
+        }
+        catch {
+            ctx.writer.stderr("Warning: Couldn't revoke your previous sign-in; it will expire on its own.");
+            return;
+        }
+        // The grant came from identity-credentials.json, or from a CLI 0.2.0 credentials.json when that file is absent.
+        const { identity } = await readStoredCredentials(ctx.config, () => { });
+        await (identity ? clearIdentityCredentials(ctx.config) : clearOneCredentials(ctx.config));
+    }, true);
+}
 export const handleLogin = async (ctx) => {
     if (ctx.rest.length)
         throw new Error('Usage: vigilbase login [--token-stdin | --token <bearer>] [--no-open]');
@@ -26,6 +54,9 @@ export const handleLogin = async (ctx) => {
     if (ctx.loginHandler) {
         return ctx.loginHandler(ctx.config);
     }
+    // Fail on Windows or an unsafe credentials directory or file before validating a token or starting device
+    // authorization: once a device grant is approved, a failed save would leave it unsaved and unrevoked.
+    await checkCredentialsLocation(ctx.config);
     if (ctx.values.isTokenStdin && (ctx.values.token !== undefined || ctx.env.VIGILBASE_ONE_TOKEN !== undefined)) {
         throw new Error('Use --token-stdin without --token or VIGILBASE_ONE_TOKEN.');
     }
@@ -47,15 +78,19 @@ export const handleLogin = async (ctx) => {
             email: session.user.email ?? undefined,
             name: session.user.name ?? undefined,
         };
-        await writeOneCredentials(ctx.config, {
-            accessToken: explicitToken,
-            tokenType: 'Bearer',
-            expiresAt: typeof session.session?.expiresAt === 'string'
-                ? session.session.expiresAt
-                : undefined,
-            user,
-            obtainedAt: new Date().toISOString(),
-        });
+        await withCredentialsLock(ctx.config, async () => {
+            // Identity credentials win when tokens are read, so revoke them before saving this session.
+            await revokeIdentityCredentials(ctx.config);
+            await writeOneCredentials(ctx.config, {
+                accessToken: explicitToken,
+                tokenType: 'Bearer',
+                expiresAt: typeof session.session?.expiresAt === 'string'
+                    ? session.session.expiresAt
+                    : undefined,
+                user,
+                obtainedAt: new Date().toISOString(),
+            });
+        }, true);
         if (ctx.mode === 'json') {
             outputJson(ctx, {
                 success: true,
@@ -72,8 +107,11 @@ export const handleLogin = async (ctx) => {
     }
     const preferNoOpen = Boolean(ctx.values.isNoOpen) || isHeadlessEnvironment(ctx.env);
     ctx.writer.stderr(`login  ${ctx.config.oneBaseUrl}`);
+    ctx.config.authProvider = await discoverAuthProvider(ctx.config);
+    if (ctx.config.authProvider)
+        await retirePreviousIdentityGrant(ctx);
     const device = await withSpinner(ctx, 'Requesting device code', () => requestDeviceCode(ctx.config));
-    const verifyUrl = resolveDeviceVerificationUrl(ctx.config.oneBaseUrl, device);
+    const verifyUrl = resolveDeviceVerificationUrl(ctx.config.authProvider?.issuer ?? ctx.config.oneBaseUrl, device);
     const prettyCode = formatUserCode(device.user_code);
     ctx.writer.stderr(`code   ${prettyCode}`);
     ctx.writer.stderr(`url    ${verifyUrl}`);
@@ -124,14 +162,23 @@ export const handleLogin = async (ctx) => {
     catch {
         // Session enrichment is best-effort.
     }
-    await writeOneCredentials(ctx.config, {
-        accessToken: token.access_token,
-        tokenType: token.token_type,
-        scope: token.scope,
-        expiresAt,
-        user,
-        obtainedAt: new Date().toISOString(),
-    });
+    if (ctx.config.authProvider && (!token.refresh_token || !expiresAt || !token.expires_in || token.expires_in > 300))
+        throw new Error('Identity returned an invalid token grant.');
+    const identityMetadata = ctx.config.authProvider ? readIdentityTokenMetadata(token.access_token, { issuer: ctx.config.authProvider.issuer, clientId: ctx.config.clientId, resource: ctx.config.authProvider.resource }) : undefined;
+    await withCredentialsLock(ctx.config, async () => {
+        // A legacy session is saved in credentials.json, which saved Identity credentials would override.
+        if (!ctx.config.authProvider)
+            await revokeIdentityCredentials(ctx.config);
+        await writeOneCredentials(ctx.config, {
+            ...(ctx.config.authProvider ? { issuer: ctx.config.authProvider.issuer, clientId: ctx.config.clientId, resource: ctx.config.authProvider.resource, refreshToken: token.refresh_token, orgId: identityMetadata?.organizationId } : {}),
+            accessToken: token.access_token,
+            tokenType: token.token_type,
+            scope: token.scope,
+            expiresAt,
+            user,
+            obtainedAt: new Date().toISOString(),
+        });
+    }, true);
     if (ctx.mode === 'json') {
         outputJson(ctx, {
             success: true,
@@ -152,7 +199,10 @@ export const handleLogout = async (ctx) => {
     if (ctx.rest.length)
         throw new Error('Usage: vigilbase logout');
     assertCommandFlags(ctx, []);
-    const cleared = await clearOneCredentials(ctx.config);
+    const cleared = await revokeSavedCredentials(ctx.config, (warning) => {
+        if (ctx.mode !== 'json')
+            ctx.writer.stderr(`Warning: ${warning}`);
+    });
     if (ctx.mode === 'json') {
         outputJson(ctx, { success: true, cleared });
     }
@@ -169,11 +219,12 @@ export const handleWhoami = async (ctx) => {
         throw new Error('Usage: vigilbase whoami');
     assertCommandFlags(ctx, []);
     const credentials = await readCredentials(ctx.config);
+    const legacyIdentityFileIgnored = await hasIgnoredIdentityCredentials(ctx.config);
     const accessToken = await getOneAccessToken(ctx.config);
     let liveUser = null;
     if (accessToken) {
         try {
-            const session = await withSpinner(ctx, 'Loading session', () => new VigilbaseOneClient(ctx.config, accessToken).getSession());
+            const session = await withSpinner(ctx, 'Loading session', () => new VigilbaseOneClient(ctx.config, accessToken, true).getSession());
             if (session.user) {
                 liveUser = {
                     id: session.user.id,
@@ -194,12 +245,19 @@ export const handleWhoami = async (ctx) => {
     const payload = {
         authenticated: signedIn,
         oneBaseUrl: ctx.config.oneBaseUrl,
+        issuer: credentials.one?.issuer ?? null,
+        clientId: credentials.one?.clientId ?? null,
+        resource: credentials.one?.resource ?? null,
+        organizationId: credentials.one?.orgId ?? null,
         user: liveUser,
         expiresAt: signedIn ? credentials.one?.expiresAt ?? null : null,
         scope: signedIn ? credentials.one?.scope ?? null : null,
         obtainedAt: signedIn ? credentials.one?.obtainedAt ?? null : null,
         authRequiredTools: signedIn ? [...ONE_AUTH_REQUIRED_TOOLS] : [],
+        legacyIdentityFileIgnored,
     };
+    // CLI 0.2.0 can save a second Identity grant in credentials.json; logout revokes it.
+    const legacyNote = 'Note: found a credentials file from CLI 0.2.0. `vigilbase logout` will revoke and remove it.';
     if (ctx.mode === 'json') {
         outputJson(ctx, payload);
     }
@@ -207,6 +265,7 @@ export const handleWhoami = async (ctx) => {
         outputLines(ctx, [
             'Not signed in. Public tools still work.',
             'Run `vigilbase login` to unlock auth-required tools (website-security, react2shell, fortibleed-check).',
+            ...(legacyIdentityFileIgnored ? [legacyNote] : []),
         ]);
     }
     else {
@@ -217,8 +276,9 @@ export const handleWhoami = async (ctx) => {
             lines.push(`Expires: ${credentials.one.expiresAt}`);
         }
         lines.push(`Auth-required tools: ${ONE_AUTH_REQUIRED_TOOLS.join(', ')}`);
+        if (legacyIdentityFileIgnored)
+            lines.push(legacyNote);
         outputLines(ctx, lines);
     }
     return ok();
 };
-//# sourceMappingURL=auth.js.map

package/dist/commands/billing.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleBilling: CommandHandler;
-//# sourceMappingURL=billing.d.ts.map

package/dist/commands/billing.js

@@ -48,4 +48,3 @@ export const handleBilling = async (ctx) => {
     }
     throw new Error('Usage: vigilbase billing [summary|portal] [--json] [--no-open]');
 };
-//# sourceMappingURL=billing.js.map

package/dist/commands/cloudflare.d.ts

@@ -1,4 +1,3 @@
 import { type CommandHandler } from './helpers.js';
-export declare const CLOUDFLARE_HELP = "Usage: vigilbase cf <command> [options]\nAlias: vigilbase cloudflare\n\nInventory and workspace:\n  zones                         List zones (default); --customer-id, --account-id, --zone-id\n  zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id\n  accounts                     List accessible accounts; --customer-id, --account-id\n  account <account-id>          Stored account detail; --customer-id\n  workspace [section]          Workspace bootstrap or section; --customer-id, --account-id, --zone-id\n    Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings\n\nZone reads (optional --customer-id; IDs can use --zone-id):\n  dns <zone-id>                 DNS records, TTL and proxy state\n  waf <zone-id>                 WAF rules, expressions, analytics and suggestions\n  speed-settings <zone-id>      Performance settings (internal users only)\n\nAccount reads (optional --customer-id; IDs can use --account-id):\n  audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)\n  zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics\n  developer-platform <account-id>  Workers, Workers analytics and Pages\n  magic-transit <account-id>    Prefixes, routes and traffic analytics\n    Zero Trust, Developer Platform and Magic Transit require deployment-read permission.\n\nAnalytics and checkups:\n  analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]\n    Default 7 days; live zone analytics uses the most recent 23 hours.\n  checkup [status]             Latest completed checkup; --customer-id, --account-id\n  checkup start                Start and persist a scan; --customer-id, --account-id\n  checkup progress <run-uuid>   Read saved progress once\n  checkup result <run-uuid>     Read the stored Cloudflare checkup result\n    checkups aliases checkup; list/show alias status; run aliases start.\n\nCommon options: --json, --one-url <origin>, --timeout <milliseconds>, --help\nCustomer IDs are UUIDs; account and zone IDs are 32 hexadecimal characters.\nOne login, tenant bindings and permissions apply to every command.\nCheckup start creates a scan run. These commands do not edit provider configuration.\nSee CLOUDFLARE.md for full grammar, API mapping, data limits and examples.";
+export declare const CLOUDFLARE_HELP = "Usage: vigilbase cf <command> [options]\nAlias: vigilbase cloudflare\n\nInventory and workspace:\n  zones                         List zones (default); --customer-id, --account-id, --zone-id\n  zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id\n  accounts                      List accessible accounts; --customer-id, --account-id\n  account <account-id>          Stored account detail; --customer-id\n  workspace [section]           Workspace bootstrap or section; --customer-id, --account-id, --zone-id\n    Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings\n\nZone reads (optional --customer-id; IDs can use --zone-id):\n  dns <zone-id>                 DNS records, TTL and proxy state\n  waf <zone-id>                 WAF rules, expressions, analytics and suggestions\n  speed-settings <zone-id>      Performance settings (internal users only)\n\nAccount reads (optional --customer-id; IDs can use --account-id):\n  audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)\n  zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics\n  developer-platform <account-id>\n                                Workers, Workers analytics and Pages\n  magic-transit <account-id>    Prefixes, routes and traffic analytics\n    Zero Trust, Developer Platform and Magic Transit require deployment-read permission.\n\nAnalytics and checkups:\n  analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]\n    Default 7 days; live zone analytics uses the most recent 23 hours.\n  checkup [status]              Latest completed checkup; --customer-id, --account-id\n  checkup start                 Start and persist a scan; --customer-id, --account-id\n  checkup progress <run-uuid>   Read saved progress once\n  checkup result <run-uuid>     Read the stored Cloudflare checkup result\n    checkups aliases checkup; list/show alias status; run aliases start.\n\nCommon options: --json, --one-url <origin>, --timeout <milliseconds>, --help\nCustomer IDs are UUIDs; account and zone IDs are 32 hexadecimal characters.\nOne login, tenant bindings and permissions apply to every command.\nCheckup start creates a scan run. These commands do not edit provider configuration.\nSee CLOUDFLARE.md for full grammar, API mapping, data limits and examples.";
 export declare const handleCloudflare: CommandHandler;
-//# sourceMappingURL=cloudflare.d.ts.map

package/dist/commands/cloudflare.js

@@ -9,9 +9,9 @@ Alias: vigilbase cloudflare
 Inventory and workspace:
   zones                         List zones (default); --customer-id, --account-id, --zone-id
   zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id
-  accounts                     List accessible accounts; --customer-id, --account-id
+  accounts                      List accessible accounts; --customer-id, --account-id
   account <account-id>          Stored account detail; --customer-id
-  workspace [section]          Workspace bootstrap or section; --customer-id, --account-id, --zone-id
+  workspace [section]           Workspace bootstrap or section; --customer-id, --account-id, --zone-id
     Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings
 
 Zone reads (optional --customer-id; IDs can use --zone-id):
@@ -22,15 +22,16 @@ Zone reads (optional --customer-id; IDs can use --zone-id):
 Account reads (optional --customer-id; IDs can use --account-id):
   audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)
   zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics
-  developer-platform <account-id>  Workers, Workers analytics and Pages
+  developer-platform <account-id>
+                                Workers, Workers analytics and Pages
   magic-transit <account-id>    Prefixes, routes and traffic analytics
     Zero Trust, Developer Platform and Magic Transit require deployment-read permission.
 
 Analytics and checkups:
   analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]
     Default 7 days; live zone analytics uses the most recent 23 hours.
-  checkup [status]             Latest completed checkup; --customer-id, --account-id
-  checkup start                Start and persist a scan; --customer-id, --account-id
+  checkup [status]              Latest completed checkup; --customer-id, --account-id
+  checkup start                 Start and persist a scan; --customer-id, --account-id
   checkup progress <run-uuid>   Read saved progress once
   checkup result <run-uuid>     Read the stored Cloudflare checkup result
     checkups aliases checkup; list/show alias status; run aliases start.
@@ -338,4 +339,3 @@ export const handleCloudflare = async (ctx) => {
             fields(ctx, report);
     });
 };
-//# sourceMappingURL=cloudflare.js.map

package/dist/commands/helpers.d.ts

@@ -10,6 +10,7 @@ export type ParsedCliValues = {
     isVersion?: boolean;
     'base-url'?: string;
     'one-url'?: string;
+    'auth-url'?: string;
     'client-id'?: string;
     timeout?: string;
     style?: string;
@@ -57,6 +58,14 @@ export type ParsedCliValues = {
     'revision'?: string;
     isAll?: boolean;
     isLight?: boolean;
+    profile?: string;
+    'cf-auth'?: string;
+    'cf-bin'?: string;
+    out?: string;
+    isOverwrite?: boolean;
+    isDryRun?: boolean;
+    'max-requests-per-5min'?: string;
+    isYes?: boolean;
 };
 export type CommandContext = {
     command: string;
@@ -68,6 +77,12 @@ export type CommandContext = {
     publicClient: VigilbaseClient;
     env: NodeJS.ProcessEnv;
     stdin?: NodeJS.ReadableStream;
+    /** Raw stdout, only to tell whether it is a terminal; text output still goes through `writer`. */
+    stdoutStream?: NodeJS.WritableStream & {
+        isTTY?: boolean;
+    };
+    /** Raw stderr for prompts that must not end in a newline; text output still goes through `writer`. */
+    stderrStream?: NodeJS.WritableStream;
     loginHandler?: (config: CliConfigLegacy) => Promise<ExitCode>;
 };
 export type CommandHandler = (ctx: CommandContext) => Promise<ExitCode>;
@@ -81,4 +96,3 @@ export declare function requireOneClient(ctx: CommandContext): Promise<Vigilbase
 export declare function withSpinner<T>(ctx: CommandContext, label: string, work: () => Promise<T>): Promise<T>;
 export declare function ok(): ExitCode;
 export { EXIT };
-//# sourceMappingURL=helpers.d.ts.map

package/dist/commands/helpers.js

@@ -5,7 +5,7 @@ import { getOneAccessToken } from '../auth/index.js';
 import { VigilbaseOneClient as OneClient } from '../lib/one-client.js';
 /** Reject known flags from other command groups instead of silently ignoring filters. */
 export function assertCommandFlags(ctx, allowed) {
-    const common = new Set(['isJson', 'isHelp', 'isVersion', 'base-url', 'one-url', 'client-id', 'timeout']);
+    const common = new Set(['isJson', 'isHelp', 'isVersion', 'base-url', 'one-url', 'auth-url', 'client-id', 'timeout']);
     for (const [key, value] of Object.entries(ctx.values)) {
         if (value === undefined || value === false || common.has(key) || allowed.includes(key))
             continue;
@@ -36,7 +36,7 @@ export async function requireOneClient(ctx) {
     if (!accessToken) {
         throw new Error('This command requires Vigilbase One auth. Run `vigilbase login` first.');
     }
-    return new OneClient(ctx.config, accessToken);
+    return new OneClient(ctx.config, accessToken, true);
 }
 export async function withSpinner(ctx, label, work) {
     return withProgress(label, ctx.mode, work);
@@ -45,4 +45,3 @@ export function ok() {
     return EXIT.OK;
 }
 export { EXIT };
-//# sourceMappingURL=helpers.js.map

package/dist/commands/index.d.ts

@@ -2,8 +2,9 @@ import type { CommandHandler } from './helpers.js';
 /**
  * Modular command registry.
  * Public tool commands never require auth. Auth-gated commands live under
- * account / runs / cf / watchdog / billing / login.
+ * account / runs / cf / watchdog / billing / login. `local` runs on this
+ * machine with the user's own tools (Cloudflare's cf) and needs no login;
+ * `cloudflare-checkup` is the top-level alias of `local cloudflare-checkup`.
  */
 export declare const COMMAND_HANDLERS: Record<string, CommandHandler>;
 export declare function getCommandHandler(command: string): CommandHandler | null;
-//# sourceMappingURL=index.d.ts.map

package/dist/commands/index.js

@@ -2,6 +2,7 @@ import { handleLogin, handleLogout, handleWhoami } from './auth.js';
 import { handleAccount } from './account.js';
 import { handleBilling } from './billing.js';
 import { handleCloudflare } from './cloudflare.js';
+import { handleCloudflareCheckup, handleLocal } from './local.js';
 import { handleBadge, handleDescribe, handleDoctor, handleList, handleRun, handleSkill, } from './public-tools.js';
 import { handleRuns } from './runs.js';
 import { handleOne } from './one.js';
@@ -10,7 +11,9 @@ import { handleWatchdog } from './watchdog.js';
 /**
  * Modular command registry.
  * Public tool commands never require auth. Auth-gated commands live under
- * account / runs / cf / watchdog / billing / login.
+ * account / runs / cf / watchdog / billing / login. `local` runs on this
+ * machine with the user's own tools (Cloudflare's cf) and needs no login;
+ * `cloudflare-checkup` is the top-level alias of `local cloudflare-checkup`.
  */
 export const COMMAND_HANDLERS = {
     list: handleList,
@@ -37,8 +40,9 @@ export const COMMAND_HANDLERS = {
     monitoring: handleOne,
     support: handleOne,
     billing: handleBilling,
+    local: handleLocal,
+    'cloudflare-checkup': handleCloudflareCheckup,
 };
 export function getCommandHandler(command) {
     return COMMAND_HANDLERS[command] ?? null;
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/legacy-validation.d.ts

@@ -18,4 +18,3 @@ export declare const invitationSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export declare const toolNameSchema: z.ZodString;
-//# sourceMappingURL=legacy-validation.d.ts.map

package/dist/commands/legacy-validation.js

@@ -17,4 +17,3 @@ export const invitationSchema = z.object({
     role: z.enum(['admin', 'member', 'readonly', 'partner_owner', 'partner_sales', 'partner_operations', 'partner_finance', 'partner_readonly', 'billing_only', 'sales_only']).default('member'),
 });
 export const toolNameSchema = z.string().trim().min(1).max(128).regex(/^[a-z0-9-]+$/, 'Tool names must contain lowercase letters, digits, or hyphens.');
-//# sourceMappingURL=legacy-validation.js.map

package/dist/commands/local.d.ts

@@ -0,0 +1,35 @@
+import { type CommandHandler } from './helpers.js';
+/**
+ * How the page, the docs and the hints spell the command: the bare package,
+ * no version. vigilbase.com refuses CLIs older than it accepts, and that
+ * error's hint (CLI_UPGRADE_REQUIRED) names `@latest` to get past a cached copy.
+ */
+export declare const NPX_COMMAND = "npx @vigilbase/cli";
+export declare const LOCAL_HELP: string;
+/** `vigilbase local cloudflare-checkup [<command>] …` */
+export declare const handleLocal: CommandHandler;
+/** `vigilbase cloudflare-checkup …`: the top-level alias. */
+export declare const handleCloudflareCheckup: CommandHandler;
+/**
+ * A path as one shell word, for hints the user may copy. POSIX shells get
+ * single quotes (nothing inside is expanded), with a leading `~/` left outside
+ * them so the shell still expands it.
+ */
+export declare function shellArg(value: string, platform?: NodeJS.Platform): string;
+/**
+ * `~/…` for paths under the home directory. Not on Windows: cmd and Windows
+ * PowerShell do not expand `~` for native commands, and the printed path is
+ * what users pass to `submit`.
+ */
+export declare function displayPath(path: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+/**
+ * `cloudflare-checkup-<first 8 of the account ID>-<UTC yyyymmddThhmmssZ>.json`;
+ * `-2`, `-3`, … only when a run in the same second already used the name.
+ */
+export declare function defaultSnapshotName(accountId: string, at: Date, attempt?: number): string;
+/**
+ * `submit` for a saved file. A loopback origin is named with `--base-url`, so a
+ * development run never suggests an upload to production; production is the
+ * CLI's default and is not named.
+ */
+export declare function submitCommand(path: string, origin: string): string;