@vigilbase/cli 0.1.4 → 0.2.1

package/dist/commands/one.d.ts

@@ -3,4 +3,3 @@ import { type CommandContext, type CommandHandler } from './helpers.js';
 export declare function buildOneOperation(ctx: CommandContext): OneOperation;
 export declare const handleOne: CommandHandler;
 export declare const ONE_HELP: Record<string, string>;
-//# sourceMappingURL=one.d.ts.map

package/dist/commands/one.js

@@ -153,7 +153,7 @@ export const handleOne = async (ctx) => {
 };
 export const ONE_HELP = {
     customers: `Usage: vigilbase customers <command> [--json]
-  list                              List visible customers (also the default)
+  list                               List visible customers (also the default)
   show <customer-id>                 Full customer details
   summary <customer-id>              Lightweight service/integration summary
   services <customer-id>             Service records
@@ -163,7 +163,7 @@ export const ONE_HELP = {
   watchdog-targets <customer-id>     Security/uptime targets
   watchdog-scans <customer-id>       --limit 1..100 --offset 0..1000000 --target-id UUID
   reports <customer-id>              Recon reports; --limit 1..100
-  report <customer-id> <report-id>    Recon report detail
+  report <customer-id> <report-id>   Recon report detail
   investigations <customer-id>       --limit 1..100 --cursor TEXT or --before ISO; --issue-id TEXT
   investigation <customer-id> <id>   --revision 1..2147483647
   contracts <customer-id>            --status draft|pending|active|expired|terminated
@@ -186,10 +186,10 @@ These commands read organization context; they do not switch the active organiza
   health                  Metrics backend and alerting readiness (also the default)
   probes                  Registered probe heartbeats (internal operators)
   probe-health            Live probe health, with database fallback
-  metrics <target-id>...   Metrics for 1..50 target UUIDs
-  targets <customer-id>    Customer's monitoring targets
-  status <customer-id>     Current status; --light skips latency/SSL provider reads
-  history <customer-id>    --range 24h|7d|30d --region CODE --target-id UUID
+  metrics <target-id>...  Metrics for 1..50 target UUIDs
+  targets <customer-id>   Customer's monitoring targets
+  status <customer-id>    Current status; --light skips latency/SSL provider reads
+  history <customer-id>   --range 24h|7d|30d --region CODE --target-id UUID
 All operations require read:monitoring and the API's tenant access checks.
 History defaults to 7d. Health metadata preserves unknown, partial, and unavailable states.`,
     support: `Usage: vigilbase support tickets [--all] [--limit 1..100] [--json]
@@ -197,4 +197,3 @@ Lists current organization's open tickets; --all includes closed tickets.
 The API defaults to 50 results. Requires support:access and a linked Pylon account.
 The response retains hasMore; the API does not expose cursor pagination.`,
 };
-//# sourceMappingURL=one.js.map

package/dist/commands/public-tools.d.ts

@@ -6,4 +6,3 @@ export declare const handleDescribe: CommandHandler;
 export declare const handleSkill: CommandHandler;
 export declare const handleBadge: CommandHandler;
 export declare const handleDoctor: CommandHandler;
-//# sourceMappingURL=public-tools.d.ts.map

package/dist/commands/public-tools.js

@@ -2,16 +2,38 @@ import { z } from 'zod';
 import { toolNameSchema, validateArguments } from './legacy-validation.js';
 import { NetworkError } from '../lib/network.js';
 import { VigilbaseApiError } from '../lib/client.js';
-import { getOneAccessToken } from '../auth/index.js';
+import { getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, readCredentials } from '../auth/index.js';
+import { SignInUnsupportedError } from '../auth/store.js';
 import { formatExecuteResult, formatToolDescription, formatToolsList, } from '../lib/format.js';
 import { isOneAuthRequiredTool, isOneExecutableTool, ONE_AUTH_REQUIRED_TOOLS, resolveToolDefinition, VigilbaseOneClient, } from '../lib/one-client.js';
 import { EXIT, ok, outputJson, withSpinner, } from './helpers.js';
+const ONE_SIGN_IN_REQUIRED = 'This tool needs a Vigilbase One sign-in: run `vigilbase login`.';
+/**
+ * For --via one and auth-required tools only: any sign-in problem fails. Specific errors keep their
+ * message; those that don't already point to `vigilbase login` get it as their hint.
+ */
+async function requireOneSignIn(config) {
+    let accessToken;
+    try {
+        accessToken = await getOneAccessToken(config);
+    }
+    catch (error) {
+        // Windows cannot sign in at all, so pointing to login would mislead.
+        if (error instanceof Error && !(error instanceof SignInUnsupportedError) && !error.message.includes('`vigilbase login`')) {
+            Object.assign(error, { hint: ONE_SIGN_IN_REQUIRED });
+        }
+        throw error;
+    }
+    if (!accessToken)
+        throw new Error(ONE_SIGN_IN_REQUIRED);
+    return accessToken;
+}
 /** Public tools work without login. Auth-required tools need Vigilbase One. */
 export const handleList = async (ctx) => {
     validateArguments(ctx, 0);
     const catalog = await withSpinner(ctx, 'Loading tool catalog', () => ctx.publicClient.listTools());
-    const accessToken = await getOneAccessToken(ctx.config);
-    const authenticated = Boolean(accessToken);
+    // Offline: list never refreshes, so it cannot leave a refresh half-done.
+    const authenticated = await hasUsableSignIn(ctx.config, ctx.writer.stderr);
     if (ctx.mode === 'json') {
         outputJson(ctx, {
             ...catalog,
@@ -65,19 +87,17 @@ export const handleRun = async (ctx) => {
     if (via && via !== 'one' && via !== 'public') {
         throw new Error('--via must be one of: public, one');
     }
-    const accessToken = await getOneAccessToken(ctx.config);
     const forcePublic = Boolean(ctx.values.isPublic) || via === 'public';
     const forceOne = via === 'one';
     // Public tools stay free unless forced onto One. Auth-required tools need login.
+    // The public route is anonymous and never reads the credential store.
     const useOne = !forcePublic && (forceOne || isOneAuthRequiredTool(toolName));
     if (useOne) {
-        if (!accessToken) {
-            throw new Error(`Tool "${toolName}" requires Vigilbase One auth. Run \`vigilbase login\` first.`);
-        }
+        const accessToken = await requireOneSignIn(ctx.config);
         if (!isOneExecutableTool(toolName)) {
             throw new Error(`Tool "${toolName}" is not executable via Vigilbase One CLI yet.`);
         }
-        const oneClient = new VigilbaseOneClient(ctx.config, accessToken);
+        const oneClient = new VigilbaseOneClient(ctx.config, accessToken, true);
         const oneResult = await withSpinner(ctx, `Running ${toolName} against ${target}`, () => oneClient.executeTool(toolName, target));
         formatExecuteResult({
             success: Boolean(oneResult.success),
@@ -162,12 +182,22 @@ export const handleBadge = async (ctx) => {
 };
 export const handleDoctor = async (ctx) => {
     validateArguments(ctx, 0);
-    const [publicResult, oneResult] = await withSpinner(ctx, 'Checking public API and Vigilbase One', () => Promise.allSettled([
+    let oneCheckUrl = `${ctx.config.oneBaseUrl}/api/auth/get-session`;
+    // A sign-in problem fails its own check, and One connectivity is then checked anonymously.
+    // The saved sign-in may refresh, with the configured timeout like any One command.
+    const signIn = getOptionalOneAccessToken(ctx.config);
+    const [publicResult, oneResult, signInResult] = await withSpinner(ctx, 'Checking public API and Vigilbase One', () => Promise.allSettled([
         ctx.publicClient.listTools(),
         (async () => {
-            const accessToken = await getOneAccessToken(ctx.config);
+            const { accessToken } = await signIn;
+            const saved = accessToken ? await readCredentials(ctx.config) : null;
+            // An Identity session is checked at the userinfo endpoint its issuer's discovery names.
+            if (saved?.version === 2)
+                oneCheckUrl = `${saved.one.issuer}/.well-known/openid-configuration`;
+            // Signed out, the check stays anonymous and never reads the credential store.
+            const client = new VigilbaseOneClient(ctx.config, accessToken ?? '', Boolean(accessToken));
             try {
-                const session = await new VigilbaseOneClient(ctx.config, accessToken ?? '').getSession();
+                const session = await client.getSession();
                 return { authenticated: Boolean(session.user?.id) };
             }
             catch (error) {
@@ -177,15 +207,23 @@ export const handleDoctor = async (ctx) => {
                 }
                 throw error;
             }
+            finally {
+                if (client.userinfoEndpoint)
+                    oneCheckUrl = client.userinfoEndpoint;
+            }
         })(),
+        signIn.then(({ problem }) => {
+            if (problem)
+                throw new Error(problem);
+        }),
     ]));
     const checkResult = (result, url) => {
         if (result.status === 'fulfilled')
-            return { ok: true, url };
+            return { ok: true, ...(url ? { url } : {}) };
         const error = result.reason;
         return {
             ok: false,
-            url,
+            ...(url ? { url } : {}),
             error: error instanceof Error ? error.message : 'Connectivity check failed.',
             ...(error instanceof VigilbaseApiError || error instanceof NetworkError ? { status: error.status } : {}),
             ...(error instanceof NetworkError ? { code: error.code } : {}),
@@ -193,9 +231,10 @@ export const handleDoctor = async (ctx) => {
     };
     const checks = {
         publicApi: checkResult(publicResult, `${ctx.config.publicBaseUrl}/api/agent/tools`),
-        one: checkResult(oneResult, `${ctx.config.oneBaseUrl}/api/auth/get-session`),
+        one: checkResult(oneResult, oneCheckUrl),
+        signIn: checkResult(signInResult),
     };
-    const isOk = checks.publicApi.ok && checks.one.ok;
+    const isOk = checks.publicApi.ok && checks.one.ok && checks.signIn.ok;
     const firstFailure = Object.values(checks).find((check) => !check.ok);
     const catalog = publicResult.status === 'fulfilled' ? publicResult.value : null;
     const payload = {
@@ -219,10 +258,9 @@ export const handleDoctor = async (ctx) => {
     }
     else {
         for (const [label, check] of Object.entries(checks)) {
-            ctx.writer.stdout(`${check.ok ? 'ok' : 'fail'}  ${label}  ${check.url}${check.error ? ` — ${check.error}` : ''}`);
+            ctx.writer.stdout(`${check.ok ? 'ok' : 'fail'}  ${label}${check.url ? `  ${check.url}` : ''}${check.error ? ` — ${check.error}` : ''}`);
         }
         ctx.writer.stdout(`auth=${payload.authenticated ? 'in' : 'out'}  tools=${payload.tools.join(',') || 'unavailable'}`);
     }
     return isOk ? ok() : EXIT.ERROR;
 };
-//# sourceMappingURL=public-tools.js.map

package/dist/commands/runs.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleRuns: CommandHandler;
-//# sourceMappingURL=runs.d.ts.map

package/dist/commands/runs.js

@@ -73,4 +73,3 @@ export const handleRuns = async (ctx) => {
     }
     throw new Error('Usage: vigilbase runs [list|get <id>] [--tool …] [--limit …] [--json]');
 };
-//# sourceMappingURL=runs.js.map

package/dist/commands/security.d.ts

@@ -2,5 +2,4 @@ import { type SecurityRequest } from '../lib/security-client.js';
 import { type CommandContext, type CommandHandler } from './helpers.js';
 export declare function buildSecurityRequest(ctx: CommandContext): SecurityRequest;
 export declare const handleSecurity: CommandHandler;
-export declare const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                       --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>                --limit --before\n  incidents fabric <id>                  --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>         --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>                --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";
-//# sourceMappingURL=security.d.ts.map
+export declare const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                      --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>               --limit --before\n  incidents fabric <id>                 --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>        --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>               --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";

package/dist/commands/security.js

@@ -387,5 +387,4 @@ export const handleSecurity = async (ctx) => {
         display(ctx, request, payload);
     return ok();
 };
-export const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                       --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>                --limit --before\n  incidents fabric <id>                  --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>         --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>                --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";
-//# sourceMappingURL=security.js.map
+export const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                      --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>               --limit --before\n  incidents fabric <id>                 --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>        --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>               --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";

package/dist/commands/watchdog.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleWatchdog: CommandHandler;
-//# sourceMappingURL=watchdog.d.ts.map

package/dist/commands/watchdog.js

@@ -59,4 +59,3 @@ export const handleWatchdog = async (ctx) => {
     }
     throw new Error('Usage: vigilbase watchdog [list|scans] [--target-id …] [--limit …] [--json]');
 };
-//# sourceMappingURL=watchdog.js.map

package/dist/index.d.ts

@@ -1,13 +1,13 @@
 export { runCli, CLI_VERSION } from './cli.js';
 export { VigilbaseClient, VigilbaseApiError } from './lib/client.js';
 export { createConfig, resolveBaseUrl, resolvePublicBaseUrl, resolveOneBaseUrl, } from './lib/config.js';
-export { clearOneCredentials, credentialsPath, DeviceAuthError, getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from './auth/index.js';
+export { discoverAuthProvider, identityProvider, managedAccessToken, revokeSavedCredentials, clearOneCredentials, credentialsPath, DeviceAuthError, getOneAccessToken, identityCredentialsPath, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from './auth/index.js';
 export { isOneAuthRequiredTool, isOneExecutableTool, ONE_AUTH_REQUIRED_TOOLS, ONE_AUTH_REQUIRED_TOOL_DEFINITIONS, ONE_EXECUTABLE_TOOLS, VigilbaseOneClient, } from './lib/one-client.js';
 export { EXIT } from './types.js';
-export type { AgentToolDefinition, AgentToolExecuteResponse, AgentToolsCatalogResponse, CliOutputMode, ExitCode, } from './types.js';
+export type { AgentApiError, AgentApiErrorCode, AgentApiErrorResponse, AgentToolDefinition, AgentToolExecuteResponse, AgentToolsCatalogResponse, CliOutputMode, ExitCode, } from './types.js';
+export type { AuthProvider } from './auth/provider.js';
 export type { CredentialsFile, OneCredentials } from './auth/types.js';
 export { CloudflareClient } from './lib/cloudflare-client.js';
 export type { CloudflareScope, WorkspaceSection } from './lib/cloudflare-client.js';
 export { SecurityClient } from './lib/security-client.js';
 export type { SecurityPayload, SecurityQuery, SecurityRequest } from './lib/security-client.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,9 +1,8 @@
 export { runCli, CLI_VERSION } from './cli.js';
 export { VigilbaseClient, VigilbaseApiError } from './lib/client.js';
 export { createConfig, resolveBaseUrl, resolvePublicBaseUrl, resolveOneBaseUrl, } from './lib/config.js';
-export { clearOneCredentials, credentialsPath, DeviceAuthError, getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from './auth/index.js';
+export { discoverAuthProvider, identityProvider, managedAccessToken, revokeSavedCredentials, clearOneCredentials, credentialsPath, DeviceAuthError, getOneAccessToken, identityCredentialsPath, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from './auth/index.js';
 export { isOneAuthRequiredTool, isOneExecutableTool, ONE_AUTH_REQUIRED_TOOLS, ONE_AUTH_REQUIRED_TOOL_DEFINITIONS, ONE_EXECUTABLE_TOOLS, VigilbaseOneClient, } from './lib/one-client.js';
 export { EXIT } from './types.js';
 export { CloudflareClient } from './lib/cloudflare-client.js';
 export { SecurityClient } from './lib/security-client.js';
-//# sourceMappingURL=index.js.map

package/dist/lib/banner.d.ts

@@ -26,4 +26,3 @@ export declare function shouldShowBanner(mode?: 'text' | 'json', env?: NodeJS.Pr
 export declare function renderBanner(options?: BannerOptions, stream?: {
     isTTY?: boolean;
 } | undefined, env?: NodeJS.ProcessEnv): string;
-//# sourceMappingURL=banner.d.ts.map

package/dist/lib/banner.js

@@ -65,4 +65,3 @@ export function renderBanner(options = {}, stream = process.stdout, env = proces
     });
     return lines.join('\n');
 }
-//# sourceMappingURL=banner.js.map

package/dist/lib/client.d.ts

@@ -1,15 +1,18 @@
-import type { AgentToolExecuteResponse, AgentToolsCatalogResponse } from '../types.js';
+import { type AgentToolExecuteResponse, type AgentToolsCatalogResponse } from '../types.js';
 import type { CliConfig } from './config.js';
 export declare class VigilbaseApiError extends Error {
     readonly status: number;
     readonly body: unknown;
     readonly retryAfterSec?: number;
     readonly code?: string;
+    /** The server's sanitised explanation, set only for known vigilbase.com problem errors. */
+    readonly reason?: string;
     constructor(message: string, options: {
         status: number;
         body?: unknown;
         retryAfterSec?: number;
         code?: string;
+        reason?: string;
     });
 }
 export declare function retryAfterSeconds(response: Response, body: unknown): number | undefined;
@@ -27,4 +30,3 @@ export declare class VigilbaseClient {
     fetchSkillMarkdown(skillUrl: string): Promise<string>;
     badgeUrl(domain: string, style?: 'default' | 'compact' | 'mini'): string;
 }
-//# sourceMappingURL=client.d.ts.map

package/dist/lib/client.js

@@ -1,11 +1,15 @@
 import { z } from 'zod';
+import { singleLine } from './format.js';
 import { parseJsonResponse, requestText } from './network.js';
 import { fetchSkillText } from './skill-fetch.js';
+import { AGENT_API_ERROR_CODES, } from '../types.js';
 export class VigilbaseApiError extends Error {
     status;
     body;
     retryAfterSec;
     code;
+    /** The server's sanitised explanation, set only for known vigilbase.com problem errors. */
+    reason;
     constructor(message, options) {
         super(message);
         this.name = 'VigilbaseApiError';
@@ -13,6 +17,7 @@ export class VigilbaseApiError extends Error {
         this.body = options.body;
         this.retryAfterSec = options.retryAfterSec;
         this.code = options.code;
+        this.reason = options.reason;
     }
 }
 export function retryAfterSeconds(response, body) {
@@ -30,6 +35,39 @@ export function retryAfterSeconds(response, body) {
     }
     return undefined;
 }
+/** Longer messages are withheld rather than cut. */
+const MAX_REASON_SOURCE_LENGTH = 1000;
+const problemSchema = z.object({
+    error: z.object({ code: z.unknown(), message: z.string().max(MAX_REASON_SOURCE_LENGTH) }),
+    code: z.unknown(),
+});
+/**
+ * The reason a vigilbase.com problem+json error gives, when its code is one com sends.
+ * Anything else stays redacted: other media types, unknown codes, odd messages.
+ */
+function problemReason(response, body) {
+    const mediaType = response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase();
+    if (mediaType !== 'application/problem+json')
+        return undefined;
+    const problem = problemSchema.safeParse(body);
+    if (!problem.success)
+        return undefined;
+    const code = z.enum(AGENT_API_ERROR_CODES).safeParse(problem.data.error.code ?? problem.data.code);
+    if (!code.success)
+        return undefined;
+    const message = singleLine(problem.data.error.message);
+    return message ? { code: code.data, message } : undefined;
+}
+function publicApiError(fallback, response, body) {
+    const reason = problemReason(response, body);
+    return new VigilbaseApiError(reason?.message ?? fallback, {
+        status: response.status,
+        body,
+        retryAfterSec: retryAfterSeconds(response, body),
+        code: reason?.code,
+        reason: reason?.message,
+    });
+}
 /**
  * Public (unauthenticated) vigilbase.com tools client.
  * Vigilbase One authenticated calls will use a separate client + device-auth tokens.
@@ -57,12 +95,7 @@ export class VigilbaseClient {
     async listTools() {
         const { response, body } = await this.request('/api/agent/tools');
         if (!response.ok) {
-            const message = `Failed to list tools (HTTP ${response.status})`;
-            throw new VigilbaseApiError(message, {
-                status: response.status,
-                body,
-                retryAfterSec: retryAfterSeconds(response, body),
-            });
+            throw publicApiError(`Failed to list tools (HTTP ${response.status})`, response, body);
         }
         const schema = z.object({
             success: z.literal(true),
@@ -84,24 +117,16 @@ export class VigilbaseClient {
         });
         const parsed = (body ?? {});
         if (response.status === 429) {
-            throw new VigilbaseApiError('Rate limit exceeded. Retry after the indicated delay.', {
-                status: 429,
-                body: parsed,
-                retryAfterSec: retryAfterSeconds(response, body),
-            });
+            throw publicApiError('Rate limit exceeded. Retry after the indicated delay.', response, parsed);
         }
         if (!response.ok && response.status !== 422) {
-            throw new VigilbaseApiError(`Tool execution failed (HTTP ${response.status})`, {
-                status: response.status,
-                body: parsed,
-                retryAfterSec: retryAfterSeconds(response, body),
-            });
+            throw publicApiError(`Tool execution failed (HTTP ${response.status})`, response, parsed);
         }
         if (!z.object({ success: z.boolean() }).passthrough().safeParse(body).success) {
             throw new VigilbaseApiError('Invalid tool execution response. Check the API URL or retry later.', { status: response.status });
         }
         if (!parsed.success) {
-            throw new VigilbaseApiError('Tool execution was unsuccessful.', { status: response.status, body, retryAfterSec: retryAfterSeconds(response, body) });
+            throw publicApiError('Tool execution was unsuccessful.', response, body);
         }
         return parsed;
     }
@@ -116,4 +141,3 @@ export class VigilbaseClient {
         return `${this.origin}/api/badge/${encodeURIComponent(domain)}${query ? `?${query}` : ''}`;
     }
 }
-//# sourceMappingURL=client.js.map

package/dist/lib/cloudflare-client.d.ts

@@ -37,4 +37,3 @@ export declare class CloudflareClient {
     checkupProgress(toolRunId: string): Promise<Record<string, unknown>>;
     private path;
 }
-//# sourceMappingURL=cloudflare-client.d.ts.map

package/dist/lib/cloudflare-client.js

@@ -78,4 +78,3 @@ export class CloudflareClient {
         return `${path}${query ? `?${query}` : ''}`;
     }
 }
-//# sourceMappingURL=cloudflare-client.js.map

package/dist/lib/config.d.ts

@@ -5,7 +5,13 @@ export type CliConfig = {
     oneBaseUrl: string;
     /** OAuth client_id for Better Auth device authorization. */
     clientId: string;
-    /** Directory for credentials and local config (~/.config/vigilbase). */
+    /** Explicit Identity issuer (--auth-url / VIGILBASE_AUTH_URL). One's discovery must name it; unset, only production Identity is trusted. */
+    identityBaseUrl?: string;
+    authProvider?: import('../auth/provider.js').AuthProvider;
+    /**
+     * Directory for credentials and local config (~/.config/vigilbase). Not validated when the config is built:
+     * the credential store rejects a relative path itself, so commands that never use it work whatever it holds.
+     */
     configDir: string;
     userAgent: string;
     timeoutMs: number;
@@ -14,20 +20,42 @@ export type CliConfig = {
 export type CliConfigLegacy = CliConfig & {
     baseUrl: string;
 };
+export declare function parseOrigin(raw: string, option: string): string;
+/** Default request timeout; also used when library callers omit `timeoutMs`. */
+export declare const DEFAULT_TIMEOUT_MS = 60000;
 export declare function resolvePublicBaseUrl(explicit?: string | null): string;
 export declare function resolveOneBaseUrl(explicit?: string | null): string;
 /** Validate at transport boundaries too: library callers may construct config objects. */
 export declare function validateOneOrigin(raw: string): string;
+/** Production Identity: the only issuer trusted unless --auth-url / VIGILBASE_AUTH_URL names another. */
+export declare const DEFAULT_IDENTITY_ISSUER = "https://auth.vigilbase.com";
+export declare const STAGING_IDENTITY_ISSUER = "https://identity-staging.vigilbase.com";
+export declare function resolveIdentityBaseUrl(raw: string): string;
+/**
+ * The one Identity issuer this configuration trusts: --auth-url / VIGILBASE_AUTH_URL
+ * when set, otherwise production. Staging is trusted only when configured explicitly.
+ * Validated here too because library callers may construct config objects.
+ */
+export declare function trustedIdentityIssuer(config: Pick<CliConfig, 'oneBaseUrl' | 'identityBaseUrl'>): string;
 export declare function resolveClientId(explicit?: string | null): string;
-export declare function resolveConfigDir(explicit?: string | null): string;
+/** The config directory, which must be absolute. */
+export declare function resolveConfigDir(explicit?: string | null, env?: NodeJS.ProcessEnv): string;
 export declare function createConfig(options?: {
     baseUrl?: string | null;
     publicBaseUrl?: string | null;
     oneBaseUrl?: string | null;
     clientId?: string | null;
+    identityBaseUrl?: string | null;
     configDir?: string | null;
     timeoutMs?: number;
 }): CliConfigLegacy;
+/**
+ * Config for `vigilbase local …` and `vigilbase cloudflare-checkup`. Local
+ * checkups resolve their own submit origin (resolveSubmitOrigin) and never
+ * read VIGILBASE_* URLs. They resolve the config directory themselves, and
+ * only when they need it (the managed cf install, the default snapshot path),
+ * so malformed values cannot block offline commands such as `inspect`.
+ */
+export declare function createLocalCommandConfig(timeoutMs?: number): CliConfigLegacy;
 /** Back-compat helper used by older call sites / tests. */
 export declare function resolveBaseUrl(explicit?: string | null): string;
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.js

@@ -9,7 +9,7 @@ const DEFAULT_CLIENT_ID = 'vigilbase-cli';
 const originSchema = z.string().url().transform((raw) => new URL(raw)).refine((url) => (url.protocol === 'https:' || url.protocol === 'http:') &&
     !url.username && !url.password &&
     /^\/+$/.test(url.pathname) && !url.search && !url.hash, 'Expected an HTTP(S) origin without credentials, a path, query, or fragment.').transform((url) => url.origin);
-function parseOrigin(raw, option) {
+export function parseOrigin(raw, option) {
     const result = originSchema.safeParse(raw);
     if (!result.success) {
         // Do not echo the input: malformed URLs can contain credentials.
@@ -18,6 +18,8 @@ function parseOrigin(raw, option) {
     return result.data;
 }
 const timeoutSchema = z.number().int().min(1).max(2_147_483_647);
+/** Default request timeout; also used when library callers omit `timeoutMs`. */
+export const DEFAULT_TIMEOUT_MS = 60_000;
 export function resolvePublicBaseUrl(explicit) {
     const raw = explicit?.trim() ||
         process.env.VIGILBASE_BASE_URL?.trim() ||
@@ -42,26 +44,60 @@ export function validateOneOrigin(raw) {
     }
     return origin;
 }
+/** Production Identity: the only issuer trusted unless --auth-url / VIGILBASE_AUTH_URL names another. */
+export const DEFAULT_IDENTITY_ISSUER = 'https://auth.vigilbase.com';
+export const STAGING_IDENTITY_ISSUER = 'https://identity-staging.vigilbase.com';
+const IDENTITY_OPTION = '--auth-url / VIGILBASE_AUTH_URL';
+function isIdentityLoopback(origin) {
+    return ['localhost', '127.0.0.1', '[::1]'].includes(new URL(origin).hostname);
+}
+export function resolveIdentityBaseUrl(raw) {
+    const origin = parseOrigin(raw, IDENTITY_OPTION);
+    if (origin !== DEFAULT_IDENTITY_ISSUER && origin !== STAGING_IDENTITY_ISSUER && !isIdentityLoopback(origin)) {
+        throw new Error(`${IDENTITY_OPTION} must be ${DEFAULT_IDENTITY_ISSUER}, ${STAGING_IDENTITY_ISSUER} or a loopback development origin.`);
+    }
+    return origin;
+}
+/**
+ * The one Identity issuer this configuration trusts: --auth-url / VIGILBASE_AUTH_URL
+ * when set, otherwise production. Staging is trusted only when configured explicitly.
+ * Validated here too because library callers may construct config objects.
+ */
+export function trustedIdentityIssuer(config) {
+    if (!config.identityBaseUrl)
+        return DEFAULT_IDENTITY_ISSUER;
+    const origin = resolveIdentityBaseUrl(config.identityBaseUrl);
+    if (isIdentityLoopback(origin) && !isIdentityLoopback(validateOneOrigin(config.oneBaseUrl))) {
+        throw new Error(`${IDENTITY_OPTION} can be a loopback origin only when --one-url / VIGILBASE_ONE_URL is loopback too.`);
+    }
+    return origin;
+}
 export function resolveClientId(explicit) {
     return (explicit?.trim() ||
         process.env.VIGILBASE_CLIENT_ID?.trim() ||
         DEFAULT_CLIENT_ID);
 }
-export function resolveConfigDir(explicit) {
-    const custom = explicit?.trim() || process.env.VIGILBASE_CONFIG_DIR?.trim();
-    const xdg = process.env.XDG_CONFIG_HOME?.trim();
-    if ((custom && !isAbsolute(custom)) || (xdg && !isAbsolute(xdg))) {
-        throw new Error('Custom config directories and XDG_CONFIG_HOME must be absolute paths.');
-    }
+/**
+ * VIGILBASE_CONFIG_DIR (or `explicit`), else $XDG_CONFIG_HOME/vigilbase, else ~/.config/vigilbase. A relative
+ * XDG_CONFIG_HOME is ignored, as the XDG Base Directory spec says; a relative custom directory is returned as is.
+ */
+function configDirFromEnvironment(explicit, env) {
+    const custom = explicit?.trim() || env.VIGILBASE_CONFIG_DIR?.trim();
     if (custom)
         return custom;
-    if (xdg)
-        return join(xdg, 'vigilbase');
-    return join(homedir(), '.config', 'vigilbase');
+    const xdg = env.XDG_CONFIG_HOME?.trim();
+    return xdg && isAbsolute(xdg) ? join(xdg, 'vigilbase') : join(homedir(), '.config', 'vigilbase');
+}
+/** The config directory, which must be absolute. */
+export function resolveConfigDir(explicit, env = process.env) {
+    const configDir = configDirFromEnvironment(explicit, env);
+    if (!isAbsolute(configDir))
+        throw new Error('VIGILBASE_CONFIG_DIR must be an absolute path.');
+    return configDir;
 }
 export function createConfig(options) {
     const publicBaseUrl = resolvePublicBaseUrl(options?.publicBaseUrl ?? options?.baseUrl);
-    const timeoutMs = options?.timeoutMs ?? 60_000;
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     if (!timeoutSchema.safeParse(timeoutMs).success) {
         throw new Error('Request timeout must be an integer between 1 and 2147483647 milliseconds.');
     }
@@ -70,14 +106,37 @@ export function createConfig(options) {
         /** Alias used by the current public tools client. */
         baseUrl: publicBaseUrl,
         oneBaseUrl: resolveOneBaseUrl(options?.oneBaseUrl),
+        ...(options?.identityBaseUrl || process.env.VIGILBASE_AUTH_URL ? { identityBaseUrl: resolveIdentityBaseUrl(options?.identityBaseUrl || process.env.VIGILBASE_AUTH_URL) } : {}),
         clientId: resolveClientId(options?.clientId),
-        configDir: resolveConfigDir(options?.configDir),
+        configDir: configDirFromEnvironment(options?.configDir, process.env),
         userAgent: `@vigilbase/cli/${CLI_VERSION} (+https://vigilbase.com; node/${process.version})`,
         timeoutMs,
     };
 }
+/**
+ * Config for `vigilbase local …` and `vigilbase cloudflare-checkup`. Local
+ * checkups resolve their own submit origin (resolveSubmitOrigin) and never
+ * read VIGILBASE_* URLs. They resolve the config directory themselves, and
+ * only when they need it (the managed cf install, the default snapshot path),
+ * so malformed values cannot block offline commands such as `inspect`.
+ */
+export function createLocalCommandConfig(timeoutMs) {
+    const timeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (!timeoutSchema.safeParse(timeout).success) {
+        throw new Error('Request timeout must be an integer between 1 and 2147483647 milliseconds.');
+    }
+    return {
+        publicBaseUrl: DEFAULT_PUBLIC_BASE_URL,
+        baseUrl: DEFAULT_PUBLIC_BASE_URL,
+        oneBaseUrl: DEFAULT_ONE_BASE_URL,
+        clientId: DEFAULT_CLIENT_ID,
+        // Unused by local commands; never read from the environment.
+        configDir: join(homedir(), '.config', 'vigilbase'),
+        userAgent: `@vigilbase/cli/${CLI_VERSION} (+https://vigilbase.com; node/${process.version})`,
+        timeoutMs: timeout,
+    };
+}
 /** Back-compat helper used by older call sites / tests. */
 export function resolveBaseUrl(explicit) {
     return resolvePublicBaseUrl(explicit);
 }
-//# sourceMappingURL=config.js.map