@vigilbase/cli 0.2.0 → 0.2.1

package/dist/commands/account.js

@@ -184,4 +184,3 @@ export const handleAccount = async (ctx) => {
     }
     throw new Error('Usage: vigilbase account [services|org|endpoints|sessions|invites|billing] [--json]');
 };
-//# sourceMappingURL=account.js.map

package/dist/commands/auth.d.ts

@@ -3,4 +3,3 @@ export declare function readTokenFromStdin(input?: NodeJS.ReadableStream): Promi
 export declare const handleLogin: CommandHandler;
 export declare const handleLogout: CommandHandler;
 export declare const handleWhoami: CommandHandler;
-//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.js

@@ -1,6 +1,7 @@
 import { readIdentityTokenMetadata } from '../auth/token-metadata.js';
 import { discoverAuthProvider } from '../auth/provider.js';
-import { revokeSavedCredentials, withCredentialsLock } from '../auth/refresh.js';
+import { revokeIdentityCredentials, revokeIdentityGrant, revokeSavedCredentials, withCredentialsLock } from '../auth/refresh.js';
+import { checkCredentialsLocation, clearIdentityCredentials, clearOneCredentials, hasIgnoredIdentityCredentials, readReplacedIdentityGrant, readStoredCredentials } from '../auth/store.js';
 import { getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from '../auth/index.js';
 import { VigilbaseOneClient, ONE_AUTH_REQUIRED_TOOLS } from '../lib/one-client.js';
 import { VigilbaseApiError } from '../lib/client.js';
@@ -22,6 +23,30 @@ export async function readTokenFromStdin(input = process.stdin) {
         throw new Error('Token input must contain exactly one nonempty token.');
     return token;
 }
+/**
+ * Revoke the Identity grant a new login replaces, before the new grant exists. Identity treats a revoked refresh
+ * token presented again as reuse and ends every CLI grant of the user, so revoking after the new grant was issued
+ * could end it too. The lock is held from the read to the removal of the old file, so no concurrent command can
+ * refresh with the token in between, and no later command presents it again.
+ */
+async function retirePreviousIdentityGrant(ctx) {
+    await withCredentialsLock(ctx.config, async () => {
+        const previous = await readReplacedIdentityGrant(ctx.config);
+        // After a refresh with an uncertain result the token may be rotated already; presenting it trips the same check.
+        if (!previous || previous.refreshPending)
+            return;
+        try {
+            await revokeIdentityGrant(ctx.config, previous);
+        }
+        catch {
+            ctx.writer.stderr("Warning: Couldn't revoke your previous sign-in; it will expire on its own.");
+            return;
+        }
+        // The grant came from identity-credentials.json, or from a CLI 0.2.0 credentials.json when that file is absent.
+        const { identity } = await readStoredCredentials(ctx.config, () => { });
+        await (identity ? clearIdentityCredentials(ctx.config) : clearOneCredentials(ctx.config));
+    }, true);
+}
 export const handleLogin = async (ctx) => {
     if (ctx.rest.length)
         throw new Error('Usage: vigilbase login [--token-stdin | --token <bearer>] [--no-open]');
@@ -29,6 +54,9 @@ export const handleLogin = async (ctx) => {
     if (ctx.loginHandler) {
         return ctx.loginHandler(ctx.config);
     }
+    // Fail on Windows or an unsafe credentials directory or file before validating a token or starting device
+    // authorization: once a device grant is approved, a failed save would leave it unsaved and unrevoked.
+    await checkCredentialsLocation(ctx.config);
     if (ctx.values.isTokenStdin && (ctx.values.token !== undefined || ctx.env.VIGILBASE_ONE_TOKEN !== undefined)) {
         throw new Error('Use --token-stdin without --token or VIGILBASE_ONE_TOKEN.');
     }
@@ -50,15 +78,19 @@ export const handleLogin = async (ctx) => {
             email: session.user.email ?? undefined,
             name: session.user.name ?? undefined,
         };
-        await withCredentialsLock(ctx.config, () => writeOneCredentials(ctx.config, {
-            accessToken: explicitToken,
-            tokenType: 'Bearer',
-            expiresAt: typeof session.session?.expiresAt === 'string'
-                ? session.session.expiresAt
-                : undefined,
-            user,
-            obtainedAt: new Date().toISOString(),
-        }), true);
+        await withCredentialsLock(ctx.config, async () => {
+            // Identity credentials win when tokens are read, so revoke them before saving this session.
+            await revokeIdentityCredentials(ctx.config);
+            await writeOneCredentials(ctx.config, {
+                accessToken: explicitToken,
+                tokenType: 'Bearer',
+                expiresAt: typeof session.session?.expiresAt === 'string'
+                    ? session.session.expiresAt
+                    : undefined,
+                user,
+                obtainedAt: new Date().toISOString(),
+            });
+        }, true);
         if (ctx.mode === 'json') {
             outputJson(ctx, {
                 success: true,
@@ -76,6 +108,8 @@ export const handleLogin = async (ctx) => {
     const preferNoOpen = Boolean(ctx.values.isNoOpen) || isHeadlessEnvironment(ctx.env);
     ctx.writer.stderr(`login  ${ctx.config.oneBaseUrl}`);
     ctx.config.authProvider = await discoverAuthProvider(ctx.config);
+    if (ctx.config.authProvider)
+        await retirePreviousIdentityGrant(ctx);
     const device = await withSpinner(ctx, 'Requesting device code', () => requestDeviceCode(ctx.config));
     const verifyUrl = resolveDeviceVerificationUrl(ctx.config.authProvider?.issuer ?? ctx.config.oneBaseUrl, device);
     const prettyCode = formatUserCode(device.user_code);
@@ -131,15 +165,20 @@ export const handleLogin = async (ctx) => {
     if (ctx.config.authProvider && (!token.refresh_token || !expiresAt || !token.expires_in || token.expires_in > 300))
         throw new Error('Identity returned an invalid token grant.');
     const identityMetadata = ctx.config.authProvider ? readIdentityTokenMetadata(token.access_token, { issuer: ctx.config.authProvider.issuer, clientId: ctx.config.clientId, resource: ctx.config.authProvider.resource }) : undefined;
-    await withCredentialsLock(ctx.config, () => writeOneCredentials(ctx.config, {
-        ...(ctx.config.authProvider ? { issuer: ctx.config.authProvider.issuer, clientId: ctx.config.clientId, resource: ctx.config.authProvider.resource, refreshToken: token.refresh_token, orgId: identityMetadata?.organizationId } : {}),
-        accessToken: token.access_token,
-        tokenType: token.token_type,
-        scope: token.scope,
-        expiresAt,
-        user,
-        obtainedAt: new Date().toISOString(),
-    }), true);
+    await withCredentialsLock(ctx.config, async () => {
+        // A legacy session is saved in credentials.json, which saved Identity credentials would override.
+        if (!ctx.config.authProvider)
+            await revokeIdentityCredentials(ctx.config);
+        await writeOneCredentials(ctx.config, {
+            ...(ctx.config.authProvider ? { issuer: ctx.config.authProvider.issuer, clientId: ctx.config.clientId, resource: ctx.config.authProvider.resource, refreshToken: token.refresh_token, orgId: identityMetadata?.organizationId } : {}),
+            accessToken: token.access_token,
+            tokenType: token.token_type,
+            scope: token.scope,
+            expiresAt,
+            user,
+            obtainedAt: new Date().toISOString(),
+        });
+    }, true);
     if (ctx.mode === 'json') {
         outputJson(ctx, {
             success: true,
@@ -160,7 +199,10 @@ export const handleLogout = async (ctx) => {
     if (ctx.rest.length)
         throw new Error('Usage: vigilbase logout');
     assertCommandFlags(ctx, []);
-    const cleared = await revokeSavedCredentials(ctx.config);
+    const cleared = await revokeSavedCredentials(ctx.config, (warning) => {
+        if (ctx.mode !== 'json')
+            ctx.writer.stderr(`Warning: ${warning}`);
+    });
     if (ctx.mode === 'json') {
         outputJson(ctx, { success: true, cleared });
     }
@@ -177,6 +219,7 @@ export const handleWhoami = async (ctx) => {
         throw new Error('Usage: vigilbase whoami');
     assertCommandFlags(ctx, []);
     const credentials = await readCredentials(ctx.config);
+    const legacyIdentityFileIgnored = await hasIgnoredIdentityCredentials(ctx.config);
     const accessToken = await getOneAccessToken(ctx.config);
     let liveUser = null;
     if (accessToken) {
@@ -211,7 +254,10 @@ export const handleWhoami = async (ctx) => {
         scope: signedIn ? credentials.one?.scope ?? null : null,
         obtainedAt: signedIn ? credentials.one?.obtainedAt ?? null : null,
         authRequiredTools: signedIn ? [...ONE_AUTH_REQUIRED_TOOLS] : [],
+        legacyIdentityFileIgnored,
     };
+    // CLI 0.2.0 can save a second Identity grant in credentials.json; logout revokes it.
+    const legacyNote = 'Note: found a credentials file from CLI 0.2.0. `vigilbase logout` will revoke and remove it.';
     if (ctx.mode === 'json') {
         outputJson(ctx, payload);
     }
@@ -219,6 +265,7 @@ export const handleWhoami = async (ctx) => {
         outputLines(ctx, [
             'Not signed in. Public tools still work.',
             'Run `vigilbase login` to unlock auth-required tools (website-security, react2shell, fortibleed-check).',
+            ...(legacyIdentityFileIgnored ? [legacyNote] : []),
         ]);
     }
     else {
@@ -229,8 +276,9 @@ export const handleWhoami = async (ctx) => {
             lines.push(`Expires: ${credentials.one.expiresAt}`);
         }
         lines.push(`Auth-required tools: ${ONE_AUTH_REQUIRED_TOOLS.join(', ')}`);
+        if (legacyIdentityFileIgnored)
+            lines.push(legacyNote);
         outputLines(ctx, lines);
     }
     return ok();
 };
-//# sourceMappingURL=auth.js.map

package/dist/commands/billing.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleBilling: CommandHandler;
-//# sourceMappingURL=billing.d.ts.map

package/dist/commands/billing.js

@@ -48,4 +48,3 @@ export const handleBilling = async (ctx) => {
     }
     throw new Error('Usage: vigilbase billing [summary|portal] [--json] [--no-open]');
 };
-//# sourceMappingURL=billing.js.map

package/dist/commands/cloudflare.d.ts

@@ -1,4 +1,3 @@
 import { type CommandHandler } from './helpers.js';
-export declare const CLOUDFLARE_HELP = "Usage: vigilbase cf <command> [options]\nAlias: vigilbase cloudflare\n\nInventory and workspace:\n  zones                         List zones (default); --customer-id, --account-id, --zone-id\n  zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id\n  accounts                     List accessible accounts; --customer-id, --account-id\n  account <account-id>          Stored account detail; --customer-id\n  workspace [section]          Workspace bootstrap or section; --customer-id, --account-id, --zone-id\n    Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings\n\nZone reads (optional --customer-id; IDs can use --zone-id):\n  dns <zone-id>                 DNS records, TTL and proxy state\n  waf <zone-id>                 WAF rules, expressions, analytics and suggestions\n  speed-settings <zone-id>      Performance settings (internal users only)\n\nAccount reads (optional --customer-id; IDs can use --account-id):\n  audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)\n  zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics\n  developer-platform <account-id>  Workers, Workers analytics and Pages\n  magic-transit <account-id>    Prefixes, routes and traffic analytics\n    Zero Trust, Developer Platform and Magic Transit require deployment-read permission.\n\nAnalytics and checkups:\n  analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]\n    Default 7 days; live zone analytics uses the most recent 23 hours.\n  checkup [status]             Latest completed checkup; --customer-id, --account-id\n  checkup start                Start and persist a scan; --customer-id, --account-id\n  checkup progress <run-uuid>   Read saved progress once\n  checkup result <run-uuid>     Read the stored Cloudflare checkup result\n    checkups aliases checkup; list/show alias status; run aliases start.\n\nCommon options: --json, --one-url <origin>, --timeout <milliseconds>, --help\nCustomer IDs are UUIDs; account and zone IDs are 32 hexadecimal characters.\nOne login, tenant bindings and permissions apply to every command.\nCheckup start creates a scan run. These commands do not edit provider configuration.\nSee CLOUDFLARE.md for full grammar, API mapping, data limits and examples.";
+export declare const CLOUDFLARE_HELP = "Usage: vigilbase cf <command> [options]\nAlias: vigilbase cloudflare\n\nInventory and workspace:\n  zones                         List zones (default); --customer-id, --account-id, --zone-id\n  zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id\n  accounts                      List accessible accounts; --customer-id, --account-id\n  account <account-id>          Stored account detail; --customer-id\n  workspace [section]           Workspace bootstrap or section; --customer-id, --account-id, --zone-id\n    Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings\n\nZone reads (optional --customer-id; IDs can use --zone-id):\n  dns <zone-id>                 DNS records, TTL and proxy state\n  waf <zone-id>                 WAF rules, expressions, analytics and suggestions\n  speed-settings <zone-id>      Performance settings (internal users only)\n\nAccount reads (optional --customer-id; IDs can use --account-id):\n  audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)\n  zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics\n  developer-platform <account-id>\n                                Workers, Workers analytics and Pages\n  magic-transit <account-id>    Prefixes, routes and traffic analytics\n    Zero Trust, Developer Platform and Magic Transit require deployment-read permission.\n\nAnalytics and checkups:\n  analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]\n    Default 7 days; live zone analytics uses the most recent 23 hours.\n  checkup [status]              Latest completed checkup; --customer-id, --account-id\n  checkup start                 Start and persist a scan; --customer-id, --account-id\n  checkup progress <run-uuid>   Read saved progress once\n  checkup result <run-uuid>     Read the stored Cloudflare checkup result\n    checkups aliases checkup; list/show alias status; run aliases start.\n\nCommon options: --json, --one-url <origin>, --timeout <milliseconds>, --help\nCustomer IDs are UUIDs; account and zone IDs are 32 hexadecimal characters.\nOne login, tenant bindings and permissions apply to every command.\nCheckup start creates a scan run. These commands do not edit provider configuration.\nSee CLOUDFLARE.md for full grammar, API mapping, data limits and examples.";
 export declare const handleCloudflare: CommandHandler;
-//# sourceMappingURL=cloudflare.d.ts.map

package/dist/commands/cloudflare.js

@@ -9,9 +9,9 @@ Alias: vigilbase cloudflare
 Inventory and workspace:
   zones                         List zones (default); --customer-id, --account-id, --zone-id
   zone <zone-id>                Zone detail; --customer-id selects live details, optional --account-id
-  accounts                     List accessible accounts; --customer-id, --account-id
+  accounts                      List accessible accounts; --customer-id, --account-id
   account <account-id>          Stored account detail; --customer-id
-  workspace [section]          Workspace bootstrap or section; --customer-id, --account-id, --zone-id
+  workspace [section]           Workspace bootstrap or section; --customer-id, --account-id, --zone-id
     Sections: overview, reports, zones, rule-analyzer, accounts, checkups, settings
 
 Zone reads (optional --customer-id; IDs can use --zone-id):
@@ -22,15 +22,16 @@ Zone reads (optional --customer-id; IDs can use --zone-id):
 Account reads (optional --customer-id; IDs can use --account-id):
   audit-logs <account-id>       Latest provider audit events (up to 100; service-read permission)
   zero-trust <account-id>       Users, Access applications, tunnels and authentication analytics
-  developer-platform <account-id>  Workers, Workers analytics and Pages
+  developer-platform <account-id>
+                                Workers, Workers analytics and Pages
   magic-transit <account-id>    Prefixes, routes and traffic analytics
     Zero Trust, Developer Platform and Magic Transit require deployment-read permission.
 
 Analytics and checkups:
   analytics --customer-id <uuid> [--account-id <id> | --zone-id <id>] [--days 1..30]
     Default 7 days; live zone analytics uses the most recent 23 hours.
-  checkup [status]             Latest completed checkup; --customer-id, --account-id
-  checkup start                Start and persist a scan; --customer-id, --account-id
+  checkup [status]              Latest completed checkup; --customer-id, --account-id
+  checkup start                 Start and persist a scan; --customer-id, --account-id
   checkup progress <run-uuid>   Read saved progress once
   checkup result <run-uuid>     Read the stored Cloudflare checkup result
     checkups aliases checkup; list/show alias status; run aliases start.
@@ -338,4 +339,3 @@ export const handleCloudflare = async (ctx) => {
             fields(ctx, report);
     });
 };
-//# sourceMappingURL=cloudflare.js.map

package/dist/commands/helpers.d.ts

@@ -96,4 +96,3 @@ export declare function requireOneClient(ctx: CommandContext): Promise<Vigilbase
 export declare function withSpinner<T>(ctx: CommandContext, label: string, work: () => Promise<T>): Promise<T>;
 export declare function ok(): ExitCode;
 export { EXIT };
-//# sourceMappingURL=helpers.d.ts.map

package/dist/commands/helpers.js

@@ -45,4 +45,3 @@ export function ok() {
     return EXIT.OK;
 }
 export { EXIT };
-//# sourceMappingURL=helpers.js.map

package/dist/commands/index.d.ts

@@ -8,4 +8,3 @@ import type { CommandHandler } from './helpers.js';
  */
 export declare const COMMAND_HANDLERS: Record<string, CommandHandler>;
 export declare function getCommandHandler(command: string): CommandHandler | null;
-//# sourceMappingURL=index.d.ts.map

package/dist/commands/index.js

@@ -46,4 +46,3 @@ export const COMMAND_HANDLERS = {
 export function getCommandHandler(command) {
     return COMMAND_HANDLERS[command] ?? null;
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/legacy-validation.d.ts

@@ -18,4 +18,3 @@ export declare const invitationSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export declare const toolNameSchema: z.ZodString;
-//# sourceMappingURL=legacy-validation.d.ts.map

package/dist/commands/legacy-validation.js

@@ -17,4 +17,3 @@ export const invitationSchema = z.object({
     role: z.enum(['admin', 'member', 'readonly', 'partner_owner', 'partner_sales', 'partner_operations', 'partner_finance', 'partner_readonly', 'billing_only', 'sales_only']).default('member'),
 });
 export const toolNameSchema = z.string().trim().min(1).max(128).regex(/^[a-z0-9-]+$/, 'Tool names must contain lowercase letters, digits, or hyphens.');
-//# sourceMappingURL=legacy-validation.js.map

package/dist/commands/local.d.ts

@@ -27,4 +27,9 @@ export declare function displayPath(path: string, env?: NodeJS.ProcessEnv, platf
  * `-2`, `-3`, … only when a run in the same second already used the name.
  */
 export declare function defaultSnapshotName(accountId: string, at: Date, attempt?: number): string;
-//# sourceMappingURL=local.d.ts.map
+/**
+ * `submit` for a saved file. A loopback origin is named with `--base-url`, so a
+ * development run never suggests an upload to production; production is the
+ * CLI's default and is not named.
+ */
+export declare function submitCommand(path: string, origin: string): string;

package/dist/commands/local.js

@@ -33,7 +33,7 @@ import { buildSnapshot, collectAccount, estimateRequests, listAccounts } from '.
 import { accountName, countEntries, countEntriesByKind, dataCategories, loadSnapshotFile, writeSnapshotFile, zoneCount, } from '../local/cloudflare-checkup/snapshot-file.js';
 import { confirmDefaultYes, confirmUpload, hasInteractiveInput, promptLine } from '../local/cloudflare-checkup/prompts.js';
 import { SAME_ADDRESS_WAIT, emailLocale, parseEmailFlag, verifyEmail } from '../local/cloudflare-checkup/email-verification.js';
-import { SubmitClient, VerificationClient, assertSessionAccepts, displayRequester, resolveSubmitOrigin, } from '../local/cloudflare-checkup/submit-client.js';
+import { SubmitClient, VerificationClient, assertServerAccepts, displayRequester, isLoopbackOrigin, resolveSubmitOrigin, } from '../local/cloudflare-checkup/submit-client.js';
 import { displayText, formatBytes, formatClock, formatDuration, maskId, readsSummary, shortSha, startCountsProgress } from '../local/cloudflare-checkup/output.js';
 import { CheckupTui } from '../local/cloudflare-checkup/terminal-ui.js';
 import { EXIT, assertCommandFlags, ok, outputJson } from './helpers.js';
@@ -1159,10 +1159,23 @@ function clientOptions(ctx, origin) {
         ...(ctx.values.timeout !== undefined ? { timeoutMs: ctx.config.timeoutMs } : {}),
     };
 }
+/**
+ * Before the email is asked for (or `--email` is used): vigilbase.com says
+ * whether local checkups are on and which CLI and snapshot schema it accepts,
+ * so a switched-off local mode (LOCAL_MODE_DISABLED) or an old CLI
+ * (CLI_UPGRADE_REQUIRED) never costs an emailed code. Without a usable answer
+ * the run goes on, and the session check after the email decides as before.
+ */
+async function checkAvailability(ctx, origin, schemaVersion) {
+    const client = new VerificationClient(clientOptions(ctx, origin));
+    const availability = await busy(ctx, 'Checking vigilbase.com', () => client.availability());
+    if (availability)
+        assertServerAccepts(availability, CLI_VERSION, schemaVersion);
+}
 /**
  * The email verification (prompts on stderr, answers from piped stdin
- * without a terminal), then `✓ Verified j***@acme.com`. Nothing is sent
- * before an address is entered, and cf is not touched before it is verified.
+ * without a terminal), then `✓ Verified j***@acme.com`. No address is sent
+ * before one is entered, and cf is not touched before it is verified.
  */
 async function verifyRequester(ctx, options, origin) {
     const verified = await verifyEmail({
@@ -1230,16 +1243,25 @@ class CheckupSession {
 /** Failures after the snapshot is saved that a later `submit <file>` can fix without collecting again. */
 const UPLOAD_LATER_CODES = new Set(['SESSION_INVALID', 'SESSION_EXPIRED', 'SESSION_CLOSED', 'VERIFICATION_EXPIRED', 'VERIFICATION_INVALID',
     'SUBMIT_FAILED', 'VIGILBASE_RATE_LIMITED', 'VIGILBASE_CHALLENGED', 'LOCAL_MODE_DISABLED']);
+/**
+ * `submit` for a saved file. A loopback origin is named with `--base-url`, so a
+ * development run never suggests an upload to production; production is the
+ * CLI's default and is not named.
+ */
+export function submitCommand(path, origin) {
+    const baseUrl = isLoopbackOrigin(origin) ? ` --base-url ${shellArg(origin)}` : '';
+    return `${NPX_COMMAND} cloudflare-checkup submit ${shellArg(path)}${baseUrl}`;
+}
 /**
  * Right before such an error is reported (stderr, both modes): the `submit`
  * command for the saved file. A line of its own, because hints are capped at
  * 300 characters and a path has no fixed length; in the terminal UI, the
  * command has a line of its own too, never wrapped, so it can be copied.
  */
-function noteSavedSnapshot(ctx, error, path) {
+function noteSavedSnapshot(ctx, error, path, origin) {
     if (!(error instanceof LocalCheckupError) || !UPLOAD_LATER_CODES.has(error.code))
         return;
-    const submit = `${NPX_COMMAND} cloudflare-checkup submit ${shellArg(path)}`;
+    const submit = submitCommand(path, origin);
     if (ctx.tui)
         ctx.tui.uploadLater(submit);
     else
@@ -1247,7 +1269,7 @@ function noteSavedSnapshot(ctx, error, path) {
 }
 /** Session checks that need no upload: CLI version, single use, and the bound account. */
 function assertSessionUsable(session, accountId) {
-    assertSessionAccepts(session, CLI_VERSION, SNAPSHOT_SCHEMA_VERSION);
+    assertServerAccepts(session, CLI_VERSION, SNAPSHOT_SCHEMA_VERSION);
     if (session.state === 'completed')
         throw new LocalCheckupError('SESSION_USED', 'This checkup already has results, so it cannot accept a new snapshot.');
     // A checkup the email verification just started is never processing; this guards any other state.
@@ -1288,7 +1310,8 @@ async function runOneCommand(ctx, options) {
     // A bad --out never costs an emailed code (collectSnapshot checks it again).
     if (options.out !== undefined)
         await assertOutWritable(options.out, Boolean(ctx.values.isOverwrite));
-    // 1-3. The email is verified, and the checkup it started is checked, before cf is touched.
+    // 1-3. Availability, then the email, then the checkup it started are checked before cf is touched.
+    await checkAvailability(ctx, origin, SNAPSHOT_SCHEMA_VERSION);
     const checkup = new CheckupSession(ctx, origin, await verifyRequester(ctx, options, origin));
     const early = await busy(ctx, 'Checking the checkup', () => checkup.getSession());
     assertSessionUsable(early, options.accountId);
@@ -1312,7 +1335,7 @@ async function runOneCommand(ctx, options) {
         result = await uploadLoaded(ctx, { checkup, session, origin, loaded });
     }
     catch (error) {
-        noteSavedSnapshot(ctx, error, outcome.path);
+        noteSavedSnapshot(ctx, error, outcome.path, origin);
         throw error;
     }
     if (ctx.mode === 'json') {
@@ -1410,7 +1433,8 @@ async function submitFile(ctx, options) {
         ctx.writer.stderr(head);
     else
         ctx.writer.stdout(head);
-    // The file is checked before the email is verified, so a bad file never sends a code.
+    // The file, then vigilbase.com's availability, are checked before the email is verified, so neither costs a code.
+    await checkAvailability(ctx, origin, loaded.snapshot.schemaVersion);
     const checkup = new CheckupSession(ctx, origin, await verifyRequester(ctx, options, origin));
     const session = await busy(ctx, 'Checking the checkup', () => checkup.getSession());
     const result = await uploadLoaded(ctx, { checkup, session, origin, loaded });
@@ -1455,7 +1479,7 @@ async function uploadLoaded(ctx, input) {
     const { checkup, session, origin, loaded } = input;
     const { snapshot } = loaded;
     assertFresh(snapshot);
-    assertSessionAccepts(session, CLI_VERSION, snapshot.schemaVersion);
+    assertServerAccepts(session, CLI_VERSION, snapshot.schemaVersion);
     if (session.accountId !== null && session.accountId !== snapshot.accountId) {
         throw new LocalCheckupError('ACCOUNT_MISMATCH', `This checkup is bound to Cloudflare account ${maskId(session.accountId)}, but the snapshot is for ${maskId(snapshot.accountId)}. Nothing was uploaded.`);
     }
@@ -1517,4 +1541,3 @@ async function uploadLoaded(ctx, input) {
         ...(result.resultsUrl !== undefined ? { resultsUrl: result.resultsUrl } : {}),
     };
 }
-//# sourceMappingURL=local.js.map

package/dist/commands/one.d.ts

@@ -3,4 +3,3 @@ import { type CommandContext, type CommandHandler } from './helpers.js';
 export declare function buildOneOperation(ctx: CommandContext): OneOperation;
 export declare const handleOne: CommandHandler;
 export declare const ONE_HELP: Record<string, string>;
-//# sourceMappingURL=one.d.ts.map

package/dist/commands/one.js

@@ -153,7 +153,7 @@ export const handleOne = async (ctx) => {
 };
 export const ONE_HELP = {
     customers: `Usage: vigilbase customers <command> [--json]
-  list                              List visible customers (also the default)
+  list                               List visible customers (also the default)
   show <customer-id>                 Full customer details
   summary <customer-id>              Lightweight service/integration summary
   services <customer-id>             Service records
@@ -163,7 +163,7 @@ export const ONE_HELP = {
   watchdog-targets <customer-id>     Security/uptime targets
   watchdog-scans <customer-id>       --limit 1..100 --offset 0..1000000 --target-id UUID
   reports <customer-id>              Recon reports; --limit 1..100
-  report <customer-id> <report-id>    Recon report detail
+  report <customer-id> <report-id>   Recon report detail
   investigations <customer-id>       --limit 1..100 --cursor TEXT or --before ISO; --issue-id TEXT
   investigation <customer-id> <id>   --revision 1..2147483647
   contracts <customer-id>            --status draft|pending|active|expired|terminated
@@ -186,10 +186,10 @@ These commands read organization context; they do not switch the active organiza
   health                  Metrics backend and alerting readiness (also the default)
   probes                  Registered probe heartbeats (internal operators)
   probe-health            Live probe health, with database fallback
-  metrics <target-id>...   Metrics for 1..50 target UUIDs
-  targets <customer-id>    Customer's monitoring targets
-  status <customer-id>     Current status; --light skips latency/SSL provider reads
-  history <customer-id>    --range 24h|7d|30d --region CODE --target-id UUID
+  metrics <target-id>...  Metrics for 1..50 target UUIDs
+  targets <customer-id>   Customer's monitoring targets
+  status <customer-id>    Current status; --light skips latency/SSL provider reads
+  history <customer-id>   --range 24h|7d|30d --region CODE --target-id UUID
 All operations require read:monitoring and the API's tenant access checks.
 History defaults to 7d. Health metadata preserves unknown, partial, and unavailable states.`,
     support: `Usage: vigilbase support tickets [--all] [--limit 1..100] [--json]
@@ -197,4 +197,3 @@ Lists current organization's open tickets; --all includes closed tickets.
 The API defaults to 50 results. Requires support:access and a linked Pylon account.
 The response retains hasMore; the API does not expose cursor pagination.`,
 };
-//# sourceMappingURL=one.js.map

package/dist/commands/public-tools.d.ts

@@ -6,4 +6,3 @@ export declare const handleDescribe: CommandHandler;
 export declare const handleSkill: CommandHandler;
 export declare const handleBadge: CommandHandler;
 export declare const handleDoctor: CommandHandler;
-//# sourceMappingURL=public-tools.d.ts.map

package/dist/commands/public-tools.js

@@ -2,16 +2,38 @@ import { z } from 'zod';
 import { toolNameSchema, validateArguments } from './legacy-validation.js';
 import { NetworkError } from '../lib/network.js';
 import { VigilbaseApiError } from '../lib/client.js';
-import { getOneAccessToken, readCredentials } from '../auth/index.js';
+import { getOneAccessToken, getOptionalOneAccessToken, hasUsableSignIn, readCredentials } from '../auth/index.js';
+import { SignInUnsupportedError } from '../auth/store.js';
 import { formatExecuteResult, formatToolDescription, formatToolsList, } from '../lib/format.js';
 import { isOneAuthRequiredTool, isOneExecutableTool, ONE_AUTH_REQUIRED_TOOLS, resolveToolDefinition, VigilbaseOneClient, } from '../lib/one-client.js';
 import { EXIT, ok, outputJson, withSpinner, } from './helpers.js';
+const ONE_SIGN_IN_REQUIRED = 'This tool needs a Vigilbase One sign-in: run `vigilbase login`.';
+/**
+ * For --via one and auth-required tools only: any sign-in problem fails. Specific errors keep their
+ * message; those that don't already point to `vigilbase login` get it as their hint.
+ */
+async function requireOneSignIn(config) {
+    let accessToken;
+    try {
+        accessToken = await getOneAccessToken(config);
+    }
+    catch (error) {
+        // Windows cannot sign in at all, so pointing to login would mislead.
+        if (error instanceof Error && !(error instanceof SignInUnsupportedError) && !error.message.includes('`vigilbase login`')) {
+            Object.assign(error, { hint: ONE_SIGN_IN_REQUIRED });
+        }
+        throw error;
+    }
+    if (!accessToken)
+        throw new Error(ONE_SIGN_IN_REQUIRED);
+    return accessToken;
+}
 /** Public tools work without login. Auth-required tools need Vigilbase One. */
 export const handleList = async (ctx) => {
     validateArguments(ctx, 0);
     const catalog = await withSpinner(ctx, 'Loading tool catalog', () => ctx.publicClient.listTools());
-    const accessToken = await getOneAccessToken(ctx.config);
-    const authenticated = Boolean(accessToken);
+    // Offline: list never refreshes, so it cannot leave a refresh half-done.
+    const authenticated = await hasUsableSignIn(ctx.config, ctx.writer.stderr);
     if (ctx.mode === 'json') {
         outputJson(ctx, {
             ...catalog,
@@ -65,15 +87,13 @@ export const handleRun = async (ctx) => {
     if (via && via !== 'one' && via !== 'public') {
         throw new Error('--via must be one of: public, one');
     }
-    const accessToken = await getOneAccessToken(ctx.config);
     const forcePublic = Boolean(ctx.values.isPublic) || via === 'public';
     const forceOne = via === 'one';
     // Public tools stay free unless forced onto One. Auth-required tools need login.
+    // The public route is anonymous and never reads the credential store.
     const useOne = !forcePublic && (forceOne || isOneAuthRequiredTool(toolName));
     if (useOne) {
-        if (!accessToken) {
-            throw new Error(`Tool "${toolName}" requires Vigilbase One auth. Run \`vigilbase login\` first.`);
-        }
+        const accessToken = await requireOneSignIn(ctx.config);
         if (!isOneExecutableTool(toolName)) {
             throw new Error(`Tool "${toolName}" is not executable via Vigilbase One CLI yet.`);
         }
@@ -163,15 +183,21 @@ export const handleBadge = async (ctx) => {
 export const handleDoctor = async (ctx) => {
     validateArguments(ctx, 0);
     let oneCheckUrl = `${ctx.config.oneBaseUrl}/api/auth/get-session`;
-    const [publicResult, oneResult] = await withSpinner(ctx, 'Checking public API and Vigilbase One', () => Promise.allSettled([
+    // A sign-in problem fails its own check, and One connectivity is then checked anonymously.
+    // The saved sign-in may refresh, with the configured timeout like any One command.
+    const signIn = getOptionalOneAccessToken(ctx.config);
+    const [publicResult, oneResult, signInResult] = await withSpinner(ctx, 'Checking public API and Vigilbase One', () => Promise.allSettled([
         ctx.publicClient.listTools(),
         (async () => {
-            const accessToken = await getOneAccessToken(ctx.config);
-            const saved = await readCredentials(ctx.config);
-            if (accessToken && saved.version === 2)
-                oneCheckUrl = `${saved.one.issuer}/api/auth/oauth2/userinfo`;
+            const { accessToken } = await signIn;
+            const saved = accessToken ? await readCredentials(ctx.config) : null;
+            // An Identity session is checked at the userinfo endpoint its issuer's discovery names.
+            if (saved?.version === 2)
+                oneCheckUrl = `${saved.one.issuer}/.well-known/openid-configuration`;
+            // Signed out, the check stays anonymous and never reads the credential store.
+            const client = new VigilbaseOneClient(ctx.config, accessToken ?? '', Boolean(accessToken));
             try {
-                const session = await new VigilbaseOneClient(ctx.config, accessToken ?? '', true).getSession();
+                const session = await client.getSession();
                 return { authenticated: Boolean(session.user?.id) };
             }
             catch (error) {
@@ -181,15 +207,23 @@ export const handleDoctor = async (ctx) => {
                 }
                 throw error;
             }
+            finally {
+                if (client.userinfoEndpoint)
+                    oneCheckUrl = client.userinfoEndpoint;
+            }
         })(),
+        signIn.then(({ problem }) => {
+            if (problem)
+                throw new Error(problem);
+        }),
     ]));
     const checkResult = (result, url) => {
         if (result.status === 'fulfilled')
-            return { ok: true, url };
+            return { ok: true, ...(url ? { url } : {}) };
         const error = result.reason;
         return {
             ok: false,
-            url,
+            ...(url ? { url } : {}),
             error: error instanceof Error ? error.message : 'Connectivity check failed.',
             ...(error instanceof VigilbaseApiError || error instanceof NetworkError ? { status: error.status } : {}),
             ...(error instanceof NetworkError ? { code: error.code } : {}),
@@ -198,8 +232,9 @@ export const handleDoctor = async (ctx) => {
     const checks = {
         publicApi: checkResult(publicResult, `${ctx.config.publicBaseUrl}/api/agent/tools`),
         one: checkResult(oneResult, oneCheckUrl),
+        signIn: checkResult(signInResult),
     };
-    const isOk = checks.publicApi.ok && checks.one.ok;
+    const isOk = checks.publicApi.ok && checks.one.ok && checks.signIn.ok;
     const firstFailure = Object.values(checks).find((check) => !check.ok);
     const catalog = publicResult.status === 'fulfilled' ? publicResult.value : null;
     const payload = {
@@ -223,10 +258,9 @@ export const handleDoctor = async (ctx) => {
     }
     else {
         for (const [label, check] of Object.entries(checks)) {
-            ctx.writer.stdout(`${check.ok ? 'ok' : 'fail'}  ${label}  ${check.url}${check.error ? ` — ${check.error}` : ''}`);
+            ctx.writer.stdout(`${check.ok ? 'ok' : 'fail'}  ${label}${check.url ? `  ${check.url}` : ''}${check.error ? ` — ${check.error}` : ''}`);
         }
         ctx.writer.stdout(`auth=${payload.authenticated ? 'in' : 'out'}  tools=${payload.tools.join(',') || 'unavailable'}`);
     }
     return isOk ? ok() : EXIT.ERROR;
 };
-//# sourceMappingURL=public-tools.js.map

package/dist/commands/runs.d.ts

@@ -1,3 +1,2 @@
 import { type CommandHandler } from './helpers.js';
 export declare const handleRuns: CommandHandler;
-//# sourceMappingURL=runs.d.ts.map

package/dist/commands/runs.js

@@ -73,4 +73,3 @@ export const handleRuns = async (ctx) => {
     }
     throw new Error('Usage: vigilbase runs [list|get <id>] [--tool …] [--limit …] [--json]');
 };
-//# sourceMappingURL=runs.js.map

package/dist/commands/security.d.ts

@@ -2,5 +2,4 @@ import { type SecurityRequest } from '../lib/security-client.js';
 import { type CommandContext, type CommandHandler } from './helpers.js';
 export declare function buildSecurityRequest(ctx: CommandContext): SecurityRequest;
 export declare const handleSecurity: CommandHandler;
-export declare const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                       --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>                --limit --before\n  incidents fabric <id>                  --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>         --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>                --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";
-//# sourceMappingURL=security.d.ts.map
+export declare const SECURITY_HELP = "vigilbase security \u2014 managed security in Vigilbase One\n\n  [overview]\n  incidents [list]                      --status --severity --attack-category\n                                        --order-by --order-direction --limit --offset\n  incidents show <id>\n  incidents timeline <id>               --limit --before\n  incidents fabric <id>                 --dataset --min-weight --limit\n  incidents share-links <id>\n  incidents update <id> <status>        --confirm [--note]\n  alerts [list]                         --limit --asset-id --start\n  alerts show <id>\n  logs                                  --limit --asset-id --provider --dataset --search\n                                        --start --end --sort --frs-min --cursor\n  audit                                 --limit --cursor --action-prefix --outcome\n  assets\n  assets <allowlist|blocklist|remediation|autonomy|datasets> <asset-id>\n  assets graph <asset-id>               --dataset --hours --min-weight --limit\n  fabric default-asset\n  detections                            --asset-id\n  providers\n  connections [list]\n  connections show <id>\n  connections <available-assets|remediation> <id>\n  connections <logpush-status|worker-stats> <connection-id> <job-id>\n  analytics [overview]                  --metrics + time-window flags\n  analytics <security-analysis|bot-activity|top-attacker-ips|bot-asns|dns-security|page-shield>\n  analytics provider-events             --provider --dataset --start --end\n                                        [--asset-id --search --limit]\n  zero-trust <device-health|app-tests|access|sessions|device-posture>\n  zero-trust gateway <dns|http|network>\n  cloudflare-account [inventory]\n  cloudflare-account <audit|ingestion|posture>\n  notifications [list]                  --limit\n  notifications <settings|preferences|slack-channels>\n  reports [list]                        --limit --offset\n  reports show <id>\n  reports settings\n  intel quota\n  intel <ip|asn|cidr|ja3|ja4> <query>\n  settings <lifecycle-emails|broadcast-emails|applications>\n\nTime-window flags: --hours (1\u2013720, default 24) or --start/--end ISO timestamps;\noptional --asset-id. Apply to analytics (except provider-events), zero-trust,\nand cloudflare-account audit/ingestion/posture. Inventory has no window flags.\nLimits: list incidents/reports/audit 1\u2013100 (default 50); alerts/notifications\n1\u2013100 (default 100); timeline 1\u2013200 (default 100); logs 1\u20131000 (default 100);\nprovider-events 1\u2013500 (default 200); graph 1\u20131000 (default 200).\nOffsets: 0\u20131000000. Graph min-weight: 1\u20131000000 (default 1).\nAll: --json, --timeout <ms>, --customer-id <One customer UUID> (internal View-as).\nAll operations read data except confirmed incident status updates.\nUpdate status: acknowledged, mitigating, resolved, false_positive.\nSee SECURITY.md for every endpoint, supported value, alias, and pagination contract.\n";