@vigilbase/cli 0.2.4 → 0.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CLOUDFLARE.md +1 -1
  2. package/COMMANDS.md +5 -5
  3. package/LOCAL.md +2 -2
  4. package/ONE.md +2 -2
  5. package/README.md +6 -6
  6. package/dist/lib/one-error-hints.d.ts +1 -0
  7. package/dist/lib/one-error-hints.js +10 -0
  8. package/package.json +1 -1
package/CLOUDFLARE.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  `vigilbase cf` and `vigilbase cloudflare` use the authenticated Vigilbase One API. Run `vigilbase login` first (signing in isn't supported on Windows yet). Your organization, permissions, customer links, and allowed zones determine access. The CLI never requires a Cloudflare API key.
4
4
 
5
- `cf checkup` runs on One's servers. `cloudflare-checkup` (also `local cloudflare-checkup`) runs on your machine with Cloudflare's own `cf` CLI and needs no Vigilbase login: one command, `npx @vigilbase/cli cloudflare-checkup`, verifies your work email with a code, installs cf if needed, signs in read-only, collects and uploads after you confirm. It works while vigilbase.com has local checkups switched on; otherwise it says so before asking for your email and points you to the checkup in your browser at https://vigilbase.com/tools/cloudflare-checkup (see [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md)).
5
+ `cf checkup` runs on One's servers. `cloudflare-checkup` (also `local cloudflare-checkup`) runs on your machine with Cloudflare's own `cf` CLI and needs no Vigilbase login: one command, `npx @vigilbase/cli cloudflare-checkup`, verifies your work email with a code, installs cf if needed, signs in read-only, collects and uploads after you confirm. It works while vigilbase.com has local checkups switched on; otherwise it says so before asking for your email and points you to the checkup in your browser at https://vigilbase.com/tools/cloudflare-checkup (see [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/LOCAL.md)).
6
6
 
7
7
  Customer provider access requires an `active` or `trialing` Cloudflare service
8
8
  entitlement for the selected account. Historical/inactive rows and legacy account
package/COMMANDS.md CHANGED
@@ -12,11 +12,11 @@ case.
12
12
 
13
13
  | Area | Complete command and API reference |
14
14
  | --- | --- |
15
- | Cloudflare | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) |
16
- | Security | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) |
17
- | Customers, organizations, monitoring, support | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/ONE.md) |
18
- | Local Cloudflare Checkup (cf on your machine) | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) |
19
- | Sign-in, credentials, configuration, troubleshooting | [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md) |
15
+ | Cloudflare | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/CLOUDFLARE.md) |
16
+ | Security | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/SECURITY.md) |
17
+ | Customers, organizations, monitoring, support | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/ONE.md) |
18
+ | Local Cloudflare Checkup (cf on your machine) | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/LOCAL.md) |
19
+ | Sign-in, credentials, configuration, troubleshooting | [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/README.md) |
20
20
 
21
21
  The references list the supported operations, filters, response and pagination
22
22
  behaviour, API endpoints and access requirements of the CLI.
package/LOCAL.md CHANGED
@@ -15,7 +15,7 @@ before it asks for your email; when local mode is off it stops with
15
15
  your browser at <https://vigilbase.com/tools/cloudflare-checkup>.
16
16
 
17
17
  `vigilbase cf checkup` runs on Vigilbase One's servers with stored credentials
18
- (see [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md));
18
+ (see [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/CLOUDFLARE.md));
19
19
  `vigilbase cloudflare-checkup` runs on your machine and needs no Vigilbase
20
20
  login.
21
21
 
@@ -35,7 +35,7 @@ update the global install with `npm install -g @vigilbase/cli@latest`. With
35
35
  Yarn 4.15+ or pnpm 11+, `yarn dlx` and `pnpm dlx` run an older release for a
36
36
  day after each release, and pnpm 10.16+ with `minimumReleaseAge` set refuses
37
37
  the new version; use `npx` (see
38
- [Troubleshooting](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md#troubleshooting)).
38
+ [Troubleshooting](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/README.md#troubleshooting)).
39
39
 
40
40
  The command does everything, in this order, and stops at the first problem
41
41
  before any slower step:
package/ONE.md CHANGED
@@ -49,7 +49,7 @@ contract scope fails closed; no allowed subscriptions returns an empty list.
49
49
 
50
50
  Unspecified query parameters are omitted. API defaults: Watchdog scans limit 20/offset 0, Recon reports limit 12, investigations limit 50, invoices limit 50. For Watchdog scans, advance `--offset` using the response's `total`. For investigations, pass `data.nextCursor` back to `--cursor` (maximum 512 characters); `--before` must be an ISO timestamp with timezone and `--issue-id` is at most 256 characters. `--before` and `--cursor` are mutually exclusive. The API validates opaque cursors. Omitting `--revision` loads the latest investigation revision. Invoice responses preserve `has_more`, but this One endpoint has no cursor option; the CLI cannot fetch subsequent invoice pages beyond the requested limit.
51
51
 
52
- Customer discovery follows the API's internal, customer, and partner visibility. Detail/summary/contact/organization/Recon reads require customer read access; endpoints/services require service read access. Watchdog routes require monitoring/tool permissions as enforced by the API. Contracts and billing reads require their respective permissions. Linked project reads are restricted to internal operators with service read access. Vigil investigation reads require internal Vigil investigation permission and the Vigil UI feature to be enabled; disabled deployments return 404. Stripe resources are fetched by One from Stripe and are not persisted by the CLI.
52
+ Customer discovery follows the API's internal, customer, and partner visibility. Detail/summary/contact/organization/Recon reads require customer read access; endpoints/services require service read access. Watchdog routes require monitoring/tool permissions as enforced by the API. Contracts and billing reads require their respective permissions. Linked project reads are restricted to internal operators with service read access. Vigil investigation reads require internal Vigil investigation permission and the Vigil UI feature to be enabled. Signed-out callers get 401 and callers without that permission 404. While the feature is off, permitted staff get 501 `VIGIL_UI_DISABLED` for an existing customer (404 for an unknown one), which the CLI explains with a hint. Stripe resources are fetched by One from Stripe and are not persisted by the CLI.
53
53
 
54
54
  The service command uses the dashboard's `/service-records` API. `/customers/{id}/services` and `/customers/search` require a separate Vigil machine credential and are intentionally not exposed. The customer bootstrap `/customers/me` endpoint can provision a customer, so use existing `vigilbase account` to inspect the current customer's context. Generating Watchdog AI insights, re-running investigations, syncing providers, creating reports, and other effectful APIs are not invoked by these read commands.
55
55
 
@@ -95,4 +95,4 @@ vigilbase support tickets [--all] [--limit 1..100] [--customer-id <uuid>] [--jso
95
95
 
96
96
  ## Related commands and validation
97
97
 
98
- See [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md) for sign-in and configuration, [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/COMMANDS.md) for account, billing, public scanners, run history and Watchdog, [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) for `cf`/`cloudflare`, and [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) for security commands. The read operations above do not replace the existing explicitly confirmed write commands.
98
+ See [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/README.md) for sign-in and configuration, [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/COMMANDS.md) for account, billing, public scanners, run history and Watchdog, [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/CLOUDFLARE.md) for `cf`/`cloudflare`, and [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/SECURITY.md) for security commands. The read operations above do not replace the existing explicitly confirmed write commands.
package/README.md CHANGED
@@ -28,11 +28,11 @@ supported on Windows yet; public tools and `cloudflare-checkup` still work there
28
28
 
29
29
  | Reference | Covers |
30
30
  | --- | --- |
31
- | [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/COMMANDS.md) | Core commands, aliases, global options, API mapping, sign-in, output |
32
- | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) | Accounts, zones, DNS, WAF, analytics, Zero Trust, Workers/Pages, audit, checkups |
33
- | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) | Incidents, logs, intelligence, analytics, assets, connections, policies, notifications, reports |
34
- | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/ONE.md) | Customer records, billing, reports, investigations, organizations, monitoring, support |
35
- | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) | `cloudflare-checkup`: verifies your work email, collects your Cloudflare configuration on your machine with Cloudflare's `cf` and uploads it after you confirm |
31
+ | [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/COMMANDS.md) | Core commands, aliases, global options, API mapping, sign-in, output |
32
+ | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/CLOUDFLARE.md) | Accounts, zones, DNS, WAF, analytics, Zero Trust, Workers/Pages, audit, checkups |
33
+ | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/SECURITY.md) | Incidents, logs, intelligence, analytics, assets, connections, policies, notifications, reports |
34
+ | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/ONE.md) | Customer records, billing, reports, investigations, organizations, monitoring, support |
35
+ | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/LOCAL.md) | `cloudflare-checkup`: verifies your work email, collects your Cloudflare configuration on your machine with Cloudflare's `cf` and uploads it after you confirm |
36
36
 
37
37
  These files ship with the package. Built-in help: `vigilbase <command> --help`
38
38
  or `vigilbase help <command>`; `vigilbase help <command> <subcommand>` (for
@@ -146,7 +146,7 @@ read-only Cloudflare API token instead. When you are done:
146
146
  npx @vigilbase/cli cloudflare-checkup logout # removes the read-only cf login and the cf it installed
147
147
  ```
148
148
 
149
- See [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) for
149
+ See [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.5/files/LOCAL.md) for
150
150
  every step, what is uploaded and the error codes.
151
151
 
152
152
  ## Public tools and sign-in
package/dist/lib/one-error-hints.d.ts CHANGED
@@ -7,6 +7,7 @@
7
7
  export declare const STAFF_CUSTOMER_SCOPE_HINT = "Vigilbase staff: add --customer-id <uuid>.";
8
8
  export declare const PERSONAL_SETTINGS_HINT = "Personal settings belong to each user, so View-as (--customer-id) cannot read them.";
9
9
  export declare const BROWSER_SESSION_HINT = "Invitations need a One browser session: manage them at https://one.vigilbase.com.";
10
+ export declare const VIGIL_UI_DISABLED_HINT = "Vigil investigations aren't enabled in Vigilbase One.";
10
11
  export type OneErrorContext = {
11
12
  method: string;
12
13
  /** The One path the CLI requested, with its query string. */
package/dist/lib/one-error-hints.js CHANGED
@@ -7,6 +7,7 @@
7
7
  export const STAFF_CUSTOMER_SCOPE_HINT = 'Vigilbase staff: add --customer-id <uuid>.';
8
8
  export const PERSONAL_SETTINGS_HINT = 'Personal settings belong to each user, so View-as (--customer-id) cannot read them.';
9
9
  export const BROWSER_SESSION_HINT = 'Invitations need a One browser session: manage them at https://one.vigilbase.com.';
10
+ export const VIGIL_UI_DISABLED_HINT = "Vigil investigations aren't enabled in Vigilbase One.";
10
11
  /** One's security boundary codes that already explain a 403 (apps/one/src/lib/flarehawk/access.ts). */
11
12
  const SECURITY_ACCESS_CODES = new Set([
12
13
  'FLAREHAWK_CUSTOMER_ACCESS_DENIED',
@@ -33,6 +34,15 @@ const RULES = [
33
34
  // Identity's management API accepts only One browser sessions, so CLI tokens can't read or send invitations.
34
35
  { method: 'GET', route: /^\/api\/auth\/orgs\/invitations$/u, status: 403, hasCustomerScope: false, hint: BROWSER_SESSION_HINT, code: 'browser_session_required' },
35
36
  { method: 'POST', route: /^\/api\/auth\/orgs\/invite$/u, status: 403, hasCustomerScope: false, hint: BROWSER_SESSION_HINT, code: 'browser_session_required' },
37
+ // One answers authorized staff 501 VIGIL_UI_DISABLED while the investigation UI ships dark.
38
+ {
39
+ method: 'GET',
40
+ route: /^\/api\/customers\/[0-9a-f-]{36}\/vigil\/investigations(?:\/[0-9a-f-]{36})?$/iu,
41
+ status: 501,
42
+ hasCustomerScope: false,
43
+ hint: VIGIL_UI_DISABLED_HINT,
44
+ code: 'VIGIL_UI_DISABLED',
45
+ },
36
46
  ];
37
47
  export function oneErrorHint(context) {
38
48
  const [pathname = '', query = ''] = context.path.split('?', 2);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@vigilbase/cli",
3
- "version": "0.2.4",
3
+ "version": "0.2.5",
4
4
  "description": "Vigilbase CLI — security scanners, agent tools, and Vigilbase One from the terminal.",
5
5
  "keywords": [
6
6
  "vigilbase",