@vigilbase/cli 0.2.4 → 0.2.6

package/CLOUDFLARE.md

@@ -2,7 +2,7 @@
 
 `vigilbase cf` and `vigilbase cloudflare` use the authenticated Vigilbase One API. Run `vigilbase login` first (signing in isn't supported on Windows yet). Your organization, permissions, customer links, and allowed zones determine access. The CLI never requires a Cloudflare API key.
 
-`cf checkup` runs on One's servers. `cloudflare-checkup` (also `local cloudflare-checkup`) runs on your machine with Cloudflare's own `cf` CLI and needs no Vigilbase login: one command, `npx @vigilbase/cli cloudflare-checkup`, verifies your work email with a code, installs cf if needed, signs in read-only, collects and uploads after you confirm. It works while vigilbase.com has local checkups switched on; otherwise it says so before asking for your email and points you to the checkup in your browser at https://vigilbase.com/tools/cloudflare-checkup (see [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md)).
+`cf checkup` runs on One's servers. `cloudflare-checkup` (also `local cloudflare-checkup`) runs on your machine with Cloudflare's own `cf` CLI and needs no Vigilbase login: one command, `npx @vigilbase/cli cloudflare-checkup`, verifies your work email with a code, installs cf if needed, signs in read-only, collects and uploads after you confirm. It works while vigilbase.com has local checkups switched on; otherwise it says so before asking for your email and points you to the checkup in your browser at https://vigilbase.com/tools/cloudflare-checkup (see [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/LOCAL.md)).
 
 Customer provider access requires an `active` or `trialing` Cloudflare service
 entitlement for the selected account. Historical/inactive rows and legacy account
@@ -92,10 +92,11 @@ Every path below is relative to the configured One origin. `customerId`, `accoun
 | `speed-settings` | `GET /api/cloudflare/zones/Z/speed-settings?customerId=C` | Read provider settings; internal permission checks |
 | `audit-logs`, `zero-trust`, `developer-platform`, `magic-transit` | `GET /api/cloudflare/accounts/A/RESOURCE?customerId=C` | Read provider account resource |
 | `analytics` | `GET /api/services/cloudflare/analytics?days=N&customerId=C&accountId=A` or `zoneId=Z` | Read usage/provider analytics |
-| Checkup status | `GET /api/services/cloudflare/checkups?customerId=C&accountId=A` | Read completed checkup/configuration |
+| Checkup status | `GET /api/services/cloudflare/checkups?customerId=C&accountId=A` | Read completed checkup/configuration; `report` is deprecated, read `latestRun.results` |
 | Checkup start | `POST /api/services/cloudflare/checkups/start`, JSON `{customerId?, accountId?}` | Starts scanner and persists a run; no DNS/WAF configuration edits |
 | Checkup progress | `GET /api/services/cloudflare/checkups/progress?toolRunId=ID` | Read up to 500 persisted events per response |
 | Checkup result | `GET /api/tool-runs/ID` | Read stored run; server may claim eligible run ownership for the organization |
+| (no command) Checkup PDF | `GET /api/services/cloudflare/checkups/report?toolRunId=ID`, or `?customerId=C&accountId=A` for the latest completed run | Read stored run as the shared PDF report; never starts a scan |
 
 Account audit logs require service-read permissions. Zero Trust, Developer Platform and Magic Transit require deployment-read permissions. Speed settings require internal access plus service/deployment read permissions. One verifies tenant/account/zone bindings for these reads; account-wide reads may be unavailable for grants restricted to individual zones.
 
@@ -105,6 +106,12 @@ The API may return empty audit logs, WAF rules, speed settings or other account
 
 Analytics prefers scoped stored usage when available and otherwise uses provider analytics. Live zone analytics covers the most recent 23 hours regardless of `--days`; account analytics uses the requested period. Zero-valued results can represent unavailable data. JSON mode preserves the API's shape, including either `analytics` or `bandwidth`.
 
+In text mode, `cf checkup result` and `cf checkup` print a readable summary of the stored result instead of its raw fields: the grade and score, the check counts, the account's domains (worst score first, up to 15, with plan, grade and failed, warning and passed counts), the top 8 priorities (each check once, failed before warnings, then by the severity the scanner gave it, with the number of domains it affects and the first line of its recommendation) and the full report link when the result has one. Longer lists end with how many more there are and where to see them, for example `… 94 more findings in the full report (--json lists them all)` (without a report link: `… 94 more findings (--json lists them all)`). These caps are the ones the web report, the PDF and the emails use. On a terminal, the grade, counts and a bar of the checks are coloured and lines fit the width; `NO_COLOR` or `FORCE_COLOR=0` turns colours off. `--json` returns the API envelope unchanged, with every check and field.
+
+The `cf checkup --json` envelope (`GET /api/services/cloudflare/checkups`) carries the latest completed run as `latestRun`, with the stored Cloudflare Checkup result in `latestRun.results`. Its `report` field is deprecated and kept only for scripts written against the earlier envelope; responses name it in the `X-Vigilbase-Deprecated-Fields: report` header. Use `latestRun.results`. `report` is now derived from that stored result: the account, `generatedAt` (the scan time), the grade and score (unlocked results only), `scope` on a zone-scoped checkup, the old `summary` counts, `metadata.dnssecEnabled` and `metadata.wafEnabled`, and per zone its status, plan, grade, score, check counts, `dnssec` and `waf` when those checks ran, and its issues. Each issue keeps `id` (the check ID), `severity` (`critical`, `warning` or `info`, mapped as before), `title`, `description` and `recommendation`, and adds the check's `status` and the scanner's own `checkSeverity`. Checks that could not run are not issues. Fields the stored result cannot answer are omitted rather than estimated: per-zone `dnsRecords`, `firewall`, `paused` and `developmentMode`, and `metadata.firewallProtected` and `metadata.apexConfigured`. `report` is `null` when there is no completed run.
+
+The same run is available as the shared PDF report from `GET /api/services/cloudflare/checkups/report?toolRunId=ID`, or for an account's latest completed run from `GET /api/services/cloudflare/checkups/report?customerId=C&accountId=A` (account administrators). The account form never starts a scan: without a completed run it answers 404 `No completed checkup for this account; start one via POST /checkups/start`. `POST /api/services/cloudflare/checkups/analyze` takes `{ "toolRunId": ID }`; the earlier body, a checkup report, is refused with 400.
+
 Checkup progress reads once and does not poll automatically. Run the command again to refresh. Status describes the latest completed run; use its returned run ID or the ID from `start` with `progress` to inspect an in-progress scan. `result` verifies that the selected run is a Cloudflare checkup and reports when no result is available yet.
 
 Malformed IDs, conflicting selections, extra positional arguments and unsupported scope combinations fail before a network request. Authentication, permission, HTTP and explicit `success:false` API failures return a nonzero exit status. Provider configuration writes, token management, cache purge, account deletion and DNS edits are not exposed by this command group.

package/COMMANDS.md

@@ -12,11 +12,11 @@ case.
 
 | Area | Complete command and API reference |
 | --- | --- |
-| Cloudflare | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) |
-| Security | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) |
-| Customers, organizations, monitoring, support | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/ONE.md) |
-| Local Cloudflare Checkup (cf on your machine) | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) |
-| Sign-in, credentials, configuration, troubleshooting | [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md) |
+| Cloudflare | [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/CLOUDFLARE.md) |
+| Security | [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/SECURITY.md) |
+| Customers, organizations, monitoring, support | [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/ONE.md) |
+| Local Cloudflare Checkup (cf on your machine) | [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/LOCAL.md) |
+| Sign-in, credentials, configuration, troubleshooting | [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/README.md) |
 
 The references list the supported operations, filters, response and pagination
 behaviour, API endpoints and access requirements of the CLI.

package/LOCAL.md

@@ -15,7 +15,7 @@ before it asks for your email; when local mode is off it stops with
 your browser at <https://vigilbase.com/tools/cloudflare-checkup>.
 
 `vigilbase cf checkup` runs on Vigilbase One's servers with stored credentials
-(see [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md));
+(see [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/CLOUDFLARE.md));
 `vigilbase cloudflare-checkup` runs on your machine and needs no Vigilbase
 login.
 
@@ -35,7 +35,7 @@ update the global install with `npm install -g @vigilbase/cli@latest`. With
 Yarn 4.15+ or pnpm 11+, `yarn dlx` and `pnpm dlx` run an older release for a
 day after each release, and pnpm 10.16+ with `minimumReleaseAge` set refuses
 the new version; use `npx` (see
-[Troubleshooting](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md#troubleshooting)).
+[Troubleshooting](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/README.md#troubleshooting)).
 
 The command does everything, in this order, and stops at the first problem
 before any slower step:
@@ -44,7 +44,8 @@ before any slower step:
 2. Asks vigilbase.com whether local checkups are available and accept this CLI
    version (nothing about you is sent). If not, it stops here, before asking
    for your email.
-3. Asks for your work email (`Work email for your results:`), and
+3. Uses your verified Vigilbase CLI login without email prompts or codes.
+   If signed out, asks for your work email (`Work email for your results:`), and
    vigilbase.com emails you a 6-digit code. You enter it at
    `Code from the email:` (`123456`, `123 456` and `123-456` all work), and
    the CLI prints `✓ Verified j***@acme.com`.
@@ -90,6 +91,14 @@ $ npx @vigilbase/cli cloudflare-checkup
 ◇  Upload 182 KB to vigilbase.com? › Yes
 │
 └  ✓ Done. 31 passed · 6 warnings · 4 failed · 30 reads not collected locally
+   ████████████████████████░░░░░░░░  31 of 41 free checks passed
+
+   Top findings
+   ✗ critical  Account MFA Enforcement  account-wide
+   ✗ high      DNSSEC                   on 3 domains
+   ▲ medium    Always Use HTTPS         on 6 domains
+   +412 more checks in the full report
+
    Results: https://vigilbase.com/tools/run/0b7f3c1e-1d2a-4c55-9e1a-8d3f2b6c9a10 (opening in your browser)
    A link has also been emailed to j***@acme.com.
    Remove the read-only Cloudflare login and the cf Vigilbase installed later with:
@@ -122,6 +131,11 @@ Results go to j***@acme.com. Upload 182 KB to https://vigilbase.com? [y/N] y
 ✓ Uploaded. Free summary: 31 passed · 6 warnings · 4 failed · 30 reads not collected locally
 Results: https://vigilbase.com/tools/run/0b7f3c1e-1d2a-4c55-9e1a-8d3f2b6c9a10
 A link has also been emailed to j***@acme.com.
+Top findings:
+  ✗ critical  Account MFA Enforcement · account-wide
+  ✗ high      DNSSEC · on 3 domains
+  ▲ medium    Always Use HTTPS · on 6 domains
++412 more checks in the full report
 Remove the read-only Cloudflare login and the cf Vigilbase installed later with: npx @vigilbase/cli cloudflare-checkup logout
 ```
 
@@ -142,7 +156,7 @@ and `vigilbase local cloudflare-checkup run` are the same command.
 
 | Option | Meaning |
 | --- | --- |
-| `--email <address>` | Your work email; without it, the CLI asks for it. |
+| `--email <address>` | Override the signed-in address; a different address requires email verification. Signed out, the CLI asks when omitted. |
 | `--account-id <id>` | Skip the account picker (32 hex characters). |
 | `--out <file>` | Write the snapshot here instead of the default path; `--overwrite` replaces an existing file. |
 | `--yes` | Answer yes to installing cf and to the upload question. |
@@ -237,10 +251,22 @@ the terminal width, also after a resize.
 - If the Cloudflare sign-in fails or is cancelled, it asks `Try signing in
   again?`, up to twice more. While cf signs in, the terminal belongs to cf, so
   its own messages appear between the steps.
+- The result ends with a short card from vigilbase.com's free report: a bar
+  of the free checks (green passed, yellow warnings, red failed; without
+  colour, the share that passed), up to five top findings (failed before
+  warnings, then by the severity vigilbase.com gave them; each check once, with
+  the number of domains it affects, never their names; any more are counted:
+  `… 2 more findings on the results page`) and how many more checks the full
+  report has. Long names are cut to the terminal width.
 - The results link is underlined, and clickable (an OSC 8 link) in terminals
   known to support it (`FORCE_HYPERLINK=0` turns that off, `1` turns it on).
   When stdout is not a terminal (`> results.txt`), the plain result lines go to
   stdout as well.
+- In the plain output, the `✓ Uploaded. Free summary: …`, `Results: …` and
+  email lines come first and keep their wording, so scripts can match them;
+  the top findings (`Top findings:`, one indented line each and, past five,
+  `… N more findings on the results page`) and the
+  `+N more checks in the full report` line follow them.
 - Ctrl-C at any point gives the terminal back (raw mode off, cursor shown),
   says what happened (for example `Cancelled. Nothing was uploaded.`) and
   exits 130. While cf or npm runs, Ctrl-C, SIGTERM and SIGHUP stop them and
@@ -264,8 +290,34 @@ between the items of a summary line, in every step, spinner and message.
 
 ## Email verification and the checkup session
 
-The CLI verifies your email itself; there is no browser step and no bot check
-on this path.
+Snapshot uploads retry network failures and HTTP 503 responses twice using
+the same bytes and session. A 503's `retryAfterSec` or `Retry-After` delay is
+honoured up to 60 seconds per retry; longer delays stop with retry guidance.
+Without a server delay, retries wait 2 seconds, then 5 seconds. Challenges and
+the local-mode kill switch are never retried. The saved snapshot remains
+available for a later `submit` if these attempts fail.
+
+When you are signed in with `vigilbase login`, both the one command and
+`submit` use your verified account identity and skip email prompts and codes.
+The CLI sends its login token only to One's
+`POST /api/tools/cloudflare-checkup/local-identity`. One checks the live
+identity and verified mailbox, then signs a proof valid for at most two minutes
+and tied to this checkup's run ID. The CLI exchanges that proof at
+`POST …/local-session/identity` for an upload session. vigilbase.com never
+receives the login token. Session renewal obtains a fresh proof for the same
+run; it does not send an email or create a second checkup. Proofs and session
+codes stay in memory and are never printed or passed to cf or npm.
+
+A missing, expired or rejected login uses the email flow below. `--email`
+matching the live identity also skips verification; a different address must
+verify by email. Signed-in users may use their verified account mailbox even
+when it is a personal address; signed-out email verification still requires a
+business address. Availability, rate limits, the upload confirmation and
+Cloudflare's own sign-in apply to both paths.
+
+The CLI verifies signed-out users' email itself; there is no browser step and
+no bot check on this path.
+
 
 - **Availability first.** Before asking for your email, the one command and
   `submit` send `GET …/local-session/availability`, with no email, no
@@ -538,7 +590,7 @@ passed.
 | account | `accounts get` | single |
 | zones | `zones list --account-id A --per-page 50 --page N` | until an empty page |
 | members | `accounts members list --per-page 50 --page N` | until an empty page |
-| account rulesets | `rulesets list --per-page 100` | one call |
+| account rulesets | `rulesets list --per-page 50` | one call |
 | account access rules | `firewall access-rules list --per-page 50 --page N` | until an empty page |
 | Access apps, IdPs, service tokens | `zero-trust access applications list`, `zero-trust identity-providers list`, `zero-trust access service-tokens list` (`--per-page 50 --page N`) | until an empty page |
 | Gateway rules, locations | `zero-trust gateway rules list`, `zero-trust gateway locations list` | single |
@@ -547,11 +599,14 @@ passed.
 | DNSSEC | `dns dnssec get --zone Z` | single |
 | DNS records | `dns records list --zone Z --per-page 100 --page N` | until an empty page (cap 100) |
 | Universal SSL, Total TLS | `ssl universal settings get --zone Z`, `acm total-tls get --zone Z` | single |
-| zone rulesets | `rulesets list --zone Z --per-page 100` | one call |
+| zone rulesets | `rulesets list --zone Z --per-page 50` | one call |
 | ruleset detail | `rulesets get R --zone Z` | single |
 | zone access rules | `firewall access-rules list --zone Z --per-page 100 --page N` | until an empty page |
 | page rules, bot management, page shield | `page-rules list --zone Z`, `bot-management get --zone Z`, `client-side-security settings get --zone Z` | single |
 | API Shield | `api-security schema-validation settings get --zone Z`, `api-security schema-validation schemas list --zone Z --omit-source --per-page 100 --page N` | single / until an empty page |
+| Edge certificate packs | `ssl certificate-packs list --zone Z --status all --per-page 50 --page N` | until an empty page |
+| Uploaded custom certificates | `custom-certificates list --zone Z --per-page 50 --page N` | until an empty page |
+| API operation enforcement | `web-assets operations list --zone Z --feature schema_info --per-page 50 --page N` | until an empty page |
 
 The only other cf argv are `--version`, `auth whoami`,
 `auth create <p> [--no-browser] --scopes …` (sign-in, interactive;
@@ -574,7 +629,7 @@ for `accounts list`, `accounts get` or `zones list` the run stops with
 cf strips pagination metadata, so lists are paged until a page comes back empty
 (one extra call per list, immune to server-side page clamps). A page whose first
 item repeats the previous page's is `invalid_output` (cf ignoring `--page`). The
-rulesets lists are cursor-only and the cursor is not printed: 100 or more items
+rulesets lists are cursor-only and the cursor is not printed: 50 or more items
 are recorded as `possibly_truncated`.
 
 ## Process and environment policy
@@ -662,9 +717,11 @@ Each cf response is projected immediately and the raw text discarded. The file
   shield `enabled`;
 - DNS A/AAAA records with **pseudonymised IPs** (the first two IPv4 or three IPv6
   groups are kept, the host part becomes a per-prefix counter,
-  `per_prefix_sequential/1`); names only for non-proxied records;
-- ruleset `id, phase`, `name: 'ddos'` markers, and rules reduced to action,
-  `enabled:false`, a `true`/geo-block expression marker, managed-ruleset IDs and
+  `per_prefix_sequential/1`); DNS hostnames, including proxied CNAMEs without their targets;
+- certificate status, covered hostnames and expiry; API operation schema IDs and
+  mitigation actions, without API endpoint paths, schema source or certificate keys;
+- ruleset `id, phase, kind`, `name: 'ddos'` markers, and rules reduced to action,
+  `enabled:false`, a `true`/`false`/geo-block expression marker, execution target IDs and
   name keywords; IDs and descriptions only on disabled managed rules and
   block-everything rules; identical rules run-length encoded;
 - legacy page-rule action IDs, bot-management and schema-validation settings.
@@ -697,6 +754,14 @@ legacy Filters, previous-version WAF packages, previous-version Rate Limiting,
 and WAF traffic analytics (GraphQL). They are recorded as `not_collected`, shown
 as **Not collected locally** and never scored as passing.
 
+Effective managed WAF scope and overrides are also explicitly not collected:
+V1 projections omit account ruleset details, scope expressions and customer
+overrides. They cannot establish effective coverage, even when basic deployment
+evidence is present. Certificate and API-operation inputs are optional additions;
+older V1 snapshots remain valid and report those missing inputs rather than
+assuming protection. Browser scans include the full effective WAF checks and
+bounded analytics, with Free-plan restrictions and sampling labeled separately.
+
 The plan and add-on review is not collected either: the snapshot has no entry
 for add-on entitlements or the Smart Shield setting. The PDF report shows each
 zone's plan from the zone list and lists Advanced Bot Management, Advanced Rate
@@ -776,6 +841,16 @@ Windows on ARM is not supported. The checkup needs no Vigilbase sign-in, so it
 works on Windows even though `vigilbase login` doesn't yet. pnpm and Volta
 global installs are found automatically; otherwise pass `--cf-bin` as above.
 
+## Report analytics
+
+Unlocked results and PDFs include check outcomes, evaluation coverage, category
+findings and domain comparisons from the same evaluator used by browser scans.
+Local reports remain labelled self-reported. Traffic analytics are not collected
+by the CLI: reports say so explicitly rather than showing unmeasured zeroes.
+Older V1 snapshots remain accepted; optional inputs absent from them produce
+coverage gaps, not passing results. No additional upload fields or permissions
+are required for the configuration charts.
+
 ## Cleanup
 
 ```bash

package/ONE.md

@@ -49,7 +49,7 @@ contract scope fails closed; no allowed subscriptions returns an empty list.
 
 Unspecified query parameters are omitted. API defaults: Watchdog scans limit 20/offset 0, Recon reports limit 12, investigations limit 50, invoices limit 50. For Watchdog scans, advance `--offset` using the response's `total`. For investigations, pass `data.nextCursor` back to `--cursor` (maximum 512 characters); `--before` must be an ISO timestamp with timezone and `--issue-id` is at most 256 characters. `--before` and `--cursor` are mutually exclusive. The API validates opaque cursors. Omitting `--revision` loads the latest investigation revision. Invoice responses preserve `has_more`, but this One endpoint has no cursor option; the CLI cannot fetch subsequent invoice pages beyond the requested limit.
 
-Customer discovery follows the API's internal, customer, and partner visibility. Detail/summary/contact/organization/Recon reads require customer read access; endpoints/services require service read access. Watchdog routes require monitoring/tool permissions as enforced by the API. Contracts and billing reads require their respective permissions. Linked project reads are restricted to internal operators with service read access. Vigil investigation reads require internal Vigil investigation permission and the Vigil UI feature to be enabled; disabled deployments return 404. Stripe resources are fetched by One from Stripe and are not persisted by the CLI.
+Customer discovery follows the API's internal, customer, and partner visibility. Detail/summary/contact/organization/Recon reads require customer read access; endpoints/services require service read access. Watchdog routes require monitoring/tool permissions as enforced by the API. Contracts and billing reads require their respective permissions. Linked project reads are restricted to internal operators with service read access. Vigil investigation reads require internal Vigil investigation permission and the Vigil UI feature to be enabled. Signed-out callers get 401 and callers without that permission 404. While the feature is off, permitted staff get 501 `VIGIL_UI_DISABLED` for an existing customer (404 for an unknown one), which the CLI explains with a hint. Stripe resources are fetched by One from Stripe and are not persisted by the CLI.
 
 The service command uses the dashboard's `/service-records` API. `/customers/{id}/services` and `/customers/search` require a separate Vigil machine credential and are intentionally not exposed. The customer bootstrap `/customers/me` endpoint can provision a customer, so use existing `vigilbase account` to inspect the current customer's context. Generating Watchdog AI insights, re-running investigations, syncing providers, creating reports, and other effectful APIs are not invoked by these read commands.
 
@@ -95,4 +95,4 @@ vigilbase support tickets [--all] [--limit 1..100] [--customer-id <uuid>] [--jso
 
 ## Related commands and validation
 
-See [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/README.md) for sign-in and configuration, [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/COMMANDS.md) for account, billing, public scanners, run history and Watchdog, [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) for `cf`/`cloudflare`, and [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) for security commands. The read operations above do not replace the existing explicitly confirmed write commands.
+See [README.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/README.md) for sign-in and configuration, [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/COMMANDS.md) for account, billing, public scanners, run history and Watchdog, [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/CLOUDFLARE.md) for `cf`/`cloudflare`, and [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/SECURITY.md) for security commands. The read operations above do not replace the existing explicitly confirmed write commands.

package/README.md

@@ -28,11 +28,11 @@ supported on Windows yet; public tools and `cloudflare-checkup` still work there
 
 | Reference | Covers |
 | --- | --- |
-| [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/COMMANDS.md) | Core commands, aliases, global options, API mapping, sign-in, output |
-| [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/CLOUDFLARE.md) | Accounts, zones, DNS, WAF, analytics, Zero Trust, Workers/Pages, audit, checkups |
-| [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/SECURITY.md) | Incidents, logs, intelligence, analytics, assets, connections, policies, notifications, reports |
-| [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/ONE.md) | Customer records, billing, reports, investigations, organizations, monitoring, support |
-| [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) | `cloudflare-checkup`: verifies your work email, collects your Cloudflare configuration on your machine with Cloudflare's `cf` and uploads it after you confirm |
+| [COMMANDS.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/COMMANDS.md) | Core commands, aliases, global options, API mapping, sign-in, output |
+| [CLOUDFLARE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/CLOUDFLARE.md) | Accounts, zones, DNS, WAF, analytics, Zero Trust, Workers/Pages, audit, checkups |
+| [SECURITY.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/SECURITY.md) | Incidents, logs, intelligence, analytics, assets, connections, policies, notifications, reports |
+| [ONE.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/ONE.md) | Customer records, billing, reports, investigations, organizations, monitoring, support |
+| [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/LOCAL.md) | `cloudflare-checkup`: verifies your work email, collects your Cloudflare configuration on your machine with Cloudflare's `cf` and uploads it after you confirm |
 
 These files ship with the package. Built-in help: `vigilbase <command> --help`
 or `vigilbase help <command>`; `vigilbase help <command> <subcommand>` (for
@@ -124,15 +124,18 @@ npx @vigilbase/cli cloudflare-checkup
 This one command (also `vigilbase cloudflare-checkup` or
 `vigilbase local cloudflare-checkup`) runs the Vigilbase Cloudflare Checkup
 on your machine with Cloudflare's own `cf` CLI. It needs no Vigilbase sign-in.
-It asks for your work email and vigilbase.com emails you a 6-digit code to
-enter. It then installs cf if needed (it asks first), signs in to Cloudflare
+If you are signed in with `vigilbase login`, it uses your verified account
+identity without asking for an email or code. Otherwise it asks for your work
+email and vigilbase.com emails you a 6-digit code to enter. It then installs cf if needed (it asks first), signs in to Cloudflare
 read-only, lets you choose the account, collects, and uploads the snapshot only
 after you confirm. It prints the results link and opens it in your browser on
 macOS and Linux; the results also go to your verified email.
 
 cf owns your Cloudflare login: this CLI never reads, prints, stores or uploads
-it. Your email address goes to vigilbase.com only so it can send the code; the
-CLI never prints, logs or stores it and shows only the masked `j***@acme.com`.
+it. Your account token is sent only to One; vigilbase.com receives a short-lived
+proof tied to this checkup. Checkup output shows only the masked
+`j***@acme.com` address. `--email` can select a different recipient, which
+requires email verification.
 In a terminal the steps show as an interactive timeline; pipes, CI,
 `TERM=dumb` and `--json` get plain lines.
 
@@ -146,7 +149,7 @@ read-only Cloudflare API token instead. When you are done:
 npx @vigilbase/cli cloudflare-checkup logout   # removes the read-only cf login and the cf it installed
 ```
 
-See [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.4/files/LOCAL.md) for
+See [LOCAL.md](https://app.unpkg.com/@vigilbase/cli@0.2.6/files/LOCAL.md) for
 every step, what is uploaded and the error codes.
 
 ## Public tools and sign-in

package/dist/commands/cloudflare.js

@@ -1,4 +1,8 @@
 import { z } from 'zod';
+import { shouldUseColor } from '../lib/banner.js';
+import { checkupReportLines, readCheckupReport, styleGrade } from '../lib/checkup-report.js';
+import { sanitizeTerminal, singleLine } from '../lib/format.js';
+import { ASCII_SYMBOLS, UNICODE_SYMBOLS, createStyles, stripAnsi, supportsUnicode } from '../lib/tui.js';
 import { CloudflareClient, accountResourceSchema, cloudflareScopeSchema, workspaceSectionSchema, } from '../lib/cloudflare-client.js';
 import { assertCommandFlags, asArray, asRecord, ok, outputJson, requireOneClient, withSpinner, } from './helpers.js';
 import { InvalidArgumentError, inRange, oneOf, unknownSubcommand } from './legacy-validation.js';
@@ -72,6 +76,45 @@ function fields(ctx, data) {
         writeLine(ctx, `${key.padEnd(20)} ${typeof value === 'object' ? JSON.stringify(value) : String(value)}`);
     }
 }
+/**
+ * Text output of the checkup commands. On a terminal with colour (stdout a
+ * TTY, TERM not dumb, NO_COLOR and FORCE_COLOR=0 unset, not CI), lines carry
+ * the palette's SGR styles and are written to stdout directly; everywhere
+ * else they go through the writer as plain text. Every payload string in a
+ * line was sanitised when it was read, so the only escape sequences a line
+ * can hold are the palette's own styles; a line with anything else is
+ * written plain.
+ */
+function checkupOutput(ctx) {
+    const stream = ctx.stdoutStream;
+    const terminal = ctx.mode === 'text' && stream?.isTTY === true && (ctx.env.TERM ?? '').toLowerCase() !== 'dumb';
+    const color = terminal && shouldUseColor(stream, ctx.env);
+    const width = Math.floor(Number(stream?.columns) || 0);
+    const palette = {
+        style: createStyles(color),
+        // Plain output keeps the Unicode symbols, like the CLI's other plain lines; legacy consoles get ASCII.
+        symbols: terminal && !supportsUnicode(ctx.env) ? ASCII_SYMBOLS : UNICODE_SYMBOLS,
+        color,
+        columns: terminal ? (width > 0 ? Math.max(40, width) : 80) : null,
+    };
+    return {
+        palette,
+        line: (text = '') => {
+            const visible = stripAnsi(text);
+            const styledOnly = !/\u001b(?!\[[0-9;]*m)/.test(text) && sanitizeTerminal(visible) === visible;
+            if (color && stream && styledOnly)
+                stream.write(`${text}\n`);
+            else
+                writeLine(ctx, visible);
+        },
+    };
+}
+/** `grade      D  47`, the server's grade in its band's colour. */
+function gradeLine(palette, grade, score) {
+    const scoreText = typeof score === 'number' || typeof score === 'string' ? singleLine(String(score), 10) : '';
+    return `grade      ${styleGrade(palette.style, singleLine(String(grade), 3))}${scoreText ? `  ${scoreText}` : ''}`;
+}
+const FULL_DATA_HINT = 'For every check and field, add --json.';
 function zones(ctx, values) {
     const items = asArray(values).map(asRecord).filter((item) => item !== null);
     if (!items.length)
@@ -331,13 +374,21 @@ export const handleCloudflare = async (ctx) => {
         if (run.tool_name !== 'cloudflare-checkup')
             throw new Error('This run is not a Cloudflare checkup.');
         return emit(payload, (data) => {
-            writeLine(ctx, `checkup    ${String(data.status)}`);
+            const out = checkupOutput(ctx);
+            out.line(`checkup    ${singleLine(String(data.status), 40)}`);
             if (data.grade)
-                writeLine(ctx, `grade      ${String(data.grade)}  ${String(data.grade_score ?? '')}`);
-            if (data.results)
-                fields(ctx, asRecord(data.results) ?? { results: data.results });
-            else
-                writeLine(ctx, 'No result is available yet.');
+                out.line(gradeLine(out.palette, data.grade, data.grade_score));
+            const view = readCheckupReport(data.results);
+            if (!view) {
+                if (data.error_message)
+                    out.line(`error      ${singleLine(String(data.error_message))}`);
+                out.line('No result is available yet.');
+                return;
+            }
+            for (const line of checkupReportLines(out.palette, view))
+                out.line(line);
+            out.line();
+            out.line(out.palette.style.dim(FULL_DATA_HINT));
         });
     }
     const isStart = action === 'start' || action === 'run';
@@ -349,12 +400,27 @@ export const handleCloudflare = async (ctx) => {
         }
         const run = asRecord(data.latestRun);
         const report = asRecord(data.report);
-        writeLine(ctx, `checkup    ${data.requiresSetup ? 'setup required' : String(run?.status ?? (report ? 'completed' : 'no completed runs'))}`);
-        if (run?.id)
-            writeLine(ctx, `run        ${String(run.id)}`);
-        if (run?.grade ?? report?.grade)
-            writeLine(ctx, `grade      ${String(run?.grade ?? report?.grade)}`);
-        if (report)
-            fields(ctx, report);
+        const out = checkupOutput(ctx);
+        out.line(`checkup    ${data.requiresSetup ? 'setup required' : singleLine(String(run?.status ?? (report ? 'completed' : 'no completed runs')), 40)}`);
+        const runId = typeof run?.id === 'string' ? singleLine(run.id, 80) : null;
+        if (runId)
+            out.line(`run        ${runId}`);
+        if (run?.grade)
+            out.line(gradeLine(out.palette, run.grade, run.grade_score));
+        else if (report?.grade)
+            out.line(gradeLine(out.palette, report.grade, report.score));
+        // The run's stored result; One's summary report of it for runs that have none.
+        const view = readCheckupReport(run?.results) ?? readCheckupReport(report);
+        if (!view)
+            return;
+        const lines = checkupReportLines(out.palette, view);
+        for (const line of lines)
+            out.line(line);
+        if (runId || lines.length)
+            out.line();
+        if (runId)
+            out.line(out.palette.style.dim(`Details: vigilbase cf checkup result ${runId}`));
+        if (lines.length)
+            out.line(out.palette.style.dim(FULL_DATA_HINT));
     });
 };

package/dist/commands/helpers.d.ts

@@ -77,7 +77,10 @@ export type CommandContext = {
     publicClient: VigilbaseClient;
     env: NodeJS.ProcessEnv;
     stdin?: NodeJS.ReadableStream;
-    /** Raw stdout, only to tell whether it is a terminal; text output still goes through `writer`. */
+    /**
+     * Raw stdout, to tell whether it is a terminal; text output still goes through `writer`, except the
+     * coloured checkup report of `cf checkup` (see `checkupOutput` in cloudflare.ts), built from sanitised text.
+     */
     stdoutStream?: NodeJS.WritableStream & {
         isTTY?: boolean;
     };