@vigilbase/cli 0.2.4 → 0.2.6

package/dist/commands/local.js

@@ -3,9 +3,9 @@
  * ≡ `vigilbase local cloudflare-checkup [run] [options]`, plus the advanced
  * `login|doctor|accounts|collect|inspect|submit|logout` subcommands.
  *
- * The one command verifies the user's work email (vigilbase.com emails a
- * 6-digit code), finds (or, after asking, installs) Cloudflare's cf CLI, signs
- * in to Cloudflare with a read-only cf login, lets the user choose the
+ * The one command uses the signed-in Vigilbase identity, or verifies a work
+ * email with a 6-digit code, then finds (or, after asking, installs) Cloudflare's
+ * cf CLI, signs in to Cloudflare with a read-only cf login, lets the user choose the
  * account, collects a minimised snapshot with a fixed allowlist of read-only
  * cf commands, shows what it contains, uploads exactly that file to
  * vigilbase.com after an explicit confirmation and opens the results page.
@@ -17,9 +17,12 @@ import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
 import { z } from 'zod';
 import { CLI_VERSION } from '../version.js';
+import { verifySignedInRequester } from '../local/cloudflare-checkup/identity-verification.js';
+import { localResultPlainLines, readCheckupReport } from '../lib/checkup-report.js';
 import { resolveConfigDir } from '../lib/config.js';
 import { isHeadlessEnvironment, openUrlInBrowser } from '../lib/open-url.js';
 import { shouldShowProgress } from '../lib/progress.js';
+import { UNICODE_SYMBOLS, createStyles } from '../lib/tui.js';
 import { CF_SUPPORTED, NOT_COLLECTABLE_ZONE_KINDS, PRODUCTION_ORIGIN, RECOMMENDED_CF_SCOPES, SNAPSHOT_COLLECTOR_NAME, SNAPSHOT_LIMITS, SNAPSHOT_SCHEMA_VERSION, } from '../local/cloudflare-checkup/contract.js';
 import { CF_DAMAGED_HINT, CF_NOT_FOUND_ADVANCED_HINT, ENV_TOKEN_AUTH_HINT, LOCAL_ERROR_HINTS, LocalCheckupError, SNAPSHOT_STALE_FILE_HINT, } from '../local/cloudflare-checkup/errors.js';
 import { CF_TOKEN_ENV, buildChildEnv, childEnvVariableNames, hasEnvToken, missingEnvTokenMessage, strippedTokenNotice, } from '../local/cloudflare-checkup/cf/child-env.js';
@@ -53,15 +56,17 @@ Runs the Vigilbase Cloudflare Checkup on this machine, in one command:
 
   ${NPX_COMMAND} cloudflare-checkup
 
-It asks for your work email and emails you a 6-digit code to enter, installs
-Cloudflare's cf CLI if it is missing (asks first), signs in to Cloudflare with
+It uses your Vigilbase login, skipping email prompts and codes. Signed out,
+it verifies your work email with a 6-digit code. It installs Cloudflare's cf
+CLI if it is missing (asks first), signs in to Cloudflare with
 a read-only cf login, lets you choose the account, collects a snapshot, shows
 what it contains, uploads it only after you confirm and opens the results.
 cf owns your Cloudflare login; this CLI never reads, prints, stores or
 uploads it.
 
 Options (the default command, also called run):
-  --email <address>              Your work email (asked for when omitted)
+  --email <address>              Override the signed-in email; a different
+                                 address requires email verification
   --account-id <id>              Skip the account picker
   --out <file>                   Where to save the snapshot (default:
                                  <config dir>/checkups/…); --overwrite
@@ -81,8 +86,8 @@ Options (the default command, also called run):
                                  (default) or a loopback origin
   --timeout <milliseconds> · --json
 
-Without a terminal, add --yes: the email (unless --email is given) and the
-code are read from stdin, one line each, after their prompts on stderr.
+Without a terminal, add --yes. When email verification is needed, the email
+(unless --email is given) and code are read from stdin after their prompts.
 
 Advanced commands:
   login                          Create or refresh the read-only cf profile
@@ -93,7 +98,7 @@ Advanced commands:
   collect --out <file>           Collect only [--overwrite] [--account-id];
                                  --dry-run shows every cf command (offline)
   inspect <file>                 Validate a snapshot and show what it contains
-  submit <file>                  Verify your email, then upload a snapshot
+  submit <file>                  Identify yourself, then upload a snapshot
                                  [--email] [--yes|--confirm] [--no-open]
                                  [--base-url] [--timeout]
   logout                         Delete the read-only cf profile and the cf
@@ -1272,14 +1277,23 @@ function assertWithinLimits(server, loaded) {
         throw new LocalCheckupError('SNAPSHOT_TOO_LARGE', `The snapshot is over the vigilbase.com limit (${formatBytes(maxBytes)}, ${maxZones} zones). Nothing was uploaded.`);
     }
 }
-/**
- * The email verification (prompts on stderr, answers from piped stdin
- * without a terminal), then `✓ Verified j***@acme.com`. No address is sent
- * before one is entered, and cf is not touched before it is verified.
- */
+/** Use the live signed-in identity, or verify an address when no matching login is available. */
 async function verifyRequester(ctx, options, origin) {
+    const client = new VerificationClient(clientOptions(ctx, origin));
+    const configDir = options.configDir;
+    const identity = configDir ? await busy(ctx, 'Using your Vigilbase identity', () => verifySignedInRequester({
+        config: { ...ctx.config, configDir }, client, locale: emailLocale(ctx.env), email: options.email,
+        warn: (message) => ctx.writer.stderr(`Warning: ${message}`),
+    })) : null;
+    if (identity) {
+        if (ctx.tui)
+            ctx.tui.step(`Signed in as ${identity.requester}`);
+        else
+            say(ctx, `✓ Signed in as ${identity.requester}`);
+        return identity;
+    }
     const verified = await verifyEmail({
-        client: new VerificationClient(clientOptions(ctx, origin)),
+        client,
         io: promptIO(ctx),
         locale: emailLocale(ctx.env),
         ...(options.email !== undefined ? { email: options.email } : {}),
@@ -1293,10 +1307,10 @@ async function verifyRequester(ctx, options, origin) {
     return verified;
 }
 /**
- * The checkup the verified email started. A session that expired (a long
- * collection, or a slow answer to the upload question) is renewed once with
- * the token and code still in memory; vigilbase.com mints the next session
- * code for the same checkup. The snapshot file is kept either way.
+ * The checkup the verified requester started. An expired session is renewed
+ * once, using a fresh identity proof or the email token and code still in
+ * memory. vigilbase.com mints the next session code for the same checkup.
+ * The snapshot file is kept either way.
  */
 class CheckupSession {
     ctx;
@@ -1323,7 +1337,7 @@ class CheckupSession {
         }
         catch (error) {
             if (error instanceof LocalCheckupError && (error.code === 'VERIFICATION_EXPIRED' || error.code === 'VERIFICATION_INVALID')) {
-                throw new LocalCheckupError('SESSION_EXPIRED', 'The checkup session expired, and the code from the email can no longer renew it.', error.status !== undefined ? { status: error.status } : {});
+                throw new LocalCheckupError('SESSION_EXPIRED', 'The checkup session expired, and its identity verification can no longer renew it.', error.status !== undefined ? { status: error.status } : {});
             }
             throw error;
         }
@@ -1365,7 +1379,7 @@ function noteSavedSnapshot(ctx, error, path, origin) {
     if (ctx.tui)
         ctx.tui.uploadLater(submit);
     else
-        ctx.writer.stderr(`The snapshot stays saved. To upload it later without collecting again, run ${submit} (it verifies your email again).`);
+        ctx.writer.stderr(`The snapshot stays saved. To upload it later without collecting again, run ${submit} (it checks your identity again).`);
 }
 /** Session checks that need no upload: CLI version, single use, and the bound account. */
 function assertSessionUsable(session, accountId) {
@@ -1515,7 +1529,7 @@ async function runInspect(ctx, options) {
             return `  ${kind.padEnd(34)} ${String(kindCounts.total).padStart(5)}${notOk ? `  (${notOk} not ok)` : ''}`;
         }),
         'Free text and identifiers in this file:',
-        `  member emails ${categories.memberEmails} · access-rule values ${categories.accessRuleValues} · non-proxied DNS names ${categories.dnsHostnames} · pseudonymised IPs ${categories.pseudonymizedIps} · rule descriptions ${categories.ruleDescriptions}`,
+        `  member emails ${categories.memberEmails} · access-rule values ${categories.accessRuleValues} · DNS and certificate hostnames ${categories.dnsHostnames} · pseudonymised IPs ${categories.pseudonymizedIps} · rule descriptions ${categories.ruleDescriptions}`,
         'No credentials are included, and origin IPs are pseudonymised.',
     ];
     for (const line of lines)
@@ -1635,6 +1649,10 @@ async function uploadLoaded(ctx, input) {
         ].filter((part) => part !== null);
         const summary = `${result.replayed ? '✓ Already uploaded (same file); nothing changed.' : '✓ Uploaded.'} Free summary: ${parts.join(' · ')}`;
         const emailed = result.resultsUrl !== undefined ? `A link has also been emailed to ${requester}.` : `A link to the results has been emailed to ${requester}.`;
+        // The free checks the server sent (names and zone counts, never zone names) and its premium count.
+        const report = readCheckupReport(result.report);
+        // Appended after the lines above, which stay as they were for scripts.
+        const more = report ? localResultPlainLines(report, { style: createStyles(false), symbols: UNICODE_SYMBOLS, color: false, columns: null }) : [];
         if (ctx.tui) {
             const opening = result.resultsUrl !== undefined && openResults(ctx, result.resultsUrl, origin);
             ctx.tui.uploaded({
@@ -1643,7 +1661,8 @@ async function uploadLoaded(ctx, input) {
                 ...(warnings !== undefined ? { warnings } : {}),
                 ...(failedChecks !== undefined ? { failed: failedChecks } : {}),
                 ...(result.resultsUrl !== undefined ? { resultsUrl: result.resultsUrl } : {}),
-            }, [summary, ...(result.resultsUrl !== undefined ? [`Results: ${result.resultsUrl}`] : []), emailed]);
+                ...(report ? { report } : {}),
+            }, [summary, ...(result.resultsUrl !== undefined ? [`Results: ${result.resultsUrl}`] : []), emailed, ...more]);
         }
         else {
             ctx.writer.stdout(summary);
@@ -1652,6 +1671,8 @@ async function uploadLoaded(ctx, input) {
                 openResults(ctx, result.resultsUrl, origin);
             }
             ctx.writer.stdout(emailed);
+            for (const line of more)
+                ctx.writer.stdout(line);
         }
     }
     return {

package/dist/lib/checkup-report-limits.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The Cloudflare Checkup list caps the CLI prints, from `CHECKUP_REPORT_LIMITS`
+ * in packages/tools/src/pdf/cloudflare-checkup-report-limits.ts, so the
+ * terminal cuts long lists where the web report, the PDF and the emails do.
+ * The CLI is published to npm and cannot depend on the private
+ * `@vigilbase/tools` package; checkup-report-limits.test.ts keeps these values
+ * equal to the source.
+ */
+export declare const CLI_CHECKUP_LIMITS: {
+    /** Top priorities of `cf checkup result` and `cf checkup` (`priorities.cli`). */
+    readonly priorities: 8;
+    /** Their domain table rows (`cliDomains`). */
+    readonly domains: 15;
+    /** Top findings on the local checkup's result card (`priorities.cliCard`). */
+    readonly card: 5;
+};

package/dist/lib/checkup-report-limits.js

@@ -0,0 +1,16 @@
+/**
+ * The Cloudflare Checkup list caps the CLI prints, from `CHECKUP_REPORT_LIMITS`
+ * in packages/tools/src/pdf/cloudflare-checkup-report-limits.ts, so the
+ * terminal cuts long lists where the web report, the PDF and the emails do.
+ * The CLI is published to npm and cannot depend on the private
+ * `@vigilbase/tools` package; checkup-report-limits.test.ts keeps these values
+ * equal to the source.
+ */
+export const CLI_CHECKUP_LIMITS = {
+    /** Top priorities of `cf checkup result` and `cf checkup` (`priorities.cli`). */
+    priorities: 8,
+    /** Their domain table rows (`cliDomains`). */
+    domains: 15,
+    /** Top findings on the local checkup's result card (`priorities.cliCard`). */
+    card: 5,
+};

package/dist/lib/checkup-report.d.ts

@@ -0,0 +1,118 @@
+import { type Styles, type Symbols } from './tui.js';
+export type CheckupCounts = {
+    total: number | null;
+    passed: number | null;
+    warnings: number | null;
+    failed: number | null;
+    skipped: number | null;
+};
+/** One check ID's failing or warning instances, across the account and its zones. */
+export type CheckupFinding = {
+    name: string;
+    /** The server's label (`critical`, `high`, …), as sent. */
+    severity: string | null;
+    /** `failed` (fail or error) or `warning`; null for a legacy report's issue, which has no status. */
+    status: 'failed' | 'warning' | null;
+    /** Distinct zones with this finding. */
+    zones: number;
+    /** An account-level check. */
+    account: boolean;
+    /** The first line of the server's recommendation. */
+    recommendation: string | null;
+};
+export type CheckupZoneRow = {
+    name: string;
+    plan: string | null;
+    status: string | null;
+    grade: string | null;
+    score: number | null;
+    passed: number | null;
+    warnings: number | null;
+    failed: number | null;
+    /** A legacy report's issue count (it has no pass/warning/fail summary). */
+    issues: number | null;
+};
+export type CheckupReportView = {
+    accountName: string | null;
+    zoneCount: number | null;
+    scannedZones: number | null;
+    grade: string | null;
+    score: number | null;
+    summary: CheckupCounts | null;
+    zones: CheckupZoneRow[];
+    /** Ordered: failed before warnings, then by the server's severity, then the widest. */
+    findings: CheckupFinding[];
+    /** Premium checks the locked projection holds back. */
+    lockedPremiumCount: number;
+    /** The results page, only when it is an https://vigilbase.com URL. */
+    shareableUrl: string | null;
+    scannedAt: string | null;
+};
+/**
+ * The view of a checkup result (`CheckupResult`, its locked projection, or a
+ * legacy One report), or null when `value` is not an object. Malformed parts
+ * are left out rather than failing the whole view.
+ */
+export declare function readCheckupReport(value: unknown): CheckupReportView | null;
+/** How the lines are drawn: styles (identity without colour), symbols (ASCII on legacy consoles) and the width to fit, if any. */
+export type ReportPalette = {
+    style: Styles;
+    symbols: Symbols;
+    /** Colours on: the bar shows warnings and failed checks in their colours. */
+    color: boolean;
+    /** Terminal columns; null for plain output (pipes, files), which is never cut. */
+    columns: number | null;
+};
+export declare function joinParts(palette: ReportPalette, parts: readonly string[]): string;
+/** `account-wide`, `on 2 domains`, or '' (a legacy issue without a zone list). */
+export declare function findingScope(finding: CheckupFinding): string;
+/** A grade in the colour of its band, bold: A green, B and C yellow, D and F red (the server's letter, coloured). */
+export declare function styleGrade(style: Styles, grade: string): string;
+/**
+ * Cells per segment for a stacked bar: proportional, summing to `width`, and
+ * at least one cell for every non-zero count while the width allows.
+ */
+export declare function segmentWidths(values: readonly number[], width: number): number[];
+/**
+ * `██████░░`: passed, then warnings and failed (yellow and red with colour),
+ * then checks with any other status. Without colour, everything but passed is
+ * the empty cell, so the bar still reads as the share that passed.
+ */
+export declare function checksBar(palette: ReportPalette, summary: CheckupCounts, width: number): string | null;
+/**
+ * Finding lines, aligned: `✗ critical  Account MFA Enforcement  account-wide`.
+ * `indent` prefixes every line; with `recommendations`, the first line of the
+ * recommendation follows each finding, dim, under its name.
+ */
+export declare function findingLines(palette: ReportPalette, findings: readonly CheckupFinding[], options: {
+    indent: string;
+    recommendations?: boolean;
+}): string[];
+/** `+87 more checks in the full report` */
+export declare function lockedTeaser(palette: ReportPalette, locked: number): string | null;
+/** Findings shown at the end of a local checkup. */
+export declare const LOCAL_FINDINGS_SHOWN: 5;
+/**
+ * The result card of the terminal UI, under `└  ✓ Done. …`: the free checks as
+ * a bar, the top findings (failed, then warnings; names and zone counts, never
+ * zone names) and how many premium checks the full report adds. Lines are
+ * indented to the end of the timeline and fit the width.
+ */
+export declare function localResultCard(palette: ReportPalette, view: CheckupReportView): string[];
+/**
+ * The same, as plain lines appended after the plain result lines:
+ * `Top findings:`, one indented line each, then the premium teaser. Empty when
+ * there is nothing to add.
+ */
+export declare function localResultPlainLines(view: CheckupReportView, palette: ReportPalette): string[];
+/** Priorities shown by `cf checkup result` and `cf checkup`. */
+export declare const PRIORITIES_SHOWN: 8;
+/** Domain rows shown before `… N more domains`. */
+export declare const ZONES_SHOWN: 15;
+/**
+ * The body of `cf checkup result` and `cf checkup` in text mode, after their
+ * `checkup` and `grade` lines: the account, the counts (a bar on a terminal),
+ * the domains, the top priorities with the first line of each recommendation,
+ * the premium teaser of a locked result and the full report link.
+ */
+export declare function checkupReportLines(palette: ReportPalette, view: CheckupReportView): string[];