@vigilbase/cli 0.2.4 → 0.2.6

package/dist/local/cloudflare-checkup/contract.js

@@ -22,8 +22,8 @@
  * Line references below are to `packages/tools/src/cloudflare-checkup/scanner.ts`
  * before the read-client refactor; the function names are the stable anchor.
  *
- * Any change to a field read or a projection rule is a new schema version
- * (`/2`), and the server then accepts both for at least one CLI minor release.
+ * Optional protection entries and DNS hostname coverage extend V1; older V1
+ * snapshots remain accepted with the same required entry checks.
  */
 import { z } from 'zod';
 // ============================================================================
@@ -43,6 +43,8 @@ export const LOCAL_AVAILABILITY_PATH = '/api/v1/tools/cloudflare-checkup/local-s
 export const LOCAL_REQUEST_PATH = '/api/v1/tools/cloudflare-checkup/local-session/request';
 /** The CLI trades the verification token and the emailed code for a session code. */
 export const LOCAL_VERIFY_PATH = '/api/v1/tools/cloudflare-checkup/local-session/verify';
+/** Exchange a signed, run-scoped One identity proof for an upload session. */
+export const LOCAL_IDENTITY_PATH = '/api/v1/tools/cloudflare-checkup/local-session/identity';
 /** `vbcv1_` + base64url_nopad(iv[12] ‖ AES-256-GCM(runId[16] ‖ iat[4]) ‖ tag[16]): names a run awaiting its emailed code. */
 export const VERIFICATION_TOKEN_REGEX = /^vbcv1_[A-Za-z0-9_-]{64}$/;
 /** The six-digit code One emails for a tool run. */
@@ -77,7 +79,7 @@ export const SNAPSHOT_LIMITS = Object.freeze({
     maxFutureSkewSeconds: 300,
     // cf prints cursor-only lists without the cursor; a list this long may be
     // truncated. Lowered to the server's per_page maximum observed in launch gate 1.
-    rulesetListTruncationAt: 100,
+    rulesetListTruncationAt: 50,
 });
 // The 19 zone settings the scanner reads (scanZone 664-732; phase functions).
 export const ZONE_SETTING_IDS = [
@@ -151,6 +153,17 @@ export const ZONE_SINGLE_KINDS = [
     'zone_schema_validation_settings',
     'zone_schema_validation_schemas',
 ];
+export const OPTIONAL_ZONE_KINDS = [
+    'zone_certificate_packs',
+    'zone_custom_certificates',
+    'zone_api_operations',
+];
+export const SNAPSHOT_PROTECTION_COVERAGE_DESCRIPTORS = {
+    zone_certificate_packs: { label: 'Edge certificate packs', affects: ['certificate_coverage', 'certificate_expiry'] },
+    zone_custom_certificates: { label: 'Custom edge certificates', affects: ['certificate_coverage', 'certificate_expiry'] },
+    zone_api_operations: { label: 'API operation schema enforcement', affects: ['api_enforcement_coverage'] },
+    zone_effective_waf_inputs: { label: 'Effective WAF scope and overrides', affects: ['managed_ruleset_coverage', 'managed_ruleset_overrides'] },
+};
 // cf 1.0.0-beta.13 has no command for these reads; they are always `not_collected`.
 export const NOT_COLLECTABLE_ZONE_KINDS = [
     'zone_legacy_firewall_rules',
@@ -163,6 +176,7 @@ export const SNAPSHOT_KINDS = [
     ...ACCOUNT_KINDS,
     'zone_setting',
     ...ZONE_SINGLE_KINDS,
+    ...OPTIONAL_ZONE_KINDS,
     'zone_ruleset',
     ...NOT_COLLECTABLE_ZONE_KINDS,
 ];
@@ -304,7 +318,7 @@ export const AccountData = z.object({ id: hex32, name: text(256), type: token(32
     settings: z.object({ enforce_twofactor: z.boolean().optional() }).strict().optional() }).strict();
 export const ZoneData = z.object({ id: hex32, name: hostname, status: token(32).optional(), paused: z.boolean().optional(),
     type: token(32).optional(), development_mode: z.number().int().optional(),
-    plan: z.object({ name: text(64) }).strict().optional(), account: z.object({ id: hex32, name: text(256) }).strict() }).strict();
+    plan: z.object({ name: text(64).optional(), legacy_id: token(64).optional() }).strict().optional(), account: z.object({ id: hex32, name: text(256) }).strict() }).strict();
 export const MemberData = z.object({ status: z.literal('pending').optional(), email: email.optional(),
     user: z.object({ two_factor_authentication_enabled: z.literal(false) }).strict().optional() }).strict();
 export const AccessRuleData = z.object({ mode: token(32).optional(),
@@ -316,11 +330,24 @@ export const TunnelData = z.object({ status: token(32).optional(), is_deleted: z
 export const SettingData = z.object({ value: z.union([scalar,
         z.record(token(64), z.union([scalar, z.record(token(64), scalar)]))]).optional() }).strict();
 export const DnssecData = z.object({ status: token(32).optional(), algorithm: z.union([token(16), z.number().int()]).optional() }).strict();
-export const DnsRecordData = z.object({ type: z.enum(['A', 'AAAA']), name: hostname.optional(),
-    content: z.string().min(1).max(64).regex(IP_CONTENT_RE), proxied: z.literal(true).optional() }).strict();
-export const RulesetHeadData = z.object({ id: hex32, phase: token(64).optional(), name: z.literal('ddos').optional() }).strict();
+export const DnsRecordData = z.union([
+    z.object({ type: z.enum(['A', 'AAAA']), name: hostname.optional(),
+        content: z.string().min(1).max(64).regex(IP_CONTENT_RE), proxied: z.literal(true).optional() }).strict(),
+    z.object({ type: z.literal('CNAME'), name: hostname.optional(), proxied: z.literal(true) }).strict(),
+]);
+export const CertificateData = z.object({ status: token(64).optional(), hosts: list(hostname).optional(),
+    expires_on: iso.optional() }).strict();
+export const CertificatePackData = CertificateData.extend({ certificates: list(CertificateData).optional() }).strict();
+export const ApiOperationData = z.object({
+    features: z.object({ schema_info: z.object({
+            active_schema: z.object({ id: token(64) }).strict().optional(),
+            mitigation_action: z.enum(['block', 'log', 'none']).optional(),
+        }).strict().optional() }).strict().optional(),
+}).strict();
+const rulesetKind = z.enum(['managed', 'zone', 'root', 'custom']);
+export const RulesetHeadData = z.object({ id: hex32, phase: token(64).optional(), name: z.literal('ddos').optional(), kind: rulesetKind.optional() }).strict();
 export const RulesetDetailData = z.object({ id: hex32, phase: token(64).optional(), name: z.literal('ddos').optional(),
-    rulesBody: bodyRef.optional() }).strict();
+    kind: rulesetKind.optional(), rulesBody: bodyRef.optional() }).strict();
 export const PageRuleData = z.object({ actions: z.array(z.object({ id: z.enum(LEGACY_PAGE_RULE_ACTIONS) }).strict()).max(32).optional() }).strict();
 // `stale_zone_configuration` is its key list in API order: the scanner prints
 // `Object.keys(...)`, and the serialiser sorts object keys, so a `{key: true}`
@@ -339,8 +366,8 @@ const needleJoin = z.string().max(200).refine((v) => {
 const ruleShape = {
     action: z.string().regex(RULE_ACTION_RE).optional(), // non-conforming raw actions become 'other'
     enabled: z.literal(false).optional(),
-    expression: z.enum(['true', 'ip.geoip.country in']).optional(),
-    action_parameters: z.object({ id: z.string().refine((v) => MANAGED_RULESET_IDS.includes(v)).optional(),
+    expression: z.enum(['true', 'false', 'ip.geoip.country in']).optional(),
+    action_parameters: z.object({ id: hex32.optional(),
         name: needleJoin.optional() }).strict().optional(),
     id: token(64).optional(),
     ref: text(128).optional(),
@@ -354,7 +381,7 @@ export const RuleRunData = z.object({
 // Collector-side ruleset detail: rules are projected but not yet encoded into
 // `ruleBodies` (`assembleSnapshot` does that once every zone is collected).
 export const ProjectedRulesetDetailData = z.object({ id: hex32, phase: token(64).optional(), name: z.literal('ddos').optional(),
-    rules: z.array(ProjectedRuleData).max(SNAPSHOT_LIMITS.maxRulesPerBody) }).strict();
+    kind: rulesetKind.optional(), rules: z.array(ProjectedRuleData).max(SNAPSHOT_LIMITS.maxRulesPerBody) }).strict();
 // ============================================================================
 // Entries and the snapshot
 // ============================================================================
@@ -387,6 +414,9 @@ export const SnapshotEntrySchema = z.discriminatedUnion('kind', [
     Z('zone_page_shield', result(enabledOnly)),
     Z('zone_schema_validation_settings', result(SchemaValidationSettingsData)),
     Z('zone_schema_validation_schemas', result(counted)),
+    Z('zone_certificate_packs', z.union([result(list(CertificatePackData)), notCollected])),
+    Z('zone_custom_certificates', z.union([result(list(CertificateData)), notCollected])),
+    Z('zone_api_operations', z.union([result(list(ApiOperationData)), notCollected])),
     Z('zone_legacy_firewall_rules', notCollected),
     Z('zone_legacy_filters', notCollected),
     Z('zone_legacy_waf_packages', notCollected),
@@ -500,7 +530,7 @@ export function validateSnapshotSemantics(snapshot, ctx) {
         const key = snapshotEntryKey(entry, accountId);
         if (seen.has(key))
             issue('duplicate_entry', ['entries', i], 'snapshot_incomplete');
-        else if (!expected.has(key))
+        else if (!expected.has(key) && !OPTIONAL_ZONE_KINDS.includes(entry.kind))
             issue('unexpected_entry', ['entries', i], 'snapshot_incomplete');
         seen.add(key);
     });
@@ -522,7 +552,7 @@ export function validateSnapshotSemantics(snapshot, ctx) {
         runs.forEach((run, j) => {
             const path = ['ruleBodies', ref, j];
             const action = run.action?.toLowerCase();
-            if (run.expression !== undefined && action !== 'block')
+            if (run.expression !== undefined && action !== 'block' && !(action === 'execute' && run.expression === 'false'))
                 issue('expression_on_non_block_rule', [...path, 'expression']);
             if (run.action_parameters !== undefined && run.action !== 'execute') {
                 issue('action_parameters_on_non_execute_rule', [...path, 'action_parameters']);
@@ -587,6 +617,8 @@ export function validateSnapshotSemantics(snapshot, ctx) {
         if (entry.kind !== 'zone_dns_records' || !entry.result.ok)
             return;
         entry.result.data.forEach((record, r) => {
+            if (record.type !== 'A' && record.type !== 'AAAA')
+                return;
             const path = ['entries', i, 'result', 'data', r, 'content'];
             const pseudonym = parsePseudonym(record.content);
             if (pseudonym === null) {
@@ -769,6 +801,9 @@ export function snapshotRequestKey(kind, ids) {
         case 'zone_dns_records': return `GET /zones/${z}/dns_records`;
         case 'zone_universal_ssl': return `GET /zones/${z}/ssl/universal/settings`;
         case 'zone_total_tls': return `GET /zones/${z}/acm/total_tls`;
+        case 'zone_certificate_packs': return `GET /zones/${z}/ssl/certificate_packs?status=all`;
+        case 'zone_custom_certificates': return `GET /zones/${z}/custom_certificates`;
+        case 'zone_api_operations': return `GET /zones/${z}/api_gateway/operations?feature=schema_info&per_page=50`;
         case 'zone_rulesets': return `GET /zones/${z}/rulesets`;
         case 'zone_ruleset': return `GET /zones/${z}/rulesets/${ids.rulesetId ?? ''}`;
         case 'zone_access_rules': return `GET /zones/${z}/firewall/access_rules/rules`;
@@ -887,7 +922,7 @@ export function projectAccount(raw) {
 }
 /**
  * `zones` (all pages merged, API order): `id, name, status, paused, type,
- * development_mode, plan.name, account.{id,name}`. zoneCtxFor (4338) prints the
+ * development_mode, plan.{name,legacy_id}, account.{id,name}`. zoneCtxFor (4338) prints the
  * account; createZoneStatusCheck (1960-1990), createDevModeCheck (2165-2197),
  * createDNSModeCheck (3218-3234) and assembleCheckupResult (5099-5102) read the rest.
  * `paused` is only tested for truthiness.
@@ -906,8 +941,9 @@ export function projectZones(raw) {
             type: zone.type ?? undefined,
             development_mode: zone.development_mode ?? undefined,
         });
-        if (plan && printedIfTruthy(plan.name) !== undefined)
-            out.plan = { name: plan.name };
+        if (plan && (printedIfTruthy(plan.name) !== undefined || printedIfTruthy(plan.legacy_id) !== undefined)) {
+            out.plan = assignDefined({}, { name: printedIfTruthy(plan.name), legacy_id: printedIfTruthy(plan.legacy_id) });
+        }
         out.account = { id: account.id, name: account.name };
         return out;
     }));
@@ -1113,28 +1149,60 @@ export function projectDnssec(raw) {
     });
 }
 /**
- * `zone_dns_records` (all pages, API order): only `(A|AAAA) && content` records.
+ * `zone_dns_records` (all pages, API order): `(A|AAAA) && content` records and
+ * proxied CNAME hostnames without their targets.
  * findOriginExposure and detectOriginIpReuseAcrossZones (3307-3373) read
  * `type`, `content` (as a Map key and through `maskIp`), `proxied` (truthiness)
- * and `name`, which is printed only for non-proxied records (3292-3297); proxied
- * names are only counted. `content` stays raw here and is pseudonymised by
+ * and `name`. Certificate coverage reads proxied hostnames. Address `content`
+ * stays raw here and is pseudonymised by
  * `createIpPseudonymizer` (via `assembleSnapshot`) once every zone is collected.
  */
 export function projectDnsRecords(raw) {
     return runProjector(list(DnsRecordData), () => {
         const records = rawItems(raw, Number.MAX_SAFE_INTEGER)
-            .filter((record) => (record.type === 'A' || record.type === 'AAAA') && record.content)
+            .filter((record) => ((record.type === 'A' || record.type === 'AAAA') && record.content) || (record.type === 'CNAME' && record.proxied))
             .map((record) => {
-            const out = { type: record.type, content: record.content };
+            const out = { type: record.type };
+            if (record.type !== 'CNAME')
+                out.content = record.content;
             if (record.proxied)
                 out.proxied = true;
-            else if (record.name)
+            if (record.name)
                 out.name = record.name;
             return out;
         });
         return records.length > SNAPSHOT_LIMITS.maxListItems ? tooLarge() : records;
     });
 }
+function certificateFields(raw) {
+    return assignDefined({}, { status: raw.status, hosts: raw.hosts, expires_on: raw.expires_on });
+}
+export function projectCertificatePacks(raw) {
+    return runProjector(list(CertificatePackData), () => rawItems(raw).map((pack) => {
+        const out = certificateFields(pack);
+        if (pack.certificates !== undefined)
+            out.certificates = rawItems(pack.certificates).map(certificateFields);
+        return out;
+    }));
+}
+export function projectCustomCertificates(raw) {
+    return runProjector(list(CertificateData), () => rawItems(raw).map((certificate) => certificateFields(certificate)));
+}
+export function projectApiOperations(raw) {
+    return runProjector(list(ApiOperationData), () => rawItems(raw).map((operation) => {
+        if (operation.features === undefined)
+            return {};
+        const features = rawObject(operation.features);
+        if (features.schema_info === undefined)
+            return { features: {} };
+        const info = rawObject(features.schema_info);
+        const schemaInfo = assignDefined({}, { mitigation_action: info.mitigation_action });
+        if (info.active_schema !== undefined && info.active_schema !== null) {
+            schemaInfo.active_schema = { id: rawObject(info.active_schema).id };
+        }
+        return { features: { schema_info: schemaInfo } };
+    }));
+}
 /**
  * `zone_universal_ssl`, `zone_total_tls`, `zone_page_shield`: `enabled`.
  * The checks read `enabled !== false` (3797) and `enabled === true` (2697,
@@ -1152,11 +1220,14 @@ function rulesetHead(ruleset) {
         out.phase = ruleset.phase;
     if (typeof ruleset.name === 'string' && ruleset.name.toLowerCase().includes('ddos'))
         out.name = 'ddos';
+    if (rulesetKind.safeParse(ruleset.kind).success)
+        out.kind = ruleset.kind;
     return out;
 }
 /**
  * `zone_rulesets` heads: `id, phase`, `name:'ddos'` iff the name contains
- * "ddos"; `kind` and `version` are dropped. `name` is read only by
+ * "ddos"; the managed `kind` marker is retained to distinguish vendor definitions
+ * from customer configuration, while `version` is dropped. `name` is read only by
  * createDDoSCheck (2511); `phase` at 2326, 2511, 2559-2564, 3446 and 4019.
  */
 export function projectRulesetHeads(raw) {
@@ -1184,6 +1255,8 @@ function projectRule(rule, phase) {
         out.action = RULE_ACTION_RE.test(action) ? action : 'other';
     if (rule.enabled === false)
         out.enabled = false;
+    if (action === 'execute' && typeof rule.expression === 'string' && rule.expression.trim().toLowerCase() === 'false')
+        out.expression = 'false';
     if (action?.toLowerCase() === 'block' && typeof rule.expression === 'string') {
         const expression = rule.expression.toLowerCase();
         if (expression.trim() === 'true')
@@ -1197,7 +1270,7 @@ function projectRule(rule, phase) {
         const executeName = String(params.name || '').toLowerCase();
         const needles = MANAGED_NAME_NEEDLES.filter((needle) => executeName.includes(needle));
         const actionParameters = {};
-        if (MANAGED_RULESET_IDS.includes(executeId))
+        if (HEX32_REGEX.test(executeId))
             actionParameters.id = executeId;
         if (needles.length > 0)
             actionParameters.name = needles.join(' | ');
@@ -1338,6 +1411,9 @@ export const PROJECTORS = {
     zone_page_shield: projectEnabledOnly,
     zone_schema_validation_settings: projectSchemaValidationSettings,
     zone_schema_validation_schemas: projectCounted,
+    zone_certificate_packs: projectCertificatePacks,
+    zone_custom_certificates: projectCustomCertificates,
+    zone_api_operations: projectApiOperations,
 };
 export const NOT_COLLECTED_RESULT = Object.freeze({ ok: false, reason: 'not_collected' });
 export function httpErrorResult(status) {
@@ -1533,15 +1609,17 @@ export function assembleSnapshot(input) {
             if (entry.kind !== 'zone_dns_records' || entry.zoneId !== zoneId || !entry.result.ok)
                 continue;
             const records = entry.result.data;
-            const invalidContent = records.some((record) => !pseudonymFormatOk(record.content));
+            const addresses = records.filter((record) => record.type === 'A' || record.type === 'AAAA');
+            const invalidContent = addresses.some((record) => !pseudonymFormatOk(record.content));
             const pseudonyms = invalidContent
                 ? { ok: false, detail: 'invalid_output' }
-                : pseudonymizer.pseudonymizeAll(records.map((record) => record.content));
+                : pseudonymizer.pseudonymizeAll(addresses.map((record) => record.content));
+            let addressIndex = 0;
             pseudonymized.set(entry, {
                 kind: 'zone_dns_records',
                 zoneId,
                 result: pseudonyms.ok
-                    ? { ok: true, data: records.map((record, r) => ({ ...record, content: pseudonyms.data[r] })) }
+                    ? { ok: true, data: records.map((record) => record.type === 'CNAME' ? record : { ...record, content: pseudonyms.data[addressIndex++] }) }
                     : collectionFailedResult(pseudonyms.detail),
             });
         }
@@ -1554,6 +1632,10 @@ export function assembleSnapshot(input) {
             listed[entry.zoneId] = entry.result.data.map((head) => head.id);
     }
     const rank = new Map(expectedEntryKeys(accountId, zoneIds, listed).map((key, index) => [key, index]));
+    for (const zoneId of zoneIds) {
+        for (const kind of OPTIONAL_ZONE_KINDS)
+            rank.set(snapshotRequestKey(kind, { accountId, zoneId }), rank.size);
+    }
     const ordered = entries
         .map((entry, index) => ({ entry, index, rank: rank.get(snapshotEntryKey(entry, accountId)) ?? Number.MAX_SAFE_INTEGER }))
         .sort((a, b) => a.rank - b.rank || a.index - b.index)
@@ -1672,6 +1754,8 @@ export const LocalSnapshotResponseSchema = z.object({ success: z.literal(true),
     resultsUrl: z.url().max(2048).optional() });
 // Email verification in the CLI. Request bodies are strict: the server refuses fields it does not know.
 export const LocalRequestBodySchema = z.object({ email: z.string().min(3).max(254), locale: z.enum(LOCAL_EMAIL_LOCALES) }).strict();
+export const LocalIdentityBodySchema = z.object({ runId: z.uuid(), email: z.email().max(254),
+    proof: z.string().min(1).max(2048), locale: z.enum(LOCAL_EMAIL_LOCALES) }).strict();
 export const LocalVerifyBodySchema = z.object({ verification: z.string().regex(VERIFICATION_TOKEN_REGEX),
     code: z.string().regex(EMAIL_CODE_REGEX) }).strict();
 // `expiresAt` is when the emailed code (and so the token) stops working.

package/dist/local/cloudflare-checkup/email-verification.d.ts

@@ -45,7 +45,14 @@ export declare function emailLocale(env: NodeJS.ProcessEnv): LocalEmailLocale;
  * token, the emailed code and the session code out of `JSON.stringify` and
  * `util.inspect`.
  */
-export declare class VerifiedEmail {
+export interface VerifiedRequester {
+    readonly requester: string;
+    readonly sessionCode: string;
+    readonly expiresAt: string;
+    readonly renewable: boolean;
+    renew(): Promise<void>;
+}
+export declare class VerifiedEmail implements VerifiedRequester {
     #private;
     /** The masked address from vigilbase.com, safe to print. */
     readonly requester: string;

package/dist/local/cloudflare-checkup/email-verification.js

@@ -38,11 +38,6 @@ export function emailLocale(env) {
     const language = value.trim().toLowerCase();
     return language.startsWith('pt') ? 'pt-PT' : language.startsWith('ar') ? 'ar' : 'en';
 }
-/**
- * A verified email and the session code it earned. Private fields keep the
- * token, the emailed code and the session code out of `JSON.stringify` and
- * `util.inspect`.
- */
 export class VerifiedEmail {
     #client;
     #token;

package/dist/local/cloudflare-checkup/identity-verification.d.ts

@@ -0,0 +1,11 @@
+import type { CliConfig } from '../../lib/config.js';
+import type { LocalEmailLocale } from './contract.js';
+import type { VerifiedRequester } from './email-verification.js';
+import { type VerificationClient } from './submit-client.js';
+export declare function verifySignedInRequester(options: {
+    config: CliConfig;
+    client: VerificationClient;
+    locale: LocalEmailLocale;
+    email?: string;
+    warn(message: string): void;
+}): Promise<VerifiedRequester | null>;

package/dist/local/cloudflare-checkup/identity-verification.js

@@ -0,0 +1,65 @@
+/** Reuse the CLI login through a live, run-scoped proof from One. */
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { getOptionalOneAccessToken } from '../../auth/store.js';
+import { VigilbaseApiError } from '../../lib/client.js';
+import { VigilbaseOneClient } from '../../lib/one-client.js';
+import { LocalCheckupError } from './errors.js';
+import { displayRequester } from './submit-client.js';
+const IdentityProofSchema = z.object({ success: z.literal(true), identity: z.object({
+        runId: z.uuid(), email: z.email().max(254), proof: z.string().min(1).max(2048),
+    }) });
+class IdentityRequester {
+    #session;
+    #renewed = false;
+    #exchange;
+    constructor(session, exchange) {
+        this.#session = session;
+        this.#exchange = exchange;
+    }
+    get requester() { return displayRequester(this.#session.requester); }
+    get sessionCode() { return this.#session.code; }
+    get expiresAt() { return this.#session.expiresAt; }
+    get renewable() { return !this.#renewed; }
+    async renew() {
+        if (this.#renewed)
+            throw new LocalCheckupError('SESSION_EXPIRED', 'The checkup session expired again after it was renewed.');
+        this.#renewed = true;
+        this.#session = await this.#exchange();
+    }
+    toJSON() { return { requester: this.requester }; }
+}
+export async function verifySignedInRequester(options) {
+    const saved = await getOptionalOneAccessToken(options.config);
+    if (saved.problem)
+        options.warn(saved.problem);
+    if (!saved.accessToken)
+        return null;
+    const one = new VigilbaseOneClient(options.config, saved.accessToken, true);
+    const runId = randomUUID();
+    const proof = async () => {
+        const response = await one.requestJson('/api/tools/cloudflare-checkup/local-identity', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ runId }),
+        });
+        const parsed = IdentityProofSchema.safeParse(response);
+        if (!parsed.success || parsed.data.identity.runId !== runId) {
+            throw new LocalCheckupError('VERIFICATION_INVALID', 'One returned an invalid checkup identity proof.');
+        }
+        return parsed.data.identity;
+    };
+    let identity;
+    try {
+        identity = await proof();
+    }
+    catch (error) {
+        // A revoked or unverified login can still run the public email flow.
+        if (error instanceof VigilbaseApiError && [401, 403].includes(error.status))
+            return null;
+        throw error;
+    }
+    if (options.email && options.email.toLowerCase() !== identity.email.toLowerCase())
+        return null;
+    const exchange = async () => options.client.exchangeIdentity({ ...await proof(), locale: options.locale });
+    const session = await options.client.exchangeIdentity({ ...identity, locale: options.locale });
+    return new IdentityRequester(session, exchange);
+}

package/dist/local/cloudflare-checkup/snapshot-file.js

@@ -178,9 +178,21 @@ export function dataCategories(snapshot) {
                 for (const record of entry.result.data) {
                     if (record.name !== undefined)
                         categories.dnsHostnames++;
-                    ips.add(record.content);
+                    if (record.type === 'A' || record.type === 'AAAA')
+                        ips.add(record.content);
                 }
                 break;
+            case 'zone_certificate_packs':
+                for (const pack of entry.result.data) {
+                    categories.dnsHostnames += pack.hosts?.length ?? 0;
+                    for (const certificate of pack.certificates ?? [])
+                        categories.dnsHostnames += certificate.hosts?.length ?? 0;
+                }
+                break;
+            case 'zone_custom_certificates':
+                for (const certificate of entry.result.data)
+                    categories.dnsHostnames += certificate.hosts?.length ?? 0;
+                break;
             default:
                 break;
         }

package/dist/local/cloudflare-checkup/submit-client.d.ts

@@ -1,4 +1,4 @@
-import { type LocalAvailabilityResponse, type LocalRequestBody, type LocalRequestResponse, type LocalSessionResponse, type LocalVerifyBody, type LocalVerifyResponse } from './contract.js';
+import { type LocalIdentityBody, type LocalAvailabilityResponse, type LocalRequestBody, type LocalRequestResponse, type LocalSessionResponse, type LocalVerifyBody, type LocalVerifyResponse } from './contract.js';
 /**
  * `GET local-session`. The account is chosen in the CLI and bound by the
  * uploaded snapshot, so `accountId` is `null` until then; runs created before
@@ -67,6 +67,8 @@ declare abstract class LocalHttpClient {
  * the lost answer was to a wrong code does the retry cost a second try.
  */
 export declare class VerificationClient extends LocalHttpClient {
+    /** Only a signed, run-scoped email proof goes to Com; never the CLI login token. */
+    exchangeIdentity(body: LocalIdentityBody): Promise<VerifiedSession>;
     private postJson;
     /**
      * `GET local-session/availability`, before the email is asked for: what
@@ -97,8 +99,9 @@ export declare class SubmitClient extends LocalHttpClient {
     getSession(): Promise<LocalSession>;
     /**
      * `POST local-session/snapshot` with the exact file bytes. 503 and network
-     * errors are retried twice (after 2 s, then 5 s) with the same bytes, which
-     * the server treats idempotently. Challenges are never retried.
+     * errors are retried twice with the same bytes, which the server treats
+     * idempotently. Respect Retry-After up to 60 s; otherwise stop with the
+     * server's retry guidance. Without it, wait 2 s, then 5 s.
      */
     postSnapshot(bytes: Buffer, sha256: string): Promise<UploadResult>;
 }

package/dist/local/cloudflare-checkup/submit-client.js

@@ -1,5 +1,5 @@
 import { NetworkError, readBoundedBody } from '../../lib/network.js';
-import { CLI_VERSION_HEADER, LOCAL_AVAILABILITY_PATH, LOCAL_REQUEST_PATH, LOCAL_SESSION_PATH, LOCAL_SNAPSHOT_PATH, LOCAL_VERIFY_PATH, LocalAvailabilityResponseSchema, LocalErrorResponseSchema, LocalRequestBodySchema, LocalRequestResponseSchema, LocalSessionResponseSchema, LocalSnapshotResponseSchema, LocalVerifyBodySchema, LocalVerifyResponseSchema, PRODUCTION_ORIGIN, SESSION_CODE_REGEX, SNAPSHOT_SHA256_HEADER, compareSemver, } from './contract.js';
+import { CLI_VERSION_HEADER, LOCAL_AVAILABILITY_PATH, LOCAL_REQUEST_PATH, LOCAL_IDENTITY_PATH, LocalIdentityBodySchema, LOCAL_SESSION_PATH, LOCAL_SNAPSHOT_PATH, LOCAL_VERIFY_PATH, LocalAvailabilityResponseSchema, LocalErrorResponseSchema, LocalRequestBodySchema, LocalRequestResponseSchema, LocalSessionResponseSchema, LocalSnapshotResponseSchema, LocalVerifyBodySchema, LocalVerifyResponseSchema, PRODUCTION_ORIGIN, SESSION_CODE_REGEX, SNAPSHOT_SHA256_HEADER, compareSemver, } from './contract.js';
 import { LocalCheckupError, browserCheckupHint } from './errors.js';
 import { formatDuration } from './output.js';
 export const GET_TIMEOUT_MS = 30_000;
@@ -8,6 +8,7 @@ export const AVAILABILITY_TIMEOUT_MS = 10_000;
 export const POST_TIMEOUT_MS = 120_000;
 export const MAX_SUBMIT_RESPONSE_BYTES = 1024 * 1024;
 export const POST_RETRY_DELAYS_MS = [2_000, 5_000];
+const MAX_UPLOAD_RETRY_WAIT_MS = 60_000;
 /** A verify that failed on the network or with a 503 is sent once more, after this pause. */
 export const VERIFY_RETRY_DELAYS_MS = [2_000];
 function isLoopbackHost(hostname) {
@@ -249,6 +250,14 @@ class LocalHttpClient {
  * the lost answer was to a wrong code does the retry cost a second try.
  */
 export class VerificationClient extends LocalHttpClient {
+    /** Only a signed, run-scoped email proof goes to Com; never the CLI login token. */
+    async exchangeIdentity(body) {
+        const checked = LocalIdentityBodySchema.safeParse(body);
+        if (!checked.success)
+            throw new LocalCheckupError('VERIFICATION_INVALID', 'One returned an invalid checkup identity proof.');
+        const { response, text } = await this.postJson(LOCAL_IDENTITY_PATH, checked.data);
+        return parseSuccess(LocalVerifyResponseSchema, response, text, 'identity').session;
+    }
     async postJson(path, body) {
         const result = await this.request(path, {
             method: 'POST',
@@ -337,8 +346,9 @@ export class SubmitClient extends LocalHttpClient {
     }
     /**
      * `POST local-session/snapshot` with the exact file bytes. 503 and network
-     * errors are retried twice (after 2 s, then 5 s) with the same bytes, which
-     * the server treats idempotently. Challenges are never retried.
+     * errors are retried twice with the same bytes, which the server treats
+     * idempotently. Respect Retry-After up to 60 s; otherwise stop with the
+     * server's retry guidance. Without it, wait 2 s, then 5 s.
      */
     async postSnapshot(bytes, sha256) {
         for (let attempt = 0;; attempt++) {
@@ -373,7 +383,10 @@ export class SubmitClient extends LocalHttpClient {
             }
             const error = responseError(response, text, 'session', this.options.origin);
             if (response.status === 503 && error.code !== 'VIGILBASE_CHALLENGED' && error.code !== 'LOCAL_MODE_DISABLED' && attempt < POST_RETRY_DELAYS_MS.length) {
-                await this.sleep(POST_RETRY_DELAYS_MS[attempt]);
+                const requestedMs = (error.retryAfterSec ?? 0) * 1_000;
+                if (!Number.isFinite(requestedMs) || requestedMs > MAX_UPLOAD_RETRY_WAIT_MS)
+                    throw error;
+                await this.sleep(Math.max(POST_RETRY_DELAYS_MS[attempt], requestedMs));
                 continue;
             }
             throw error;

package/dist/local/cloudflare-checkup/terminal-ui.d.ts

@@ -15,6 +15,7 @@
  * ASCII-only console (the Linux console, legacy Windows consoles) gets no
  * character outside ASCII.
  */
+import { type CheckupReportView } from '../../lib/checkup-report.js';
 import { type Writer } from '../../lib/format.js';
 import { Tui, type SignalSource, type TtyInput, type TtyOutput } from '../../lib/tui.js';
 import type { CollectProgress } from './collector.js';
@@ -49,6 +50,8 @@ export type UploadSummary = {
     resultsUrl?: string;
     opening: boolean;
     requester: string;
+    /** The upload's locked free report, for the result card. */
+    report?: CheckupReportView;
 };
 export type CheckupTuiOptions = {
     mode: 'text' | 'json';
@@ -151,10 +154,14 @@ export declare class CheckupTui {
     }): Promise<boolean>;
     /** The upload and the scoring, which happen in one request. */
     uploading<T>(bytes: number, work: () => Promise<T>): Promise<T>;
+    /** Styles, symbols and width for the result card. */
+    private get palette();
     /**
-     * `└  ✓ Done. 10 passed · 2 failed`, the results link (underlined, an OSC 8
-     * link where supported) and the email note. `plainLines` are the plain
-     * result lines, also written to stdout when stdout is not a terminal.
+     * `└  ✓ Done. 10 passed · 2 failed`, the result card (a bar of the free
+     * checks, the top findings and the premium teaser), the results link
+     * (underlined, an OSC 8 link where supported) and the email note.
+     * `plainLines` are the plain result lines, also written to stdout when
+     * stdout is not a terminal.
      */
     uploaded(summary: UploadSummary, plainLines: readonly string[]): void;
     /** Dim lines under the end of the timeline (the logout hint), then the command on a line of its own. */

package/dist/local/cloudflare-checkup/terminal-ui.js

@@ -15,6 +15,7 @@
  * ASCII-only console (the Linux console, legacy Windows consoles) gets no
  * character outside ASCII.
  */
+import { localResultCard } from '../../lib/checkup-report.js';
 import { sanitizeTerminal } from '../../lib/format.js';
 import { Tui, displayWidth, markRendered, terminalFeatures } from '../../lib/tui.js';
 import { LocalCheckupError } from './errors.js';
@@ -331,10 +332,16 @@ export class CheckupTui {
             this.cancelMessage = 'Cancelled.';
         }
     }
+    /** Styles, symbols and width for the result card. */
+    get palette() {
+        return { style: this.tui.style, symbols: this.tui.symbols, color: this.tui.features.color, columns: this.tui.columns };
+    }
     /**
-     * `└  ✓ Done. 10 passed · 2 failed`, the results link (underlined, an OSC 8
-     * link where supported) and the email note. `plainLines` are the plain
-     * result lines, also written to stdout when stdout is not a terminal.
+     * `└  ✓ Done. 10 passed · 2 failed`, the result card (a bar of the free
+     * checks, the top findings and the premium teaser), the results link
+     * (underlined, an OSC 8 link where supported) and the email note.
+     * `plainLines` are the plain result lines, also written to stdout when
+     * stdout is not a terminal.
      */
     uploaded(summary, plainLines) {
         const { style, symbols } = this.tui;
@@ -346,6 +353,9 @@ export class CheckupTui {
         ].filter((part) => part !== null);
         const done = summary.replayed ? 'Already uploaded (same file); nothing changed.' : 'Done.';
         const lines = [`${style.green(symbols.end)}  ${style.green(symbols.check)} ${done}${counts.length ? ` ${this.join(counts)}` : ''}`];
+        const card = summary.report ? localResultCard(this.palette, summary.report) : [];
+        if (card.length)
+            lines.push(...card, '');
         const requester = sanitizeTerminal(summary.requester);
         if (summary.resultsUrl !== undefined) {
             const link = style.underline(this.tui.link(summary.resultsUrl));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vigilbase/cli",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Vigilbase CLI — security scanners, agent tools, and Vigilbase One from the terminal.",
   "keywords": [
     "vigilbase",