securenow 8.11.2 → 8.11.3

package/cli/security.js

@@ -1,1856 +1,1866 @@
-'use strict';
-
-const fs = require('fs');
-const { api, requireAuth } = require('./client');
-const config = require('./config');
-const ui = require('./ui');
-
-function resolveApp(flags) {
-  return flags.app || config.getDefaultApp();
-}
-
-function resolveEnvironment(flags, fallback = null) {
-  return flags.env || flags.environment || fallback;
-}
-
-// ── Alert Rules ──
-
-function formatRuleApplicationsCell(rule) {
-  if (rule.applicationsAll) {
-    return ui.c.cyan('all apps');
-  }
-  const keys = rule.applications || [];
-  if (keys.length === 0) return ui.c.dim('—');
-  const joined = keys.join(', ');
-  return joined.length > 48 ? `${joined.slice(0, 45)}…` : joined;
-}
-
-function ruleStatusBadge(rule) {
-  const st = rule.status || (rule.enabled !== false ? 'Active' : 'Disabled');
-  if (st === 'Active') return ui.statusBadge('active');
-  if (st === 'Disabled') return ui.statusBadge('disabled');
-  if (st === 'Paused') return ui.statusBadge('paused');
-  return st;
-}
-
-/** Dispatch: list | show <id> | update <id> ... */
-async function alertRulesRoute(args, flags) {
-  const sub = args[0];
-  if (sub === 'create' || sub === 'add') {
-    return alertRuleCreate(args.slice(1), flags);
-  }
-  if (sub === 'show') {
-    return alertRuleShow(args.slice(1), flags);
-  }
-  if (sub === 'update') {
-    return alertRuleUpdate(args.slice(1), flags);
-  }
-  if (sub === 'set-sql' || sub === 'edit-sql') {
-    return alertRuleSetSql(args.slice(1), flags);
-  }
-  if (sub === 'versions' || sub === 'history') {
-    return alertRuleVersions(args.slice(1), flags);
-  }
-  if (sub === 'version') {
-    return alertRuleVersionShow(args.slice(1), flags);
-  }
-  if (sub === 'rollback' || sub === 'revert') {
-    return alertRuleRollback(args.slice(1), flags);
-  }
-  if (sub === 'delete' || sub === 'rm' || sub === 'remove') {
-    return alertRuleDelete(args.slice(1), flags);
-  }
-  if (sub === 'duplicate' || sub === 'clone') {
-    return alertRuleDuplicate(args.slice(1), flags);
-  }
-  if (sub === 'test') {
-    return alertRuleTest(args.slice(1), flags);
-  }
-  if (sub === 'dry-run-query' || sub === 'candidate-test' || sub === 'validate') {
-    return alertRuleCandidateTest(args.slice(1), flags);
-  }
-  if (sub === 'tune-query' || sub === 'query-update') {
-    return alertRuleQueryUpdate(args.slice(1), flags);
-  }
-  if (sub === 'exclusions') {
-    return alertRuleExclusions(args.slice(1), flags);
-  }
-  if (sub === 'promote') {
-    return alertRuleSetMode(args.slice(1), flags, 'prod');
-  }
-  if (sub === 'demote') {
-    return alertRuleSetMode(args.slice(1), flags, 'test');
-  }
-  if (sub === 'list') {
-    return alertRulesList(args.slice(1), flags);
-  }
-  return alertRulesList(args, flags);
-}
-
-// Promote (test -> prod) or demote (prod -> test) one or more rules. In test mode a
-// rule detects only — instant.block, automations, and the autonomous operator all
-// skip its notifications. Promoting to prod makes those mitigations eligible.
-async function alertRuleSetMode(args, flags, mode) {
-  requireAuth();
-  const ids = args.filter(Boolean);
-  const verb = mode === 'prod' ? 'promote' : 'demote';
-  if (ids.length === 0) {
-    ui.error(`Usage: securenow alerts rules ${verb} <rule-id> [<rule-id> ...] [--yes]`);
-    process.exit(1);
-  }
-  if (mode === 'prod' && !flags.yes && !flags.force) {
-    ui.warn('Promoting to prod ARMS automatic mitigation (instant.block, automations, autonomous operator) for matching detections.');
-    const ok = await ui.confirm(`Promote ${ids.length} rule${ids.length !== 1 ? 's' : ''} to prod (mitigations become eligible)?`);
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  let okCount = 0;
-  const failures = [];
-  for (const id of ids) {
-    const s = ui.spinner(`${mode === 'prod' ? 'Promoting' : 'Demoting'} ${id}`);
-    try {
-      await api.put(`/alert-rules/${id}`, { mode });
-      s.stop(`${ui.truncate(id, 12)} → ${mode}`);
-      okCount++;
-    } catch (err) {
-      s.fail(`Failed on ${ui.truncate(id, 12)}: ${err.message}`);
-      failures.push(id);
-    }
-  }
-  if (flags.json) { ui.json({ mode, updated: okCount, failed: failures }); return; }
-  console.log('');
-  ui.success(`${okCount}/${ids.length} rule${ids.length !== 1 ? 's' : ''} set to ${mode}.`);
-  if (mode === 'prod') ui.info('Enable the matching automations to let mitigations act. Reverse anytime: securenow alerts rules demote <id>');
-  else ui.info('Detect-only — no mitigation will act. Promote when confident: securenow alerts rules promote <id>');
-}
-
-// Duplicate any rule (including a read-only system template) into a new CUSTOM rule you
-// own. System rules are view-only examples — fork one with this to enable / edit it. The
-// copy defaults to Disabled (opt in with --enable / --status active); SQL, instant.block,
-// schedule, scope, and mode are copied from the source.
-async function alertRuleDuplicate(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules duplicate <rule-id> [--enable] [--status active|disabled|paused] [--name "..."] [--mode test|prod]');
-    process.exit(1);
-  }
-  const body = {};
-  if (flags.enable) body.status = 'Active';
-  else if (flags.disable) body.status = 'Disabled';
-  else if (flags.pause) body.status = 'Paused';
-  else if (flags.status) {
-    const s = String(flags.status).toLowerCase();
-    body.status = s === 'active' ? 'Active' : s === 'paused' ? 'Paused' : 'Disabled';
-  }
-  if (flags.name) body.name = String(flags.name);
-  if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
-
-  const spin = ui.spinner(`Duplicating ${ui.truncate(id, 12)}`);
-  let data;
-  try {
-    data = await api.post(`/alert-rules/${id}/duplicate`, body);
-    spin.stop('Duplicated');
-  } catch (err) {
-    spin.fail(`Failed to duplicate: ${err.message}`);
-    process.exit(1);
-  }
-
-  if (flags.json) { ui.json(data); return; }
-  const r = data.alertRule || {};
-  const newId = r.id || r._id || '';
-  console.log('');
-  ui.success(`Created custom rule ${newId}`);
-  console.log(`  Name        ${r.name || ''}`);
-  console.log(`  Status      ${r.status || ''}`);
-  console.log(`  Mode        ${r.mode || ''}`);
-  console.log(`  Exec mode   ${r.executionMode || ''}`);
-  console.log(`  Custom      ${r.isSystem ? 'NO — still a system rule (unexpected)' : 'yes (editable / enable-able)'}`);
-  if (data.duplicatedFromSystem) ui.info('Forked from a read-only system template — edit or enable this custom copy freely.');
-  if (r.status !== 'Active') ui.info(`Disabled by default. Enable with: securenow alerts rules update ${newId} --enable`);
-}
-
-async function alertRulesList(args, flags) {
-  requireAuth();
-  // Server-side filters (API supports ?mode/status/active/isSystem).
-  const query = {};
-  if (flags.mode === 'test' || flags.mode === 'prod') query.mode = flags.mode;
-  if (['Active', 'Disabled', 'Paused'].includes(flags.status)) query.status = flags.status;
-  if (flags.active === true || flags.active === 'true') query.active = 'true';
-  else if (flags.active === false || flags.active === 'false') query.active = 'false';
-  if (flags.system === true || flags.system === 'true') query.isSystem = 'true';
-  else if (flags.user === true || flags.user === 'true') query.isSystem = 'false';
-
-  const s = ui.spinner('Fetching alert rules');
-  try {
-    const data = await api.get('/alert-rules', Object.keys(query).length ? { query } : undefined);
-    const rules = data.alertRules || [];
-    s.stop(`Found ${rules.length} rule${rules.length !== 1 ? 's' : ''}`);
-
-    if (flags.json) { ui.json(rules); return; }
-
-    console.log('');
-    const rows = rules.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
-      r.name || '—',
-      ruleStatusBadge(r),
-      r.mode === 'test' ? ui.c.yellow('test') : ui.c.dim('prod'),
-      formatRuleApplicationsCell(r),
-      r.schedule?.enabled === false ? ui.c.dim('off') : (r.schedule?.description || r.schedule?.cronExpression || '—'),
-    ]);
-    ui.table(['ID', 'Name', 'Status', 'Mode', 'Applications', 'Schedule'], rows);
-    console.log('');
-    console.log(ui.c.dim('  Filters: --mode test|prod  --status Active|Disabled|Paused  --active true|false  --system|--user'));
-    console.log(ui.c.dim('  Mode: test = detect-only (no mitigation, human review).  Promote: securenow alerts rules promote <id>'));
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch alert rules');
-    throw err;
-  }
-}
-
-async function alertRuleCreate(args, flags) {
-  requireAuth();
-  const name = flags.name;
-  const usage = 'Usage: securenow alerts rules create --name "..." --sql <sql|@file|-> (--applications-all | --apps k1,k2) '
-    + '[--severity critical|high|medium|low] [--schedule "*/15 * * * *"] [--throttle-minutes 15 | --no-throttle] '
-    + '[--description "..."] [--nlp "plain-English intent"] [--category custom] [--channel id1,id2] [--query-mapping-id <id>]';
-  if (!name) {
-    ui.error(usage);
-    process.exit(1);
-  }
-
-  const queryMappingId = flags['query-mapping-id'] || flags.queryMappingId;
-  const sqlQuery = readSqlArg(flags);
-  if (!queryMappingId && !sqlQuery) {
-    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>).');
-    console.log(ui.c.dim('  Scope app keys in SQL with the __USER_APP_KEYS__ placeholder, e.g.'));
-    console.log(ui.c.dim("  ...WHERE resource_string_service$$name IN (__USER_APP_KEYS__) ..."));
-    process.exit(1);
-  }
-
-  const hasAll = flags['applications-all'] === true || flags['applications-all'] === 'true';
-  const appsStr = flags.apps || flags.app;
-  if (!hasAll && !appsStr) {
-    ui.error('Scope the rule with --applications-all or --apps key1,key2');
-    process.exit(1);
-  }
-
-  const body = { name };
-  if (flags.description) body.description = flags.description;
-  if (queryMappingId) body.queryMappingId = queryMappingId;
-  else body.sqlQuery = sqlQuery;
-  if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
-  if (flags.category) body.category = flags.category;
-  if (flags.severity) body.severity = String(flags.severity).toLowerCase();
-  if (flags['execution-mode']) body.executionMode = flags['execution-mode'];
-
-  if (hasAll) {
-    body.applicationsAll = true;
-    body.applications = [];
-  } else {
-    body.applicationsAll = false;
-    body.applications = String(appsStr).split(',').map((x) => x.trim()).filter(Boolean);
-    if (body.applications.length === 0) {
-      ui.error('No application keys parsed from --apps');
-      process.exit(1);
-    }
-  }
-
-  const cron = flags.schedule || flags.cron;
-  if (cron) {
-    body.schedule = {
-      enabled: true,
-      cronExpression: cron,
-      description: flags['schedule-description'] || cron,
-    };
-  }
-  if (flags['no-throttle']) body.throttle = { enabled: false, minutes: 0 };
-  else if (flags['throttle-minutes']) body.throttle = { enabled: true, minutes: Number(flags['throttle-minutes']) };
-
-  const channelStr = flags.channel || flags.channels;
-  if (channelStr) {
-    body.alertChannelIds = String(channelStr).split(',').map((x) => x.trim()).filter(Boolean);
-  }
-
-  const s = ui.spinner('Creating alert rule');
-  let createdId = null;
-  try {
-    const data = await api.post('/alert-rules', body);
-    const r = data.alertRule || data;
-    createdId = r._id || r.id || null;
-    s.stop('Alert rule created');
-
-    // Transactional safety: `create` only runs scope/safety validation, not a real
-    // query execution — so a query that is valid-but-wrong (e.g. an unknown column)
-    // is accepted and would silently never fire. Custom-rule SQL also can't be
-    // patched via the API, so a broken rule would be stuck. We therefore dry-run the
-    // new scheduled rule and roll it back (delete) on a hard query failure, unless
-    // --no-validate is passed. A "complete" dry-run with 0 rows is healthy, not a failure.
-    const scheduled = r.executionMode !== 'instant' && r.schedule?.enabled !== false;
-    if (createdId && scheduled && !flags['no-validate']) {
-      const v = await validateRuleById(createdId, flags);
-      if (v && v.status === 'failed') {
-        const rolledBack = await api.delete(`/alert-rules/${createdId}`).then(() => true).catch(() => false);
-        ui.error(`Rule query failed validation and was ${rolledBack ? 'rolled back (deleted)' : 'left in place (auto-delete failed — remove it manually)'}:`);
-        ui.error(`  ${v.error || 'unknown query error'}`);
-        ui.info('Fix the SQL and re-create, or validate first: securenow alerts rules validate --sql @rule.sql --app <key>');
-        process.exit(1);
-      }
-    }
-
-    if (flags.json) { ui.json(data); return; }
-    console.log('');
-    ui.keyValue([
-      ['ID', createdId || '-'],
-      ['Name', r.name || '-'],
-      ['Status', r.status || '-'],
-      ['Mode', r.executionMode || 'scheduled'],
-      ['Severity', r.severity || '-'],
-      ['Applications', r.applicationsAll ? 'all apps' : ((r.applications || []).join(', ') || '-')],
-      ['Schedule', r.schedule?.enabled === false ? 'disabled' : (r.schedule?.description || r.schedule?.cronExpression || '-')],
-      ['Throttle', r.throttle?.enabled ? `${r.throttle.minutes} min` : 'off'],
-      ['Query', r.queryMappingId?.name || r.queryMappingId || '-'],
-      ['Validation', flags['no-validate'] ? 'skipped' : 'dry-run clean'],
-    ]);
-    console.log('');
-    ui.success(`Created. View it with: securenow alerts rules show ${createdId}`);
-  } catch (err) {
-    s.fail('Failed to create alert rule');
-    throw err;
-  }
-}
-
-async function alertRuleShow(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules show <rule-id>');
-    process.exit(1);
-  }
-  const s = ui.spinner('Fetching alert rule');
-  try {
-    const data = await api.get(`/alert-rules/${id}`);
-    const r = data.alertRule;
-    s.stop('');
-
-    if (flags.json) {
-      ui.json(r);
-      return;
-    }
-
-    console.log('');
-    ui.heading(r.name || 'Alert rule');
-    console.log('');
-    const appLine = r.applicationsAll
-      ? 'All applications (current & future)'
-      : (r.applications && r.applications.length > 0 ? r.applications.join(', ') : '—');
-    ui.keyValue([
-      ['ID', r._id || r.id || id],
-      ['Status', r.status || '—'],
-      ['Mode', r.mode === 'test' ? ui.c.yellow('test (detect-only, no mitigation)') : (r.mode || 'prod')],
-      ['System rule', r.isSystem ? 'yes' : 'no'],
-      ['Applications', appLine],
-      ['Schedule', r.schedule?.enabled === false ? 'disabled' : (r.schedule?.description || r.schedule?.cronExpression || '—')],
-      ['Throttle', r.throttle?.enabled ? `${r.throttle.minutes} min` : 'off'],
-      ['Query', r.queryMappingId?.name || '—'],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch alert rule');
-    throw err;
-  }
-}
-
-async function alertRuleUpdate(args, flags) {
-  requireAuth();
-  // `update <id> --sql ...` is an alias for set-sql so SQL edits and scope edits
-  // share one verb. set-sql handles its own validation/feedback.
-  if (flags.sql || flags.query || flags.file) {
-    return alertRuleSetSql(args, flags);
-  }
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules update <rule-id> [--applications-all | --apps <k1,k2>] [--status Active|Disabled|Paused | --enable | --disable | --pause] [--mode test|prod]');
-    process.exit(1);
-  }
-
-  const hasAll =
-    flags['applications-all'] === true ||
-    flags['applications-all'] === 'true';
-  const hasNoAll =
-    flags['no-applications-all'] === true ||
-    flags['no-applications-all'] === 'true';
-  const appsStr = flags.apps;
-
-  if (hasAll && hasNoAll) {
-    ui.error('Use only one of --applications-all or --no-applications-all');
-    process.exit(1);
-  }
-  if (hasAll && appsStr) {
-    ui.error('Cannot combine --applications-all with --apps');
-    process.exit(1);
-  }
-
-  const body = {};
-  if (hasAll) {
-    body.applicationsAll = true;
-    body.applications = [];
-  } else if (hasNoAll || appsStr) {
-    body.applicationsAll = false;
-    if (!appsStr) {
-      ui.error('Pass --apps key1,key2 when using --no-applications-all, or omit --no-applications-all and use --apps only');
-      process.exit(1);
-    }
-    body.applications = String(appsStr)
-      .split(',')
-      .map((x) => x.trim())
-      .filter(Boolean);
-    if (body.applications.length === 0) {
-      ui.error('No application keys parsed from --apps');
-      process.exit(1);
-    }
-  }
-
-  // Status: --status X, or convenience --enable / --disable / --pause.
-  let status = null;
-  if (flags.enable === true || flags.enable === 'true') status = 'Active';
-  else if (flags.disable === true || flags.disable === 'true') status = 'Disabled';
-  else if (flags.pause === true || flags.pause === 'true') status = 'Paused';
-  else if (flags.status) {
-    const match = ['Active', 'Disabled', 'Paused'].find((x) => x.toLowerCase() === String(flags.status).toLowerCase());
-    if (!match) { ui.error('--status must be Active, Disabled, or Paused'); process.exit(1); }
-    status = match;
-  }
-  if (status) body.status = status;
-
-  // Lifecycle mode promote/demote (also available as: alerts rules promote|demote <id>).
-  if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
-
-  if (Object.keys(body).length === 0) {
-    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), or --mode test|prod (or: alerts rules promote/demote <id>).');
-    process.exit(1);
-  }
-
-  const s = ui.spinner('Updating alert rule');
-  try {
-    await api.put(`/alert-rules/${id}`, body);
-    s.stop('Updated');
-    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`].filter(Boolean);
-    ui.success('Alert rule updated' + (extras.length ? ` (${extras.join(', ')})` : ''));
-  } catch (err) {
-    s.fail('Failed to update alert rule');
-    throw err;
-  }
-}
-
-async function alertRuleSetSql(args, flags) {
-  requireAuth();
-  const id = args[0];
-  const sqlQuery = readSqlArg(flags);
-  if (!id || !sqlQuery) {
-    ui.error('Usage: securenow alerts rules set-sql <rule-id> --sql <sql|@file|-> [--nlp "intent"] [--no-validate]');
-    process.exit(1);
-  }
-  const body = { sqlQuery };
-  if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
-  if (flags.category) body.category = flags.category;
-
-  const s = ui.spinner('Updating rule SQL');
-  try {
-    const data = await api.put(`/alert-rules/${id}`, body);
-    s.stop('Rule SQL updated');
-    const ok = flags['no-validate'] ? null : await validateRuleById(id, flags);
-    if (ok && ok.status === 'failed') {
-      ui.warn(`Saved, but the new SQL failed a dry-run: ${ok.error || 'unknown error'}`);
-      ui.info('Fix the SQL and run set-sql again, or delete the rule with: securenow alerts rules delete ' + id);
-    } else if (ok) {
-      ui.success('Saved and dry-run clean.');
-    }
-    if (flags.json) ui.json(data);
-  } catch (err) {
-    s.fail('Failed to update rule SQL');
-    throw err;
-  }
-}
-
-// List a rule's configuration version history (newest first). Each material update (SQL,
-// instant config, settings), duplicate, and rollback is a version; rollback restores a
-// prior snapshot and is itself recorded as a new version.
-async function alertRuleVersions(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules versions <rule-id> [--limit N] [--page N]');
-    process.exit(1);
-  }
-  const query = {};
-  if (flags.limit) query.limit = flags.limit;
-  if (flags.page) query.page = flags.page;
-  const s = ui.spinner('Fetching version history');
-  let data;
-  try {
-    data = await api.get(`/alert-rules/${id}/versions`, Object.keys(query).length ? { query } : undefined);
-    s.stop(`Found ${data.total ?? (data.versions || []).length} version${(data.total ?? 0) === 1 ? '' : 's'}`);
-  } catch (err) {
-    s.fail(`Failed to fetch versions: ${err.message}`);
-    process.exit(1);
-  }
-  if (flags.json) { ui.json(data); return; }
-  const rows = data.versions || [];
-  if (rows.length === 0) { ui.info('No versions recorded yet.'); return; }
-  console.log('');
-  ui.info(`Current: v${data.currentVersion}`);
-  for (const v of rows) {
-    const marker = v.isCurrent ? ui.c.green('→') : ' ';
-    const when = v.createdAt ? new Date(v.createdAt).toISOString().replace('T', ' ').slice(0, 19) : '';
-    const extra = v.changeType === 'rollback' && v.rolledBackFrom ? ` (from v${v.rolledBackFrom})` : '';
-    console.log(`${marker} ${ui.c.bold('v' + v.version).padEnd(14)} ${String(v.changeType + extra).padEnd(22)} ${ui.c.dim(when)}  ${v.createdByName || ''}`);
-    if (v.reason) console.log(`     ${ui.c.dim(ui.truncate(v.reason, 90))}`);
-  }
-  console.log('');
-  ui.info(`Show: securenow alerts rules version ${ui.truncate(id, 12)} <n>   |   Roll back: securenow alerts rules rollback ${ui.truncate(id, 12)} <n>`);
-}
-
-// Show one version's full material snapshot (diff-able SQL / instant / settings).
-async function alertRuleVersionShow(args, flags) {
-  requireAuth();
-  const id = args[0];
-  const version = args[1];
-  if (!id || !version) {
-    ui.error('Usage: securenow alerts rules version <rule-id> <version-number>');
-    process.exit(1);
-  }
-  const s = ui.spinner(`Fetching v${version}`);
-  let data;
-  try {
-    data = await api.get(`/alert-rules/${id}/versions/${version}`);
-    s.stop(`Loaded v${version}`);
-  } catch (err) {
-    s.fail(`Failed: ${err.message}`);
-    process.exit(1);
-  }
-  if (flags.json) { ui.json(data); return; }
-  const v = data.version || {};
-  const snap = v.snapshot || {};
-  console.log('');
-  ui.success(`v${v.version}${v.isCurrent ? ' (current)' : ''} — ${v.changeType}`);
-  console.log(`  When     ${v.createdAt || ''}`);
-  if (v.createdByName) console.log(`  By       ${v.createdByName}`);
-  if (v.reason) console.log(`  Reason   ${v.reason}`);
-  if (v.rolledBackFrom) console.log(`  Restored v${v.rolledBackFrom}`);
-  console.log('');
-  console.log(`  Name     ${snap.name || ''}`);
-  console.log(`  Mode     ${snap.mode || ''} / ${snap.executionMode || ''}   severity ${snap.severity || '-'}`);
-  if (snap.instant && snap.instant.enabled) {
-    console.log(`  Instant  enabled  block=${snap.instant.block}  (${(snap.instant.conditions || []).length} condition${(snap.instant.conditions || []).length === 1 ? '' : 's'})`);
-  }
-  if (snap.query && snap.query.sqlQuery) {
-    console.log('  SQL:');
-    console.log(snap.query.sqlQuery.split('\n').map((l) => '    ' + ui.c.dim(l)).join('\n'));
-  }
-}
-
-// Roll a rule back to a prior version — restores that version's full snapshot and records it
-// as a new version (append-only history). System (read-only template) rules can't be rolled back.
-async function alertRuleRollback(args, flags) {
-  requireAuth();
-  const id = args[0];
-  const version = args[1] || flags.version;
-  if (!id || !version) {
-    ui.error('Usage: securenow alerts rules rollback <rule-id> <version-number> [--reason "..."] [--yes]');
-    process.exit(1);
-  }
-  if (!flags.yes && !flags.force) {
-    const ok = await ui.confirm(`Roll back rule ${ui.truncate(id, 12)} to v${version}? Restores that config and creates a new version.`);
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  const body = { version: Number(version) };
-  if (flags.reason) body.reason = String(flags.reason);
-  const s = ui.spinner(`Rolling back to v${version}`);
-  let data;
-  try {
-    data = await api.post(`/alert-rules/${id}/rollback`, body);
-    s.stop(`Rolled back to v${version}`);
-  } catch (err) {
-    s.fail(`Failed to roll back: ${err.message}`);
-    process.exit(1);
-  }
-  if (flags.json) { ui.json(data); return; }
-  ui.success(`Restored from v${data.rolledBackFrom} → now at v${data.newVersion}`);
-  ui.info(`History: securenow alerts rules versions ${ui.truncate(id, 12)}`);
-}
-
-async function alertRuleDelete(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules delete <rule-id> [--yes]');
-    process.exit(1);
-  }
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm(`Delete alert rule ${id}? This cannot be undone (system rules can only be disabled).`);
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  const s = ui.spinner('Deleting alert rule');
-  try {
-    const data = await api.delete(`/alert-rules/${id}`);
-    s.stop('Alert rule deleted');
-    if (flags.json) { ui.json(data); return; }
-    ui.success(`Deleted alert rule ${id}`);
-  } catch (err) {
-    s.fail('Failed to delete alert rule');
-    throw err;
-  }
-}
-
-// Run a dry-run test of an existing rule and return { status, error, resultCount }.
-// Used to validate a rule after create/set-sql. Never throws — returns null on error.
-async function validateRuleById(id, flags = {}) {
-  try {
-    let data = await api.post(`/alert-rules/${id}/test`, { mode: 'dry_run' });
-    if (data.testId) {
-      for (let i = 0; i < 40; i++) {
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
-        if (['complete', 'failed'].includes(data.status)) break;
-      }
-    }
-    return { status: data.status, error: data.error, resultCount: data.resultCount };
-  } catch {
-    return null;
-  }
-}
-
-// Pick an existing rule id to host a candidate dry-run (the test endpoint needs a
-// rule to attach the candidate SQL to). Prefer a system rule (always present on
-// provisioned accounts and never mutated by a dry-run).
-async function resolveHostRuleId() {
-  const data = await api.get('/alert-rules');
-  const rules = data.alertRules || data.rules || [];
-  if (!rules.length) return null;
-  const sys = rules.find((r) => r.isSystem);
-  return (sys || rules[0])._id || (sys || rules[0]).id || null;
-}
-
-function readSqlArg(flags) {
-  const raw = flags.sql || flags.query || flags.file;
-  if (!raw) return null;
-  if (flags.file) return fs.readFileSync(flags.file, 'utf8');
-  const text = String(raw);
-  if (text === '-') return fs.readFileSync(0, 'utf8');
-  if (text.startsWith('@')) return fs.readFileSync(text.slice(1), 'utf8');
-  return text;
-}
-
-async function alertRuleTest(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow alerts rules test <rule-id> [--app <key>] [--mode dry_run] [--wait]');
-    process.exit(1);
-  }
-
-  const body = {};
-  if (flags.app) body.applicationKey = flags.app;
-  if (flags.mode) body.mode = flags.mode;
-  const s = ui.spinner('Starting alert rule test');
-  try {
-    let data = await api.post(`/alert-rules/${id}/test`, body);
-    if (flags.wait && data.testId) {
-      s.update('Waiting for alert rule test results');
-      for (let i = 0; i < 40; i++) {
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
-        if (['complete', 'failed'].includes(data.status)) break;
-      }
-    }
-    s.stop('Alert rule test ready');
-    if (flags.json) { ui.json(data); return; }
-    console.log('');
-    ui.keyValue([
-      ['Test ID', data.testId || '-'],
-      ['Mode', data.mode || body.mode || 'live'],
-      ['Status', data.status || '-'],
-      ['Result count', String(data.resultCount ?? '-')],
-      ['Error', data.error || '-'],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to test alert rule');
-    throw err;
-  }
-}
-
-async function alertRuleCandidateTest(args, flags) {
-  requireAuth();
-  let id = args[0];
-  const candidateSqlQuery = readSqlArg(flags);
-  if (!candidateSqlQuery) {
-    ui.error('Usage: securenow alerts rules validate --sql <sql|@file|-> [--app <key>]   (or dry-run-query <rule-id> --sql ...)');
-    process.exit(1);
-  }
-  // The test endpoint attaches the candidate SQL to an existing rule. When no
-  // rule id is given, auto-pick a host so a candidate can be validated before any
-  // rule exists for it (every provisioned account has system rules to host on).
-  if (!id) {
-    id = await resolveHostRuleId();
-    if (!id) {
-      ui.error('No existing rule to host the dry-run. Create one rule first, or pass <rule-id>.');
-      process.exit(1);
-    }
-  }
-  // `validate` is meant to return a verdict, so wait for the result by default.
-  const wait = flags.wait || flags['no-wait'] !== true;
-
-  const body = { mode: 'dry_run', candidateSqlQuery };
-  if (flags.app) body.applicationKey = flags.app;
-
-  const s = ui.spinner('Starting candidate SQL dry-run');
-  try {
-    let data = await api.post(`/alert-rules/${id}/test`, body);
-    if (wait && data.testId) {
-      s.update('Waiting for candidate SQL dry-run results');
-      for (let i = 0; i < 40; i++) {
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
-        if (['complete', 'failed'].includes(data.status)) break;
-      }
-    }
-    s.stop('Candidate dry-run ready');
-    if (flags.json) { ui.json(data); return; }
-    console.log('');
-    ui.keyValue([
-      ['Test ID', data.testId || '-'],
-      ['Status', data.status || '-'],
-      ['Candidate', data.candidate ? 'yes' : 'no'],
-      ['Current SQL hash', data.currentSqlHash || '-'],
-      ['Candidate SQL hash', data.candidateSqlHash || '-'],
-      ['Result count', String(data.resultCount ?? '-')],
-      ['Error', data.error || '-'],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to dry-run candidate SQL');
-    throw err;
-  }
-}
-
-async function alertRuleQueryUpdate(args, flags) {
-  requireAuth();
-  const id = args[0];
-  const sqlQuery = readSqlArg(flags);
-  const reason = flags.reason;
-  if (!id || !sqlQuery || !reason) {
-    ui.error('Usage: securenow alerts rules tune-query <rule-id> --sql <sql|@file|-> --reason "..." --apply-globally --yes');
-    process.exit(1);
-  }
-  if (!flags['apply-globally'] && flags.applyGlobally !== true) {
-    ui.error('System query tuning requires --apply-globally.');
-    process.exit(1);
-  }
-
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Update the shared system query mapping for all customer copies?');
-    if (!ok) {
-      ui.info('Cancelled');
-      return;
-    }
-  }
-
-  const body = {
-    sqlQuery,
-    reason,
-    applyGlobally: true,
-    reactivatePausedCopies: !!(flags['reactivate-paused'] || flags.reactivatePausedCopies),
-  };
-  if (flags['expected-hash']) body.expectedCurrentSqlHash = flags['expected-hash'];
-  if (flags.notification) body.reviewNotificationId = flags.notification;
-  if (flags.note) body.reviewNote = flags.note;
-
-  const s = ui.spinner('Updating system query mapping');
-  try {
-    const data = await api.put(`/alert-rules/${id}/query-mapping`, body);
-    s.stop('System query mapping updated');
-    if (flags.json) { ui.json(data); return; }
-    console.log('');
-    ui.keyValue([
-      ['Query mapping', data.queryMapping?.name || data.queryMapping?.id || '-'],
-      ['Previous SQL hash', data.queryMapping?.previousSqlHash || '-'],
-      ['New SQL hash', data.queryMapping?.newSqlHash || '-'],
-      ['Affected system rules', String(data.affectedSystemRules ?? '-')],
-      ['Reactivated paused copies', data.reactivatedPausedCopies ? 'yes' : 'no'],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to update system query mapping');
-    throw err;
-  }
-}
-
-async function alertRuleExclusions(args, flags) {
-  requireAuth();
-  const id = args[0];
-  const action = args[1] || 'list';
-  if (!id) {
-    ui.error('Usage: securenow alerts rules exclusions <rule-id> [list|add|delete] [exclusion-id]');
-    process.exit(1);
-  }
-
-  try {
-    if (action === 'add') {
-      const body = {};
-      if (flags.conditions) body.conditions = JSON.parse(flags.conditions);
-      if (flags['match-mode']) body.matchMode = flags['match-mode'];
-      if (flags.reason) body.reason = flags.reason;
-      if (flags.path) body.pathPattern = flags.path;
-      const data = await api.post(`/alert-rules/${id}/exclusions`, body);
-      if (flags.json) { ui.json(data); return; }
-      ui.success('Exclusion added');
-      return;
-    }
-
-    if (action === 'delete' || action === 'remove') {
-      const exclusionId = args[2];
-      if (!exclusionId) {
-        ui.error('Exclusion id required.');
-        process.exit(1);
-      }
-      const data = await api.delete(`/alert-rules/${id}/exclusions/${exclusionId}`);
-      if (flags.json) { ui.json(data); return; }
-      ui.success('Exclusion removed');
-      return;
-    }
-
-    const data = await api.get(`/alert-rules/${id}/exclusions`);
-    const exclusions = data.exclusions || [];
-    if (flags.json) { ui.json(data); return; }
-    console.log('');
-    const rows = exclusions.map((e) => [
-      ui.c.dim(ui.truncate(e._id, 12)),
-      e.isActive === false ? ui.statusBadge('disabled') : ui.statusBadge('active'),
-      e.matchMode || 'all',
-      ui.truncate(e.reason || e.pathPattern || JSON.stringify(e.conditions || []), 72),
-    ]);
-    ui.table(['ID', 'Status', 'Mode', 'Reason/Pattern'], rows);
-    console.log('');
-  } catch (err) {
-    throw err;
-  }
-}
-
-// ── Alert Channels ──
-
-async function alertChannelsList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching alert channels');
-  try {
-    const data = await api.get('/alert-channels');
-    const channels = data.alertChannels || [];
-    s.stop(`Found ${channels.length} channel${channels.length !== 1 ? 's' : ''}`);
-
-    if (flags.json) { ui.json(channels); return; }
-
-    console.log('');
-    const rows = channels.map(ch => [
-      ui.c.dim(ui.truncate(ch._id, 12)),
-      ch.name || '—',
-      ch.type || '—',
-      ui.statusBadge(ch.enabled !== false ? 'enabled' : 'disabled'),
-      ch.target || ch.email || ch.webhookUrl || '—',
-    ]);
-    ui.table(['ID', 'Name', 'Type', 'Status', 'Target'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch alert channels');
-    throw err;
-  }
-}
-
-// ── Alert History ──
-
-async function alertHistoryList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching alert history');
-  try {
-    const query = { limit: flags.limit || 20 };
-    const data = await api.get('/alert-history', { query });
-    const history = data.alerts || [];
-    s.stop(`Found ${history.length} alert${history.length !== 1 ? 's' : ''}${data.totalItems ? ` (${data.totalItems} total)` : ''}`);
-
-    if (flags.json) { ui.json(data); return; }
-
-    console.log('');
-    const rows = history.map(h => [
-      ui.c.dim(ui.truncate(h._id, 12)),
-      h.ruleName || h.type || '—',
-      h.severity ? ui.statusBadge(h.severity) : '—',
-      ui.truncate(h.message || h.description || '', 40),
-      h.serviceName || '—',
-      ui.timeAgo(h.triggeredAt || h.createdAt),
-    ]);
-    ui.table(['ID', 'Rule', 'Severity', 'Message', 'App', 'Triggered'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch alert history');
-    throw err;
-  }
-}
-
-// ── Blocklist ──
-
-function describeBlockTarget(entry) {
-  const parts = [entry.ip || entry.cidr || '-'];
-  if (entry.method && entry.method !== 'ALL') parts.push(entry.method);
-  if (entry.pathPattern) parts.push(`${entry.pathMatchMode || 'prefix'}:${entry.pathPattern}`);
-  return parts.join(' ');
-}
-
-async function blocklistList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching blocklist');
-  try {
-    const query = {};
-    if (flags.page) query.page = flags.page;
-    if (flags.limit) query.limit = flags.limit;
-    if (flags.app) query.appKey = flags.app;
-    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
-    if (flags.status) query.status = flags.status;
-    if (flags.search) query.search = flags.search;
-    if (flags.view) query.view = flags.view;
-    if (flags.approvalStatus || flags['approval-status']) {
-      query.approvalStatus = flags.approvalStatus || flags['approval-status'];
-    }
-    const data = await api.get('/blocklist', { query });
-    const items = data.blockedIps || [];
-    s.stop(`Found ${items.length} blocked IP${items.length !== 1 ? 's' : ''}${data.total ? ` (${data.total} total)` : ''}`);
-
-    if (flags.json) { ui.json(data); return; }
-
-    console.log('');
-    const rows = items.map(b => [
-      ui.c.dim(ui.truncate(b._id, 12)),
-      ui.c.red(describeBlockTarget(b)),
-      ui.truncate(b.reason || '', 40),
-      b.source || '—',
-      b.status || 'active',
-      b.applicationKey || ui.c.dim('all apps'),
-      b.environment || ui.c.dim('all envs'),
-      ui.timeAgo(b.createdAt),
-      b.unblockedAt ? ui.timeAgo(b.unblockedAt) : ui.c.dim('—'),
-      b.expiresAt ? new Date(b.expiresAt).toLocaleDateString() : ui.c.dim('permanent'),
-    ]);
-    ui.table(['ID', 'Target', 'Reason', 'Source', 'Status', 'App', 'Env', 'Added', 'Unblocked', 'Expires'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch blocklist');
-    throw err;
-  }
-}
-
-async function revokeRoute(args, flags) {
-  const sub = args[0];
-  if (sub === 'list') return revokeList(args.slice(1), flags);
-  if (sub === 'restore') return revokeRestore(args.slice(1), flags);
-  if (sub === 'session' || sub === 'user') return revokeAdd(sub, args.slice(1), flags);
-  ui.error('Usage: securenow revoke <session <id> | user <id> | list | restore <id>> [--reason "..."] [--duration 24h] [--app <key>] [--env <env>]');
-  process.exit(1);
-}
-
-async function revokeAdd(type, args, flags) {
-  requireAuth();
-  const value = args[0];
-  if (!value) {
-    ui.error(`Usage: securenow revoke ${type} <${type === 'session' ? 'session-id' : 'user-id'}> [--reason "..."] [--duration 24h] [--app <key>] [--env <env>]`);
-    process.exit(1);
-  }
-  const body = { type, value, source: 'cli' };
-  if (flags.reason) body.reason = flags.reason;
-  if (flags.duration) body.duration = flags.duration;
-  if (flags.app || flags.apps) body.applicationKey = flags.app || flags.apps;
-  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
-
-  const s = ui.spinner(`Revoking ${type} ${value}`);
-  try {
-    const data = await api.post('/revocations', body);
-    s.stop(`Revoked ${type} ${ui.truncate(value, 24)}`);
-    if (flags.json) { ui.json(data); return; }
-    const r = data.revocation || data;
-    ui.keyValue([
-      ['ID', r._id || r.id || '-'],
-      ['Type', r.type || type],
-      ['Value', r.value || value],
-      ['Scope', r.applicationKey || 'all apps'],
-      ['Expires', r.expiresAt ? new Date(r.expiresAt).toISOString() : 'never'],
-    ]);
-  } catch (err) {
-    s.fail('Failed to revoke');
-    throw err;
-  }
-}
-
-async function revokeList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching revocations');
-  try {
-    const query = {};
-    if (flags.type) query.type = flags.type;
-    if (flags.status) query.status = flags.status;
-    const data = await api.get('/revocations', { query });
-    const entries = data.revocations || [];
-    s.stop(`Found ${entries.length} revocation${entries.length !== 1 ? 's' : ''}`);
-    if (flags.json) { ui.json(entries); return; }
-    console.log('');
-    ui.table(['ID', 'Type', 'Value', 'Scope', 'Expires'], entries.map((r) => [
-      ui.c.dim(ui.truncate(r._id || r.id, 12)),
-      r.type,
-      ui.truncate(r.value, 28),
-      r.applicationKey || ui.c.dim('all'),
-      r.expiresAt ? new Date(r.expiresAt).toISOString().slice(0, 16) : ui.c.dim('never'),
-    ]));
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to list revocations');
-    throw err;
-  }
-}
-
-async function revokeRestore(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) { ui.error('Usage: securenow revoke restore <id> [--reason "..."]'); process.exit(1); }
-  const s = ui.spinner('Restoring');
-  try {
-    const data = await api.post(`/revocations/${id}/restore`, { reason: flags.reason || '' });
-    s.stop('Revocation lifted');
-    if (flags.json) ui.json(data);
-  } catch (err) {
-    s.fail('Failed to restore');
-    throw err;
-  }
-}
-
-async function blocklistAdd(args, flags) {
-  requireAuth();
-  let ip = args[0];
-  if (!ip) {
-    ip = await ui.prompt('IP address or CIDR to block');
-    if (!ip) { ui.error('IP is required'); process.exit(1); }
-  }
-
-  const body = { ip };
-  if (flags.reason) body.reason = flags.reason;
-  if (flags.duration) body.duration = flags.duration;
-  if (flags.app) body.appKey = flags.app;
-  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
-  if (flags.route || flags.path || flags.pattern) body.pathPattern = flags.route || flags.path || flags.pattern;
-  if (flags.mode || flags['path-mode']) body.pathMatchMode = flags.mode || flags['path-mode'];
-  if (flags.method) body.method = flags.method;
-
-  const target = describeBlockTarget({ ip, method: body.method, pathPattern: body.pathPattern, pathMatchMode: body.pathMatchMode });
-  const s = ui.spinner(`Blocking ${target}`);
-  try {
-    const data = await api.post('/blocklist', body);
-    s.stop(`${target} added to blocklist`);
-    if (flags.json) ui.json(data);
-  } catch (err) {
-    s.fail('Failed to add to blocklist');
-    throw err;
-  }
-}
-
-async function blocklistRemove(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Blocklist entry ID required. Usage: securenow blocklist unblock <id> [--reason <reason>]');
-    process.exit(1);
-  }
-
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Unblock this IP? Firewall enforcement stops, but block report and history stay saved.');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-
-  const s = ui.spinner('Unblocking IP');
-  try {
-    const body = {};
-    if (flags.reason) body.reason = flags.reason;
-    await api.post(`/blocklist/${id}/unblock`, body);
-    s.stop('Unblocked; block report and history retained');
-  } catch (err) {
-    s.fail('Failed to unblock IP');
-    throw err;
-  }
-}
-
-// Approve a block that the AI prepared but parked pending customer approval
-// (e.g. the autopilot held it under block_risk_score_below_policy). Enforces the IP.
-async function blocklistApprove(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow blocklist approve <pending-block-id> [--reason <reason>] [--yes]');
-    process.exit(1);
-  }
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Approve this pending block? The IP will be enforced by the firewall.');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  const s = ui.spinner('Approving pending block');
-  try {
-    const body = {};
-    if (flags.reason) body.reason = flags.reason;
-    const data = await api.post(`/blocklist/${id}/approve`, body);
-    s.stop('Pending block approved — IP now enforced');
-    if (flags.json) ui.json(data);
-  } catch (err) {
-    s.fail('Failed to approve pending block');
-    throw err;
-  }
-}
-
-// Reject a pending block: the IP is NOT blocked, the entry is removed, and a scoped
-// no-block decision is recorded so auto-block won't re-block this IP for the same rule.
-async function blocklistReject(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Usage: securenow blocklist reject <pending-block-id> [--reason <reason>] [--yes]');
-    process.exit(1);
-  }
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Reject this pending block? The IP will NOT be blocked; a scoped no-block decision is recorded for the rule that proposed it.');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  const s = ui.spinner('Rejecting pending block');
-  try {
-    const body = {};
-    if (flags.reason) body.reason = flags.reason;
-    const data = await api.post(`/blocklist/${id}/reject`, body);
-    s.stop('Pending block rejected — IP cleared (scoped no-block decision recorded)');
-    if (flags.json) ui.json(data);
-  } catch (err) {
-    s.fail('Failed to reject pending block');
-    throw err;
-  }
-}
-
-async function blocklistStats(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching blocklist stats');
-  try {
-    const data = await api.get('/blocklist/stats');
-    const stats = data.stats || data;
-    s.stop('Stats loaded');
-
-    if (flags.json) { ui.json(stats); return; }
-
-    console.log('');
-    ui.heading('Blocklist Statistics');
-    console.log('');
-    ui.keyValue([
-      ['Total Active', String(stats.totalActive ?? '—')],
-      ['Total Removed', String(stats.totalRemoved ?? '—')],
-      ['Manual Blocks', String(stats.manualCount ?? '—')],
-      ['Automation Blocks', String(stats.automationCount ?? '—')],
-      ['Active Rules', String(stats.activeAutomationRules ?? '—')],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch stats');
-    throw err;
-  }
-}
-
-// ── Allowlist ──
-
-async function allowlistList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching allowlist');
-  try {
-    const query = {};
-    if (flags.page) query.page = flags.page;
-    if (flags.limit) query.limit = flags.limit;
-    if (flags.app) query.appKey = flags.app;
-    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
-    const data = await api.get('/allowlist', { query });
-    const items = data.allowedIps || [];
-    s.stop(`Found ${items.length} allowed IP${items.length !== 1 ? 's' : ''}${data.total ? ` (${data.total} total)` : ''}`);
-
-    if (flags.json) { ui.json(data); return; }
-
-    console.log('');
-    const rows = items.map(a => [
-      ui.c.dim(ui.truncate(a._id, 12)),
-      ui.c.green(a.ip || '—'),
-      a.label || ui.c.dim('—'),
-      ui.truncate(a.reason || '', 40),
-      a.applicationKey || ui.c.dim('all apps'),
-      a.environment || ui.c.dim('all envs'),
-      ui.timeAgo(a.createdAt),
-      a.expiresAt ? new Date(a.expiresAt).toLocaleDateString() : ui.c.dim('permanent'),
-    ]);
-    ui.table(['ID', 'IP/CIDR', 'Label', 'Reason', 'App', 'Env', 'Added', 'Expires'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch allowlist');
-    throw err;
-  }
-}
-
-async function allowlistAdd(args, flags) {
-  requireAuth();
-  let ip = args[0];
-  if (!ip) {
-    ip = await ui.prompt('IP address or CIDR to allow');
-    if (!ip) { ui.error('IP is required'); process.exit(1); }
-  }
-
-  const body = { ip };
-  if (flags.label) body.label = flags.label;
-  if (flags.reason) body.reason = flags.reason;
-  if (flags.app) {
-    body.applicationsAll = false;
-    body.applicationKeys = String(flags.app).split(',').map((x) => x.trim()).filter(Boolean);
-  }
-  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
-
-  if (!flags.force && !flags.yes) {
-    ui.warn('IP Allowlist is deny-by-default: once active, only listed IPs can reach the scoped app/environment and all others are blocked.');
-    ui.info('Use `securenow trusted add` instead if this IP should be trusted without locking out normal visitors.');
-    const ok = await ui.confirm('Add this IP to the restrictive allowlist?');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-  body.allowlistDenyAllApproved = true;
-
-  const s = ui.spinner(`Allowing ${ip}`);
-  try {
-    await api.post('/allowlist', body);
-    s.stop(`${ip} added to allowlist`);
-  } catch (err) {
-    s.fail('Failed to add to allowlist');
-    throw err;
-  }
-}
-
-async function allowlistRemove(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Allowlist entry ID required. Usage: securenow allowlist remove <id>');
-    process.exit(1);
-  }
-
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Remove this IP from the allowlist?');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-
-  const s = ui.spinner('Removing from allowlist');
-  try {
-    await api.delete(`/allowlist/${id}`);
-    s.stop('Removed from allowlist');
-  } catch (err) {
-    s.fail('Failed to remove from allowlist');
-    throw err;
-  }
-}
-
-async function allowlistStats(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching allowlist stats');
-  try {
-    const data = await api.get('/allowlist/stats');
-    const stats = data.stats || data;
-    s.stop('Stats loaded');
-
-    if (flags.json) { ui.json(stats); return; }
-
-    console.log('');
-    ui.heading('Allowlist Statistics');
-    console.log('');
-    ui.keyValue([
-      ['Total Active', String(stats.totalActive ?? '—')],
-      ['Total Removed', String(stats.totalRemoved ?? '—')],
-    ]);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch stats');
-    throw err;
-  }
-}
-
-// ── Trusted IPs ──
-
-async function trustedList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching trusted IPs');
-  try {
-    const query = {};
-    if (flags.app) query.appKey = flags.app;
-    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
-    const data = await api.get('/trusted-ips', { query });
-    const items = data.trustedIps || [];
-    s.stop(`Found ${items.length} trusted IP${items.length !== 1 ? 's' : ''}`);
-
-    if (flags.json) { ui.json(items); return; }
-
-    console.log('');
-    const rows = items.map(t => [
-      ui.c.dim(ui.truncate(t._id, 12)),
-      ui.c.green(t.ip || t.cidr || '—'),
-      t.label || t.description || ui.c.dim('—'),
-      t.applicationKey || ui.c.dim('all apps'),
-      t.environment || ui.c.dim('all envs'),
-      ui.timeAgo(t.createdAt),
-    ]);
-    ui.table(['ID', 'IP/CIDR', 'Label', 'App', 'Env', 'Added'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch trusted IPs');
-    throw err;
-  }
-}
-
-async function trustedAdd(args, flags) {
-  requireAuth();
-  let ip = args[0];
-  if (!ip) {
-    ip = await ui.prompt('IP address or CIDR to trust');
-    if (!ip) { ui.error('IP is required'); process.exit(1); }
-  }
-
-  const body = { ip };
-  if (flags.label) body.label = flags.label;
-  if (flags.description) body.description = flags.description;
-  if (flags.note) body.note = flags.note;
-  if (flags.app) {
-    body.applicationsAll = false;
-    body.applicationKeys = String(flags.app).split(',').map((x) => x.trim()).filter(Boolean);
-  }
-  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
-
-  const s = ui.spinner(`Adding ${ip} to trusted IPs`);
-  try {
-    await api.post('/trusted-ips', body);
-    s.stop(`${ip} added to trusted IPs`);
-  } catch (err) {
-    s.fail('Failed to add trusted IP');
-    throw err;
-  }
-}
-
-async function trustedRemove(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Trusted IP entry ID required. Usage: securenow trusted remove <id>');
-    process.exit(1);
-  }
-
-  if (!flags.force && !flags.yes) {
-    const ok = await ui.confirm('Remove this IP from trusted list?');
-    if (!ok) { ui.info('Cancelled'); return; }
-  }
-
-  const s = ui.spinner('Removing from trusted IPs');
-  try {
-    await api.delete(`/trusted-ips/${id}`);
-    s.stop('Removed from trusted IPs');
-  } catch (err) {
-    s.fail('Failed to remove trusted IP');
-    throw err;
-  }
-}
-
-// ── Helpers ──
-
-async function resolveAppId(flags) {
-  const appKey = flags.app || config.getDefaultApp();
-  if (!appKey) return null;
-  const data = await api.get('/applications');
-  const apps = data.applications || [];
-  const match = apps.find(a => a.key === appKey);
-  return match ? { id: match._id, key: match.key, name: match.name } : null;
-}
-
-// ── Forensics ──
-
-async function forensicsQuery(args, flags) {
-  requireAuth();
-  const query = args.join(' ');
-  if (!query) {
-    ui.error('Query required. Usage: securenow forensics "your natural language query" [--app <key>]');
-    process.exit(1);
-  }
-
-  const s = ui.spinner('Submitting forensic query');
-  try {
-    const body = { query, environment: resolveEnvironment(flags, 'production') };
-    const resolved = await resolveAppId(flags);
-    if (resolved) {
-      body.applicationId = resolved.id;
-    } else if (flags.instance) {
-      body.instanceId = flags.instance;
-    }
-
-    const job = await api.post('/forensics/query', body);
-    const jobId = job.jobId;
-
-    if (!jobId) {
-      s.stop('Query complete');
-      if (flags.json) { ui.json(job); return; }
-      if (job.result) {
-        console.log('');
-        if (job.sqlquery) {
-          ui.subheading('Generated SQL');
-          console.log(`\n  ${ui.c.dim(job.sqlquery)}\n`);
-        }
-        const data = job.result;
-        if (Array.isArray(data) && data.length > 0) {
-          const headers = Object.keys(data[0]);
-          const rows = data.map(row => headers.map(h => String(row[h] ?? '')));
-          ui.table(headers, rows);
-        } else {
-          ui.json(data);
-        }
-        console.log('');
-      }
-      return;
-    }
-
-    s.update('Processing query...');
-
-    let result;
-    const maxAttempts = 60;
-    for (let i = 0; i < maxAttempts; i++) {
-      await new Promise(r => setTimeout(r, 2000));
-      result = await api.get(`/forensics/query/status/${jobId}`);
-      if (result.status === 'completed' || result.status === 'failed') break;
-      s.update(`Processing query... (${(i + 1) * 2}s)`);
-    }
-
-    if (result.status === 'failed') {
-      s.fail('Query failed');
-      ui.error(result.error || 'Unknown error');
-      return;
-    }
-
-    if (result.status !== 'completed') {
-      s.fail('Query timed out');
-      ui.warn('Query is still processing. Check back later.');
-      return;
-    }
-
-    s.stop('Query complete');
-
-    if (flags.json) { ui.json(result); return; }
-
-    console.log('');
-    if (result.sqlquery) {
-      ui.subheading('Generated SQL');
-      console.log(`\n  ${ui.c.dim(result.sqlquery)}\n`);
-    }
-
-    if (result.result) {
-      const data = result.result;
-      ui.subheading(`Results (${result.rowCount ?? (Array.isArray(data) ? data.length : '?')} rows)`);
-      console.log('');
-
-      if (Array.isArray(data) && data.length > 0) {
-        const headers = Object.keys(data[0]);
-        const rows = data.map(row => headers.map(h => String(row[h] ?? '')));
-        ui.table(headers, rows);
-      } else {
-        ui.json(data);
-      }
-    }
-    console.log('');
-  } catch (err) {
-    s.fail('Forensic query failed');
-    throw err;
-  }
-}
-
-async function forensicsLibrary(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching query library');
-  try {
-    const data = await api.get('/forensics/query-library');
-    const queries = data.data || [];
-    s.stop(`Found ${queries.length} saved quer${queries.length !== 1 ? 'ies' : 'y'}`);
-
-    if (flags.json) { ui.json(queries); return; }
-
-    console.log('');
-    const rows = queries.map(q => [
-      ui.c.dim(ui.truncate(q._id, 12)),
-      q.name || q.title || '—',
-      ui.truncate(q.description || q.query || '', 50),
-      ui.timeAgo(q.createdAt),
-    ]);
-    ui.table(['ID', 'Name', 'Description', 'Created'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch query library');
-    throw err;
-  }
-}
-
-// ── Forensics Chat ──
-
-async function forensicsChat(args, flags) {
-  requireAuth();
-  const resolved = await resolveAppId(flags);
-  if (!resolved) {
-    ui.error('App required. Usage: securenow forensics chat --app <key>');
-    ui.info('Set a default with: securenow apps default <key>');
-    process.exit(1);
-  }
-
-  console.log('');
-  ui.heading(`Forensics Chat — ${resolved.name || resolved.key}`);
-  console.log(ui.c.dim(`  App: ${resolved.key} (${resolved.id})`));
-  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
-
-  const environment = resolveEnvironment(flags, 'production');
-  console.log(ui.c.dim(`  Env: ${environment}`));
-
-  let conversationId = null;
-
-  const readline = require('readline');
-  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-
-  const askLine = () => new Promise((resolve) => {
-    rl.question(ui.c.cyan('  you > '), (answer) => resolve(answer.trim()));
-  });
-
-  try {
-    while (true) {
-      const message = await askLine();
-      if (!message || message.toLowerCase() === 'exit' || message.toLowerCase() === 'quit') {
-        console.log('');
-        ui.info('Chat ended.');
-        break;
-      }
-
-      const s = ui.spinner('Thinking');
-      try {
-        const body = { message, applicationKey: resolved.key, environment };
-        if (conversationId) body.conversationId = conversationId;
-
-        const chatRes = await api.post('/forensics/chat', body);
-        conversationId = chatRes.conversationId;
-
-        if (chatRes.status === 'processing') {
-          let result;
-          for (let i = 0; i < 150; i++) {
-            await new Promise(r => setTimeout(r, 2000));
-            result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-            if (result.status === 'complete' || result.status === 'failed' || result.status === 'awaiting_confirmation') break;
-            const progress = result._progress;
-            if (progress?.action) s.update(progress.action);
-          }
-
-          if (!result || result.status === 'processing') {
-            s.fail('Response timed out');
-            continue;
-          }
-
-          s.stop('Done');
-          printChatMessage(result.message);
-
-          if (result.status === 'awaiting_confirmation') {
-            const proceed = await ui.confirm('Proceed with this query?');
-            if (proceed) {
-              const cs = ui.spinner('Executing query');
-              await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
-              let confirmResult;
-              for (let i = 0; i < 90; i++) {
-                await new Promise(r => setTimeout(r, 2000));
-                confirmResult = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-                if (confirmResult.status !== 'processing') break;
-              }
-              cs.stop('Done');
-              if (confirmResult?.message) printChatMessage(confirmResult.message);
-            } else {
-              ui.info('Query skipped. Ask a different question or refine.');
-            }
-          }
-        } else if (chatRes.message) {
-          s.stop('Done');
-          printChatMessage(chatRes.message);
-        } else {
-          s.stop('Done');
-        }
-      } catch (err) {
-        s.fail('Error');
-        ui.error(err.message);
-      }
-      console.log('');
-    }
-  } finally {
-    rl.close();
-  }
-}
-
-function printChatMessage(msg) {
-  if (!msg) return;
-  console.log('');
-  if (msg.content) {
-    console.log(`  ${ui.c.green('ai >')} ${msg.content}`);
-  }
-  if (msg.sqlQuery) {
-    console.log('');
-    ui.subheading('Generated SQL');
-    console.log(`\n  ${ui.c.dim(msg.sqlQuery)}\n`);
-  }
-  if (msg.results && Array.isArray(msg.results) && msg.results.length > 0) {
-    ui.subheading(`Results (${msg.resultCount ?? msg.results.length} rows)`);
-    console.log('');
-    const headers = Object.keys(msg.results[0]);
-    const rows = msg.results.map(row => headers.map(h => String(row[h] ?? '')));
-    ui.table(headers, rows);
-  }
-  if (msg.estimation) {
-    const est = msg.estimation;
-    const rowLabel = est.timedOut
-      ? 'very large (estimation timed out)'
-      : est.estimatedRows != null
-        ? `~${Number(est.estimatedRows).toLocaleString()}`
-        : 'unknown';
-    console.log(`\n  ${ui.c.yellow('!')} Estimated rows: ${rowLabel}`);
-    if (est.suggestions?.length) {
-      console.log(ui.c.dim('  Suggestions:'));
-      for (const sug of est.suggestions) {
-        console.log(ui.c.dim(`    • ${sug}`));
-      }
-    }
-  }
-  if (msg.error && !msg.results) {
-    console.log(`\n  ${ui.c.red('Error:')} ${msg.error}`);
-  }
-}
-
-// ── IP Lookup ──
-
-async function ipLookup(args, flags) {
-  requireAuth();
-  const ip = args[0];
-  if (!ip) {
-    ui.error('IP address required. Usage: securenow ip <ip-address>');
-    process.exit(1);
-  }
-
-  const s = ui.spinner(`Looking up ${ip}`);
-  try {
-    const data = await api.get(`/ip/${ip}`);
-    s.stop('IP intelligence loaded');
-
-    if (flags.json) { ui.json(data); return; }
-
-    console.log('');
-    ui.heading(`IP Intelligence: ${data.ip || ip}`);
-    console.log('');
-
-    const pairs = [];
-    if (data.countryName || data.countryCode) pairs.push(['Country', `${data.countryName || ''} ${data.countryCode ? `(${data.countryCode})` : ''}`.trim()]);
-    if (data.domain) pairs.push(['Domain', data.domain]);
-    if (data.isp) pairs.push(['ISP', data.isp]);
-    if (data.usageType) pairs.push(['Usage Type', data.usageType]);
-    if (data.abuseConfidenceScore != null) pairs.push(['SecureNow IPDB Score', `${data.abuseConfidenceScore}/100`]);
-    if (data.securenowScore != null) pairs.push(['SecureNow Score', String(data.securenowScore)]);
-    if (data.verdict) pairs.push(['Verdict', data.verdict]);
-    if (data.isMalicious != null) pairs.push(['Malicious', data.isMalicious ? ui.c.red('Yes') : ui.c.green('No')]);
-    if (data.isBot != null) pairs.push(['Bot', data.isBot ? ui.c.yellow('Yes') : 'No']);
-    if (data.activityType) pairs.push(['Activity', data.activityType]);
-    if (data.totalReports != null) pairs.push(['Total Reports', String(data.totalReports)]);
-    if (data.lastReportedAt) pairs.push(['Last Reported', new Date(data.lastReportedAt).toLocaleString()]);
-
-    if (pairs.length) {
-      ui.keyValue(pairs);
-    }
-
-    if (data.riskFactors?.length) {
-      ui.subheading('Risk Factors');
-      console.log('');
-      data.riskFactors.forEach(f => console.log(`  • ${f}`));
-    }
-
-    if (data.attackTypes?.length) {
-      ui.subheading('Attack Types');
-      console.log('');
-      data.attackTypes.forEach(a => console.log(`  • ${a}`));
-    }
-
-    if (data.summary) {
-      ui.subheading('Summary');
-      console.log(`\n  ${data.summary}`);
-    }
-    console.log('');
-  } catch (err) {
-    s.fail('IP lookup failed');
-    throw err;
-  }
-}
-
-async function ipTraces(args, flags) {
-  requireAuth();
-  const ip = args[0];
-  if (!ip) {
-    ui.error('IP address required. Usage: securenow ip traces <ip>');
-    process.exit(1);
-  }
-
-  const s = ui.spinner(`Fetching traces for ${ip}`);
-  try {
-    const query = {};
-    const appKey = resolveApp(flags);
-    if (appKey) query.appKeys = appKey;
-    const environment = resolveEnvironment(flags, null);
-    if (environment) query.environment = environment;
-    const data = await api.get(`/ip/${ip}/traces`, { query });
-    const traces = data.traces || [];
-    s.stop(`Found ${traces.length} trace${traces.length !== 1 ? 's' : ''}`);
-
-    if (flags.json) { ui.json(data); return; }
-
-    console.log('');
-    const rows = traces.map(t => [
-      ui.c.dim(ui.truncate(t.traceID || t.traceId, 16)),
-      t.httpMethod || t.method || '—',
-      ui.httpStatusColor(t.statusCode || t.httpStatusCode || t.responseStatusCode || '—'),
-      ui.truncate(t.httpUrl || t.url || '', 40),
-      ui.durationColor(t.durationNano ? t.durationNano / 1e6 : t.duration),
-      ui.timeAgo(t.timestamp),
-    ]);
-    ui.table(['Trace ID', 'Method', 'Status', 'URL', 'Duration', 'Time'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch traces');
-    throw err;
-  }
-}
-
-// ── Instances ──
-
-async function instancesList(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching instances');
-  try {
-    const data = await api.get('/instances');
-    const instances = data.instances || [];
-    s.stop(`Found ${instances.length} instance${instances.length !== 1 ? 's' : ''}`);
-
-    if (flags.json) { ui.json(instances); return; }
-
-    console.log('');
-    const rows = instances.map(inst => [
-      ui.c.dim(ui.truncate(inst._id, 12)),
-      inst.name || inst.host || '—',
-      inst.host || '—',
-      inst.port != null ? String(inst.port) : '—',
-      inst.linkedApps != null ? String(inst.linkedApps) : '—',
-      ui.timeAgo(inst.createdAt),
-    ]);
-    ui.table(['ID', 'Name', 'Host', 'Port', 'Linked Apps', 'Added'], rows);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch instances');
-    throw err;
-  }
-}
-
-async function instancesTest(args, flags) {
-  requireAuth();
-  const id = args[0];
-  if (!id) {
-    ui.error('Instance ID required. Usage: securenow instances test <id>');
-    process.exit(1);
-  }
-
-  const s = ui.spinner('Testing instance connection');
-  try {
-    const result = await api.post(`/instances/${id}/test`);
-    if (result.success) {
-      s.stop(`Connection successful${result.storageGb ? ` (${result.storageGb} GB storage)` : ''}`);
-    } else {
-      s.fail(result.message || 'Connection failed');
-    }
-
-    if (flags.json) ui.json(result);
-  } catch (err) {
-    s.fail('Instance test failed');
-    throw err;
-  }
-}
-
-// ── Analytics ──
-
-async function analytics(args, flags) {
-  requireAuth();
-  const s = ui.spinner('Fetching analytics');
-  try {
-    const query = {};
-    const appKey = resolveApp(flags);
-    if (flags.instance) query.instanceId = flags.instance;
-
-    const data = await api.get('/analytics/summary', { query });
-
-    s.stop('Analytics loaded');
-
-    if (flags.json) {
-      ui.json(data);
-      return;
-    }
-
-    console.log('');
-    ui.heading('Analytics Overview');
-    console.log('');
-
-    const groups = ['2xx-responses', '3xx-responses', '4xx-responses', '5xx-responses', '500-errors'];
-    const pairs = groups.map(ep => {
-      const val = data[ep];
-      const count = val?.meta?.count ?? '—';
-      return [ep, String(count)];
-    });
-    ui.keyValue(pairs);
-    console.log('');
-  } catch (err) {
-    s.fail('Failed to fetch analytics');
-    throw err;
-  }
-}
-
-module.exports = {
-  alertRulesRoute,
-  alertRulesList,
-  alertRuleShow,
-  alertRuleUpdate,
-  alertRuleTest,
-  alertRuleExclusions,
-  alertChannelsList,
-  alertHistoryList,
-  blocklistList,
-  blocklistAdd,
-  blocklistRemove,
-  blocklistApprove,
-  blocklistReject,
-  blocklistStats,
-  revokeRoute,
-  allowlistList,
-  allowlistAdd,
-  allowlistRemove,
-  allowlistStats,
-  trustedList,
-  trustedAdd,
-  trustedRemove,
-  forensicsQuery,
-  forensicsChat,
-  forensicsLibrary,
-  ipLookup,
-  ipTraces,
-  instancesList,
-  instancesTest,
-  analytics,
-};
+'use strict';
+
+const fs = require('fs');
+const { api, requireAuth } = require('./client');
+const config = require('./config');
+const ui = require('./ui');
+
+function resolveApp(flags) {
+  return flags.app || config.getDefaultApp();
+}
+
+function resolveEnvironment(flags, fallback = null) {
+  return flags.env || flags.environment || fallback;
+}
+
+// ── Alert Rules ──
+
+function formatRuleApplicationsCell(rule) {
+  if (rule.applicationsAll) {
+    return ui.c.cyan('all apps');
+  }
+  const keys = rule.applications || [];
+  if (keys.length === 0) return ui.c.dim('—');
+  const joined = keys.join(', ');
+  return joined.length > 48 ? `${joined.slice(0, 45)}…` : joined;
+}
+
+function ruleStatusBadge(rule) {
+  const st = rule.status || (rule.enabled !== false ? 'Active' : 'Disabled');
+  if (st === 'Active') return ui.statusBadge('active');
+  if (st === 'Disabled') return ui.statusBadge('disabled');
+  if (st === 'Paused') return ui.statusBadge('paused');
+  return st;
+}
+
+/** Dispatch: list | show <id> | update <id> ... */
+async function alertRulesRoute(args, flags) {
+  const sub = args[0];
+  if (sub === 'create' || sub === 'add') {
+    return alertRuleCreate(args.slice(1), flags);
+  }
+  if (sub === 'show') {
+    return alertRuleShow(args.slice(1), flags);
+  }
+  if (sub === 'update') {
+    return alertRuleUpdate(args.slice(1), flags);
+  }
+  if (sub === 'set-sql' || sub === 'edit-sql') {
+    return alertRuleSetSql(args.slice(1), flags);
+  }
+  if (sub === 'versions' || sub === 'history') {
+    return alertRuleVersions(args.slice(1), flags);
+  }
+  if (sub === 'version') {
+    return alertRuleVersionShow(args.slice(1), flags);
+  }
+  if (sub === 'rollback' || sub === 'revert') {
+    return alertRuleRollback(args.slice(1), flags);
+  }
+  if (sub === 'delete' || sub === 'rm' || sub === 'remove') {
+    return alertRuleDelete(args.slice(1), flags);
+  }
+  if (sub === 'duplicate' || sub === 'clone') {
+    return alertRuleDuplicate(args.slice(1), flags);
+  }
+  if (sub === 'test') {
+    return alertRuleTest(args.slice(1), flags);
+  }
+  if (sub === 'dry-run-query' || sub === 'candidate-test' || sub === 'validate') {
+    return alertRuleCandidateTest(args.slice(1), flags);
+  }
+  if (sub === 'tune-query' || sub === 'query-update') {
+    return alertRuleQueryUpdate(args.slice(1), flags);
+  }
+  if (sub === 'exclusions') {
+    return alertRuleExclusions(args.slice(1), flags);
+  }
+  if (sub === 'promote') {
+    return alertRuleSetMode(args.slice(1), flags, 'prod');
+  }
+  if (sub === 'demote') {
+    return alertRuleSetMode(args.slice(1), flags, 'test');
+  }
+  if (sub === 'list') {
+    return alertRulesList(args.slice(1), flags);
+  }
+  return alertRulesList(args, flags);
+}
+
+// Promote (test -> prod) or demote (prod -> test) one or more rules. In test mode a
+// rule detects only — instant.block, automations, and the autonomous operator all
+// skip its notifications. Promoting to prod makes those mitigations eligible.
+async function alertRuleSetMode(args, flags, mode) {
+  requireAuth();
+  const ids = args.filter(Boolean);
+  const verb = mode === 'prod' ? 'promote' : 'demote';
+  if (ids.length === 0) {
+    ui.error(`Usage: securenow alerts rules ${verb} <rule-id> [<rule-id> ...] [--yes]`);
+    process.exit(1);
+  }
+  if (mode === 'prod' && !flags.yes && !flags.force) {
+    ui.warn('Promoting to prod ARMS automatic mitigation (instant.block, automations, autonomous operator) for matching detections.');
+    const ok = await ui.confirm(`Promote ${ids.length} rule${ids.length !== 1 ? 's' : ''} to prod (mitigations become eligible)?`);
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  let okCount = 0;
+  const failures = [];
+  for (const id of ids) {
+    const s = ui.spinner(`${mode === 'prod' ? 'Promoting' : 'Demoting'} ${id}`);
+    try {
+      await api.put(`/alert-rules/${id}`, { mode });
+      s.stop(`${ui.truncate(id, 12)} → ${mode}`);
+      okCount++;
+    } catch (err) {
+      s.fail(`Failed on ${ui.truncate(id, 12)}: ${err.message}`);
+      failures.push(id);
+    }
+  }
+  if (flags.json) { ui.json({ mode, updated: okCount, failed: failures }); return; }
+  console.log('');
+  ui.success(`${okCount}/${ids.length} rule${ids.length !== 1 ? 's' : ''} set to ${mode}.`);
+  if (mode === 'prod') ui.info('Enable the matching automations to let mitigations act. Reverse anytime: securenow alerts rules demote <id>');
+  else ui.info('Detect-only — no mitigation will act. Promote when confident: securenow alerts rules promote <id>');
+}
+
+// Duplicate any rule (including a read-only system template) into a new CUSTOM rule you
+// own. System rules are view-only examples — fork one with this to enable / edit it. The
+// copy defaults to Disabled (opt in with --enable / --status active); SQL, instant.block,
+// schedule, scope, and mode are copied from the source.
+async function alertRuleDuplicate(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules duplicate <rule-id> [--enable] [--status active|disabled|paused] [--name "..."] [--mode test|prod]');
+    process.exit(1);
+  }
+  const body = {};
+  if (flags.enable) body.status = 'Active';
+  else if (flags.disable) body.status = 'Disabled';
+  else if (flags.pause) body.status = 'Paused';
+  else if (flags.status) {
+    const s = String(flags.status).toLowerCase();
+    body.status = s === 'active' ? 'Active' : s === 'paused' ? 'Paused' : 'Disabled';
+  }
+  if (flags.name) body.name = String(flags.name);
+  if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
+
+  const spin = ui.spinner(`Duplicating ${ui.truncate(id, 12)}`);
+  let data;
+  try {
+    data = await api.post(`/alert-rules/${id}/duplicate`, body);
+    spin.stop('Duplicated');
+  } catch (err) {
+    spin.fail(`Failed to duplicate: ${err.message}`);
+    process.exit(1);
+  }
+
+  if (flags.json) { ui.json(data); return; }
+  const r = data.alertRule || {};
+  const newId = r.id || r._id || '';
+  console.log('');
+  ui.success(`Created custom rule ${newId}`);
+  console.log(`  Name        ${r.name || ''}`);
+  console.log(`  Status      ${r.status || ''}`);
+  console.log(`  Mode        ${r.mode || ''}`);
+  console.log(`  Exec mode   ${r.executionMode || ''}`);
+  console.log(`  Custom      ${r.isSystem ? 'NO — still a system rule (unexpected)' : 'yes (editable / enable-able)'}`);
+  if (data.duplicatedFromSystem) ui.info('Forked from a read-only system template — edit or enable this custom copy freely.');
+  if (r.status !== 'Active') ui.info(`Disabled by default. Enable with: securenow alerts rules update ${newId} --enable`);
+}
+
+async function alertRulesList(args, flags) {
+  requireAuth();
+  // Server-side filters (API supports ?mode/status/active/isSystem).
+  const query = {};
+  if (flags.mode === 'test' || flags.mode === 'prod') query.mode = flags.mode;
+  if (['Active', 'Disabled', 'Paused'].includes(flags.status)) query.status = flags.status;
+  if (flags.active === true || flags.active === 'true') query.active = 'true';
+  else if (flags.active === false || flags.active === 'false') query.active = 'false';
+  if (flags.system === true || flags.system === 'true') query.isSystem = 'true';
+  else if (flags.user === true || flags.user === 'true') query.isSystem = 'false';
+
+  const s = ui.spinner('Fetching alert rules');
+  try {
+    const data = await api.get('/alert-rules', Object.keys(query).length ? { query } : undefined);
+    const rules = data.alertRules || [];
+    s.stop(`Found ${rules.length} rule${rules.length !== 1 ? 's' : ''}`);
+
+    if (flags.json) { ui.json(rules); return; }
+
+    console.log('');
+    const rows = rules.map((r) => [
+      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      r.name || '—',
+      ruleStatusBadge(r),
+      r.mode === 'test' ? ui.c.yellow('test') : ui.c.dim('prod'),
+      formatRuleApplicationsCell(r),
+      r.schedule?.enabled === false ? ui.c.dim('off') : (r.schedule?.description || r.schedule?.cronExpression || '—'),
+    ]);
+    ui.table(['ID', 'Name', 'Status', 'Mode', 'Applications', 'Schedule'], rows);
+    console.log('');
+    console.log(ui.c.dim('  Filters: --mode test|prod  --status Active|Disabled|Paused  --active true|false  --system|--user'));
+    console.log(ui.c.dim('  Mode: test = detect-only (no mitigation, human review).  Promote: securenow alerts rules promote <id>'));
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch alert rules');
+    throw err;
+  }
+}
+
+async function alertRuleCreate(args, flags) {
+  requireAuth();
+  const name = flags.name;
+  const usage = 'Usage: securenow alerts rules create --name "..." --sql <sql|@file|-> (--applications-all | --apps k1,k2) '
+    + '[--severity critical|high|medium|low] [--schedule "*/15 * * * *"] [--throttle-minutes 15 | --no-throttle] '
+    + '[--description "..."] [--nlp "plain-English intent"] [--category custom] [--channel id1,id2] [--query-mapping-id <id>]';
+  if (!name) {
+    ui.error(usage);
+    process.exit(1);
+  }
+
+  const queryMappingId = flags['query-mapping-id'] || flags.queryMappingId;
+  const sqlQuery = readSqlArg(flags);
+  if (!queryMappingId && !sqlQuery) {
+    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>).');
+    console.log(ui.c.dim('  Scope app keys in SQL with the __USER_APP_KEYS__ placeholder. The column differs by table:'));
+    console.log(ui.c.dim("  traces: WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__) AND timestamp >= now64(9) - INTERVAL 15 MINUTE"));
+    console.log(ui.c.dim("  logs:   WHERE resources_string['service.name'] IN (__USER_APP_KEYS__) AND timestamp >= toUnixTimestamp64Nano(now64() - INTERVAL 15 MINUTE)"));
+    console.log(ui.c.dim('  See `securenow telemetry schema` for both tables.'));
+    process.exit(1);
+  }
+
+  const hasAll = flags['applications-all'] === true || flags['applications-all'] === 'true';
+  const appsStr = flags.apps || flags.app;
+  if (!hasAll && !appsStr) {
+    ui.error('Scope the rule with --applications-all or --apps key1,key2');
+    process.exit(1);
+  }
+
+  const body = { name };
+  if (flags.description) body.description = flags.description;
+  if (queryMappingId) body.queryMappingId = queryMappingId;
+  else body.sqlQuery = sqlQuery;
+  if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
+  if (flags.category) body.category = flags.category;
+  if (flags.severity) body.severity = String(flags.severity).toLowerCase();
+  if (flags['execution-mode']) body.executionMode = flags['execution-mode'];
+
+  if (hasAll) {
+    body.applicationsAll = true;
+    body.applications = [];
+  } else {
+    body.applicationsAll = false;
+    body.applications = String(appsStr).split(',').map((x) => x.trim()).filter(Boolean);
+    if (body.applications.length === 0) {
+      ui.error('No application keys parsed from --apps');
+      process.exit(1);
+    }
+  }
+
+  const cron = flags.schedule || flags.cron;
+  if (cron) {
+    body.schedule = {
+      enabled: true,
+      cronExpression: cron,
+      description: flags['schedule-description'] || cron,
+    };
+  }
+  if (flags['no-throttle']) body.throttle = { enabled: false, minutes: 0 };
+  else if (flags['throttle-minutes']) body.throttle = { enabled: true, minutes: Number(flags['throttle-minutes']) };
+
+  const channelStr = flags.channel || flags.channels;
+  if (channelStr) {
+    body.alertChannelIds = String(channelStr).split(',').map((x) => x.trim()).filter(Boolean);
+  }
+
+  const s = ui.spinner('Creating alert rule');
+  let createdId = null;
+  try {
+    const data = await api.post('/alert-rules', body);
+    const r = data.alertRule || data;
+    createdId = r._id || r.id || null;
+    s.stop('Alert rule created');
+
+    // Transactional safety: `create` only runs scope/safety validation, not a real
+    // query execution — so a query that is valid-but-wrong (e.g. an unknown column)
+    // is accepted and would silently never fire. Custom-rule SQL also can't be
+    // patched via the API, so a broken rule would be stuck. We therefore dry-run the
+    // new scheduled rule and roll it back (delete) on a hard query failure, unless
+    // --no-validate is passed. A "complete" dry-run with 0 rows is healthy, not a failure.
+    const scheduled = r.executionMode !== 'instant' && r.schedule?.enabled !== false;
+    if (createdId && scheduled && !flags['no-validate']) {
+      const v = await validateRuleById(createdId, flags);
+      if (v && v.status === 'failed') {
+        const rolledBack = await api.delete(`/alert-rules/${createdId}`).then(() => true).catch(() => false);
+        ui.error(`Rule query failed validation and was ${rolledBack ? 'rolled back (deleted)' : 'left in place (auto-delete failed — remove it manually)'}:`);
+        ui.error(`  ${v.error || 'unknown query error'}`);
+        ui.info('Fix the SQL and re-create, or validate first: securenow alerts rules validate --sql @rule.sql --app <key>');
+        process.exit(1);
+      }
+    }
+
+    if (flags.json) { ui.json(data); return; }
+    console.log('');
+    ui.keyValue([
+      ['ID', createdId || '-'],
+      ['Name', r.name || '-'],
+      ['Status', r.status || '-'],
+      ['Mode', r.executionMode || 'scheduled'],
+      ['Severity', r.severity || '-'],
+      ['Applications', r.applicationsAll ? 'all apps' : ((r.applications || []).join(', ') || '-')],
+      ['Schedule', r.schedule?.enabled === false ? 'disabled' : (r.schedule?.description || r.schedule?.cronExpression || '-')],
+      ['Throttle', r.throttle?.enabled ? `${r.throttle.minutes} min` : 'off'],
+      ['Query', r.queryMappingId?.name || r.queryMappingId || '-'],
+      ['Validation', flags['no-validate'] ? 'skipped' : 'dry-run clean'],
+    ]);
+    console.log('');
+    ui.success(`Created. View it with: securenow alerts rules show ${createdId}`);
+  } catch (err) {
+    s.fail('Failed to create alert rule');
+    throw err;
+  }
+}
+
+async function alertRuleShow(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules show <rule-id>');
+    process.exit(1);
+  }
+  const s = ui.spinner('Fetching alert rule');
+  try {
+    const data = await api.get(`/alert-rules/${id}`);
+    const r = data.alertRule;
+    s.stop('');
+
+    if (flags.json) {
+      ui.json(r);
+      return;
+    }
+
+    console.log('');
+    ui.heading(r.name || 'Alert rule');
+    console.log('');
+    const appLine = r.applicationsAll
+      ? 'All applications (current & future)'
+      : (r.applications && r.applications.length > 0 ? r.applications.join(', ') : '—');
+    ui.keyValue([
+      ['ID', r._id || r.id || id],
+      ['Status', r.status || '—'],
+      ['Mode', r.mode === 'test' ? ui.c.yellow('test (detect-only, no mitigation)') : (r.mode || 'prod')],
+      ['System rule', r.isSystem ? 'yes' : 'no'],
+      ['Applications', appLine],
+      ['Schedule', r.schedule?.enabled === false ? 'disabled' : (r.schedule?.description || r.schedule?.cronExpression || '—')],
+      ['Throttle', r.throttle?.enabled ? `${r.throttle.minutes} min` : 'off'],
+      ['Query', r.queryMappingId?.name || '—'],
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch alert rule');
+    throw err;
+  }
+}
+
+async function alertRuleUpdate(args, flags) {
+  requireAuth();
+  // `update <id> --sql ...` is an alias for set-sql so SQL edits and scope edits
+  // share one verb. set-sql handles its own validation/feedback.
+  if (flags.sql || flags.query || flags.file) {
+    return alertRuleSetSql(args, flags);
+  }
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules update <rule-id> [--applications-all | --apps <k1,k2>] [--status Active|Disabled|Paused | --enable | --disable | --pause] [--mode test|prod]');
+    process.exit(1);
+  }
+
+  const hasAll =
+    flags['applications-all'] === true ||
+    flags['applications-all'] === 'true';
+  const hasNoAll =
+    flags['no-applications-all'] === true ||
+    flags['no-applications-all'] === 'true';
+  const appsStr = flags.apps;
+
+  if (hasAll && hasNoAll) {
+    ui.error('Use only one of --applications-all or --no-applications-all');
+    process.exit(1);
+  }
+  if (hasAll && appsStr) {
+    ui.error('Cannot combine --applications-all with --apps');
+    process.exit(1);
+  }
+
+  const body = {};
+  if (hasAll) {
+    body.applicationsAll = true;
+    body.applications = [];
+  } else if (hasNoAll || appsStr) {
+    body.applicationsAll = false;
+    if (!appsStr) {
+      ui.error('Pass --apps key1,key2 when using --no-applications-all, or omit --no-applications-all and use --apps only');
+      process.exit(1);
+    }
+    body.applications = String(appsStr)
+      .split(',')
+      .map((x) => x.trim())
+      .filter(Boolean);
+    if (body.applications.length === 0) {
+      ui.error('No application keys parsed from --apps');
+      process.exit(1);
+    }
+  }
+
+  // Status: --status X, or convenience --enable / --disable / --pause.
+  let status = null;
+  if (flags.enable === true || flags.enable === 'true') status = 'Active';
+  else if (flags.disable === true || flags.disable === 'true') status = 'Disabled';
+  else if (flags.pause === true || flags.pause === 'true') status = 'Paused';
+  else if (flags.status) {
+    const match = ['Active', 'Disabled', 'Paused'].find((x) => x.toLowerCase() === String(flags.status).toLowerCase());
+    if (!match) { ui.error('--status must be Active, Disabled, or Paused'); process.exit(1); }
+    status = match;
+  }
+  if (status) body.status = status;
+
+  // Lifecycle mode promote/demote (also available as: alerts rules promote|demote <id>).
+  if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
+
+  if (Object.keys(body).length === 0) {
+    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), or --mode test|prod (or: alerts rules promote/demote <id>).');
+    process.exit(1);
+  }
+
+  const s = ui.spinner('Updating alert rule');
+  try {
+    await api.put(`/alert-rules/${id}`, body);
+    s.stop('Updated');
+    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`].filter(Boolean);
+    ui.success('Alert rule updated' + (extras.length ? ` (${extras.join(', ')})` : ''));
+  } catch (err) {
+    s.fail('Failed to update alert rule');
+    throw err;
+  }
+}
+
+async function alertRuleSetSql(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const sqlQuery = readSqlArg(flags);
+  if (!id || !sqlQuery) {
+    ui.error('Usage: securenow alerts rules set-sql <rule-id> --sql <sql|@file|-> [--nlp "intent"] [--no-validate]');
+    process.exit(1);
+  }
+  const body = { sqlQuery };
+  if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
+  if (flags.category) body.category = flags.category;
+
+  const s = ui.spinner('Updating rule SQL');
+  try {
+    const data = await api.put(`/alert-rules/${id}`, body);
+    s.stop('Rule SQL updated');
+    const ok = flags['no-validate'] ? null : await validateRuleById(id, flags);
+    if (ok && ok.status === 'failed') {
+      ui.warn(`Saved, but the new SQL failed a dry-run: ${ok.error || 'unknown error'}`);
+      ui.info('Fix the SQL and run set-sql again, or delete the rule with: securenow alerts rules delete ' + id);
+    } else if (ok) {
+      ui.success('Saved and dry-run clean.');
+    }
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to update rule SQL');
+    throw err;
+  }
+}
+
+// List a rule's configuration version history (newest first). Each material update (SQL,
+// instant config, settings), duplicate, and rollback is a version; rollback restores a
+// prior snapshot and is itself recorded as a new version.
+async function alertRuleVersions(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules versions <rule-id> [--limit N] [--page N]');
+    process.exit(1);
+  }
+  const query = {};
+  if (flags.limit) query.limit = flags.limit;
+  if (flags.page) query.page = flags.page;
+  const s = ui.spinner('Fetching version history');
+  let data;
+  try {
+    data = await api.get(`/alert-rules/${id}/versions`, Object.keys(query).length ? { query } : undefined);
+    s.stop(`Found ${data.total ?? (data.versions || []).length} version${(data.total ?? 0) === 1 ? '' : 's'}`);
+  } catch (err) {
+    s.fail(`Failed to fetch versions: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  const rows = data.versions || [];
+  if (rows.length === 0) { ui.info('No versions recorded yet.'); return; }
+  console.log('');
+  ui.info(`Current: v${data.currentVersion}`);
+  for (const v of rows) {
+    const marker = v.isCurrent ? ui.c.green('→') : ' ';
+    const when = v.createdAt ? new Date(v.createdAt).toISOString().replace('T', ' ').slice(0, 19) : '';
+    const extra = v.changeType === 'rollback' && v.rolledBackFrom ? ` (from v${v.rolledBackFrom})` : '';
+    console.log(`${marker} ${ui.c.bold('v' + v.version).padEnd(14)} ${String(v.changeType + extra).padEnd(22)} ${ui.c.dim(when)}  ${v.createdByName || ''}`);
+    if (v.reason) console.log(`     ${ui.c.dim(ui.truncate(v.reason, 90))}`);
+  }
+  console.log('');
+  ui.info(`Show: securenow alerts rules version ${ui.truncate(id, 12)} <n>   |   Roll back: securenow alerts rules rollback ${ui.truncate(id, 12)} <n>`);
+}
+
+// Show one version's full material snapshot (diff-able SQL / instant / settings).
+async function alertRuleVersionShow(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const version = args[1];
+  if (!id || !version) {
+    ui.error('Usage: securenow alerts rules version <rule-id> <version-number>');
+    process.exit(1);
+  }
+  const s = ui.spinner(`Fetching v${version}`);
+  let data;
+  try {
+    data = await api.get(`/alert-rules/${id}/versions/${version}`);
+    s.stop(`Loaded v${version}`);
+  } catch (err) {
+    s.fail(`Failed: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  const v = data.version || {};
+  const snap = v.snapshot || {};
+  console.log('');
+  ui.success(`v${v.version}${v.isCurrent ? ' (current)' : ''} — ${v.changeType}`);
+  console.log(`  When     ${v.createdAt || ''}`);
+  if (v.createdByName) console.log(`  By       ${v.createdByName}`);
+  if (v.reason) console.log(`  Reason   ${v.reason}`);
+  if (v.rolledBackFrom) console.log(`  Restored v${v.rolledBackFrom}`);
+  console.log('');
+  console.log(`  Name     ${snap.name || ''}`);
+  console.log(`  Mode     ${snap.mode || ''} / ${snap.executionMode || ''}   severity ${snap.severity || '-'}`);
+  if (snap.instant && snap.instant.enabled) {
+    console.log(`  Instant  enabled  block=${snap.instant.block}  (${(snap.instant.conditions || []).length} condition${(snap.instant.conditions || []).length === 1 ? '' : 's'})`);
+  }
+  if (snap.query && snap.query.sqlQuery) {
+    console.log('  SQL:');
+    console.log(snap.query.sqlQuery.split('\n').map((l) => '    ' + ui.c.dim(l)).join('\n'));
+  }
+}
+
+// Roll a rule back to a prior version — restores that version's full snapshot and records it
+// as a new version (append-only history). System (read-only template) rules can't be rolled back.
+async function alertRuleRollback(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const version = args[1] || flags.version;
+  if (!id || !version) {
+    ui.error('Usage: securenow alerts rules rollback <rule-id> <version-number> [--reason "..."] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.yes && !flags.force) {
+    const ok = await ui.confirm(`Roll back rule ${ui.truncate(id, 12)} to v${version}? Restores that config and creates a new version.`);
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const body = { version: Number(version) };
+  if (flags.reason) body.reason = String(flags.reason);
+  const s = ui.spinner(`Rolling back to v${version}`);
+  let data;
+  try {
+    data = await api.post(`/alert-rules/${id}/rollback`, body);
+    s.stop(`Rolled back to v${version}`);
+  } catch (err) {
+    s.fail(`Failed to roll back: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  ui.success(`Restored from v${data.rolledBackFrom} → now at v${data.newVersion}`);
+  ui.info(`History: securenow alerts rules versions ${ui.truncate(id, 12)}`);
+}
+
+async function alertRuleDelete(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules delete <rule-id> [--yes]');
+    process.exit(1);
+  }
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm(`Delete alert rule ${id}? This cannot be undone (system rules can only be disabled).`);
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const s = ui.spinner('Deleting alert rule');
+  try {
+    const data = await api.delete(`/alert-rules/${id}`);
+    s.stop('Alert rule deleted');
+    if (flags.json) { ui.json(data); return; }
+    ui.success(`Deleted alert rule ${id}`);
+  } catch (err) {
+    s.fail('Failed to delete alert rule');
+    throw err;
+  }
+}
+
+// Run a dry-run test of an existing rule and return { status, error, resultCount }.
+// Used to validate a rule after create/set-sql. Never throws — returns null on error.
+async function validateRuleById(id, flags = {}) {
+  try {
+    let data = await api.post(`/alert-rules/${id}/test`, { mode: 'dry_run' });
+    if (data.testId) {
+      for (let i = 0; i < 40; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
+        if (['complete', 'failed'].includes(data.status)) break;
+      }
+    }
+    return { status: data.status, error: data.error, resultCount: data.resultCount };
+  } catch {
+    return null;
+  }
+}
+
+// Pick an existing rule id to host a candidate dry-run (the test endpoint needs a
+// rule to attach the candidate SQL to; a dry-run never mutates it). The host must
+// cover the requested app, or the API rejects the test.
+async function resolveHostRuleId(appKey) {
+  const data = await api.get('/alert-rules');
+  const rules = data.alertRules || data.rules || [];
+  if (!rules.length) return null;
+  const covers = (r) => !appKey || r.applicationsAll || (r.applications || []).includes(appKey);
+  const host = rules.find((r) => covers(r) && r.status === 'Active') || rules.find(covers);
+  if (!host) return null;
+  return host._id || host.id || null;
+}
+
+function readSqlArg(flags) {
+  const raw = flags.sql || flags.query || flags.file;
+  if (!raw) return null;
+  if (flags.file) return fs.readFileSync(flags.file, 'utf8');
+  const text = String(raw);
+  if (text === '-') return fs.readFileSync(0, 'utf8');
+  if (text.startsWith('@')) return fs.readFileSync(text.slice(1), 'utf8');
+  return text;
+}
+
+async function alertRuleTest(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules test <rule-id> [--app <key>] [--mode dry_run|live] [--wait]');
+    process.exit(1);
+  }
+
+  // Default to a read-only dry-run. `--mode live` inserts synthetic spans into the app's
+  // telemetry, so it must be asked for explicitly.
+  const body = { mode: typeof flags.mode === 'string' ? flags.mode : 'dry_run' };
+  if (flags.app) body.applicationKey = flags.app;
+  const s = ui.spinner('Starting alert rule test');
+  try {
+    let data = await api.post(`/alert-rules/${id}/test`, body);
+    if (flags.wait && data.testId) {
+      s.update('Waiting for alert rule test results');
+      for (let i = 0; i < 40; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
+        if (['complete', 'failed'].includes(data.status)) break;
+      }
+    }
+    s.stop('Alert rule test ready');
+    if (flags.json) { ui.json(data); return; }
+    console.log('');
+    ui.keyValue([
+      ['Test ID', data.testId || '-'],
+      ['Mode', data.mode || body.mode],
+      ['Status', data.status || '-'],
+      ['Result count', String(data.resultCount ?? '-')],
+      ['Error', data.error || '-'],
+      ...(data.warning ? [['Warning', data.warning]] : []),
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to test alert rule');
+    throw err;
+  }
+}
+
+async function alertRuleCandidateTest(args, flags) {
+  requireAuth();
+  let id = args[0];
+  const candidateSqlQuery = readSqlArg(flags);
+  if (!candidateSqlQuery) {
+    ui.error('Usage: securenow alerts rules validate --sql <sql|@file|-> [--app <key>]   (or dry-run-query <rule-id> --sql ...)');
+    process.exit(1);
+  }
+  // The test endpoint attaches the candidate SQL to an existing rule. When no
+  // rule id is given, auto-pick a host so a candidate can be validated before any
+  // rule exists for it. A brand-new account has no rules at all (none are pre-built):
+  // its first rule is validated by `alerts rules create`, which dry-runs the SQL itself.
+  if (!id) {
+    id = await resolveHostRuleId(flags.app);
+    if (!id) {
+      ui.error(flags.app
+        ? `No existing rule covers app ${flags.app} to host the dry-run. Create one rule for it first, or pass <rule-id>.`
+        : 'No existing rule to host the dry-run. Create one rule first, or pass <rule-id>.');
+      process.exit(1);
+    }
+  }
+  // `validate` is meant to return a verdict, so wait for the result by default.
+  const wait = flags.wait || flags['no-wait'] !== true;
+
+  const body = { mode: 'dry_run', candidateSqlQuery };
+  if (flags.app) body.applicationKey = flags.app;
+
+  const s = ui.spinner('Starting candidate SQL dry-run');
+  try {
+    let data = await api.post(`/alert-rules/${id}/test`, body);
+    if (wait && data.testId) {
+      s.update('Waiting for candidate SQL dry-run results');
+      for (let i = 0; i < 40; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        data = await api.get(`/alert-rules/${id}/test/${data.testId}`);
+        if (['complete', 'failed'].includes(data.status)) break;
+      }
+    }
+    s.stop('Candidate dry-run ready');
+    if (flags.json) { ui.json(data); return; }
+    console.log('');
+    ui.keyValue([
+      ['Test ID', data.testId || '-'],
+      ['Status', data.status || '-'],
+      ['Candidate', data.candidate ? 'yes' : 'no'],
+      ['Current SQL hash', data.currentSqlHash || '-'],
+      ['Candidate SQL hash', data.candidateSqlHash || '-'],
+      ['Result count', String(data.resultCount ?? '-')],
+      ['Error', data.error || '-'],
+      ...(data.warning ? [['Warning', data.warning]] : []),
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to dry-run candidate SQL');
+    throw err;
+  }
+}
+
+async function alertRuleQueryUpdate(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const sqlQuery = readSqlArg(flags);
+  const reason = flags.reason;
+  if (!id || !sqlQuery || !reason) {
+    ui.error('Usage: securenow alerts rules tune-query <rule-id> --sql <sql|@file|-> --reason "..." --apply-globally --yes');
+    process.exit(1);
+  }
+  if (!flags['apply-globally'] && flags.applyGlobally !== true) {
+    ui.error('System query tuning requires --apply-globally.');
+    process.exit(1);
+  }
+
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Update the shared system query mapping for all customer copies?');
+    if (!ok) {
+      ui.info('Cancelled');
+      return;
+    }
+  }
+
+  const body = {
+    sqlQuery,
+    reason,
+    applyGlobally: true,
+    reactivatePausedCopies: !!(flags['reactivate-paused'] || flags.reactivatePausedCopies),
+  };
+  if (flags['expected-hash']) body.expectedCurrentSqlHash = flags['expected-hash'];
+  if (flags.notification) body.reviewNotificationId = flags.notification;
+  if (flags.note) body.reviewNote = flags.note;
+
+  const s = ui.spinner('Updating system query mapping');
+  try {
+    const data = await api.put(`/alert-rules/${id}/query-mapping`, body);
+    s.stop('System query mapping updated');
+    if (flags.json) { ui.json(data); return; }
+    console.log('');
+    ui.keyValue([
+      ['Query mapping', data.queryMapping?.name || data.queryMapping?.id || '-'],
+      ['Previous SQL hash', data.queryMapping?.previousSqlHash || '-'],
+      ['New SQL hash', data.queryMapping?.newSqlHash || '-'],
+      ['Affected system rules', String(data.affectedSystemRules ?? '-')],
+      ['Reactivated paused copies', data.reactivatedPausedCopies ? 'yes' : 'no'],
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to update system query mapping');
+    throw err;
+  }
+}
+
+async function alertRuleExclusions(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const action = args[1] || 'list';
+  if (!id) {
+    ui.error('Usage: securenow alerts rules exclusions <rule-id> [list|add|delete] [exclusion-id]');
+    process.exit(1);
+  }
+
+  try {
+    if (action === 'add') {
+      const body = {};
+      if (flags.conditions) body.conditions = JSON.parse(flags.conditions);
+      if (flags['match-mode']) body.matchMode = flags['match-mode'];
+      if (flags.reason) body.reason = flags.reason;
+      if (flags.path) body.pathPattern = flags.path;
+      const data = await api.post(`/alert-rules/${id}/exclusions`, body);
+      if (flags.json) { ui.json(data); return; }
+      ui.success('Exclusion added');
+      return;
+    }
+
+    if (action === 'delete' || action === 'remove') {
+      const exclusionId = args[2];
+      if (!exclusionId) {
+        ui.error('Exclusion id required.');
+        process.exit(1);
+      }
+      const data = await api.delete(`/alert-rules/${id}/exclusions/${exclusionId}`);
+      if (flags.json) { ui.json(data); return; }
+      ui.success('Exclusion removed');
+      return;
+    }
+
+    const data = await api.get(`/alert-rules/${id}/exclusions`);
+    const exclusions = data.exclusions || [];
+    if (flags.json) { ui.json(data); return; }
+    console.log('');
+    const rows = exclusions.map((e) => [
+      ui.c.dim(ui.truncate(e._id, 12)),
+      e.isActive === false ? ui.statusBadge('disabled') : ui.statusBadge('active'),
+      e.matchMode || 'all',
+      ui.truncate(e.reason || e.pathPattern || JSON.stringify(e.conditions || []), 72),
+    ]);
+    ui.table(['ID', 'Status', 'Mode', 'Reason/Pattern'], rows);
+    console.log('');
+  } catch (err) {
+    throw err;
+  }
+}
+
+// ── Alert Channels ──
+
+async function alertChannelsList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching alert channels');
+  try {
+    const data = await api.get('/alert-channels');
+    const channels = data.alertChannels || [];
+    s.stop(`Found ${channels.length} channel${channels.length !== 1 ? 's' : ''}`);
+
+    if (flags.json) { ui.json(channels); return; }
+
+    console.log('');
+    const rows = channels.map(ch => [
+      ui.c.dim(ui.truncate(ch._id, 12)),
+      ch.name || '—',
+      ch.type || '—',
+      ui.statusBadge(ch.enabled !== false ? 'enabled' : 'disabled'),
+      ch.target || ch.email || ch.webhookUrl || '—',
+    ]);
+    ui.table(['ID', 'Name', 'Type', 'Status', 'Target'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch alert channels');
+    throw err;
+  }
+}
+
+// ── Alert History ──
+
+async function alertHistoryList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching alert history');
+  try {
+    const query = { limit: flags.limit || 20 };
+    const data = await api.get('/alert-history', { query });
+    const history = data.alerts || [];
+    s.stop(`Found ${history.length} alert${history.length !== 1 ? 's' : ''}${data.totalItems ? ` (${data.totalItems} total)` : ''}`);
+
+    if (flags.json) { ui.json(data); return; }
+
+    console.log('');
+    const rows = history.map(h => [
+      ui.c.dim(ui.truncate(h._id, 12)),
+      h.ruleName || h.type || '—',
+      h.severity ? ui.statusBadge(h.severity) : '—',
+      ui.truncate(h.message || h.description || '', 40),
+      h.serviceName || '—',
+      ui.timeAgo(h.triggeredAt || h.createdAt),
+    ]);
+    ui.table(['ID', 'Rule', 'Severity', 'Message', 'App', 'Triggered'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch alert history');
+    throw err;
+  }
+}
+
+// ── Blocklist ──
+
+function describeBlockTarget(entry) {
+  const parts = [entry.ip || entry.cidr || '-'];
+  if (entry.method && entry.method !== 'ALL') parts.push(entry.method);
+  if (entry.pathPattern) parts.push(`${entry.pathMatchMode || 'prefix'}:${entry.pathPattern}`);
+  return parts.join(' ');
+}
+
+async function blocklistList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching blocklist');
+  try {
+    const query = {};
+    if (flags.page) query.page = flags.page;
+    if (flags.limit) query.limit = flags.limit;
+    if (flags.app) query.appKey = flags.app;
+    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
+    if (flags.status) query.status = flags.status;
+    if (flags.search) query.search = flags.search;
+    if (flags.view) query.view = flags.view;
+    if (flags.approvalStatus || flags['approval-status']) {
+      query.approvalStatus = flags.approvalStatus || flags['approval-status'];
+    }
+    const data = await api.get('/blocklist', { query });
+    const items = data.blockedIps || [];
+    s.stop(`Found ${items.length} blocked IP${items.length !== 1 ? 's' : ''}${data.total ? ` (${data.total} total)` : ''}`);
+
+    if (flags.json) { ui.json(data); return; }
+
+    console.log('');
+    const rows = items.map(b => [
+      ui.c.dim(ui.truncate(b._id, 12)),
+      ui.c.red(describeBlockTarget(b)),
+      ui.truncate(b.reason || '', 40),
+      b.source || '—',
+      b.status || 'active',
+      b.applicationKey || ui.c.dim('all apps'),
+      b.environment || ui.c.dim('all envs'),
+      ui.timeAgo(b.createdAt),
+      b.unblockedAt ? ui.timeAgo(b.unblockedAt) : ui.c.dim('—'),
+      b.expiresAt ? new Date(b.expiresAt).toLocaleDateString() : ui.c.dim('permanent'),
+    ]);
+    ui.table(['ID', 'Target', 'Reason', 'Source', 'Status', 'App', 'Env', 'Added', 'Unblocked', 'Expires'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch blocklist');
+    throw err;
+  }
+}
+
+async function revokeRoute(args, flags) {
+  const sub = args[0];
+  if (sub === 'list') return revokeList(args.slice(1), flags);
+  if (sub === 'restore') return revokeRestore(args.slice(1), flags);
+  if (sub === 'session' || sub === 'user') return revokeAdd(sub, args.slice(1), flags);
+  ui.error('Usage: securenow revoke <session <id> | user <id> | list | restore <id>> [--reason "..."] [--duration 24h] [--app <key>] [--env <env>]');
+  process.exit(1);
+}
+
+async function revokeAdd(type, args, flags) {
+  requireAuth();
+  const value = args[0];
+  if (!value) {
+    ui.error(`Usage: securenow revoke ${type} <${type === 'session' ? 'session-id' : 'user-id'}> [--reason "..."] [--duration 24h] [--app <key>] [--env <env>]`);
+    process.exit(1);
+  }
+  const body = { type, value, source: 'cli' };
+  if (flags.reason) body.reason = flags.reason;
+  if (flags.duration) body.duration = flags.duration;
+  if (flags.app || flags.apps) body.applicationKey = flags.app || flags.apps;
+  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
+
+  const s = ui.spinner(`Revoking ${type} ${value}`);
+  try {
+    const data = await api.post('/revocations', body);
+    s.stop(`Revoked ${type} ${ui.truncate(value, 24)}`);
+    if (flags.json) { ui.json(data); return; }
+    const r = data.revocation || data;
+    ui.keyValue([
+      ['ID', r._id || r.id || '-'],
+      ['Type', r.type || type],
+      ['Value', r.value || value],
+      ['Scope', r.applicationKey || 'all apps'],
+      ['Expires', r.expiresAt ? new Date(r.expiresAt).toISOString() : 'never'],
+    ]);
+  } catch (err) {
+    s.fail('Failed to revoke');
+    throw err;
+  }
+}
+
+async function revokeList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching revocations');
+  try {
+    const query = {};
+    if (flags.type) query.type = flags.type;
+    if (flags.status) query.status = flags.status;
+    const data = await api.get('/revocations', { query });
+    const entries = data.revocations || [];
+    s.stop(`Found ${entries.length} revocation${entries.length !== 1 ? 's' : ''}`);
+    if (flags.json) { ui.json(entries); return; }
+    console.log('');
+    ui.table(['ID', 'Type', 'Value', 'Scope', 'Expires'], entries.map((r) => [
+      ui.c.dim(ui.truncate(r._id || r.id, 12)),
+      r.type,
+      ui.truncate(r.value, 28),
+      r.applicationKey || ui.c.dim('all'),
+      r.expiresAt ? new Date(r.expiresAt).toISOString().slice(0, 16) : ui.c.dim('never'),
+    ]));
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to list revocations');
+    throw err;
+  }
+}
+
+async function revokeRestore(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) { ui.error('Usage: securenow revoke restore <id> [--reason "..."]'); process.exit(1); }
+  const s = ui.spinner('Restoring');
+  try {
+    const data = await api.post(`/revocations/${id}/restore`, { reason: flags.reason || '' });
+    s.stop('Revocation lifted');
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to restore');
+    throw err;
+  }
+}
+
+async function blocklistAdd(args, flags) {
+  requireAuth();
+  let ip = args[0];
+  if (!ip) {
+    ip = await ui.prompt('IP address or CIDR to block');
+    if (!ip) { ui.error('IP is required'); process.exit(1); }
+  }
+
+  const body = { ip };
+  if (flags.reason) body.reason = flags.reason;
+  if (flags.duration) body.duration = flags.duration;
+  if (flags.app) body.appKey = flags.app;
+  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
+  if (flags.route || flags.path || flags.pattern) body.pathPattern = flags.route || flags.path || flags.pattern;
+  if (flags.mode || flags['path-mode']) body.pathMatchMode = flags.mode || flags['path-mode'];
+  if (flags.method) body.method = flags.method;
+
+  const target = describeBlockTarget({ ip, method: body.method, pathPattern: body.pathPattern, pathMatchMode: body.pathMatchMode });
+  const s = ui.spinner(`Blocking ${target}`);
+  try {
+    const data = await api.post('/blocklist', body);
+    s.stop(`${target} added to blocklist`);
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to add to blocklist');
+    throw err;
+  }
+}
+
+async function blocklistRemove(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Blocklist entry ID required. Usage: securenow blocklist unblock <id> [--reason <reason>]');
+    process.exit(1);
+  }
+
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Unblock this IP? Firewall enforcement stops, but block report and history stay saved.');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+
+  const s = ui.spinner('Unblocking IP');
+  try {
+    const body = {};
+    if (flags.reason) body.reason = flags.reason;
+    await api.post(`/blocklist/${id}/unblock`, body);
+    s.stop('Unblocked; block report and history retained');
+  } catch (err) {
+    s.fail('Failed to unblock IP');
+    throw err;
+  }
+}
+
+// Approve a block that the AI prepared but parked pending customer approval
+// (e.g. the autopilot held it under block_risk_score_below_policy). Enforces the IP.
+async function blocklistApprove(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow blocklist approve <pending-block-id> [--reason <reason>] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Approve this pending block? The IP will be enforced by the firewall.');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const s = ui.spinner('Approving pending block');
+  try {
+    const body = {};
+    if (flags.reason) body.reason = flags.reason;
+    const data = await api.post(`/blocklist/${id}/approve`, body);
+    s.stop('Pending block approved — IP now enforced');
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to approve pending block');
+    throw err;
+  }
+}
+
+// Reject a pending block: the IP is NOT blocked, the entry is removed, and a scoped
+// no-block decision is recorded so auto-block won't re-block this IP for the same rule.
+async function blocklistReject(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow blocklist reject <pending-block-id> [--reason <reason>] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Reject this pending block? The IP will NOT be blocked; a scoped no-block decision is recorded for the rule that proposed it.');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const s = ui.spinner('Rejecting pending block');
+  try {
+    const body = {};
+    if (flags.reason) body.reason = flags.reason;
+    const data = await api.post(`/blocklist/${id}/reject`, body);
+    s.stop('Pending block rejected — IP cleared (scoped no-block decision recorded)');
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to reject pending block');
+    throw err;
+  }
+}
+
+async function blocklistStats(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching blocklist stats');
+  try {
+    const data = await api.get('/blocklist/stats');
+    const stats = data.stats || data;
+    s.stop('Stats loaded');
+
+    if (flags.json) { ui.json(stats); return; }
+
+    console.log('');
+    ui.heading('Blocklist Statistics');
+    console.log('');
+    ui.keyValue([
+      ['Total Active', String(stats.totalActive ?? '—')],
+      ['Total Removed', String(stats.totalRemoved ?? '—')],
+      ['Manual Blocks', String(stats.manualCount ?? '—')],
+      ['Automation Blocks', String(stats.automationCount ?? '—')],
+      ['Active Rules', String(stats.activeAutomationRules ?? '—')],
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch stats');
+    throw err;
+  }
+}
+
+// ── Allowlist ──
+
+async function allowlistList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching allowlist');
+  try {
+    const query = {};
+    if (flags.page) query.page = flags.page;
+    if (flags.limit) query.limit = flags.limit;
+    if (flags.app) query.appKey = flags.app;
+    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
+    const data = await api.get('/allowlist', { query });
+    const items = data.allowedIps || [];
+    s.stop(`Found ${items.length} allowed IP${items.length !== 1 ? 's' : ''}${data.total ? ` (${data.total} total)` : ''}`);
+
+    if (flags.json) { ui.json(data); return; }
+
+    console.log('');
+    const rows = items.map(a => [
+      ui.c.dim(ui.truncate(a._id, 12)),
+      ui.c.green(a.ip || '—'),
+      a.label || ui.c.dim('—'),
+      ui.truncate(a.reason || '', 40),
+      a.applicationKey || ui.c.dim('all apps'),
+      a.environment || ui.c.dim('all envs'),
+      ui.timeAgo(a.createdAt),
+      a.expiresAt ? new Date(a.expiresAt).toLocaleDateString() : ui.c.dim('permanent'),
+    ]);
+    ui.table(['ID', 'IP/CIDR', 'Label', 'Reason', 'App', 'Env', 'Added', 'Expires'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch allowlist');
+    throw err;
+  }
+}
+
+async function allowlistAdd(args, flags) {
+  requireAuth();
+  let ip = args[0];
+  if (!ip) {
+    ip = await ui.prompt('IP address or CIDR to allow');
+    if (!ip) { ui.error('IP is required'); process.exit(1); }
+  }
+
+  const body = { ip };
+  if (flags.label) body.label = flags.label;
+  if (flags.reason) body.reason = flags.reason;
+  if (flags.app) {
+    body.applicationsAll = false;
+    body.applicationKeys = String(flags.app).split(',').map((x) => x.trim()).filter(Boolean);
+  }
+  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
+
+  if (!flags.force && !flags.yes) {
+    ui.warn('IP Allowlist is deny-by-default: once active, only listed IPs can reach the scoped app/environment and all others are blocked.');
+    ui.info('Use `securenow trusted add` instead if this IP should be trusted without locking out normal visitors.');
+    const ok = await ui.confirm('Add this IP to the restrictive allowlist?');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  body.allowlistDenyAllApproved = true;
+
+  const s = ui.spinner(`Allowing ${ip}`);
+  try {
+    await api.post('/allowlist', body);
+    s.stop(`${ip} added to allowlist`);
+  } catch (err) {
+    s.fail('Failed to add to allowlist');
+    throw err;
+  }
+}
+
+async function allowlistRemove(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Allowlist entry ID required. Usage: securenow allowlist remove <id>');
+    process.exit(1);
+  }
+
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Remove this IP from the allowlist?');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+
+  const s = ui.spinner('Removing from allowlist');
+  try {
+    await api.delete(`/allowlist/${id}`);
+    s.stop('Removed from allowlist');
+  } catch (err) {
+    s.fail('Failed to remove from allowlist');
+    throw err;
+  }
+}
+
+async function allowlistStats(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching allowlist stats');
+  try {
+    const data = await api.get('/allowlist/stats');
+    const stats = data.stats || data;
+    s.stop('Stats loaded');
+
+    if (flags.json) { ui.json(stats); return; }
+
+    console.log('');
+    ui.heading('Allowlist Statistics');
+    console.log('');
+    ui.keyValue([
+      ['Total Active', String(stats.totalActive ?? '—')],
+      ['Total Removed', String(stats.totalRemoved ?? '—')],
+    ]);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch stats');
+    throw err;
+  }
+}
+
+// ── Trusted IPs ──
+
+async function trustedList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching trusted IPs');
+  try {
+    const query = {};
+    if (flags.app) query.appKey = flags.app;
+    if (flags.env || flags.environment) query.environment = flags.env || flags.environment;
+    const data = await api.get('/trusted-ips', { query });
+    const items = data.trustedIps || [];
+    s.stop(`Found ${items.length} trusted IP${items.length !== 1 ? 's' : ''}`);
+
+    if (flags.json) { ui.json(items); return; }
+
+    console.log('');
+    const rows = items.map(t => [
+      ui.c.dim(ui.truncate(t._id, 12)),
+      ui.c.green(t.ip || t.cidr || '—'),
+      t.label || t.description || ui.c.dim('—'),
+      t.applicationKey || ui.c.dim('all apps'),
+      t.environment || ui.c.dim('all envs'),
+      ui.timeAgo(t.createdAt),
+    ]);
+    ui.table(['ID', 'IP/CIDR', 'Label', 'App', 'Env', 'Added'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch trusted IPs');
+    throw err;
+  }
+}
+
+async function trustedAdd(args, flags) {
+  requireAuth();
+  let ip = args[0];
+  if (!ip) {
+    ip = await ui.prompt('IP address or CIDR to trust');
+    if (!ip) { ui.error('IP is required'); process.exit(1); }
+  }
+
+  const body = { ip };
+  if (flags.label) body.label = flags.label;
+  if (flags.description) body.description = flags.description;
+  if (flags.note) body.note = flags.note;
+  if (flags.app) {
+    body.applicationsAll = false;
+    body.applicationKeys = String(flags.app).split(',').map((x) => x.trim()).filter(Boolean);
+  }
+  if (flags.env || flags.environment) body.environment = flags.env || flags.environment;
+
+  const s = ui.spinner(`Adding ${ip} to trusted IPs`);
+  try {
+    await api.post('/trusted-ips', body);
+    s.stop(`${ip} added to trusted IPs`);
+  } catch (err) {
+    s.fail('Failed to add trusted IP');
+    throw err;
+  }
+}
+
+async function trustedRemove(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Trusted IP entry ID required. Usage: securenow trusted remove <id>');
+    process.exit(1);
+  }
+
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Remove this IP from trusted list?');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+
+  const s = ui.spinner('Removing from trusted IPs');
+  try {
+    await api.delete(`/trusted-ips/${id}`);
+    s.stop('Removed from trusted IPs');
+  } catch (err) {
+    s.fail('Failed to remove trusted IP');
+    throw err;
+  }
+}
+
+// ── Helpers ──
+
+async function resolveAppId(flags) {
+  const appKey = flags.app || config.getDefaultApp();
+  if (!appKey) return null;
+  const data = await api.get('/applications');
+  const apps = data.applications || [];
+  const match = apps.find(a => a.key === appKey);
+  return match ? { id: match._id, key: match.key, name: match.name } : null;
+}
+
+// ── Forensics ──
+
+async function forensicsQuery(args, flags) {
+  requireAuth();
+  const query = args.join(' ');
+  if (!query) {
+    ui.error('Query required. Usage: securenow forensics "your natural language query" [--app <key>]');
+    process.exit(1);
+  }
+
+  const s = ui.spinner('Submitting forensic query');
+  try {
+    const body = { query, environment: resolveEnvironment(flags, 'production') };
+    const resolved = await resolveAppId(flags);
+    if (resolved) {
+      body.applicationId = resolved.id;
+    } else if (flags.instance) {
+      body.instanceId = flags.instance;
+    }
+
+    const job = await api.post('/forensics/query', body);
+    const jobId = job.jobId;
+
+    if (!jobId) {
+      s.stop('Query complete');
+      if (flags.json) { ui.json(job); return; }
+      if (job.result) {
+        console.log('');
+        if (job.sqlquery) {
+          ui.subheading('Generated SQL');
+          console.log(`\n  ${ui.c.dim(job.sqlquery)}\n`);
+        }
+        const data = job.result;
+        if (Array.isArray(data) && data.length > 0) {
+          const headers = Object.keys(data[0]);
+          const rows = data.map(row => headers.map(h => String(row[h] ?? '')));
+          ui.table(headers, rows);
+        } else {
+          ui.json(data);
+        }
+        console.log('');
+      }
+      return;
+    }
+
+    s.update('Processing query...');
+
+    let result;
+    const maxAttempts = 60;
+    for (let i = 0; i < maxAttempts; i++) {
+      await new Promise(r => setTimeout(r, 2000));
+      result = await api.get(`/forensics/query/status/${jobId}`);
+      if (result.status === 'completed' || result.status === 'failed') break;
+      s.update(`Processing query... (${(i + 1) * 2}s)`);
+    }
+
+    if (result.status === 'failed') {
+      s.fail('Query failed');
+      ui.error(result.error || 'Unknown error');
+      return;
+    }
+
+    if (result.status !== 'completed') {
+      s.fail('Query timed out');
+      ui.warn('Query is still processing. Check back later.');
+      return;
+    }
+
+    s.stop('Query complete');
+
+    if (flags.json) { ui.json(result); return; }
+
+    console.log('');
+    if (result.sqlquery) {
+      ui.subheading('Generated SQL');
+      console.log(`\n  ${ui.c.dim(result.sqlquery)}\n`);
+    }
+
+    if (result.result) {
+      const data = result.result;
+      ui.subheading(`Results (${result.rowCount ?? (Array.isArray(data) ? data.length : '?')} rows)`);
+      console.log('');
+
+      if (Array.isArray(data) && data.length > 0) {
+        const headers = Object.keys(data[0]);
+        const rows = data.map(row => headers.map(h => String(row[h] ?? '')));
+        ui.table(headers, rows);
+      } else {
+        ui.json(data);
+      }
+    }
+    console.log('');
+  } catch (err) {
+    s.fail('Forensic query failed');
+    throw err;
+  }
+}
+
+async function forensicsLibrary(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching query library');
+  try {
+    const data = await api.get('/forensics/query-library');
+    const queries = data.data || [];
+    s.stop(`Found ${queries.length} saved quer${queries.length !== 1 ? 'ies' : 'y'}`);
+
+    if (flags.json) { ui.json(queries); return; }
+
+    console.log('');
+    const rows = queries.map(q => [
+      ui.c.dim(ui.truncate(q._id, 12)),
+      q.name || q.title || '—',
+      ui.truncate(q.description || q.query || '', 50),
+      ui.timeAgo(q.createdAt),
+    ]);
+    ui.table(['ID', 'Name', 'Description', 'Created'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch query library');
+    throw err;
+  }
+}
+
+// ── Forensics Chat ──
+
+async function forensicsChat(args, flags) {
+  requireAuth();
+  const resolved = await resolveAppId(flags);
+  if (!resolved) {
+    ui.error('App required. Usage: securenow forensics chat --app <key>');
+    ui.info('Set a default with: securenow apps default <key>');
+    process.exit(1);
+  }
+
+  console.log('');
+  ui.heading(`Forensics Chat — ${resolved.name || resolved.key}`);
+  console.log(ui.c.dim(`  App: ${resolved.key} (${resolved.id})`));
+  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
+
+  const environment = resolveEnvironment(flags, 'production');
+  console.log(ui.c.dim(`  Env: ${environment}`));
+
+  let conversationId = null;
+
+  const readline = require('readline');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+
+  const askLine = () => new Promise((resolve) => {
+    rl.question(ui.c.cyan('  you > '), (answer) => resolve(answer.trim()));
+  });
+
+  try {
+    while (true) {
+      const message = await askLine();
+      if (!message || message.toLowerCase() === 'exit' || message.toLowerCase() === 'quit') {
+        console.log('');
+        ui.info('Chat ended.');
+        break;
+      }
+
+      const s = ui.spinner('Thinking');
+      try {
+        const body = { message, applicationKey: resolved.key, environment };
+        if (conversationId) body.conversationId = conversationId;
+
+        const chatRes = await api.post('/forensics/chat', body);
+        conversationId = chatRes.conversationId;
+
+        if (chatRes.status === 'processing') {
+          let result;
+          for (let i = 0; i < 150; i++) {
+            await new Promise(r => setTimeout(r, 2000));
+            result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
+            if (result.status === 'complete' || result.status === 'failed' || result.status === 'awaiting_confirmation') break;
+            const progress = result._progress;
+            if (progress?.action) s.update(progress.action);
+          }
+
+          if (!result || result.status === 'processing') {
+            s.fail('Response timed out');
+            continue;
+          }
+
+          s.stop('Done');
+          printChatMessage(result.message);
+
+          if (result.status === 'awaiting_confirmation') {
+            const proceed = await ui.confirm('Proceed with this query?');
+            if (proceed) {
+              const cs = ui.spinner('Executing query');
+              await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
+              let confirmResult;
+              for (let i = 0; i < 90; i++) {
+                await new Promise(r => setTimeout(r, 2000));
+                confirmResult = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
+                if (confirmResult.status !== 'processing') break;
+              }
+              cs.stop('Done');
+              if (confirmResult?.message) printChatMessage(confirmResult.message);
+            } else {
+              ui.info('Query skipped. Ask a different question or refine.');
+            }
+          }
+        } else if (chatRes.message) {
+          s.stop('Done');
+          printChatMessage(chatRes.message);
+        } else {
+          s.stop('Done');
+        }
+      } catch (err) {
+        s.fail('Error');
+        ui.error(err.message);
+      }
+      console.log('');
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+function printChatMessage(msg) {
+  if (!msg) return;
+  console.log('');
+  if (msg.content) {
+    console.log(`  ${ui.c.green('ai >')} ${msg.content}`);
+  }
+  if (msg.sqlQuery) {
+    console.log('');
+    ui.subheading('Generated SQL');
+    console.log(`\n  ${ui.c.dim(msg.sqlQuery)}\n`);
+  }
+  if (msg.results && Array.isArray(msg.results) && msg.results.length > 0) {
+    ui.subheading(`Results (${msg.resultCount ?? msg.results.length} rows)`);
+    console.log('');
+    const headers = Object.keys(msg.results[0]);
+    const rows = msg.results.map(row => headers.map(h => String(row[h] ?? '')));
+    ui.table(headers, rows);
+  }
+  if (msg.estimation) {
+    const est = msg.estimation;
+    const rowLabel = est.timedOut
+      ? 'very large (estimation timed out)'
+      : est.estimatedRows != null
+        ? `~${Number(est.estimatedRows).toLocaleString()}`
+        : 'unknown';
+    console.log(`\n  ${ui.c.yellow('!')} Estimated rows: ${rowLabel}`);
+    if (est.suggestions?.length) {
+      console.log(ui.c.dim('  Suggestions:'));
+      for (const sug of est.suggestions) {
+        console.log(ui.c.dim(`    • ${sug}`));
+      }
+    }
+  }
+  if (msg.error && !msg.results) {
+    console.log(`\n  ${ui.c.red('Error:')} ${msg.error}`);
+  }
+}
+
+// ── IP Lookup ──
+
+async function ipLookup(args, flags) {
+  requireAuth();
+  const ip = args[0];
+  if (!ip) {
+    ui.error('IP address required. Usage: securenow ip <ip-address>');
+    process.exit(1);
+  }
+
+  const s = ui.spinner(`Looking up ${ip}`);
+  try {
+    const data = await api.get(`/ip/${ip}`);
+    s.stop('IP intelligence loaded');
+
+    if (flags.json) { ui.json(data); return; }
+
+    console.log('');
+    ui.heading(`IP Intelligence: ${data.ip || ip}`);
+    console.log('');
+
+    const pairs = [];
+    if (data.countryName || data.countryCode) pairs.push(['Country', `${data.countryName || ''} ${data.countryCode ? `(${data.countryCode})` : ''}`.trim()]);
+    if (data.domain) pairs.push(['Domain', data.domain]);
+    if (data.isp) pairs.push(['ISP', data.isp]);
+    if (data.usageType) pairs.push(['Usage Type', data.usageType]);
+    if (data.abuseConfidenceScore != null) pairs.push(['SecureNow IPDB Score', `${data.abuseConfidenceScore}/100`]);
+    if (data.securenowScore != null) pairs.push(['SecureNow Score', String(data.securenowScore)]);
+    if (data.verdict) pairs.push(['Verdict', data.verdict]);
+    if (data.isMalicious != null) pairs.push(['Malicious', data.isMalicious ? ui.c.red('Yes') : ui.c.green('No')]);
+    if (data.isBot != null) pairs.push(['Bot', data.isBot ? ui.c.yellow('Yes') : 'No']);
+    if (data.activityType) pairs.push(['Activity', data.activityType]);
+    if (data.totalReports != null) pairs.push(['Total Reports', String(data.totalReports)]);
+    if (data.lastReportedAt) pairs.push(['Last Reported', new Date(data.lastReportedAt).toLocaleString()]);
+
+    if (pairs.length) {
+      ui.keyValue(pairs);
+    }
+
+    if (data.riskFactors?.length) {
+      ui.subheading('Risk Factors');
+      console.log('');
+      data.riskFactors.forEach(f => console.log(`  • ${f}`));
+    }
+
+    if (data.attackTypes?.length) {
+      ui.subheading('Attack Types');
+      console.log('');
+      data.attackTypes.forEach(a => console.log(`  • ${a}`));
+    }
+
+    if (data.summary) {
+      ui.subheading('Summary');
+      console.log(`\n  ${data.summary}`);
+    }
+    console.log('');
+  } catch (err) {
+    s.fail('IP lookup failed');
+    throw err;
+  }
+}
+
+async function ipTraces(args, flags) {
+  requireAuth();
+  const ip = args[0];
+  if (!ip) {
+    ui.error('IP address required. Usage: securenow ip traces <ip>');
+    process.exit(1);
+  }
+
+  const s = ui.spinner(`Fetching traces for ${ip}`);
+  try {
+    const query = {};
+    const appKey = resolveApp(flags);
+    if (appKey) query.appKeys = appKey;
+    const environment = resolveEnvironment(flags, null);
+    if (environment) query.environment = environment;
+    const data = await api.get(`/ip/${ip}/traces`, { query });
+    const traces = data.traces || [];
+    s.stop(`Found ${traces.length} trace${traces.length !== 1 ? 's' : ''}`);
+
+    if (flags.json) { ui.json(data); return; }
+
+    console.log('');
+    const rows = traces.map(t => [
+      ui.c.dim(ui.truncate(t.traceID || t.traceId, 16)),
+      t.httpMethod || t.method || '—',
+      ui.httpStatusColor(t.statusCode || t.httpStatusCode || t.responseStatusCode || '—'),
+      ui.truncate(t.httpUrl || t.url || '', 40),
+      ui.durationColor(t.durationNano ? t.durationNano / 1e6 : t.duration),
+      ui.timeAgo(t.timestamp),
+    ]);
+    ui.table(['Trace ID', 'Method', 'Status', 'URL', 'Duration', 'Time'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch traces');
+    throw err;
+  }
+}
+
+// ── Instances ──
+
+async function instancesList(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching instances');
+  try {
+    const data = await api.get('/instances');
+    const instances = data.instances || [];
+    s.stop(`Found ${instances.length} instance${instances.length !== 1 ? 's' : ''}`);
+
+    if (flags.json) { ui.json(instances); return; }
+
+    console.log('');
+    const rows = instances.map(inst => [
+      ui.c.dim(ui.truncate(inst._id, 12)),
+      inst.name || inst.host || '—',
+      inst.host || '—',
+      inst.port != null ? String(inst.port) : '—',
+      inst.linkedApps != null ? String(inst.linkedApps) : '—',
+      ui.timeAgo(inst.createdAt),
+    ]);
+    ui.table(['ID', 'Name', 'Host', 'Port', 'Linked Apps', 'Added'], rows);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch instances');
+    throw err;
+  }
+}
+
+async function instancesTest(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Instance ID required. Usage: securenow instances test <id>');
+    process.exit(1);
+  }
+
+  const s = ui.spinner('Testing instance connection');
+  try {
+    const result = await api.post(`/instances/${id}/test`);
+    if (result.success) {
+      s.stop(`Connection successful${result.storageGb ? ` (${result.storageGb} GB storage)` : ''}`);
+    } else {
+      s.fail(result.message || 'Connection failed');
+    }
+
+    if (flags.json) ui.json(result);
+  } catch (err) {
+    s.fail('Instance test failed');
+    throw err;
+  }
+}
+
+// ── Analytics ──
+
+async function analytics(args, flags) {
+  requireAuth();
+  const s = ui.spinner('Fetching analytics');
+  try {
+    const query = {};
+    const appKey = resolveApp(flags);
+    if (flags.instance) query.instanceId = flags.instance;
+
+    const data = await api.get('/analytics/summary', { query });
+
+    s.stop('Analytics loaded');
+
+    if (flags.json) {
+      ui.json(data);
+      return;
+    }
+
+    console.log('');
+    ui.heading('Analytics Overview');
+    console.log('');
+
+    const groups = ['2xx-responses', '3xx-responses', '4xx-responses', '5xx-responses', '500-errors'];
+    const pairs = groups.map(ep => {
+      const val = data[ep];
+      const count = val?.meta?.count ?? '—';
+      return [ep, String(count)];
+    });
+    ui.keyValue(pairs);
+    console.log('');
+  } catch (err) {
+    s.fail('Failed to fetch analytics');
+    throw err;
+  }
+}
+
+module.exports = {
+  alertRulesRoute,
+  alertRulesList,
+  alertRuleShow,
+  alertRuleUpdate,
+  alertRuleTest,
+  alertRuleExclusions,
+  alertChannelsList,
+  alertHistoryList,
+  blocklistList,
+  blocklistAdd,
+  blocklistRemove,
+  blocklistApprove,
+  blocklistReject,
+  blocklistStats,
+  revokeRoute,
+  allowlistList,
+  allowlistAdd,
+  allowlistRemove,
+  allowlistStats,
+  trustedList,
+  trustedAdd,
+  trustedRemove,
+  forensicsQuery,
+  forensicsChat,
+  forensicsLibrary,
+  ipLookup,
+  ipTraces,
+  instancesList,
+  instancesTest,
+  analytics,
+};