@bridgeline-digital/hawk-app-cli 0.1.0-dev.20261020202308 → 0.1.0

package/src/sso.mjs

@@ -1,182 +1,182 @@
-// `hawk-app sso`: Bridgeline staff sign in with their AD account in the browser, and the platform issues them their own
-// publisher key (it expires; sign in again then). No key is handed from person to person. `hawk-app login` with a key
-// from the portal keeps working, and pipelines keep using portal keys.
-//
-// The standard flow for command-line tools: OAuth 2.0 authorization code with PKCE (RFC 7636) against the HawkSearch
-// user pool, sent straight to the Bridgeline identity provider, with the browser returning to a one-time server on
-// localhost (RFC 8252). The ID token goes to the platform, which verifies it and answers with the key.
-import { spawn } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import { createServer } from 'node:http';
-import { hostname } from 'node:os';
-import { credentialsPath, readCredentials, saveCredential } from './credentials.mjs';
-import { describePlatform, resolveSettings } from './env.mjs';
-
-const SIGN_IN_TIMEOUT_MS = 5 * 60_000;
-
-const base64url = (buffer) => buffer.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
-
-/** Opens a URL in the default browser, without a shell (the URL has & in it). Best effort: the URL is printed too. */
-export function openBrowser(url) {
-    const [command, args] =
-        process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
-    try {
-        const child = spawn(command, args, { stdio: 'ignore', detached: true });
-        child.on('error', () => {});
-        child.unref();
-    } catch {
-        // The printed address still works.
-    }
-}
-
-const PAGE = (title, text) =>
-    `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.4rem">${title}</h1><p>${text}</p></body>`;
-
-/**
- * Listens on the first free port of `ports` for the browser's return to /callback. Resolves to { port, redirectUri,
- * result, close }: `result` settles with the query of the first /callback request.
- */
-async function callbackServer(ports, expectedState) {
-    let settle;
-    const result = new Promise((resolve, reject) => (settle = { resolve, reject }));
-    const server = createServer((req, res) => {
-        const url = new URL(req.url ?? '/', 'http://localhost');
-        if (url.pathname !== '/callback') {
-            res.writeHead(404).end();
-            return;
-        }
-        const query = Object.fromEntries(url.searchParams);
-        if (query.state !== expectedState) {
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' }).end(PAGE('Sign-in failed', 'This sign-in was not started by this terminal. Run <code>hawk-app sso</code> again.'));
-            settle.reject(new Error('The sign-in came back with the wrong state (not this attempt). Nothing was saved.'));
-            return;
-        }
-        const failed = Boolean(query.error);
-        res.writeHead(failed ? 400 : 200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }).end(
-            failed ? PAGE('Sign-in failed', 'Go back to the terminal for the details.') : PAGE('Signed in', 'You can close this tab and go back to the terminal.'),
-        );
-        settle.resolve(query);
-    });
-    for (const port of ports) {
-        try {
-            await new Promise((resolve, reject) => {
-                server.once('error', reject);
-                server.listen(port, 'localhost', () => {
-                    server.off('error', reject);
-                    resolve();
-                });
-            });
-            return { port, redirectUri: `http://localhost:${port}/callback`, result, close: () => server.close() };
-        } catch (error) {
-            if (error.code !== 'EADDRINUSE') throw error;
-        }
-    }
-    throw new Error(`Ports ${ports.join(', ')} are all in use, so the sign-in can't come back to this terminal. Close what uses them and try again.`);
-}
-
-async function json(response) {
-    const text = await response.text();
-    try {
-        return text ? JSON.parse(text) : {};
-    } catch {
-        return { detail: text.slice(0, 200) };
-    }
-}
-
-/**
- * Signs in with Bridgeline AD and saves the issued key for this machine and platform, like `hawk-app login`.
- * `openUrl` opens the browser (tests stand in for it); `machine` names this computer's key.
- */
-export async function sso({
-    dir = process.cwd(),
-    platform,
-    env,
-    publisher,
-    fetchImpl = fetch,
-    openUrl = openBrowser,
-    log = console.log,
-    machine = hostname(),
-    timeoutMs = SIGN_IN_TIMEOUT_MS,
-    credentialsFile = credentialsPath(),
-}) {
-    const { url } = resolveSettings({ flagPlatform: platform, flagEnv: env, dir, credentialsFile });
-    log(`Platform: ${describePlatform(url)}`);
-
-    let response;
-    try {
-        response = await fetchImpl(`${url}/publish/sso`);
-    } catch (error) {
-        throw new Error(`Could not reach ${url}: ${error.message}.`);
-    }
-    if (response.status === 404) throw new Error(`Sign-in isn't available on ${describePlatform(url)}. Use \`hawk-app login\` with a publisher key from Engineering.`);
-    if (!response.ok) throw new Error(`The platform answered ${response.status} for the sign-in settings.`);
-    const settings = await json(response);
-    // The team to work in: its apps are the ones the key can change. Checked before the browser opens.
-    const publishers = settings.publishers ?? [];
-    if (publisher && publishers.length && !publishers.includes(publisher)) {
-        throw new Error(`Sign-in can't issue keys for publisher "${publisher}". Choose one of: ${publishers.join(', ')} (default ${publishers[0]}).`);
-    }
-
-    const verifier = base64url(randomBytes(32));
-    const state = base64url(randomBytes(16));
-    const server = await callbackServer(settings.redirectPorts, state);
-    try {
-        const authorize = new URL(settings.authorizeUrl);
-        for (const [name, value] of Object.entries({
-            response_type: 'code',
-            client_id: settings.clientId,
-            redirect_uri: server.redirectUri,
-            identity_provider: settings.identityProvider,
-            scope: settings.scopes,
-            state,
-            code_challenge: base64url(createHash('sha256').update(verifier).digest()),
-            code_challenge_method: 'S256',
-        })) {
-            authorize.searchParams.set(name, value);
-        }
-        log('Opening your browser to sign in with your Bridgeline account…');
-        log(`  If it doesn't open, go to: ${authorize.href}`);
-        openUrl(authorize.href);
-
-        let timer;
-        const query = await Promise.race([
-            server.result,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error('No sign-in within 5 minutes. Run `hawk-app sso` again.')), timeoutMs);
-            }),
-        ]).finally(() => clearTimeout(timer));
-        if (query.error) throw new Error(`The sign-in failed: ${query.error_description ?? query.error}. Nothing was saved.`);
-        if (!query.code) throw new Error('The sign-in came back without a code. Nothing was saved.');
-
-        // The code, for the ID token: a public client proves it started the sign-in with the PKCE verifier.
-        const token = await fetchImpl(settings.tokenUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({ grant_type: 'authorization_code', client_id: settings.clientId, code: query.code, redirect_uri: server.redirectUri, code_verifier: verifier }).toString(),
-        });
-        const tokens = await json(token);
-        if (!token.ok || !tokens.id_token) throw new Error(`The sign-in couldn't be completed (${tokens.error_description ?? tokens.error ?? token.status}). Nothing was saved.`);
-
-        const issued = await fetchImpl(`${url}/publish/sso`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ idToken: tokens.id_token, machine, ...(publisher ? { publisherId: publisher } : {}) }),
-        });
-        const key = await json(issued);
-        if (!issued.ok || !key.key) throw new Error(`${key.detail ?? key.title ?? `The platform answered ${issued.status}.`} Nothing was saved.`);
-
-        // One saved key per platform: say so when it was another team's.
-        const previous = (await readCredentials(credentialsFile)).platforms[url]?.publisherKey;
-        await saveCredential(credentialsFile, url, key.key);
-        if (previous && previous.split('.')[0] !== key.publisherId) {
-            log(`  (This replaces your saved key for publisher "${previous.split('.')[0]}" on this platform. Switch back with \`hawk-app sso --publisher ${previous.split('.')[0]}\` or \`hawk-app login\`.)`);
-        }
-        log(`✔ Signed in as ${key.label} (${key.email}) on ${describePlatform(url)}, publisher "${key.publisherId}".`);
-        log(`  Your key ${key.publisherId}/${key.keyId} is saved for every app on this machine and works until ${String(key.expiresAt).slice(0, 10)}; run \`hawk-app sso\` again then.`);
-        if (key.developerGroup === 'added') log('  You are in Hawk-App-Developers, so you can submit apps for approval in HawkSearch.');
-        if (key.developerGroup === 'failed') log("  ! Couldn't add you to Hawk-App-Developers (needed to submit apps for approval in HawkSearch). Ask Engineering, or run `hawk-app sso` again later.");
-        return key;
-    } finally {
-        server.close();
-    }
-}
+// `hawk-app sso`: Bridgeline staff sign in with their AD account in the browser, and the platform issues them their own
+// publisher key (it expires; sign in again then). No key is handed from person to person. `hawk-app login` with a key
+// from the portal keeps working, and pipelines keep using portal keys.
+//
+// The standard flow for command-line tools: OAuth 2.0 authorization code with PKCE (RFC 7636) against the HawkSearch
+// user pool, sent straight to the Bridgeline identity provider, with the browser returning to a one-time server on
+// localhost (RFC 8252). The ID token goes to the platform, which verifies it and answers with the key.
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { hostname } from 'node:os';
+import { credentialsPath, readCredentials, saveCredential } from './credentials.mjs';
+import { describePlatform, resolveSettings } from './env.mjs';
+
+const SIGN_IN_TIMEOUT_MS = 5 * 60_000;
+
+const base64url = (buffer) => buffer.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+
+/** Opens a URL in the default browser, without a shell (the URL has & in it). Best effort: the URL is printed too. */
+export function openBrowser(url) {
+    const [command, args] =
+        process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => {});
+        child.unref();
+    } catch {
+        // The printed address still works.
+    }
+}
+
+const PAGE = (title, text) =>
+    `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.4rem">${title}</h1><p>${text}</p></body>`;
+
+/**
+ * Listens on the first free port of `ports` for the browser's return to /callback. Resolves to { port, redirectUri,
+ * result, close }: `result` settles with the query of the first /callback request.
+ */
+async function callbackServer(ports, expectedState) {
+    let settle;
+    const result = new Promise((resolve, reject) => (settle = { resolve, reject }));
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if (url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const query = Object.fromEntries(url.searchParams);
+        if (query.state !== expectedState) {
+            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' }).end(PAGE('Sign-in failed', 'This sign-in was not started by this terminal. Run <code>hawk-app sso</code> again.'));
+            settle.reject(new Error('The sign-in came back with the wrong state (not this attempt). Nothing was saved.'));
+            return;
+        }
+        const failed = Boolean(query.error);
+        res.writeHead(failed ? 400 : 200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }).end(
+            failed ? PAGE('Sign-in failed', 'Go back to the terminal for the details.') : PAGE('Signed in', 'You can close this tab and go back to the terminal.'),
+        );
+        settle.resolve(query);
+    });
+    for (const port of ports) {
+        try {
+            await new Promise((resolve, reject) => {
+                server.once('error', reject);
+                server.listen(port, 'localhost', () => {
+                    server.off('error', reject);
+                    resolve();
+                });
+            });
+            return { port, redirectUri: `http://localhost:${port}/callback`, result, close: () => server.close() };
+        } catch (error) {
+            if (error.code !== 'EADDRINUSE') throw error;
+        }
+    }
+    throw new Error(`Ports ${ports.join(', ')} are all in use, so the sign-in can't come back to this terminal. Close what uses them and try again.`);
+}
+
+async function json(response) {
+    const text = await response.text();
+    try {
+        return text ? JSON.parse(text) : {};
+    } catch {
+        return { detail: text.slice(0, 200) };
+    }
+}
+
+/**
+ * Signs in with Bridgeline AD and saves the issued key for this machine and platform, like `hawk-app login`.
+ * `openUrl` opens the browser (tests stand in for it); `machine` names this computer's key.
+ */
+export async function sso({
+    dir = process.cwd(),
+    platform,
+    env,
+    publisher,
+    fetchImpl = fetch,
+    openUrl = openBrowser,
+    log = console.log,
+    machine = hostname(),
+    timeoutMs = SIGN_IN_TIMEOUT_MS,
+    credentialsFile = credentialsPath(),
+}) {
+    const { url } = resolveSettings({ flagPlatform: platform, flagEnv: env, dir, credentialsFile });
+    log(`Platform: ${describePlatform(url)}`);
+
+    let response;
+    try {
+        response = await fetchImpl(`${url}/publish/sso`);
+    } catch (error) {
+        throw new Error(`Could not reach ${url}: ${error.message}.`);
+    }
+    if (response.status === 404) throw new Error(`Sign-in isn't available on ${describePlatform(url)}. Use \`hawk-app login\` with a publisher key from Engineering.`);
+    if (!response.ok) throw new Error(`The platform answered ${response.status} for the sign-in settings.`);
+    const settings = await json(response);
+    // The team to work in: its apps are the ones the key can change. Checked before the browser opens.
+    const publishers = settings.publishers ?? [];
+    if (publisher && publishers.length && !publishers.includes(publisher)) {
+        throw new Error(`Sign-in can't issue keys for publisher "${publisher}". Choose one of: ${publishers.join(', ')} (default ${publishers[0]}).`);
+    }
+
+    const verifier = base64url(randomBytes(32));
+    const state = base64url(randomBytes(16));
+    const server = await callbackServer(settings.redirectPorts, state);
+    try {
+        const authorize = new URL(settings.authorizeUrl);
+        for (const [name, value] of Object.entries({
+            response_type: 'code',
+            client_id: settings.clientId,
+            redirect_uri: server.redirectUri,
+            identity_provider: settings.identityProvider,
+            scope: settings.scopes,
+            state,
+            code_challenge: base64url(createHash('sha256').update(verifier).digest()),
+            code_challenge_method: 'S256',
+        })) {
+            authorize.searchParams.set(name, value);
+        }
+        log('Opening your browser to sign in with your Bridgeline account…');
+        log(`  If it doesn't open, go to: ${authorize.href}`);
+        openUrl(authorize.href);
+
+        let timer;
+        const query = await Promise.race([
+            server.result,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('No sign-in within 5 minutes. Run `hawk-app sso` again.')), timeoutMs);
+            }),
+        ]).finally(() => clearTimeout(timer));
+        if (query.error) throw new Error(`The sign-in failed: ${query.error_description ?? query.error}. Nothing was saved.`);
+        if (!query.code) throw new Error('The sign-in came back without a code. Nothing was saved.');
+
+        // The code, for the ID token: a public client proves it started the sign-in with the PKCE verifier.
+        const token = await fetchImpl(settings.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ grant_type: 'authorization_code', client_id: settings.clientId, code: query.code, redirect_uri: server.redirectUri, code_verifier: verifier }).toString(),
+        });
+        const tokens = await json(token);
+        if (!token.ok || !tokens.id_token) throw new Error(`The sign-in couldn't be completed (${tokens.error_description ?? tokens.error ?? token.status}). Nothing was saved.`);
+
+        const issued = await fetchImpl(`${url}/publish/sso`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ idToken: tokens.id_token, machine, ...(publisher ? { publisherId: publisher } : {}) }),
+        });
+        const key = await json(issued);
+        if (!issued.ok || !key.key) throw new Error(`${key.detail ?? key.title ?? `The platform answered ${issued.status}.`} Nothing was saved.`);
+
+        // One saved key per platform: say so when it was another team's.
+        const previous = (await readCredentials(credentialsFile)).platforms[url]?.publisherKey;
+        await saveCredential(credentialsFile, url, key.key);
+        if (previous && previous.split('.')[0] !== key.publisherId) {
+            log(`  (This replaces your saved key for publisher "${previous.split('.')[0]}" on this platform. Switch back with \`hawk-app sso --publisher ${previous.split('.')[0]}\` or \`hawk-app login\`.)`);
+        }
+        log(`✔ Signed in as ${key.label} (${key.email}) on ${describePlatform(url)}, publisher "${key.publisherId}".`);
+        log(`  Your key ${key.publisherId}/${key.keyId} is saved for every app on this machine and works until ${String(key.expiresAt).slice(0, 10)}; run \`hawk-app sso\` again then.`);
+        if (key.developerGroup === 'added') log('  You are in Hawk-App-Developers, so you can submit apps for approval in HawkSearch.');
+        if (key.developerGroup === 'failed') log("  ! Couldn't add you to Hawk-App-Developers (needed to submit apps for approval in HawkSearch). Ask Engineering, or run `hawk-app sso` again later.");
+        return key;
+    } finally {
+        server.close();
+    }
+}

package/src/telemetry.mjs

@@ -1,50 +1,50 @@
-// `hawk-app errors` and `hawk-app usage`: what the bridge reports from the app's pages (uncaught errors and rejections,
-// and one open per page load), as the platform groups them. Read-only.
-
-const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
-
-function parseDays(value, fallback, max) {
-    if (value === undefined || value === true) return fallback;
-    const days = Number(value);
-    if (!Number.isInteger(days) || days < 1 || days > max) throw new Error(`--days must be a whole number from 1 to ${max}.`);
-    return days;
-}
-
-/** `hawk-app errors [--days 7]`: the app's errors, the most frequent first. */
-export async function errorsCommand({ client, manifest, flags = {}, log = console.log }) {
-    const days = parseDays(flags.days, 7, 30);
-    const { total, groups } = await client.appErrors(manifest.slug, days);
-    if (!groups.length) {
-        log(`No errors reported for ${manifest.slug} in the last ${plural(days, 'day')}.`);
-        return 0;
-    }
-    log(`${plural(total, 'error')} in ${plural(groups.length, 'group')}, the last ${plural(days, 'day')} (${manifest.slug}):`);
-    for (const group of groups) {
-        const versions = group.versions.length ? ` · ${group.versions.map((v) => `v${v}`).join(', ')}` : '';
-        const when = group.firstDay === group.lastDay ? group.lastDay : `${group.firstDay} – ${group.lastDay}`;
-        log('');
-        log(`${group.count}× ${group.kind === 'rejection' ? 'unhandled rejection' : 'error'}: ${group.message}`);
-        log(`   ${plural(group.clients, 'client')}${versions} · ${when}${group.source ? ` · ${group.source}` : ''}`);
-        const frames = (group.stack ?? '').split('\n').map((l) => l.trim()).filter((l) => l.startsWith('at ') || l.includes('@')).slice(0, 3);
-        for (const frame of frames) log(`   ${frame}`);
-    }
-    return 0;
-}
-
-/** `hawk-app usage [--days 30]`: opens and users per day and client. */
-export async function usageCommand({ client, manifest, flags = {}, log = console.log }) {
-    const days = parseDays(flags.days, 30, 400);
-    const usage = await client.appUsage(manifest.slug, days);
-    log(`${manifest.slug}, the last ${plural(days, 'day')}:`);
-    log(`  ${plural(usage.opens, 'open')} of the app and ${plural(usage.viewOpens, 'view open')} (previews, slots) by ${plural(usage.users, 'user')} at ${plural(usage.clients, 'client')}`);
-    log(`  ${plural(usage.staffOpens, 'open')} by Bridgeline staff (not counted above)`);
-    if (usage.perClient.length) {
-        log('');
-        log('  Client             Opens   Views   Users   Last day');
-        for (const c of usage.perClient.slice(0, 20)) {
-            log(`  ${c.clientId.padEnd(18)} ${String(c.opens).padStart(5)}   ${String(c.viewOpens).padStart(5)}   ${String(c.users).padStart(5)}   ${c.lastDay}`);
-        }
-        if (usage.perClient.length > 20) log(`  … and ${usage.perClient.length - 20} more`);
-    }
-    return 0;
-}
+// `hawk-app errors` and `hawk-app usage`: what the bridge reports from the app's pages (uncaught errors and rejections,
+// and one open per page load), as the platform groups them. Read-only.
+
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+function parseDays(value, fallback, max) {
+    if (value === undefined || value === true) return fallback;
+    const days = Number(value);
+    if (!Number.isInteger(days) || days < 1 || days > max) throw new Error(`--days must be a whole number from 1 to ${max}.`);
+    return days;
+}
+
+/** `hawk-app errors [--days 7]`: the app's errors, the most frequent first. */
+export async function errorsCommand({ client, manifest, flags = {}, log = console.log }) {
+    const days = parseDays(flags.days, 7, 30);
+    const { total, groups } = await client.appErrors(manifest.slug, days);
+    if (!groups.length) {
+        log(`No errors reported for ${manifest.slug} in the last ${plural(days, 'day')}.`);
+        return 0;
+    }
+    log(`${plural(total, 'error')} in ${plural(groups.length, 'group')}, the last ${plural(days, 'day')} (${manifest.slug}):`);
+    for (const group of groups) {
+        const versions = group.versions.length ? ` · ${group.versions.map((v) => `v${v}`).join(', ')}` : '';
+        const when = group.firstDay === group.lastDay ? group.lastDay : `${group.firstDay} – ${group.lastDay}`;
+        log('');
+        log(`${group.count}× ${group.kind === 'rejection' ? 'unhandled rejection' : 'error'}: ${group.message}`);
+        log(`   ${plural(group.clients, 'client')}${versions} · ${when}${group.source ? ` · ${group.source}` : ''}`);
+        const frames = (group.stack ?? '').split('\n').map((l) => l.trim()).filter((l) => l.startsWith('at ') || l.includes('@')).slice(0, 3);
+        for (const frame of frames) log(`   ${frame}`);
+    }
+    return 0;
+}
+
+/** `hawk-app usage [--days 30]`: opens and users per day and client. */
+export async function usageCommand({ client, manifest, flags = {}, log = console.log }) {
+    const days = parseDays(flags.days, 30, 400);
+    const usage = await client.appUsage(manifest.slug, days);
+    log(`${manifest.slug}, the last ${plural(days, 'day')}:`);
+    log(`  ${plural(usage.opens, 'open')} of the app and ${plural(usage.viewOpens, 'view open')} (previews, slots) by ${plural(usage.users, 'user')} at ${plural(usage.clients, 'client')}`);
+    log(`  ${plural(usage.staffOpens, 'open')} by Bridgeline staff (not counted above)`);
+    if (usage.perClient.length) {
+        log('');
+        log('  Client             Opens   Views   Users   Last day');
+        for (const c of usage.perClient.slice(0, 20)) {
+            log(`  ${c.clientId.padEnd(18)} ${String(c.opens).padStart(5)}   ${String(c.viewOpens).padStart(5)}   ${String(c.users).padStart(5)}   ${c.lastDay}`);
+        }
+        if (usage.perClient.length > 20) log(`  … and ${usage.perClient.length - 20} more`);
+    }
+    return 0;
+}