@flowdular/sdk 0.2.4 → 0.3.1

package/modules/metering/spec/module.yaml

@@ -0,0 +1,269 @@
+schemaVersion: 2
+id: metering.core
+specVersion: 0.1.7
+status: approved
+name: Metering Core
+description: Counts what a workspace consumes through meters every module declares, keeps the facts in daily buckets under the tenant's own row-level security, shows usage to the workspace, and lets the deployment operator set per-workspace limits that a module checks before a costly operation and that refuse it once exhausted.
+profile: full
+capabilities:
+  - api
+  - database
+  - client
+  - translations
+  - cli
+dependencies:
+  - id: system.core
+    range: ^0.7.0
+  - id: auth.core
+    range: ^0.13.0
+  - id: reports.core
+    range: ^0.1.0
+requires:
+  - id: notifications.publish.v1
+    optional: true
+  - id: reports.v1
+    optional: true
+tenancy: required
+locales:
+  - en
+  - pl
+invariants:
+  - Persistence runs on the shared asynchronous database contract with explicit PostgreSQL SQL; every tenant table enables and forces row-level security with USING and WITH CHECK policies bound to the transaction-local tenant id, and the runtime role holds neither SUPERUSER nor BYPASSRLS.
+  - A meter is declared by its owning module through the public capability metering.meters.v1 at composition with a stable key, a label, a unit and whether it is cumulative per period or a gauge; metering.core records only what a module reports through the same capability and never reads another module's tables.
+  - metering.core registers the report provider metering.usage through the public capability reports.v1 at composition when reports.core is present, and continues without it when it is not. The provider answers this calendar month's usage per meter with the operator's monthly limit carried as the unit's context, ordered by usage and bounded to the tiles one provider answer may carry; it reads this module's own service inside this module's own tenant transaction and no other module's tables. It answers the calendar month it rolled up as the period of that answer, names itself with a key of this module's own translation bundle beside the English literal, and hands the reader's time budget to that transaction so the statement is cancelled when the budget expires.
+  - A usage fact is reported through record(tenantId, meter, amount, at, sourceRef) and written by metering.core inside its own tenant-scoped transaction, never through the reporter's database handle; it lands in the day bucket of the workspace's calendar day in UTC, uses integer arithmetic, and is idempotent per (tenantId, meter, sourceRef) when the reporter names a source reference. An instant outside the range a UTC day covers is refused with a stable error before anything is written, and a month total past the safe integer range is read as that maximum rather than failing the fact that crossed it, because every ceiling is smaller.
+  - A limit is a per-workspace ceiling per meter per calendar month, set only by the deployment operator through the CLI or a platform setting, never by the workspace; a workspace without a limit is unlimited.
+  - A module asks check(tenantId, meter, amount) before a costly operation and receives allowed, warning or refused; refused is returned once the month's usage plus the amount exceeds the limit, and the refusal is recorded in the module's audit trail by the caller with the stable code METER_LIMIT_EXCEEDED.
+  - When a month's usage first crosses 80 percent of a limit, and again when it reaches 100 percent, metering.core publishes a notification of kind meter-threshold to the workspace owners through notifications.publish.v1 when present, once per meter per month per threshold.
+  - Usage and limits are readable by members holding metering.usage.read; the deployment operator lists and sets limits with the CLI, which writes a limit event with the operator label in the same transaction as the limit.
+  - Buckets sum amounts for both meter kinds; a gauge meter differs only in how the reporter chooses amounts and how a screen labels them, and a distinct gauge rollup is a later decision.
+  - Buckets older than the workspace's retention for the class metering.core.buckets are swept through the platform data class registry, at most the batch the registry asked for, taking the idempotency claims of the swept days with them and reporting the number of buckets removed; limits and threshold records are kept until the operator removes them.
+permissions:
+  - id: metering.usage.read
+    description: Read usage, meters and limits of the active workspace.
+dataOwnership:
+  - metering.core owns meter declarations as recorded, day buckets, monthly limits and threshold notifications.
+  - Each declaring module owns the operation it meters and decides when to ask and how to refuse; metering.core never performs the operation.
+entities:
+  - id: meter
+    name: Meter
+    description: One declared counter as the workspace sees it.
+    fields:
+      - id: key
+        type: string
+        required: true
+        unique: tenant
+        maxLength: 96
+        description: module id plus meter key, for example agents.core.run-tokens.
+      - id: moduleId
+        type: string
+        required: true
+        maxLength: 64
+      - id: label
+        type: string
+        required: true
+        maxLength: 120
+      - id: unit
+        type: string
+        required: true
+        maxLength: 32
+      - id: kind
+        type: enum
+        required: true
+        values:
+          - cumulative
+          - gauge
+  - id: bucket
+    name: Usage bucket
+    description: The usage of one meter on one UTC day.
+    fields:
+      - id: meter
+        type: reference
+        required: true
+        reference: meter
+      - id: day
+        type: date
+        required: true
+      - id: amount
+        type: integer
+        required: true
+      - id: events
+        type: integer
+        required: true
+  - id: limit
+    name: Monthly limit
+    description: The operator's ceiling for one meter in one workspace.
+    fields:
+      - id: meter
+        type: reference
+        required: true
+        reference: meter
+      - id: monthlyLimit
+        type: integer
+        required: true
+      - id: setBy
+        type: string
+        required: true
+        maxLength: 128
+        description: The operator label recorded by the CLI.
+      - id: updatedAt
+        type: datetime
+        required: true
+  - id: limit-event
+    name: Limit event
+    description: The immutable record of one limit change by the operator.
+    fields:
+      - id: meter
+        type: reference
+        required: true
+        reference: meter
+      - id: previousLimit
+        type: integer
+        required: false
+      - id: monthlyLimit
+        type: integer
+        required: true
+      - id: setBy
+        type: string
+        required: true
+        maxLength: 128
+      - id: occurredAt
+        type: datetime
+        required: true
+  - id: threshold-notice
+    name: Threshold notice
+    description: A record that a threshold notification was sent for a meter in a month.
+    fields:
+      - id: meter
+        type: reference
+        required: true
+        reference: meter
+      - id: month
+        type: string
+        required: true
+        maxLength: 7
+        description: YYYY-MM in UTC.
+      - id: threshold
+        type: enum
+        required: true
+        values:
+          - warning
+          - exhausted
+      - id: sentAt
+        type: datetime
+        required: true
+screens:
+  - id: usage
+    kind: list
+    entity: meter
+    title: Usage
+    columns:
+      - key
+      - label
+      - unit
+      - kind
+    filters:
+      - moduleId
+    navigationGroup: Administration
+  - id: limits
+    kind: list
+    entity: limit
+    title: Limits
+    columns:
+      - meter
+      - monthlyLimit
+      - setBy
+      - updatedAt
+    navigationGroup: Administration
+actions: []
+widgets:
+  - id: usage-summary
+    slot: dashboard.metrics
+    entity: bucket
+    description: This month's usage of the three busiest meters against their limits when limits exist.
+settings:
+  - key: warningPercent
+    type: integer
+    scope: platform
+    default: 80
+    description: Percent of a limit at which the warning notification is sent; 50 to 99.
+agentTools: []
+outOfScope:
+  - No module declares or reports a meter in this version. metering.core ships as the substrate only; agents.core run tokens is the first producer and is delivered as a separate change (D-METERING-PRODUCER).
+  - Billing, invoices, prices and payment collection are not offered; metering counts and limits.
+  - Workspace administrators cannot set their own limits; a self-imposed cost cap is a later decision.
+  - Real-time streaming of usage is not offered; the dashboard reads day buckets.
+decisions:
+  - id: D-METERING-SCOPE
+    question: What does the first version contain?
+    answer: A meter registry per module, day buckets under tenant RLS, a usage screen, operator-set per-workspace monthly limits, and a check that refuses once exhausted; no billing.
+    decidedBy: user
+  - id: D-METERING-LIMITS
+    question: Who sets limits and what happens when they are exceeded?
+    answer: The deployment operator through the CLI or platform settings; owners are notified at 80 percent and at 100 percent, the operation is refused with a stable error and audited, and the month resets on the calendar.
+    decidedBy: user
+  - id: D-METERING-REGISTRY
+    question: How do modules declare and report?
+    answer: Through the capability metering.meters.v1 with declare at composition and record and check at run time; metering.core writes the fact in its own tenant-scoped transaction and no database handle crosses the capability, so a fact commits independently of whatever the reporter is doing and a source reference is what makes a repeat a no-op.
+    decidedBy: default
+  - id: D-METERING-PERMISSIONS
+    question: Who reads usage?
+    answer: Owners hold metering.usage.read; members hold nothing.
+    decidedBy: default
+  - id: D-METERING-CLI
+    question: What does the operator use?
+    answer: The commands metering limits list and metering limits set --workspace --meter --monthly-limit [--apply], with dry run and audit; a command that is not applying anything verifies the migration ledger and applies no schema, so a read never creates this module's tables.
+    decidedBy: default
+  - id: D-METERING-PRODUCER
+    question: Which module reports the first facts?
+    answer: None in this version. The substrate ships first, so the capability, the store, the limits and the screens are delivered and proved against a stand-in reporter, and agents.core run tokens is the first real producer, delivered next as its own change on the schedule the coordinator sets.
+    decidedBy: user
+acceptanceScenarios:
+  - id: METERING-DECLARE-RECORD
+    given: A module declares a cumulative meter at composition and records two facts with source references on the same UTC day.
+    when: A principal holding metering.usage.read reads usage.
+    then: One bucket for that day holds the sum with two events, a repeat of a fact with the same source reference changes nothing, and the meter appears with its module, label and unit.
+  - id: METERING-CHECK
+    given: A workspace with a monthly limit of 100 on a meter and usage of 90 this month.
+    when: The module checks an amount of 5, then an amount of 20, then usage reaches 100 and it checks 1.
+    then: The first answers allowed, the second answers refused with METER_LIMIT_EXCEEDED before any write by the caller, and the third answers refused; a workspace without a limit always answers allowed.
+  - id: METERING-THRESHOLDS
+    given: A limit of 100 and a notifications capability present.
+    when: Usage crosses 80 and later reaches 100 within the same month, then more facts arrive.
+    then: One meter-threshold warning and one exhausted notification reach the workspace owners, each once, and the threshold records prevent repeats until the next month.
+  - id: METERING-LIMIT-SET
+    given: A workspace and a declared meter.
+    when: The operator runs metering limits set for the workspace and meter without --apply, then with --apply, then lists limits.
+    then: The dry run prints the plan and writes nothing, the apply persists the limit with the operator label and an audit event, and the list shows it; a member of the workspace cannot change it through any endpoint.
+  - id: METERING-MONTH-RESET
+    given: Usage exhausted a limit in one month.
+    when: The next calendar month begins and the module checks an amount.
+    then: The check answers allowed and the previous month's buckets remain readable.
+  - id: METERING-DENY
+    given: A principal is unauthenticated or lacks metering.usage.read.
+    when: The principal reads usage or limits.
+    then: The server denies the operation before repository access.
+  - id: METERING-TENANT-BOUNDARY
+    given: Two workspaces with buckets and limits on the same meter.
+    when: A runtime transaction bound to one workspace reads or writes any of them.
+    then: Only that workspace's rows are visible or mutable and a row carrying another tenant identifier is rejected by the forced policy.
+  - id: METERING-CLI-READONLY
+    given: A deployment database this module has never been migrated in.
+    when: The operator lists limits, or runs the set command without --apply.
+    then: The command applies no schema and refuses with a stable error naming the missing migration, and the tables appear only once a command runs with --apply or the platform starts.
+  - id: METERING-INSTANT-BOUNDS
+    given: A reporter passing an instant no UTC day covers.
+    when: It reports a fact.
+    then: The call is refused with a stable error and nothing is counted.
+  - id: METERING-SWEEP-BATCH
+    given: A workspace with buckets older than its retention.
+    when: The registry sweeps the class with a batch that is not a whole number, and again with one over the module's own ceiling.
+    then: Each pass removes rows under a batch clamped to a whole number within the ceiling, and neither is refused, because a batch this module would not have chosen is no reason to leave the rows unswept.
+  - id: METERING-ZERO-LIMIT
+    given: A meter whose workspace limit is zero.
+    when: A member reads usage.
+    then: The meter reads as fully consumed at 100 percent in the danger tone and its dashboard tile carries the attention badge, distinct from an unlimited meter, which carries no share.
+  - id: METERING-REPORT-USAGE
+    given: A workspace with facts recorded on several meters this month and an operator limit on one of them.
+    when: The reports.core provider metering.usage is read.
+    then: It answers one tile per meter with this month's usage as the value and the meter's unit carrying the monthly limit as its context, ordered by usage, bounded to the tiles one provider answer may carry, and no series. It names its own calendar month as the period those tiles cover and names itself with a key of this module's bundle, and it passes the reader's time budget into its own tenant transaction so an expired budget cancels the statement instead of leaving it running.

package/modules/metering/src/acl/permissions.ts

@@ -0,0 +1,5 @@
+export const METERING_PERMISSIONS = {
+	read: 'metering.usage.read',
+} as const;
+
+export const permissions = Object.freeze(Object.values(METERING_PERMISSIONS));

package/modules/metering/src/api/endpoints.ts

@@ -0,0 +1,104 @@
+import {
+	defineEndpoint,
+	jsonResponse,
+	problemResponse,
+} from '@flowdular/sdk/server';
+import type { AuthRuntime } from '@flowdular/sdk/modules/auth/server';
+import {
+	endpointIdentityFromContext,
+	principalFromContext,
+} from '@flowdular/sdk/modules/auth/server';
+import { METERING_PERMISSIONS } from '../acl/permissions.ts';
+import type { MeteringRuntime } from '../server/runtime.ts';
+import { MeteringServiceError } from '../services/service-error.ts';
+
+function failure(error: unknown): Response {
+	if (error instanceof MeteringServiceError) {
+		return jsonResponse(
+			{ error: { code: error.code, message: error.message } },
+			error.status,
+		);
+	}
+	return problemResponse(error, 'The metering operation failed.');
+}
+
+/* Every route is a read. Limits are the operator's, so this module publishes no
+   mutation a workspace could reach, and there is no CSRF surface to guard. */
+export function createMeteringRoutes(
+	_auth: AuthRuntime,
+	runtime: MeteringRuntime,
+) {
+	const meters = defineEndpoint({
+		id: 'metering.meters.list',
+		path: '/api/metering/meters',
+		methods: ['GET'],
+		access: { kind: 'permission', permission: METERING_PERMISSIONS.read },
+		resolveIdentity: endpointIdentityFromContext,
+		handler: async ({ octane }) => {
+			try {
+				const service = await runtime.service();
+				return jsonResponse({
+					meters: await service.usage(principalFromContext(octane)!.tenantId),
+					warningPercent: service.warningPercent(),
+				});
+			} catch (error) {
+				return failure(error);
+			}
+		},
+	});
+	const buckets = defineEndpoint({
+		id: 'metering.buckets.list',
+		path: '/api/metering/buckets',
+		methods: ['GET'],
+		access: { kind: 'permission', permission: METERING_PERMISSIONS.read },
+		resolveIdentity: endpointIdentityFromContext,
+		handler: async ({ octane }) => {
+			try {
+				const url = new URL(octane.request.url);
+				const meter = url.searchParams.get('meter');
+				if (meter === null || meter === '') {
+					throw new MeteringServiceError('INVALID_INPUT', 'meter is required.');
+				}
+				const from = url.searchParams.get('from');
+				const to = url.searchParams.get('to');
+				const service = await runtime.service();
+				return jsonResponse({
+					buckets: await service.buckets(
+						principalFromContext(octane)!.tenantId,
+						{
+							meter,
+							...(from ? { from } : {}),
+							...(to ? { to } : {}),
+						},
+					),
+				});
+			} catch (error) {
+				return failure(error);
+			}
+		},
+	});
+	const limits = defineEndpoint({
+		id: 'metering.limits.list',
+		path: '/api/metering/limits',
+		methods: ['GET'],
+		access: { kind: 'permission', permission: METERING_PERMISSIONS.read },
+		resolveIdentity: endpointIdentityFromContext,
+		handler: async ({ octane }) => {
+			try {
+				const service = await runtime.service();
+				return jsonResponse({
+					limits: await service.limits(principalFromContext(octane)!.tenantId),
+				});
+			} catch (error) {
+				return failure(error);
+			}
+		},
+	});
+	return [meters.serverRoute, buckets.serverRoute, limits.serverRoute] as const;
+}
+
+export const endpoints = [
+	'metering.meters.list',
+	'metering.buckets.list',
+	'metering.limits.list',
+] as const;

package/modules/metering/src/cli/commands.json

@@ -0,0 +1,28 @@
+{
+	"protocolVersion": 1,
+	"moduleId": "metering.core",
+	"commands": [
+		{
+			"path": ["metering", "limits", "list"],
+			"capability": {
+				"id": "metering.limits.list",
+				"version": 1,
+				"summary": "List the monthly meter limits of one workspace.",
+				"risk": "read",
+				"requiresApprovedSpec": false,
+				"supportsDryRun": false
+			}
+		},
+		{
+			"path": ["metering", "limits", "set"],
+			"capability": {
+				"id": "metering.limits.set",
+				"version": 1,
+				"summary": "Set the monthly limit of one meter for one workspace.",
+				"risk": "process",
+				"requiresApprovedSpec": false,
+				"supportsDryRun": true
+			}
+		}
+	]
+}

package/modules/metering/src/cli/index.ts

@@ -0,0 +1,246 @@
+import {
+	defineCliExtension,
+	type CliExtensionContext,
+	type CliExtensionResult,
+} from '@flowdular/sdk/cli-protocol';
+import {
+	authRuntimeOptionsFromEnvironment,
+	createAuthRuntime,
+} from '@flowdular/sdk/modules/auth/server';
+import { METER_LIMITS } from '../domain/meters.ts';
+import { createMeteringRuntime } from '../server/runtime.ts';
+import { MeteringServiceError } from '../services/service-error.ts';
+import { DEFAULT_WARNING_PERCENT } from '../settings.ts';
+
+const listCapability = {
+	id: 'metering.limits.list',
+	version: 1,
+	summary: 'List the monthly meter limits of one workspace.',
+	risk: 'read' as const,
+	requiresApprovedSpec: false,
+	supportsDryRun: false,
+};
+
+const setCapability = {
+	id: 'metering.limits.set',
+	version: 1,
+	summary: 'Set the monthly limit of one meter for one workspace.',
+	risk: 'process' as const,
+	requiresApprovedSpec: false,
+	supportsDryRun: true,
+};
+
+const EVIDENCE = ['modules/metering/spec/module.yaml', 'docs/cli.md'] as const;
+
+const USAGE =
+	'Use metering limits set --workspace <slug|id> --meter <key> --monthly-limit <n> [--apply].';
+
+interface Workspace {
+	readonly tenantId: string;
+	readonly slug: string;
+	readonly name: string;
+}
+
+function stringFlag(context: CliExtensionContext, name: string): string {
+	const value = context.flags.get(name);
+	if (typeof value !== 'string' || value.trim() === '') {
+		throw new MeteringServiceError(
+			'INPUT_REQUIRED',
+			`${USAGE} --${name} is missing.`,
+		);
+	}
+	return value.trim();
+}
+
+function integerFlag(context: CliExtensionContext, name: string): number {
+	const raw = stringFlag(context, name);
+	const value = Number(raw);
+	if (
+		!/^\d+$/.test(raw) ||
+		!Number.isSafeInteger(value) ||
+		value > METER_LIMITS.monthlyLimit
+	) {
+		throw new MeteringServiceError(
+			'INVALID_INPUT',
+			`--${name} must be a whole number between 0 and ${METER_LIMITS.monthlyLimit}.`,
+		);
+	}
+	return value;
+}
+
+function databases(context: CliExtensionContext) {
+	if (!context.databases) {
+		throw new MeteringServiceError(
+			'DATABASE_UNAVAILABLE',
+			'metering.core CLI commands read the deployment database, and this workspace has none configured.',
+			503,
+		);
+	}
+	return context.databases;
+}
+
+/**
+ * Resolves a workspace slug or identifier through auth.core's own service, on
+ * auth.core's own leases. metering.core never opens another module's table.
+ */
+async function resolveWorkspace(
+	context: CliExtensionContext,
+	reference: string,
+): Promise<Workspace> {
+	const auth = createAuthRuntime({
+		databases: databases(context),
+		...authRuntimeOptionsFromEnvironment(process.env, context.workspaceRoot),
+	});
+	try {
+		const tenant = await (await auth.service()).findTenant(reference);
+		if (!tenant) {
+			throw new MeteringServiceError(
+				'WORKSPACE_NOT_FOUND',
+				`No workspace matches "${reference}".`,
+				404,
+			);
+		}
+		return { tenantId: tenant.tenantId, slug: tenant.slug, name: tenant.name };
+	} finally {
+		await auth.dispose();
+	}
+}
+
+/* The operator runs these outside a composed platform, so no module has
+   declared a meter and no threshold can be published from here: the runtime is
+   opened for its leases and its repository only.
+
+   A command that is not applying anything applies no schema either: a read and
+   a dry run verify the ledger and stop there, so `metering limits list` can
+   never be what creates this module's tables in a deployment. */
+async function withRuntime<T>(
+	context: CliExtensionContext,
+	operation: (runtime: ReturnType<typeof createMeteringRuntime>) => Promise<T>,
+): Promise<T> {
+	const runtime = createMeteringRuntime({
+		databases: databases(context),
+		warningPercent: () => DEFAULT_WARNING_PERCENT,
+		migrations: context.apply ? 'apply' : 'verify',
+	});
+	try {
+		return await operation(runtime);
+	} finally {
+		await runtime.dispose();
+	}
+}
+
+/** The person who ran the command, as the limit row records them. */
+function operatorLabel(): string {
+	return `cli:${process.env.USER ?? 'operator'}`;
+}
+
+export const cliExtension = defineCliExtension({
+	protocolVersion: 1,
+	moduleId: 'metering.core',
+	commands: [
+		{
+			path: ['metering', 'limits', 'list'],
+			capability: listCapability,
+			execute: async (context): Promise<CliExtensionResult> => {
+				const workspace = await resolveWorkspace(
+					context,
+					stringFlag(context, 'workspace'),
+				);
+				return withRuntime(context, async (runtime) => {
+					const service = await runtime.service();
+					const limits = await service.limits(workspace.tenantId);
+					const usage = await service.usage(workspace.tenantId);
+					const used = new Map(
+						usage.map((entry) => [entry.meter.key, entry.used]),
+					);
+					return {
+						data: {
+							moduleId: 'metering.core',
+							workspace: workspace.slug,
+							limits: limits.map((limit) => ({
+								meter: limit.meter,
+								monthlyLimit: limit.monthlyLimit,
+								usedThisMonth: used.get(limit.meter) ?? 0,
+								setBy: limit.setBy,
+								updatedAt: new Date(limit.updatedAt).toISOString(),
+							})),
+						},
+						evidence: [...EVIDENCE],
+					};
+				});
+			},
+		},
+		{
+			path: ['metering', 'limits', 'set'],
+			capability: setCapability,
+			execute: async (context): Promise<CliExtensionResult> => {
+				const reference = stringFlag(context, 'workspace');
+				const meter = stringFlag(context, 'meter');
+				if (meter.length > METER_LIMITS.key) {
+					throw new MeteringServiceError(
+						'INVALID_INPUT',
+						`--meter must be at most ${METER_LIMITS.key} characters.`,
+					);
+				}
+				const monthlyLimit = integerFlag(context, 'monthly-limit');
+				const workspace = await resolveWorkspace(context, reference);
+				return withRuntime(context, async (runtime) => {
+					const service = await runtime.service();
+					const before =
+						(await service.limits(workspace.tenantId)).find(
+							(limit) => limit.meter === meter,
+						) ?? null;
+					/* An operator caps a meter before the workspace has reported its
+					   first fact, so an unrecorded meter is a warning, never a
+					   refusal. */
+					const recorded = (await service.usage(workspace.tenantId)).some(
+						(entry) => entry.meter.key === meter,
+					);
+					const warnings = recorded
+						? []
+						: [
+								`This workspace has not recorded the meter "${meter}" yet. The limit applies from its first fact.`,
+							];
+					if (!context.apply) {
+						return {
+							data: {
+								moduleId: 'metering.core',
+								applied: false,
+								workspace: workspace.slug,
+								meter,
+								previousLimit: before?.monthlyLimit ?? null,
+								monthlyLimit,
+								setBy: operatorLabel(),
+							},
+							evidence: [...EVIDENCE],
+							warnings,
+						};
+					}
+					const saved = await service.setLimit({
+						tenantId: workspace.tenantId,
+						meter,
+						monthlyLimit,
+						setBy: operatorLabel(),
+					});
+					return {
+						data: {
+							moduleId: 'metering.core',
+							applied: true,
+							workspace: workspace.slug,
+							meter: saved.limit.meter,
+							previousLimit: saved.previousLimit,
+							monthlyLimit: saved.limit.monthlyLimit,
+							setBy: saved.limit.setBy,
+							auditEventId: saved.event.id,
+							occurredAt: new Date(saved.event.occurredAt).toISOString(),
+						},
+						evidence: [...EVIDENCE],
+						warnings,
+					};
+				});
+			},
+		},
+	],
+});
+
+export default cliExtension;