@freecodecamp/universe-cli 0.11.0 → 0.12.0

package/dist/index.cjs

@@ -15892,19 +15892,23 @@ const LabelsSchema = record(union([
 	literal("service")
 ]), record(string(), string()));
 //#endregion
+//#region src/commands/create/layer-composition/assets.json
+var templateVersion = "0.2.0";
+var templateUrl = "https://github.com/freeCodeCamp-Universe/templates/releases/download/app-templates-v{{version}}/app-templates-{{version}}.tar.gz";
+//#endregion
+//#region src/commands/create/layer-composition/assets.ts
+const defaultTemplateVersion = templateVersion;
+const resolveTemplateUrl = (version) => templateUrl.replaceAll("{{version}}", version);
+//#endregion
 //#region src/commands/create/layer-composition/template-cache.ts
-const APP_DIR$2 = "universe-cli";
-const TEMPLATES_DIR = "templates";
+const APP_DIR$3 = "universe-cli";
+const TEMPLATES_DIR$1 = "templates";
 const cacheBase = () => {
 	const xdg = process.env["XDG_CACHE_HOME"];
 	if (xdg && xdg.length > 0) return xdg;
 	return (0, node_path.join)((0, node_os.homedir)(), ".cache");
 };
-const versionFromUrl = (url) => {
-	const filename = url.split("/").at(-1) ?? url;
-	return filename.match(/^templates-(.+)\.tar\.gz$/)?.[1] ?? filename;
-};
-const templateCacheDir = (url) => (0, node_path.join)(cacheBase(), APP_DIR$2, TEMPLATES_DIR, versionFromUrl(url));
+const templateCacheDir = (version) => (0, node_path.join)(cacheBase(), APP_DIR$3, TEMPLATES_DIR$1, version);
 //#endregion
 //#region src/commands/create/layer-composition/template-provider.ts
 const execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
@@ -15919,7 +15923,7 @@ const EXPECTED_LAYER_FILES = [
 const EXPECTED_ROOT_ENTRIES = ["labels.json", "layers"];
 const readEnv = () => ({
 	UNIVERSE_TEMPLATES_DIR: process.env["UNIVERSE_TEMPLATES_DIR"],
-	UNIVERSE_TEMPLATES_URL: process.env["UNIVERSE_TEMPLATES_URL"]
+	UNIVERSE_TEMPLATES_VERSION: process.env["UNIVERSE_TEMPLATES_VERSION"]
 });
 const validateEntries = (dir, expected, actual) => {
 	const expectedSet = new Set(expected);
@@ -15996,7 +16000,7 @@ const fetchTarball = async (url, fetchImpl) => {
 	} catch {
 		throw new ConfigError("Templates not cached. Run `universe templates fetch` or check network.");
 	}
-	if (response.status === 404) throw new ConfigError(`Template not found at ${url}. Check UNIVERSE_TEMPLATES_URL.`);
+	if (response.status === 404) throw new ConfigError(`Template not found at ${url}. Check UNIVERSE_TEMPLATES_VERSION.`);
 	if (!response.ok) throw new ConfigError(`Failed to fetch templates from ${url}: HTTP ${String(response.status)}`);
 	const arrayBuffer = await response.arrayBuffer();
 	return Buffer.from(arrayBuffer);
@@ -16045,24 +16049,169 @@ var RemoteTemplateProvider = class {
 		this.cacheBaseOverride = cacheBaseOverride;
 		this.fetchImpl = fetchImpl;
 	}
-	resolveCacheDir(url) {
-		if (this.cacheBaseOverride !== void 0) return (0, node_path.join)(this.cacheBaseOverride(), versionFromUrl(url));
-		return templateCacheDir(url);
+	resolveCacheDir(version) {
+		if (this.cacheBaseOverride !== void 0) return (0, node_path.join)(this.cacheBaseOverride, version);
+		return templateCacheDir(version);
 	}
 	async loadLayers(options) {
-		const { UNIVERSE_TEMPLATES_DIR, UNIVERSE_TEMPLATES_URL } = this.env();
+		const { UNIVERSE_TEMPLATES_DIR, UNIVERSE_TEMPLATES_VERSION } = this.env();
 		if (UNIVERSE_TEMPLATES_DIR !== void 0 && UNIVERSE_TEMPLATES_DIR.length > 0) return loadFromDir(UNIVERSE_TEMPLATES_DIR);
-		if (UNIVERSE_TEMPLATES_URL === void 0 || UNIVERSE_TEMPLATES_URL.length === 0) throw new ConfigError("UNIVERSE_TEMPLATES_URL is not set. Set it to the URL of a universe-templates release asset.");
-		const cacheDir = this.resolveCacheDir(UNIVERSE_TEMPLATES_URL);
+		const version = UNIVERSE_TEMPLATES_VERSION && UNIVERSE_TEMPLATES_VERSION.length > 0 ? UNIVERSE_TEMPLATES_VERSION : defaultTemplateVersion;
+		const url = resolveTemplateUrl(version);
+		const cacheDir = this.resolveCacheDir(version);
 		if (options?.forceFetch) await (0, node_fs_promises.rm)(cacheDir, {
 			force: true,
 			recursive: true
 		});
 		if (await cacheHit(cacheDir)) return loadFromDir(cacheDir);
-		return fetchAndCache(UNIVERSE_TEMPLATES_URL, cacheDir, this.fetchImpl);
+		return fetchAndCache(url, cacheDir, this.fetchImpl);
 	}
 };
 //#endregion
+//#region src/lib/version-utils.ts
+const DEFAULT_TTL_MS = 3600 * 1e3;
+function ttlMs() {
+	const raw = process.env["UNIVERSE_UPDATE_TTL_MS"];
+	if (raw !== void 0) {
+		const n = Number.parseInt(raw, 10);
+		if (Number.isFinite(n) && n >= 0) return n;
+	}
+	return DEFAULT_TTL_MS;
+}
+function isDisabled() {
+	const v = process.env["UNIVERSE_NO_UPDATE_CHECK"];
+	return v === "1" || v === "true";
+}
+function parseCache(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null || !("latest" in parsed) || !("lastCheck" in parsed)) return null;
+	const { latest, lastCheck } = parsed;
+	if (typeof latest !== "string" || typeof lastCheck !== "number") return null;
+	return {
+		latest,
+		lastCheck
+	};
+}
+function compareVersions(a, b) {
+	const pa = parseVersion(a);
+	const pb = parseVersion(b);
+	if (pa === null || pb === null) return 0;
+	for (let i = 0; i < 3; i += 1) {
+		const ai = pa[i] ?? 0;
+		const bi = pb[i] ?? 0;
+		if (ai < bi) return -1;
+		if (ai > bi) return 1;
+	}
+	return 0;
+}
+function parseVersion(s) {
+	const parts = (s.split("-")[0] ?? "").split(".");
+	if (parts.length !== 3) return null;
+	const nums = parts.map((p) => Number.parseInt(p, 10));
+	if (nums.some((n) => Number.isNaN(n))) return null;
+	return [
+		nums[0],
+		nums[1],
+		nums[2]
+	];
+}
+function useColor() {
+	if (process.env["NO_COLOR"] && process.env["NO_COLOR"].length > 0) return false;
+	return process.stderr.isTTY === true;
+}
+function paint(s, code, color) {
+	if (!color) return s;
+	return `\x1b[${code}m${s}\x1b[0m`;
+}
+//#endregion
+//#region src/lib/template-version-check.ts
+const APP_DIR$2 = "universe-cli";
+const TEMPLATES_DIR = "templates";
+const CACHE_FILE$1 = "template-version-check.json";
+const GITHUB_LATEST_URL = "https://api.github.com/repos/freeCodeCamp-Universe/templates/releases/latest";
+const FETCH_TIMEOUT_MS$1 = 3e3;
+const TAG_PREFIX = "app-templates-v";
+function templateCheckCachePath() {
+	return (0, node_path.join)(cacheBase(), APP_DIR$2, TEMPLATES_DIR, CACHE_FILE$1);
+}
+async function readTemplateCache() {
+	try {
+		return parseCache(await (0, node_fs_promises.readFile)(templateCheckCachePath(), "utf-8"));
+	} catch {
+		return null;
+	}
+}
+async function writeTemplateCache(c) {
+	const path = templateCheckCachePath();
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(path), {
+		recursive: true,
+		mode: 448
+	});
+	await (0, node_fs_promises.writeFile)(path, JSON.stringify(c), { mode: 420 });
+}
+async function fetchLatestTemplateVersion() {
+	const ctl = new AbortController();
+	const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS$1);
+	try {
+		const res = await fetch(GITHUB_LATEST_URL, {
+			signal: ctl.signal,
+			headers: { accept: "application/vnd.github+json" }
+		});
+		if (!res.ok) return null;
+		const body = await res.json();
+		if (typeof body.tag_name !== "string") return null;
+		if (!body.tag_name.startsWith(TAG_PREFIX)) return null;
+		return body.tag_name.slice(15);
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function checkTemplateVersion(currentVersion, now = Date.now()) {
+	if (isDisabled()) return null;
+	const cache = await readTemplateCache();
+	if (cache !== null && now - cache.lastCheck < ttlMs()) {
+		if (compareVersions(currentVersion, cache.latest) < 0) return {
+			current: currentVersion,
+			latest: cache.latest
+		};
+		return null;
+	}
+	const latest = await fetchLatestTemplateVersion();
+	if (latest === null) return null;
+	try {
+		await writeTemplateCache({
+			latest,
+			lastCheck: now
+		});
+	} catch {}
+	if (compareVersions(currentVersion, latest) < 0) return {
+		current: currentVersion,
+		latest
+	};
+	return null;
+}
+function formatTemplateNotice(n, color = useColor()) {
+	const dim = (s) => paint(s, "2", color);
+	const yellow = (s) => paint(s, "33", color);
+	const cyan = (s) => paint(s, "36", color);
+	const bar = dim("│");
+	return [
+		"",
+		bar,
+		`${yellow("▲")}  Newer templates available: ${dim(n.current)} → ${cyan(n.latest)}`,
+		`${bar}  Set ${cyan(`UNIVERSE_TEMPLATES_VERSION=${n.latest}`)} to use them.`,
+		dim("└"),
+		""
+	].join("\n");
+}
+//#endregion
 //#region src/commands/create/index.ts
 const defaultFilesystemWriter = new LocalProjectWriter();
 const create$1 = async (options, deps = {}) => {
@@ -16077,6 +16226,15 @@ const create$1 = async (options, deps = {}) => {
 	const platformManifestGenerator = deps.platformManifestGenerator ?? new PlatformManifestService();
 	const repoInitialiser = deps.repoInitialiser ?? new GitRepoInitialiser();
 	try {
+		const templatesDir = process.env["UNIVERSE_TEMPLATES_DIR"];
+		if (!(templatesDir && templatesDir.length > 0)) {
+			const envVersion = process.env["UNIVERSE_TEMPLATES_VERSION"];
+			const effectiveVersion = envVersion && envVersion.length > 0 ? envVersion : defaultTemplateVersion;
+			try {
+				const notice = await checkTemplateVersion(effectiveVersion);
+				if (notice) process.stderr.write(formatTemplateNotice(notice));
+			} catch {}
+		}
 		const templateProvider = deps.templateProvider ?? new RemoteTemplateProvider();
 		const { labels, registry } = await templateProvider.loadLayers({ forceFetch: options.forceFetch });
 		const interactive = (deps.isTTY ?? Boolean(process.stdin.isTTY)) && !options.yes && !options.json;
@@ -16566,6 +16724,17 @@ function suggest(target, candidates, threshold = 2) {
 	}
 	return bestD <= threshold ? best : null;
 }
+const auditRowArraySchema = array(object({
+	id: number(),
+	occurredAt: string(),
+	actor: string(),
+	action: string(),
+	site: string().optional(),
+	deployId: string().optional(),
+	outcome: string(),
+	requestId: string().optional(),
+	detail: record(string(), unknown()).optional()
+}));
 const repoName = string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/, "must start with a letter or digit, then letters, digits, '.', '_' or '-' (max 100 chars)");
 const visibilitySchema = _enum(["public", "private"]);
 const repoStatusSchema = _enum([
@@ -16968,6 +17137,23 @@ function createProxyClient(cfg) {
 				}
 			}, (raw) => repoRowArraySchema.parse(raw));
 		},
+		async listAudit(req) {
+			const params = new URLSearchParams();
+			if (req?.site) params.set("site", req.site);
+			if (req?.actor) params.set("actor", req.actor);
+			if (req?.action) params.set("action", req.action);
+			if (req?.since) params.set("since", req.since);
+			if (req?.limit !== void 0) params.set("limit", String(req.limit));
+			if (req?.offset !== void 0) params.set("offset", String(req.offset));
+			const qs = params.toString();
+			return call(`${base}/api/audit${qs ? `?${qs}` : ""}`, {
+				method: "GET",
+				headers: {
+					Authorization: await userBearer(),
+					Accept: "application/json"
+				}
+			}, (raw) => auditRowArraySchema.parse(raw));
+		},
 		async getRepoRequest(id) {
 			return call(`${base}/api/repo/${encodeURIComponent(id)}`, {
 				method: "GET",
@@ -17869,24 +18055,26 @@ async function readSiteFromYaml(cwd, read) {
 	if (!r.ok) throw new ConfigError(r.error);
 	return r.value.site;
 }
-function formatTable$1(deploys) {
+function formatTable$2(deploys) {
 	const header = [
 		"DEPLOY ID",
 		"TIMESTAMP",
 		"SHA",
-		"STATE"
+		"STATE",
+		"ACTOR"
 	];
 	const rows = deploys.map((d) => [
 		d.deployId,
 		d.timestamp ? d.timestamp.replace("T", " ").replace("Z", "") : "—",
 		d.sha ?? "—",
-		d.state ?? "—"
+		d.state ?? "—",
+		d.actor ?? "—"
 	]);
 	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
 	const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
 	return [fmt(header), ...rows.map(fmt)].join("\n");
 }
-async function ls$2(options, deps = {}) {
+async function ls$3(options, deps = {}) {
 	const cwd = deps.cwd ?? process.cwd();
 	const env = deps.env ?? process.env;
 	const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml$2;
@@ -17907,7 +18095,8 @@ async function ls$2(options, deps = {}) {
 			getAuthToken: () => identity.token,
 			timeoutMs: parseFetchTimeoutMs(env)
 		});
-		const parsed = [...await client.siteDeploys({ site })].sort((a, b) => b.deployId.localeCompare(a.deployId)).map((d) => parseDeployId(d.deployId));
+		const sorted = [...await client.siteDeploys({ site })].sort((a, b) => b.deployId.localeCompare(a.deployId));
+		const parsed = sorted.map((d) => parseDeployId(d.deployId));
 		let previewId = null;
 		let productionId = null;
 		if (parsed.length > 0) {
@@ -17921,9 +18110,10 @@ async function ls$2(options, deps = {}) {
 			previewId = preview?.deployId ?? null;
 			productionId = production?.deployId ?? null;
 		}
-		const deploys = parsed.map((d) => ({
+		const deploys = parsed.map((d, i) => ({
 			...d,
-			state: deployState(d.deployId, previewId, productionId)
+			state: deployState(d.deployId, previewId, productionId),
+			actor: sorted[i]?.actor
 		}));
 		if (options.json) {
 			emitJson(buildEnvelope("ls", true, {
@@ -17941,7 +18131,7 @@ async function ls$2(options, deps = {}) {
 			info(`(no deploys for ${site})`);
 			return;
 		}
-		success(formatTable$1(deploys));
+		success(formatTable$2(deploys));
 	} catch (err) {
 		const { code, message } = wrapProxyError("ls", err);
 		outputError({
@@ -18241,7 +18431,7 @@ function parseTeamsFlag(raw) {
 * Resolve identity + construct a proxy client. Throws CredentialError
 * if no identity is available — caller wraps via wrapProxyError.
 */
-async function setupClient$1(deps) {
+async function setupClient$2(deps) {
 	const env = deps.env ?? process.env;
 	const resolveId = deps.resolveIdentity ?? resolveIdentity;
 	const mkClient = deps.createProxyClient ?? createProxyClient;
@@ -18258,7 +18448,7 @@ async function setupClient$1(deps) {
 }
 //#endregion
 //#region src/commands/sites/ls.ts
-function formatTable(rows) {
+function formatTable$1(rows) {
 	if (rows.length === 0) return "No registered sites.";
 	const headers = [
 		"SLUG",
@@ -18276,13 +18466,13 @@ function formatTable(rows) {
 	const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
 	return [fmt(headers), ...cells.map(fmt)].join("\n");
 }
-async function ls$1(options, deps = {}) {
+async function ls$2(options, deps = {}) {
 	const command = "sites ls";
 	const success = deps.logSuccess ?? ((s) => R.message(s));
 	const error = deps.logError ?? ((s) => R.error(s));
 	const exit = deps.exit ?? exitWithCode;
 	try {
-		const { client, identitySource } = await setupClient$1(deps);
+		const { client, identitySource } = await setupClient$2(deps);
 		let rows = await client.listSites();
 		let scope = "all";
 		if (options.mine) {
@@ -18297,7 +18487,7 @@ async function ls$1(options, deps = {}) {
 			sites: rows,
 			identitySource
 		}));
-		else success(formatTable(rows));
+		else success(formatTable$1(rows));
 	} catch (err) {
 		const { code, message } = wrapProxyError(command, err);
 		outputError({
@@ -18317,7 +18507,7 @@ async function register(options, deps = {}) {
 	try {
 		if (!options.slug || options.slug.trim().length === 0) throw new UsageError("slug is required (positional argument)");
 		const teams = parseTeamsFlag(options.team);
-		const { client, identitySource } = await setupClient$1(deps);
+		const { client, identitySource } = await setupClient$2(deps);
 		const row = await client.registerSite({
 			slug: options.slug,
 			teams: teams.length > 0 ? teams : void 0
@@ -18355,7 +18545,7 @@ async function rm$1(options, deps = {}) {
 	const exit = deps.exit ?? exitWithCode;
 	try {
 		if (!options.slug || options.slug.trim().length === 0) throw new UsageError("slug is required (positional argument)");
-		const { client, identitySource } = await setupClient$1(deps);
+		const { client, identitySource } = await setupClient$2(deps);
 		await client.deleteSite({ slug: options.slug });
 		if (options.json) emitJson(buildEnvelope(command, true, {
 			slug: options.slug,
@@ -18388,7 +18578,7 @@ async function update(options, deps = {}) {
 		if (!options.slug || options.slug.trim().length === 0) throw new UsageError("slug is required (positional argument)");
 		const teams = parseTeamsFlag(options.team);
 		if (teams.length === 0) throw new UsageError("--team is required with at least one slug; use `sites rm` to remove a site");
-		const { client, identitySource } = await setupClient$1(deps);
+		const { client, identitySource } = await setupClient$2(deps);
 		const row = await client.updateSite({
 			slug: options.slug,
 			teams
@@ -18427,7 +18617,7 @@ const defaultRepoPrompts = {
 * Resolve identity + construct a proxy client. Throws CredentialError
 * when no identity is available — the caller wraps via wrapProxyError.
 */
-async function setupClient(deps) {
+async function setupClient$1(deps) {
 	const env = deps.env ?? process.env;
 	const resolveId = deps.resolveIdentity ?? resolveIdentity;
 	const mkClient = deps.createProxyClient ?? createProxyClient;
@@ -18447,6 +18637,26 @@ async function setupClient(deps) {
 * Render repo-request rows as an aligned text table. Returns `emptyMsg`
 * when there are no rows (the caller passes a status-specific phrase).
 */
+function humanizeDuration(ms) {
+	const s = Math.floor(ms / 1e3);
+	if (s < 60) return `${s}s`;
+	const m = Math.floor(s / 60);
+	if (m < 60) return `${m}m`;
+	const h = Math.floor(m / 60);
+	if (h < 24) return `${h}h${m % 60}m`;
+	return `${Math.floor(h / 24)}d${h % 24}h`;
+}
+const RESOLVED_STATUSES = new Set([
+	"active",
+	"rejected",
+	"failed"
+]);
+function resolveLatency(r) {
+	if (!RESOLVED_STATUSES.has(r.status)) return "";
+	const ms = Date.parse(r.updatedAt) - Date.parse(r.createdAt);
+	if (!Number.isFinite(ms) || ms < 0) return "";
+	return humanizeDuration(ms);
+}
 function formatRepoTable(rows, emptyMsg = "No repo requests.") {
 	if (rows.length === 0) return emptyMsg;
 	const headers = [
@@ -18455,7 +18665,9 @@ function formatRepoTable(rows, emptyMsg = "No repo requests.") {
 		"VIS",
 		"STATUS",
 		"REQUESTED BY",
-		"REQUESTED AT"
+		"REQUESTED AT",
+		"APPROVER",
+		"LATENCY"
 	];
 	const cells = rows.map((r) => [
 		r.id,
@@ -18463,7 +18675,9 @@ function formatRepoTable(rows, emptyMsg = "No repo requests.") {
 		r.visibility,
 		r.status,
 		r.requestedBy,
-		r.createdAt
+		r.createdAt,
+		r.approver ?? "",
+		resolveLatency(r)
 	]);
 	const widths = headers.map((h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0)));
 	const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
@@ -18482,7 +18696,7 @@ async function approve(options, deps = {}) {
 	let identitySource;
 	try {
 		if (!options.id || options.id.trim().length === 0) throw new UsageError("request id is required (positional argument)");
-		const setup = await setupClient(deps);
+		const setup = await setupClient$1(deps);
 		const client = setup.client;
 		identitySource = setup.identitySource;
 		if (!options.json && !options.yes) {
@@ -18600,7 +18814,7 @@ async function create(options, deps = {}) {
 		let client;
 		const ensureClient = async () => {
 			if (!client) {
-				const setup = await setupClient(deps);
+				const setup = await setupClient$1(deps);
 				client = setup.client;
 				identitySource = setup.identitySource;
 			}
@@ -18702,7 +18916,7 @@ async function create(options, deps = {}) {
 //#region src/commands/repo/ls.ts
 /** Closed set accepted by `--status`: the row statuses plus `all`. */
 const LS_STATUSES = [...repoStatusSchema.options, "all"];
-async function ls(options, deps = {}) {
+async function ls$1(options, deps = {}) {
 	const command = "repo ls";
 	const message = deps.logMessage ?? ((s) => R.message(s));
 	const error = deps.logError ?? ((s) => R.error(s));
@@ -18711,7 +18925,7 @@ async function ls(options, deps = {}) {
 	try {
 		const requestedStatus = options.all ? "all" : options.status;
 		if (requestedStatus !== void 0 && !LS_STATUSES.includes(requestedStatus)) throw new UsageError(`invalid --status "${requestedStatus}": must be one of ${LS_STATUSES.join(", ")}`);
-		const setup = await setupClient(deps);
+		const setup = await setupClient$1(deps);
 		const client = setup.client;
 		identitySource = setup.identitySource;
 		const rows = await client.listRepoRequests({
@@ -18753,7 +18967,7 @@ async function reject(options, deps = {}) {
 	let identitySource;
 	try {
 		if (!options.id || options.id.trim().length === 0) throw new UsageError("request id is required (positional argument)");
-		const setup = await setupClient(deps);
+		const setup = await setupClient$1(deps);
 		const client = setup.client;
 		identitySource = setup.identitySource;
 		if (!options.json && !options.yes) {
@@ -18806,7 +19020,7 @@ async function rm(options, deps = {}) {
 	let identitySource;
 	try {
 		if (!options.id || options.id.trim().length === 0) throw new UsageError("request id is required (positional argument)");
-		const setup = await setupClient(deps);
+		const setup = await setupClient$1(deps);
 		const client = setup.client;
 		identitySource = setup.identitySource;
 		if (!options.json && !options.yes) {
@@ -18864,7 +19078,7 @@ async function status(options, deps = {}) {
 	let identitySource;
 	try {
 		if (!options.id || options.id.trim().length === 0) throw new UsageError("request id is required (positional argument)");
-		const setup = await setupClient(deps);
+		const setup = await setupClient$1(deps);
 		const client = setup.client;
 		identitySource = setup.identitySource;
 		const row = await client.getRepoRequest(options.id);
@@ -18888,22 +19102,93 @@ async function status(options, deps = {}) {
 	}
 }
 //#endregion
+//#region src/commands/audit/_shared.ts
+async function setupClient(deps) {
+	const env = deps.env ?? process.env;
+	const resolveId = deps.resolveIdentity ?? resolveIdentity;
+	const mkClient = deps.createProxyClient ?? createProxyClient;
+	const identity = await resolveId({ env });
+	if (!identity) throw new CredentialError("No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.");
+	return {
+		client: mkClient({
+			baseUrl: env["UNIVERSE_PROXY_URL"] ?? "https://uploads.freecode.camp",
+			getAuthToken: () => identity.token,
+			timeoutMs: parseFetchTimeoutMs(env)
+		}),
+		identitySource: identity.source
+	};
+}
+//#endregion
+//#region src/commands/audit/ls.ts
+function formatTable(rows) {
+	if (rows.length === 0) return "No audit events.";
+	const headers = [
+		"OCCURRED AT",
+		"ACTOR",
+		"ACTION",
+		"TARGET",
+		"OUTCOME"
+	];
+	const cells = rows.map((r) => [
+		r.occurredAt,
+		r.actor,
+		r.action,
+		r.site || r.deployId || targetFromDetail(r),
+		r.outcome
+	]);
+	const widths = headers.map((h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0)));
+	const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
+	return [fmt(headers), ...cells.map(fmt)].join("\n");
+}
+function targetFromDetail(r) {
+	const name = r.detail?.["name"];
+	return typeof name === "string" ? name : "";
+}
+async function ls(options, deps = {}) {
+	const command = "audit ls";
+	const message = deps.logMessage ?? ((s) => R.message(s));
+	const error = deps.logError ?? ((s) => R.error(s));
+	const exit = deps.exit ?? exitWithCode;
+	let identitySource;
+	try {
+		if (options.limit !== void 0 && (!Number.isInteger(options.limit) || options.limit < 0)) throw new UsageError("--limit must be a non-negative integer");
+		const setup = await setupClient(deps);
+		identitySource = setup.identitySource;
+		const rows = await setup.client.listAudit({
+			site: options.site,
+			actor: options.actor,
+			action: options.action,
+			since: options.since,
+			limit: options.limit
+		});
+		if (options.json) emitJson(buildEnvelope(command, true, {
+			count: rows.length,
+			events: rows,
+			identitySource
+		}));
+		else message(formatTable(rows));
+	} catch (err) {
+		const { code, message: msg, kind, requestId } = wrapProxyError(command, err);
+		outputError({
+			json: options.json,
+			command
+		}, code, msg, {
+			logError: error,
+			kind,
+			requestId,
+			extras: identitySource ? { identitySource } : void 0
+		});
+		exit(code);
+	}
+}
+//#endregion
 //#region src/lib/update-notifier.ts
 const APP_DIR = "universe-cli";
 const CACHE_FILE = "update-check.json";
 const PKG_NAME = "@freecodecamp/universe-cli";
 const NPM_LATEST_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
-const DEFAULT_TTL_MS = 3600 * 1e3;
 const FETCH_TIMEOUT_MS = 3e3;
 const REFRESH_ENV = "UNIVERSE_REFRESH_WORKER";
-function ttlMs() {
-	const raw = process.env["UNIVERSE_UPDATE_TTL_MS"];
-	if (raw !== void 0) {
-		const n = Number.parseInt(raw, 10);
-		if (Number.isFinite(n) && n >= 0) return n;
-	}
-	return DEFAULT_TTL_MS;
-}
 function latestUrl() {
 	const override = process.env["UNIVERSE_UPDATE_URL"];
 	return override && override.length > 0 ? override : NPM_LATEST_URL;
@@ -18916,25 +19201,6 @@ function configBase() {
 function cachePath() {
 	return (0, node_path.join)(configBase(), APP_DIR, CACHE_FILE);
 }
-function isDisabled() {
-	const v = process.env["UNIVERSE_NO_UPDATE_CHECK"];
-	return v === "1" || v === "true";
-}
-function parseCache(raw) {
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return null;
-	}
-	if (typeof parsed !== "object" || parsed === null || !("latest" in parsed) || !("lastCheck" in parsed)) return null;
-	const { latest, lastCheck } = parsed;
-	if (typeof latest !== "string" || typeof lastCheck !== "number") return null;
-	return {
-		latest,
-		lastCheck
-	};
-}
 async function readCache() {
 	try {
 		return parseCache(await (0, node_fs_promises.readFile)(cachePath(), "utf-8"));
@@ -18974,29 +19240,6 @@ async function fetchLatest() {
 		clearTimeout(timer);
 	}
 }
-function compareVersions(a, b) {
-	const pa = parseVersion(a);
-	const pb = parseVersion(b);
-	if (pa === null || pb === null) return 0;
-	for (let i = 0; i < 3; i += 1) {
-		const ai = pa[i] ?? 0;
-		const bi = pb[i] ?? 0;
-		if (ai < bi) return -1;
-		if (ai > bi) return 1;
-	}
-	return 0;
-}
-function parseVersion(s) {
-	const parts = (s.split("-")[0] ?? "").split(".");
-	if (parts.length !== 3) return null;
-	const nums = parts.map((p) => Number.parseInt(p, 10));
-	if (nums.some((n) => Number.isNaN(n))) return null;
-	return [
-		nums[0],
-		nums[1],
-		nums[2]
-	];
-}
 async function refreshIfStale(now = Date.now(), options = {}) {
 	if (isDisabled()) return;
 	if (!options.force) {
@@ -19042,14 +19285,6 @@ function getNoticeSync(current) {
 		latest: cache.latest
 	};
 }
-function useColor() {
-	if (process.env["NO_COLOR"] && process.env["NO_COLOR"].length > 0) return false;
-	return process.stderr.isTTY === true;
-}
-function paint(s, code, color) {
-	if (!color) return s;
-	return `\x1b[${code}m${s}\x1b[0m`;
-}
 function formatNotice(n, color = useColor()) {
 	const dim = (s) => paint(s, "2", color);
 	const yellow = (s) => paint(s, "33", color);
@@ -19081,7 +19316,7 @@ function installExitNotice(current) {
 }
 //#endregion
 //#region src/cli.ts
-const version = "0.11.0";
+const version = "0.12.0";
 function handleActionError(command, json, err) {
 	const ctx = {
 		json,
@@ -19125,6 +19360,7 @@ async function run(argv = process.argv) {
 	const sitesCli = namespaceGroup("sites", "Static site registry commands");
 	const staticCli = namespaceGroup("static", "Static site deployment commands");
 	const repoCli = namespaceGroup("repo", "Repository creation + approval queue commands");
+	const auditCli = namespaceGroup("audit", "Audit trail query commands");
 	sitesCli.command("register <slug>").description("Register a new static site (staff only)").option("--team <name>", "GitHub team slug (repeatable, or comma-separated). Defaults to staff.").action(async (slug, _opts, cmd) => {
 		const opts = cmd.optsWithGlobals();
 		try {
@@ -19140,7 +19376,7 @@ async function run(argv = process.argv) {
 	sitesCli.command("ls").description("List sites in the registry").option("--mine", "Filter to sites your GitHub identity is authorized for").action(async (_opts, cmd) => {
 		const opts = cmd.optsWithGlobals();
 		try {
-			await ls$1({
+			await ls$2({
 				json: opts.json ?? false,
 				mine: opts.mine ?? false
 			});
@@ -19189,7 +19425,7 @@ async function run(argv = process.argv) {
 	repoCli.command("ls").description("List repo requests (default: pending)").option("--status <status>", "pending | approved | active | rejected | failed | all").option("--mine", "Only requests you submitted").option("--all", "Show every state (shorthand for --status all)").action(async (_opts, cmd) => {
 		const opts = cmd.optsWithGlobals();
 		try {
-			await ls({
+			await ls$1({
 				json: opts.json ?? false,
 				status: opts.status,
 				mine: opts.mine ?? false,
@@ -19284,7 +19520,7 @@ async function run(argv = process.argv) {
 	staticCli.command("ls").description("List recent deploys for a site").option("--site <site>", "Override site from platform.yaml").action(async (_opts, cmd) => {
 		const opts = cmd.optsWithGlobals();
 		try {
-			await ls$2({
+			await ls$3({
 				json: opts.json ?? false,
 				site: opts.site
 			});
@@ -19351,9 +19587,25 @@ async function run(argv = process.argv) {
 			handleActionError("whoami", opts.json ?? false, err);
 		}
 	});
+	auditCli.command("ls").description("List durable audit events (who did what)").option("--actor <login>", "Filter by GitHub actor").option("--action <action>", "Filter by action (e.g. repo.approve)").option("--site <slug>", "Filter by site").option("--since <rfc3339>", "Only events at or after this timestamp").option("--limit <n>", "Max rows (default 100, max 500)", (v) => Number.parseInt(v, 10)).action(async (_opts, cmd) => {
+		const opts = cmd.optsWithGlobals();
+		try {
+			await ls({
+				json: opts.json ?? false,
+				actor: opts.actor,
+				action: opts.action,
+				site: opts.site,
+				since: opts.since,
+				limit: opts.limit
+			});
+		} catch (err) {
+			handleActionError("audit ls", opts.json ?? false, err);
+		}
+	});
 	cli.addCommand(staticCli);
 	cli.addCommand(sitesCli);
 	cli.addCommand(repoCli);
+	cli.addCommand(auditCli);
 	if (args.length === 0) {
 		cli.outputHelp();
 		return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@freecodecamp/universe-cli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "main": "dist/index.cjs",
   "scripts": {
     "test": "vitest run",