@saptools/cf-events 0.1.1

package/dist/index.js

@@ -0,0 +1,873 @@
+#!/usr/bin/env node
+
+// src/api.ts
+var MAX_PER_PAGE = 100;
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error("The CF API returned a response that is not valid JSON.");
+  }
+}
+function asRecord(value) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  return {};
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asString(value) {
+  return typeof value === "string" ? value : "";
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function mapEntityRef(value) {
+  const record = asRecord(value);
+  return {
+    guid: asString(record["guid"]),
+    type: asString(record["type"]),
+    name: asString(record["name"])
+  };
+}
+function optionalGuid(value) {
+  const guid = asString(asRecord(value)["guid"]);
+  return guid.length > 0 ? guid : void 0;
+}
+function mapAuditEvent(value) {
+  const record = asRecord(value);
+  return {
+    guid: asString(record["guid"]),
+    type: asString(record["type"]),
+    createdAt: asString(record["created_at"]),
+    updatedAt: asString(record["updated_at"]),
+    actor: mapEntityRef(record["actor"]),
+    target: mapEntityRef(record["target"]),
+    data: asRecord(record["data"]),
+    spaceGuid: optionalGuid(record["space"]),
+    organizationGuid: optionalGuid(record["organization"])
+  };
+}
+function mapProcessStat(value) {
+  const record = asRecord(value);
+  const usage = asRecord(record["usage"]);
+  return {
+    type: asString(record["type"]),
+    index: asNumber(record["index"]) ?? 0,
+    state: asString(record["state"]),
+    uptimeSeconds: asNumber(record["uptime"]),
+    cpu: asNumber(usage["cpu"]),
+    memBytes: asNumber(usage["mem"]),
+    memQuotaBytes: asNumber(record["mem_quota"]),
+    diskBytes: asNumber(usage["disk"]),
+    diskQuotaBytes: asNumber(record["disk_quota"])
+  };
+}
+function buildAuditEventsPath(input, perPage) {
+  const params = new URLSearchParams();
+  params.set("target_guids", input.appGuid);
+  params.set("order_by", "-created_at");
+  params.set("per_page", perPage.toString());
+  if (input.types !== void 0 && input.types.length > 0) {
+    params.set("types", input.types.join(","));
+  }
+  if (input.createdAfter !== void 0) {
+    params.set("created_ats[gt]", input.createdAfter);
+  }
+  return `/v3/audit_events?${params.toString()}`;
+}
+function nextPagePath(body) {
+  const next = asRecord(asRecord(asRecord(body)["pagination"])["next"]);
+  const href = next["href"];
+  if (typeof href !== "string" || href.length === 0) {
+    return void 0;
+  }
+  try {
+    const url = new URL(href);
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return void 0;
+  }
+}
+async function fetchAuditEvents(input, curl) {
+  const limit = Math.max(input.limit, 1);
+  const perPage = Math.min(limit, MAX_PER_PAGE);
+  const events = [];
+  let path = buildAuditEventsPath(input, perPage);
+  while (path !== void 0 && events.length < limit) {
+    const body = parseJson(await curl(path));
+    for (const resource of asArray(asRecord(body)["resources"])) {
+      events.push(mapAuditEvent(resource));
+      if (events.length >= limit) {
+        break;
+      }
+    }
+    path = events.length < limit ? nextPagePath(body) : void 0;
+  }
+  return events;
+}
+async function fetchApp(appGuid, curl) {
+  const body = asRecord(parseJson(await curl(`/v3/apps/${appGuid}`)));
+  return {
+    guid: asString(body["guid"]),
+    name: asString(body["name"]),
+    state: asString(body["state"])
+  };
+}
+async function fetchSshEnabled(appGuid, curl) {
+  const body = asRecord(parseJson(await curl(`/v3/apps/${appGuid}/ssh_enabled`)));
+  return {
+    enabled: body["enabled"] === true,
+    reason: asString(body["reason"])
+  };
+}
+async function fetchWebProcessStats(appGuid, curl) {
+  const body = asRecord(parseJson(await curl(`/v3/apps/${appGuid}/processes/web/stats`)));
+  return asArray(body["resources"]).map(mapProcessStat);
+}
+
+// src/cf.ts
+import { execFile } from "child_process";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+var CF_MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+var CF_COMMAND_TIMEOUT_MS = 3e4;
+var CF_RETRY_MAX_ATTEMPTS = 3;
+var CF_RETRY_BASE_DELAY_MS = 120;
+var GUID_PATTERN = /^[0-9a-f-]{16,}$/i;
+async function withCfSession(work) {
+  const cfHomeDir = await mkdtemp(join(tmpdir(), "saptools-cf-events-"));
+  try {
+    return await work({ cfHomeDir });
+  } finally {
+    await rm(cfHomeDir, { recursive: true, force: true });
+  }
+}
+async function prepareCfCliSession(input, ctx) {
+  await runCfCommand(["api", input.apiEndpoint], ctx, "Failed to set the CF API endpoint.");
+  await runCfCommand(["auth"], ctx, "Failed to authenticate the Cloud Foundry CLI.", {
+    CF_USERNAME: input.credentials.email,
+    CF_PASSWORD: input.credentials.password
+  });
+  await runCfCommand(
+    ["target", "-o", input.orgName, "-s", input.spaceName],
+    ctx,
+    "Failed to target the CF org and space."
+  );
+}
+async function cfAppGuid(appName, ctx) {
+  const stdout = await runCfCommand(
+    ["app", appName, "--guid"],
+    ctx,
+    `Failed to resolve the GUID for app "${appName}".`
+  );
+  const guid = stdout.trim();
+  if (!GUID_PATTERN.test(guid)) {
+    throw new Error(
+      `Could not resolve the GUID for app "${appName}" - the CF CLI returned an unexpected value.`
+    );
+  }
+  return guid;
+}
+async function cfCurl(path, ctx) {
+  return await runCfCommand(["curl", path], ctx, `Failed to call the CF API path "${path}".`);
+}
+async function runCfCommand(args, ctx, failureMessage, envOverrides = {}) {
+  const command = resolveCommand();
+  const env = buildEnv(ctx.cfHomeDir, envOverrides);
+  let lastError;
+  for (let attempt = 1; attempt <= CF_RETRY_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      return await execFileWithResult(command.bin, [...command.argsPrefix, ...args], env);
+    } catch (error) {
+      lastError = error;
+      if (attempt >= CF_RETRY_MAX_ATTEMPTS || !shouldRetryCfCliError(error)) {
+        break;
+      }
+      await sleep(resolveRetryDelayMs(attempt));
+    }
+  }
+  const detail = extractSafeCliDetail(lastError);
+  throw new Error(detail.length > 0 ? `${failureMessage} ${detail}` : failureMessage, {
+    cause: lastError
+  });
+}
+function resolveCommand() {
+  const bin = process.env["CF_EVENTS_CF_BIN"] ?? "cf";
+  if (/\.(?:c|m)?js$/i.test(bin)) {
+    return { bin: process.execPath, argsPrefix: [bin] };
+  }
+  return { bin, argsPrefix: [] };
+}
+function buildEnv(cfHomeDir, overrides) {
+  const env = { ...process.env };
+  delete env["SAP_EMAIL"];
+  delete env["SAP_PASSWORD"];
+  env["CF_HOME"] = cfHomeDir;
+  Object.assign(env, overrides);
+  return env;
+}
+async function execFileWithResult(command, args, env) {
+  return await new Promise((resolvePromise, rejectPromise) => {
+    execFile(
+      command,
+      [...args],
+      { env, maxBuffer: CF_MAX_BUFFER_BYTES, timeout: CF_COMMAND_TIMEOUT_MS },
+      (error, stdout, stderr) => {
+        if (error !== null) {
+          rejectPromise(Object.assign(error, { stdout, stderr }));
+          return;
+        }
+        resolvePromise(stdout);
+      }
+    );
+  });
+}
+function shouldRetryCfCliError(error) {
+  const haystack = `${readErrorStderr(error)} ${readErrorMessage(error)}`.toLowerCase();
+  if (haystack.includes("invalid") || haystack.includes("credentials were rejected") || haystack.includes("authentication failed") || haystack.includes("not authorized") || haystack.includes("forbidden")) {
+    return false;
+  }
+  return haystack.includes("timeout") || haystack.includes("timed out") || haystack.includes("connection reset") || haystack.includes("temporarily unavailable") || haystack.includes("network") || haystack.includes("econnreset") || haystack.includes("econnrefused");
+}
+function readErrorStderr(error) {
+  if (typeof error !== "object" || error === null) {
+    return "";
+  }
+  const stderr = error.stderr;
+  return typeof stderr === "string" ? stderr : "";
+}
+function readErrorMessage(error) {
+  return error instanceof Error ? error.message : "";
+}
+function resolveRetryDelayMs(attempt) {
+  const jitter = Math.floor(Math.random() * CF_RETRY_BASE_DELAY_MS);
+  return CF_RETRY_BASE_DELAY_MS * attempt + jitter;
+}
+async function sleep(delayMs) {
+  await new Promise((resolvePromise) => {
+    setTimeout(resolvePromise, delayMs);
+  });
+}
+function extractSafeCliDetail(error) {
+  const stderr = readErrorStderr(error);
+  if (stderr.length === 0) {
+    return "";
+  }
+  const cleaned = stderr.replaceAll(/\s+/g, " ").trim();
+  return cleaned.length > 0 ? `(cli: ${cleaned.slice(0, 180)})` : "";
+}
+
+// src/types.ts
+var APP_EVENT_TYPES = [
+  "audit.app.create",
+  "audit.app.update",
+  "audit.app.delete-request",
+  "audit.app.start",
+  "audit.app.stop",
+  "audit.app.restage",
+  "audit.app.ssh-authorized",
+  "audit.app.ssh-unauthorized",
+  "audit.app.crash",
+  "audit.app.process.create",
+  "audit.app.process.scale",
+  "audit.app.process.update",
+  "audit.app.process.crash",
+  "audit.app.process.terminate_instance",
+  "audit.app.map-route",
+  "audit.app.unmap-route",
+  "audit.app.environment_variables.show"
+];
+var SSH_EVENT_TYPES = ["audit.app.ssh-authorized", "audit.app.ssh-unauthorized"];
+var CRASH_EVENT_TYPES = ["audit.app.crash", "audit.app.process.crash"];
+
+// src/events.ts
+var DURATION_PATTERN = /^(\d+)\s*(s|m|h|d)$/;
+var DURATION_UNIT_MS = {
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5
+};
+function isCrashEvent(event) {
+  return CRASH_EVENT_TYPES.includes(event.type);
+}
+function isSshEvent(event) {
+  return SSH_EVENT_TYPES.includes(event.type);
+}
+function filterByTypes(events, types) {
+  if (types.length === 0) {
+    return events;
+  }
+  const allowed = new Set(types);
+  return events.filter((event) => allowed.has(event.type));
+}
+function sortEventsNewestFirst(events) {
+  return [...events].sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+}
+function parseDuration(raw) {
+  const match = DURATION_PATTERN.exec(raw.trim().toLowerCase());
+  const amountToken = match?.[1];
+  const unitToken = match?.[2];
+  if (amountToken === void 0 || unitToken === void 0) {
+    throw new Error(`Invalid duration "${raw}". Use forms like 30m, 6h, or 7d.`);
+  }
+  const amount = Number.parseInt(amountToken, 10);
+  const unitMs = DURATION_UNIT_MS[unitToken];
+  if (unitMs === void 0 || amount <= 0) {
+    throw new Error(`Invalid duration "${raw}". Use forms like 30m, 6h, or 7d.`);
+  }
+  return amount * unitMs;
+}
+function durationToCreatedAfter(raw, now) {
+  return new Date(now.getTime() - parseDuration(raw)).toISOString();
+}
+function parseTypeFilter(raw) {
+  if (raw === void 0) {
+    return [];
+  }
+  const tokens = raw.split(",").map((token) => token.trim()).filter((token) => token.length > 0);
+  const resolved = [];
+  for (const token of tokens) {
+    if (token === "ssh") {
+      resolved.push(...SSH_EVENT_TYPES);
+    } else if (token === "crash") {
+      resolved.push(...CRASH_EVENT_TYPES);
+    } else if (token.startsWith("audit.") || token.startsWith("app.")) {
+      resolved.push(token);
+    } else {
+      throw new Error(
+        `Unknown event type "${token}". Use a full CF event type (e.g. audit.app.start) or the shorthand "ssh"/"crash".`
+      );
+    }
+  }
+  return [...new Set(resolved)];
+}
+function readString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function toCrashRecord(event) {
+  return {
+    at: event.createdAt,
+    index: readNumber(event.data["index"]),
+    reason: readString(event.data["reason"]) ?? readString(event.data["exit_description"]),
+    exitStatus: readNumber(event.data["exit_status"])
+  };
+}
+function summarizeCrashes(appName, events) {
+  const crashes = events.filter(isCrashEvent).map(toCrashRecord).sort((left, right) => right.at.localeCompare(left.at));
+  const last = crashes[0];
+  return {
+    appName,
+    crashCount: crashes.length,
+    lastCrashAt: last?.at,
+    lastCrashReason: last?.reason,
+    crashes
+  };
+}
+
+// src/format.ts
+var EVENT_LABELS = {
+  "audit.app.create": "App created",
+  "audit.app.update": "App updated",
+  "audit.app.delete-request": "App delete requested",
+  "audit.app.start": "App started",
+  "audit.app.stop": "App stopped",
+  "audit.app.restage": "App restaged",
+  "audit.app.ssh-authorized": "SSH session authorized",
+  "audit.app.ssh-unauthorized": "SSH attempt denied",
+  "audit.app.crash": "App crashed",
+  "audit.app.process.create": "Process created",
+  "audit.app.process.scale": "Process scaled",
+  "audit.app.process.update": "Process updated",
+  "audit.app.process.crash": "Process crashed",
+  "audit.app.process.terminate_instance": "Instance terminated",
+  "audit.app.map-route": "Route mapped",
+  "audit.app.unmap-route": "Route unmapped",
+  "audit.app.environment_variables.show": "Env variables viewed"
+};
+function describeEventType(type) {
+  return EVENT_LABELS[type] ?? type;
+}
+function formatUptime(seconds) {
+  if (seconds === void 0 || seconds <= 0) {
+    return "-";
+  }
+  const totalMinutes = Math.floor(seconds / 60);
+  const days = Math.floor(totalMinutes / 1440);
+  const hours = Math.floor(totalMinutes % 1440 / 60);
+  const minutes = totalMinutes % 60;
+  const parts = [];
+  if (days > 0) {
+    parts.push(`${days.toString()}d`);
+  }
+  if (hours > 0) {
+    parts.push(`${hours.toString()}h`);
+  }
+  if (minutes > 0 || parts.length === 0) {
+    parts.push(`${minutes.toString()}m`);
+  }
+  return parts.join(" ");
+}
+function formatBytes(bytes) {
+  if (bytes === void 0 || bytes < 0) {
+    return "-";
+  }
+  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  let value = bytes;
+  let unitIndex = 0;
+  while (value >= 1024 && unitIndex < units.length - 1) {
+    value /= 1024;
+    unitIndex += 1;
+  }
+  return `${value.toFixed(unitIndex === 0 ? 0 : 1)} ${units[unitIndex] ?? "B"}`;
+}
+function formatCpu(cpu) {
+  if (cpu === void 0) {
+    return "-";
+  }
+  return `${(cpu * 100).toFixed(1)}%`;
+}
+function formatRelativeTime(timestamp, now) {
+  const at = Date.parse(timestamp);
+  if (Number.isNaN(at)) {
+    return "unknown";
+  }
+  const deltaMs = now.getTime() - at;
+  if (deltaMs < 6e4) {
+    return "just now";
+  }
+  const minutes = Math.floor(deltaMs / 6e4);
+  if (minutes < 60) {
+    return `${minutes.toString()}m ago`;
+  }
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) {
+    return `${hours.toString()}h ago`;
+  }
+  return `${Math.floor(hours / 24).toString()}d ago`;
+}
+function formatEventLine(event, now) {
+  const actor = event.actor.name.length > 0 ? event.actor.name : event.actor.type;
+  return [
+    `  ${event.createdAt.padEnd(26)}`,
+    formatRelativeTime(event.createdAt, now).padEnd(11),
+    describeEventType(event.type).padEnd(24),
+    actor.length > 0 ? actor : "(unknown actor)"
+  ].join("  ");
+}
+function formatEventsReport(appName, events, now) {
+  if (events.length === 0) {
+    return `No audit events found for ${appName}.`;
+  }
+  return [
+    `Audit events for ${appName} (${events.length.toString()}):`,
+    ...events.map((event) => formatEventLine(event, now))
+  ].join("\n");
+}
+function formatSshStatusReport(status, now) {
+  const sessionLines = status.sessions.map((session) => {
+    const tag = session.likelyActive ? "[active]" : "[past]  ";
+    const when = formatRelativeTime(session.authorizedAt, now);
+    return `    ${tag}  ${session.actor.padEnd(30)}  authorized ${session.authorizedAt} (${when})`;
+  });
+  const deniedLines = status.deniedAttempts.map((attempt) => {
+    const actor = attempt.actor.name.length > 0 ? attempt.actor.name : attempt.actor.type;
+    return `    ${actor.padEnd(30)}  ${attempt.createdAt}`;
+  });
+  return [
+    `SSH status for ${status.appName}`,
+    "",
+    `  SSH enabled:            ${status.sshEnabled ? "yes" : "no"}`,
+    ...!status.sshEnabled && status.sshReason.length > 0 ? [`  Disabled reason:        ${status.sshReason}`] : [],
+    `  Recent SSH sessions:    ${status.sessions.length.toString()}`,
+    `  Likely active sessions: ${status.activeSessionCount.toString()}`,
+    ...sessionLines.length > 0 ? ["", "  Sessions:", ...sessionLines] : [],
+    ...deniedLines.length > 0 ? ["", `  Denied SSH attempts: ${status.deniedAttempts.length.toString()}`, ...deniedLines] : [],
+    "",
+    '  Note: Cloud Foundry exposes no live-session API; "likely active" sessions',
+    "  are inferred from recent ssh-authorized audit events."
+  ].join("\n");
+}
+function formatCrashReport(summary, now) {
+  if (summary.crashCount === 0) {
+    return `No crashes found for ${summary.appName}.`;
+  }
+  const crashLines = summary.crashes.map((crash) => {
+    const index = crash.index === void 0 ? "-" : `#${crash.index.toString()}`;
+    const reason = crash.reason ?? "unknown";
+    const exit = crash.exitStatus === void 0 ? "" : `  exit ${crash.exitStatus.toString()}`;
+    return `    ${crash.at}  instance ${index}  ${reason}${exit}`;
+  });
+  return [
+    `Crash report for ${summary.appName}`,
+    "",
+    `  Crashes: ${summary.crashCount.toString()}`,
+    ...summary.lastCrashAt === void 0 ? [] : [`  Last crash: ${summary.lastCrashAt} (${formatRelativeTime(summary.lastCrashAt, now)})`],
+    ...summary.lastCrashReason === void 0 ? [] : [`  Last reason: ${summary.lastCrashReason}`],
+    "",
+    "  Recent crashes:",
+    ...crashLines
+  ].join("\n");
+}
+function formatInstanceLine(instance) {
+  return [
+    `  #${instance.index.toString()}`.padEnd(6),
+    instance.state.padEnd(10),
+    `up ${formatUptime(instance.uptimeSeconds)}`.padEnd(16),
+    `cpu ${formatCpu(instance.cpu)}`.padEnd(13),
+    `mem ${formatBytes(instance.memBytes)} / ${formatBytes(instance.memQuotaBytes)}`
+  ].join("  ");
+}
+function formatStatusReport(health, now) {
+  const lastEventLine = health.lastEvent === void 0 ? "  Last event: (none)" : `  Last event: ${describeEventType(health.lastEvent.type)} - ${health.lastEvent.createdAt} (${formatRelativeTime(health.lastEvent.createdAt, now)})`;
+  return [
+    `App status: ${health.appName}`,
+    "",
+    `  GUID:            ${health.appGuid}`,
+    `  Requested state: ${health.requestedState.length > 0 ? health.requestedState : "unknown"}`,
+    `  SSH enabled:     ${health.sshEnabled ? "yes" : "no"}`,
+    `  Instances:       ${health.instances.length.toString()}`,
+    ...health.instances.length > 0 ? ["", ...health.instances.map((instance) => formatInstanceLine(instance))] : [],
+    "",
+    lastEventLine
+  ].join("\n");
+}
+
+// src/runtime.ts
+import { setTimeout as delayPromise } from "timers/promises";
+
+// src/selector.ts
+import { readStructure } from "@saptools/cf-sync";
+var SELECTOR_USAGE = 'use "region/org/space/app" or a bare app name';
+function parseSelector(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    throw new Error(`A selector is required: ${SELECTOR_USAGE}.`);
+  }
+  const parts = trimmed.split("/").map((part) => part.trim());
+  if (parts.length === 1) {
+    const appName = parts[0] ?? "";
+    if (appName.length === 0) {
+      throw new Error(`A selector is required: ${SELECTOR_USAGE}.`);
+    }
+    return { kind: "appName", appName };
+  }
+  if (parts.length === 4) {
+    const [regionKey, orgName, spaceName, appName] = parts;
+    if (regionKey === void 0 || orgName === void 0 || spaceName === void 0 || appName === void 0 || regionKey.length === 0 || orgName.length === 0 || spaceName.length === 0 || appName.length === 0) {
+      throw new Error(`Invalid selector "${raw}": every region/org/space/app segment must be non-empty.`);
+    }
+    return { kind: "explicit", regionKey, orgName, spaceName, appName };
+  }
+  throw new Error(`Invalid selector "${raw}": ${SELECTOR_USAGE}.`);
+}
+function resolveExplicit(raw, parsed, structure) {
+  const region = structure.regions.find((entry) => entry.key === parsed.regionKey);
+  if (region === void 0) {
+    throw new Error(
+      `Region "${parsed.regionKey}" is not in the CF topology snapshot. Run \`cf-sync sync\` first (or \`cf-sync regions\` to list valid region keys).`
+    );
+  }
+  const org = region.orgs.find((entry) => entry.name === parsed.orgName);
+  if (org === void 0) {
+    throw new Error(
+      `Org "${parsed.orgName}" was not found in region ${parsed.regionKey}. Run \`cf-sync orgs ${parsed.regionKey}\` to refresh it.`
+    );
+  }
+  const space = org.spaces.find((entry) => entry.name === parsed.spaceName);
+  if (space === void 0) {
+    throw new Error(
+      `Space "${parsed.spaceName}" was not found in ${parsed.regionKey}/${parsed.orgName}. Run \`cf-sync org ${parsed.regionKey} ${parsed.orgName}\` to refresh it.`
+    );
+  }
+  const app = space.apps.find((entry) => entry.name === parsed.appName);
+  if (app === void 0) {
+    throw new Error(
+      `App "${parsed.appName}" was not found in ${parsed.regionKey}/${parsed.orgName}/${parsed.spaceName}. Run \`cf-sync space ${parsed.regionKey} ${parsed.orgName} ${parsed.spaceName}\` to refresh it.`
+    );
+  }
+  return {
+    raw,
+    regionKey: region.key,
+    apiEndpoint: region.apiEndpoint,
+    orgName: org.name,
+    spaceName: space.name,
+    appName: app.name
+  };
+}
+function resolveByAppName(raw, appName, structure) {
+  const matches = [];
+  for (const region of structure.regions) {
+    for (const org of region.orgs) {
+      for (const space of org.spaces) {
+        for (const app of space.apps) {
+          if (app.name === appName) {
+            matches.push({
+              raw,
+              regionKey: region.key,
+              apiEndpoint: region.apiEndpoint,
+              orgName: org.name,
+              spaceName: space.name,
+              appName: app.name
+            });
+          }
+        }
+      }
+    }
+  }
+  if (matches.length === 0) {
+    throw new Error(
+      `App "${appName}" was not found in the CF topology snapshot. Run \`cf-sync sync\` first, or pass a full region/org/space/app selector.`
+    );
+  }
+  if (matches.length > 1) {
+    const candidates = matches.map((match) => `  ${match.regionKey}/${match.orgName}/${match.spaceName}/${match.appName}`).join("\n");
+    throw new Error(
+      `App "${appName}" is ambiguous - it exists in multiple spaces:
+${candidates}
+Pass a full region/org/space/app selector to disambiguate.`
+    );
+  }
+  const onlyMatch = matches[0];
+  if (onlyMatch === void 0) {
+    throw new Error(`App "${appName}" could not be resolved.`);
+  }
+  return onlyMatch;
+}
+async function resolveSelector(raw) {
+  const parsed = parseSelector(raw);
+  const structure = await readStructure();
+  if (structure === void 0) {
+    throw new Error(
+      "No CF topology snapshot found. Run `cf-sync sync` (or `cf-sync space ...`) first."
+    );
+  }
+  if (parsed.kind === "explicit") {
+    return resolveExplicit(raw, parsed, structure);
+  }
+  return resolveByAppName(raw, parsed.appName, structure);
+}
+
+// src/ssh.ts
+var SSH_AUTHORIZED_TYPE = "audit.app.ssh-authorized";
+var SSH_DENIED_TYPE = "audit.app.ssh-unauthorized";
+var LIKELY_ACTIVE_WINDOW_MS = 60 * 60 * 1e3;
+function isWithinActiveWindow(timestamp, now) {
+  const at = Date.parse(timestamp);
+  if (Number.isNaN(at)) {
+    return false;
+  }
+  const delta = now.getTime() - at;
+  return delta >= 0 && delta <= LIKELY_ACTIVE_WINDOW_MS;
+}
+function inferSshSessions(events, now) {
+  return events.filter((event) => event.type === SSH_AUTHORIZED_TYPE).map((event) => ({
+    actor: event.actor.name.length > 0 ? event.actor.name : event.actor.guid,
+    authorizedAt: event.createdAt,
+    likelyActive: isWithinActiveWindow(event.createdAt, now)
+  })).sort((left, right) => right.authorizedAt.localeCompare(left.authorizedAt));
+}
+function buildSshStatus(input) {
+  const sshEvents = input.events.filter(isSshEvent);
+  const sessions = inferSshSessions(sshEvents, input.now);
+  const deniedAttempts = sshEvents.filter((event) => event.type === SSH_DENIED_TYPE).sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+  return {
+    appName: input.appName,
+    sshEnabled: input.sshEnabled,
+    sshReason: input.sshReason,
+    sessions,
+    deniedAttempts,
+    activeSessionCount: sessions.filter((session) => session.likelyActive).length
+  };
+}
+
+// src/runtime.ts
+var SSH_STATUS_EVENT_LIMIT = 200;
+var WATCH_FETCH_LIMIT = 100;
+function createCfClient(curl) {
+  return {
+    fetchAuditEvents: (input) => fetchAuditEvents(input, curl),
+    fetchApp: (appGuid) => fetchApp(appGuid, curl),
+    fetchSshEnabled: (appGuid) => fetchSshEnabled(appGuid, curl),
+    fetchWebProcessStats: (appGuid) => fetchWebProcessStats(appGuid, curl)
+  };
+}
+async function defaultWithCfApp(selector, credentials, work) {
+  return await withCfSession(async (ctx) => {
+    await prepareCfCliSession(
+      {
+        apiEndpoint: selector.apiEndpoint,
+        orgName: selector.orgName,
+        spaceName: selector.spaceName,
+        credentials
+      },
+      ctx
+    );
+    const appGuid = await cfAppGuid(selector.appName, ctx);
+    const client = createCfClient((path) => cfCurl(path, ctx));
+    return await work({ appGuid, client });
+  });
+}
+function createDefaultDependencies() {
+  return {
+    resolveSelector,
+    withCfApp: defaultWithCfApp,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function delay(ms, signal) {
+  try {
+    await delayPromise(ms, void 0, { signal });
+  } catch {
+  }
+}
+var CfEventsRuntime = class {
+  deps;
+  constructor(deps = createDefaultDependencies()) {
+    this.deps = deps;
+  }
+  async fetchEvents(raw, credentials, options) {
+    const selector = await this.deps.resolveSelector(raw);
+    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+      return await client.fetchAuditEvents({
+        appGuid,
+        types: options.types.length > 0 ? options.types : void 0,
+        createdAfter: this.resolveCreatedAfter(options.since),
+        limit: options.limit
+      });
+    });
+  }
+  async getSshStatus(raw, credentials, since) {
+    const selector = await this.deps.resolveSelector(raw);
+    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+      const [sshEnabled, events] = await Promise.all([
+        client.fetchSshEnabled(appGuid),
+        client.fetchAuditEvents({
+          appGuid,
+          types: [...SSH_EVENT_TYPES],
+          createdAfter: durationToCreatedAfter(since, this.deps.now()),
+          limit: SSH_STATUS_EVENT_LIMIT
+        })
+      ]);
+      return buildSshStatus({
+        appName: selector.appName,
+        sshEnabled: sshEnabled.enabled,
+        sshReason: sshEnabled.reason,
+        events,
+        now: this.deps.now()
+      });
+    });
+  }
+  async getCrashes(raw, credentials, options) {
+    const selector = await this.deps.resolveSelector(raw);
+    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+      const events = await client.fetchAuditEvents({
+        appGuid,
+        types: [...CRASH_EVENT_TYPES],
+        createdAfter: this.resolveCreatedAfter(options.since),
+        limit: options.limit
+      });
+      return summarizeCrashes(selector.appName, events);
+    });
+  }
+  async getStatus(raw, credentials) {
+    const selector = await this.deps.resolveSelector(raw);
+    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+      const [app, instances, sshEnabled, recent] = await Promise.all([
+        client.fetchApp(appGuid),
+        client.fetchWebProcessStats(appGuid),
+        client.fetchSshEnabled(appGuid),
+        client.fetchAuditEvents({ appGuid, types: void 0, createdAfter: void 0, limit: 1 })
+      ]);
+      return {
+        appName: selector.appName,
+        appGuid,
+        requestedState: app.state,
+        sshEnabled: sshEnabled.enabled,
+        instances,
+        lastEvent: recent[0]
+      };
+    });
+  }
+  async watchEvents(raw, credentials, options, onEvent, signal) {
+    const selector = await this.deps.resolveSelector(raw);
+    await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+      const seen = /* @__PURE__ */ new Set();
+      let cursor = durationToCreatedAfter(options.lookback, this.deps.now());
+      while (!signal.aborted) {
+        const events = await client.fetchAuditEvents({
+          appGuid,
+          types: options.types.length > 0 ? options.types : void 0,
+          createdAfter: cursor,
+          limit: WATCH_FETCH_LIMIT
+        });
+        const fresh = [];
+        for (const event of events) {
+          if (!seen.has(event.guid)) {
+            seen.add(event.guid);
+            fresh.push(event);
+          }
+        }
+        for (const event of [...fresh].reverse()) {
+          onEvent(event);
+        }
+        const newest = events[0];
+        if (newest !== void 0 && newest.createdAt.length > 0) {
+          cursor = newest.createdAt;
+        }
+        await delay(options.intervalMs, signal);
+      }
+    });
+  }
+  resolveCreatedAfter(since) {
+    return since === void 0 ? void 0 : durationToCreatedAfter(since, this.deps.now());
+  }
+};
+export {
+  APP_EVENT_TYPES,
+  CRASH_EVENT_TYPES,
+  CfEventsRuntime,
+  SSH_EVENT_TYPES,
+  buildAuditEventsPath,
+  buildSshStatus,
+  cfAppGuid,
+  cfCurl,
+  createDefaultDependencies,
+  describeEventType,
+  durationToCreatedAfter,
+  fetchApp,
+  fetchAuditEvents,
+  fetchSshEnabled,
+  fetchWebProcessStats,
+  filterByTypes,
+  formatBytes,
+  formatCpu,
+  formatCrashReport,
+  formatEventLine,
+  formatEventsReport,
+  formatRelativeTime,
+  formatSshStatusReport,
+  formatStatusReport,
+  formatUptime,
+  inferSshSessions,
+  isCrashEvent,
+  isSshEvent,
+  parseDuration,
+  parseSelector,
+  parseTypeFilter,
+  prepareCfCliSession,
+  resolveSelector,
+  runCfCommand,
+  sortEventsNewestFirst,
+  summarizeCrashes,
+  toCrashRecord,
+  withCfSession
+};
+//# sourceMappingURL=index.js.map