@saptools/cf-events 0.1.4 → 0.2.0

package/README.md

@@ -2,9 +2,9 @@
 
 # ☁️ `@saptools/cf-events`
 
-**Inspect SAP BTP Cloud Foundry application audit events and detect active SSH/debug sessions from the command line.**
+**Inspect SAP BTP Cloud Foundry application and space audit events and detect active SSH/debug sessions from the command line.**
 
-Point it at a `region/org/space/app` (or a bare app name) and instantly answer: "what just happened?", "is anyone SSH'd in right now?", or "why did it crash?".
+Point it at a `region/org/space/app`, `region/org/space`, or a bare app name and instantly answer: "what just happened?", "is anyone SSH'd in right now?", or "why did it crash?".
 
 [![npm version](https://img.shields.io/npm/v/@saptools/cf-events.svg?style=flat&color=CB3837&logo=npm)](https://www.npmjs.com/package/@saptools/cf-events)
 [![license](https://img.shields.io/npm/l/@saptools/cf-events.svg?style=flat&color=blue)](./LICENSE)
@@ -20,16 +20,15 @@ Point it at a `region/org/space/app` (or a bare app name) and instantly answer:
 
 ## ✨ Features
 
-- 📜 **Audit event inspection** — list recent `audit.app.*` events (start/stop, scale, restarts, restage, route changes, env views, crashes, SSH authz)
+- 📜 **Audit event inspection** — list recent `audit.app.*` events for one app or all apps in a space
 - 🔐 **SSH & debug session detection** — surface authorized sessions + denied attempts; infer "likely active" ones from recent `ssh-authorized` events (CF has no live session or close events)
-- 💥 **Crash summaries** — count, last crash time/reason/exit code, and per-instance detail
+- 💥 **Crash summaries** — count, last crash time/reason/exit code, and per-instance detail for an app or grouped by app across a space
 - ❤️ **One-glance status** — requested state, per-instance CPU/mem/uptime, SSH flag, and the most recent audit event
 - 👀 **Live watch** — poll `/v3/audit_events` on an interval and stream new events (Ctrl+C to stop)
-- 🧭 **Smart selectors** — full `region/org/space/app` or bare app name (resolved via the `cf-sync` snapshot; falls back to current `cf target` for bare names)
-- 🔄 **Reuses cf-sync** — topology snapshot + current-target helpers from [`@saptools/cf-sync`](https://www.npmjs.com/package/@saptools/cf-sync)
+- 🧭 **Smart selectors** — full app selectors (`region/org/space/app`), space selectors (`region/org/space`), or bare app names resolved from the current `cf target`
 - 🧪 **Isolated sessions** — every invocation uses a fresh ephemeral `CF_HOME`; never touches your interactive login
 - 🧩 **CLI + typed library** — full TypeScript exports for `CfEventsRuntime`, parsers, formatters, and types
-- 🪶 **Zero daemon, tiny deps** — commander + cf-sync only
+- 🪶 **Zero daemon, tiny deps** — commander only
 
 ---
 
@@ -59,12 +58,10 @@ npm install @saptools/cf-events
 export SAP_EMAIL="you@company.com"
 export SAP_PASSWORD="your-sap-password"
 
-# 2. Make sure you have a topology snapshot (or be logged into a CF target)
-cf-sync sync --only ap10   # or cf-sync space ap10 my-org dev
-
-# 3. Inspect events
+# 2. Inspect events
 cf-events events orders-srv
 cf-events events ap10/my-org/dev/orders-srv --limit 100 --since 6h
+cf-events events ap10/my-org/dev --limit 200 --since 6h
 
 # 4. Check for active SSH/debug sessions
 cf-events ssh-status orders-srv --since 7d
@@ -79,16 +76,17 @@ cf-events status orders-srv
 cf-events watch orders-srv --type crash
 ```
 
-After a `cf-sync` snapshot exists, bare app names are resolved automatically (with current `cf target` expansion when no `/` present).
+Bare app names use the current `cf target` for org/space/API context. Explicit app and space selectors do not require a topology snapshot.
 
 ---
 
 ## 🧰 CLI
 
-All commands accept a single positional **selector**:
+All commands accept a single positional **selector**. `events`, `watch`, and `crashes` accept app or space selectors; `status` and `ssh-status` require an app selector.
 
-- Full path: `ap10/my-org/dev/orders-srv`
-- Bare app name: `orders-srv` — resolved against the cf-sync snapshot (and current `cf target` when the name is unique within the target scope). Ambiguous names list the candidates and fail.
+- App path: `ap10/my-org/dev/orders-srv`
+- Space path: `ap10/my-org/dev`
+- Bare app name: `orders-srv` — resolved against the current `cf target`. Bare single-segment selectors are always app names, never spaces.
 
 Common credential flags (all commands):
 
@@ -100,13 +98,14 @@ Common credential flags (all commands):
 
 ### `events <selector>`
 
-List recent audit events for the app (deployments, restarts, scaling, crashes, SSH, routes, ...).
+List recent audit events for the app or all apps in a space (deployments, restarts, scaling, crashes, SSH, routes, ...).
 
 ```bash
 cf-events events ap10/my-org/dev/orders-srv
 cf-events events orders-srv --limit 100 --since 6h
 cf-events events orders-srv --type ssh --json
 cf-events events orders-srv --type audit.app.start,audit.app.stop
+cf-events events ap10/my-org/dev --type ssh --json
 ```
 
 | Flag     | Description                                      |
@@ -133,11 +132,12 @@ cf-events ssh-status orders-srv --since 7d --json
 
 ### `crashes <selector>`
 
-Count and detail recent crash events (both `audit.app.crash` and `audit.app.process.crash`).
+Count and detail recent crash events for an app or grouped by target app across a space (both `audit.app.crash` and `audit.app.process.crash`).
 
 ```bash
 cf-events crashes orders-srv
 cf-events crashes orders-srv --since 24h --json
+cf-events crashes ap10/my-org/dev --since 24h --json
 ```
 
 | Flag          | Description                              |
@@ -156,11 +156,12 @@ cf-events status orders-srv --json
 
 ### `watch <selector>`
 
-Poll `/v3/audit_events` repeatedly and print (or emit NDJSON) fresh events as they arrive. Press Ctrl+C to stop.
+Poll `/v3/audit_events` repeatedly for an app or space and print (or emit NDJSON) fresh events as they arrive. Press Ctrl+C to stop.
 
 ```bash
 cf-events watch orders-srv
 cf-events watch orders-srv --interval 30000 --type crash --lookback 5m
+cf-events watch ap10/my-org/dev --lookback 5m --type crash --json
 ```
 
 | Flag             | Description                                      |
@@ -172,24 +173,22 @@ cf-events watch orders-srv --interval 30000 --type crash --lookback 5m
 
 ---
 
-## 📁 Prerequisites & Snapshots
-
-`cf-events` relies on a `cf-sync` snapshot at `~/.saptools/cf-structure.json` for bare-app-name resolution and validation of explicit paths.
+## 📁 Prerequisites & Selector Resolution
 
-- Run `cf-sync sync`, `cf-sync space ...`, or `cf-sync org ...` at least once.
-- When you pass a bare app name, `cf-events` will also consult your current `cf target` (via `cf target` output) to build a full selector before validating against the snapshot.
-- Pure `--json` + explicit full selectors still require the snapshot for safety.
+`cf-events` uses direct CF CLI/API calls and an isolated throw-away `CF_HOME`; it does not read or validate a `cf-sync` snapshot.
 
-All CF operations run inside a throw-away `CF_HOME`. Your interactive `cf` login is never affected.
+- Explicit app selectors (`region/org/space/app`) and space selectors (`region/org/space`) use the built-in SAP BTP region-to-API map, then authenticate and target that org/space.
+- Bare app names use your current interactive `cf target` only to discover API endpoint, org, and space, then resolve the app GUID inside the isolated session.
+- Space-wide audit event queries use the Cloud Foundry v3 `space_guids` audit-event filter after resolving org and space GUIDs with `/v3/organizations?names=...` and `/v3/spaces?names=...&organization_guids=...`.
 
----
+For JSON output, `events --json` returns the same raw audit-event array shape for app and space selectors. Space events include target, space, and organization references from the CF response. `watch --json` emits newline-delimited JSON events.
 
 ## ❓ FAQ
 
 <details>
 <summary><b>Do I need to run cf target first?</b></summary>
 
-Not required. Pass a full selector or make sure a cf-sync snapshot exists. Bare names will try to use your current `cf target` output to expand into `region/org/space/app`.
+Not required for explicit selectors. Bare app names require a current `cf target` so `cf-events` can discover the API endpoint, org, and space.
 
 </details>
 
@@ -217,7 +216,7 @@ Yes: `--type crash` or `--type ssh`. You can also pass comma-separated full type
 <details>
 <summary><b>Is the snapshot required even for JSON output?</b></summary>
 
-Yes for safety and consistent resolution. The snapshot is the single source of truth for which apps exist in which spaces.
+No. `cf-events` does not read a snapshot. Explicit selectors are resolved with the region map and live CF API/CLI calls; bare app names use the current `cf target`.
 
 </details>
 
@@ -243,7 +242,6 @@ E2E tests are fully fake-backed (no real CF or credentials needed).
 
 ## 🌐 Related
 
-- 🗺️ [`@saptools/cf-sync`](https://www.npmjs.com/package/@saptools/cf-sync) — the topology snapshot and current-target helpers that power selector resolution
 - 🔐 [`@saptools/cf-xsuaa`](https://www.npmjs.com/package/@saptools/cf-xsuaa)
 - 🐛 [`@saptools/cf-debugger`](https://www.npmjs.com/package/@saptools/cf-debugger)
 - Full toolbox: [saptools monorepo](https://github.com/dongitran/saptools)

package/dist/cli.js

@@ -88,6 +88,39 @@ function summarizeCrashes(appName, events) {
     crashes
   };
 }
+function crashAppName(event) {
+  if (event.target.name.length > 0) {
+    return event.target.name;
+  }
+  if (event.target.guid.length > 0) {
+    return event.target.guid;
+  }
+  return "(unknown app)";
+}
+function summarizeSpaceCrashes(selector, events) {
+  const byApp = /* @__PURE__ */ new Map();
+  for (const event of events.filter(isCrashEvent)) {
+    const appName = crashAppName(event);
+    byApp.set(appName, [...byApp.get(appName) ?? [], event]);
+  }
+  const apps = [...byApp.entries()].map(([appName, appEvents]) => summarizeCrashes(appName, appEvents)).map(({ appName, crashCount, lastCrashAt, lastCrashReason, crashes }) => ({
+    appName,
+    crashCount,
+    lastCrashAt,
+    lastCrashReason,
+    crashes
+  })).sort((left, right) => {
+    const byTime = (right.lastCrashAt ?? "").localeCompare(left.lastCrashAt ?? "");
+    return byTime === 0 ? left.appName.localeCompare(right.appName) : byTime;
+  });
+  return {
+    scope: "space",
+    selector,
+    crashCount: apps.reduce((sum, app) => sum + app.crashCount, 0),
+    lastCrashAt: apps[0]?.lastCrashAt,
+    apps
+  };
+}
 
 // src/format.ts
 var EVENT_LABELS = {
@@ -188,6 +221,34 @@ function formatEventsReport(appName, events, now) {
     ...events.map((event) => formatEventLine(event, now))
   ].join("\n");
 }
+function eventTargetLabel(event) {
+  if (event.target.name.length > 0) {
+    return event.target.name;
+  }
+  if (event.target.type.length > 0) {
+    return event.target.type;
+  }
+  return event.target.guid.length > 0 ? event.target.guid : "(unknown target)";
+}
+function formatSpaceEventLine(event, now) {
+  const actor = event.actor.name.length > 0 ? event.actor.name : event.actor.type;
+  return [
+    `  ${event.createdAt.padEnd(26)}`,
+    formatRelativeTime(event.createdAt, now).padEnd(11),
+    describeEventType(event.type).padEnd(24),
+    eventTargetLabel(event).padEnd(18),
+    actor.length > 0 ? actor : "(unknown actor)"
+  ].join("  ");
+}
+function formatSpaceEventsReport(selector, events, now) {
+  if (events.length === 0) {
+    return `No audit events found for space ${selector}.`;
+  }
+  return [
+    `Audit events for space ${selector} (${events.length.toString()}):`,
+    ...events.map((event) => formatSpaceEventLine(event, now))
+  ].join("\n");
+}
 function formatSshStatusReport(status, now) {
   const sessionLines = status.sessions.map((session) => {
     const tag = session.likelyActive ? "[active]" : "[past]  ";
@@ -212,7 +273,7 @@ function formatSshStatusReport(status, now) {
     "  are inferred from recent ssh-authorized audit events."
   ].join("\n");
 }
-function formatCrashReport(summary, now) {
+function formatAppCrashReport(summary, now) {
   if (summary.crashCount === 0) {
     return `No crashes found for ${summary.appName}.`;
   }
@@ -233,6 +294,35 @@ function formatCrashReport(summary, now) {
     ...crashLines
   ].join("\n");
 }
+function formatSpaceCrashReport(summary, now) {
+  if (summary.crashCount === 0) {
+    return `No crashes found for space ${summary.selector}.`;
+  }
+  const appLines = summary.apps.flatMap((app) => [
+    `  ${app.appName} (${app.crashCount.toString()})`,
+    ...app.crashes.map((crash) => {
+      const index = crash.index === void 0 ? "-" : `#${crash.index.toString()}`;
+      const reason = crash.reason ?? "unknown";
+      const exit = crash.exitStatus === void 0 ? "" : `  exit ${crash.exitStatus.toString()}`;
+      return `    ${crash.at}  instance ${index}  ${reason}${exit}`;
+    })
+  ]);
+  return [
+    `Crash report for space ${summary.selector}`,
+    "",
+    `  Crashes: ${summary.crashCount.toString()}`,
+    `  Apps affected: ${summary.apps.length.toString()}`,
+    ...summary.lastCrashAt === void 0 ? [] : [`  Last crash: ${summary.lastCrashAt} (${formatRelativeTime(summary.lastCrashAt, now)})`],
+    "",
+    ...appLines
+  ].join("\n");
+}
+function formatCrashReport(summary, now) {
+  if ("scope" in summary) {
+    return formatSpaceCrashReport(summary, now);
+  }
+  return formatAppCrashReport(summary, now);
+}
 function formatInstanceLine(instance) {
   return [
     `  #${instance.index.toString()}`.padEnd(6),
@@ -327,7 +417,7 @@ function mapProcessStat(value) {
 }
 function buildAuditEventsPath(input, perPage) {
   const params = new URLSearchParams();
-  params.set("target_guids", input.appGuid);
+  applyAuditEventScope(params, input.scope);
   params.set("order_by", "-created_at");
   params.set("per_page", perPage.toString());
   if (input.types !== void 0 && input.types.length > 0) {
@@ -338,6 +428,36 @@ function buildAuditEventsPath(input, perPage) {
   }
   return `/v3/audit_events?${params.toString()}`;
 }
+function applyAuditEventScope(params, scope) {
+  if (scope.kind === "app") {
+    params.set("target_guids", scope.appGuid);
+    return;
+  }
+  params.set("space_guids", scope.spaceGuid);
+}
+async function resolveOrganizationGuid(orgName, curl) {
+  const params = new URLSearchParams();
+  params.set("names", orgName);
+  const body = asRecord(parseJson(await curl(`/v3/organizations?${params.toString()}`)));
+  const first = asRecord(asArray(body["resources"])[0]);
+  const guid = asString(first["guid"]);
+  if (guid.length === 0) {
+    throw new Error(`Could not resolve the GUID for organization "${orgName}".`);
+  }
+  return guid;
+}
+async function resolveSpaceGuid(spaceName, orgGuid, curl) {
+  const params = new URLSearchParams();
+  params.set("names", spaceName);
+  params.set("organization_guids", orgGuid);
+  const body = asRecord(parseJson(await curl(`/v3/spaces?${params.toString()}`)));
+  const first = asRecord(asArray(body["resources"])[0]);
+  const guid = asString(first["guid"]);
+  if (guid.length === 0) {
+    throw new Error(`Could not resolve the GUID for space "${spaceName}".`);
+  }
+  return guid;
+}
 function nextPagePath(body) {
   const next = asRecord(asRecord(asRecord(body)["pagination"])["next"]);
   const href = next["href"];
@@ -626,7 +746,12 @@ function extractSafeCliDetail(error) {
 }
 
 // src/selector.ts
-var SELECTOR_USAGE = 'use "region/org/space/app" or a bare app name';
+var SELECTOR_USAGE = 'use "region/org/space", "region/org/space/app", or a bare app name';
+function assertNonEmpty(raw, parts, shape) {
+  if (parts.some((part) => part.length === 0)) {
+    throw new Error(`Invalid selector "${raw}": every ${shape} segment must be non-empty.`);
+  }
+}
 function parseSelector(raw) {
   const trimmed = raw.trim();
   if (trimmed.length === 0) {
@@ -640,12 +765,21 @@ function parseSelector(raw) {
     }
     return { kind: "appName", appName };
   }
+  if (parts.length === 3) {
+    assertNonEmpty(raw, parts, "region/org/space");
+    const [regionKey, orgName, spaceName] = parts;
+    return { kind: "spacePath", regionKey: regionKey ?? "", orgName: orgName ?? "", spaceName: spaceName ?? "" };
+  }
   if (parts.length === 4) {
+    assertNonEmpty(raw, parts, "region/org/space/app");
     const [regionKey, orgName, spaceName, appName] = parts;
-    if (regionKey === void 0 || orgName === void 0 || spaceName === void 0 || appName === void 0 || regionKey.length === 0 || orgName.length === 0 || spaceName.length === 0 || appName.length === 0) {
-      throw new Error(`Invalid selector "${raw}": every region/org/space/app segment must be non-empty.`);
-    }
-    return { kind: "explicit", regionKey, orgName, spaceName, appName };
+    return {
+      kind: "appPath",
+      regionKey: regionKey ?? "",
+      orgName: orgName ?? "",
+      spaceName: spaceName ?? "",
+      appName: appName ?? ""
+    };
   }
   throw new Error(`Invalid selector "${raw}": ${SELECTOR_USAGE}.`);
 }
@@ -659,6 +793,7 @@ async function resolveSelector(raw) {
       );
     }
     return {
+      kind: "app",
       raw,
       regionKey: current.regionKey ?? "",
       apiEndpoint: current.apiEndpoint,
@@ -673,7 +808,18 @@ async function resolveSelector(raw) {
       `Unknown region "${parsed.regionKey}". Use a bare app name (requires current CF target) or a known region key.`
     );
   }
+  if (parsed.kind === "spacePath") {
+    return {
+      kind: "space",
+      raw,
+      regionKey: parsed.regionKey,
+      apiEndpoint,
+      orgName: parsed.orgName,
+      spaceName: parsed.spaceName
+    };
+  }
   return {
+    kind: "app",
     raw,
     regionKey: parsed.regionKey,
     apiEndpoint,
@@ -724,10 +870,12 @@ function createCfClient(curl) {
     fetchAuditEvents: (input) => fetchAuditEvents(input, curl),
     fetchApp: (appGuid) => fetchApp(appGuid, curl),
     fetchSshEnabled: (appGuid) => fetchSshEnabled(appGuid, curl),
-    fetchWebProcessStats: (appGuid) => fetchWebProcessStats(appGuid, curl)
+    fetchWebProcessStats: (appGuid) => fetchWebProcessStats(appGuid, curl),
+    resolveOrganizationGuid: (orgName) => resolveOrganizationGuid(orgName, curl),
+    resolveSpaceGuid: (spaceName, orgGuid) => resolveSpaceGuid(spaceName, orgGuid, curl)
   };
 }
-async function defaultWithCfApp(selector, credentials, work) {
+async function defaultWithCfTarget(selector, credentials, work) {
   return await withCfSession(async (ctx) => {
     await prepareCfCliSession(
       {
@@ -738,15 +886,14 @@ async function defaultWithCfApp(selector, credentials, work) {
       },
       ctx
     );
-    const appGuid = await cfAppGuid(selector.appName, ctx);
     const client = createCfClient((path) => cfCurl(path, ctx));
-    return await work({ appGuid, client });
+    return await work({ selector, client, resolveAppGuid: (appName) => cfAppGuid(appName, ctx) });
   });
 }
 function createDefaultDependencies() {
   return {
     resolveSelector,
-    withCfApp: defaultWithCfApp,
+    withCfTarget: defaultWithCfTarget,
     now: () => /* @__PURE__ */ new Date()
   };
 }
@@ -756,6 +903,24 @@ async function delay(ms, signal) {
   } catch {
   }
 }
+function requireAppSelector(selector, command) {
+  if (selector.kind === "app") {
+    return selector;
+  }
+  throw new Error(
+    `The ${command} command requires an app selector. Use region/org/space/app or a bare app name.`
+  );
+}
+async function resolveAuditScope(session) {
+  if (session.selector.kind === "app") {
+    return { kind: "app", appGuid: await session.resolveAppGuid(session.selector.appName) };
+  }
+  const orgGuid = await session.client.resolveOrganizationGuid(session.selector.orgName);
+  return {
+    kind: "space",
+    spaceGuid: await session.client.resolveSpaceGuid(session.selector.spaceName, orgGuid)
+  };
+}
 var CfEventsRuntime = class {
   deps;
   constructor(deps = createDefaultDependencies()) {
@@ -763,9 +928,9 @@ var CfEventsRuntime = class {
   }
   async fetchEvents(raw, credentials, options) {
     const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
-      return await client.fetchAuditEvents({
-        appGuid,
+    return await this.deps.withCfTarget(selector, credentials, async (session) => {
+      return await session.client.fetchAuditEvents({
+        scope: await resolveAuditScope(session),
         types: options.types.length > 0 ? options.types : void 0,
         createdAfter: this.resolveCreatedAfter(options.since),
         limit: options.limit
@@ -773,12 +938,13 @@ var CfEventsRuntime = class {
     });
   }
   async getSshStatus(raw, credentials, since) {
-    const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    const selector = requireAppSelector(await this.deps.resolveSelector(raw), "ssh-status");
+    return await this.deps.withCfTarget(selector, credentials, async ({ client, resolveAppGuid }) => {
+      const appGuid = await resolveAppGuid(selector.appName);
       const [sshEnabled, events] = await Promise.all([
         client.fetchSshEnabled(appGuid),
         client.fetchAuditEvents({
-          appGuid,
+          scope: { kind: "app", appGuid },
           types: [...SSH_EVENT_TYPES],
           createdAfter: durationToCreatedAfter(since, this.deps.now()),
           limit: SSH_STATUS_EVENT_LIMIT
@@ -795,24 +961,28 @@ var CfEventsRuntime = class {
   }
   async getCrashes(raw, credentials, options) {
     const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
-      const events = await client.fetchAuditEvents({
-        appGuid,
+    return await this.deps.withCfTarget(selector, credentials, async (session) => {
+      const events = await session.client.fetchAuditEvents({
+        scope: await resolveAuditScope(session),
         types: [...CRASH_EVENT_TYPES],
         createdAfter: this.resolveCreatedAfter(options.since),
         limit: options.limit
       });
-      return summarizeCrashes(selector.appName, events);
+      if (selector.kind === "app") {
+        return summarizeCrashes(selector.appName, events);
+      }
+      return summarizeSpaceCrashes(`${selector.regionKey}/${selector.orgName}/${selector.spaceName}`, events);
     });
   }
   async getStatus(raw, credentials) {
-    const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    const selector = requireAppSelector(await this.deps.resolveSelector(raw), "status");
+    return await this.deps.withCfTarget(selector, credentials, async ({ client, resolveAppGuid }) => {
+      const appGuid = await resolveAppGuid(selector.appName);
       const [app, instances, sshEnabled, recent] = await Promise.all([
         client.fetchApp(appGuid),
         client.fetchWebProcessStats(appGuid),
         client.fetchSshEnabled(appGuid),
-        client.fetchAuditEvents({ appGuid, types: void 0, createdAfter: void 0, limit: 1 })
+        client.fetchAuditEvents({ scope: { kind: "app", appGuid }, types: void 0, createdAfter: void 0, limit: 1 })
       ]);
       return {
         appName: selector.appName,
@@ -826,12 +996,13 @@ var CfEventsRuntime = class {
   }
   async watchEvents(raw, credentials, options, onEvent, signal) {
     const selector = await this.deps.resolveSelector(raw);
-    await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    await this.deps.withCfTarget(selector, credentials, async (session) => {
+      const scope = await resolveAuditScope(session);
       const seen = /* @__PURE__ */ new Set();
       let cursor = durationToCreatedAfter(options.lookback, this.deps.now());
       while (!signal.aborted) {
-        const events = await client.fetchAuditEvents({
-          appGuid,
+        const events = await session.client.fetchAuditEvents({
+          scope,
           types: options.types.length > 0 ? options.types : void 0,
           createdAfter: cursor,
           limit: WATCH_FETCH_LIMIT
@@ -893,6 +1064,13 @@ function parsePositiveInteger(value, optionName) {
 function appLabel(selector) {
   return (selector.split("/").at(-1) ?? selector).trim();
 }
+function isSpaceSelector(selector) {
+  return parseSelector(selector).kind === "spacePath";
+}
+function spaceLabel(selector) {
+  const parsed = parseSelector(selector);
+  return parsed.kind === "spacePath" ? `${parsed.regionKey}/${parsed.orgName}/${parsed.spaceName}` : selector;
+}
 function resolveSelectorArgument(selector) {
   return selector;
 }
@@ -920,7 +1098,7 @@ async function runEvents(selector, flags) {
     writeJson(events);
     return;
   }
-  writeOut(formatEventsReport(appLabel(resolvedSelector), events, /* @__PURE__ */ new Date()));
+  writeOut(isSpaceSelector(resolvedSelector) ? formatSpaceEventsReport(spaceLabel(resolvedSelector), events, /* @__PURE__ */ new Date()) : formatEventsReport(appLabel(resolvedSelector), events, /* @__PURE__ */ new Date()));
 }
 async function runSshStatus(selector, flags) {
   const resolvedSelector = resolveSelectorArgument(selector);
@@ -959,12 +1137,12 @@ async function runStatus(selector, flags) {
   }
   writeOut(formatStatusReport(health, /* @__PURE__ */ new Date()));
 }
-function emitWatchEvent(event, asJson) {
+function emitWatchEvent(event, asJson, spaceScope) {
   if (asJson) {
     writeJsonLine(event);
     return;
   }
-  writeOut(formatEventLine(event, /* @__PURE__ */ new Date()));
+  writeOut(spaceScope ? formatSpaceEventLine(event, /* @__PURE__ */ new Date()) : formatEventLine(event, /* @__PURE__ */ new Date()));
 }
 async function runWatch(selector, flags) {
   const resolvedSelector = resolveSelectorArgument(selector);
@@ -978,6 +1156,7 @@ async function runWatch(selector, flags) {
     controller.abort();
   });
   const asJson = flags.json === true;
+  const spaceScope = isSpaceSelector(resolvedSelector);
   try {
     process2.stderr.write(`Watching ${resolvedSelector} for new audit events. Press Ctrl+C to stop.
 `);
@@ -990,7 +1169,7 @@ async function runWatch(selector, flags) {
         types: parseTypeFilter(flags.type)
       },
       (event) => {
-        emitWatchEvent(event, asJson);
+        emitWatchEvent(event, asJson, spaceScope);
       },
       controller.signal
     );
@@ -1036,7 +1215,7 @@ function buildProgram() {
   const program = new Command();
   program.name("cf-events").description("Inspect SAP BTP Cloud Foundry application audit events and SSH/debug sessions").version(readPackageVersion(), "-V, --version", "Print the cf-events package version");
   addCommonOptions(
-    program.command("events").description("List recent audit events for an app").argument("<selector>", "region/org/space/app or a bare app name")
+    program.command("events").description("List recent audit events for an app or all apps in a space").argument("<selector>", "region/org/space, region/org/space/app, or a bare app name")
   ).option(
     "--limit <count>",
     "Maximum number of events to return",
@@ -1050,7 +1229,7 @@ function buildProgram() {
     await runSshStatus(selector, flags);
   });
   addCommonOptions(
-    program.command("crashes").description("Summarize recent crash events for an app").argument("<selector>", "region/org/space/app or a bare app name")
+    program.command("crashes").description("Summarize recent crash events for an app or all apps in a space").argument("<selector>", "region/org/space, region/org/space/app, or a bare app name")
   ).option(
     "--limit <count>",
     "Maximum number of crash events to inspect",
@@ -1064,7 +1243,7 @@ function buildProgram() {
     await runStatus(selector, flags);
   });
   addCommonOptions(
-    program.command("watch").description("Poll for new audit events and print them as they appear").argument("<selector>", "region/org/space/app or a bare app name")
+    program.command("watch").description("Poll for new audit events for an app or all apps in a space").argument("<selector>", "region/org/space, region/org/space/app, or a bare app name")
   ).option(
     "--interval <ms>",
     "Polling interval in milliseconds",