@saptools/cf-events 0.1.4 → 0.2.1

package/dist/index.d.ts

@@ -10,8 +10,9 @@ interface CfCredentials {
     readonly email: string;
     readonly password: string;
 }
-/** A fully resolved `region/org/space/app` target. */
-interface ResolvedSelector {
+/** A fully resolved application target. */
+interface ResolvedAppSelector {
+    readonly kind: "app";
     readonly raw: string;
     readonly regionKey: RegionKey;
     readonly apiEndpoint: string;
@@ -19,6 +20,16 @@ interface ResolvedSelector {
     readonly spaceName: string;
     readonly appName: string;
 }
+/** A fully resolved space target for space-wide audit-event queries. */
+interface ResolvedSpaceSelector {
+    readonly kind: "space";
+    readonly raw: string;
+    readonly regionKey: RegionKey;
+    readonly apiEndpoint: string;
+    readonly orgName: string;
+    readonly spaceName: string;
+}
+type ResolvedSelector = ResolvedAppSelector | ResolvedSpaceSelector;
 interface CfSessionInput {
     readonly apiEndpoint: string;
     readonly orgName: string;
@@ -104,8 +115,30 @@ interface AppHealth {
     readonly instances: readonly ProcessInstanceStat[];
     readonly lastEvent: AuditEvent | undefined;
 }
-interface FetchAuditEventsInput {
+interface AppCrashSummary {
+    readonly appName: string;
+    readonly crashCount: number;
+    readonly lastCrashAt: string | undefined;
+    readonly lastCrashReason: string | undefined;
+    readonly crashes: readonly CrashRecord[];
+}
+interface SpaceCrashSummary {
+    readonly scope: "space";
+    readonly selector: string;
+    readonly crashCount: number;
+    readonly lastCrashAt: string | undefined;
+    readonly apps: readonly AppCrashSummary[];
+}
+type CrashReportSummary = CrashSummary | SpaceCrashSummary;
+type AuditEventScope = {
+    readonly kind: "app";
     readonly appGuid: string;
+} | {
+    readonly kind: "space";
+    readonly spaceGuid: string;
+};
+interface FetchAuditEventsInput {
+    readonly scope: AuditEventScope;
     readonly types: readonly string[] | undefined;
     readonly createdAfter: string | undefined;
     readonly limit: number;
@@ -113,8 +146,11 @@ interface FetchAuditEventsInput {
 
 /** Calls a Cloud Foundry v3 API path and returns the raw response body. */
 type CurlFn = (path: string) => Promise<string>;
+declare function mapAuditEvent(value: unknown): AuditEvent;
 declare function buildAuditEventsPath(input: FetchAuditEventsInput, perPage: number): string;
-/** Fetches audit events for an app, following pagination up to `input.limit`. */
+declare function resolveOrganizationGuid(orgName: string, curl: CurlFn): Promise<string>;
+declare function resolveSpaceGuid(spaceName: string, orgGuid: string, curl: CurlFn): Promise<string>;
+/** Fetches audit events for an app or space, following pagination up to `input.limit`. */
 declare function fetchAuditEvents(input: FetchAuditEventsInput, curl: CurlFn): Promise<readonly AuditEvent[]>;
 declare function fetchApp(appGuid: string, curl: CurlFn): Promise<AppSummary>;
 declare function fetchSshEnabled(appGuid: string, curl: CurlFn): Promise<SshEnabled>;
@@ -149,7 +185,7 @@ declare function filterByTypes(events: readonly AuditEvent[], types: readonly st
 declare function sortEventsNewestFirst(events: readonly AuditEvent[]): readonly AuditEvent[];
 /** Parses a human duration such as `30m`, `6h`, or `7d` into milliseconds. */
 declare function parseDuration(raw: string): number;
-/** Converts a duration into an ISO timestamp suitable for `created_ats[gt]`. */
+/** Converts a duration into a CF audit timestamp suitable for `created_ats[gt]`. */
 declare function durationToCreatedAfter(raw: string, now: Date): string;
 /**
  * Parses a comma-separated `--type` filter. Accepts the shorthands `ssh` and
@@ -158,6 +194,7 @@ declare function durationToCreatedAfter(raw: string, now: Date): string;
 declare function parseTypeFilter(raw: string | undefined): readonly string[];
 declare function toCrashRecord(event: AuditEvent): CrashRecord;
 declare function summarizeCrashes(appName: string, events: readonly AuditEvent[]): CrashSummary;
+declare function summarizeSpaceCrashes(selector: string, events: readonly AuditEvent[]): SpaceCrashSummary;
 
 declare function describeEventType(type: string): string;
 declare function formatUptime(seconds: number | undefined): string;
@@ -166,8 +203,10 @@ declare function formatCpu(cpu: number | undefined): string;
 declare function formatRelativeTime(timestamp: string, now: Date): string;
 declare function formatEventLine(event: AuditEvent, now: Date): string;
 declare function formatEventsReport(appName: string, events: readonly AuditEvent[], now: Date): string;
+declare function formatSpaceEventLine(event: AuditEvent, now: Date): string;
+declare function formatSpaceEventsReport(selector: string, events: readonly AuditEvent[], now: Date): string;
 declare function formatSshStatusReport(status: SshStatus, now: Date): string;
-declare function formatCrashReport(summary: CrashSummary, now: Date): string;
+declare function formatCrashReport(summary: CrashReportSummary, now: Date): string;
 declare function formatStatusReport(health: AppHealth, now: Date): string;
 
 /** Typed accessor for the Cloud Foundry v3 API used by the runtime. */
@@ -176,15 +215,18 @@ interface CfClient {
     readonly fetchApp: (appGuid: string) => Promise<AppSummary>;
     readonly fetchSshEnabled: (appGuid: string) => Promise<SshEnabled>;
     readonly fetchWebProcessStats: (appGuid: string) => Promise<readonly ProcessInstanceStat[]>;
+    readonly resolveOrganizationGuid: (orgName: string) => Promise<string>;
+    readonly resolveSpaceGuid: (spaceName: string, orgGuid: string) => Promise<string>;
 }
-interface CfAppSession {
-    readonly appGuid: string;
+interface CfTargetSession {
+    readonly selector: ResolvedSelector;
     readonly client: CfClient;
+    readonly resolveAppGuid: (appName: string) => Promise<string>;
 }
 /** Injection seam so the orchestration can be unit-tested without a real CF. */
 interface CfEventsDependencies {
     readonly resolveSelector: (raw: string) => Promise<ResolvedSelector>;
-    readonly withCfApp: <T>(selector: ResolvedSelector, credentials: CfCredentials, work: (session: CfAppSession) => Promise<T>) => Promise<T>;
+    readonly withCfTarget: <T>(selector: ResolvedSelector, credentials: CfCredentials, work: (session: CfTargetSession) => Promise<T>) => Promise<T>;
     readonly now: () => Date;
 }
 interface EventQueryOptions {
@@ -208,7 +250,7 @@ declare class CfEventsRuntime {
     constructor(deps?: CfEventsDependencies);
     fetchEvents(raw: string, credentials: CfCredentials, options: EventQueryOptions): Promise<readonly AuditEvent[]>;
     getSshStatus(raw: string, credentials: CfCredentials, since: string): Promise<SshStatus>;
-    getCrashes(raw: string, credentials: CfCredentials, options: CrashQueryOptions): Promise<CrashSummary>;
+    getCrashes(raw: string, credentials: CfCredentials, options: CrashQueryOptions): Promise<CrashReportSummary>;
     getStatus(raw: string, credentials: CfCredentials): Promise<AppHealth>;
     watchEvents(raw: string, credentials: CfCredentials, options: WatchOptions, onEvent: (event: AuditEvent) => void, signal: AbortSignal): Promise<void>;
     private resolveCreatedAfter;
@@ -218,20 +260,26 @@ interface ParsedAppName {
     readonly kind: "appName";
     readonly appName: string;
 }
-interface ParsedExplicit {
-    readonly kind: "explicit";
+interface ParsedAppPath {
+    readonly kind: "appPath";
     readonly regionKey: string;
     readonly orgName: string;
     readonly spaceName: string;
     readonly appName: string;
 }
-type ParsedSelector = ParsedAppName | ParsedExplicit;
+interface ParsedSpacePath {
+    readonly kind: "spacePath";
+    readonly regionKey: string;
+    readonly orgName: string;
+    readonly spaceName: string;
+}
+type ParsedSelector = ParsedAppName | ParsedAppPath | ParsedSpacePath;
 /** Parses a raw selector string into its structural parts without any I/O. */
 declare function parseSelector(raw: string): ParsedSelector;
 /**
  * Resolves a raw selector.
  * - Bare app name: based strictly on the CURRENT CF target (no global search).
- * - Full path: uses known region-to-api mapping; trusts the provided org/space/app (no snapshot validation).
+ * - Explicit paths: use known region-to-api mapping; trust the provided org/space/app.
  */
 declare function resolveSelector(raw: string): Promise<ResolvedSelector>;
 
@@ -246,4 +294,4 @@ interface SshStatusInput {
 }
 declare function buildSshStatus(input: SshStatusInput): SshStatus;
 
-export { APP_EVENT_TYPES, type AppEventType, type AppHealth, type AppSummary, type AuditEvent, CRASH_EVENT_TYPES, type CfAppSession, type CfCliContext, type CfClient, type CfCredentials, type CfEntityRef, type CfEventsDependencies, CfEventsRuntime, type CfSessionInput, type CrashQueryOptions, type CrashRecord, type CrashSummary, type CurlFn, type CurrentCfTarget, type EventQueryOptions, type FetchAuditEventsInput, type ParsedAppName, type ParsedExplicit, type ParsedSelector, type ProcessInstanceStat, type RegionKey, type ResolvedSelector, SSH_EVENT_TYPES, type SshEnabled, type SshSession, type SshStatus, type SshStatusInput, type WatchOptions, buildAuditEventsPath, buildSshStatus, cfAppGuid, cfCurl, createDefaultDependencies, describeEventType, durationToCreatedAfter, fetchApp, fetchAuditEvents, fetchSshEnabled, fetchWebProcessStats, filterByTypes, formatBytes, formatCpu, formatCrashReport, formatEventLine, formatEventsReport, formatRelativeTime, formatSshStatusReport, formatStatusReport, formatUptime, getApiEndpointForRegion, getRegionKeyForApi, inferSshSessions, isCrashEvent, isSshEvent, parseCfTargetOutput, parseDuration, parseSelector, parseTypeFilter, prepareCfCliSession, readCurrentCfTarget, resolveSelector, runCfCommand, sortEventsNewestFirst, summarizeCrashes, toCrashRecord, withCfSession };
+export { APP_EVENT_TYPES, type AppCrashSummary, type AppEventType, type AppHealth, type AppSummary, type AuditEvent, type AuditEventScope, CRASH_EVENT_TYPES, type CfCliContext, type CfClient, type CfCredentials, type CfEntityRef, type CfEventsDependencies, CfEventsRuntime, type CfSessionInput, type CfTargetSession, type CrashQueryOptions, type CrashRecord, type CrashReportSummary, type CrashSummary, type CurlFn, type CurrentCfTarget, type EventQueryOptions, type FetchAuditEventsInput, type ParsedAppName, type ParsedAppPath, type ParsedSelector, type ParsedSpacePath, type ProcessInstanceStat, type RegionKey, type ResolvedAppSelector, type ResolvedSelector, type ResolvedSpaceSelector, SSH_EVENT_TYPES, type SpaceCrashSummary, type SshEnabled, type SshSession, type SshStatus, type SshStatusInput, type WatchOptions, buildAuditEventsPath, buildSshStatus, cfAppGuid, cfCurl, createDefaultDependencies, describeEventType, durationToCreatedAfter, fetchApp, fetchAuditEvents, fetchSshEnabled, fetchWebProcessStats, filterByTypes, formatBytes, formatCpu, formatCrashReport, formatEventLine, formatEventsReport, formatRelativeTime, formatSpaceEventLine, formatSpaceEventsReport, formatSshStatusReport, formatStatusReport, formatUptime, getApiEndpointForRegion, getRegionKeyForApi, inferSshSessions, isCrashEvent, isSshEvent, mapAuditEvent, parseCfTargetOutput, parseDuration, parseSelector, parseTypeFilter, prepareCfCliSession, readCurrentCfTarget, resolveOrganizationGuid, resolveSelector, resolveSpaceGuid, runCfCommand, sortEventsNewestFirst, summarizeCrashes, summarizeSpaceCrashes, toCrashRecord, withCfSession };

package/dist/index.js

@@ -18,6 +18,12 @@ function asRecord(value) {
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
+function requireArray(value, message) {
+  if (!Array.isArray(value)) {
+    throw new Error(message);
+  }
+  return value;
+}
 function asString(value) {
   return typeof value === "string" ? value : "";
 }
@@ -67,7 +73,7 @@ function mapProcessStat(value) {
 }
 function buildAuditEventsPath(input, perPage) {
   const params = new URLSearchParams();
-  params.set("target_guids", input.appGuid);
+  applyAuditEventScope(params, input.scope);
   params.set("order_by", "-created_at");
   params.set("per_page", perPage.toString());
   if (input.types !== void 0 && input.types.length > 0) {
@@ -78,6 +84,60 @@ function buildAuditEventsPath(input, perPage) {
   }
   return `/v3/audit_events?${params.toString()}`;
 }
+function applyAuditEventScope(params, scope) {
+  if (scope.kind === "app") {
+    params.set("target_guids", scope.appGuid);
+    return;
+  }
+  params.set("space_guids", scope.spaceGuid);
+}
+async function resolveOrganizationGuid(orgName, curl) {
+  const params = new URLSearchParams();
+  params.set("names", orgName);
+  const body = asRecord(parseJson(await curl(`/v3/organizations?${params.toString()}`)));
+  const first = asRecord(asArray(body["resources"])[0]);
+  const guid = asString(first["guid"]);
+  if (guid.length === 0) {
+    throw new Error(`Could not resolve the GUID for organization "${orgName}".`);
+  }
+  return guid;
+}
+async function resolveSpaceGuid(spaceName, orgGuid, curl) {
+  const params = new URLSearchParams();
+  params.set("names", spaceName);
+  params.set("organization_guids", orgGuid);
+  const body = asRecord(parseJson(await curl(`/v3/spaces?${params.toString()}`)));
+  const first = asRecord(asArray(body["resources"])[0]);
+  const guid = asString(first["guid"]);
+  if (guid.length === 0) {
+    throw new Error(`Could not resolve the GUID for space "${spaceName}".`);
+  }
+  return guid;
+}
+function formatCfApiError(error) {
+  const record = asRecord(error);
+  const title = asString(record["title"]);
+  const detail = asString(record["detail"]);
+  if (title.length > 0 && detail.length > 0) {
+    return `${title}: ${detail}`;
+  }
+  if (title.length > 0) {
+    return title;
+  }
+  if (detail.length > 0) {
+    return detail;
+  }
+  const code = asNumber(record["code"]);
+  return code === void 0 ? "unknown CF API error" : `code ${code.toString()}`;
+}
+function throwIfCfApiErrors(body) {
+  const errors = asRecord(body)["errors"];
+  if (errors === void 0) {
+    return;
+  }
+  const details = requireArray(errors, "The CF API returned an invalid errors response.").map(formatCfApiError).filter((detail) => detail.length > 0);
+  throw new Error(`CF API error ${details.length > 0 ? details.join("; ") : "unknown CF API error"}`);
+}
 function nextPagePath(body) {
   const next = asRecord(asRecord(asRecord(body)["pagination"])["next"]);
   const href = next["href"];
@@ -98,7 +158,11 @@ async function fetchAuditEvents(input, curl) {
   let path = buildAuditEventsPath(input, perPage);
   while (path !== void 0 && events.length < limit) {
     const body = parseJson(await curl(path));
-    for (const resource of asArray(asRecord(body)["resources"])) {
+    throwIfCfApiErrors(body);
+    for (const resource of requireArray(
+      asRecord(body)["resources"],
+      "The CF API returned an invalid audit events response: missing resources array."
+    )) {
       events.push(mapAuditEvent(resource));
       if (events.length >= limit) {
         break;
@@ -426,8 +490,11 @@ function parseDuration(raw) {
   }
   return amount * unitMs;
 }
+function toCfAuditTimestamp(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
 function durationToCreatedAfter(raw, now) {
-  return new Date(now.getTime() - parseDuration(raw)).toISOString();
+  return toCfAuditTimestamp(new Date(now.getTime() - parseDuration(raw)));
 }
 function parseTypeFilter(raw) {
   if (raw === void 0) {
@@ -475,6 +542,39 @@ function summarizeCrashes(appName, events) {
     crashes
   };
 }
+function crashAppName(event) {
+  if (event.target.name.length > 0) {
+    return event.target.name;
+  }
+  if (event.target.guid.length > 0) {
+    return event.target.guid;
+  }
+  return "(unknown app)";
+}
+function summarizeSpaceCrashes(selector, events) {
+  const byApp = /* @__PURE__ */ new Map();
+  for (const event of events.filter(isCrashEvent)) {
+    const appName = crashAppName(event);
+    byApp.set(appName, [...byApp.get(appName) ?? [], event]);
+  }
+  const apps = [...byApp.entries()].map(([appName, appEvents]) => summarizeCrashes(appName, appEvents)).map(({ appName, crashCount, lastCrashAt, lastCrashReason, crashes }) => ({
+    appName,
+    crashCount,
+    lastCrashAt,
+    lastCrashReason,
+    crashes
+  })).sort((left, right) => {
+    const byTime = (right.lastCrashAt ?? "").localeCompare(left.lastCrashAt ?? "");
+    return byTime === 0 ? left.appName.localeCompare(right.appName) : byTime;
+  });
+  return {
+    scope: "space",
+    selector,
+    crashCount: apps.reduce((sum, app) => sum + app.crashCount, 0),
+    lastCrashAt: apps[0]?.lastCrashAt,
+    apps
+  };
+}
 
 // src/format.ts
 var EVENT_LABELS = {
@@ -575,6 +675,34 @@ function formatEventsReport(appName, events, now) {
     ...events.map((event) => formatEventLine(event, now))
   ].join("\n");
 }
+function eventTargetLabel(event) {
+  if (event.target.name.length > 0) {
+    return event.target.name;
+  }
+  if (event.target.type.length > 0) {
+    return event.target.type;
+  }
+  return event.target.guid.length > 0 ? event.target.guid : "(unknown target)";
+}
+function formatSpaceEventLine(event, now) {
+  const actor = event.actor.name.length > 0 ? event.actor.name : event.actor.type;
+  return [
+    `  ${event.createdAt.padEnd(26)}`,
+    formatRelativeTime(event.createdAt, now).padEnd(11),
+    describeEventType(event.type).padEnd(24),
+    eventTargetLabel(event).padEnd(18),
+    actor.length > 0 ? actor : "(unknown actor)"
+  ].join("  ");
+}
+function formatSpaceEventsReport(selector, events, now) {
+  if (events.length === 0) {
+    return `No audit events found for space ${selector}.`;
+  }
+  return [
+    `Audit events for space ${selector} (${events.length.toString()}):`,
+    ...events.map((event) => formatSpaceEventLine(event, now))
+  ].join("\n");
+}
 function formatSshStatusReport(status, now) {
   const sessionLines = status.sessions.map((session) => {
     const tag = session.likelyActive ? "[active]" : "[past]  ";
@@ -599,7 +727,7 @@ function formatSshStatusReport(status, now) {
     "  are inferred from recent ssh-authorized audit events."
   ].join("\n");
 }
-function formatCrashReport(summary, now) {
+function formatAppCrashReport(summary, now) {
   if (summary.crashCount === 0) {
     return `No crashes found for ${summary.appName}.`;
   }
@@ -620,6 +748,35 @@ function formatCrashReport(summary, now) {
     ...crashLines
   ].join("\n");
 }
+function formatSpaceCrashReport(summary, now) {
+  if (summary.crashCount === 0) {
+    return `No crashes found for space ${summary.selector}.`;
+  }
+  const appLines = summary.apps.flatMap((app) => [
+    `  ${app.appName} (${app.crashCount.toString()})`,
+    ...app.crashes.map((crash) => {
+      const index = crash.index === void 0 ? "-" : `#${crash.index.toString()}`;
+      const reason = crash.reason ?? "unknown";
+      const exit = crash.exitStatus === void 0 ? "" : `  exit ${crash.exitStatus.toString()}`;
+      return `    ${crash.at}  instance ${index}  ${reason}${exit}`;
+    })
+  ]);
+  return [
+    `Crash report for space ${summary.selector}`,
+    "",
+    `  Crashes: ${summary.crashCount.toString()}`,
+    `  Apps affected: ${summary.apps.length.toString()}`,
+    ...summary.lastCrashAt === void 0 ? [] : [`  Last crash: ${summary.lastCrashAt} (${formatRelativeTime(summary.lastCrashAt, now)})`],
+    "",
+    ...appLines
+  ].join("\n");
+}
+function formatCrashReport(summary, now) {
+  if ("scope" in summary) {
+    return formatSpaceCrashReport(summary, now);
+  }
+  return formatAppCrashReport(summary, now);
+}
 function formatInstanceLine(instance) {
   return [
     `  #${instance.index.toString()}`.padEnd(6),
@@ -648,7 +805,12 @@ function formatStatusReport(health, now) {
 import { setTimeout as delayPromise } from "timers/promises";
 
 // src/selector.ts
-var SELECTOR_USAGE = 'use "region/org/space/app" or a bare app name';
+var SELECTOR_USAGE = 'use "region/org/space", "region/org/space/app", or a bare app name';
+function assertNonEmpty(raw, parts, shape) {
+  if (parts.some((part) => part.length === 0)) {
+    throw new Error(`Invalid selector "${raw}": every ${shape} segment must be non-empty.`);
+  }
+}
 function parseSelector(raw) {
   const trimmed = raw.trim();
   if (trimmed.length === 0) {
@@ -662,12 +824,21 @@ function parseSelector(raw) {
     }
     return { kind: "appName", appName };
   }
+  if (parts.length === 3) {
+    assertNonEmpty(raw, parts, "region/org/space");
+    const [regionKey, orgName, spaceName] = parts;
+    return { kind: "spacePath", regionKey: regionKey ?? "", orgName: orgName ?? "", spaceName: spaceName ?? "" };
+  }
   if (parts.length === 4) {
+    assertNonEmpty(raw, parts, "region/org/space/app");
     const [regionKey, orgName, spaceName, appName] = parts;
-    if (regionKey === void 0 || orgName === void 0 || spaceName === void 0 || appName === void 0 || regionKey.length === 0 || orgName.length === 0 || spaceName.length === 0 || appName.length === 0) {
-      throw new Error(`Invalid selector "${raw}": every region/org/space/app segment must be non-empty.`);
-    }
-    return { kind: "explicit", regionKey, orgName, spaceName, appName };
+    return {
+      kind: "appPath",
+      regionKey: regionKey ?? "",
+      orgName: orgName ?? "",
+      spaceName: spaceName ?? "",
+      appName: appName ?? ""
+    };
   }
   throw new Error(`Invalid selector "${raw}": ${SELECTOR_USAGE}.`);
 }
@@ -681,6 +852,7 @@ async function resolveSelector(raw) {
       );
     }
     return {
+      kind: "app",
       raw,
       regionKey: current.regionKey ?? "",
       apiEndpoint: current.apiEndpoint,
@@ -695,7 +867,18 @@ async function resolveSelector(raw) {
       `Unknown region "${parsed.regionKey}". Use a bare app name (requires current CF target) or a known region key.`
     );
   }
+  if (parsed.kind === "spacePath") {
+    return {
+      kind: "space",
+      raw,
+      regionKey: parsed.regionKey,
+      apiEndpoint,
+      orgName: parsed.orgName,
+      spaceName: parsed.spaceName
+    };
+  }
   return {
+    kind: "app",
     raw,
     regionKey: parsed.regionKey,
     apiEndpoint,
@@ -746,10 +929,12 @@ function createCfClient(curl) {
     fetchAuditEvents: (input) => fetchAuditEvents(input, curl),
     fetchApp: (appGuid) => fetchApp(appGuid, curl),
     fetchSshEnabled: (appGuid) => fetchSshEnabled(appGuid, curl),
-    fetchWebProcessStats: (appGuid) => fetchWebProcessStats(appGuid, curl)
+    fetchWebProcessStats: (appGuid) => fetchWebProcessStats(appGuid, curl),
+    resolveOrganizationGuid: (orgName) => resolveOrganizationGuid(orgName, curl),
+    resolveSpaceGuid: (spaceName, orgGuid) => resolveSpaceGuid(spaceName, orgGuid, curl)
   };
 }
-async function defaultWithCfApp(selector, credentials, work) {
+async function defaultWithCfTarget(selector, credentials, work) {
   return await withCfSession(async (ctx) => {
     await prepareCfCliSession(
       {
@@ -760,15 +945,14 @@ async function defaultWithCfApp(selector, credentials, work) {
       },
       ctx
     );
-    const appGuid = await cfAppGuid(selector.appName, ctx);
     const client = createCfClient((path) => cfCurl(path, ctx));
-    return await work({ appGuid, client });
+    return await work({ selector, client, resolveAppGuid: (appName) => cfAppGuid(appName, ctx) });
   });
 }
 function createDefaultDependencies() {
   return {
     resolveSelector,
-    withCfApp: defaultWithCfApp,
+    withCfTarget: defaultWithCfTarget,
     now: () => /* @__PURE__ */ new Date()
   };
 }
@@ -778,6 +962,24 @@ async function delay(ms, signal) {
   } catch {
   }
 }
+function requireAppSelector(selector, command) {
+  if (selector.kind === "app") {
+    return selector;
+  }
+  throw new Error(
+    `The ${command} command requires an app selector. Use region/org/space/app or a bare app name.`
+  );
+}
+async function resolveAuditScope(session) {
+  if (session.selector.kind === "app") {
+    return { kind: "app", appGuid: await session.resolveAppGuid(session.selector.appName) };
+  }
+  const orgGuid = await session.client.resolveOrganizationGuid(session.selector.orgName);
+  return {
+    kind: "space",
+    spaceGuid: await session.client.resolveSpaceGuid(session.selector.spaceName, orgGuid)
+  };
+}
 var CfEventsRuntime = class {
   deps;
   constructor(deps = createDefaultDependencies()) {
@@ -785,9 +987,9 @@ var CfEventsRuntime = class {
   }
   async fetchEvents(raw, credentials, options) {
     const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
-      return await client.fetchAuditEvents({
-        appGuid,
+    return await this.deps.withCfTarget(selector, credentials, async (session) => {
+      return await session.client.fetchAuditEvents({
+        scope: await resolveAuditScope(session),
         types: options.types.length > 0 ? options.types : void 0,
         createdAfter: this.resolveCreatedAfter(options.since),
         limit: options.limit
@@ -795,12 +997,13 @@ var CfEventsRuntime = class {
     });
   }
   async getSshStatus(raw, credentials, since) {
-    const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    const selector = requireAppSelector(await this.deps.resolveSelector(raw), "ssh-status");
+    return await this.deps.withCfTarget(selector, credentials, async ({ client, resolveAppGuid }) => {
+      const appGuid = await resolveAppGuid(selector.appName);
       const [sshEnabled, events] = await Promise.all([
         client.fetchSshEnabled(appGuid),
         client.fetchAuditEvents({
-          appGuid,
+          scope: { kind: "app", appGuid },
           types: [...SSH_EVENT_TYPES],
           createdAfter: durationToCreatedAfter(since, this.deps.now()),
           limit: SSH_STATUS_EVENT_LIMIT
@@ -817,24 +1020,28 @@ var CfEventsRuntime = class {
   }
   async getCrashes(raw, credentials, options) {
     const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
-      const events = await client.fetchAuditEvents({
-        appGuid,
+    return await this.deps.withCfTarget(selector, credentials, async (session) => {
+      const events = await session.client.fetchAuditEvents({
+        scope: await resolveAuditScope(session),
         types: [...CRASH_EVENT_TYPES],
         createdAfter: this.resolveCreatedAfter(options.since),
         limit: options.limit
       });
-      return summarizeCrashes(selector.appName, events);
+      if (selector.kind === "app") {
+        return summarizeCrashes(selector.appName, events);
+      }
+      return summarizeSpaceCrashes(`${selector.regionKey}/${selector.orgName}/${selector.spaceName}`, events);
     });
   }
   async getStatus(raw, credentials) {
-    const selector = await this.deps.resolveSelector(raw);
-    return await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    const selector = requireAppSelector(await this.deps.resolveSelector(raw), "status");
+    return await this.deps.withCfTarget(selector, credentials, async ({ client, resolveAppGuid }) => {
+      const appGuid = await resolveAppGuid(selector.appName);
       const [app, instances, sshEnabled, recent] = await Promise.all([
         client.fetchApp(appGuid),
         client.fetchWebProcessStats(appGuid),
         client.fetchSshEnabled(appGuid),
-        client.fetchAuditEvents({ appGuid, types: void 0, createdAfter: void 0, limit: 1 })
+        client.fetchAuditEvents({ scope: { kind: "app", appGuid }, types: void 0, createdAfter: void 0, limit: 1 })
       ]);
       return {
         appName: selector.appName,
@@ -848,12 +1055,13 @@ var CfEventsRuntime = class {
   }
   async watchEvents(raw, credentials, options, onEvent, signal) {
     const selector = await this.deps.resolveSelector(raw);
-    await this.deps.withCfApp(selector, credentials, async ({ appGuid, client }) => {
+    await this.deps.withCfTarget(selector, credentials, async (session) => {
+      const scope = await resolveAuditScope(session);
       const seen = /* @__PURE__ */ new Set();
       let cursor = durationToCreatedAfter(options.lookback, this.deps.now());
       while (!signal.aborted) {
-        const events = await client.fetchAuditEvents({
-          appGuid,
+        const events = await session.client.fetchAuditEvents({
+          scope,
           types: options.types.length > 0 ? options.types : void 0,
           createdAfter: cursor,
           limit: WATCH_FETCH_LIMIT
@@ -903,6 +1111,8 @@ export {
   formatEventLine,
   formatEventsReport,
   formatRelativeTime,
+  formatSpaceEventLine,
+  formatSpaceEventsReport,
   formatSshStatusReport,
   formatStatusReport,
   formatUptime,
@@ -911,16 +1121,20 @@ export {
   inferSshSessions,
   isCrashEvent,
   isSshEvent,
+  mapAuditEvent,
   parseCfTargetOutput,
   parseDuration,
   parseSelector,
   parseTypeFilter,
   prepareCfCliSession,
   readCurrentCfTarget,
+  resolveOrganizationGuid,
   resolveSelector,
+  resolveSpaceGuid,
   runCfCommand,
   sortEventsNewestFirst,
   summarizeCrashes,
+  summarizeSpaceCrashes,
   toCrashRecord,
   withCfSession
 };