@soat/cli 0.15.14 → 0.16.1

package/dist/index.mjs

@@ -13,7 +13,7 @@ import { load } from "js-yaml";
 import * as os from "node:os";
 
 //#region package.json
-var version = "0.15.14";
+var version = "0.16.1";
 
 //#endregion
 //#region src/cli-wrappers/wrappers/formations.ts
@@ -1528,6 +1528,46 @@ var routes = {
       "in": "query"
     }]
   },
+  "list-approval-recurrences": {
+    serviceClass: "Approvals",
+    operationId: "listApprovalRecurrences",
+    description: "Read-only rollup answering \"what keeps coming back?\" — groups items by `dedup_key` and returns those recurring at least `min_count` times, most-recurrent first. Each group carries the ordered item chain (via `previous_item_id`) and the resolution reasons in order, so a human can read recurring rejections side by side and graduate the pattern into a guardrail `deny`. Exact-key grouping only; no cluster state is stored.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/approvals",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "status", "min_count", "limit", "offset"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "status",
+      "description": "Lifecycle status the groups are built from (default `rejected`)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "min_count",
+      "description": "Minimum items in a group for it to be returned",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "limit",
+      "description": "Maximum number of groups to return",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "offset",
+      "description": "Number of groups to skip",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }]
+  },
   "get-approval": {
     serviceClass: "Approvals",
     operationId: "getApproval",
@@ -1595,7 +1635,7 @@ var routes = {
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/audit-log",
     httpMethod: "get",
     pathParams: [],
-    queryParams: ["project_id", "action", "actor_id", "resource_public_id", "resource_srn", "from", "to", "limit", "offset"],
+    queryParams: ["project_id", "action", "principal_id", "resource_public_id", "resource_srn", "from", "to", "limit", "offset"],
     flags: [{
       "name": "project_id",
       "description": "Project ID (scopes results; required if not using project key auth for a specific project)",
@@ -1609,7 +1649,7 @@ var routes = {
       "type": "string",
       "in": "query"
     }, {
-      "name": "actor_id",
+      "name": "principal_id",
       "description": "Public id of the principal (`user_…` or `key_…`)",
       "required": false,
       "type": "string",
@@ -1652,6 +1692,58 @@ var routes = {
       "in": "query"
     }]
   },
+  "export-audit-entries": {
+    serviceClass: "AuditLog",
+    operationId: "exportAuditEntries",
+    description: "Streams a project's audit-log entries as newline-delimited JSON — one entry object per line, oldest first — for archival before the retention window expires, or for shipping into an external system. `project_id` is required: the export is per-project by design. Filters behave exactly as they do on the list endpoint.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/audit-log",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "action", "principal_id", "resource_public_id", "resource_srn", "from", "to"],
+    flags: [{
+      "name": "project_id",
+      "description": "Project whose entries are exported",
+      "required": true,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "action",
+      "description": "Exact permission-action string, e.g. `secrets:DeleteSecret`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "principal_id",
+      "description": "Public id of the principal (`user_…` or `key_…`)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "resource_public_id",
+      "description": "Exact target resource public id, e.g. `sec_…`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "resource_srn",
+      "description": "SRN prefix match, e.g. `soat:{project}:secret:`",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "from",
+      "description": "Only entries created at or after this timestamp (ISO 8601)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "to",
+      "description": "Only entries created at or before this timestamp (ISO 8601)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }]
+  },
   "get-audit-entry": {
     serviceClass: "AuditLog",
     operationId: "getAuditEntry",
@@ -4831,7 +4923,7 @@ var routes = {
   "update-project": {
     serviceClass: "Projects",
     operationId: "updateProject",
-    description: "Updates a project's name and/or its attached guardrails (`guardrail_ids` — the project-scope baseline governing every tool call by every agent in the project). Requires admin role. Detaching a guardrail (removing an id) additionally requires guardrails:DetachGuardrail.",
+    description: "Updates a project's name, its attached guardrails (`guardrail_ids` — the project-scope baseline governing every tool call by every agent in the project), its orchestration concurrency limit (`max_concurrent_runs`), and/or its read-auditing opt-in (`audit_reads_enabled`). At least one field is required. Requires admin role. Detaching a guardrail (removing an id) additionally requires guardrails:DetachGuardrail.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/projects",
     httpMethod: "patch",
     pathParams: ["project_id"],
@@ -4860,6 +4952,12 @@ var routes = {
       "required": false,
       "type": "integer",
       "in": "body"
+    }, {
+      "name": "audit_reads_enabled",
+      "description": "Opt the project into read auditing. When true, `GET` requests that name this project are recorded in the audit log alongside mutations. Defaults to `false`.",
+      "required": false,
+      "type": "boolean",
+      "in": "body"
     }]
   },
   "delete-project": {
@@ -4996,7 +5094,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "mode",
-      "description": "enforce blocks with 429 (requests at the middleware, tokens/cost_usd at the pre-generation check); monitor is a pass-through no-op until the webhook phase ships.",
+      "description": "enforce blocks with 429 (requests at the middleware, tokens/cost_usd at the pre-generation check); monitor observes without blocking — a breach fires the quota.exceeded webhook and writes a quotas:MonitorBreach audit entry, but the request is let through.",
       "required": false,
       "type": "string",
       "in": "body"
@@ -7153,6 +7251,22 @@ var kebabToSnake = s => {
 var toKebab = s => {
   return s.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").toLowerCase();
 };
+/**
+* Renders a command's payload for stdout.
+*
+* A response the SDK could not parse as JSON (the NDJSON audit export, a file
+* download) arrives as a Blob, which `JSON.stringify` collapses to `{}` — those
+* are printed as their own bytes instead.
+*
+* Everything else keeps going through `JSON.stringify`, **including a plain
+* string**: a JSON body may legitimately *be* a bare string (a `call-tool`
+* response whose output mapping yields a scalar), and callers pipe that into
+* `jq`, which needs the quotes to parse it.
+*/
+var formatResultData = async data => {
+  if (data instanceof Blob) return data.text();
+  return JSON.stringify(data, null, 2);
+};
 var parseFlagValue = value => {
   const trimmed = value.trim();
   if (trimmed.startsWith("{") || trimmed.startsWith("[") || trimmed === "true" || trimmed === "false" || trimmed === "null" || /^-?\d+(\.\d+)?$/.test(trimmed)) try {
@@ -7426,7 +7540,7 @@ program.argument("[command]", "API command in kebab-case (e.g. list-actors)").ar
     console.error(JSON.stringify(errorOutput, null, 2));
     process.exit(1);
   }
-  console.log(JSON.stringify(result.data, null, 2));
+  console.log(await formatResultData(result.data));
 });
 var runCli = async args => {
   const previousArgv = process.argv;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soat/cli",
-  "version": "0.15.14",
+  "version": "0.16.1",
   "type": "module",
   "dependencies": {
     "@inquirer/input": "^5.1.2",
@@ -8,7 +8,7 @@
     "@ttoss/logger": "^0.8.19",
     "commander": "^15.0.0",
     "js-yaml": "^5.2.1",
-    "@soat/sdk": "0.15.14"
+    "@soat/sdk": "0.16.1"
   },
   "devDependencies": {
     "@ttoss/config": "^1.37.17",