@tityra/cli 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.1.0
+
+- Clarify that audit requests use explicit authorisation and validated scope without a second manual staff authority confirmation, while retaining report quality and commercial checks.
+- Add selected-project monitoring reads and confirmed enable, pause, resume and scope changes.
+- Require a new explicit `monitoring:write` grant for changes, preserving revision checks and stable retry keys.
+- Explain that confirmed website and scope authorisation enables monitoring without separate administrator approval.
+- Expose monitoring settings in the interactive project menu without adding write permissions.
+- Show server-provided pricing status, including genuine included weekly audits, in audit tables.
+- Clarify the first-request schedule, automatic admission of overdue audits and organisation Billing Profile eligibility.
+- Clarify Scale and Enterprise workspace plans, monthly and annual Enterprise pricing and
+  per-project weekly AX Audit monitoring in the package documentation.
+- Specify that Expert Review always follows the separately paid request and checkout flow.
+- Explain that AX Audit and Expert Review requests submitted with `audits create` are separately priced;
+  billing assignment and subscription changes stay in the Tityra application.
+
 ## 1.0.0
 
 - Stable `@tityra/cli` release, version `1.0.0`, distributed through npm's `latest` tag.

package/README.md

@@ -6,7 +6,7 @@ The CLI is an API client for the Tityra service. It uses the same account permis
 
 ## Project status
 
-Version `1.0.0` is the stable release. Stable releases use npm's `latest` tag. CI targets Node.js 22 and 24 on Linux, macOS and Windows; local regression tests use isolated fixtures rather than live customer accounts.
+Version `1.1.0` adds project monitoring commands and included-audit pricing status. Stable releases use npm's `latest` tag; check the [npm package page](https://www.npmjs.com/package/@tityra/cli) for the currently published version. CI targets Node.js 22 and 24 on Linux, macOS and Windows; local regression tests use isolated fixtures rather than live customer accounts.
 
 ## Basic functionality
 
@@ -18,7 +18,7 @@ Version `1.0.0` is the stable release. Stable releases use npm's `latest` tag. C
 
 ## What it does not do
 
-The CLI does not execute audits locally, approve website authority or replace Tityra's staff review. It does not verify a fix, change technical report evidence, expose private staff notes or grant access to another customer's data. Checkout creates a link; it does not make a payment or authorise automatic charges.
+The CLI does not execute audits locally or independently verify website ownership. Your explicit `authorisation: true` declaration and the validated website scope provide the required request authorisation; no second manual staff confirmation of website authority is required. Individually requested reports retain Tityra's staff quality review. The CLI does not verify a fix, change technical report evidence, expose private staff notes or grant access to another customer's data. Checkout creates a link; it does not make a payment or authorise automatic charges.
 
 The interactive workspace offers read-only navigation. Account changes use the explicit commands described below and require reviewed JSON input plus `--yes`.
 
@@ -73,6 +73,43 @@ tityra audits payment AUDIT_ID
 
 Audit options describe the existing eligibility and review rules. A submitted request does not start an instant scan or promise a delivery date. Payment status provides the canonical report reference when available.
 
+### Workspace plans and weekly monitoring
+
+Scale and Enterprise support unlimited organisations, projects and members. Enterprise offers monthly billing at £3,600 or annual billing at £36,000, excluding VAT, with one scheduled AX Audit per week for each enabled project and up to 500 pages per project. Check [current plans and prices](https://app.tityra.com/customer) in your account before subscribing.
+
+Enable **Monitor this project** in the Tityra application, or use the monitoring commands below with an explicitly granted `monitoring:write` permission and current project management access. Confirm that you are authorised to scan the website and selected pages. Eligibility comes from the project's organisation and its explicitly assigned Billing Profile, with an active subscription or explicit complimentary assignment that includes weekly monitoring. Your personal plan or membership in another paying organisation does not supply it. Your confirmed project consent enables monitoring without a separate administrator approval. Reports are delivered automatically after the required checks. You can pause and resume each project separately; existing reports remain available.
+
+The first included AX Audit is due seven days after the project's first production audit request for its current website, whether that request was Free Audit, AX Audit or Expert Review. If no request exists, confirmed monitoring consent starts that interval. Enabling or resuming an eligible project whose audit is already due automatically queues one included AX Audit. Later included audits remain at least seven days apart; missed slots do not accumulate. Read the server's `nextScheduledAt` and `history` rather than calculating a new start date locally.
+
+Use `audits list` and `reports get` to read released weekly AX Audit reports within the projects and permissions you approved. An AX Audit submitted through `audits create` is an additional request, charged separately; it does not replace the included weekly AX Audit slot. Expert Review is never included in weekly monitoring and always follows the normal separately paid request and checkout process. Free Audit requests retain their normal eligibility limits. The CLI cannot choose a payer or change a subscription.
+
+Audit lists show the server's pricing status when your connection has `billing:read`; genuine included monitoring requests use `included`. A missing pricing status does not mean a payment is due. Use `audits payment AUDIT_ID` for current payment requirements. Normal report publication and payment checks remain in force.
+
+Monitoring commands require version `1.1.0` or later; version `1.0.0` does not include them. Read settings with `projects:read`. To change them, request `monitoring:write` through fresh consent; default scopes and existing connections stay unchanged. The `--scope` list replaces the defaults, so include any other access you still need.
+
+The interactive project menu also offers **Weekly monitoring** to read the same settings. It does not change monitoring or request additional permissions.
+
+```sh
+tityra auth login --scope "projects:read monitoring:write"
+tityra projects monitoring get PROJECT_ID --json
+tityra projects monitoring update PROJECT_ID --input monitoring.json --yes --json
+```
+
+For `monitoring.json`, copy the current `revision` and `website` into `expectedRevision` and `expectedWebsite`, and generate a UUID once for the intended action:
+
+```json
+{
+  "action": "enable",
+  "expectedRevision": 0,
+  "expectedWebsite": "https://example.com/",
+  "authorisation": true,
+  "auditScope": { "mode": "website" },
+  "idempotencyKey": "10000000-0000-4000-8000-000000000001"
+}
+```
+
+`enable` also resumes monitoring or changes its scope. To pause, send only `action: "disable"`, the current `expectedRevision` and a new action's `idempotencyKey`. Revision zero is valid for a project without settings. On an uncertain write, retry only the same input and key. The server checks the selected project, current manager, explicit payer, subscription and website. Confirm your authorisation again when changing the website or scope.
+
 ### 3. Read reports, findings and discussions
 
 ```sh
@@ -114,18 +151,19 @@ tityra discussions create REPORT_ID FINDING_ID --input discussion.json --yes --j
 
 Other write commands use the same confirmation pattern:
 
-| Command                                            | Input fields besides `idempotencyKey`                                                                     |
-| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
-| `audits create`                                    | `projectId`, `plan` (`free`, `automated`, `human`), `authorisation: true`; optional `notes`, `auditScope` |
-| `findings challenge REPORT_ID FINDING_ID`          | `reason` (`irrelevant`, `false_positive`, `unclear_other`), `body`, `expectedReportRevision`              |
-| `discussions create REPORT_ID FINDING_ID`          | `body`, `expectedReportRevision`                                                                          |
-| `discussions reply REPORT_ID FINDING_ID THREAD_ID` | `body`, `expectedReportRevision`, `expectedThreadRevision`                                                |
-| `findings remediate REPORT_ID FINDING_ID`          | `status`, `reason`, `expectedReportRevision`, `expectedTrackingRevision`                                  |
-| `reports checkout REPORT_ID`                       | No additional fields                                                                                      |
+| Command                                            | Input fields besides `idempotencyKey`                                                                                                  |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `audits create`                                    | `projectId`, `plan` (`free`, `automated`, `human`), `authorisation: true`; optional `notes`, `auditScope`                              |
+| `projects monitoring update PROJECT_ID`            | `action` (`enable`, `disable`), `expectedRevision`; enable requires `authorisation: true`, `expectedWebsite`, and accepts `auditScope` |
+| `findings challenge REPORT_ID FINDING_ID`          | `reason` (`irrelevant`, `false_positive`, `unclear_other`), `body`, `expectedReportRevision`                                           |
+| `discussions create REPORT_ID FINDING_ID`          | `body`, `expectedReportRevision`                                                                                                       |
+| `discussions reply REPORT_ID FINDING_ID THREAD_ID` | `body`, `expectedReportRevision`, `expectedThreadRevision`                                                                             |
+| `findings remediate REPORT_ID FINDING_ID`          | `status`, `reason`, `expectedReportRevision`, `expectedTrackingRevision`                                                               |
+| `reports checkout REPORT_ID`                       | No additional fields                                                                                                                   |
 
 Read current revision fields using `--json` before changing a record. Discussion and challenge messages contain 3–4,000 characters. Remediation statuses are `open`, `planned`, `in_progress`, `resolved`, `wont_fix` and `not_applicable`; `resolved` remains customer-reported rather than independently verified.
 
-Audit scope is either `{"mode":"website"}` or `{"mode":"specific_urls","urls":["https://example.com/path"]}`. The project supplies the website, and existing authority, scope and commercial checks still apply. Checkout creates a link for the customer to complete.
+Audit scope is either `{"mode":"website"}` or `{"mode":"specific_urls","urls":["https://example.com/path"]}`. The project supplies the website. Normal audit requests record your explicit authorisation for that scope without a separate manual staff authority confirmation. Eligibility, scope and commercial checks still apply, and individually requested reports retain staff quality review. Monitoring reuses the confirmed project consent described above. Checkout creates a link for the customer to complete.
 
 ### 5. Use the CLI in scripts or with an agent
 

package/dist/commands/audits.js

@@ -36,7 +36,8 @@ export function registerAuditsCommands(program, context) {
     });
     writeOptions(audits
         .command('create')
-        .description('Request an audit under the existing eligibility and authority rules')).action(async (_options, command) => {
+        .description('Request an additional audit with explicit authorisation for its website scope')
+        .addHelpText('after', '\nYour authorisation: true declaration and the validated website scope provide the required request authorisation. No second manual staff confirmation of website authority is required.\nEligibility, scope and commercial checks still apply. Individually requested reports retain staff quality review.\nWeekly monitoring includes AX Audit only. Additional AX Audits and Expert Review require a separate request and payment through the normal checkout.\nUse projects monitoring get/update for an explicitly authorised project, or manage monitoring in the Tityra application.\n')).action(async (_options, command) => {
         await write(command, context, 'audit', '/api/agent/audits');
     });
 }

package/dist/commands/projects.js

@@ -1,11 +1,28 @@
-import { read } from './shared.js';
+import { identifier } from '../schema/writeSchema.js';
+import { read, write, writeOptions } from './shared.js';
 export function registerProjectsCommands(program, context) {
-    program
+    const projects = program
         .command('projects')
-        .description('Read the projects selected for this connection')
+        .description('Read selected projects and manage authorised weekly monitoring');
+    projects
         .command('list')
         .description('List accessible projects')
         .action(async (_options, command) => {
         await read(command, context, '/api/agent/projects', 'Loading projects');
     });
+    const monitoring = projects
+        .command('monitoring')
+        .description('Read or change weekly AX Audit monitoring for a selected project');
+    monitoring
+        .command('get <project-id>')
+        .description('Read current monitoring settings, scope, revision and report history')
+        .action(async (id, _options, command) => {
+        await read(command, context, `/api/agent/projects/${identifier(id)}/monitoring`, 'Loading project monitoring');
+    });
+    writeOptions(monitoring
+        .command('update <project-id>')
+        .description('Enable, pause, resume or update the scope of weekly AX Audit monitoring')
+        .addHelpText('after', '\nRequires an explicitly granted monitoring:write permission and current project management access.\nRead settings first; include the current expectedRevision and keep the same input and idempotencyKey when retrying an uncertain write.\nUse action enable with authorisation: true and the returned website as expectedWebsite. Use action disable to pause.\nEnabling monitoring records your website and scope authorisation without a separate administrator approval. Confirm that authorisation again after changing the website or scope.\nThe first included audit is due seven days after the first audit request for this project website, or after consent if none exists. Enabling or resuming an overdue eligible project queues its due AX Audit automatically. Read nextScheduledAt and history for the current server state.\nThe CLI cannot select a payer or change a subscription.\n')).action(async (id, _options, command) => {
+        await write(command, context, 'monitoring', `/api/agent/projects/${identifier(id)}/monitoring`, 'PATCH');
+    });
 }

package/dist/schema/writeSchema.js

@@ -38,6 +38,14 @@ export function validateWrite(kind, input) {
             'idempotencyKey',
         ],
         checkout: ['idempotencyKey'],
+        monitoring: [
+            'action',
+            'expectedRevision',
+            'idempotencyKey',
+            'authorisation',
+            'expectedWebsite',
+            'auditScope',
+        ],
     };
     if (Object.keys(body).some((key) => !fields[kind].includes(key)))
         usage('Input contains an unsupported field. Use the documented request body.');
@@ -51,7 +59,32 @@ export function validateWrite(kind, input) {
         if (!Number.isSafeInteger(body[key]) || Number(body[key]) < 1)
             usage(`${key} must be a positive integer from the current server response.`);
     };
-    if (kind === 'audit') {
+    if (kind === 'monitoring') {
+        if (!['enable', 'disable'].includes(String(body.action)))
+            usage('Monitoring action must be enable or disable.');
+        if (!Number.isSafeInteger(body.expectedRevision) || Number(body.expectedRevision) < 0)
+            usage('expectedRevision must be a non-negative integer from the current monitoring response.');
+        if (body.action === 'enable') {
+            if (body.authorisation !== true)
+                usage('Enabling monitoring requires explicit authorisation: true.');
+            text('expectedWebsite', 1, 2000);
+            let website;
+            try {
+                website = new URL(body.expectedWebsite);
+            }
+            catch {
+                usage('expectedWebsite must be the website returned by the monitoring response.');
+            }
+            if (!['http:', 'https:'].includes(website.protocol) || website.username || website.password)
+                usage('expectedWebsite must be an HTTP(S) website without credentials.');
+            validateAuditScope(body.auditScope);
+        }
+        else if (body.authorisation !== undefined ||
+            body.expectedWebsite !== undefined ||
+            body.auditScope !== undefined)
+            usage('Pausing monitoring accepts only action, expectedRevision and idempotencyKey.');
+    }
+    else if (kind === 'audit') {
         if (typeof body.projectId !== 'string')
             usage('projectId is required.');
         identifier(body.projectId);
@@ -61,25 +94,7 @@ export function validateWrite(kind, input) {
             usage('Audit requests require a plan and explicit authorisation: true.');
         if (body.notes !== undefined)
             text('notes', 0, 20000);
-        if (body.auditScope !== undefined) {
-            if (!body.auditScope || typeof body.auditScope !== 'object' || Array.isArray(body.auditScope))
-                usage('auditScope must be an object.');
-            const scope = body.auditScope;
-            if (scope.mode === 'website') {
-                if (Object.keys(scope).length !== 1)
-                    usage('Website auditScope accepts only mode.');
-            }
-            else if (scope.mode === 'specific_urls') {
-                if (Object.keys(scope).some((k) => !['mode', 'urls'].includes(k)) ||
-                    !Array.isArray(scope.urls) ||
-                    scope.urls.length < 1 ||
-                    scope.urls.length > 500 ||
-                    scope.urls.some((url) => typeof url !== 'string' || !url.length || url.length > 2000))
-                    usage('specific_urls requires 1–500 URL strings.');
-            }
-            else
-                usage('auditScope.mode must be website or specific_urls.');
-        }
+        validateAuditScope(body.auditScope);
     }
     else if (kind !== 'checkout') {
         revision('expectedReportRevision');
@@ -101,3 +116,24 @@ export function validateWrite(kind, input) {
     }
     return body;
 }
+function validateAuditScope(value) {
+    if (value === undefined)
+        return;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        usage('auditScope must be an object.');
+    const scope = value;
+    if (scope.mode === 'website') {
+        if (Object.keys(scope).length !== 1)
+            usage('Website auditScope accepts only mode.');
+    }
+    else if (scope.mode === 'specific_urls') {
+        if (Object.keys(scope).some((key) => !['mode', 'urls'].includes(key)) ||
+            !Array.isArray(scope.urls) ||
+            scope.urls.length < 1 ||
+            scope.urls.length > 500 ||
+            scope.urls.some((url) => typeof url !== 'string' || !url.length || url.length > 2000))
+            usage('specific_urls requires 1–500 URL strings.');
+    }
+    else
+        usage('auditScope.mode must be website or specific_urls.');
+}

package/dist/services/apiClient.js

@@ -91,9 +91,11 @@ export class ApiClient {
                 : response.status === 403
                     ? 'Your connection does not have permission for this project or action. Review its scopes and project access.'
                     : response.status === 402
-                        ? 'Payment is required before this report is available.'
+                        ? pathname.endsWith('/monitoring')
+                            ? 'This project is not currently eligible for monitoring. Review its subscription in Tityra.'
+                            : 'Payment is required before this report is available.'
                         : response.status === 409
-                            ? 'The report or discussion changed. Read the latest revision and review your input before retrying.'
+                            ? 'The resource or its authorisation changed. Read the latest revision and review your input before retrying.'
                             : response.status === 429
                                 ? 'Tityra rate limited this request. Wait before retrying; preserve the idempotency key for writes.'
                                 : response.status === 404

package/dist/services/brandingService.js

@@ -20,7 +20,7 @@ export function welcomeBanner(version, color = true) {
         level: color && !('NO_COLOR' in process.env) && supportsColor ? supportsColor.level : 0,
     });
     if (process.env.TERM === 'dumb')
-        return `\nTityra · v${version}\n`;
+        return `\nTityra v${version}\n`;
     const captions = {
         2: paint.hex('#ed4832').bold('Tityra'),
         4: (process.stdout.columns || 80) >= 70 ? 'Your workspace, from the terminal.' : '',

package/dist/services/outputService.js

@@ -39,7 +39,15 @@ export function createOutput(json = false, color = true) {
                 process.stdout.write(paint.dim('No results.\n'));
                 return;
             }
-            const keys = ['id', 'threadId', 'title', 'name', 'status', 'severity'].filter((key) => rows.some((row) => row[key] !== undefined));
+            const keys = [
+                'id',
+                'threadId',
+                'title',
+                'name',
+                'status',
+                'severity',
+                'pricingStatus',
+            ].filter((key) => rows.some((row) => row[key] !== undefined));
             if (!keys.length) {
                 process.stdout.write(humanJson(data) + '\n');
                 return;
@@ -53,12 +61,12 @@ export function createOutput(json = false, color = true) {
             })
                 .join('  ')
                 .trimEnd();
-            process.stdout.write(paint.bold(rowText(Object.fromEntries(keys.map((key) => [key, key.toUpperCase()])))) + '\n');
+            process.stdout.write(paint.bold(rowText(Object.fromEntries(keys.map((key) => [key, key === 'pricingStatus' ? 'PRICING' : key.toUpperCase()])))) + '\n');
             for (const row of rows)
                 process.stdout.write(rowText(row) + '\n');
             if (value?.pagination && typeof value.pagination === 'object') {
                 const pagination = value.pagination;
-                process.stdout.write(paint.dim(`\nPage ${terminalText(pagination.page)} · ${terminalText(pagination.total)} total${pagination.hasMore ? ' · more available' : ''}\n`));
+                process.stdout.write(paint.dim(`\nPage ${terminalText(pagination.page)}: ${terminalText(pagination.total)} total${pagination.hasMore ? ', more available' : ''}\n`));
             }
             process.stdout.write(paint.dim('Use --json for complete records and revision fields.\n'));
         },

package/dist/services/workspaceService.js

@@ -56,7 +56,7 @@ async function requestMenu(context, initial, environment) {
         if (reportId)
             choices.push({ title: 'Read report', value: 'report' }, { title: 'View findings', value: 'findings' });
         choices.push({ title: 'Payment status', value: 'payment' }, back);
-        const action = await environment.choose(`Audit ${terminalText(request.id)} · ${terminalText(request.status)}`, choices);
+        const action = await environment.choose(`Audit ${terminalText(request.id)}: ${terminalText(request.status)}`, choices);
         if (!action || action === 'back')
             return;
         if (action === 'status') {
@@ -81,9 +81,16 @@ async function recentAudits(context, projectId, environment) {
         const result = await load(context, `/api/agent/audits?${query}`);
         const requests = items(result, 'requests');
         const choices = requests.map((request, index) => ({
-            title: `${terminalText(request.packageName || request.id)} · ${terminalText(request.status)}`,
+            title: `${terminalText(request.packageName || request.id)}: ${terminalText(request.status)}`,
             value: `request:${index}`,
-            description: terminalText(request.receivedAt || request.websiteUrl),
+            description: [
+                terminalText(request.receivedAt || request.websiteUrl),
+                ...(typeof request.pricingStatus === 'string'
+                    ? [`Pricing: ${terminalText(request.pricingStatus)}`]
+                    : []),
+            ]
+                .filter(Boolean)
+                .join(' | '),
         }));
         if (!requests.length)
             environment.write('\nNo audit requests on this page.\n');
@@ -95,7 +102,7 @@ async function recentAudits(context, projectId, environment) {
         if (page > 1)
             choices.push({ title: 'Previous page', value: 'previous' });
         choices.push(back);
-        const selected = await environment.choose(`Recent audits · page ${page}`, choices);
+        const selected = await environment.choose(`Recent audits: page ${page}`, choices);
         if (!selected || selected === 'back')
             return;
         if (selected === 'next') {
@@ -145,6 +152,7 @@ async function projectWorkspace(context, projects, environment) {
             const action = await environment.choose('What would you like to do?', [
                 { title: 'Recent audits', value: 'audits' },
                 { title: 'Audit options', value: 'options' },
+                { title: 'Weekly monitoring', value: 'monitoring' },
                 { title: 'Switch project', value: 'switch' },
                 { title: 'Connection status', value: 'status' },
                 exit,
@@ -157,6 +165,8 @@ async function projectWorkspace(context, projects, environment) {
                 context.output(await environment.status(context.auth));
             else if (action === 'options')
                 context.output(await load(context, `/api/agent/audits/options?${new URLSearchParams({ projectId })}`));
+            else if (action === 'monitoring')
+                context.output(await load(context, `/api/agent/projects/${projectId}/monitoring`));
             else if (action === 'audits')
                 await recentAudits(context, projectId, environment);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tityra/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Official Tityra CLI for projects, audits, reports and findings. Built for developers, AI agents and automated workflows.",
   "type": "module",
   "bin": {