securenow 8.8.0 → 8.10.0

package/NPM_README.md

@@ -306,6 +306,36 @@ X-SecureNow-App-Key: <app-uuid>
 
 CLI: `npx securenow event send auth.login.failure --user u_1 --ip 1.2.3.4 --attrs reason=bad_token`
 
+### Build alert SQL from the installed telemetry contract
+
+The NPM package ships the exact ClickHouse table/field contract used for alert-rule authoring.
+Agents should read it instead of guessing SQL columns:
+
+```bash
+# Offline: installed SDK schema, tenant scope, timestamp types, event mappings, and templates
+npx securenow telemetry schema --json
+
+# Connected app: names/types/counts observed in real telemetry (never attribute values)
+npx securenow telemetry fields --app <app-key> --env production --since 24h --json
+
+# Prove candidate SQL against the backend before creating anything
+npx securenow alerts rules validate --sql @rule.sql --app <app-key>
+```
+
+The same local contract is available programmatically:
+
+```js
+const telemetrySchema = require('securenow/telemetry-schema');
+```
+
+Use the installed schema to draft SQL, live field discovery to verify that optional/custom
+fields are actually emitted, and `alerts rules validate` to prove the query compiles and runs.
+A field absent from the selected live window is **unverified**, not necessarily unsupported.
+Mark detections `NEEDS_INSTRUMENTATION` when the repository must add a `track()` event,
+`NEEDS_BASELINE` when only the threshold remains unknown, and `READY` only after field
+verification plus SQL validation. See `node_modules/securenow/TELEMETRY-SQL.md` for tables,
+timestamp handling, privacy rules, templates, and the full test-to-production lifecycle.
+
 ```bash
 # Create a custom detection rule from your own SQL (new in 8.1)
 npx securenow alerts rules create \

package/README.md

@@ -223,6 +223,10 @@ npx securenow logs                  # tail logs
 npx securenow status                # dashboard summary
 npx securenow doctor                # diagnose config + connectivity
 
+# Detection authoring contract
+npx securenow telemetry schema --json
+npx securenow telemetry fields --app <key> --env production --since 24h --json
+
 # Security
 npx securenow firewall status --env production
 npx securenow blocklist add 1.2.3.4 --reason "scanner"
@@ -363,6 +367,16 @@ After install, the `securenow` CLI is available via `npx securenow` or globally
 | `securenow analytics` | Response code analytics |
 | `securenow status` | Dashboard summary |
 
+### Detection authoring
+
+| Command | Description |
+|---|---|
+| `securenow telemetry schema --json` | Offline, versioned tables, fields, event mappings, tenant scope, and SQL requirements |
+| `securenow telemetry fields --app <key> --env production --since 24h --json` | Fields, types, and custom event names actually observed for an authorized app; values are never returned |
+| `securenow alerts rules validate --sql @rule.sql --app <key>` | Compile and dry-run candidate SQL before creating a rule |
+
+The machine-readable contract is also exported as `require('securenow/telemetry-schema')`; the full workflow and SQL examples are in [`TELEMETRY-SQL.md`](./TELEMETRY-SQL.md).
+
 ### Detect & Respond
 
 | Command | Description |

package/SKILL-API.md

@@ -453,6 +453,29 @@ Requires peer dep: `npm install @google-cloud/compute`
 
 Logging is enabled by default (`config.logging.enabled: true`). Logs are exported to your OTLP collector alongside traces.
 
+### Telemetry contract for alert-rule agents
+
+The package exports a versioned, machine-readable description of the ClickHouse tables,
+timestamp types, map access, tenant scope, automatic fields, custom-event mapping, client-IP
+expression, and safe SQL templates:
+
+```js
+const telemetrySchema = require('securenow/telemetry-schema');
+```
+
+The CLI exposes the same contract and can compare it with fields observed in the connected app:
+
+```bash
+securenow telemetry schema --json
+securenow telemetry fields --app <key> --env production --since 24h --json
+securenow alerts rules validate --sql @rule.sql --app <key>
+```
+
+The first command works offline. Live discovery returns field names/types/counts and event names,
+never values. A coding agent should inspect the customer repository for routes and `track()` calls,
+use the local contract to construct SQL, use live discovery to verify emitted fields, then validate
+the candidate query. Full guidance is shipped in `TELEMETRY-SQL.md`.
+
 ### Get a Logger
 
 ```javascript

package/SKILL-CLI.md

@@ -250,9 +250,27 @@ MCP parity:
 
 Write tools still require `confirm:true` plus a reason. False positives should stay restrictive to the app, alert rule, path, method/status, user-agent, body pattern, or other exact evidence the AI report supports. Notification IP investigations can include `metadata.matchedSubdetectors`; prefer that exact field over inferring which subdetector fired from the title or sample body.
 
-### Alerts
-
-```bash
+### Alerts
+
+Before authoring any alert SQL, load the contract shipped by the installed package and compare
+it with fields actually observed for the selected application:
+
+```bash
+securenow telemetry schema --json
+securenow telemetry schema logs --json
+securenow telemetry schema traces --json
+securenow telemetry schema events --json
+securenow telemetry fields --app <key> --env production --since 24h --source all --json
+```
+
+`telemetry schema` is offline and versioned with the SDK. `telemetry fields` requires admin
+auth and telemetry access; it returns names, map scopes, data types, occurrence counts, and
+custom event types, but never customer attribute values. Absence means "not observed in this
+window," not "unsupported." Use only documented fields, and label a rule `READY` only when
+its fields were observed and `alerts rules validate` succeeds. Otherwise label it
+`NEEDS_INSTRUMENTATION`, `NEEDS_BASELINE`, or `NEEDS_CUSTOMER_DECISION` as appropriate.
+
+```bash
 securenow alerts                             # list alert rules (default)
 securenow alerts rules                       # list alert rules (columns: Status, Applications, Schedule)
 securenow alerts rules validate \            # dry-run a candidate query BEFORE creating any rule

package/TELEMETRY-SQL.md

@@ -0,0 +1,98 @@
+# SecureNow telemetry and alert SQL contract
+
+This document is the canonical starting point for humans and coding agents that construct SecureNow alert rules from a customer codebase. The same contract is available as machine-readable JSON:
+
+```bash
+npx securenow telemetry schema --json
+```
+
+The SDK contract tells you which tables and fields are supported. Live field discovery tells you which fields the connected application has actually emitted:
+
+```bash
+npx securenow telemetry fields --app <app-key> --env production --since 24h --json
+```
+
+Do not treat a documented optional or custom field as present until it appears in live discovery or the codebase contains the corresponding instrumentation.
+
+## Alert-rule SQL requirements
+
+- Use ClickHouse SQL.
+- Query `signoz_logs.distributed_logs_v2` for custom events and logs.
+- Query `signoz_traces.distributed_signoz_index_v3` for HTTP spans and traces.
+- Keep `__USER_APP_KEYS__` in every customer-scoped query.
+- For logs, scope with `resources_string['service.name'] IN (__USER_APP_KEYS__)`.
+- For traces, scope with `` `resource_string_service$$name` IN (__USER_APP_KEYS__) ``.
+- Bound the query with a time window.
+- Return an `ip` column and exclude empty IPs when the rule can trigger IP remediation.
+- Use the correct timestamp representation: log timestamps are UInt64 nanoseconds; trace timestamps are `DateTime64(9)`.
+- Validate SQL against the connected SecureNow backend before creating the rule.
+
+## Authoring workflow
+
+```bash
+# 1. Read the exact contract shipped with the installed SDK.
+npx securenow telemetry schema --json
+
+# 2. Discover actual fields and types emitted by this app.
+npx securenow telemetry fields --app <app-key> --env production --since 24h --json
+
+# 3. Avoid duplicating existing coverage.
+npx securenow alerts rules --json
+
+# 4. Validate the candidate before any write.
+npx securenow alerts rules validate --sql @rule.sql --app <app-key>
+
+# 5. Create in detect-only mode and dry-run it.
+npx securenow alerts rules create --name "Auth: OTP send abuse" --sql @rule.sql --apps <app-key>
+npx securenow alerts rules test <rule-id> --mode dry_run --wait
+
+# New custom rules start in detect-only test mode. Promote only after reviewing real matches and false positives.
+npx securenow alerts rules promote <rule-id>
+```
+
+`telemetry schema` works offline. `telemetry fields`, alert-rule validation, and rule management require admin authentication and access to the selected app.
+
+## Custom security events
+
+The SDK accepts arbitrary event names and scalar custom attributes:
+
+```js
+const { track } = require('securenow/events');
+
+track('auth.otp.send.result', {
+  userId,
+  sessionId,
+  ip,
+  attributes: {
+    channel: 'sms',
+    provider: 'twilio',
+    provider_result: 'accepted',
+    destination_hash: sha256(normalizedDestination),
+    cost_units: 1,
+  },
+});
+```
+
+Event properties are stored in the logs table:
+
+| SDK property | Alert SQL field |
+|---|---|
+| Event type | `attributes_string['event.type']` |
+| `userId` | `attributes_string['enduser.id']` |
+| `sessionId` | `attributes_string['session.id']` |
+| `ip` | `attributes_string['http.client_ip']` |
+| `userAgent` | `attributes_string['http.user_agent']` |
+| String custom attribute | `attributes_string['<key>']` |
+| Numeric custom attribute | `attributes_number['<key>']` |
+| Boolean custom attribute | `attributes_bool['<key>']` |
+
+Never send raw passwords, tokens, OTPs, session secrets, email addresses, phone numbers, or other unnecessary personal data. Hash destinations when correlation is required.
+
+## Readiness labels for generated detections
+
+- `READY`: every queried field was observed and the SQL validation passed.
+- `NEEDS_INSTRUMENTATION`: the codebase must add one or more `track()` events or attributes.
+- `NEEDS_BASELINE`: fields and SQL are valid, but the threshold needs production traffic history.
+- `NEEDS_CUSTOMER_DECISION`: cost limits or mitigation behavior require customer approval.
+
+Static repository analysis can produce candidate SQL and exact instrumentation TODOs. Only live field discovery plus SQL validation can justify the `READY` label.

package/cli/security.js

@@ -48,6 +48,15 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'set-sql' || sub === 'edit-sql') {
     return alertRuleSetSql(args.slice(1), flags);
   }
+  if (sub === 'versions' || sub === 'history') {
+    return alertRuleVersions(args.slice(1), flags);
+  }
+  if (sub === 'version') {
+    return alertRuleVersionShow(args.slice(1), flags);
+  }
+  if (sub === 'rollback' || sub === 'revert') {
+    return alertRuleRollback(args.slice(1), flags);
+  }
   if (sub === 'delete' || sub === 'rm' || sub === 'remove') {
     return alertRuleDelete(args.slice(1), flags);
   }
@@ -464,6 +473,113 @@ async function alertRuleSetSql(args, flags) {
   }
 }
 
+// List a rule's configuration version history (newest first). Each material update (SQL,
+// instant config, settings), duplicate, and rollback is a version; rollback restores a
+// prior snapshot and is itself recorded as a new version.
+async function alertRuleVersions(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules versions <rule-id> [--limit N] [--page N]');
+    process.exit(1);
+  }
+  const query = {};
+  if (flags.limit) query.limit = flags.limit;
+  if (flags.page) query.page = flags.page;
+  const s = ui.spinner('Fetching version history');
+  let data;
+  try {
+    data = await api.get(`/alert-rules/${id}/versions`, Object.keys(query).length ? { query } : undefined);
+    s.stop(`Found ${data.total ?? (data.versions || []).length} version${(data.total ?? 0) === 1 ? '' : 's'}`);
+  } catch (err) {
+    s.fail(`Failed to fetch versions: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  const rows = data.versions || [];
+  if (rows.length === 0) { ui.info('No versions recorded yet.'); return; }
+  console.log('');
+  ui.info(`Current: v${data.currentVersion}`);
+  for (const v of rows) {
+    const marker = v.isCurrent ? ui.c.green('→') : ' ';
+    const when = v.createdAt ? new Date(v.createdAt).toISOString().replace('T', ' ').slice(0, 19) : '';
+    const extra = v.changeType === 'rollback' && v.rolledBackFrom ? ` (from v${v.rolledBackFrom})` : '';
+    console.log(`${marker} ${ui.c.bold('v' + v.version).padEnd(14)} ${String(v.changeType + extra).padEnd(22)} ${ui.c.dim(when)}  ${v.createdByName || ''}`);
+    if (v.reason) console.log(`     ${ui.c.dim(ui.truncate(v.reason, 90))}`);
+  }
+  console.log('');
+  ui.info(`Show: securenow alerts rules version ${ui.truncate(id, 12)} <n>   |   Roll back: securenow alerts rules rollback ${ui.truncate(id, 12)} <n>`);
+}
+
+// Show one version's full material snapshot (diff-able SQL / instant / settings).
+async function alertRuleVersionShow(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const version = args[1];
+  if (!id || !version) {
+    ui.error('Usage: securenow alerts rules version <rule-id> <version-number>');
+    process.exit(1);
+  }
+  const s = ui.spinner(`Fetching v${version}`);
+  let data;
+  try {
+    data = await api.get(`/alert-rules/${id}/versions/${version}`);
+    s.stop(`Loaded v${version}`);
+  } catch (err) {
+    s.fail(`Failed: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  const v = data.version || {};
+  const snap = v.snapshot || {};
+  console.log('');
+  ui.success(`v${v.version}${v.isCurrent ? ' (current)' : ''} — ${v.changeType}`);
+  console.log(`  When     ${v.createdAt || ''}`);
+  if (v.createdByName) console.log(`  By       ${v.createdByName}`);
+  if (v.reason) console.log(`  Reason   ${v.reason}`);
+  if (v.rolledBackFrom) console.log(`  Restored v${v.rolledBackFrom}`);
+  console.log('');
+  console.log(`  Name     ${snap.name || ''}`);
+  console.log(`  Mode     ${snap.mode || ''} / ${snap.executionMode || ''}   severity ${snap.severity || '-'}`);
+  if (snap.instant && snap.instant.enabled) {
+    console.log(`  Instant  enabled  block=${snap.instant.block}  (${(snap.instant.conditions || []).length} condition${(snap.instant.conditions || []).length === 1 ? '' : 's'})`);
+  }
+  if (snap.query && snap.query.sqlQuery) {
+    console.log('  SQL:');
+    console.log(snap.query.sqlQuery.split('\n').map((l) => '    ' + ui.c.dim(l)).join('\n'));
+  }
+}
+
+// Roll a rule back to a prior version — restores that version's full snapshot and records it
+// as a new version (append-only history). System (read-only template) rules can't be rolled back.
+async function alertRuleRollback(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const version = args[1] || flags.version;
+  if (!id || !version) {
+    ui.error('Usage: securenow alerts rules rollback <rule-id> <version-number> [--reason "..."] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.yes && !flags.force) {
+    const ok = await ui.confirm(`Roll back rule ${ui.truncate(id, 12)} to v${version}? Restores that config and creates a new version.`);
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const body = { version: Number(version) };
+  if (flags.reason) body.reason = String(flags.reason);
+  const s = ui.spinner(`Rolling back to v${version}`);
+  let data;
+  try {
+    data = await api.post(`/alert-rules/${id}/rollback`, body);
+    s.stop(`Rolled back to v${version}`);
+  } catch (err) {
+    s.fail(`Failed to roll back: ${err.message}`);
+    process.exit(1);
+  }
+  if (flags.json) { ui.json(data); return; }
+  ui.success(`Restored from v${data.rolledBackFrom} → now at v${data.newVersion}`);
+  ui.info(`History: securenow alerts rules versions ${ui.truncate(id, 12)}`);
+}
+
 async function alertRuleDelete(args, flags) {
   requireAuth();
   const id = args[0];
@@ -967,6 +1083,58 @@ async function blocklistRemove(args, flags) {
   }
 }
 
+// Approve a block that the AI prepared but parked pending customer approval
+// (e.g. the autopilot held it under block_risk_score_below_policy). Enforces the IP.
+async function blocklistApprove(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow blocklist approve <pending-block-id> [--reason <reason>] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Approve this pending block? The IP will be enforced by the firewall.');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const s = ui.spinner('Approving pending block');
+  try {
+    const body = {};
+    if (flags.reason) body.reason = flags.reason;
+    const data = await api.post(`/blocklist/${id}/approve`, body);
+    s.stop('Pending block approved — IP now enforced');
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to approve pending block');
+    throw err;
+  }
+}
+
+// Reject a pending block: the IP is NOT blocked, the entry is removed, and a scoped
+// no-block decision is recorded so auto-block won't re-block this IP for the same rule.
+async function blocklistReject(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow blocklist reject <pending-block-id> [--reason <reason>] [--yes]');
+    process.exit(1);
+  }
+  if (!flags.force && !flags.yes) {
+    const ok = await ui.confirm('Reject this pending block? The IP will NOT be blocked; a scoped no-block decision is recorded for the rule that proposed it.');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const s = ui.spinner('Rejecting pending block');
+  try {
+    const body = {};
+    if (flags.reason) body.reason = flags.reason;
+    const data = await api.post(`/blocklist/${id}/reject`, body);
+    s.stop('Pending block rejected — IP cleared (scoped no-block decision recorded)');
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail('Failed to reject pending block');
+    throw err;
+  }
+}
+
 async function blocklistStats(args, flags) {
   requireAuth();
   const s = ui.spinner('Fetching blocklist stats');
@@ -1666,6 +1834,8 @@ module.exports = {
   blocklistList,
   blocklistAdd,
   blocklistRemove,
+  blocklistApprove,
+  blocklistReject,
   blocklistStats,
   revokeRoute,
   allowlistList,

package/cli/telemetry.js

@@ -0,0 +1,199 @@
+'use strict';
+
+const schemaContract = require('../telemetry-schema.json');
+const { api, requireAuth } = require('./client');
+const config = require('./config');
+const appConfig = require('../app-config');
+const ui = require('./ui');
+
+function parseDurationToMinutes(value) {
+  if (value == null || value === '') return 24 * 60;
+  const match = String(value).trim().match(/^(\d+)\s*(m|h|d)?$/i);
+  if (!match) return null;
+  const amount = Number.parseInt(match[1], 10);
+  const unit = String(match[2] || 'm').toLowerCase();
+  if (amount < 1) return null;
+  if (unit === 'm') return amount;
+  if (unit === 'h') return amount * 60;
+  if (unit === 'd') return amount * 24 * 60;
+  return null;
+}
+
+function filteredSchema(section) {
+  const selected = String(section || 'all').toLowerCase();
+  if (selected === 'all') return schemaContract;
+  if (selected === 'logs' || selected === 'traces') {
+    return {
+      contract: schemaContract.contract,
+      schemaVersion: schemaContract.schemaVersion,
+      dialect: schemaContract.dialect,
+      ruleContract: schemaContract.ruleContract,
+      table: schemaContract.tables[selected],
+      clientIp: schemaContract.clientIp,
+      templates: schemaContract.templates,
+    };
+  }
+  if (selected === 'events') {
+    return {
+      contract: schemaContract.contract,
+      schemaVersion: schemaContract.schemaVersion,
+      dialect: schemaContract.dialect,
+      ruleContract: schemaContract.ruleContract,
+      storageTable: schemaContract.tables.logs,
+      customEvents: schemaContract.customEvents,
+      templates: { eventFailuresByIp: schemaContract.templates.eventFailuresByIp },
+    };
+  }
+  return null;
+}
+
+async function schema(args, flags) {
+  const section = args[0] || flags.source || 'all';
+  const contract = filteredSchema(section);
+  if (!contract) {
+    ui.error('Unknown schema section. Use all, logs, traces, or events.');
+    process.exitCode = 1;
+    return;
+  }
+
+  if (flags.json) {
+    ui.json(contract);
+    return;
+  }
+
+  console.log('');
+  ui.heading('SecureNow Telemetry & Alert SQL Contract');
+  console.log('');
+  ui.keyValue([
+    ['Schema version', schemaContract.schemaVersion],
+    ['SQL dialect', schemaContract.dialect],
+    ['Tenant placeholder', schemaContract.ruleContract.tenantPlaceholder],
+    ['Required result', 'ip column for IP-remediation rules'],
+  ]);
+
+  const tables = section === 'all'
+    ? Object.entries(schemaContract.tables)
+    : section === 'events'
+      ? [['logs', schemaContract.tables.logs]]
+      : [[section, schemaContract.tables[section]]];
+  console.log('');
+  ui.subheading('Tables');
+  console.log('');
+  ui.table(
+    ['Signal', 'Table', 'Timestamp', 'Tenant scope'],
+    tables.map(([name, table]) => [
+      name,
+      table.name,
+      `${table.timestamp.type} (${table.timestamp.unit})`,
+      table.tenantExpression,
+    ])
+  );
+
+  if (section === 'all' || section === 'events') {
+    console.log('');
+    ui.subheading('Custom event mapping');
+    console.log('');
+    ui.table(
+      ['SDK property', 'SQL field'],
+      Object.entries(schemaContract.customEvents.propertyMapping).map(([property, field]) => [property, field])
+    );
+  }
+
+  console.log('');
+  ui.info('Machine-readable: securenow telemetry schema --json');
+  ui.info('Live verification: securenow telemetry fields --app <key> --env production --since 24h --json');
+  ui.info('Full guide: node_modules/securenow/TELEMETRY-SQL.md');
+  console.log('');
+}
+
+async function fields(args, flags) {
+  requireAuth();
+  const appKey = flags.app || config.getDefaultApp() || appConfig.resolveAppKey();
+  if (!appKey) {
+    ui.error('No app specified. Use --app <key>, run `securenow app connect`, or set a default app.');
+    process.exitCode = 1;
+    return;
+  }
+
+  const sinceMinutes = parseDurationToMinutes(flags.since || '24h');
+  if (sinceMinutes == null || sinceMinutes > 30 * 24 * 60) {
+    ui.error('Invalid --since value. Use a duration such as 30m, 24h, or 7d (maximum 30d).');
+    process.exitCode = 1;
+    return;
+  }
+  const source = String(flags.source || args[0] || 'all').toLowerCase();
+  if (!['all', 'logs', 'traces'].includes(source)) {
+    ui.error('Invalid --source. Use all, logs, or traces.');
+    process.exitCode = 1;
+    return;
+  }
+  const parsedLimit = Number.parseInt(flags.limit || '200', 10);
+  if (!Number.isFinite(parsedLimit) || parsedLimit < 1 || parsedLimit > 500) {
+    ui.error('--limit must be between 1 and 500.');
+    process.exitCode = 1;
+    return;
+  }
+  const environment = flags.env || flags.environment || 'production';
+
+  const spinner = ui.spinner('Discovering observed telemetry fields');
+  try {
+    const data = await api.get('/telemetry/fields', {
+      query: {
+        appKeys: appKey,
+        environment,
+        sinceMinutes,
+        source,
+        limit: parsedLimit,
+      },
+    });
+    spinner.stop(`Found ${(data.fields || []).length} observed field${(data.fields || []).length === 1 ? '' : 's'}`);
+    if (flags.json) {
+      ui.json(data);
+      return;
+    }
+
+    console.log('');
+    ui.heading('Observed Telemetry Fields');
+    console.log('');
+    ui.keyValue([
+      ['App', appKey],
+      ['Environment', (data.environments || [environment]).join(', ')],
+      ['Window', `${sinceMinutes} minutes`],
+      ['Source', source],
+    ]);
+    console.log('');
+    ui.table(
+      ['Signal', 'Scope', 'Type', 'Field', 'Occurrences'],
+      (data.fields || []).map((field) => [
+        field.source,
+        field.fieldScope,
+        field.dataType,
+        field.field,
+        String(field.occurrences || 0),
+      ])
+    );
+
+    if ((data.eventTypes || []).length > 0) {
+      console.log('');
+      ui.subheading('Observed custom event types');
+      console.log('');
+      ui.table(
+        ['Event type', 'Occurrences'],
+        data.eventTypes.map((event) => [event.eventType, String(event.occurrences || 0)])
+      );
+    }
+    console.log('');
+    ui.info(data.note || 'Absence in this window does not prove a field can never be emitted.');
+    console.log('');
+  } catch (error) {
+    spinner.fail('Failed to discover telemetry fields');
+    throw error;
+  }
+}
+
+module.exports = {
+  schema,
+  fields,
+  parseDurationToMinutes,
+  filteredSchema,
+};