securenow 8.8.0 → 8.10.0

package/cli.js

@@ -188,16 +188,54 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
-  logs: {
+  logs: {
     desc: 'View application logs',
     usage: 'securenow logs [options]',
     sub: {
       list: { desc: 'List recent logs', flags: { app: 'App key', env: 'Environment (production, staging, preview, local, or all)', environment: 'Alias for --env', limit: 'Max results (default 200)', since: 'Time window (e.g. 30m, 6h, 2d)', minutes: 'Time window in minutes (alias for --since Nm)', level: 'Filter by level (error, warn, info, debug)', start: 'Start time (ISO 8601)', end: 'End time (ISO 8601)' }, run: (a, f) => require('./cli/monitor').logsList(a, f) },
       trace: { desc: 'Show logs for a trace', usage: 'securenow logs trace <traceId>', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env' }, run: (a, f) => require('./cli/monitor').logsTrace(a, f) },
     },
-    defaultSub: 'list',
-  },
-  notifications: {
+    defaultSub: 'list',
+  },
+  telemetry: {
+    desc: 'Inspect the alert-SQL telemetry contract and fields observed for an app',
+    usage: 'securenow telemetry <schema|fields> [options]',
+    flags: {
+      app: 'With fields: application key (defaults to connected/default app)',
+      env: 'With fields: environment or all (default: production)',
+      since: 'With fields: observation window such as 30m, 24h, or 7d (maximum 30d)',
+      source: 'Schema section or live signal source',
+      limit: 'With fields: maximum fields per signal (1-500, default 200)',
+      json: 'Machine-readable output',
+    },
+    sub: {
+      schema: {
+        desc: 'Print the packaged ClickHouse tables, fields, mappings, and SQL requirements',
+        usage: 'securenow telemetry schema [all|logs|traces|events] [--json]',
+        flags: {
+          source: 'Schema section: all, logs, traces, or events',
+          json: 'Output the machine-readable contract as JSON',
+        },
+        run: (a, f) => require('./cli/telemetry').schema(a, f),
+      },
+      fields: {
+        desc: 'Discover fields and custom event types actually emitted by an app',
+        usage: 'securenow telemetry fields [--app <key>] [--env production] [--since 24h] [--source all] [--limit 200] [--json]',
+        flags: {
+          app: 'Application key (defaults to connected/default app)',
+          env: 'Environment, comma-separated environments, or all (default: production)',
+          environment: 'Alias for --env',
+          since: 'Observation window such as 30m, 24h, or 7d (maximum 30d)',
+          source: 'Signal source: all, logs, or traces',
+          limit: 'Maximum fields per signal (1-500, default 200)',
+          json: 'Output JSON for agents and scripts',
+        },
+        run: (a, f) => require('./cli/telemetry').fields(a, f),
+      },
+    },
+    defaultSub: 'schema',
+  },
+  notifications: {
     desc: 'Manage notifications',
     usage: 'securenow notifications <subcommand> [options]',
     sub: {
@@ -473,6 +511,8 @@ const COMMANDS = {
       add: { desc: 'Block an IP', usage: 'securenow blocklist add <ip> [--route /admin*] [--mode prefix] [--method GET] [--app <key>] [--env production] [--duration 24h] [--reason <reason>]', run: (a, f) => require('./cli/security').blocklistAdd(a, f) },
       unblock: { desc: 'Unblock an IP and keep block history', usage: 'securenow blocklist unblock <id> [--reason <reason>]', run: (a, f) => require('./cli/security').blocklistRemove(a, f) },
       remove: { desc: 'Unblock an IP (compatibility alias)', usage: 'securenow blocklist remove <id> [--reason <reason>]', run: (a, f) => require('./cli/security').blocklistRemove(a, f) },
+      approve: { desc: 'Approve a pending block (enforce the IP)', usage: 'securenow blocklist approve <pending-block-id> [--reason <reason>] [--yes]', run: (a, f) => require('./cli/security').blocklistApprove(a, f) },
+      reject: { desc: 'Reject a pending block (clear the IP, record a scoped no-block decision)', usage: 'securenow blocklist reject <pending-block-id> [--reason <reason>] [--yes]', run: (a, f) => require('./cli/security').blocklistReject(a, f) },
       stats: { desc: 'Blocklist statistics', run: (a, f) => require('./cli/security').blocklistStats(a, f) },
     },
     defaultSub: 'list',
@@ -763,7 +803,7 @@ function showHelp(commandName) {
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
-    'Telemetry': ['log', 'event', 'test-span'],
+    'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
     'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };