ravmem-cli 0.1.0__tar.gz → 1.1.0__tar.gz

{ravmem_cli-0.1.0/ravmem_cli.egg-info → ravmem_cli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ravmem-cli
-Version: 0.1.0
+Version: 1.1.0
 Summary: RavMem CLI — lightweight client for the RavMem code knowledge graph server
 Author-email: RavMem <harpreet.singh@ravmem.com>
 License-Expression: MIT
@@ -18,9 +18,14 @@ Requires-Dist: typer[all]>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: pydantic>=2.0
+Requires-Dist: uvicorn>=0.27.0
+Requires-Dist: rich>=13.0
+Provides-Extra: serve
+Requires-Dist: ravmem-server>=0.2.2; extra == "serve"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
+Requires-Dist: pytest-httpx>=0.30.0; extra == "dev"
 Dynamic: license-file
 
 # ravmem-cli
@@ -37,7 +42,11 @@ pip install ravmem-cli
 
 ```bash
 # Point the CLI at your RavMem server
-ravmem remote config --url http://localhost:7432
+ravmem remote config --url http://localhost:7432 --api-key <ADMIN_TOKEN>
+
+# Activate the license (one command: seals the key to this machine, then
+# brings the server live — the key is never stored in a file)
+ravmem license activate RAVMEM-XXXX-XXXX-XXXX-XXXX
 
 # Register a repository
 ravmem remote add /path/to/repo --name my-project --default-branch main

{ravmem_cli-0.1.0 → ravmem_cli-1.1.0}/README.md

@@ -12,7 +12,11 @@ pip install ravmem-cli
 
 ```bash
 # Point the CLI at your RavMem server
-ravmem remote config --url http://localhost:7432
+ravmem remote config --url http://localhost:7432 --api-key <ADMIN_TOKEN>
+
+# Activate the license (one command: seals the key to this machine, then
+# brings the server live — the key is never stored in a file)
+ravmem license activate RAVMEM-XXXX-XXXX-XXXX-XXXX
 
 # Register a repository
 ravmem remote add /path/to/repo --name my-project --default-branch main

{ravmem_cli-0.1.0 → ravmem_cli-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ravmem-cli"
-version = "0.1.0"
+version = "1.1.0"
 description = "RavMem CLI — lightweight client for the RavMem code knowledge graph server"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -26,15 +26,21 @@ dependencies = [
     "httpx>=0.27.0",
     "pyyaml>=6.0",
     "pydantic>=2.0",
+    "uvicorn>=0.27.0",
+    "rich>=13.0",
 ]
 
 [project.urls]
 Homepage = "https://www.ravmem.com"
 
 [project.optional-dependencies]
+serve = [
+    "ravmem-server>=0.2.2",
+]
 dev = [
     "pytest>=8.0.0",
     "pytest-asyncio>=0.23.0",
+    "pytest-httpx>=0.30.0",
 ]
 
 [project.scripts]

ravmem_cli-1.1.0/ravmem/cli/_common.py

@@ -0,0 +1,138 @@
+"""Shared helpers for ravmem CLI commands."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+from typing import Optional
+
+import typer
+
+
+def detect_branch(repo_path: Path, explicit: Optional[str]) -> str:
+    if explicit:
+        return explicit
+    try:
+        out = subprocess.run(
+            ["git", "-C", str(repo_path), "rev-parse", "--abbrev-ref", "HEAD"],
+            capture_output=True, text=True, check=True,
+        ).stdout.strip()
+        return out if out and out != "HEAD" else "main"
+    except Exception:
+        return "main"
+
+
+def print_embed_job_summary(job: dict) -> None:
+    """Print a one-line summary for the embed job ``wait_for_indexing`` attaches
+    (as ``job["embed_job"]``) when called with ``wait_for="embed"``/``"both"``.
+    No-op if there is no embed job (``wait_for="graph"``, or the server isn't
+    running with embedding decoupled).
+    """
+    embed_job = job.get("embed_job")
+    if not embed_job:
+        return
+    status = embed_job.get("status", "unknown")
+    job_id = embed_job.get("id", "?")
+    if status == "done":
+        typer.echo(f"✓ Embedding complete (job {job_id}) — semantic search is ready.")
+    elif status == "failed":
+        typer.echo(f"✗ Embedding failed (job {job_id}): {embed_job.get('failure_reason', 'unknown')}", err=True)
+    else:
+        typer.echo(f"Embed job {job_id} ended with status: {status}")
+
+
+def wait_for_indexing(client, project_id: str, branch_name: str, job_id: int, wait_for: str) -> dict:
+    """Poll the graph job to completion, then (per ``wait_for``) also poll the embed job.
+
+    ``wait_for="graph"`` (default) returns as soon as the graph job — the one
+    ``job_id`` returned by index/upload endpoints refers to — finishes. This
+    matches pre-decoupling behavior: search over structure/impact is usable.
+
+    ``wait_for="embed"``/``"both"`` additionally look up the branch's
+    ``last_embed_job`` (via ``get_branch_status``) once the graph job is done
+    and poll that too, since the embed job is a separate job the caller
+    doesn't otherwise have the id for. No-ops (no separate embed job exists)
+    when the server isn't running with embedding decoupled — the graph job's
+    own embedding already finished inline in that case.
+
+    Both polls render a live progress bar (phase + %) instead of streaming
+    each poll request to the console — see ``_poll_job_with_progress``.
+    """
+    job = _poll_job_with_progress(client, job_id, "Indexing")
+    if wait_for == "graph" or job.get("status") != "done":
+        return job
+    try:
+        status = client.get_branch_status(project_id, branch_name)
+    except Exception:
+        return job
+    embed_job = status.get("last_embed_job")
+    if not embed_job or not embed_job.get("id"):
+        return job
+    embed_result = _poll_job_with_progress(client, embed_job["id"], "Embedding")
+    return {**job, "embed_job": embed_result}
+
+
+def _poll_job_with_progress(
+    client, job_id: int, label: str, interval: float = 1.0, timeout: float = 600.0,
+) -> dict:
+    """Poll a job to completion, rendering a live progress bar (phase + %)
+    instead of ``client.poll_job``'s silent loop — which, combined with the
+    default INFO log level, used to stream one raw HTTP request/response log
+    line to the console per poll (every 2s) rather than showing progress.
+
+    Temporarily silences the ``httpx`` logger regardless of the configured
+    log level — a log line printed mid-poll would corrupt the live-updating
+    bar's terminal redraw (rich's ``Progress`` assumes exclusive control of
+    the current line while its context is open).
+    """
+    import logging
+    import time
+    from rich.progress import BarColumn, Progress, TextColumn, TimeElapsedColumn
+
+    httpx_logger = logging.getLogger("httpx")
+    prev_level = httpx_logger.level
+    httpx_logger.setLevel(logging.WARNING)
+    deadline = time.monotonic() + timeout
+    try:
+        with Progress(
+            TextColumn("[bold]{task.description}"),
+            BarColumn(),
+            TextColumn("{task.percentage:>3.0f}%"),
+            TextColumn("[dim]{task.fields[phase]}"),
+            TimeElapsedColumn(),
+            transient=True,
+        ) as progress:
+            task = progress.add_task(label, total=100, phase="")
+            while True:
+                job = client.get_job(job_id)
+                status = job.get("status", "")
+                pct = job.get("progress_pct") or 0
+                phase = job.get("current_phase") or status
+                progress.update(task, completed=pct, phase=phase)
+                if status in ("done", "failed", "cancelled"):
+                    progress.update(task, completed=100 if status == "done" else pct)
+                    return job
+                if time.monotonic() >= deadline:
+                    raise TimeoutError(f"Job {job_id} did not complete within {timeout}s")
+                time.sleep(interval)
+    finally:
+        httpx_logger.setLevel(prev_level)
+
+
+def get_client(remote: Optional[str]):
+    from ravmem.client.api import RavMemClient
+    from ravmem.client.config import load_config
+
+    url = remote
+    api_key = None
+    if not url:
+        cfg = load_config()
+        url = cfg.get("server_url")
+        api_key = cfg.get("api_key")
+    if not url:
+        typer.echo(
+            "No server configured. Run: ravmem remote config --url <URL>",
+            err=True,
+        )
+        raise typer.Exit(1)
+    return RavMemClient(base_url=url, api_key=api_key or None)

ravmem_cli-1.1.0/ravmem/cli/_errors.py

@@ -0,0 +1,160 @@
+"""Shared CLI error-handling utilities.
+
+All CLI modules import from here so every command surfaces the same
+clean, human-readable messages instead of raw Python tracebacks.
+"""
+from __future__ import annotations
+
+import typer
+
+
+def _extract_detail(exc) -> str:
+    """Pull the best human-readable string out of an httpx HTTP error body."""
+    try:
+        body = exc.response.json()
+        if isinstance(body, dict):
+            detail = body.get("detail") or body.get("message") or body.get("error")
+            if isinstance(detail, list):
+                # FastAPI validation error list - join the loc + msg pairs
+                parts = []
+                for item in detail:
+                    loc = " -> ".join(str(x) for x in item.get("loc", []))
+                    msg = item.get("msg", "")
+                    parts.append(f"{loc}: {msg}" if loc else msg)
+                return "; ".join(parts)
+            if detail:
+                return str(detail)
+        return exc.response.text or str(exc)
+    except Exception:
+        return exc.response.text or str(exc)
+
+
+def handle_error(exc: Exception, server_url: str = "") -> None:
+    """Print a clean, user-friendly error message to stderr.
+
+    Does NOT raise - callers are responsible for raising typer.Exit(1) after.
+    """
+    import httpx
+
+    if isinstance(exc, (httpx.ConnectError, httpx.ConnectTimeout)):
+        target = server_url
+        if not target:
+            try:
+                target = str(exc.request.url) if exc.request else ""
+            except Exception:
+                pass
+        target = target or "the server"
+        typer.echo(
+            f"Error: Cannot connect to {target}.\n"
+            "  Is the server running? Check: ravmem health",
+            err=True,
+        )
+    elif isinstance(exc, httpx.TimeoutException):
+        typer.echo(
+            "Error: Request timed out. The server may be overloaded or unreachable.",
+            err=True,
+        )
+    elif isinstance(exc, httpx.RemoteProtocolError):
+        typer.echo(
+            f"Error: Invalid response from server - {exc}",
+            err=True,
+        )
+    elif isinstance(exc, httpx.HTTPStatusError):
+        code = exc.response.status_code
+        detail = _extract_detail(exc)
+        if code == 400:
+            typer.echo(f"Error: Bad request - {detail}", err=True)
+        elif code == 401:
+            typer.echo(
+                "Error: Not authenticated.\n"
+                "  Set an API token with: ravmem remote config --api-key <TOKEN>\n"
+                "  Or log in with:        ravmem auth login",
+                err=True,
+            )
+        elif code == 403:
+            # Distinguish entitlement enforcement errors from plain RBAC denials
+            event_code = ""
+            try:
+                body = exc.response.json()
+                if isinstance(body.get("detail"), dict):
+                    event_code = body["detail"].get("event_code", "")
+                    detail = body["detail"].get("message", detail)
+            except Exception:
+                pass
+            _ENTITLEMENT_HINTS: dict[str, str] = {
+                "ENTITLEMENT_PROJECTS_LIMIT": (
+                    "You have reached the project limit for your plan. "
+                    "Delete an existing project or upgrade your plan."
+                ),
+                "ENTITLEMENT_LOC_LIMIT": (
+                    "You have reached the lines-of-code limit for your plan. "
+                    "Remove a project or upgrade your plan."
+                ),
+                "ENTITLEMENT_KG_NODE_LIMIT": (
+                    "You have reached the knowledge graph node limit for your plan. "
+                    "Deactivate unused nodes or upgrade your plan."
+                ),
+                "ENTITLEMENT_USER_LIMIT": (
+                    "You have reached the user limit for your plan. "
+                    "Remove a user or upgrade your plan to add more seats."
+                ),
+                "ENTITLEMENT_SINGLE_USER_MODE": (
+                    "User management is disabled on this installation (single-user mode). "
+                    "Upgrade your plan to add more users."
+                ),
+                "ENTITLEMENT_CROSSGRAPH_DISABLED": (
+                    "Cross-graph linking is not available on your plan. "
+                    "Upgrade to Pro or higher."
+                ),
+                "ENTITLEMENT_OBSERVABILITY_DISABLED": (
+                    "Full observability/metrics are not available on your plan. "
+                    "Upgrade to Pro or higher."
+                ),
+                "ENTITLEMENT_AUDIT_LOGS_DISABLED": (
+                    "Audit logs are not available on your plan. "
+                    "Upgrade to Team or higher."
+                ),
+                "ENTITLEMENT_OIDC_DISABLED": (
+                    "OIDC authentication is not available on your plan. "
+                    "Contact ravmem for Enterprise licensing."
+                ),
+                "ENTITLEMENT_CONNECTIONS_LIMIT": (
+                    "Too many concurrent connections for your plan. "
+                    "Retry shortly or upgrade your plan."
+                ),
+            }
+            hint = _ENTITLEMENT_HINTS.get(event_code)
+            if hint:
+                typer.echo(f"Error: License limit — {detail}\n  Hint: {hint}", err=True)
+            else:
+                typer.echo(
+                    f"Error: Permission denied - {detail}\n"
+                    "  Ask an admin to grant the necessary role.",
+                    err=True,
+                )
+        elif code == 404:
+            typer.echo(f"Error: Not found - {detail}", err=True)
+        elif code == 409:
+            typer.echo(f"Error: Conflict - {detail}", err=True)
+        elif code == 422:
+            typer.echo(f"Error: Invalid request parameters - {detail}", err=True)
+        elif code == 429:
+            typer.echo(
+                "Error: Rate limit exceeded - too many requests. Wait a moment and retry.",
+                err=True,
+            )
+        elif code == 500:
+            typer.echo(f"Error: Server error - {detail}", err=True)
+        elif code == 503:
+            typer.echo(
+                f"Error: Server unavailable - {detail}\n"
+                "  Possible causes:\n"
+                "    - License not activated: run 'ravmem license init'\n"
+                "    - ArcadeDB is still starting up\n"
+                "  Check server status with: ravmem health",
+                err=True,
+            )
+        else:
+            typer.echo(f"Error {code}: {detail}", err=True)
+    else:
+        typer.echo(f"Error: {exc}", err=True)

{ravmem_cli-0.1.0 → ravmem_cli-1.1.0}/ravmem/cli/analyze.py

@@ -8,6 +8,8 @@ from typing import Optional
 
 import typer
 
+from ravmem.cli._common import get_client as _get_client_shared
+from ravmem.client.api import handle_api_error
 from ravmem.config import DEFAULT_LANGS
 
 # Extensions whose content is never useful for the code-graph pipeline.
@@ -38,38 +40,25 @@ _CLI_MAX_FILE_BYTES = 5 * 1024 * 1024
 
 
 def _get_client(remote: str | None):
-    from ravmem.client.api import RavMemClient
-    from ravmem.client.config import load_config
-
-    url = remote
-    api_key = None
-    if not url:
-        cfg = load_config()
-        url = cfg.get("server_url")
-        api_key = cfg.get("api_key")
-    if not url:
-        typer.echo(
-            "Error: No server configured. "
-            "Run `ravmem remote config --url <URL>` or pass --remote <URL>.",
-            err=True,
-        )
-        raise typer.Exit(1)
-    return RavMemClient(base_url=url, api_key=api_key or None)
+    return _get_client_shared(remote)
 
 
 def _print_job_result(job: dict) -> None:
     status = job.get("status", "unknown")
     if status == "done":
-        typer.echo(f"✓ Indexing complete (job {job.get('job_id', '?')}).")
+        typer.echo(f"✓ Indexing complete (job {job.get('id', job.get('job_id', '?'))}).")
     elif status == "failed":
         typer.echo(
-            f"✗ Indexing failed (job {job.get('job_id', '?')}): "
+            f"✗ Indexing failed (job {job.get('id', job.get('job_id', '?'))}): "
             f"{job.get('failure_reason', 'unknown')}",
             err=True,
         )
         raise typer.Exit(1)
     else:
-        typer.echo(f"Job {job.get('job_id', '?')} ended with status: {status}")
+        typer.echo(f"Job {job.get('id', job.get('job_id', '?'))} ended with status: {status}")
+
+    from ravmem.cli._common import print_embed_job_summary
+    print_embed_job_summary(job)
 
 
 def _analyze_upload(
@@ -81,6 +70,7 @@ def _analyze_upload(
     batch_size: int,
     lang_list: list[str],
     wait: bool,
+    wait_for: str = "graph",
 ) -> None:
     """Upload committed files to the server in batches and trigger indexing."""
     from ravmem.cli.git_local import ls_files, rev_parse, LocalGitError
@@ -171,7 +161,8 @@ def _analyze_upload(
 
     if wait:
         typer.echo("Waiting for completion…")
-        job = client.poll_job(job_id)
+        from ravmem.cli._common import wait_for_indexing
+        job = wait_for_indexing(client, project_id, branch_name, job_id, wait_for)
         _print_job_result(job)
 
 
@@ -184,6 +175,7 @@ def _analyze_incremental_upload(
     batch_size: int,
     lang_list: list[str],
     wait: bool,
+    wait_for: str = "graph",
 ) -> None:
     """Upload only the files changed since the last index, plus a deletion list."""
     from ravmem.cli.git_local import diff_name_status, rev_parse, LocalGitError
@@ -208,6 +200,7 @@ def _analyze_incremental_upload(
             batch_size=batch_size,
             lang_list=lang_list,
             wait=wait,
+            wait_for=wait_for,
         )
         return
 
@@ -295,7 +288,8 @@ def _analyze_incremental_upload(
 
     if wait:
         typer.echo("Waiting for completion…")
-        job = client.poll_job(job_id)
+        from ravmem.cli._common import wait_for_indexing
+        job = wait_for_indexing(client, project_id, branch_name, job_id, wait_for)
         _print_job_result(job)
 
 
@@ -308,6 +302,7 @@ def _analyze_server_side(
     wait: bool,
     yes: bool,
     no_auto_sync: bool = False,
+    wait_for: str = "graph",
 ) -> None:
     """Trigger server-side indexing (mount / clone projects)."""
     # Pre-flight divergence check
@@ -354,7 +349,8 @@ def _analyze_server_side(
 
     if wait and job_id is not None:
         typer.echo("Waiting for completion…")
-        job = client.poll_job(job_id)
+        from ravmem.cli._common import wait_for_indexing
+        job = wait_for_indexing(client, project_id, branch_name, job_id, wait_for)
         _print_job_result(job)
 
 
@@ -388,6 +384,13 @@ def analyze_cmd(
         help="Set/update the project's default/parent branch",
     ),
     wait: bool = typer.Option(False, "--wait", "-w", help="Wait for indexing to complete"),
+    wait_for: str = typer.Option(
+        "graph", "--wait-for",
+        help="What --wait waits for: 'graph' (structure/impact ready — default), "
+             "'embed' (semantic search ready), or 'both'. Embedding is decoupled "
+             "into its own job by default on the server, so 'graph' now returns "
+             "~8x faster than the old single-job wait.",
+    ),
     yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompts (CI/scripts)"),
     no_auto_sync: bool = typer.Option(
         False, "--no-auto-sync",
@@ -395,7 +398,39 @@ def analyze_cmd(
              "Use when you know the workspace is already up to date.",
     ),
 ) -> None:
-    """Index a repository — detects upload/clone/mount mode from the project registration."""
+    """Index a repository (auto-detects mode from the project registration).
+
+    \b
+    Register your project first with `ravmem remote add`, then run this command.
+
+    \b
+    Mode behaviour:
+      upload  — CLI reads committed files locally and pushes them to the server.
+                The project must be registered without --git-url and without --mount.
+                Only committed files are indexed; commit before running.
+      clone   — Server pulls from the git remote it cloned at registration.
+                No local files are uploaded. Use `ravmem remote clone` for first run.
+      mount   — Server reads directly from the mounted path. No upload needed.
+
+    \b
+    Quick-start examples:
+      # Upload mode (local repo → server)
+      ravmem remote add /my/repo --name myproject
+      ravmem analyze /my/repo --project myproject --wait
+
+      # Clone mode (server pulls from GitHub)
+      ravmem remote add --git-url https://github.com/org/repo --name myproject
+      ravmem remote clone --project myproject --wait
+      ravmem analyze --project myproject --incremental --wait  # subsequent runs
+
+      # Mount mode (repo already on the server filesystem)
+      ravmem remote add /server/path/repo --name myproject --mount
+      ravmem analyze --project myproject --wait
+    """
+
+    if wait_for not in ("graph", "embed", "both"):
+        typer.echo(f"✗ --wait-for must be one of: graph, embed, both (got '{wait_for}')", err=True)
+        raise typer.Exit(1)
 
     repo_path = repo.resolve()
 
@@ -454,6 +489,7 @@ def analyze_cmd(
                     batch_size=batch_size,
                     lang_list=lang_list,
                     wait=wait,
+                    wait_for=wait_for,
                 )
             else:
                 _analyze_upload(
@@ -465,6 +501,7 @@ def analyze_cmd(
                     batch_size=batch_size,
                     lang_list=lang_list,
                     wait=wait,
+                    wait_for=wait_for,
                 )
         else:
             # mount or clone — server-side indexing
@@ -478,6 +515,7 @@ def analyze_cmd(
                 wait=wait,
                 yes=yes,
                 no_auto_sync=no_auto_sync,
+                wait_for=wait_for,
             )
 
     finally:

ravmem_cli-1.1.0/ravmem/cli/audit.py

@@ -0,0 +1,83 @@
+"""ravmem audit — audit log management commands."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import typer
+
+from ravmem.cli._common import get_client
+from ravmem.cli._errors import handle_error
+
+
+def audit_list_cmd(
+    limit: int = typer.Option(50, "--limit", "-n", help="Max entries to return"),
+    user: Optional[str] = typer.Option(None, "--user", "-u", help="Filter by user ID"),
+    action: Optional[str] = typer.Option(None, "--action", "-a", help="Filter by action name"),
+    remote: Optional[str] = typer.Option(None, "--remote", help="Server URL override"),
+    output_json: bool = typer.Option(False, "--json", help="Raw JSON output"),
+) -> None:
+    """List audit log entries (admin only)."""
+    import json
+    from rich.console import Console
+    from rich.table import Table
+    from rich import box
+
+    client = get_client(remote)
+    try:
+        entries = client.list_audit(limit=limit, user_id=user, action=action)
+    except Exception as exc:
+        handle_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    if output_json:
+        typer.echo(json.dumps(entries, indent=2, default=str))
+        return
+
+    if not entries:
+        typer.echo("No audit entries found.")
+        return
+
+    console = Console()
+    t = Table(box=box.SIMPLE, show_header=True, header_style="bold",
+              title=f"Audit log ({len(entries)} entries)")
+    t.add_column("Time", width=19)
+    t.add_column("User", width=16)
+    t.add_column("Action", width=20)
+    t.add_column("Resource", width=30)
+    t.add_column("Result", width=8)
+
+    for e in entries:
+        result_color = "green" if e.get("result") == "ok" else "red"
+        t.add_row(
+            str(e.get("timestamp", ""))[:19],
+            str(e.get("user_id", ""))[:16],
+            str(e.get("action", ""))[:20],
+            str(e.get("resource", ""))[:30],
+            f"[{result_color}]{e.get('result', '?')}[/{result_color}]",
+        )
+    console.print(t)
+
+
+def audit_rotate_cmd(
+    retain_days: int = typer.Option(90, "--retain-days", help="Keep entries newer than N days"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
+    remote: Optional[str] = typer.Option(None, "--remote", help="Server URL override"),
+) -> None:
+    """Rotate audit logs, discarding entries older than --retain-days (admin only)."""
+    if not yes:
+        typer.confirm(f"Rotate audit log (keep last {retain_days} days)?", abort=True)
+
+    client = get_client(remote)
+    try:
+        result = client.rotate_audit()
+    except Exception as exc:
+        handle_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    removed = result.get("removed", result.get("deleted", "?"))
+    typer.echo(f"Audit log rotated. Entries removed: {removed}")