Add auth attempt export downloads to pscale audit-log

[bwarminski]

This adds an auth-attempts download subcommand to audit-log that will download auth attempts from the upcoming API endpoint.

It includes:

• some reuse of the presigned URL logic used for query bundles
• some friendliness in the arguments and output destinations for humans and agents so you don't need the exact timestamp formats

Help Output

/tmp/auth-attempt-export-cli-smoke-1/cli ❯ ./pscale audit-log auth-attempts download --help                                                    03:27:41 PM
!! WARNING: You are using a self-compiled binary which is not officially supported.
!! To dismiss this warning, set PSCALE_DISABLE_DEV_WARNING=true

Generate an authentication-attempt export for a UTC time window, wait for it to be ready, and download its ZIP artifact. Use --since with a positive duration (24h, 7d, or 2w), or use --start-at and optionally --end-at. Named values and zone-less timestamps use the local timezone; requests are sent in UTC.

Usage:
  pscale audit-log auth-attempts download [flags]

Examples:
  # Export the last 24 hours.
	  pscale audit-log auth-attempts download --since 24h

	  # Export from local midnight yesterday through now.
	  pscale audit-log auth-attempts download --start-at yesterday

	  # Export a date-only window.
	  pscale audit-log auth-attempts download --start-at 2026-07-28 --end-at 2026-07-29

	  # Zone-less local ISO timestamps can use T or a space.
	  pscale audit-log auth-attempts download --start-at '2026-07-29 16:00' --end-at '2026-07-29 17:00'

	  # RFC3339 timestamps may include any explicit offset.
	  pscale audit-log auth-attempts download \
	    --start-at 2026-07-29T00:00:00Z --end-at 2026-07-29T01:00:00Z

	  # Export denied attempts from two addresses during a UTC window.
	  pscale audit-log auth-attempts download \
	    --start-at 2026-07-29T00:00:00Z --end-at 2026-07-29T01:00:00Z \
	    --source-ip 203.0.113.0/24 --source-ip 2001:db8::/32

Flags:
      --backend-route strings          Backend route: postgres, pgbouncer, unknown
      --branch strings                 Branch public ID or database/branch name (repeat or comma-separate)
      --end-at string                  Exclusive end: now, today, yesterday, YYYY-MM-DD, local ISO, or RFC3339; defaults to now
      --export-format string           Artifact format: jsonl, csv, parquet; defaults from --format (human/csv -> csv, json -> JSONL; parquet is explicit)
      --failure-reason strings         Failure reason: bad_password, unknown_user, authorization_failed, ip_not_allowed, other
  -h, --help                           help for download
      --outcome strings                Authentication outcome: allow or deny
      --output string                  Output file name, or - to write raw ZIP bytes to stdout
      --since string                   Export window ending now: positive duration such as 24h, 7d, or 2w
      --source-ip strings              Source IP address or CIDR range (repeat or comma-separate)
      --start-at string                Inclusive start: now, today, yesterday, YYYY-MM-DD, local ISO, or RFC3339
      --startup-database stringArray   Startup database name (repeatable)
      --username stringArray           Authentication username (repeatable; commas are part of the name, not separators)

Global Flags:
      --api-token string          The API token to use for authenticating against the PlanetScale API.
      --api-url string            The base URL for the PlanetScale API. (default "https://api.planetscale.com/")
      --config string             Config file (default is $HOME/.config/planetscale/pscale.yml)
      --debug                     Enable debug mode
  -f, --format string             Show output in a specific format. Possible values: [human, json, csv] (default "human")
      --no-color                  Disable color output
      --org string                The organization for the current user
      --service-token string      Service Token for authenticating.
      --service-token-id string   The Service Token ID for authenticating.

Agents: run "pscale agent-guide --format json" for machine-readable guidance, or "pscale help agents" to read the full guide.

Verification

In addition to tests, ran locally with some fixture data for artifacts and validated each output format.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0f8ce57. Configure here.}

[cursor]

Fractional RFC3339 timestamps rejected

Low Severity

--start-at / --end-at parse zoned times with time.RFC3339, which rejects fractional seconds. Common RFC3339 values like 2026-07-29T00:00:00.123Z fail even though the help advertises RFC3339 input.

 

^{Reviewed by Cursor Bugbot for commit 0f8ce57. Configure here.}