CLI: agentic-auth audit
Read-only archival of the append-only audit log. It never deletes anything — a command that could remove audit rows is a mutation path this tool deliberately does not have. Purging after an export is a separate, documented, owner-run maintenance step.
audit export --before RFC3339 --out FILE [--database-url URL]
Exports every row with ts < --before to --out as JSON lines, oldest first, paging
internally so an arbitrarily large table never loads into memory at once. --database-url
defaults to AGENTIC_AUTH_DATABASE_URL.
agentic-auth audit export --before 2026-01-01T00:00:00Z --out archive.jsonl