From 4ae57bdb6b48091abd97af7499e295b4592df6b9 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Sat, 15 Aug 2026 21:17:34 -0400
Subject: [PATCH] =?UTF-8?q?docs(cli):=20row=2076=20=E2=80=94=20audit-confi?=
 =?UTF-8?q?g=20query=20JSON=20sample=20shows=20afterStateJson=20+=20bundle?=
 =?UTF-8?q?ImportId?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `entries` array is a serialized `AuditLogEntry`, so both fields are always
on the wire; the README sample showed neither, which read as if the payload
were the seven columns the table projection happens to keep. Row 57 added that
projection and the table section already names both omitted fields — the JSON
sample above it was the stale half.

Added both to the sample and documented their nullability, which is the part a
script author actually needs: `afterStateJson` is the post-change snapshot
embedded as a string and is null for deletes (no after-state), `bundleImportId`
is the import session id when the change came from `transport import` and null
for a direct change. Also grew the sample from one entry to two so it now
mirrors the table-output sample directly below it row for row — the same 412
Template/Created and 413 ExternalSystem/Deleted pair — which is what makes the
"the table drops these two fields" sentence checkable against the JSON above it.

Docs only.
---
 src/ZB.MOM.WW.ScadaBridge.CLI/README.md | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/ZB.MOM.WW.ScadaBridge.CLI/README.md b/src/ZB.MOM.WW.ScadaBridge.CLI/README.md
index 5e9a4e38..0555e0dc 100644
--- a/src/ZB.MOM.WW.ScadaBridge.CLI/README.md
+++ b/src/ZB.MOM.WW.ScadaBridge.CLI/README.md
@@ -1829,13 +1829,32 @@ Output shape:
       "entityType": "Template",
       "entityId": "7",
       "entityName": "PumpTemplate",
-      "timestamp": "2026-08-15T12:00:00+00:00"
+      "afterStateJson": "{\"Id\":7,\"Name\":\"PumpTemplate\",\"FolderId\":3}",
+      "timestamp": "2026-08-15T12:00:00+00:00",
+      "bundleImportId": null
+    },
+    {
+      "id": 413,
+      "user": "designer",
+      "action": "Deleted",
+      "entityType": "ExternalSystem",
+      "entityId": "3",
+      "entityName": "MES",
+      "afterStateJson": null,
+      "timestamp": "2026-08-15T12:05:00+00:00",
+      "bundleImportId": "9f2c1e40-5b31-4a7e-8d66-0c1a4b93ff21"
     }
   ],
   "totalCount": 137
 }
 ```
 
+Both nullable fields are always present on the wire. `afterStateJson` is a JSON snapshot
+of the entity's state *after* the change, embedded as a string — it is `null` for deletes,
+since there is no after-state. `bundleImportId` is the import session id when the change
+was made by a bundle import (`transport import`), and `null` for a change made directly;
+it is the join key for "what did this bundle actually change".
+
 `totalCount` is the unpaged number of rows matching the filters, so a client can page
 without a second call. JSON is the primary format for this command and is what scripts
 should consume — it is never altered by the table projection below.