feat: support Platform API 1.167 features (audit logs, IdP groups, SCIM, Intelligent Compute)

[cristianrcv]

Summary

Exposes features introduced in Platform API 1.167.0: admin audit logs, organization IdP groups and SCIM, linking teams to IdP groups, and the first Intelligent Compute tuning options.

This is one PR in a stack that catches tw up with Platform API 1.230.0: one PR per API version that introduced the features, then one PR per topic for agents and actions, which are grouped across versions so they're easier to review.

• Stack: master → 1.101 (feat: support Platform API 1.101 features (catch-up backlog) #685) → 1.113 (feat: support Platform API 1.113 features (SSH keys) #686) → 1.145 (feat: support Platform API 1.145 features (roles, folder mounts, linked datasets) #697) → 1.167 (feat: support Platform API 1.167 features (audit logs, IdP groups, SCIM, Intelligent Compute) #698) → 1.190 (feat: add 'tw info versions' and studio stars #699) → 1.200 (feat: add the lineage commands and studio logs #700) → 1.230 (fix(launch): stop launch --wait duplicate runs and support API 1.230 options [COMP-2645] #701) → agents (feat: add the agents and service-accounts command groups #702) → actions (feat(actions): add bucket, cron and pipeline-status sources and trigger history #703). This PR is based on feat: support Platform API 1.145 features (roles, folder mounts, linked datasets) #697; the next one is feat: add 'tw info versions' and studio stars #699. (There is no 1.150 PR: its only feature, cron actions, is in feat(actions): add bucket, cron and pipeline-status sources and trigger history #703.)
• SDK: unchanged. tw stays on tower-java-sdk 1.200.0, which already contains every API element used here. The 1.230 PR bumps it.

Changes

• feat(compute-envs): add Intelligent Compute options to cloud platforms (388c307)
• feat(organizations): add IdP group and SCIM commands (7ece82e)
• feat(teams): link teams to IdP groups (497d1a9)
• feat(audit-logs): add audit-logs command (24f17fe)
• fix(audit-logs): delete the downloaded CSV after export (b5e9185)
• docs: document the commands and options added for API 1.167 (46f67e2)
• build(native): register reflection metadata for the API 1.167 commands (24a2d7e)

Notes for review

• Audit logs: --state is only offered on audit-logs export. The SDK (1.200.0 and 1.230.0) cannot deserialize the AuditLogTargetStateNewState oneOf, which ignores its discriminator. export downloads into a temp file, which is always deleted.
• Intelligent Compute: --prediction-model, --nvme-storage, --backend-strategy and the warm-pool options match the UI. In the Platform code I read, they are stored but not yet acted on.

Verification

• ./gradlew test: 890 tests, 0 failures. Every new command and option has MockServer tests that assert the request (method, path, query, body) and the output.
• CI runs the full suite against the native binary on Linux, macOS and Windows.

🤖 Generated with Claude Code

[educalleja]

Usage of the new commands and options

This PR adds three new command groups (tw audit-logs, tw organizations idp-groups and tw organizations scim), IdP group options for tw teams add|update, and new Intelligent Compute (Seqera scheduler) options for tw compute-envs add aws-cloud|azure-cloud|google-cloud.

1. tw audit-logs (new)

"Inspect the installation audit logs." Every subcommand requires a root user (platform administrator). None of them take a workspace or organization option, because the logs cover the whole installation.

tw audit-logs list

Lists audit logs, newest first.

Option	Description
--after	Show only logs on or after this ISO-8601 date-time, such as 2026-01-31T00:00:00Z
--before	Show only logs on or before this ISO-8601 date-time, such as 2026-01-31T23:59:59Z
--max	Maximum number of logs per page
--page-token	Token of the page to show, as printed by a previous list with the same filters

• The output is a table with ID, Timestamp, Event, Actor, Target type and Target name.
• When there are more logs, it prints "More logs available, use: --page-token <token>". Pagination uses this token, not the usual --page / --offset options.

tw audit-logs view

Shows one audit log.

Option	Description
-i, --id	Audit log ID (required)

• The output shows ID, Timestamp, Event, Correlation ID, Actor, Actor email, Actor type, Client IP, User agent, Target type, Target ID, Target name, Organization and Workspace. If the log includes the target's state, it's printed as JSON.

tw audit-logs export

Exports audit logs as CSV. It fails when too many logs match, so narrow the date range if that happens.

Option	Description
--after / --before	Same date-time filters as list
--state	Include the state of each target before and after the change. Requires the audit state images feature
-o, --output	CSV file to write. Without it, the CSV is printed to stdout

• With -o, it prints "Audit logs exported to '<file>'".
• --state is only offered on export (see the PR's review notes).

tw audit-logs export --after 2026-09-01T00:00:00Z --before 2026-09-30T23:59:59Z -o september.csv

2. tw organizations idp-groups (new)

Manages the organization's list of IdP groups, which teams can be linked to. Requires IdP claims mapping to be enabled for the organization. Every subcommand requires -o, --organization (organization name or numeric ID).

Command	Description	Other options
list	Lists IdP groups, both those pushed by SCIM and those added manually. Columns: ID, Name, Source	None
add	Adds an IdP group manually	-n, --name (required): must exactly match the value your IdP sends in the groups claim
delete	Deletes a manually added IdP group. Groups pushed by SCIM can't be deleted	-i, --id / -n, --name: exactly one is required

• For delete by name, an unknown name fails with "IdP group '<name>' not found in organization '<orgId>'".

3. tw organizations scim (new)

Manages SCIM provisioning for the organization. Requires IdP claims mapping to be enabled for the organization. Every subcommand takes only -o, --organization (required).

Command	Description
view	Shows the SCIM configuration and token status: Endpoint URL, SSO active, Active token, Token (masked), Token created, Token last used and Groups (count)
create-token	Generates a SCIM bearer token. It revokes the active token, if there is one. The token is shown only once, with the SCIM endpoint URL
rotate-token	Revokes the active SCIM bearer token and generates a new one. The token is shown only once
revoke-token	Revokes the active SCIM bearer token

4. tw teams add|update: link teams to IdP groups

Command	Option	Description
add, update	--idp-group	Link the team to this IdP group, by its name as shown by tw organizations idp-groups list. The IdP then manages team membership
update	--unlink-idp-group	Remove the IdP group link so team members can be managed manually again

• On update, --idp-group and --unlink-idp-group can't be used together.
• tw teams view now shows the team's IdP group.

5. tw compute-envs add: Intelligent Compute options

New options in the "Scheduler options" group, next to the existing --sched-enabled, --provisioning-model and --sched-machine-types.

Option	aws-cloud	azure-cloud	google-cloud	Description
--prediction-model	✓	✓	✓	Model the scheduler uses to predict task resource requirements. Suggested values: none, qr/v1, qr/v2, qr/v3. If you leave it out, the scheduler default (none) applies
--nvme-storage	✓	✓	✓	Only use instance types with local SSD (NVMe) storage, for faster I/O
--backend-strategy	✓			Backend the scheduler runs tasks on: ECS (AWS ECS runs the tasks) or EC2 (tasks run directly on EC2 instances)
--warm-pool	✓			Keep a pool of idle VMs ready to take incoming tasks with minimal start latency. Requires --warm-pool-size. Only applies with --backend-strategy EC2
--warm-pool-size	✓			Number of idle VMs to keep in the warm pool. Must be greater than zero
--warm-pool-scale-to-zero <seconds>	✓			Seconds of inactivity after which the warm pool scales to zero. 0 means it never scales to zero

• --warm-pool without a --warm-pool-size greater than zero fails with "Option --warm-pool requires --warm-pool-size greater than zero."
• Per the PR's review notes, --prediction-model, --nvme-storage, --backend-strategy and the warm-pool options are stored by Platform but not yet acted on.

USAGE.md

• "Teams and quotas" is renamed to "Teams, IdP groups and SCIM", with entries for --idp-group / --unlink-idp-group, tw organizations idp-groups list|add|delete and tw organizations scim view|create-token|rotate-token|revoke-token.
• A new "Audit logs" section, with the export example above.
• A bullet for the Intelligent Compute options on aws-cloud, azure-cloud and google-cloud.

🤖 Generated with Claude Code