@prism-d1/cli 1.0.66 → 1.0.67

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -187,7 +187,7 @@ export class DashboardStack extends cdk.Stack {
 
     teamDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'AI Input Tokens per PR',
+        title: 'AI Input Tokens',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -202,7 +202,7 @@ export class DashboardStack extends cdk.Stack {
         leftYAxis: { min: 0, label: 'Tokens' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'AI Output Tokens per PR',
+        title: 'AI Output Tokens',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -217,7 +217,7 @@ export class DashboardStack extends cdk.Stack {
         leftYAxis: { min: 0, label: 'Tokens' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'AI Cost per PR (USD)',
+        title: 'AI Cost (USD)',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -233,6 +233,44 @@ export class DashboardStack extends cdk.Stack {
       }),
     );
 
+    // Cost breakdowns by Tool and Model. SEARCH expressions auto-discover
+    // every dimension value, so new tools/models appear without dashboard
+    // changes. These series are populated by the otel-metrics-publisher
+    // (requires -c enableOtelCollector=true); the trailer path has no
+    // per-tool/per-model breakdown and leaves these widgets empty.
+    teamDashboard.addWidgets(
+      new cloudwatch.GraphWidget({
+        title: 'AI Cost by Tool (USD)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: `SEARCH('{${METRIC_NAMESPACE},Tool} MetricName="AICostUSD"', 'Sum')`,
+            usingMetrics: {},
+            label: '',
+            period: DEFAULT_PERIOD,
+          }),
+        ],
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
+        legendPosition: cloudwatch.LegendPosition.RIGHT,
+      }),
+      new cloudwatch.GraphWidget({
+        title: 'AI Cost by Model (USD)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: `SEARCH('{${METRIC_NAMESPACE},Model} MetricName="AICostUSD"', 'Sum')`,
+            usingMetrics: {},
+            label: '',
+            period: DEFAULT_PERIOD,
+          }),
+        ],
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
+        legendPosition: cloudwatch.LegendPosition.RIGHT,
+      }),
+    );
+
     teamDashboard.addWidgets(
       new cloudwatch.TextWidget({
         markdown: '### Agent Operations',

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -441,11 +441,20 @@ async function publishCloudWatchMetrics(
       ['PostMergeDefectRate', detail.ai_dora.post_merge_defect_rate, StandardUnit.Percent, true],
       ['EvalGatePassRate', detail.ai_dora.eval_gate_pass_rate, StandardUnit.Percent, true],
       ['AITestCoverageDelta', detail.ai_dora.ai_test_coverage_delta, StandardUnit.Percent, true],
-      ['AIInputTokens', detail.ai_dora.total_input_tokens, StandardUnit.Count, false],
-      ['AIOutputTokens', detail.ai_dora.total_output_tokens, StandardUnit.Count, false],
-      ['AICostUSD', detail.ai_dora.total_cost_usd, StandardUnit.None, false],
     ];
 
+    // Token & cost metrics come from git-trailer PR sums by default. When the
+    // OTEL collector is enabled (OTEL_ENABLED=true), the otel-metrics-publisher
+    // Lambda owns AIInputTokens / AIOutputTokens / AICostUSD (higher-fidelity
+    // per-span data via `codeburn sync`) — publishing both would double-count.
+    if (process.env.OTEL_ENABLED !== 'true') {
+      aiDoraMap.push(
+        ['AIInputTokens', detail.ai_dora.total_input_tokens, StandardUnit.Count, false],
+        ['AIOutputTokens', detail.ai_dora.total_output_tokens, StandardUnit.Count, false],
+        ['AICostUSD', detail.ai_dora.total_cost_usd, StandardUnit.None, false],
+      );
+    }
+
     for (const [name, value, unit, scaleToPercent] of aiDoraMap) {
       if (value != null) {
         const publishValue = scaleToPercent && value <= 1 ? value * 100 : value;

package/dist/assets/infra/lib/lambda/otel-metrics-publisher.ts

@@ -0,0 +1,185 @@
+/**
+ * PRISM D1 — OTEL metrics publisher.
+ *
+ * Consumes the prism-d1-ai-usage DynamoDB stream (filtered at the event
+ * source to sk begins_with "OTEL#DAY#") and publishes token/cost deltas to
+ * CloudWatch under the same metric names the dashboards already read:
+ * AIInputTokens, AIOutputTokens, AICostUSD.
+ *
+ * Only active when the OTEL collector is enabled — the metrics-processor
+ * stops publishing trailer-sourced token metrics (OTEL_ENABLED=true) so
+ * these series are exclusively OTEL-fed and never double-counted.
+ *
+ * Scale guards (by design):
+ *  - Deltas are exact: OTEL#DAY# items are ADD counters, so delta = NEW − OLD.
+ *  - Metrics are timestamped with the SPAN day, not arrival time. Backfilled
+ *    days older than the CloudWatch ingest window (14 days) are dropped —
+ *    the DynamoDB aggregates and S3 OTLP archive still hold full history.
+ *  - Published dimensionless (matches dashboard widgets) AND with Tool and
+ *    Model dimensions (small, bounded cardinality) for per-tool / per-model
+ *    slicing.
+ *  - Single PutMetricData call per batch, chunked at the API limit.
+ */
+
+import {
+  CloudWatchClient,
+  PutMetricDataCommand,
+  MetricDatum,
+  StandardUnit,
+} from '@aws-sdk/client-cloudwatch';
+
+const cloudwatch = new CloudWatchClient({});
+
+const METRIC_NAMESPACE = process.env.METRIC_NAMESPACE || 'PRISM/D1/Velocity';
+/** CloudWatch rejects datapoints older than 14 days. */
+const MAX_METRIC_AGE_DAYS = 14;
+/** PutMetricData accepts up to 1000 datums per call. */
+const PUT_METRIC_BATCH_SIZE = 1000;
+
+// ---- Types (DynamoDB stream event, trimmed to what we read) ----
+
+interface AttributeValue {
+  S?: string;
+  N?: string;
+}
+
+interface StreamImage {
+  sk?: AttributeValue;
+  day?: AttributeValue;
+  tool?: AttributeValue;
+  model?: AttributeValue;
+  input_tokens?: AttributeValue;
+  output_tokens?: AttributeValue;
+  cost_usd?: AttributeValue;
+}
+
+interface StreamRecord {
+  eventName?: 'INSERT' | 'MODIFY' | 'REMOVE';
+  dynamodb?: {
+    Keys?: { pk?: AttributeValue; sk?: AttributeValue };
+    NewImage?: StreamImage;
+    OldImage?: StreamImage;
+  };
+}
+
+export interface StreamEvent {
+  Records?: StreamRecord[];
+}
+
+// ---- Helpers ----
+
+function num(v: AttributeValue | undefined): number {
+  const n = Number(v?.N ?? 0);
+  return Number.isFinite(n) ? n : 0;
+}
+
+/** Resolve the metric timestamp from the aggregate's span day. Null = drop. */
+export function resolveTimestamp(day: string, now: Date = new Date()): Date | null {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) return null;
+  // Noon UTC keeps the datum inside the calendar day for all dashboard periods.
+  const ts = new Date(`${day}T12:00:00Z`);
+  if (isNaN(ts.getTime())) return null;
+  const ageMs = now.getTime() - ts.getTime();
+  // Too old for CloudWatch ingest (backfilled history) — drop, don't error.
+  if (ageMs > MAX_METRIC_AGE_DAYS * 24 * 60 * 60 * 1000) return null;
+  // Guard against clock skew: never publish a future timestamp.
+  return ts.getTime() > now.getTime() ? now : ts;
+}
+
+interface Delta {
+  day: string;
+  tool: string;
+  model: string;
+  inputTokens: number;
+  outputTokens: number;
+  costUsd: number;
+}
+
+/** Compute the counter delta for one OTEL#DAY# stream record. Null = skip. */
+export function computeDelta(record: StreamRecord): Delta | null {
+  if (record.eventName !== 'INSERT' && record.eventName !== 'MODIFY') return null;
+
+  const newImage = record.dynamodb?.NewImage;
+  const sk = newImage?.sk?.S ?? record.dynamodb?.Keys?.sk?.S ?? '';
+  // Defense in depth — the event source filter should already guarantee this.
+  if (!sk.startsWith('OTEL#DAY#')) return null;
+
+  const oldImage = record.dynamodb?.OldImage;
+  const delta: Delta = {
+    day: newImage?.day?.S ?? sk.split('#')[2] ?? '',
+    tool: newImage?.tool?.S ?? sk.split('#')[3] ?? 'unknown',
+    model: newImage?.model?.S ?? sk.split('#')[4] ?? 'unknown',
+    inputTokens: num(newImage?.input_tokens) - num(oldImage?.input_tokens),
+    outputTokens: num(newImage?.output_tokens) - num(oldImage?.output_tokens),
+    costUsd: num(newImage?.cost_usd) - num(oldImage?.cost_usd),
+  };
+
+  // Nothing to publish (e.g. metadata-only update) or a counter went
+  // backwards (should not happen with ADD — treat defensively as no-op).
+  if (delta.inputTokens <= 0 && delta.outputTokens <= 0 && delta.costUsd <= 0) return null;
+  return delta;
+}
+
+/**
+ * Build datums for a delta across three dimension sets:
+ * dimensionless (dashboards), Tool, and Model. CloudWatch cannot roll up
+ * across dimensions, so each slice needs its own series. Tool and model
+ * cardinality are both small and bounded.
+ */
+export function buildDatums(delta: Delta, timestamp: Date): MetricDatum[] {
+  const metrics: Array<[string, number, StandardUnit]> = [
+    ['AIInputTokens', delta.inputTokens, StandardUnit.Count],
+    ['AIOutputTokens', delta.outputTokens, StandardUnit.Count],
+    ['AICostUSD', delta.costUsd, StandardUnit.None],
+  ];
+
+  const dimensionSets = [
+    [],
+    [{ Name: 'Tool', Value: delta.tool }],
+    [{ Name: 'Model', Value: delta.model }],
+  ];
+
+  const datums: MetricDatum[] = [];
+  for (const [name, value, unit] of metrics) {
+    if (value <= 0) continue;
+    for (const dimensions of dimensionSets) {
+      datums.push({ MetricName: name, Value: value, Unit: unit, Timestamp: timestamp, Dimensions: dimensions });
+    }
+  }
+  return datums;
+}
+
+// ---- Handler ----
+
+export async function handler(event: StreamEvent): Promise<void> {
+  const now = new Date();
+  const datums: MetricDatum[] = [];
+  let processed = 0;
+  let droppedOld = 0;
+
+  for (const record of event.Records ?? []) {
+    const delta = computeDelta(record);
+    if (!delta) continue;
+
+    const timestamp = resolveTimestamp(delta.day, now);
+    if (!timestamp) {
+      droppedOld++;
+      continue;
+    }
+
+    datums.push(...buildDatums(delta, timestamp));
+    processed++;
+  }
+
+  for (let i = 0; i < datums.length; i += PUT_METRIC_BATCH_SIZE) {
+    await cloudwatch.send(new PutMetricDataCommand({
+      Namespace: METRIC_NAMESPACE,
+      MetricData: datums.slice(i, i + PUT_METRIC_BATCH_SIZE),
+    }));
+  }
+
+  console.log(
+    `[otel-metrics-publisher] records=${event.Records?.length ?? 0} ` +
+    `published=${processed} droppedTooOld=${droppedOld} datums=${datums.length}`,
+  );
+}

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -11,8 +11,8 @@
  * newly-seen spans, bucketed by SPAN date, not arrival date).
  *
  * Item shapes in the AI-usage table:
- *   pk=USER#<identity>  sk=SPAN#<timestamp>#<spanId>       raw span, TTL 90d
- *   pk=USER#<identity>  sk=OTEL#DAY#<yyyy-mm-dd>#<tool>    daily aggregate
+ *   pk=USER#<identity>  sk=SPAN#<timestamp>#<spanId>            raw span, TTL 90d
+ *   pk=USER#<identity>  sk=OTEL#DAY#<yyyy-mm-dd>#<tool>#<model> daily aggregate
  */
 
 import {
@@ -272,15 +272,17 @@ async function writeSpanIfNew(user: string, s: ParsedSpan): Promise<boolean> {
 /** ADD-increment the daily aggregate for a newly-seen span (bucketed by SPAN date). */
 async function bumpDailyAggregate(user: string, s: ParsedSpan): Promise<void> {
   const day = s.timestamp.slice(0, 10);
+  // '#' is the key delimiter — strip it from the model to keep the sk parseable.
+  const model = (s.model || 'unknown').replace(/#/g, '');
   await dynamoClient.send(new UpdateItemCommand({
     TableName: AI_USAGE_TABLE,
     Key: {
       pk: { S: `USER#${user}` },
-      sk: { S: `OTEL#DAY#${day}#${s.tool}` },
+      sk: { S: `OTEL#DAY#${day}#${s.tool}#${model}` },
     },
     UpdateExpression:
       'ADD input_tokens :in, output_tokens :out, cost_usd :cost, call_count :one ' +
-      'SET record_type = :rt, tool = :tool, #day = :day, updated_at = :now',
+      'SET record_type = :rt, tool = :tool, model = :model, #day = :day, updated_at = :now',
     ExpressionAttributeNames: { '#day': 'day' },
     ExpressionAttributeValues: {
       ':in': { N: String(s.inputTokens) },
@@ -289,6 +291,7 @@ async function bumpDailyAggregate(user: string, s: ParsedSpan): Promise<void> {
       ':one': { N: '1' },
       ':rt': { S: 'OTEL_DAY' },
       ':tool': { S: s.tool },
+      ':model': { S: model },
       ':day': { S: day },
       ':now': { S: new Date().toISOString() },
     },

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -2,6 +2,8 @@ import * as cdk from 'aws-cdk-lib';
 import * as events from 'aws-cdk-lib/aws-events';
 import * as targets from 'aws-cdk-lib/aws-events-targets';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as eventsources from 'aws-cdk-lib/aws-lambda-event-sources';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as logs from 'aws-cdk-lib/aws-logs';
@@ -133,10 +135,14 @@ export class MetricsPipelineStack extends cdk.Stack {
     // -------------------------------------------------------
     // DynamoDB AI-usage table — user-keyed, KMS encrypted
     // pk = USER#<email>
-    // sk = COMMIT#<ts>#<sha>#<tool> | SPAN#<ts>#<spanId> | OTEL#DAY#<date>#<tool>
+    // sk = COMMIT#<ts>#<sha>#<tool> | SPAN#<ts>#<spanId> | OTEL#DAY#<date>#<tool>#<model>
     // Sparse GSIs (only commit-level items set them) invert the user key so the
     // same table answers by-repo / by-PR / by-commit / global-by-date.
     // -------------------------------------------------------
+    // Read the OTEL collector flag early — it also controls the table stream
+    // and which pipeline owns the token/cost CloudWatch metrics.
+    const enableOtelCollector = this.node.tryGetContext('enableOtelCollector') === 'true';
+
     this.aiUsageTable = new dynamodb.Table(this, 'AiUsageTable', {
       tableName: 'prism-d1-ai-usage',
       partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
@@ -147,6 +153,9 @@ export class MetricsPipelineStack extends cdk.Stack {
       timeToLiveAttribute: 'ttl',
       encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
       encryptionKey: prismKmsKey,
+      // NEW_AND_OLD_IMAGES so the otel-metrics-publisher can compute exact
+      // counter deltas (new − old) on OTEL#DAY# aggregate updates.
+      stream: enableOtelCollector ? dynamodb.StreamViewType.NEW_AND_OLD_IMAGES : undefined,
     });
     for (const [indexName, pkAttr, skAttr] of [
       ['by-repo', 'gsi_repo', 'gsi_repo_sk'],
@@ -222,6 +231,10 @@ export class MetricsPipelineStack extends cdk.Stack {
         EVENTS_TABLE: this.eventsTable.tableName,
         METADATA_TABLE: this.metadataTable.tableName,
         METRIC_NAMESPACE: 'PRISM/D1/Velocity',
+        // When the OTEL collector is enabled, the otel-metrics-publisher owns
+        // AIInputTokens/AIOutputTokens/AICostUSD — the processor skips its
+        // trailer-sourced copies to avoid double-counting.
+        OTEL_ENABLED: enableOtelCollector ? 'true' : 'false',
       },
       logRetention: logs.RetentionDays.ONE_MONTH,
       description: 'Processes PRISM D1 metric events from EventBridge into DynamoDB and CloudWatch',
@@ -295,7 +308,6 @@ export class MetricsPipelineStack extends cdk.Stack {
     // Per-user AI usage flows directly from codeburn sync to the
     // ai-usage table (spans + daily aggregates).
     // -------------------------------------------------------
-    const enableOtelCollector = this.node.tryGetContext('enableOtelCollector') === 'true';
     if (enableOtelCollector) {
       this.otelCollector = new OtelCollectorConstruct(this, 'OtelCollector', {
         aiUsageTable: this.aiUsageTable,
@@ -305,6 +317,97 @@ export class MetricsPipelineStack extends cdk.Stack {
         externalClientId: this.node.tryGetContext('otelClientId') as string | undefined,
         identityClaim: this.node.tryGetContext('otelIdentityClaim') as string | undefined,
       });
+
+      // ---------------------------------------------------
+      // OTEL metrics publisher — DDB stream → CloudWatch.
+      // Replaces the trailer-sourced AIInputTokens/AIOutputTokens/AICostUSD
+      // series with per-span OTEL data (same metric names — dashboards
+      // require no changes). The event-source filter limits invocations to
+      // OTEL#DAY# aggregate updates, so span-volume writes never invoke it.
+      // ---------------------------------------------------
+      const otelPublisherDlq = new sqs.Queue(this, 'OtelPublisherDLQ', {
+        queueName: 'prism-d1-otel-publisher-dlq',
+        encryptionMasterKey: prismKmsKey,
+        enforceSSL: true,
+        retentionPeriod: cdk.Duration.days(14),
+      });
+
+      const otelMetricsPublisher = new lambda.Function(this, 'OtelMetricsPublisher', {
+        functionName: 'prism-d1-otel-metrics-publisher',
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: 'otel-metrics-publisher.handler',
+        ...lambdaVpcProps,
+        code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
+          bundling: {
+            image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+            command: [
+              'bash', '-c',
+              [
+                'npm init -y > /dev/null 2>&1',
+                'npm install --save @aws-sdk/client-cloudwatch esbuild > /dev/null 2>&1',
+                'npx esbuild otel-metrics-publisher.ts --bundle --platform=node --target=node22 --outfile=/asset-output/otel-metrics-publisher.js --external:@aws-sdk/*',
+              ].join(' && '),
+            ],
+            local: {
+              tryBundle(outputDir: string): boolean {
+                try {
+                  const { execSync } = require('child_process');
+                  execSync(
+                    `npx esbuild ${path.join(__dirname, 'lambda', 'otel-metrics-publisher.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'otel-metrics-publisher.js')} --external:@aws-sdk/*`,
+                    { stdio: 'pipe' },
+                  );
+                  return true;
+                } catch {
+                  return false;
+                }
+              },
+            },
+          },
+        }),
+        timeout: cdk.Duration.seconds(60),
+        memorySize: 256,
+        environment: {
+          METRIC_NAMESPACE: 'PRISM/D1/Velocity',
+        },
+        logRetention: logs.RetentionDays.ONE_MONTH,
+        description: 'Publishes OTEL#DAY aggregate deltas from the ai-usage stream as CloudWatch token/cost metrics',
+      });
+
+      otelMetricsPublisher.addToRolePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          actions: ['cloudwatch:PutMetricData'],
+          resources: ['*'],
+          conditions: {
+            StringEquals: {
+              'cloudwatch:namespace': 'PRISM/D1/Velocity',
+            },
+          },
+        }),
+      );
+
+      otelMetricsPublisher.addEventSource(
+        new eventsources.DynamoEventSource(this.aiUsageTable, {
+          startingPosition: lambda.StartingPosition.LATEST,
+          batchSize: 100,
+          maxBatchingWindow: cdk.Duration.seconds(10),
+          bisectBatchOnError: true,
+          retryAttempts: 3,
+          onFailure: new eventsources.SqsDlq(otelPublisherDlq),
+          // Only OTEL#DAY# aggregate inserts/updates — SPAN# and COMMIT#
+          // writes (the overwhelming majority at scale) never invoke us.
+          filters: [
+            lambda.FilterCriteria.filter({
+              eventName: lambda.FilterRule.or('INSERT', 'MODIFY'),
+              dynamodb: {
+                Keys: {
+                  sk: { S: lambda.FilterRule.beginsWith('OTEL#DAY#') },
+                },
+              },
+            }),
+          ],
+        }),
+      );
     }
 
     // -------------------------------------------------------
@@ -737,6 +840,15 @@ export class MetricsPipelineStack extends cdk.Stack {
         reason: 'CDK grantReadData on DynamoDB generates wildcard for GSI index ARNs via token reference',
         appliesTo: ['Resource::<EventsTableD24865E5.Arn>/index/*', 'Resource::<AiUsageTable79F37CE0.Arn>/index/*'],
       },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'DynamoDB stream event source mapping requires ListStreams which does not support resource-level scoping beyond the table stream wildcard',
+        appliesTo: ['Resource::<AiUsageTable79F37CE0.Arn>/stream/*', 'Resource::*'],
+      },
+      {
+        id: 'AwsSolutions-SQS3',
+        reason: 'The OTEL publisher queue is itself a DLQ for the DynamoDB stream event source',
+      },
       { id: 'AwsSolutions-L1', reason: 'All Lambdas use nodejs22.x which is the latest Node.js runtime available' },
     ]);
 

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts

@@ -6,6 +6,7 @@ declare const _default: {
     }[];
     action(opts: {
         global?: boolean;
+        pinIds?: boolean;
     }): Promise<void>;
 };
 export default _default;

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBA4BqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AALzC,wBA8JE"}
+{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBAyNE"}

package/dist/src/commands/bootstrapper/setup-github-oidc.js

@@ -19,10 +19,38 @@ function run(cmd) {
         return { ok: false, stdout: '', stderr: (err.stderr || err.message || '').trim() };
     }
 }
+/**
+ * Fetch a GitHub API path, trying progressively more authenticated clients:
+ * unauthenticated (public repos/users) → GITHUB_TOKEN env → gh CLI token.
+ * Returns the parsed JSON body, or null if every attempt fails.
+ */
+async function githubApi(apiPath) {
+    const tokens = [undefined];
+    if (process.env.GITHUB_TOKEN)
+        tokens.push(process.env.GITHUB_TOKEN);
+    const ghToken = run('gh auth token');
+    if (ghToken.ok && ghToken.stdout)
+        tokens.push(ghToken.stdout);
+    for (const token of tokens) {
+        try {
+            const headers = { Accept: 'application/vnd.github+json' };
+            if (token)
+                headers.Authorization = `Bearer ${token}`;
+            const res = await fetch(`https://api.github.com${apiPath}`, { headers });
+            if (res.ok)
+                return await res.json();
+        }
+        catch {
+            // Network error — try the next credential source.
+        }
+    }
+    return null;
+}
 export default {
     description: 'Set up GitHub OIDC identity provider and IAM role for GitHub Actions',
     options: [
         { flags: '--global', description: 'Create a single role for all repos in the org/user (wildcard sub claim)' },
+        { flags: '--pin-ids', description: 'Pin the trust policy to immutable GitHub owner/repo IDs (protects against namespace resurrection; may require gh CLI or GITHUB_TOKEN for private repos)' },
     ],
     async action(opts) {
         console.log('\n🔐 GitHub OIDC Setup for AWS\n');
@@ -34,6 +62,7 @@ export default {
             process.exit(1);
         }
         let repoPath;
+        let repoName;
         let roleName;
         if (opts.global) {
             repoPath = `${githubUsername}/*`;
@@ -41,11 +70,66 @@ export default {
             console.log(`\nConfiguring OIDC for ALL repos: ${githubUsername}/*`);
         }
         else {
-            const repoName = await prompt('Repository name', 'prism-d1-velocity');
+            repoName = await prompt('Repository name', 'prism-d1-velocity');
             repoPath = `${githubUsername}/${repoName}`;
             roleName = `GitHubActions-${repoName}`;
             console.log(`\nConfiguring OIDC for: ${repoPath}`);
         }
+        // -----------------------------------------------------------------
+        // Build the OIDC sub patterns. GitHub repos created (or renamed /
+        // transferred) after mid-2026 present an immutable-ID sub format:
+        //   repo:<owner>@<ownerId>/<repo>@<repoId>:<ref>
+        // Older repos keep the classic format:
+        //   repo:<owner>/<repo>:<ref>
+        // We trust both. '@' is not a legal character in GitHub owner or repo
+        // names, so the wildcarded ID segments can only ever match numeric IDs —
+        // names cannot be crafted to collide. Wildcard IDs do forgo namespace-
+        // resurrection protection; use --pin-ids to lock to the exact IDs.
+        // -----------------------------------------------------------------
+        let ownerId;
+        let repoId;
+        if (opts.pinIds) {
+            console.log('\nResolving immutable GitHub IDs (--pin-ids)...');
+            if (opts.global) {
+                const user = await githubApi(`/users/${githubUsername}`);
+                if (user?.id)
+                    ownerId = String(user.id);
+            }
+            else {
+                const repo = await githubApi(`/repos/${githubUsername}/${repoName}`);
+                if (repo?.id && repo?.owner?.id) {
+                    repoId = String(repo.id);
+                    ownerId = String(repo.owner.id);
+                }
+            }
+            if (!ownerId) {
+                console.log('  Could not resolve IDs automatically (private repo without gh CLI or GITHUB_TOKEN?).');
+                console.log(`  You can find them with: gh api repos/${repoPath.replace('/*', '/<repo>')} --jq '"\\(.owner.id) \\(.id)"'`);
+                const pasted = await prompt(opts.global
+                    ? 'GitHub owner ID (blank = fall back to wildcard IDs)'
+                    : 'GitHub "<ownerId> <repoId>" (blank = fall back to wildcard IDs)');
+                const parts = pasted.split(/\s+/).filter(Boolean);
+                if (parts[0])
+                    ownerId = parts[0];
+                if (parts[1])
+                    repoId = parts[1];
+            }
+            if (ownerId) {
+                console.log(`  ✓ Pinned: owner ID ${ownerId}${repoId ? `, repo ID ${repoId}` : ''}`);
+            }
+            else {
+                console.log('  Falling back to wildcard ID matching.');
+            }
+        }
+        const subPatterns = opts.global
+            ? [
+                `repo:${githubUsername}/*:*`,
+                `repo:${githubUsername}@${ownerId ?? '*'}/*:*`,
+            ]
+            : [
+                `repo:${githubUsername}/${repoName}:*`,
+                `repo:${githubUsername}@${ownerId ?? '*'}/${repoName}@${repoId ?? '*'}:*`,
+            ];
         // Check AWS credentials
         const sts = run('aws sts get-caller-identity --query Account --output text');
         if (!sts.ok) {
@@ -91,7 +175,7 @@ export default {
                             'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
                         },
                         StringLike: {
-                            'token.actions.githubusercontent.com:sub': `repo:${repoPath}:*`,
+                            'token.actions.githubusercontent.com:sub': subPatterns,
                         },
                     },
                 },
@@ -156,6 +240,12 @@ export default {
         console.log('════════════════════════════════════════════════');
         console.log(`\n  Role ARN: ${roleArn}`);
         console.log(`  Repository: ${repoPath}`);
+        console.log('  Trusted sub patterns:');
+        for (const p of subPatterns)
+            console.log(`    - ${p}`);
+        if (!opts.pinIds) {
+            console.log('  Tip: rerun with --pin-ids to lock the trust policy to immutable GitHub IDs.');
+        }
         console.log('\n  Next step: Add a repository secret in GitHub');
         console.log('');
         console.log('  In your GitHub repository, go to:');

package/dist/src/commands/bootstrapper/setup-github-oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;KAC9G;IACD,KAAK,CAAC,MAAM,CAAC,IAA0B;QACrC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YACtE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,QAAQ,QAAQ,IAAI;yBAChE;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.66",
+  "version": "1.0.67",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {