@prism-d1/cli 1.0.66 → 1.0.68

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -287,16 +287,21 @@ export class OtelCollectorConstruct extends Construct {
 
     // -------------------------------------------------------
     // Outputs — everything needed to run `codeburn sync setup <url>`
+    // Logical IDs are overridden so the deploy output keys match the
+    // README verbatim (construct nesting would otherwise mangle them to
+    // OtelCollectorOtelCollectorUrl<hash>).
     // -------------------------------------------------------
-    new cdk.CfnOutput(this, 'OtelCollectorUrl', {
+    const urlOutput = new cdk.CfnOutput(this, 'OtelCollectorUrl', {
       value: this.httpApi.apiEndpoint,
       description: 'Run: codeburn sync setup <this URL>',
     });
+    urlOutput.overrideLogicalId('OtelCollectorUrl');
     if (this.userPool) {
-      new cdk.CfnOutput(this, 'OtelUserPoolId', {
+      const poolOutput = new cdk.CfnOutput(this, 'OtelUserPoolId', {
         value: this.userPool.userPoolId,
         description: 'Create users: aws cognito-idp admin-create-user --user-pool-id <this> --username <email>',
       });
+      poolOutput.overrideLogicalId('OtelUserPoolId');
     }
   }
 }

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -187,7 +187,7 @@ export class DashboardStack extends cdk.Stack {
 
     teamDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'AI Input Tokens per PR',
+        title: 'AI Input Tokens',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -202,7 +202,7 @@ export class DashboardStack extends cdk.Stack {
         leftYAxis: { min: 0, label: 'Tokens' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'AI Output Tokens per PR',
+        title: 'AI Output Tokens',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -217,7 +217,7 @@ export class DashboardStack extends cdk.Stack {
         leftYAxis: { min: 0, label: 'Tokens' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'AI Cost per PR (USD)',
+        title: 'AI Cost (USD)',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -233,6 +233,48 @@ export class DashboardStack extends cdk.Stack {
       }),
     );
 
+    // Cost breakdowns by Tool and Model. SEARCH expressions auto-discover
+    // every dimension value, so new tools/models appear without dashboard
+    // changes. These series are populated by the otel-metrics-publisher
+    // (requires -c enableOtelCollector=true); the trailer path has no
+    // per-tool/per-model breakdown and leaves these widgets empty.
+    teamDashboard.addWidgets(
+      new cloudwatch.GraphWidget({
+        title: 'AI Cost by Tool (USD)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: `SEARCH('{${METRIC_NAMESPACE},Tool} MetricName="AICostUSD"', 'Sum')`,
+            usingMetrics: {},
+            // Dynamic label: each discovered series is legend-labeled with
+            // its Tool dimension value (e.g. "claude-code").
+            label: "${PROP('Dim.Tool')}",
+            period: DEFAULT_PERIOD,
+          }),
+        ],
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
+        legendPosition: cloudwatch.LegendPosition.RIGHT,
+      }),
+      new cloudwatch.GraphWidget({
+        title: 'AI Cost by Model (USD)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: `SEARCH('{${METRIC_NAMESPACE},Model} MetricName="AICostUSD"', 'Sum')`,
+            usingMetrics: {},
+            // Dynamic label: each discovered series is legend-labeled with
+            // its Model dimension value (e.g. "claude-sonnet-4-5-20250929").
+            label: "${PROP('Dim.Model')}",
+            period: DEFAULT_PERIOD,
+          }),
+        ],
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
+        legendPosition: cloudwatch.LegendPosition.RIGHT,
+      }),
+    );
+
     teamDashboard.addWidgets(
       new cloudwatch.TextWidget({
         markdown: '### Agent Operations',

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -441,11 +441,20 @@ async function publishCloudWatchMetrics(
       ['PostMergeDefectRate', detail.ai_dora.post_merge_defect_rate, StandardUnit.Percent, true],
       ['EvalGatePassRate', detail.ai_dora.eval_gate_pass_rate, StandardUnit.Percent, true],
       ['AITestCoverageDelta', detail.ai_dora.ai_test_coverage_delta, StandardUnit.Percent, true],
-      ['AIInputTokens', detail.ai_dora.total_input_tokens, StandardUnit.Count, false],
-      ['AIOutputTokens', detail.ai_dora.total_output_tokens, StandardUnit.Count, false],
-      ['AICostUSD', detail.ai_dora.total_cost_usd, StandardUnit.None, false],
     ];
 
+    // Token & cost metrics come from git-trailer PR sums by default. When the
+    // OTEL collector is enabled (OTEL_ENABLED=true), the otel-metrics-publisher
+    // Lambda owns AIInputTokens / AIOutputTokens / AICostUSD (higher-fidelity
+    // per-span data via `codeburn sync`) — publishing both would double-count.
+    if (process.env.OTEL_ENABLED !== 'true') {
+      aiDoraMap.push(
+        ['AIInputTokens', detail.ai_dora.total_input_tokens, StandardUnit.Count, false],
+        ['AIOutputTokens', detail.ai_dora.total_output_tokens, StandardUnit.Count, false],
+        ['AICostUSD', detail.ai_dora.total_cost_usd, StandardUnit.None, false],
+      );
+    }
+
     for (const [name, value, unit, scaleToPercent] of aiDoraMap) {
       if (value != null) {
         const publishValue = scaleToPercent && value <= 1 ? value * 100 : value;

package/dist/assets/infra/lib/lambda/otel-metrics-publisher.ts

@@ -0,0 +1,185 @@
+/**
+ * PRISM D1 — OTEL metrics publisher.
+ *
+ * Consumes the prism-d1-ai-usage DynamoDB stream (filtered at the event
+ * source to sk begins_with "OTEL#DAY#") and publishes token/cost deltas to
+ * CloudWatch under the same metric names the dashboards already read:
+ * AIInputTokens, AIOutputTokens, AICostUSD.
+ *
+ * Only active when the OTEL collector is enabled — the metrics-processor
+ * stops publishing trailer-sourced token metrics (OTEL_ENABLED=true) so
+ * these series are exclusively OTEL-fed and never double-counted.
+ *
+ * Scale guards (by design):
+ *  - Deltas are exact: OTEL#DAY# items are ADD counters, so delta = NEW − OLD.
+ *  - Metrics are timestamped with the SPAN day, not arrival time. Backfilled
+ *    days older than the CloudWatch ingest window (14 days) are dropped —
+ *    the DynamoDB aggregates and S3 OTLP archive still hold full history.
+ *  - Published dimensionless (matches dashboard widgets) AND with Tool and
+ *    Model dimensions (small, bounded cardinality) for per-tool / per-model
+ *    slicing.
+ *  - Single PutMetricData call per batch, chunked at the API limit.
+ */
+
+import {
+  CloudWatchClient,
+  PutMetricDataCommand,
+  MetricDatum,
+  StandardUnit,
+} from '@aws-sdk/client-cloudwatch';
+
+const cloudwatch = new CloudWatchClient({});
+
+const METRIC_NAMESPACE = process.env.METRIC_NAMESPACE || 'PRISM/D1/Velocity';
+/** CloudWatch rejects datapoints older than 14 days. */
+const MAX_METRIC_AGE_DAYS = 14;
+/** PutMetricData accepts up to 1000 datums per call. */
+const PUT_METRIC_BATCH_SIZE = 1000;
+
+// ---- Types (DynamoDB stream event, trimmed to what we read) ----
+
+interface AttributeValue {
+  S?: string;
+  N?: string;
+}
+
+interface StreamImage {
+  sk?: AttributeValue;
+  day?: AttributeValue;
+  tool?: AttributeValue;
+  model?: AttributeValue;
+  input_tokens?: AttributeValue;
+  output_tokens?: AttributeValue;
+  cost_usd?: AttributeValue;
+}
+
+interface StreamRecord {
+  eventName?: 'INSERT' | 'MODIFY' | 'REMOVE';
+  dynamodb?: {
+    Keys?: { pk?: AttributeValue; sk?: AttributeValue };
+    NewImage?: StreamImage;
+    OldImage?: StreamImage;
+  };
+}
+
+export interface StreamEvent {
+  Records?: StreamRecord[];
+}
+
+// ---- Helpers ----
+
+function num(v: AttributeValue | undefined): number {
+  const n = Number(v?.N ?? 0);
+  return Number.isFinite(n) ? n : 0;
+}
+
+/** Resolve the metric timestamp from the aggregate's span day. Null = drop. */
+export function resolveTimestamp(day: string, now: Date = new Date()): Date | null {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) return null;
+  // Noon UTC keeps the datum inside the calendar day for all dashboard periods.
+  const ts = new Date(`${day}T12:00:00Z`);
+  if (isNaN(ts.getTime())) return null;
+  const ageMs = now.getTime() - ts.getTime();
+  // Too old for CloudWatch ingest (backfilled history) — drop, don't error.
+  if (ageMs > MAX_METRIC_AGE_DAYS * 24 * 60 * 60 * 1000) return null;
+  // Guard against clock skew: never publish a future timestamp.
+  return ts.getTime() > now.getTime() ? now : ts;
+}
+
+interface Delta {
+  day: string;
+  tool: string;
+  model: string;
+  inputTokens: number;
+  outputTokens: number;
+  costUsd: number;
+}
+
+/** Compute the counter delta for one OTEL#DAY# stream record. Null = skip. */
+export function computeDelta(record: StreamRecord): Delta | null {
+  if (record.eventName !== 'INSERT' && record.eventName !== 'MODIFY') return null;
+
+  const newImage = record.dynamodb?.NewImage;
+  const sk = newImage?.sk?.S ?? record.dynamodb?.Keys?.sk?.S ?? '';
+  // Defense in depth — the event source filter should already guarantee this.
+  if (!sk.startsWith('OTEL#DAY#')) return null;
+
+  const oldImage = record.dynamodb?.OldImage;
+  const delta: Delta = {
+    day: newImage?.day?.S ?? sk.split('#')[2] ?? '',
+    tool: newImage?.tool?.S ?? sk.split('#')[3] ?? 'unknown',
+    model: newImage?.model?.S ?? sk.split('#')[4] ?? 'unknown',
+    inputTokens: num(newImage?.input_tokens) - num(oldImage?.input_tokens),
+    outputTokens: num(newImage?.output_tokens) - num(oldImage?.output_tokens),
+    costUsd: num(newImage?.cost_usd) - num(oldImage?.cost_usd),
+  };
+
+  // Nothing to publish (e.g. metadata-only update) or a counter went
+  // backwards (should not happen with ADD — treat defensively as no-op).
+  if (delta.inputTokens <= 0 && delta.outputTokens <= 0 && delta.costUsd <= 0) return null;
+  return delta;
+}
+
+/**
+ * Build datums for a delta across three dimension sets:
+ * dimensionless (dashboards), Tool, and Model. CloudWatch cannot roll up
+ * across dimensions, so each slice needs its own series. Tool and model
+ * cardinality are both small and bounded.
+ */
+export function buildDatums(delta: Delta, timestamp: Date): MetricDatum[] {
+  const metrics: Array<[string, number, StandardUnit]> = [
+    ['AIInputTokens', delta.inputTokens, StandardUnit.Count],
+    ['AIOutputTokens', delta.outputTokens, StandardUnit.Count],
+    ['AICostUSD', delta.costUsd, StandardUnit.None],
+  ];
+
+  const dimensionSets = [
+    [],
+    [{ Name: 'Tool', Value: delta.tool }],
+    [{ Name: 'Model', Value: delta.model }],
+  ];
+
+  const datums: MetricDatum[] = [];
+  for (const [name, value, unit] of metrics) {
+    if (value <= 0) continue;
+    for (const dimensions of dimensionSets) {
+      datums.push({ MetricName: name, Value: value, Unit: unit, Timestamp: timestamp, Dimensions: dimensions });
+    }
+  }
+  return datums;
+}
+
+// ---- Handler ----
+
+export async function handler(event: StreamEvent): Promise<void> {
+  const now = new Date();
+  const datums: MetricDatum[] = [];
+  let processed = 0;
+  let droppedOld = 0;
+
+  for (const record of event.Records ?? []) {
+    const delta = computeDelta(record);
+    if (!delta) continue;
+
+    const timestamp = resolveTimestamp(delta.day, now);
+    if (!timestamp) {
+      droppedOld++;
+      continue;
+    }
+
+    datums.push(...buildDatums(delta, timestamp));
+    processed++;
+  }
+
+  for (let i = 0; i < datums.length; i += PUT_METRIC_BATCH_SIZE) {
+    await cloudwatch.send(new PutMetricDataCommand({
+      Namespace: METRIC_NAMESPACE,
+      MetricData: datums.slice(i, i + PUT_METRIC_BATCH_SIZE),
+    }));
+  }
+
+  console.log(
+    `[otel-metrics-publisher] records=${event.Records?.length ?? 0} ` +
+    `published=${processed} droppedTooOld=${droppedOld} datums=${datums.length}`,
+  );
+}

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -11,8 +11,8 @@
  * newly-seen spans, bucketed by SPAN date, not arrival date).
  *
  * Item shapes in the AI-usage table:
- *   pk=USER#<identity>  sk=SPAN#<timestamp>#<spanId>       raw span, TTL 90d
- *   pk=USER#<identity>  sk=OTEL#DAY#<yyyy-mm-dd>#<tool>    daily aggregate
+ *   pk=USER#<identity>  sk=SPAN#<timestamp>#<spanId>            raw span, TTL 90d
+ *   pk=USER#<identity>  sk=OTEL#DAY#<yyyy-mm-dd>#<tool>#<model> daily aggregate
  */
 
 import {
@@ -272,15 +272,17 @@ async function writeSpanIfNew(user: string, s: ParsedSpan): Promise<boolean> {
 /** ADD-increment the daily aggregate for a newly-seen span (bucketed by SPAN date). */
 async function bumpDailyAggregate(user: string, s: ParsedSpan): Promise<void> {
   const day = s.timestamp.slice(0, 10);
+  // '#' is the key delimiter — strip it from the model to keep the sk parseable.
+  const model = (s.model || 'unknown').replace(/#/g, '');
   await dynamoClient.send(new UpdateItemCommand({
     TableName: AI_USAGE_TABLE,
     Key: {
       pk: { S: `USER#${user}` },
-      sk: { S: `OTEL#DAY#${day}#${s.tool}` },
+      sk: { S: `OTEL#DAY#${day}#${s.tool}#${model}` },
     },
     UpdateExpression:
       'ADD input_tokens :in, output_tokens :out, cost_usd :cost, call_count :one ' +
-      'SET record_type = :rt, tool = :tool, #day = :day, updated_at = :now',
+      'SET record_type = :rt, tool = :tool, model = :model, #day = :day, updated_at = :now',
     ExpressionAttributeNames: { '#day': 'day' },
     ExpressionAttributeValues: {
       ':in': { N: String(s.inputTokens) },
@@ -289,6 +291,7 @@ async function bumpDailyAggregate(user: string, s: ParsedSpan): Promise<void> {
       ':one': { N: '1' },
       ':rt': { S: 'OTEL_DAY' },
       ':tool': { S: s.tool },
+      ':model': { S: model },
       ':day': { S: day },
       ':now': { S: new Date().toISOString() },
     },

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -2,6 +2,8 @@ import * as cdk from 'aws-cdk-lib';
 import * as events from 'aws-cdk-lib/aws-events';
 import * as targets from 'aws-cdk-lib/aws-events-targets';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
+import * as eventsources from 'aws-cdk-lib/aws-lambda-event-sources';
+import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as logs from 'aws-cdk-lib/aws-logs';
@@ -133,10 +135,14 @@ export class MetricsPipelineStack extends cdk.Stack {
     // -------------------------------------------------------
     // DynamoDB AI-usage table — user-keyed, KMS encrypted
     // pk = USER#<email>
-    // sk = COMMIT#<ts>#<sha>#<tool> | SPAN#<ts>#<spanId> | OTEL#DAY#<date>#<tool>
+    // sk = COMMIT#<ts>#<sha>#<tool> | SPAN#<ts>#<spanId> | OTEL#DAY#<date>#<tool>#<model>
     // Sparse GSIs (only commit-level items set them) invert the user key so the
     // same table answers by-repo / by-PR / by-commit / global-by-date.
     // -------------------------------------------------------
+    // Read the OTEL collector flag early — it also controls the table stream
+    // and which pipeline owns the token/cost CloudWatch metrics.
+    const enableOtelCollector = this.node.tryGetContext('enableOtelCollector') === 'true';
+
     this.aiUsageTable = new dynamodb.Table(this, 'AiUsageTable', {
       tableName: 'prism-d1-ai-usage',
       partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
@@ -147,6 +153,9 @@ export class MetricsPipelineStack extends cdk.Stack {
       timeToLiveAttribute: 'ttl',
       encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
       encryptionKey: prismKmsKey,
+      // NEW_AND_OLD_IMAGES so the otel-metrics-publisher can compute exact
+      // counter deltas (new − old) on OTEL#DAY# aggregate updates.
+      stream: enableOtelCollector ? dynamodb.StreamViewType.NEW_AND_OLD_IMAGES : undefined,
     });
     for (const [indexName, pkAttr, skAttr] of [
       ['by-repo', 'gsi_repo', 'gsi_repo_sk'],
@@ -222,6 +231,10 @@ export class MetricsPipelineStack extends cdk.Stack {
         EVENTS_TABLE: this.eventsTable.tableName,
         METADATA_TABLE: this.metadataTable.tableName,
         METRIC_NAMESPACE: 'PRISM/D1/Velocity',
+        // When the OTEL collector is enabled, the otel-metrics-publisher owns
+        // AIInputTokens/AIOutputTokens/AICostUSD — the processor skips its
+        // trailer-sourced copies to avoid double-counting.
+        OTEL_ENABLED: enableOtelCollector ? 'true' : 'false',
       },
       logRetention: logs.RetentionDays.ONE_MONTH,
       description: 'Processes PRISM D1 metric events from EventBridge into DynamoDB and CloudWatch',
@@ -295,7 +308,6 @@ export class MetricsPipelineStack extends cdk.Stack {
     // Per-user AI usage flows directly from codeburn sync to the
     // ai-usage table (spans + daily aggregates).
     // -------------------------------------------------------
-    const enableOtelCollector = this.node.tryGetContext('enableOtelCollector') === 'true';
     if (enableOtelCollector) {
       this.otelCollector = new OtelCollectorConstruct(this, 'OtelCollector', {
         aiUsageTable: this.aiUsageTable,
@@ -305,6 +317,97 @@ export class MetricsPipelineStack extends cdk.Stack {
         externalClientId: this.node.tryGetContext('otelClientId') as string | undefined,
         identityClaim: this.node.tryGetContext('otelIdentityClaim') as string | undefined,
       });
+
+      // ---------------------------------------------------
+      // OTEL metrics publisher — DDB stream → CloudWatch.
+      // Replaces the trailer-sourced AIInputTokens/AIOutputTokens/AICostUSD
+      // series with per-span OTEL data (same metric names — dashboards
+      // require no changes). The event-source filter limits invocations to
+      // OTEL#DAY# aggregate updates, so span-volume writes never invoke it.
+      // ---------------------------------------------------
+      const otelPublisherDlq = new sqs.Queue(this, 'OtelPublisherDLQ', {
+        queueName: 'prism-d1-otel-publisher-dlq',
+        encryptionMasterKey: prismKmsKey,
+        enforceSSL: true,
+        retentionPeriod: cdk.Duration.days(14),
+      });
+
+      const otelMetricsPublisher = new lambda.Function(this, 'OtelMetricsPublisher', {
+        functionName: 'prism-d1-otel-metrics-publisher',
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: 'otel-metrics-publisher.handler',
+        ...lambdaVpcProps,
+        code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
+          bundling: {
+            image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+            command: [
+              'bash', '-c',
+              [
+                'npm init -y > /dev/null 2>&1',
+                'npm install --save @aws-sdk/client-cloudwatch esbuild > /dev/null 2>&1',
+                'npx esbuild otel-metrics-publisher.ts --bundle --platform=node --target=node22 --outfile=/asset-output/otel-metrics-publisher.js --external:@aws-sdk/*',
+              ].join(' && '),
+            ],
+            local: {
+              tryBundle(outputDir: string): boolean {
+                try {
+                  const { execSync } = require('child_process');
+                  execSync(
+                    `npx esbuild ${path.join(__dirname, 'lambda', 'otel-metrics-publisher.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'otel-metrics-publisher.js')} --external:@aws-sdk/*`,
+                    { stdio: 'pipe' },
+                  );
+                  return true;
+                } catch {
+                  return false;
+                }
+              },
+            },
+          },
+        }),
+        timeout: cdk.Duration.seconds(60),
+        memorySize: 256,
+        environment: {
+          METRIC_NAMESPACE: 'PRISM/D1/Velocity',
+        },
+        logRetention: logs.RetentionDays.ONE_MONTH,
+        description: 'Publishes OTEL#DAY aggregate deltas from the ai-usage stream as CloudWatch token/cost metrics',
+      });
+
+      otelMetricsPublisher.addToRolePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          actions: ['cloudwatch:PutMetricData'],
+          resources: ['*'],
+          conditions: {
+            StringEquals: {
+              'cloudwatch:namespace': 'PRISM/D1/Velocity',
+            },
+          },
+        }),
+      );
+
+      otelMetricsPublisher.addEventSource(
+        new eventsources.DynamoEventSource(this.aiUsageTable, {
+          startingPosition: lambda.StartingPosition.LATEST,
+          batchSize: 100,
+          maxBatchingWindow: cdk.Duration.seconds(10),
+          bisectBatchOnError: true,
+          retryAttempts: 3,
+          onFailure: new eventsources.SqsDlq(otelPublisherDlq),
+          // Only OTEL#DAY# aggregate inserts/updates — SPAN# and COMMIT#
+          // writes (the overwhelming majority at scale) never invoke us.
+          filters: [
+            lambda.FilterCriteria.filter({
+              eventName: lambda.FilterRule.or('INSERT', 'MODIFY'),
+              dynamodb: {
+                Keys: {
+                  sk: { S: lambda.FilterRule.beginsWith('OTEL#DAY#') },
+                },
+              },
+            }),
+          ],
+        }),
+      );
     }
 
     // -------------------------------------------------------
@@ -737,6 +840,15 @@ export class MetricsPipelineStack extends cdk.Stack {
         reason: 'CDK grantReadData on DynamoDB generates wildcard for GSI index ARNs via token reference',
         appliesTo: ['Resource::<EventsTableD24865E5.Arn>/index/*', 'Resource::<AiUsageTable79F37CE0.Arn>/index/*'],
       },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'DynamoDB stream event source mapping requires ListStreams which does not support resource-level scoping beyond the table stream wildcard',
+        appliesTo: ['Resource::<AiUsageTable79F37CE0.Arn>/stream/*', 'Resource::*'],
+      },
+      {
+        id: 'AwsSolutions-SQS3',
+        reason: 'The OTEL publisher queue is itself a DLQ for the DynamoDB stream event source',
+      },
       { id: 'AwsSolutions-L1', reason: 'All Lambdas use nodejs22.x which is the latest Node.js runtime available' },
     ]);
 

package/dist/assets/infra/package.json

@@ -17,6 +17,7 @@
   },
   "devDependencies": {
     "@types/node": "^20.17.0",
+    "ts-node": "^10.9.2",
     "typescript": "~5.6.0",
     "aws-cdk": "^2.170.0"
   }

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts

@@ -6,6 +6,7 @@ declare const _default: {
     }[];
     action(opts: {
         global?: boolean;
+        pinIds?: boolean;
     }): Promise<void>;
 };
 export default _default;

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBA4BqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AALzC,wBA8JE"}
+{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBAyNE"}

package/dist/src/commands/bootstrapper/setup-github-oidc.js

@@ -19,10 +19,38 @@ function run(cmd) {
         return { ok: false, stdout: '', stderr: (err.stderr || err.message || '').trim() };
     }
 }
+/**
+ * Fetch a GitHub API path, trying progressively more authenticated clients:
+ * unauthenticated (public repos/users) → GITHUB_TOKEN env → gh CLI token.
+ * Returns the parsed JSON body, or null if every attempt fails.
+ */
+async function githubApi(apiPath) {
+    const tokens = [undefined];
+    if (process.env.GITHUB_TOKEN)
+        tokens.push(process.env.GITHUB_TOKEN);
+    const ghToken = run('gh auth token');
+    if (ghToken.ok && ghToken.stdout)
+        tokens.push(ghToken.stdout);
+    for (const token of tokens) {
+        try {
+            const headers = { Accept: 'application/vnd.github+json' };
+            if (token)
+                headers.Authorization = `Bearer ${token}`;
+            const res = await fetch(`https://api.github.com${apiPath}`, { headers });
+            if (res.ok)
+                return await res.json();
+        }
+        catch {
+            // Network error — try the next credential source.
+        }
+    }
+    return null;
+}
 export default {
     description: 'Set up GitHub OIDC identity provider and IAM role for GitHub Actions',
     options: [
         { flags: '--global', description: 'Create a single role for all repos in the org/user (wildcard sub claim)' },
+        { flags: '--pin-ids', description: 'Pin the trust policy to immutable GitHub owner/repo IDs (protects against namespace resurrection; may require gh CLI or GITHUB_TOKEN for private repos)' },
     ],
     async action(opts) {
         console.log('\n🔐 GitHub OIDC Setup for AWS\n');
@@ -34,6 +62,7 @@ export default {
             process.exit(1);
         }
         let repoPath;
+        let repoName;
         let roleName;
         if (opts.global) {
             repoPath = `${githubUsername}/*`;
@@ -41,11 +70,66 @@ export default {
             console.log(`\nConfiguring OIDC for ALL repos: ${githubUsername}/*`);
         }
         else {
-            const repoName = await prompt('Repository name', 'prism-d1-velocity');
+            repoName = await prompt('Repository name', 'prism-d1-velocity');
             repoPath = `${githubUsername}/${repoName}`;
             roleName = `GitHubActions-${repoName}`;
             console.log(`\nConfiguring OIDC for: ${repoPath}`);
         }
+        // -----------------------------------------------------------------
+        // Build the OIDC sub patterns. GitHub repos created (or renamed /
+        // transferred) after mid-2026 present an immutable-ID sub format:
+        //   repo:<owner>@<ownerId>/<repo>@<repoId>:<ref>
+        // Older repos keep the classic format:
+        //   repo:<owner>/<repo>:<ref>
+        // We trust both. '@' is not a legal character in GitHub owner or repo
+        // names, so the wildcarded ID segments can only ever match numeric IDs —
+        // names cannot be crafted to collide. Wildcard IDs do forgo namespace-
+        // resurrection protection; use --pin-ids to lock to the exact IDs.
+        // -----------------------------------------------------------------
+        let ownerId;
+        let repoId;
+        if (opts.pinIds) {
+            console.log('\nResolving immutable GitHub IDs (--pin-ids)...');
+            if (opts.global) {
+                const user = await githubApi(`/users/${githubUsername}`);
+                if (user?.id)
+                    ownerId = String(user.id);
+            }
+            else {
+                const repo = await githubApi(`/repos/${githubUsername}/${repoName}`);
+                if (repo?.id && repo?.owner?.id) {
+                    repoId = String(repo.id);
+                    ownerId = String(repo.owner.id);
+                }
+            }
+            if (!ownerId) {
+                console.log('  Could not resolve IDs automatically (private repo without gh CLI or GITHUB_TOKEN?).');
+                console.log(`  You can find them with: gh api repos/${repoPath.replace('/*', '/<repo>')} --jq '"\\(.owner.id) \\(.id)"'`);
+                const pasted = await prompt(opts.global
+                    ? 'GitHub owner ID (blank = fall back to wildcard IDs)'
+                    : 'GitHub "<ownerId> <repoId>" (blank = fall back to wildcard IDs)');
+                const parts = pasted.split(/\s+/).filter(Boolean);
+                if (parts[0])
+                    ownerId = parts[0];
+                if (parts[1])
+                    repoId = parts[1];
+            }
+            if (ownerId) {
+                console.log(`  ✓ Pinned: owner ID ${ownerId}${repoId ? `, repo ID ${repoId}` : ''}`);
+            }
+            else {
+                console.log('  Falling back to wildcard ID matching.');
+            }
+        }
+        const subPatterns = opts.global
+            ? [
+                `repo:${githubUsername}/*:*`,
+                `repo:${githubUsername}@${ownerId ?? '*'}/*:*`,
+            ]
+            : [
+                `repo:${githubUsername}/${repoName}:*`,
+                `repo:${githubUsername}@${ownerId ?? '*'}/${repoName}@${repoId ?? '*'}:*`,
+            ];
         // Check AWS credentials
         const sts = run('aws sts get-caller-identity --query Account --output text');
         if (!sts.ok) {
@@ -91,7 +175,7 @@ export default {
                             'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
                         },
                         StringLike: {
-                            'token.actions.githubusercontent.com:sub': `repo:${repoPath}:*`,
+                            'token.actions.githubusercontent.com:sub': subPatterns,
                         },
                     },
                 },
@@ -156,6 +240,12 @@ export default {
         console.log('════════════════════════════════════════════════');
         console.log(`\n  Role ARN: ${roleArn}`);
         console.log(`  Repository: ${repoPath}`);
+        console.log('  Trusted sub patterns:');
+        for (const p of subPatterns)
+            console.log(`    - ${p}`);
+        if (!opts.pinIds) {
+            console.log('  Tip: rerun with --pin-ids to lock the trust policy to immutable GitHub IDs.');
+        }
         console.log('\n  Next step: Add a repository secret in GitHub');
         console.log('');
         console.log('  In your GitHub repository, go to:');

package/dist/src/commands/bootstrapper/setup-github-oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;KAC9G;IACD,KAAK,CAAC,MAAM,CAAC,IAA0B;QACrC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YACtE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,QAAQ,QAAQ,IAAI;yBAChE;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/commands/bootstrapper/setup-otel-sync.d.ts

@@ -0,0 +1,15 @@
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: {
+        url?: string;
+        interval?: string;
+        status?: boolean;
+        remove?: boolean;
+    }): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=setup-otel-sync.d.ts.map

package/dist/src/commands/bootstrapper/setup-otel-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-otel-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-otel-sync.ts"],"names":[],"mappings":";;;;;;iBAgPqB;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAR5F,wBAiIE"}

package/dist/src/commands/bootstrapper/setup-otel-sync.js

@@ -0,0 +1,332 @@
+import { execSync } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { platform, homedir } from 'node:os';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+function prompt(question, defaultValue) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const suffix = defaultValue ? ` [${defaultValue}]` : '';
+    return new Promise((resolve) => {
+        rl.question(`${question}${suffix}: `, (answer) => {
+            rl.close();
+            resolve(answer.trim() || defaultValue || '');
+        });
+    });
+}
+function run(cmd) {
+    try {
+        const stdout = execSync(cmd, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        return { ok: true, stdout, stderr: '' };
+    }
+    catch (err) {
+        return { ok: false, stdout: '', stderr: (err.stderr || err.message || '').trim() };
+    }
+}
+// ---- Constants ----
+const CRON_MARKER = '# prism-otel-sync';
+const PLIST_LABEL = 'com.prism.otel-sync';
+const SCHTASK_NAME = 'PrismOtelSync';
+const LOG_DIR = join(homedir(), '.prism', 'logs');
+// ---- Scheduler helpers per OS ----
+function getCodeburnPath() {
+    const which = platform() === 'win32' ? 'where codeburn' : 'which codeburn';
+    const result = run(which);
+    return result.ok ? result.stdout.split('\n')[0] : null;
+}
+function buildSyncCommand(codeburnPath, since) {
+    return `${codeburnPath} sync push --since ${since}`;
+}
+// ---- Linux: user crontab ----
+function linuxScheduleExists() {
+    const result = run('crontab -l');
+    return result.ok && result.stdout.includes(CRON_MARKER);
+}
+function linuxInstallSchedule(codeburnPath, intervalHours) {
+    const existing = run('crontab -l');
+    const lines = existing.ok ? existing.stdout.split('\n').filter(l => !l.includes(CRON_MARKER)) : [];
+    const logFile = join(LOG_DIR, 'otel-sync.log');
+    const cronExpr = `0 */${intervalHours} * * *`;
+    lines.push(`${CRON_MARKER}`);
+    lines.push(`${cronExpr} ${buildSyncCommand(codeburnPath, '7d')} >> ${logFile} 2>&1`);
+    const tmpFile = '/tmp/prism-crontab.tmp';
+    writeFileSync(tmpFile, lines.join('\n') + '\n');
+    const result = run(`crontab ${tmpFile}`);
+    if (!result.ok)
+        throw new Error(`Failed to install crontab: ${result.stderr}`);
+}
+function linuxRemoveSchedule() {
+    const existing = run('crontab -l');
+    if (!existing.ok)
+        return;
+    const lines = existing.stdout.split('\n').filter(l => !l.includes(CRON_MARKER) && !l.includes('codeburn sync push'));
+    const tmpFile = '/tmp/prism-crontab.tmp';
+    writeFileSync(tmpFile, lines.join('\n') + '\n');
+    run(`crontab ${tmpFile}`);
+}
+// ---- macOS: LaunchAgent ----
+function darwinPlistPath() {
+    return join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);
+}
+function darwinScheduleExists() {
+    return existsSync(darwinPlistPath());
+}
+function darwinInstallSchedule(codeburnPath, intervalHours) {
+    const logFile = join(LOG_DIR, 'otel-sync.log');
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${PLIST_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${codeburnPath}</string>
+    <string>sync</string>
+    <string>push</string>
+    <string>--since</string>
+    <string>7d</string>
+  </array>
+  <key>StartInterval</key>
+  <integer>${intervalHours * 3600}</integer>
+  <key>StandardOutPath</key>
+  <string>${logFile}</string>
+  <key>StandardErrorPath</key>
+  <string>${logFile}</string>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>`;
+    const plistPath = darwinPlistPath();
+    mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });
+    writeFileSync(plistPath, plist);
+    run(`launchctl unload ${plistPath} 2>/dev/null`);
+    const result = run(`launchctl load ${plistPath}`);
+    if (!result.ok)
+        throw new Error(`Failed to load LaunchAgent: ${result.stderr}`);
+}
+function darwinRemoveSchedule() {
+    const plistPath = darwinPlistPath();
+    if (existsSync(plistPath)) {
+        run(`launchctl unload ${plistPath}`);
+        run(`rm ${plistPath}`);
+    }
+}
+// ---- Windows: schtasks ----
+function windowsScheduleExists() {
+    const result = run(`schtasks /query /tn ${SCHTASK_NAME} /fo CSV`);
+    return result.ok;
+}
+function windowsInstallSchedule(codeburnPath, intervalHours) {
+    const logFile = join(LOG_DIR, 'otel-sync.log');
+    const cmd = `${codeburnPath} sync push --since 7d >> "${logFile}" 2>&1`;
+    const result = run(`schtasks /create /tn ${SCHTASK_NAME} /sc hourly /mo ${intervalHours} ` +
+        `/tr "cmd /c ${cmd.replace(/"/g, '\\"')}" /f`);
+    if (!result.ok)
+        throw new Error(`Failed to create scheduled task: ${result.stderr}`);
+}
+function windowsRemoveSchedule() {
+    run(`schtasks /delete /tn ${SCHTASK_NAME} /f`);
+}
+// ---- Unified scheduler interface ----
+function scheduleExists() {
+    switch (platform()) {
+        case 'darwin': return darwinScheduleExists();
+        case 'win32': return windowsScheduleExists();
+        default: return linuxScheduleExists();
+    }
+}
+function installSchedule(codeburnPath, intervalHours) {
+    mkdirSync(LOG_DIR, { recursive: true });
+    switch (platform()) {
+        case 'darwin': return darwinInstallSchedule(codeburnPath, intervalHours);
+        case 'win32': return windowsInstallSchedule(codeburnPath, intervalHours);
+        default: return linuxInstallSchedule(codeburnPath, intervalHours);
+    }
+}
+function removeSchedule() {
+    switch (platform()) {
+        case 'darwin': return darwinRemoveSchedule();
+        case 'win32': return windowsRemoveSchedule();
+        default: return linuxRemoveSchedule();
+    }
+}
+function schedulerName() {
+    switch (platform()) {
+        case 'darwin': return 'LaunchAgent';
+        case 'win32': return 'Scheduled Task';
+        default: return 'crontab';
+    }
+}
+// ---- Status ----
+function showStatus(codeburnPath) {
+    console.log('\n📊 OTEL Sync Status\n');
+    // Codeburn installed?
+    if (codeburnPath) {
+        console.log(`  ✓ codeburn found: ${codeburnPath}`);
+        const ver = run(`${codeburnPath} --version`);
+        if (ver.ok)
+            console.log(`    version: ${ver.stdout}`);
+    }
+    else {
+        console.log('  ✗ codeburn not found in PATH');
+    }
+    // Sync configured?
+    const configPath = join(homedir(), '.config', 'codeburn', 'sync.json');
+    if (existsSync(configPath)) {
+        try {
+            const cfg = JSON.parse(readFileSync(configPath, 'utf8'));
+            console.log(`  ✓ sync configured: ${cfg.baseUrl || cfg.endpoint || cfg.url || '(configured)'}`);
+        }
+        catch {
+            console.log(`  ✓ sync config exists: ${configPath}`);
+        }
+    }
+    else {
+        console.log('  ✗ sync not configured (run setup first)');
+    }
+    // Schedule exists?
+    if (scheduleExists()) {
+        console.log(`  ✓ ${schedulerName()} schedule active`);
+    }
+    else {
+        console.log(`  ✗ no ${schedulerName()} schedule found`);
+    }
+    // Last log?
+    const logFile = join(LOG_DIR, 'otel-sync.log');
+    if (existsSync(logFile)) {
+        const lastLines = run(`tail -5 "${logFile}"`);
+        if (lastLines.ok && lastLines.stdout) {
+            console.log(`  Last sync output (${logFile}):`);
+            for (const line of lastLines.stdout.split('\n')) {
+                console.log(`    ${line}`);
+            }
+        }
+    }
+    console.log('');
+}
+// ---- Main ----
+export default {
+    description: 'Set up automated codeburn OTEL sync (pushes AI usage telemetry every 12h)',
+    options: [
+        { flags: '--url <url>', description: 'OTEL collector URL (from CDK deploy output OtelCollectorUrl)' },
+        { flags: '--interval <hours>', description: 'Sync interval in hours (default: 12)' },
+        { flags: '--status', description: 'Show current sync schedule status' },
+        { flags: '--remove', description: 'Remove the sync schedule' },
+    ],
+    async action(opts) {
+        const codeburnPath = getCodeburnPath();
+        // --status
+        if (opts.status) {
+            showStatus(codeburnPath);
+            return;
+        }
+        // --remove
+        if (opts.remove) {
+            if (scheduleExists()) {
+                removeSchedule();
+                console.log(`\n  ✓ ${schedulerName()} schedule removed.\n`);
+            }
+            else {
+                console.log(`\n  No ${schedulerName()} schedule found — nothing to remove.\n`);
+            }
+            return;
+        }
+        // ---- Setup flow ----
+        console.log('\n🔄 OTEL Sync Setup\n');
+        console.log('This will configure automated codeburn telemetry sync to your PRISM');
+        console.log('OTEL collector. Runs every 12 hours to keep dashboards fresh.\n');
+        // 1. Check codeburn version
+        if (!codeburnPath) {
+            console.error('Error: codeburn not found. Install with: npm install -g codeburn');
+            process.exit(1);
+        }
+        const verResult = run(`${codeburnPath} --version`);
+        if (verResult.ok) {
+            const ver = verResult.stdout.replace(/[^0-9.]/g, '');
+            const parts = ver.split('.').map(Number);
+            if (parts[0] === 0 && parts[1] < 9 || (parts[1] === 9 && parts[2] < 16)) {
+                console.error(`Error: codeburn >= 0.9.16 required (found ${ver}). Run: npm update -g codeburn`);
+                process.exit(1);
+            }
+            console.log(`  ✓ codeburn ${ver}`);
+        }
+        // 2. Get the OTEL collector URL
+        const otelUrl = opts.url || await prompt('OTEL collector URL (from CDK deploy output OtelCollectorUrl)');
+        if (!otelUrl) {
+            console.error('Error: OTEL collector URL is required.');
+            process.exit(1);
+        }
+        // 3. Check if codeburn sync is already configured for this URL
+        const configPath = join(homedir(), '.config', 'codeburn', 'sync.json');
+        let needsSetup = true;
+        if (existsSync(configPath)) {
+            try {
+                const cfg = JSON.parse(readFileSync(configPath, 'utf8'));
+                const existingUrl = cfg.baseUrl || cfg.endpoint || cfg.url || '';
+                if (existingUrl === otelUrl || existingUrl.startsWith(otelUrl)) {
+                    console.log(`  ✓ codeburn sync already configured for this endpoint.`);
+                    needsSetup = false;
+                }
+                else {
+                    console.log(`  ⚠ codeburn sync configured for different endpoint: ${existingUrl}`);
+                    const override = await prompt('Reconfigure for the new URL? (y/N)', 'N');
+                    if (override.toLowerCase() !== 'y') {
+                        console.log('  Keeping existing configuration.');
+                        needsSetup = false;
+                    }
+                }
+            }
+            catch {
+                // Corrupt config — re-setup
+            }
+        }
+        // 4. Run codeburn sync setup (opens browser for OIDC)
+        if (needsSetup) {
+            console.log('\n  Running: codeburn sync setup ' + otelUrl);
+            console.log('  (This will open a browser for OIDC authentication)\n');
+            try {
+                execSync(`${codeburnPath} sync setup ${otelUrl}`, { stdio: 'inherit' });
+                console.log('\n  ✓ codeburn sync configured.');
+            }
+            catch (err) {
+                console.error(`\n  ✗ codeburn sync setup failed. Ensure Cognito user exists and try again.`);
+                process.exit(1);
+            }
+        }
+        // 5. Initial backfill push (30d — server drops >14d from CloudWatch, keeps in DDB/S3)
+        console.log('\n  Pushing initial backfill (last 30 days of telemetry)...');
+        const backfill = run(`${codeburnPath} sync push --since 30d`);
+        if (backfill.ok) {
+            console.log('  ✓ Backfill push complete.');
+            if (backfill.stdout)
+                console.log(`    ${backfill.stdout.split('\n').slice(-1)[0]}`);
+        }
+        else {
+            console.log(`  ⚠ Backfill push failed (non-fatal): ${backfill.stderr.split('\n')[0]}`);
+            console.log('    The schedule will retry. Check ~/.prism/logs/otel-sync.log');
+        }
+        // 6. Install OS schedule
+        const intervalHours = opts.interval ? parseInt(opts.interval, 10) : 12;
+        if (isNaN(intervalHours) || intervalHours < 1) {
+            console.error('Error: --interval must be a positive integer (hours).');
+            process.exit(1);
+        }
+        if (scheduleExists()) {
+            console.log(`\n  ✓ ${schedulerName()} schedule already exists — updating.`);
+            removeSchedule();
+        }
+        installSchedule(codeburnPath, intervalHours);
+        console.log(`  ✓ ${schedulerName()} schedule installed (every ${intervalHours}h).`);
+        // Summary
+        console.log('\n════════════════════════════════════════════════');
+        console.log('  ✅ OTEL sync setup complete!');
+        console.log('════════════════════════════════════════════════');
+        console.log(`\n  Endpoint:  ${otelUrl}`);
+        console.log(`  Schedule:  every ${intervalHours}h via ${schedulerName()}`);
+        console.log(`  Backfill:  last 30d pushed (dashboard shows last 14d)`);
+        console.log(`  Logs:      ${join(LOG_DIR, 'otel-sync.log')}`);
+        console.log(`\n  Run \`prism-cli bootstrapper setup-otel-sync --status\` to check health.`);
+        console.log(`  Run \`prism-cli bootstrapper setup-otel-sync --remove\` to uninstall.\n`);
+    },
+};
+//# sourceMappingURL=setup-otel-sync.js.map

package/dist/src/commands/bootstrapper/setup-otel-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-otel-sync.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-otel-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED,sBAAsB;AAEtB,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,YAAY,GAAG,eAAe,CAAC;AACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAElD,qCAAqC;AAErC,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB,EAAE,KAAa;IAC3D,OAAO,GAAG,YAAY,sBAAsB,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,gCAAgC;AAEhC,SAAS,mBAAmB;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,aAAqB;IACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,aAAa,QAAQ,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,OAAO,OAAO,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACzC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrH,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACzC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,+BAA+B;AAE/B,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,WAAW,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,aAAqB;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG;;;;;YAKJ,WAAW;;;cAGT,YAAY;;;;;;;aAOb,aAAa,GAAG,IAAI;;YAErB,OAAO;;YAEP,OAAO;;;;SAIV,CAAC;IACR,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,GAAG,CAAC,oBAAoB,SAAS,cAAc,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8BAA8B;AAE9B,SAAS,qBAAqB;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,YAAY,UAAU,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB,EAAE,aAAqB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,YAAY,6BAA6B,OAAO,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,CAChB,wBAAwB,YAAY,mBAAmB,aAAa,GAAG;QACvE,eAAe,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAC9C,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,qBAAqB;IAC5B,GAAG,CAAC,wBAAwB,YAAY,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,wCAAwC;AAExC,SAAS,cAAc;IACrB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,oBAAoB,EAAE,CAAC;QAC7C,KAAK,OAAO,CAAC,CAAC,OAAO,qBAAqB,EAAE,CAAC;QAC7C,OAAO,CAAC,CAAC,OAAO,mBAAmB,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,aAAqB;IAClE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,qBAAqB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACzE,KAAK,OAAO,CAAC,CAAC,OAAO,sBAAsB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,OAAO,oBAAoB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,oBAAoB,EAAE,CAAC;QAC7C,KAAK,OAAO,CAAC,CAAC,OAAO,qBAAqB,EAAE,CAAC;QAC7C,OAAO,CAAC,CAAC,OAAO,mBAAmB,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,OAAO,aAAa,CAAC;QACpC,KAAK,OAAO,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACtC,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,mBAAmB;AAEnB,SAAS,UAAU,CAAC,YAA2B;IAC7C,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEvC,sBAAsB;IACtB,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,YAAY,YAAY,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,mBAAmB;IACnB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,mBAAmB;IACnB,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,OAAO,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC1D,CAAC;IAED,YAAY;IACZ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,OAAO,GAAG,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,iBAAiB;AAEjB,eAAe;IACb,WAAW,EAAE,2EAA2E;IACxF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,8DAA8D,EAAE;QACrG,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,sCAAsC,EAAE;QACpF,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACvE,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE;KAC/D;IACD,KAAK,CAAC,MAAM,CAAC,IAA6E;QACxF,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QAEvC,WAAW;QACX,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,UAAU,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,WAAW;QACX,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,cAAc,EAAE,EAAE,CAAC;gBACrB,cAAc,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,SAAS,aAAa,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,UAAU,aAAa,EAAE,wCAAwC,CAAC,CAAC;YACjF,CAAC;YACD,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,4BAA4B;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,YAAY,YAAY,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,gCAAgC,CAAC,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,MAAM,CAAC,8DAA8D,CAAC,CAAC;QACzG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;gBACjE,IAAI,WAAW,KAAK,OAAO,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;oBACvE,UAAU,GAAG,KAAK,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,wDAAwD,WAAW,EAAE,CAAC,CAAC;oBACnF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;oBACzE,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;wBACnC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;wBACjD,UAAU,GAAG,KAAK,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,OAAO,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,QAAQ,CAAC,GAAG,YAAY,eAAe,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;gBAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,sFAAsF;QACtF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,YAAY,wBAAwB,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;QAED,yBAAyB;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,cAAc,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,SAAS,aAAa,EAAE,sCAAsC,CAAC,CAAC;YAC5E,cAAc,EAAE,CAAC;QACnB,CAAC;QAED,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,aAAa,EAAE,8BAA8B,aAAa,KAAK,CAAC,CAAC;QAEpF,UAAU;QACV,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,sBAAsB,aAAa,SAAS,aAAa,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {