@prism-d1/cli 1.0.70 → 1.0.71

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -222,89 +222,209 @@ jobs:
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
 
-      - name: Wait for Security Agent
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - name: AWS Continuum diff scan
         id: security-gate
-        with:
-          script: |
-            const pr = context.issue.number;
-            const opts = { owner: context.repo.owner, repo: context.repo.repo };
-
-            // Phase 1: Wait for Security Agent to start (2 min)
-            let reviewingComment = null;
-            for (let i = 0; i < 12; i++) {
-              const { data: comments } = await github.rest.issues.listComments({ ...opts, issue_number: pr });
-              reviewingComment = comments.find(c => c.user.login === 'aws-security-agent[bot]' && c.body.includes('reviewing your pull request'));
-              if (reviewingComment) break;
-              await new Promise(r => setTimeout(r, 10000));
-            }
-            if (!reviewingComment) { core.setOutput('findings', '0'); return; }
-
-            // Phase 2: Wait for completion (10 min) — look after the "reviewing" comment
-            const since = reviewingComment.created_at;
-            for (let i = 0; i < 40; i++) {
-              // Check for completed review submission (summary appears as review body, not issue comment)
-              const { data: reviews } = await github.rest.pulls.listReviews({ ...opts, pull_number: pr });
-              const botReview = reviews.find(r => r.user.login === 'aws-security-agent[bot]' && new Date(r.submitted_at) >= new Date(since));
-              // Check for inline review comments
-              const { data: reviewComments } = await github.rest.pulls.listReviewComments({ ...opts, pull_number: pr });
-              const findings = reviewComments.filter(c => c.user.login === 'aws-security-agent[bot]' && new Date(c.created_at) >= new Date(since));
-              if (botReview || findings.length > 0) {
-                core.setOutput('findings', String(findings.length));
-                return;
-              }
-              await new Promise(r => setTimeout(r, 15000));
-            }
-            core.setOutput('findings', '0');
+        env:
+          AWS_REGION: us-west-2
+        run: |
+          # Pre-flight: verify AWS CLI has securityagent subcommand
+          if ! aws securityagent help > /dev/null 2>&1; then
+            echo "::warning::AWS CLI does not support 'securityagent' commands (upgrade to v2.35+). Skipping scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "::group::Retrieve Continuum config from SSM"
+          AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
+          SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
+          SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
+          echo "::endgroup::"
+
+          # Skip if core infrastructure not deployed
+          if [[ -z "$AGENT_SPACE_ID" || -z "$SCAN_BUCKET" ]]; then
+            echo "⚠️ AWS Continuum not configured (agent-space-id or scan-bucket missing). Skipping security scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Fallback for service role if SSM param not yet deployed
+          if [[ -z "$SERVICE_ROLE" ]]; then
+            ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+            SERVICE_ROLE="arn:aws:iam::${ACCOUNT_ID}:role/prism-d1-security-agent-prism-d1-security"
+            echo "::notice::service-role-arn SSM param not found, using convention: ${SERVICE_ROLE}"
+          fi
+
+          # Derive repo slug for per-repo SSM key (org/repo → org-repo)
+          REPO_SLUG=$(echo "${{ github.repository }}" | tr '/' '-')
+
+          echo "::group::Resolve or bootstrap Code Review for ${REPO_SLUG}"
+          CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
+
+          if [[ -z "$CODE_REVIEW_ID" ]]; then
+            echo "  No Code Review found for ${REPO_SLUG} — bootstrapping..."
+
+            # Upload repo ZIP as context for the diff scan
+            git archive HEAD --format=zip -o /tmp/repo.zip
+            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+
+            # Create Code Review resource
+            CR_RESPONSE=$(aws securityagent create-code-review \
+              --agent-space-id "${AGENT_SPACE_ID}" \
+              --title "${REPO_SLUG}-ci-diff-scan" \
+              --service-role "${SERVICE_ROLE}" \
+              --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
+              --output json 2>&1)
+
+            if echo "$CR_RESPONSE" | jq -e '.codeReviewId' > /dev/null 2>&1; then
+              CODE_REVIEW_ID=$(echo "$CR_RESPONSE" | jq -r '.codeReviewId')
+              echo "  ✅ Code Review created: ${CODE_REVIEW_ID}"
+
+              # Persist for future runs
+              aws ssm put-parameter \
+                --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
+                --value "${CODE_REVIEW_ID}" \
+                --type String --overwrite 2>/dev/null || true
+            else
+              echo "  ⚠️ Failed to create Code Review: ${CR_RESPONSE}"
+              echo "  Skipping scan (non-blocking)."
+              echo "findings=0" >> "$GITHUB_OUTPUT"
+              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          else
+            echo "  Using existing Code Review: ${CODE_REVIEW_ID}"
+
+            # Re-upload fresh repo ZIP (context for accurate cross-module analysis)
+            git archive HEAD --format=zip -o /tmp/repo.zip
+            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+          fi
+          echo "::endgroup::"
 
-      - name: Forward Security Agent findings
-        if: steps.security-gate.outputs.findings != '0'
+          echo "::group::Generate and upload diff"
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.sha }}"
+          git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
+
+          DIFF_SIZE=$(wc -c < /tmp/changes.patch)
+          if [[ "$DIFF_SIZE" -eq 0 ]]; then
+            echo "No changes to scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          DIFF_KEY="diffs/${REPO_SLUG}/${{ github.event.pull_request.number }}/${HEAD_SHA}.patch"
+          aws s3 cp /tmp/changes.patch "s3://${SCAN_BUCKET}/${DIFF_KEY}" --quiet
+          echo "::endgroup::"
+
+          echo "::group::Start Continuum diff scan"
+          JOB_RESPONSE=$(aws securityagent start-code-review-job \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-id "${CODE_REVIEW_ID}" \
+            --diff-source "{\"s3Uri\":\"s3://${SCAN_BUCKET}/${DIFF_KEY}\"}" \
+            --output json)
+
+          JOB_ID=$(echo "$JOB_RESPONSE" | jq -r '.codeReviewJobId')
+          echo "Job started: ${JOB_ID}"
+          echo "::endgroup::"
+
+          echo "::group::Poll for completion (timeout: 15 min)"
+          for i in $(seq 1 30); do
+            sleep 30
+            STATUS=$(aws securityagent batch-get-code-review-jobs \
+              --agent-space-id "${AGENT_SPACE_ID}" \
+              --code-review-job-ids "${JOB_ID}" \
+              --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
+
+            echo "  Poll ${i}/30: ${STATUS}"
+            if [[ "$STATUS" == "COMPLETED" || "$STATUS" == "FAILED" || "$STATUS" == "STOPPED" ]]; then
+              break
+            fi
+          done
+          echo "::endgroup::"
+
+          if [[ "$STATUS" == "FAILED" ]]; then
+            echo "::warning::Continuum scan failed — treating as 0 findings (non-blocking)"
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "$STATUS" != "COMPLETED" ]]; then
+            echo "::warning::Continuum scan timed out (status: ${STATUS}) — treating as 0 findings"
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "::group::Retrieve findings"
+          FINDINGS_JSON=$(aws securityagent list-findings \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-job-id "${JOB_ID}" \
+            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+
+          TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
+          CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
+          HIGH=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "HIGH")] | length')
+          MEDIUM=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "MEDIUM")] | length')
+
+          echo "Findings: ${TOTAL} total (${CRITICAL} critical, ${HIGH} high, ${MEDIUM} medium)"
+          echo "findings=${TOTAL}" >> "$GITHUB_OUTPUT"
+          echo "critical=${CRITICAL}" >> "$GITHUB_OUTPUT"
+          echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
+          echo "findings_json=$(echo "$FINDINGS_JSON" | jq -c '.findingsSummaries')" >> "$GITHUB_OUTPUT"
+          echo "::endgroup::"
+
+          # Print findings summary for PR annotations
+          if [[ "$TOTAL" -gt 0 ]]; then
+            echo "$FINDINGS_JSON" | jq -r '.findingsSummaries[] | "::error ::[\(.riskLevel)] \(.name | .[0:120])"'
+          fi
+
+      - name: Emit Continuum findings to EventBridge
+        if: steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          AWS_REGION: us-west-2
         run: |
           PR_NUMBER="${{ github.event.pull_request.number }}"
           REPO="${{ github.repository }}"
           TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
+          FINDINGS='${{ steps.security-gate.outputs.findings_json }}'
 
           AI_ORIGIN="human"
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.sha }}"
           for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
             if git log -1 --format='%B' "${SHA}" | grep -q 'AI-Origin: ai-generated\|AI-Origin: ai-assisted'; then
               AI_ORIGIN="ai-assisted"; break
             fi
           done
 
-          REVIEW_COMMENTS=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/comments" --paginate 2>/dev/null || echo "[]")
-
-          ENTRIES=$(echo "${REVIEW_COMMENTS}" | jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
+          ENTRIES=$(echo "${FINDINGS}" | jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
             --arg ai_origin "${AI_ORIGIN}" --argjson pr_number "${PR_NUMBER}" '
-            def cwe_severity:
-              {"89":"CRITICAL","78":"CRITICAL","94":"CRITICAL","502":"CRITICAL","798":"CRITICAL",
-               "79":"HIGH","22":"HIGH","918":"HIGH","352":"HIGH","287":"HIGH","862":"HIGH",
-               "200":"MEDIUM","532":"MEDIUM","601":"MEDIUM"};
-            [.[] | select(.user.login == "aws-security-agent[bot]")] |
-            to_entries | map(.value as $c |
-              ($c.body | capture("CWE-(?<id>[0-9]+)") // {id: null}).id as $cwe_id |
-              (if $cwe_id then (cwe_severity[$cwe_id] // "MEDIUM") else "MEDIUM" end) as $severity |
+            to_entries | map(.value as $f |
               {Source:"prism.d1.velocity", DetailType:"prism.d1.security.code_review",
                EventBusName:"prism-d1-metrics",
-               Detail:({team_id:$team_id, repo:$repo, timestamp:$c.created_at, prism_level:3,
+               Detail:({team_id:$team_id, repo:$repo, timestamp:($f.createdAt // now | tostring), prism_level:3,
                  metric:{name:"security_finding",value:1,unit:"count"},
-                 ai_context:{tool:"security-agent",model:"aws-security-agent",origin:$ai_origin},
-                 security_agent_finding:{finding_id:"sa-pr\($pr_number)-\($c.id)", phase:"code_review",
-                   severity:$severity, cwe_id:(if $cwe_id then "CWE-\($cwe_id)" else null end),
-                   ai_origin:$ai_origin, found_at:$c.created_at}
+                 ai_context:{tool:"continuum",model:"aws-continuum",origin:$ai_origin},
+                 continuum_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
+                   severity:($f.riskLevel // "MEDIUM"),
+                   cwe_id:($f.cweId // null),
+                   ai_origin:$ai_origin, found_at:($f.createdAt // null)}
                } | tostring)})' 2>/dev/null || echo "[]")
 
           TOTAL=$(echo "${ENTRIES}" | jq 'length')
-          for i in $(seq 0 10 $((TOTAL - 1))); do
-            aws events put-events --region us-west-2 --entries "$(echo "${ENTRIES}" | jq ".[$i:$((i+10))]")"
-          done
+          if [[ "$TOTAL" -gt 0 ]]; then
+            for i in $(seq 0 10 $((TOTAL - 1))); do
+              aws events put-events --entries "$(echo "${ENTRIES}" | jq ".[$i:$((i+10))]")"
+            done
+            echo "Emitted ${TOTAL} finding events to EventBridge"
+          fi
 
       - name: Fail on eval or security issues
-        if: steps.eval.outputs.overall_result == 'FAIL' || steps.security-gate.outputs.findings != '0'
+        if: steps.eval.outputs.overall_result == 'FAIL' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
         run: |
           [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
-          [[ "${{ steps.security-gate.outputs.findings }}" != "0" ]] && echo "❌ Security Agent found ${{ steps.security-gate.outputs.findings }} issues"
+          if [[ "${{ steps.security-gate.outputs.findings }}" != "0" && "${{ steps.security-gate.outputs.skipped }}" != "true" ]]; then
+            echo "❌ AWS Continuum found ${{ steps.security-gate.outputs.findings }} security issues (${{ steps.security-gate.outputs.critical }} critical, ${{ steps.security-gate.outputs.high }} high)"
+          fi
           exit 1

package/dist/assets/infra/lib/constructs/security-agent-construct.ts

@@ -3,6 +3,8 @@ import * as securityagent from 'aws-cdk-lib/aws-securityagent';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as kms from 'aws-cdk-lib/aws-kms';
 import * as logs from 'aws-cdk-lib/aws-logs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
 import { Construct } from 'constructs';
 import { NagSuppressions } from 'cdk-nag';
 
@@ -52,6 +54,13 @@ export interface SecurityAgentProps {
    */
   codeRemediationStrategy?: 'AUTOMATIC' | 'DISABLED';
 
+  /**
+   * SSM Parameter Store prefix for CI/CD config retrieval.
+   * Stores agent space ID, code review ID, and scan bucket name.
+   * @default '/prism/continuum'
+   */
+  ssmParameterPrefix?: string;
+
   /**
    * Tags applied to all Security Agent resources.
    */
@@ -71,6 +80,7 @@ export class SecurityAgentConstruct extends Construct {
   public readonly agentSpaceId: string;
   public readonly serviceRole: iam.Role;
   public readonly targetDomainIds: string[];
+  public readonly scanBucket: s3.Bucket;
 
   constructor(scope: Construct, id: string, props: SecurityAgentProps) {
     super(scope, id);
@@ -93,9 +103,11 @@ export class SecurityAgentConstruct extends Construct {
       }),
     );
 
-    // Grant KMS permissions for encrypted agent spaces
+    // Grant KMS permissions for encrypted agent spaces + log groups
     if (props.kmsKey) {
       props.kmsKey.grantEncryptDecrypt(this.serviceRole);
+      // DescribeKey is required for CreateLogGroup with KMS encryption
+      props.kmsKey.grant(this.serviceRole, 'kms:DescribeKey', 'kms:CreateGrant');
     }
 
     // Grant CloudWatch Logs access for pen test logging
@@ -197,11 +209,12 @@ export class SecurityAgentConstruct extends Construct {
     }
 
     // Log group for pen test results (Security Agent writes to /aws/securityagent/<space>/pt-<id>)
-    new logs.LogGroup(this, 'PentestLogGroup', {
-      logGroupName: `/aws/securityagent/${props.agentSpaceName}`,
-      retention: logs.RetentionDays.SIX_MONTHS,
-      removalPolicy: cdk.RemovalPolicy.RETAIN,
-    });
+    // Note: we do NOT set logGroupName to avoid conflicts with pre-existing log groups
+    // created by prism-cli securityagent setup or the Security Agent service itself.
+    const pentestLogGroup = logs.LogGroup.fromLogGroupName(
+      this, 'PentestLogGroup',
+      `/aws/securityagent/${props.agentSpaceName}`,
+    );
 
     // Outputs
     new cdk.CfnOutput(this, 'AgentSpaceIdOutput', {
@@ -223,6 +236,111 @@ export class SecurityAgentConstruct extends Construct {
         exportName: `PrismD1SecurityAgentDomainIds`,
       });
     }
+
+    // -------------------------------------------------------
+    // S3 Scan Bucket — stores repo ZIPs and diff files for
+    // API-triggered code reviews (diff scans from CI/CD).
+    // -------------------------------------------------------
+    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
+      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
+      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
+      // this bucket when creating the code review and cannot access a CMK it
+      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
+      // the bucket is private (BLOCK_ALL) and SSL-enforced.
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      versioned: false,
+      lifecycleRules: [
+        {
+          id: 'expire-scan-artifacts',
+          expiration: cdk.Duration.days(30),
+          enabled: true,
+        },
+      ],
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
+    // Grant Security Agent service role read access to the scan bucket
+    this.scanBucket.grantRead(this.serviceRole);
+
+    // Suppress cdk-nag for S3 read grant wildcards (grantRead expands to s3:GetObject*, s3:GetBucket*, s3:List*)
+    NagSuppressions.addResourceSuppressions(
+      this.serviceRole,
+      [
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'grantRead() generates s3:GetObject*, s3:GetBucket*, s3:List* — standard CDK pattern for bucket read access',
+          appliesTo: ['Action::s3:GetObject*', 'Action::s3:GetBucket*', 'Action::s3:List*'],
+        },
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'Scan bucket objects are dynamic (SHA-named diffs); wildcard on objects required',
+          appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+        },
+      ],
+      true,
+    );
+
+    NagSuppressions.addResourceSuppressions(
+      this.scanBucket,
+      [
+        {
+          id: 'AwsSolutions-S1',
+          reason: 'Access logging not required for ephemeral scan artifacts (30-day lifecycle, auto-deleted)',
+        },
+      ],
+      true,
+    );
+
+    // -------------------------------------------------------
+    // Code Review resource — NOT created here in CDK.
+    // CreateCodeReview requires assets.sourceCode pointing to
+    // an existing ZIP of the repo (chicken-and-egg at deploy).
+    // Instead, `prism-cli securityagent setup` handles:
+    //   1. git archive → upload repo.zip to scan bucket
+    //   2. CreateCodeReview API call
+    //   3. Write code-review-id to SSM
+    // The CDK only provisions the bucket + role + SSM scaffold.
+    // -------------------------------------------------------
+
+    new cdk.CfnOutput(this, 'ScanBucketOutput', {
+      value: this.scanBucket.bucketName,
+      description: 'S3 bucket for scan artifacts (repo ZIPs + diffs)',
+      exportName: 'PrismD1ContinuumScanBucket',
+    });
+
+    // -------------------------------------------------------
+    // SSM Parameter Store — non-sensitive CI/CD config.
+    // GitHub Actions workflows read these at runtime so no
+    // hardcoded IDs are needed in the repository.
+    // -------------------------------------------------------
+    const prefix = props.ssmParameterPrefix ?? '/prism/continuum';
+
+    new ssm.StringParameter(this, 'ParamAgentSpaceId', {
+      parameterName: `${prefix}/agent-space-id`,
+      stringValue: this.agentSpaceId,
+      description: 'AWS Continuum Agent Space ID for PRISM D1',
+      tier: ssm.ParameterTier.STANDARD,
+    });
+
+    // code-review-id is written by `prism-cli securityagent setup` (not CDK)
+    // because CreateCodeReview needs an existing repo ZIP in S3 first.
+
+    new ssm.StringParameter(this, 'ParamScanBucket', {
+      parameterName: `${prefix}/scan-bucket`,
+      stringValue: this.scanBucket.bucketName,
+      description: 'S3 bucket name for uploading repo/diff scan artifacts',
+      tier: ssm.ParameterTier.STANDARD,
+    });
+
+    new ssm.StringParameter(this, 'ParamServiceRoleArn', {
+      parameterName: `${prefix}/service-role-arn`,
+      stringValue: this.serviceRole.roleArn,
+      description: 'Service role ARN for Continuum CreateCodeReview (passed via --service-role)',
+      tier: ssm.ParameterTier.STANDARD,
+    });
   }
 
   /**

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -421,13 +421,108 @@ export class MetricsPipelineStack extends cdk.Stack {
     if (enableSecurityAgent) {
       this.securityAgent = new SecurityAgentConstruct(this, 'SecurityAgent', {
         agentSpaceName: 'prism-d1-security',
-        description: 'PRISM D1 Security Agent space for design review, code review, and pen testing',
+        description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
         kmsKey: prismKmsKey,
         codeRemediationStrategy: 'DISABLED',
         tags: {
           'prism:pillar': 'security',
         },
       });
+
+      // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
+      // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
+      // with name pattern prism-d1-github-oidc-*.
+      this.securityAgent.scanBucket.addToResourcePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
+          actions: ['s3:PutObject', 's3:GetObject'],
+          resources: [this.securityAgent.scanBucket.arnForObjects('*')],
+          conditions: {
+            ArnLike: {
+              'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
+            },
+          },
+        }),
+      );
+
+      // Create a managed policy for Continuum scan API access.
+      // Attached to the OIDC role by the bootstrapper setup script.
+      const continuumCiPolicy = new iam.ManagedPolicy(this, 'ContinuumCiPolicy', {
+        managedPolicyName: 'prism-d1-continuum-ci-scan',
+        description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
+        statements: [
+          new iam.PolicyStatement({
+            sid: 'ContinuumScanAPIs',
+            effect: iam.Effect.ALLOW,
+            actions: [
+              'securityagent:StartCodeReviewJob',
+              'securityagent:BatchGetCodeReviewJobs',
+              'securityagent:BatchGetCodeReviewJobTasks',
+              'securityagent:ListFindings',
+              'securityagent:BatchGetFindings',
+              'securityagent:CreateCodeReview',
+              'securityagent:ListCodeReviews',
+            ],
+            resources: [
+              `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
+            ],
+          }),
+          new iam.PolicyStatement({
+            sid: 'PassRoleForCodeReview',
+            effect: iam.Effect.ALLOW,
+            actions: ['iam:PassRole'],
+            resources: [this.securityAgent.serviceRole.roleArn],
+            conditions: {
+              StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
+            },
+          }),
+          new iam.PolicyStatement({
+            sid: 'ScanBucketWrite',
+            effect: iam.Effect.ALLOW,
+            actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
+            resources: [
+              this.securityAgent.scanBucket.bucketArn,
+              this.securityAgent.scanBucket.arnForObjects('*'),
+            ],
+          }),
+          new iam.PolicyStatement({
+            sid: 'SSMReadConfig',
+            effect: iam.Effect.ALLOW,
+            actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
+            resources: [
+              `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
+            ],
+          }),
+        ],
+      });
+
+      NagSuppressions.addResourceSuppressions(
+        continuumCiPolicy,
+        [
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
+            appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
+          },
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
+            appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+          },
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
+            appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
+          },
+        ],
+        true,
+      );
+
+      new cdk.CfnOutput(this, 'ContinuumCiPolicyArn', {
+        value: continuumCiPolicy.managedPolicyArn,
+        description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
+      });
     }
 
     // -------------------------------------------------------

package/dist/src/commands/securityagent/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":";;;;;;;oBAsCkB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;AANrD,wBAyFE"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":";;;;;;;oBAsCkB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;AANrD,wBA+KE"}

package/dist/src/commands/securityagent/setup.js

@@ -109,6 +109,85 @@ export default {
         console.log(`   Application: ${applicationId}`);
         console.log(`   Web console: https://${region}.console.aws.amazon.com/securityagent/home?region=${region}`);
         console.log('   Click "Admin access" to open the web app.');
+        // -------------------------------------------------------
+        // Create Code Review for CI diff scans
+        // Requires: repo ZIP uploaded to scan bucket first
+        // -------------------------------------------------------
+        console.log('\n📦 Setting up Code Review for CI/CD diff scans...');
+        // Get scan bucket from SSM (created by CDK)
+        const bucketParam = runCapture(`aws ssm get-parameter --name /prism/continuum/scan-bucket ${env} --query Parameter.Value --output text`);
+        if (!bucketParam.ok || !bucketParam.stdout) {
+            console.log('   ⚠️  Scan bucket SSM param not found. Deploy with --context enableSecurityAgent=true first.');
+            console.log('   Skipping Code Review creation.');
+            return;
+        }
+        const scanBucket = bucketParam.stdout;
+        console.log(`   Scan bucket: ${scanBucket}`);
+        // Zip the repo and upload
+        console.log('   Archiving repo...');
+        const repoRoot = process.cwd();
+        const zipResult = runCapture(`cd ${repoRoot} && git archive HEAD --format=zip -o /tmp/prism-repo.zip`);
+        if (!zipResult.ok) {
+            console.log(`   ⚠️  git archive failed (not a git repo?): ${zipResult.stdout}`);
+            console.log('   Skipping Code Review creation. Run from a git repo root.');
+            return;
+        }
+        const upload = runCapture(`aws s3 cp /tmp/prism-repo.zip s3://${scanBucket}/repo/latest.zip ${env}`);
+        if (!upload.ok) {
+            console.error(`   Failed to upload repo ZIP: ${upload.stdout}`);
+            return;
+        }
+        console.log('   ✅ Repo ZIP uploaded');
+        // Create Code Review (or find existing)
+        const codeReviewTitle = 'prism-d1-security-ci-diff-scan';
+        const createCr = runCapture(`aws securityagent create-code-review ` +
+            `--agent-space-id ${agentSpaceId} ` +
+            `--title ${codeReviewTitle} ` +
+            `--service-role ${roleArn} ` +
+            `--assets '{"sourceCode":[{"s3Location":"s3://${scanBucket}/repo/latest.zip"}]}' ` +
+            `${env} --output json`);
+        let codeReviewId;
+        if (createCr.ok) {
+            codeReviewId = JSON.parse(createCr.stdout).codeReviewId;
+            console.log(`   ✅ Code Review created: ${codeReviewId}`);
+        }
+        else if (createCr.stdout.includes('Conflict') || createCr.stdout.includes('already exists')) {
+            // Already exists — find it
+            const listCr = runCapture(`aws securityagent list-code-reviews --agent-space-id ${agentSpaceId} ${env} --output json`);
+            if (listCr.ok) {
+                const reviews = JSON.parse(listCr.stdout).codeReviews || [];
+                const existing = reviews.find((r) => r.title === codeReviewTitle);
+                if (existing) {
+                    codeReviewId = existing.codeReviewId;
+                    console.log(`   ✅ Code Review already exists: ${codeReviewId}`);
+                }
+                else {
+                    console.error('   ❌ Could not find existing Code Review');
+                    return;
+                }
+            }
+            else {
+                console.error(`   ❌ Failed to list code reviews: ${listCr.stdout}`);
+                return;
+            }
+        }
+        else {
+            console.error(`   ❌ Failed to create Code Review: ${createCr.stdout}`);
+            console.log('   The CI workflow will skip Continuum scanning until this is resolved.');
+            return;
+        }
+        // Write code-review-id to SSM
+        const ssmWrite = runCapture(`aws ssm put-parameter --name /prism/continuum/code-review-id ` +
+            `--value "${codeReviewId}" --type String --overwrite ${env}`);
+        if (ssmWrite.ok) {
+            console.log('   ✅ Code Review ID written to SSM: /prism/continuum/code-review-id');
+        }
+        else {
+            console.log(`   ⚠️  Failed to write SSM param: ${ssmWrite.stdout}`);
+            console.log(`   Manually run: aws ssm put-parameter --name /prism/continuum/code-review-id --value "${codeReviewId}" --type String --overwrite ${env}`);
+        }
+        console.log('\n🎉 Continuum CI scanning ready!');
+        console.log('   The eval gate workflow will now run diff scans on every PR.');
     },
 };
 //# sourceMappingURL=setup.js.map

package/dist/src/commands/securityagent/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,yEAAyE;IACtF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE;QACrG,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE;KAChF;IACD,MAAM,CAAC,OAA4C;QACjD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,MAAM,EAAE,CAAC;QAE1E,yCAAyC;QACzC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,UAAU,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,EAAE;YACb,mBAAmB,EAAE,OAAO,CAAC,MAAM;YACnC,kBAAkB,EAAE,MAAM;YAC1B,kBAAkB,EAAE,MAAM;SAC3B,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,2EAA2E,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9C,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;QAE/C,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACpF,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,wCAAwC,GAAG,gBAAgB,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,gBAAgB,OAAO,CAAC,MAAM,iDAAiD,CAAC;QAEhG,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,yDAAyD,aAAa,eAAe,OAAO,IAAI,GAAG,gBAAgB,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,qDAAqD,MAAM,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,yEAAyE;IACtF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE;QACrG,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE;KAChF;IACD,MAAM,CAAC,OAA4C;QACjD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,MAAM,EAAE,CAAC;QAE1E,yCAAyC;QACzC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,UAAU,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,EAAE;YACb,mBAAmB,EAAE,OAAO,CAAC,MAAM;YACnC,kBAAkB,EAAE,MAAM;YAC1B,kBAAkB,EAAE,MAAM;SAC3B,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,2EAA2E,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9C,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;QAE/C,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACpF,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,wCAAwC,GAAG,gBAAgB,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,gBAAgB,OAAO,CAAC,MAAM,iDAAiD,CAAC;QAEhG,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,yDAAyD,aAAa,eAAe,OAAO,IAAI,GAAG,gBAAgB,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,qDAAqD,MAAM,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAE5D,0DAA0D;QAC1D,uCAAuC;QACvC,mDAAmD;QACnD,0DAA0D;QAC1D,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAEnE,4CAA4C;QAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,6DAA6D,GAAG,wCAAwC,CAAC,CAAC;QACzI,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;YAC7G,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,QAAQ,0DAA0D,CAAC,CAAC;QACvG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,gDAAgD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,sCAAsC,UAAU,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAEtC,wCAAwC;QACxC,MAAM,eAAe,GAAG,gCAAgC,CAAC;QACzD,MAAM,QAAQ,GAAG,UAAU,CACzB,uCAAuC;YACvC,oBAAoB,YAAY,GAAG;YACnC,WAAW,eAAe,GAAG;YAC7B,kBAAkB,OAAO,GAAG;YAC5B,gDAAgD,UAAU,wBAAwB;YAClF,GAAG,GAAG,gBAAgB,CACvB,CAAC;QAEF,IAAI,YAAoB,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9F,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,wDAAwD,YAAY,IAAI,GAAG,gBAAgB,CAAC,CAAC;YACvH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;gBACvE,IAAI,QAAQ,EAAE,CAAC;oBACb,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,UAAU,CACzB,+DAA+D;YAC/D,YAAY,YAAY,+BAA+B,GAAG,EAAE,CAC7D,CAAC;QACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,0FAA0F,YAAY,+BAA+B,GAAG,EAAE,CAAC,CAAC;QAC1J,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.70",
+  "version": "1.0.71",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {