@prism-d1/cli 1.0.70 → 1.0.72

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -222,89 +222,232 @@ jobs:
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
 
-      - name: Wait for Security Agent
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.35+)
+        run: |
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o /tmp/awscliv2.zip.sha256
+          cd /tmp && sha256sum -c awscliv2.zip.sha256
+          unzip -qo /tmp/awscliv2.zip -d /tmp
+          sudo /tmp/aws/install --update --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || \
+            sudo /tmp/aws/install --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || true
+          rm -rf /tmp/aws /tmp/awscliv2.zip /tmp/awscliv2.zip.sha256
+          hash -r
+          echo "AWS CLI: $(aws --version)"
+          echo "Has create-code-review: $(aws securityagent create-code-review help 2>&1 | head -1)"
+
+      - name: AWS Continuum diff scan
         id: security-gate
-        with:
-          script: |
-            const pr = context.issue.number;
-            const opts = { owner: context.repo.owner, repo: context.repo.repo };
-
-            // Phase 1: Wait for Security Agent to start (2 min)
-            let reviewingComment = null;
-            for (let i = 0; i < 12; i++) {
-              const { data: comments } = await github.rest.issues.listComments({ ...opts, issue_number: pr });
-              reviewingComment = comments.find(c => c.user.login === 'aws-security-agent[bot]' && c.body.includes('reviewing your pull request'));
-              if (reviewingComment) break;
-              await new Promise(r => setTimeout(r, 10000));
-            }
-            if (!reviewingComment) { core.setOutput('findings', '0'); return; }
-
-            // Phase 2: Wait for completion (10 min) — look after the "reviewing" comment
-            const since = reviewingComment.created_at;
-            for (let i = 0; i < 40; i++) {
-              // Check for completed review submission (summary appears as review body, not issue comment)
-              const { data: reviews } = await github.rest.pulls.listReviews({ ...opts, pull_number: pr });
-              const botReview = reviews.find(r => r.user.login === 'aws-security-agent[bot]' && new Date(r.submitted_at) >= new Date(since));
-              // Check for inline review comments
-              const { data: reviewComments } = await github.rest.pulls.listReviewComments({ ...opts, pull_number: pr });
-              const findings = reviewComments.filter(c => c.user.login === 'aws-security-agent[bot]' && new Date(c.created_at) >= new Date(since));
-              if (botReview || findings.length > 0) {
-                core.setOutput('findings', String(findings.length));
-                return;
-              }
-              await new Promise(r => setTimeout(r, 15000));
-            }
-            core.setOutput('findings', '0');
+        env:
+          AWS_REGION: us-west-2
+        run: |
+          # Pre-flight: verify AWS CLI has securityagent subcommand
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::warning::AWS CLI does not support 'securityagent code review' commands after upgrade. Skipping scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "::group::Retrieve Continuum config from SSM"
+          AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
+          SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
+          SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
+          echo "::endgroup::"
+
+          # Skip if core infrastructure not deployed
+          if [[ -z "$AGENT_SPACE_ID" || -z "$SCAN_BUCKET" ]]; then
+            echo "⚠️ AWS Continuum not configured (agent-space-id or scan-bucket missing). Skipping security scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Fallback for service role if SSM param not yet deployed
+          if [[ -z "$SERVICE_ROLE" ]]; then
+            ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+            SERVICE_ROLE="arn:aws:iam::${ACCOUNT_ID}:role/prism-d1-security-agent-prism-d1-security"
+            echo "::notice::service-role-arn SSM param not found, using convention: ${SERVICE_ROLE}"
+          fi
+
+          # Derive repo slug for per-repo SSM key (org/repo → org-repo)
+          REPO_SLUG=$(echo "${{ github.repository }}" | tr '/' '-')
+
+          echo "::group::Resolve Code Review for ${REPO_SLUG}"
+          CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
+
+          if [[ -z "$CODE_REVIEW_ID" ]]; then
+            echo "  No Code Review found for ${REPO_SLUG} -- bootstrapping..."
+            echo "  CLI version: $(aws --version 2>&1 | head -1)"
+            echo "  CLI path: $(which aws)"
+
+            # Upload repo ZIP first (required as source context for the CodeReview)
+            git archive HEAD --format=zip -o /tmp/repo.zip
+            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+
+            # Create the CodeReview
+            CR_OUTPUT=$(aws securityagent create-code-review \
+              --agent-space-id "$AGENT_SPACE_ID" \
+              --title "${REPO_SLUG}-ci-diff-scan" \
+              --service-role "$SERVICE_ROLE" \
+              --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
+              --output json 2>&1) || true
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+
+            if [[ -z "$CODE_REVIEW_ID" ]]; then
+              echo "  ⚠️ Bootstrap failed:"
+              echo "  $CR_OUTPUT"
+              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
+              echo "  Skipping security scan (non-blocking)."
+              echo "findings=0" >> "$GITHUB_OUTPUT"
+              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            # Persist for future runs
+            aws ssm put-parameter \
+              --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
+              --value "$CODE_REVIEW_ID" \
+              --type String --overwrite > /dev/null
 
-      - name: Forward Security Agent findings
-        if: steps.security-gate.outputs.findings != '0'
+            echo "  [x] Code Review created: ${CODE_REVIEW_ID}"
+            echo "  [x] Saved to SSM"
+          fi
+
+          echo "  Using Code Review: ${CODE_REVIEW_ID}"
+
+          # Upload fresh repo ZIP (context for accurate cross-module analysis)
+          git archive HEAD --format=zip -o /tmp/repo.zip
+          aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+          echo "::endgroup::"
+
+          echo "::group::Generate and upload diff"
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.sha }}"
+          git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
+
+          DIFF_SIZE=$(wc -c < /tmp/changes.patch)
+          if [[ "$DIFF_SIZE" -eq 0 ]]; then
+            echo "No changes to scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          DIFF_KEY="diffs/${REPO_SLUG}/${{ github.event.pull_request.number }}/${HEAD_SHA}.patch"
+          aws s3 cp /tmp/changes.patch "s3://${SCAN_BUCKET}/${DIFF_KEY}" --quiet
+          echo "::endgroup::"
+
+          echo "::group::Start Continuum diff scan"
+          JOB_RESPONSE=$(aws securityagent start-code-review-job \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-id "${CODE_REVIEW_ID}" \
+            --diff-source "{\"s3Uri\":\"s3://${SCAN_BUCKET}/${DIFF_KEY}\"}" \
+            --output json)
+
+          JOB_ID=$(echo "$JOB_RESPONSE" | jq -r '.codeReviewJobId')
+          echo "Job started: ${JOB_ID}"
+          echo "::endgroup::"
+
+          echo "::group::Poll for completion (timeout: 30 min)"
+          for i in $(seq 1 60); do
+            sleep 30
+            STATUS=$(aws securityagent batch-get-code-review-jobs \
+              --agent-space-id "${AGENT_SPACE_ID}" \
+              --code-review-job-ids "${JOB_ID}" \
+              --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
+
+            echo "  Poll ${i}/60: ${STATUS}"
+            if [[ "$STATUS" == "COMPLETED" || "$STATUS" == "FAILED" || "$STATUS" == "STOPPED" ]]; then
+              break
+            fi
+          done
+          echo "::endgroup::"
+
+          if [[ "$STATUS" == "FAILED" ]]; then
+            echo "::warning::Continuum scan failed — check Security Agent logs"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "$STATUS" != "COMPLETED" ]]; then
+            echo "::warning::Continuum scan timed out (status: ${STATUS})"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "::group::Retrieve findings"
+          FINDINGS_JSON=$(aws securityagent list-findings \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-job-id "${JOB_ID}" \
+            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+
+          TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
+          CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
+          HIGH=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "HIGH")] | length')
+          MEDIUM=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "MEDIUM")] | length')
+
+          echo "Findings: ${TOTAL} total (${CRITICAL} critical, ${HIGH} high, ${MEDIUM} medium)"
+          echo "findings=${TOTAL}" >> "$GITHUB_OUTPUT"
+          echo "critical=${CRITICAL}" >> "$GITHUB_OUTPUT"
+          echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
+          echo "findings_json=$(echo "$FINDINGS_JSON" | jq -c '.findingsSummaries')" >> "$GITHUB_OUTPUT"
+          echo "::endgroup::"
+
+          # Print findings summary for PR annotations
+          if [[ "$TOTAL" -gt 0 ]]; then
+            echo "$FINDINGS_JSON" | jq -r '.findingsSummaries[] | "::error ::[\(.riskLevel)] \(.name | .[0:120])"'
+          fi
+
+      - name: Emit Continuum findings to EventBridge
+        if: steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          AWS_REGION: us-west-2
         run: |
           PR_NUMBER="${{ github.event.pull_request.number }}"
           REPO="${{ github.repository }}"
           TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
+          FINDINGS='${{ steps.security-gate.outputs.findings_json }}'
 
           AI_ORIGIN="human"
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.sha }}"
           for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
             if git log -1 --format='%B' "${SHA}" | grep -q 'AI-Origin: ai-generated\|AI-Origin: ai-assisted'; then
               AI_ORIGIN="ai-assisted"; break
             fi
           done
 
-          REVIEW_COMMENTS=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/comments" --paginate 2>/dev/null || echo "[]")
-
-          ENTRIES=$(echo "${REVIEW_COMMENTS}" | jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
+          ENTRIES=$(echo "${FINDINGS}" | jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
             --arg ai_origin "${AI_ORIGIN}" --argjson pr_number "${PR_NUMBER}" '
-            def cwe_severity:
-              {"89":"CRITICAL","78":"CRITICAL","94":"CRITICAL","502":"CRITICAL","798":"CRITICAL",
-               "79":"HIGH","22":"HIGH","918":"HIGH","352":"HIGH","287":"HIGH","862":"HIGH",
-               "200":"MEDIUM","532":"MEDIUM","601":"MEDIUM"};
-            [.[] | select(.user.login == "aws-security-agent[bot]")] |
-            to_entries | map(.value as $c |
-              ($c.body | capture("CWE-(?<id>[0-9]+)") // {id: null}).id as $cwe_id |
-              (if $cwe_id then (cwe_severity[$cwe_id] // "MEDIUM") else "MEDIUM" end) as $severity |
+            to_entries | map(.value as $f |
               {Source:"prism.d1.velocity", DetailType:"prism.d1.security.code_review",
                EventBusName:"prism-d1-metrics",
-               Detail:({team_id:$team_id, repo:$repo, timestamp:$c.created_at, prism_level:3,
+               Detail:({team_id:$team_id, repo:$repo, timestamp:($f.createdAt // now | tostring), prism_level:3,
                  metric:{name:"security_finding",value:1,unit:"count"},
-                 ai_context:{tool:"security-agent",model:"aws-security-agent",origin:$ai_origin},
-                 security_agent_finding:{finding_id:"sa-pr\($pr_number)-\($c.id)", phase:"code_review",
-                   severity:$severity, cwe_id:(if $cwe_id then "CWE-\($cwe_id)" else null end),
-                   ai_origin:$ai_origin, found_at:$c.created_at}
+                 ai_context:{tool:"continuum",model:"aws-continuum",origin:$ai_origin},
+                 continuum_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
+                   severity:($f.riskLevel // "MEDIUM"),
+                   cwe_id:($f.cweId // null),
+                   ai_origin:$ai_origin, found_at:($f.createdAt // null)}
                } | tostring)})' 2>/dev/null || echo "[]")
 
           TOTAL=$(echo "${ENTRIES}" | jq 'length')
-          for i in $(seq 0 10 $((TOTAL - 1))); do
-            aws events put-events --region us-west-2 --entries "$(echo "${ENTRIES}" | jq ".[$i:$((i+10))]")"
-          done
+          if [[ "$TOTAL" -gt 0 ]]; then
+            for i in $(seq 0 10 $((TOTAL - 1))); do
+              aws events put-events --entries "$(echo "${ENTRIES}" | jq ".[$i:$((i+10))]")"
+            done
+            echo "Emitted ${TOTAL} finding events to EventBridge"
+          fi
 
       - name: Fail on eval or security issues
-        if: steps.eval.outputs.overall_result == 'FAIL' || steps.security-gate.outputs.findings != '0'
+        if: steps.eval.outputs.overall_result == 'FAIL' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
         run: |
           [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
-          [[ "${{ steps.security-gate.outputs.findings }}" != "0" ]] && echo "❌ Security Agent found ${{ steps.security-gate.outputs.findings }} issues"
+          if [[ "${{ steps.security-gate.outputs.scan_error }}" == "true" ]]; then
+            echo "⚠️ AWS Continuum scan encountered an error (did not complete successfully)"
+            echo "  The security gate cannot verify this PR is safe. Re-run the workflow or check Security Agent logs."
+          elif [[ "${{ steps.security-gate.outputs.findings }}" != "0" && "${{ steps.security-gate.outputs.skipped }}" != "true" ]]; then
+            echo "❌ AWS Continuum found ${{ steps.security-gate.outputs.findings }} security issues (${{ steps.security-gate.outputs.critical }} critical, ${{ steps.security-gate.outputs.high }} high)"
+          fi
           exit 1

package/dist/assets/infra/lib/constructs/security-agent-construct.ts

@@ -3,6 +3,8 @@ import * as securityagent from 'aws-cdk-lib/aws-securityagent';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as kms from 'aws-cdk-lib/aws-kms';
 import * as logs from 'aws-cdk-lib/aws-logs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
 import { Construct } from 'constructs';
 import { NagSuppressions } from 'cdk-nag';
 
@@ -52,6 +54,13 @@ export interface SecurityAgentProps {
    */
   codeRemediationStrategy?: 'AUTOMATIC' | 'DISABLED';
 
+  /**
+   * SSM Parameter Store prefix for CI/CD config retrieval.
+   * Stores agent space ID, code review ID, and scan bucket name.
+   * @default '/prism/continuum'
+   */
+  ssmParameterPrefix?: string;
+
   /**
    * Tags applied to all Security Agent resources.
    */
@@ -71,6 +80,7 @@ export class SecurityAgentConstruct extends Construct {
   public readonly agentSpaceId: string;
   public readonly serviceRole: iam.Role;
   public readonly targetDomainIds: string[];
+  public readonly scanBucket: s3.Bucket;
 
   constructor(scope: Construct, id: string, props: SecurityAgentProps) {
     super(scope, id);
@@ -93,9 +103,11 @@ export class SecurityAgentConstruct extends Construct {
       }),
     );
 
-    // Grant KMS permissions for encrypted agent spaces
+    // Grant KMS permissions for encrypted agent spaces + log groups
     if (props.kmsKey) {
       props.kmsKey.grantEncryptDecrypt(this.serviceRole);
+      // DescribeKey is required for CreateLogGroup with KMS encryption
+      props.kmsKey.grant(this.serviceRole, 'kms:DescribeKey', 'kms:CreateGrant');
     }
 
     // Grant CloudWatch Logs access for pen test logging
@@ -197,11 +209,12 @@ export class SecurityAgentConstruct extends Construct {
     }
 
     // Log group for pen test results (Security Agent writes to /aws/securityagent/<space>/pt-<id>)
-    new logs.LogGroup(this, 'PentestLogGroup', {
-      logGroupName: `/aws/securityagent/${props.agentSpaceName}`,
-      retention: logs.RetentionDays.SIX_MONTHS,
-      removalPolicy: cdk.RemovalPolicy.RETAIN,
-    });
+    // Note: we do NOT set logGroupName to avoid conflicts with pre-existing log groups
+    // created by prism-cli securityagent setup or the Security Agent service itself.
+    const pentestLogGroup = logs.LogGroup.fromLogGroupName(
+      this, 'PentestLogGroup',
+      `/aws/securityagent/${props.agentSpaceName}`,
+    );
 
     // Outputs
     new cdk.CfnOutput(this, 'AgentSpaceIdOutput', {
@@ -223,6 +236,111 @@ export class SecurityAgentConstruct extends Construct {
         exportName: `PrismD1SecurityAgentDomainIds`,
       });
     }
+
+    // -------------------------------------------------------
+    // S3 Scan Bucket — stores repo ZIPs and diff files for
+    // API-triggered code reviews (diff scans from CI/CD).
+    // -------------------------------------------------------
+    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
+      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
+      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
+      // this bucket when creating the code review and cannot access a CMK it
+      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
+      // the bucket is private (BLOCK_ALL) and SSL-enforced.
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      versioned: false,
+      lifecycleRules: [
+        {
+          id: 'expire-scan-artifacts',
+          expiration: cdk.Duration.days(30),
+          enabled: true,
+        },
+      ],
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
+    // Grant Security Agent service role read access to the scan bucket
+    this.scanBucket.grantRead(this.serviceRole);
+
+    // Suppress cdk-nag for S3 read grant wildcards (grantRead expands to s3:GetObject*, s3:GetBucket*, s3:List*)
+    NagSuppressions.addResourceSuppressions(
+      this.serviceRole,
+      [
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'grantRead() generates s3:GetObject*, s3:GetBucket*, s3:List* — standard CDK pattern for bucket read access',
+          appliesTo: ['Action::s3:GetObject*', 'Action::s3:GetBucket*', 'Action::s3:List*'],
+        },
+        {
+          id: 'AwsSolutions-IAM5',
+          reason: 'Scan bucket objects are dynamic (SHA-named diffs); wildcard on objects required',
+          appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+        },
+      ],
+      true,
+    );
+
+    NagSuppressions.addResourceSuppressions(
+      this.scanBucket,
+      [
+        {
+          id: 'AwsSolutions-S1',
+          reason: 'Access logging not required for ephemeral scan artifacts (30-day lifecycle, auto-deleted)',
+        },
+      ],
+      true,
+    );
+
+    // -------------------------------------------------------
+    // Code Review resource — NOT created here in CDK.
+    // CreateCodeReview requires assets.sourceCode pointing to
+    // an existing ZIP of the repo (chicken-and-egg at deploy).
+    // Instead, `prism-cli securityagent setup` handles:
+    //   1. git archive → upload repo.zip to scan bucket
+    //   2. CreateCodeReview API call
+    //   3. Write code-review-id to SSM
+    // The CDK only provisions the bucket + role + SSM scaffold.
+    // -------------------------------------------------------
+
+    new cdk.CfnOutput(this, 'ScanBucketOutput', {
+      value: this.scanBucket.bucketName,
+      description: 'S3 bucket for scan artifacts (repo ZIPs + diffs)',
+      exportName: 'PrismD1ContinuumScanBucket',
+    });
+
+    // -------------------------------------------------------
+    // SSM Parameter Store — non-sensitive CI/CD config.
+    // GitHub Actions workflows read these at runtime so no
+    // hardcoded IDs are needed in the repository.
+    // -------------------------------------------------------
+    const prefix = props.ssmParameterPrefix ?? '/prism/continuum';
+
+    new ssm.StringParameter(this, 'ParamAgentSpaceId', {
+      parameterName: `${prefix}/agent-space-id`,
+      stringValue: this.agentSpaceId,
+      description: 'AWS Continuum Agent Space ID for PRISM D1',
+      tier: ssm.ParameterTier.STANDARD,
+    });
+
+    // code-review-id is written by `prism-cli securityagent setup` (not CDK)
+    // because CreateCodeReview needs an existing repo ZIP in S3 first.
+
+    new ssm.StringParameter(this, 'ParamScanBucket', {
+      parameterName: `${prefix}/scan-bucket`,
+      stringValue: this.scanBucket.bucketName,
+      description: 'S3 bucket name for uploading repo/diff scan artifacts',
+      tier: ssm.ParameterTier.STANDARD,
+    });
+
+    new ssm.StringParameter(this, 'ParamServiceRoleArn', {
+      parameterName: `${prefix}/service-role-arn`,
+      stringValue: this.serviceRole.roleArn,
+      description: 'Service role ARN for Continuum CreateCodeReview (passed via --service-role)',
+      tier: ssm.ParameterTier.STANDARD,
+    });
   }
 
   /**

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -421,13 +421,114 @@ export class MetricsPipelineStack extends cdk.Stack {
     if (enableSecurityAgent) {
       this.securityAgent = new SecurityAgentConstruct(this, 'SecurityAgent', {
         agentSpaceName: 'prism-d1-security',
-        description: 'PRISM D1 Security Agent space for design review, code review, and pen testing',
+        description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
         kmsKey: prismKmsKey,
         codeRemediationStrategy: 'DISABLED',
         tags: {
           'prism:pillar': 'security',
         },
       });
+
+      // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
+      // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
+      // with name pattern prism-d1-github-oidc-*.
+      this.securityAgent.scanBucket.addToResourcePolicy(
+        new iam.PolicyStatement({
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
+          actions: ['s3:PutObject', 's3:GetObject'],
+          resources: [this.securityAgent.scanBucket.arnForObjects('*')],
+          conditions: {
+            ArnLike: {
+              'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
+            },
+          },
+        }),
+      );
+
+      // Create a managed policy for Continuum scan API access.
+      // Attached to the OIDC role by the bootstrapper setup script.
+      const continuumCiPolicy = new iam.ManagedPolicy(this, 'ContinuumCiPolicy', {
+        managedPolicyName: 'prism-d1-continuum-ci-scan',
+        description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
+        statements: [
+          new iam.PolicyStatement({
+            sid: 'ContinuumScanAPIs',
+            effect: iam.Effect.ALLOW,
+            actions: [
+              'securityagent:StartCodeReviewJob',
+              'securityagent:BatchGetCodeReviewJobs',
+              'securityagent:BatchGetCodeReviewJobTasks',
+              'securityagent:ListFindings',
+              'securityagent:BatchGetFindings',
+              'securityagent:CreateCodeReview',
+              'securityagent:ListCodeReviews',
+            ],
+            resources: [
+              `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
+            ],
+          }),
+          new iam.PolicyStatement({
+            sid: 'PassRoleForCodeReview',
+            effect: iam.Effect.ALLOW,
+            actions: ['iam:PassRole'],
+            resources: [this.securityAgent.serviceRole.roleArn],
+            conditions: {
+              StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
+            },
+          }),
+          new iam.PolicyStatement({
+            sid: 'ScanBucketWrite',
+            effect: iam.Effect.ALLOW,
+            actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
+            resources: [
+              this.securityAgent.scanBucket.bucketArn,
+              this.securityAgent.scanBucket.arnForObjects('*'),
+            ],
+          }),
+          new iam.PolicyStatement({
+            sid: 'KMSForScanBucket',
+            effect: iam.Effect.ALLOW,
+            actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+            resources: [prismKmsKey.keyArn],
+          }),
+          new iam.PolicyStatement({
+            sid: 'SSMReadConfig',
+            effect: iam.Effect.ALLOW,
+            actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
+            resources: [
+              `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
+            ],
+          }),
+        ],
+      });
+
+      NagSuppressions.addResourceSuppressions(
+        continuumCiPolicy,
+        [
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
+            appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
+          },
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
+            appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+          },
+          {
+            id: 'AwsSolutions-IAM5',
+            reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
+            appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
+          },
+        ],
+        true,
+      );
+
+      new cdk.CfnOutput(this, 'ContinuumCiPolicyArn', {
+        value: continuumCiPolicy.managedPolicyArn,
+        description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
+      });
     }
 
     // -------------------------------------------------------

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBAyNE"}
+{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBA+OE"}

package/dist/src/commands/bootstrapper/setup-github-oidc.js

@@ -233,6 +233,26 @@ export default {
             console.error(`  ✗ Failed to attach policy: ${putPolicy.stderr}`);
             process.exit(1);
         }
+        // Step 4: Attach Continuum CI managed policy (if deployed)
+        console.log('\nStep 4: Attaching Continuum CI scan policy (if available)...');
+        const continuumPolicy = run(`aws iam list-policies --scope Local --query "Policies[?PolicyName=='prism-d1-continuum-ci-scan'].Arn" --output text`);
+        if (continuumPolicy.ok && continuumPolicy.stdout) {
+            const attachResult = run(`aws iam attach-role-policy --role-name ${roleName} --policy-arn ${continuumPolicy.stdout}`);
+            if (attachResult.ok) {
+                console.log(`  ✓ Continuum CI policy attached (SSM + S3 + SecurityAgent access).`);
+            }
+            else if (attachResult.stderr.includes('already')) {
+                console.log('  ✓ Continuum CI policy already attached.');
+            }
+            else {
+                console.log(`  ⚠️  Could not attach Continuum policy: ${attachResult.stderr}`);
+                console.log('  The eval gate workflow will skip security scanning until this is resolved.');
+            }
+        }
+        else {
+            console.log('  ℹ️  Continuum CI policy not found (deploy with --context enableSecurityAgent=true to create it).');
+            console.log('  The eval gate workflow will gracefully skip security scanning.');
+        }
         // Summary
         const roleArn = `arn:aws:iam::${accountId}:role/${roleName}`;
         console.log('\n════════════════════════════════════════════════');

package/dist/src/commands/bootstrapper/setup-github-oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,GAAG,CACzB,qHAAqH,CACtH,CAAC;QACF,IAAI,eAAe,CAAC,EAAE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,GAAG,CACtB,0CAA0C,QAAQ,iBAAiB,eAAe,CAAC,MAAM,EAAE,CAC5F,CAAC;YACF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oGAAoG,CAAC,CAAC;YAClH,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/commands/securityagent/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":";;;;;;;oBAsCkB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;AANrD,wBAyFE"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":";;;;;;;oBAsCkB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;AANrD,wBA+KE"}

package/dist/src/commands/securityagent/setup.js

@@ -109,6 +109,85 @@ export default {
         console.log(`   Application: ${applicationId}`);
         console.log(`   Web console: https://${region}.console.aws.amazon.com/securityagent/home?region=${region}`);
         console.log('   Click "Admin access" to open the web app.');
+        // -------------------------------------------------------
+        // Create Code Review for CI diff scans
+        // Requires: repo ZIP uploaded to scan bucket first
+        // -------------------------------------------------------
+        console.log('\n📦 Setting up Code Review for CI/CD diff scans...');
+        // Get scan bucket from SSM (created by CDK)
+        const bucketParam = runCapture(`aws ssm get-parameter --name /prism/continuum/scan-bucket ${env} --query Parameter.Value --output text`);
+        if (!bucketParam.ok || !bucketParam.stdout) {
+            console.log('   ⚠️  Scan bucket SSM param not found. Deploy with --context enableSecurityAgent=true first.');
+            console.log('   Skipping Code Review creation.');
+            return;
+        }
+        const scanBucket = bucketParam.stdout;
+        console.log(`   Scan bucket: ${scanBucket}`);
+        // Zip the repo and upload
+        console.log('   Archiving repo...');
+        const repoRoot = process.cwd();
+        const zipResult = runCapture(`cd ${repoRoot} && git archive HEAD --format=zip -o /tmp/prism-repo.zip`);
+        if (!zipResult.ok) {
+            console.log(`   ⚠️  git archive failed (not a git repo?): ${zipResult.stdout}`);
+            console.log('   Skipping Code Review creation. Run from a git repo root.');
+            return;
+        }
+        const upload = runCapture(`aws s3 cp /tmp/prism-repo.zip s3://${scanBucket}/repo/latest.zip ${env}`);
+        if (!upload.ok) {
+            console.error(`   Failed to upload repo ZIP: ${upload.stdout}`);
+            return;
+        }
+        console.log('   ✅ Repo ZIP uploaded');
+        // Create Code Review (or find existing)
+        const codeReviewTitle = 'prism-d1-security-ci-diff-scan';
+        const createCr = runCapture(`aws securityagent create-code-review ` +
+            `--agent-space-id ${agentSpaceId} ` +
+            `--title ${codeReviewTitle} ` +
+            `--service-role ${roleArn} ` +
+            `--assets '{"sourceCode":[{"s3Location":"s3://${scanBucket}/repo/latest.zip"}]}' ` +
+            `${env} --output json`);
+        let codeReviewId;
+        if (createCr.ok) {
+            codeReviewId = JSON.parse(createCr.stdout).codeReviewId;
+            console.log(`   ✅ Code Review created: ${codeReviewId}`);
+        }
+        else if (createCr.stdout.includes('Conflict') || createCr.stdout.includes('already exists')) {
+            // Already exists — find it
+            const listCr = runCapture(`aws securityagent list-code-reviews --agent-space-id ${agentSpaceId} ${env} --output json`);
+            if (listCr.ok) {
+                const reviews = JSON.parse(listCr.stdout).codeReviews || [];
+                const existing = reviews.find((r) => r.title === codeReviewTitle);
+                if (existing) {
+                    codeReviewId = existing.codeReviewId;
+                    console.log(`   ✅ Code Review already exists: ${codeReviewId}`);
+                }
+                else {
+                    console.error('   ❌ Could not find existing Code Review');
+                    return;
+                }
+            }
+            else {
+                console.error(`   ❌ Failed to list code reviews: ${listCr.stdout}`);
+                return;
+            }
+        }
+        else {
+            console.error(`   ❌ Failed to create Code Review: ${createCr.stdout}`);
+            console.log('   The CI workflow will skip Continuum scanning until this is resolved.');
+            return;
+        }
+        // Write code-review-id to SSM
+        const ssmWrite = runCapture(`aws ssm put-parameter --name /prism/continuum/code-review-id ` +
+            `--value "${codeReviewId}" --type String --overwrite ${env}`);
+        if (ssmWrite.ok) {
+            console.log('   ✅ Code Review ID written to SSM: /prism/continuum/code-review-id');
+        }
+        else {
+            console.log(`   ⚠️  Failed to write SSM param: ${ssmWrite.stdout}`);
+            console.log(`   Manually run: aws ssm put-parameter --name /prism/continuum/code-review-id --value "${codeReviewId}" --type String --overwrite ${env}`);
+        }
+        console.log('\n🎉 Continuum CI scanning ready!');
+        console.log('   The eval gate workflow will now run diff scans on every PR.');
     },
 };
 //# sourceMappingURL=setup.js.map

package/dist/src/commands/securityagent/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,yEAAyE;IACtF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE;QACrG,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE;KAChF;IACD,MAAM,CAAC,OAA4C;QACjD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,MAAM,EAAE,CAAC;QAE1E,yCAAyC;QACzC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,UAAU,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,EAAE;YACb,mBAAmB,EAAE,OAAO,CAAC,MAAM;YACnC,kBAAkB,EAAE,MAAM;YAC1B,kBAAkB,EAAE,MAAM;SAC3B,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,2EAA2E,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9C,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;QAE/C,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACpF,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,wCAAwC,GAAG,gBAAgB,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,gBAAgB,OAAO,CAAC,MAAM,iDAAiD,CAAC;QAEhG,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,yDAAyD,aAAa,eAAe,OAAO,IAAI,GAAG,gBAAgB,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,qDAAqD,MAAM,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../../src/commands/securityagent/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,OAA4B,EAAE;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe;IACb,WAAW,EAAE,yEAAyE;IACtF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE;QACrG,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE;KAChF;IACD,MAAM,CAAC,OAA4C;QACjD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,MAAM,EAAE,CAAC;QAE1E,yCAAyC;QACzC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,UAAU,CAAC,+BAA+B,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACjI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,EAAE;YACb,mBAAmB,EAAE,OAAO,CAAC,MAAM;YACnC,kBAAkB,EAAE,MAAM;YAC1B,kBAAkB,EAAE,MAAM;SAC3B,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,2EAA2E,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAE9C,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,YAAY,EAAE,CAAC,CAAC;QAE/C,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;QACpF,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,qBAAqB;YACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,wCAAwC,GAAG,gBAAgB,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,gBAAgB,OAAO,CAAC,MAAM,iDAAiD,CAAC;QAEhG,+BAA+B;QAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,yDAAyD,aAAa,eAAe,OAAO,IAAI,GAAG,gBAAgB,CAAC,CAAC;QAC/I,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,qDAAqD,MAAM,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAE5D,0DAA0D;QAC1D,uCAAuC;QACvC,mDAAmD;QACnD,0DAA0D;QAC1D,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QAEnE,4CAA4C;QAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,6DAA6D,GAAG,wCAAwC,CAAC,CAAC;QACzI,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,+FAA+F,CAAC,CAAC;YAC7G,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;QAE7C,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,QAAQ,0DAA0D,CAAC,CAAC;QACvG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,gDAAgD,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,sCAAsC,UAAU,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAEtC,wCAAwC;QACxC,MAAM,eAAe,GAAG,gCAAgC,CAAC;QACzD,MAAM,QAAQ,GAAG,UAAU,CACzB,uCAAuC;YACvC,oBAAoB,YAAY,GAAG;YACnC,WAAW,eAAe,GAAG;YAC7B,kBAAkB,OAAO,GAAG;YAC5B,gDAAgD,UAAU,wBAAwB;YAClF,GAAG,GAAG,gBAAgB,CACvB,CAAC;QAEF,IAAI,YAAoB,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9F,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,wDAAwD,YAAY,IAAI,GAAG,gBAAgB,CAAC,CAAC;YACvH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;gBACvE,IAAI,QAAQ,EAAE,CAAC;oBACb,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,UAAU,CACzB,+DAA+D;YAC/D,YAAY,YAAY,+BAA+B,GAAG,EAAE,CAC7D,CAAC;QACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,0FAA0F,YAAY,+BAA+B,GAAG,EAAE,CAAC,CAAC;QAC1J,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.70",
+  "version": "1.0.72",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {