@prism-d1/cli 1.0.71 → 1.0.73

package/dist/assets/eval-harness/steering/code-review.md

@@ -0,0 +1,61 @@
+# Code Review Rules
+
+> This file configures what Kiro looks for when reviewing PR diffs in CI.
+> Customize these rules for your team's standards and concerns.
+> See: https://kiro.dev/docs/steering/
+
+## Hard Failures (block merge if found)
+
+- SQL injection or command injection via string concatenation or template literals with user input
+- Hardcoded secrets, API keys, passwords, or connection strings in source code
+- Missing error handling on async operations (unhandled promise rejections, missing try/catch)
+- Unbounded database queries (no LIMIT, no pagination, no streaming for large result sets)
+- Disabled security controls (authentication bypassed, authorization checks removed)
+- Use of `eval()`, `Function()` constructor, or `child_process.exec()` with user input
+
+## Warnings (comment but don't block)
+
+- Functions exceeding 50 lines (suggest decomposition)
+- TypeScript `any` type usage without a justifying comment
+- `console.log` or `print()` in production code paths (use structured logger)
+- Missing input validation on API endpoint parameters
+- Catching errors without logging or re-throwing (`catch(e) {}`)
+- TODO/FIXME/HACK comments introduced in new code
+- Magic numbers without named constants
+- Duplicated logic that could be extracted to a shared function
+
+## What NOT to Flag
+
+- Test files (*.test.ts, *.spec.ts, *_test.py, test_*.py)
+- Generated code (files with "generated" or "auto-generated" in header comment)
+- Configuration files (*.json, *.yml, *.toml) unless they contain secrets
+- Lock files (package-lock.json, yarn.lock, poetry.lock)
+- Markdown documentation changes
+
+## Output Format
+
+Always respond with ONLY valid JSON (no markdown, no explanation outside the JSON):
+
+```json
+{
+  "findings": [
+    {
+      "file": "relative/path/to/file.ts",
+      "line": 42,
+      "severity": "high|medium|low",
+      "category": "security|correctness|performance|maintainability|reliability",
+      "message": "Brief, actionable description of the issue"
+    }
+  ],
+  "score": 0.85,
+  "summary": "One-line overall verdict"
+}
+```
+
+## Scoring Guide
+
+- **1.0**: No issues found
+- **0.9-0.99**: Only low-severity style/maintainability suggestions
+- **0.8-0.89**: Medium findings but no blocking issues
+- **0.7-0.79**: Has issues that should be addressed but aren't critical
+- **Below 0.7**: Has high-severity issues that should block merge

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -0,0 +1,379 @@
+# prism-eval-gate.yml — AI code quality gate using kiro-cli headless mode.
+#
+# Copy this file to .github/workflows/prism-eval-gate.yml in your repo.
+#
+# Required setup:
+#   - Kiro API key stored as repository secret: KIRO_API_KEY
+#   - .kiro/steering/code-review.md in your repo (review rules)
+#   - (Optional) PRISM_METRICS_ROLE_ARN for EventBridge metrics emission
+#   - (Optional) AWS Continuum configured for security scanning
+
+name: PRISM Eval Gate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main, master]
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+
+jobs:
+  eval-gate:
+    runs-on: ubuntu-latest
+    env:
+      # Secrets mapped to env so steps can gate on them (secrets context not allowed in `if`)
+      METRICS_ROLE_ARN: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
+      HAS_KIRO_KEY: ${{ secrets.KIRO_API_KEY != '' && 'true' || 'false' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Install Kiro CLI
+        run: curl -fsSL https://cli.kiro.dev/install | bash
+
+      - name: Read team ID
+        id: prism-config
+        run: |
+          TEAM_ID=$(jq -r '.team_id // "no_team"' .prism/config.json 2>/dev/null || echo "no_team")
+          echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
+
+      - name: Identify AI-generated changes
+        id: detect-ai
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          AI_FILES=""
+          for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
+            if git log -1 --format='%B' "${SHA}" | grep -q 'AI-Origin: ai-generated\|AI-Origin: ai-assisted'; then
+              FILES=$(git diff-tree --no-commit-id --name-only -r "${SHA}" \
+                | grep -E '\.(ts|js|py|go|java|rs|tsx|jsx)$' \
+                | grep -vE '\.test\.|\.spec\.|__test__|_test\.' || true)
+              AI_FILES="${AI_FILES} ${FILES}"
+            fi
+          done
+
+          UNIQUE_FILES=$(echo "${AI_FILES}" | tr ' ' '\n' | sort -u | grep -v '^$' | head -30)
+          FILE_COUNT=$(echo "${UNIQUE_FILES}" | grep -c . || echo "0")
+
+          if [ "${FILE_COUNT}" -eq 0 ]; then
+            echo "has_ai_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_ai_changes=true" >> "$GITHUB_OUTPUT"
+            echo "file_count=${FILE_COUNT}" >> "$GITHUB_OUTPUT"
+            echo "${UNIQUE_FILES}" > /tmp/ai-changed-files.txt
+          fi
+
+      - name: Kiro code quality review
+        id: review
+        if: steps.detect-ai.outputs.has_ai_changes == 'true'
+        env:
+          KIRO_API_KEY: ${{ secrets.KIRO_API_KEY }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          # Fork PRs don't receive secrets — report neutral, never silently pass
+          if [ "${HAS_KIRO_KEY}" != "true" ]; then
+            echo "::warning::KIRO_API_KEY unavailable (fork PR or missing secret) — review skipped"
+            echo "result=SKIPPED" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          FILES=$(cat /tmp/ai-changed-files.txt | tr '\n' ' ')
+          DIFF=$(git diff "${BASE_SHA}..${HEAD_SHA}" -- ${FILES})
+
+          # Find spec reference from commit trailers
+          SPEC_REF=$(git log "${BASE_SHA}..${HEAD_SHA}" --format='%(trailers:key=Spec-Ref,valueonly)' | head -1 | tr -d '[:space:]' || true)
+          SPEC_CONTEXT=""
+          if [ -n "${SPEC_REF}" ] && [ -f "${SPEC_REF}" ]; then
+            SPEC_CONTEXT="The spec for this work is at ${SPEC_REF}. Read it and verify the code implements all acceptance criteria."
+          fi
+
+          # Run kiro-cli in headless mode
+          REVIEW_OUTPUT=$(echo "${DIFF}" | kiro-cli chat --no-interactive \
+            --trust-tools=read,grep \
+            --model claude-haiku-4.5 \
+            "You are a code reviewer running in CI. Review this PR diff for code quality issues.
+
+          Changed files: ${FILES}
+
+          ${SPEC_CONTEXT}
+
+          Read the actual source files for full context (imports, related functions, tests).
+          Follow the review rules in .kiro/steering/code-review.md if it exists.
+
+          Focus on: correctness bugs, missing error handling, injection risks, performance anti-patterns, type safety violations, and hallucinated imports/APIs that don't exist.
+
+          Output ONLY valid JSON on a single line (no markdown fencing, no explanation):
+          {\"findings\":[{\"file\":\"path\",\"line\":1,\"severity\":\"high|medium|low\",\"category\":\"security|correctness|performance|maintainability|reliability\",\"message\":\"description\"}],\"score\":0.0,\"summary\":\"one line\"}" 2>/dev/null) || true
+
+          # Strip ANSI escapes, join lines, extract the last JSON object
+          CLEANED=$(echo "${REVIEW_OUTPUT}" | sed 's/\x1b\[[0-9;?]*[a-zA-Z]//g' | tr -d '\r')
+          REVIEW_JSON=$(echo "${CLEANED}" | tr '\n' ' ' | grep -o '{.*}' || true)
+
+          if [ -z "${REVIEW_JSON}" ] || ! echo "${REVIEW_JSON}" | jq -e '.score' > /dev/null 2>&1; then
+            # FAIL CLOSED: a gate that can't evaluate must not pass
+            echo "::error::Could not parse kiro-cli review output — failing closed"
+            echo "result=ERROR" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          SCORE=$(echo "${REVIEW_JSON}" | jq -r '.score')
+          FINDINGS=$(echo "${REVIEW_JSON}" | jq '.findings | length')
+          HIGH=$(echo "${REVIEW_JSON}" | jq '[.findings[] | select(.severity=="high")] | length')
+          MEDIUM=$(echo "${REVIEW_JSON}" | jq '[.findings[] | select(.severity=="medium")] | length')
+          # Single line, quotes stripped — safe for GITHUB_OUTPUT and downstream env use
+          SUMMARY=$(echo "${REVIEW_JSON}" | jq -r '.summary // "No summary"' | head -1 | tr -d '"`'"'" | cut -c1-200)
+
+          echo "score=${SCORE}" >> "$GITHUB_OUTPUT"
+          echo "findings=${FINDINGS}" >> "$GITHUB_OUTPUT"
+          echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
+          echo "medium=${MEDIUM}" >> "$GITHUB_OUTPUT"
+          echo "summary=${SUMMARY}" >> "$GITHUB_OUTPUT"
+          echo "${REVIEW_JSON}" > /tmp/kiro-review.json
+
+          # Determine pass/fail (awk instead of bc — no extra package needed)
+          PASS=$(awk -v s="${SCORE}" 'BEGIN { print (s >= 0.82) ? "true" : "false" }')
+          if [ "${HIGH}" -gt 0 ] || [ "${PASS}" != "true" ]; then
+            echo "result=FAIL" >> "$GITHUB_OUTPUT"
+          else
+            echo "result=PASS" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Post PR comment
+        if: always()
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          HAS_AI: ${{ steps.detect-ai.outputs.has_ai_changes }}
+          REVIEW_SCORE: ${{ steps.review.outputs.score }}
+          REVIEW_FINDINGS: ${{ steps.review.outputs.findings }}
+          REVIEW_HIGH: ${{ steps.review.outputs.high }}
+          REVIEW_MEDIUM: ${{ steps.review.outputs.medium }}
+          REVIEW_RESULT: ${{ steps.review.outputs.result }}
+          REVIEW_SUMMARY: ${{ steps.review.outputs.summary }}
+        with:
+          script: |
+            const fs = require('fs');
+            // All values read from env — never interpolate ${{ }} into script source
+            // (LLM-generated text could contain quotes/backticks = script injection)
+            const hasAI = process.env.HAS_AI === 'true';
+
+            let body;
+            if (!hasAI) {
+              body = '✅ **PRISM Eval Gate** — No AI-generated code detected. Skipped.';
+            } else {
+              const result = process.env.REVIEW_RESULT || 'ERROR';
+              if (result === 'SKIPPED') {
+                body = '⚠️ **PRISM Eval Gate** — Review unavailable (no API key on fork PRs). A maintainer must review manually.';
+              } else if (result === 'ERROR') {
+                body = '❌ **PRISM Eval Gate** — Review output could not be parsed. Failing closed; re-run the workflow or review manually.';
+              } else {
+                const score = process.env.REVIEW_SCORE || '?';
+                const findings = process.env.REVIEW_FINDINGS || '0';
+                const high = process.env.REVIEW_HIGH || '0';
+                const medium = process.env.REVIEW_MEDIUM || '0';
+                // Sanitize LLM text before embedding in markdown
+                const summary = (process.env.REVIEW_SUMMARY || 'No summary').replace(/[<>|]/g, ' ');
+                const emoji = result === 'PASS' ? '✅' : '❌';
+
+                let table = '';
+                try {
+                  const review = JSON.parse(fs.readFileSync('/tmp/kiro-review.json', 'utf8'));
+                  if (review.findings && review.findings.length > 0) {
+                    const clean = (s) => String(s ?? '-').replace(/[|<>`]/g, ' ').slice(0, 200);
+                    table = review.findings
+                      .map(f => `| \`${clean(f.file)}\` | ${Number(f.line) || '-'} | ${clean(f.severity)} | ${clean(f.category)} | ${clean(f.message)} |`)
+                      .join('\n');
+                  }
+                } catch(e) { /* no detail available */ }
+
+                body = `## ${emoji} PRISM Eval Gate — ${result}\n\n` +
+                  `**Score**: ${score} | **Findings**: ${findings} (${high} high, ${medium} medium)\n\n` +
+                  `**Summary**: ${summary}\n\n`;
+
+                if (table) {
+                  body += `| File | Line | Severity | Category | Issue |\n|---|---|---|---|---|\n${table}\n\n`;
+                }
+
+                body += `> Powered by kiro-cli headless • Model: claude-haiku-4.5 • Threshold: 0.82`;
+              }
+            }
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: context.issue.number
+            });
+            const existing = comments.find(c => c.body.includes('PRISM Eval Gate'));
+            const params = { owner: context.repo.owner, repo: context.repo.repo, body };
+
+            if (existing) {
+              await github.rest.issues.updateComment({ ...params, comment_id: existing.id });
+            } else {
+              await github.rest.issues.createComment({ ...params, issue_number: context.issue.number });
+            }
+
+      - name: Configure AWS credentials (OIDC) — for metrics + security scan
+        id: aws-creds
+        if: steps.detect-ai.outputs.has_ai_changes == 'true' && env.METRICS_ROLE_ARN != ''
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        with:
+          role-to-assume: ${{ env.METRICS_ROLE_ARN }}
+          aws-region: us-west-2
+        continue-on-error: true
+
+      - name: Emit prism.d1.eval event
+        if: steps.detect-ai.outputs.has_ai_changes == 'true' && steps.aws-creds.outcome == 'success'
+        env:
+          AWS_REGION: us-west-2
+          TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
+          REPO: ${{ github.repository }}
+          REVIEW_SCORE: ${{ steps.review.outputs.score }}
+          REVIEW_RESULT: ${{ steps.review.outputs.result }}
+          REVIEW_FINDINGS: ${{ steps.review.outputs.findings }}
+          REVIEW_HIGH: ${{ steps.review.outputs.high }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Only emit when we have a real score (not SKIPPED/ERROR)
+          if [ -z "${REVIEW_SCORE}" ]; then
+            echo "No score to emit (result: ${REVIEW_RESULT:-none})"
+            exit 0
+          fi
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+          DETAIL=$(jq -n -c \
+            --arg team_id "${TEAM_ID}" \
+            --arg repo "${REPO}" \
+            --arg timestamp "${TIMESTAMP}" \
+            --arg score "${REVIEW_SCORE}" \
+            --arg result "${REVIEW_RESULT}" \
+            --arg findings "${REVIEW_FINDINGS:-0}" \
+            --arg high "${REVIEW_HIGH:-0}" \
+            --arg pr_number "${PR_NUMBER}" \
+            '{team_id:$team_id,repo:$repo,timestamp:$timestamp,prism_level:2,
+              metric:{name:"eval_score",value:($score|tonumber),unit:"score"},
+              ai_context:{tool:"kiro-cli",model:"claude-haiku-4.5",origin:"ai-generated"},
+              eval:{score:($score|tonumber),result:$result,rubric:"kiro-headless",
+                    findings:($findings|tonumber),high_findings:($high|tonumber),
+                    pr_number:($pr_number|tonumber),method:"kiro-headless"}}')
+          aws events put-events --region us-west-2 --entries \
+            "[{\"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",\"EventBusName\":\"prism-d1-metrics\",\"Detail\":$(echo "${DETAIL}" | jq -Rs '.')}]" || true
+
+      - name: AWS Continuum security scan (Tier 2 — deterministic)
+        id: security-gate
+        if: steps.detect-ai.outputs.has_ai_changes == 'true' && steps.aws-creds.outcome == 'success'
+        env:
+          AWS_REGION: us-west-2
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Pre-flight: verify the specific subcommand exists (AWS CLI v2.36+)
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::warning::AWS CLI lacks securityagent code review commands (need v2.36+). Skipping scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
+          SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
+
+          if [ -z "$AGENT_SPACE_ID" ] || [ -z "$SCAN_BUCKET" ]; then
+            echo "AWS Continuum not configured (SSM params missing). Skipping security scan."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          REPO_SLUG=$(echo "${REPO}" | tr '/' '-')
+          CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
+          if [ -z "$CODE_REVIEW_ID" ]; then
+            echo "::warning::No Code Review resource for ${REPO_SLUG} — run 'prism-cli securityagent setup' first. Skipping."
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Diff must be uploaded with .patch extension (API requirement)
+          git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
+          if [ ! -s /tmp/changes.patch ]; then
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          DIFF_KEY="diffs/${REPO_SLUG}/${PR_NUMBER}/${HEAD_SHA}.patch"
+          aws s3 cp /tmp/changes.patch "s3://${SCAN_BUCKET}/${DIFF_KEY}" --quiet
+
+          JOB_ID=$(aws securityagent start-code-review-job \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-id "${CODE_REVIEW_ID}" \
+            --diff-source "{\"s3Uri\":\"s3://${SCAN_BUCKET}/${DIFF_KEY}\"}" \
+            --query 'codeReviewJobId' --output text)
+          echo "Continuum job started: ${JOB_ID}"
+
+          STATUS="UNKNOWN"
+          for i in $(seq 1 30); do
+            sleep 30
+            STATUS=$(aws securityagent batch-get-code-review-jobs \
+              --agent-space-id "${AGENT_SPACE_ID}" \
+              --code-review-job-ids "${JOB_ID}" \
+              --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
+            echo "  Poll ${i}/30: ${STATUS}"
+            case "$STATUS" in COMPLETED|FAILED|STOPPED) break ;; esac
+          done
+
+          if [ "$STATUS" != "COMPLETED" ]; then
+            echo "::warning::Continuum scan did not complete (status: ${STATUS}) — treating as skipped"
+            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # NOTE: list-findings takes agent-space-id + code-review-job-id only.
+          # Response field is 'findingsSummaries', risk field is 'riskLevel'.
+          FINDINGS_JSON=$(aws securityagent list-findings \
+            --agent-space-id "${AGENT_SPACE_ID}" \
+            --code-review-job-id "${JOB_ID}" \
+            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+
+          TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
+          CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
+          HIGH=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "HIGH")] | length')
+
+          echo "Continuum findings: ${TOTAL} total (${CRITICAL} critical, ${HIGH} high)"
+          echo "findings=${TOTAL}" >> "$GITHUB_OUTPUT"
+          echo "critical=${CRITICAL}" >> "$GITHUB_OUTPUT"
+          echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
+
+          if [ "$TOTAL" -gt 0 ]; then
+            echo "$FINDINGS_JSON" | jq -r '.findingsSummaries[] | "::warning::[\(.riskLevel)] \(.name)"'
+          fi
+
+      - name: Fail on eval gate failure
+        if: >-
+          steps.review.outputs.result == 'FAIL' ||
+          steps.review.outputs.result == 'ERROR' ||
+          (steps.security-gate.outputs.skipped != 'true' &&
+           (steps.security-gate.outputs.critical > 0 || steps.security-gate.outputs.high > 0))
+        env:
+          REVIEW_RESULT: ${{ steps.review.outputs.result }}
+          REVIEW_HIGH: ${{ steps.review.outputs.high }}
+          REVIEW_SCORE: ${{ steps.review.outputs.score }}
+          REVIEW_SUMMARY: ${{ steps.review.outputs.summary }}
+          SEC_CRITICAL: ${{ steps.security-gate.outputs.critical }}
+          SEC_HIGH: ${{ steps.security-gate.outputs.high }}
+        run: |
+          if [ "${REVIEW_RESULT}" = "ERROR" ]; then
+            echo "❌ Eval gate failed closed: review output could not be parsed"
+          elif [ "${REVIEW_RESULT}" = "FAIL" ]; then
+            echo "❌ Kiro found ${REVIEW_HIGH:-?} high-severity issues (score: ${REVIEW_SCORE:-?})"
+            echo "Summary: ${REVIEW_SUMMARY}"
+          fi
+          if [ "${SEC_CRITICAL:-0}" -gt 0 ] || [ "${SEC_HIGH:-0}" -gt 0 ]; then
+            echo "❌ Continuum found ${SEC_CRITICAL:-0} critical, ${SEC_HIGH:-0} high security findings"
+          fi
+          exit 1

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -222,14 +222,27 @@ jobs:
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
 
+      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.35+)
+        run: |
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o /tmp/awscliv2.zip.sha256
+          cd /tmp && sha256sum -c awscliv2.zip.sha256
+          unzip -qo /tmp/awscliv2.zip -d /tmp
+          sudo /tmp/aws/install --update --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || \
+            sudo /tmp/aws/install --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || true
+          rm -rf /tmp/aws /tmp/awscliv2.zip /tmp/awscliv2.zip.sha256
+          hash -r
+          echo "AWS CLI: $(aws --version)"
+          echo "Has create-code-review: $(aws securityagent create-code-review help 2>&1 | head -1)"
+
       - name: AWS Continuum diff scan
         id: security-gate
         env:
           AWS_REGION: us-west-2
         run: |
           # Pre-flight: verify AWS CLI has securityagent subcommand
-          if ! aws securityagent help > /dev/null 2>&1; then
-            echo "::warning::AWS CLI does not support 'securityagent' commands (upgrade to v2.35+). Skipping scan."
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::warning::AWS CLI does not support 'securityagent code review' commands after upgrade. Skipping scan."
             echo "findings=0" >> "$GITHUB_OUTPUT"
             echo "skipped=true" >> "$GITHUB_OUTPUT"
             exit 0
@@ -259,47 +272,52 @@ jobs:
           # Derive repo slug for per-repo SSM key (org/repo → org-repo)
           REPO_SLUG=$(echo "${{ github.repository }}" | tr '/' '-')
 
-          echo "::group::Resolve or bootstrap Code Review for ${REPO_SLUG}"
+          echo "::group::Resolve Code Review for ${REPO_SLUG}"
           CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
 
           if [[ -z "$CODE_REVIEW_ID" ]]; then
-            echo "  No Code Review found for ${REPO_SLUG} — bootstrapping..."
+            echo "  No Code Review found for ${REPO_SLUG} -- bootstrapping..."
+            echo "  CLI version: $(aws --version 2>&1 | head -1)"
+            echo "  CLI path: $(which aws)"
 
-            # Upload repo ZIP as context for the diff scan
+            # Upload repo ZIP first (required as source context for the CodeReview)
             git archive HEAD --format=zip -o /tmp/repo.zip
             aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
 
-            # Create Code Review resource
-            CR_RESPONSE=$(aws securityagent create-code-review \
-              --agent-space-id "${AGENT_SPACE_ID}" \
+            # Create the CodeReview
+            CR_OUTPUT=$(aws securityagent create-code-review \
+              --agent-space-id "$AGENT_SPACE_ID" \
               --title "${REPO_SLUG}-ci-diff-scan" \
-              --service-role "${SERVICE_ROLE}" \
+              --service-role "$SERVICE_ROLE" \
               --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
-              --output json 2>&1)
-
-            if echo "$CR_RESPONSE" | jq -e '.codeReviewId' > /dev/null 2>&1; then
-              CODE_REVIEW_ID=$(echo "$CR_RESPONSE" | jq -r '.codeReviewId')
-              echo "  ✅ Code Review created: ${CODE_REVIEW_ID}"
-
-              # Persist for future runs
-              aws ssm put-parameter \
-                --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
-                --value "${CODE_REVIEW_ID}" \
-                --type String --overwrite 2>/dev/null || true
-            else
-              echo "  ⚠️ Failed to create Code Review: ${CR_RESPONSE}"
-              echo "  Skipping scan (non-blocking)."
+              --output json 2>&1) || true
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+
+            if [[ -z "$CODE_REVIEW_ID" ]]; then
+              echo "  ⚠️ Bootstrap failed:"
+              echo "  $CR_OUTPUT"
+              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
+              echo "  Skipping security scan (non-blocking)."
               echo "findings=0" >> "$GITHUB_OUTPUT"
               echo "skipped=true" >> "$GITHUB_OUTPUT"
               exit 0
             fi
-          else
-            echo "  Using existing Code Review: ${CODE_REVIEW_ID}"
 
-            # Re-upload fresh repo ZIP (context for accurate cross-module analysis)
-            git archive HEAD --format=zip -o /tmp/repo.zip
-            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+            # Persist for future runs
+            aws ssm put-parameter \
+              --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
+              --value "$CODE_REVIEW_ID" \
+              --type String --overwrite > /dev/null
+
+            echo "  [x] Code Review created: ${CODE_REVIEW_ID}"
+            echo "  [x] Saved to SSM"
           fi
+
+          echo "  Using Code Review: ${CODE_REVIEW_ID}"
+
+          # Upload fresh repo ZIP (context for accurate cross-module analysis)
+          git archive HEAD --format=zip -o /tmp/repo.zip
+          aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
           echo "::endgroup::"
 
           echo "::group::Generate and upload diff"
@@ -329,15 +347,15 @@ jobs:
           echo "Job started: ${JOB_ID}"
           echo "::endgroup::"
 
-          echo "::group::Poll for completion (timeout: 15 min)"
-          for i in $(seq 1 30); do
+          echo "::group::Poll for completion (timeout: 30 min)"
+          for i in $(seq 1 60); do
             sleep 30
             STATUS=$(aws securityagent batch-get-code-review-jobs \
               --agent-space-id "${AGENT_SPACE_ID}" \
               --code-review-job-ids "${JOB_ID}" \
               --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
 
-            echo "  Poll ${i}/30: ${STATUS}"
+            echo "  Poll ${i}/60: ${STATUS}"
             if [[ "$STATUS" == "COMPLETED" || "$STATUS" == "FAILED" || "$STATUS" == "STOPPED" ]]; then
               break
             fi
@@ -345,14 +363,16 @@ jobs:
           echo "::endgroup::"
 
           if [[ "$STATUS" == "FAILED" ]]; then
-            echo "::warning::Continuum scan failed — treating as 0 findings (non-blocking)"
-            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "::warning::Continuum scan failed — check Security Agent logs"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           if [[ "$STATUS" != "COMPLETED" ]]; then
-            echo "::warning::Continuum scan timed out (status: ${STATUS}) — treating as 0 findings"
-            echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "::warning::Continuum scan timed out (status: ${STATUS})"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -424,7 +444,10 @@ jobs:
         if: steps.eval.outputs.overall_result == 'FAIL' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
         run: |
           [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
-          if [[ "${{ steps.security-gate.outputs.findings }}" != "0" && "${{ steps.security-gate.outputs.skipped }}" != "true" ]]; then
+          if [[ "${{ steps.security-gate.outputs.scan_error }}" == "true" ]]; then
+            echo "⚠️ AWS Continuum scan encountered an error (did not complete successfully)"
+            echo "  The security gate cannot verify this PR is safe. Re-run the workflow or check Security Agent logs."
+          elif [[ "${{ steps.security-gate.outputs.findings }}" != "0" && "${{ steps.security-gate.outputs.skipped }}" != "true" ]]; then
             echo "❌ AWS Continuum found ${{ steps.security-gate.outputs.findings }} security issues (${{ steps.security-gate.outputs.critical }} critical, ${{ steps.security-gate.outputs.high }} high)"
           fi
           exit 1

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -486,6 +486,12 @@ export class MetricsPipelineStack extends cdk.Stack {
               this.securityAgent.scanBucket.arnForObjects('*'),
             ],
           }),
+          new iam.PolicyStatement({
+            sid: 'KMSForScanBucket',
+            effect: iam.Effect.ALLOW,
+            actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+            resources: [prismKmsKey.keyArn],
+          }),
           new iam.PolicyStatement({
             sid: 'SSMReadConfig',
             effect: iam.Effect.ALLOW,

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts

@@ -5,6 +5,7 @@ declare const _default: {
         description: string;
     }[];
     action(opts: {
+        mode?: string;
         withRubrics?: boolean;
         model?: string;
         threshold?: string;

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;iBAwBqB;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AARvG,wBAyFE"}
+{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;iBAyBqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AATtH,wBAmCE"}

package/dist/src/commands/bootstrapper/install-eval-harness.js

@@ -14,10 +14,11 @@ function prompt(question, defaultValue) {
 export default {
     description: 'Install eval harness (script + config + optional rubrics)',
     options: [
-        { flags: '--with-rubrics', description: 'Include production rubrics (code-quality, api, agent, security, spec)' },
-        { flags: '--model <id>', description: 'Bedrock model ID for evaluation' },
+        { flags: '--mode <mode>', description: 'Eval mode: "kiro" (recommended, headless kiro-cli) or "bedrock" (legacy run-eval.sh)' },
+        { flags: '--with-rubrics', description: 'Include production rubrics (bedrock mode only)' },
+        { flags: '--model <id>', description: 'Bedrock model ID for evaluation (bedrock mode only)' },
         { flags: '--threshold <n>', description: 'Pass threshold (0-1)' },
-        { flags: '--uninstall', description: 'Remove eval-harness directory' },
+        { flags: '--uninstall', description: 'Remove eval-harness directory and steering files' },
     ],
     async action(opts) {
         const gitRoot = execSync('git rev-parse --show-toplevel', { encoding: 'utf8' }).trim();
@@ -27,74 +28,139 @@ export default {
                 execSync(`rm -rf "${targetDir}"`);
                 console.log('✓ Removed .prism/eval-harness/');
             }
-            else {
-                console.log('No .prism/eval-harness/ found.');
+            const steeringFile = resolve(gitRoot, '.kiro/steering/code-review.md');
+            if (existsSync(steeringFile)) {
+                execSync(`rm -f "${steeringFile}"`);
+                console.log('✓ Removed .kiro/steering/code-review.md');
             }
             return;
         }
-        // --- Config ---
-        const model = opts.model || await prompt('Eval model ID', 'us.anthropic.claude-haiku-4-5-20251001-v1:0');
-        const threshold = opts.threshold || await prompt('Pass threshold', '0.82');
-        const region = await prompt('AWS region', 'us-west-2');
-        // --- Install script + config ---
-        mkdirSync(resolve(targetDir, 'rubrics'), { recursive: true });
-        // Copy run-eval.sh
-        copyFileSync(resolve(EVAL_SOURCE, 'run-eval.sh'), resolve(targetDir, 'run-eval.sh'));
-        chmodSync(resolve(targetDir, 'run-eval.sh'), 0o755);
-        console.log('✓ Installed .prism/eval-harness/run-eval.sh');
-        // Write eval-config.json
-        const config = {
-            pass_threshold: parseFloat(threshold),
-            eval_model_id: model,
-            aws_region: region,
-            event_bus: 'prism-d1-metrics',
-            emit_to_eventbridge: true,
-        };
-        writeFileSync(resolve(targetDir, 'eval-config.json'), JSON.stringify(config, null, 2) + '\n');
-        console.log('✓ Created .prism/eval-harness/eval-config.json');
-        // --- Rubrics ---
-        if (opts.withRubrics) {
-            const rubricsSrc = resolve(EVAL_SOURCE, 'rubrics');
-            for (const file of readdirSync(rubricsSrc).filter(f => f.endsWith('.json'))) {
-                copyFileSync(resolve(rubricsSrc, file), resolve(targetDir, 'rubrics', file));
+        // Determine mode
+        const mode = opts.mode || await prompt('Eval mode (kiro = recommended, bedrock = legacy)', 'kiro');
+        if (mode === 'kiro') {
+            await installKiroMode(gitRoot, opts);
+        }
+        else {
+            await installBedrockMode(gitRoot, targetDir, opts);
+        }
+    },
+};
+async function installKiroMode(gitRoot, opts) {
+    // --- Install steering file ---
+    const steeringDir = resolve(gitRoot, '.kiro/steering');
+    mkdirSync(steeringDir, { recursive: true });
+    const steeringSrc = resolve(EVAL_SOURCE, 'steering/code-review.md');
+    const steeringDest = resolve(steeringDir, 'code-review.md');
+    if (existsSync(steeringDest)) {
+        const overwrite = await prompt('Steering file already exists. Overwrite? [y/N]', 'n');
+        if (overwrite.toLowerCase() !== 'y') {
+            console.log('  Kept existing .kiro/steering/code-review.md');
+        }
+        else {
+            copyFileSync(steeringSrc, steeringDest);
+            console.log('✓ Updated .kiro/steering/code-review.md');
+        }
+    }
+    else {
+        copyFileSync(steeringSrc, steeringDest);
+        console.log('✓ Installed .kiro/steering/code-review.md');
+    }
+    // --- Install workflow ---
+    const workflowsDir = resolve(gitRoot, '.github/workflows');
+    const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate-kiro.yml');
+    if (existsSync(workflowSrc)) {
+        mkdirSync(workflowsDir, { recursive: true });
+        const dest = resolve(workflowsDir, 'prism-eval-gate.yml');
+        if (existsSync(dest)) {
+            const overwrite = await prompt('Workflow already exists. Overwrite? [y/N]', 'n');
+            if (overwrite.toLowerCase() !== 'y') {
+                console.log('  Skipped workflow.');
+            }
+            else {
+                copyFileSync(workflowSrc, dest);
+                console.log('✓ Updated .github/workflows/prism-eval-gate.yml');
             }
-            console.log(`✓ Installed ${readdirSync(resolve(targetDir, 'rubrics')).length} production rubrics`);
         }
         else {
-            console.log('✓ rubrics/ directory created (empty — add your own rubric JSON files)');
+            copyFileSync(workflowSrc, dest);
+            console.log('✓ Installed .github/workflows/prism-eval-gate.yml');
+        }
+    }
+    console.log('\n════════════════════════════════════════════════');
+    console.log('  ✅ Kiro eval gate installed!');
+    console.log('════════════════════════════════════════════════');
+    console.log('\n  Mode:     kiro-cli headless');
+    console.log('  Rules:    .kiro/steering/code-review.md');
+    console.log('  Workflow:  .github/workflows/prism-eval-gate.yml');
+    console.log('\n  Required: Add KIRO_API_KEY as a GitHub repository secret');
+    console.log('  Generate at: https://app.kiro.dev → Settings → API Keys');
+    console.log('\n  Optional: Add PRISM_METRICS_ROLE_ARN for EventBridge metrics');
+    console.log('');
+}
+async function installBedrockMode(gitRoot, targetDir, opts) {
+    // --- Config ---
+    const model = opts.model || await prompt('Eval model ID', 'us.anthropic.claude-haiku-4-5-20251001-v1:0');
+    const threshold = opts.threshold || await prompt('Pass threshold', '0.82');
+    const region = await prompt('AWS region', 'us-west-2');
+    // --- Install script + config ---
+    mkdirSync(resolve(targetDir, 'rubrics'), { recursive: true });
+    // Copy run-eval.sh
+    copyFileSync(resolve(EVAL_SOURCE, 'run-eval.sh'), resolve(targetDir, 'run-eval.sh'));
+    chmodSync(resolve(targetDir, 'run-eval.sh'), 0o755);
+    console.log('✓ Installed .prism/eval-harness/run-eval.sh');
+    // Write eval-config.json
+    const config = {
+        pass_threshold: parseFloat(threshold),
+        eval_model_id: model,
+        aws_region: region,
+        event_bus: 'prism-d1-metrics',
+        emit_to_eventbridge: true,
+    };
+    writeFileSync(resolve(targetDir, 'eval-config.json'), JSON.stringify(config, null, 2) + '\n');
+    console.log('✓ Created .prism/eval-harness/eval-config.json');
+    // --- Rubrics ---
+    if (opts.withRubrics) {
+        const rubricsSrc = resolve(EVAL_SOURCE, 'rubrics');
+        for (const file of readdirSync(rubricsSrc).filter(f => f.endsWith('.json'))) {
+            copyFileSync(resolve(rubricsSrc, file), resolve(targetDir, 'rubrics', file));
         }
-        // --- Workflow ---
-        const workflowsDir = resolve(gitRoot, '.github/workflows');
-        const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate.yml');
-        if (existsSync(workflowSrc)) {
-            mkdirSync(workflowsDir, { recursive: true });
-            const dest = resolve(workflowsDir, 'prism-eval-gate.yml');
-            if (existsSync(dest)) {
-                const overwrite = await prompt('Workflow already exists. Overwrite? [y/N]', 'n');
-                if (overwrite.toLowerCase() !== 'y') {
-                    console.log('  Skipped workflow.');
-                }
-                else {
-                    copyFileSync(workflowSrc, dest);
-                    console.log('✓ Updated .github/workflows/prism-eval-gate.yml');
-                }
+        console.log(`✓ Installed ${readdirSync(resolve(targetDir, 'rubrics')).length} production rubrics`);
+    }
+    else {
+        console.log('✓ rubrics/ directory created (empty — add your own rubric JSON files)');
+    }
+    // --- Workflow ---
+    const workflowsDir = resolve(gitRoot, '.github/workflows');
+    const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate.yml');
+    if (existsSync(workflowSrc)) {
+        mkdirSync(workflowsDir, { recursive: true });
+        const dest = resolve(workflowsDir, 'prism-eval-gate.yml');
+        if (existsSync(dest)) {
+            const overwrite = await prompt('Workflow already exists. Overwrite? [y/N]', 'n');
+            if (overwrite.toLowerCase() !== 'y') {
+                console.log('  Skipped workflow.');
             }
             else {
                 copyFileSync(workflowSrc, dest);
-                console.log('✓ Installed .github/workflows/prism-eval-gate.yml');
+                console.log('✓ Updated .github/workflows/prism-eval-gate.yml');
             }
         }
-        console.log('\n════════════════════════════════════════════════');
-        console.log('  ✅ Eval harness installed!');
-        console.log('════════════════════════════════════════════════');
-        console.log(`\n  Model:     ${model}`);
-        console.log(`  Threshold: ${threshold}`);
-        console.log(`  Rubrics:   ${opts.withRubrics ? 'production set' : 'empty (add your own)'}`);
-        if (!opts.withRubrics) {
-            console.log('\n  Next: Create a rubric at .prism/eval-harness/rubrics/my-rubric.json');
-            console.log('  See: bootstrapper/eval-harness/rubrics/ for examples');
+        else {
+            copyFileSync(workflowSrc, dest);
+            console.log('✓ Installed .github/workflows/prism-eval-gate.yml');
         }
-        console.log('');
-    },
-};
+    }
+    console.log('\n════════════════════════════════════════════════');
+    console.log('  ✅ Eval harness installed (legacy Bedrock mode)!');
+    console.log('════════════════════════════════════════════════');
+    console.log(`\n  Model:     ${model}`);
+    console.log(`  Threshold: ${threshold}`);
+    console.log(`  Rubrics:   ${opts.withRubrics ? 'production set' : 'empty (add your own)'}`);
+    if (!opts.withRubrics) {
+        console.log('\n  Next: Create a rubric at .prism/eval-harness/rubrics/my-rubric.json');
+        console.log('  See: bootstrapper/eval-harness/rubrics/ for examples');
+    }
+    console.log('\n  💡 Consider upgrading to kiro mode: prism-cli bootstrapper install-eval-harness --mode kiro');
+    console.log('');
+}
 //# sourceMappingURL=install-eval-harness.js.map

package/dist/src/commands/bootstrapper/install-eval-harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAgB,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,uEAAuE,EAAE;QACjH,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iCAAiC,EAAE;QACzE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,+BAA+B,EAAE;KACvE;IACD,KAAK,CAAC,MAAM,CAAC,IAAwF;QACnG,MAAM,OAAO,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEvD,kCAAkC;QAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9D,mBAAmB;QACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAE3D,yBAAyB;QACzB,MAAM,MAAM,GAAG;YACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;YACrC,aAAa,EAAE,KAAK;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,kBAAkB;YAC7B,mBAAmB,EAAE,IAAI;SAC1B,CAAC;QACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAE9D,kBAAkB;QAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB;QACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;QACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;oBACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;oBAChC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAgB,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC/H,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC1F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAAuG;QAClH,MAAM,OAAO,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAEnG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAA4B;IAC1E,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAmE;IACvI,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEvD,kCAAkC;IAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,mBAAmB;IACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBAyNE"}
+{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;iBAqDqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN3D,wBA+OE"}

package/dist/src/commands/bootstrapper/setup-github-oidc.js

@@ -233,6 +233,26 @@ export default {
             console.error(`  ✗ Failed to attach policy: ${putPolicy.stderr}`);
             process.exit(1);
         }
+        // Step 4: Attach Continuum CI managed policy (if deployed)
+        console.log('\nStep 4: Attaching Continuum CI scan policy (if available)...');
+        const continuumPolicy = run(`aws iam list-policies --scope Local --query "Policies[?PolicyName=='prism-d1-continuum-ci-scan'].Arn" --output text`);
+        if (continuumPolicy.ok && continuumPolicy.stdout) {
+            const attachResult = run(`aws iam attach-role-policy --role-name ${roleName} --policy-arn ${continuumPolicy.stdout}`);
+            if (attachResult.ok) {
+                console.log(`  ✓ Continuum CI policy attached (SSM + S3 + SecurityAgent access).`);
+            }
+            else if (attachResult.stderr.includes('already')) {
+                console.log('  ✓ Continuum CI policy already attached.');
+            }
+            else {
+                console.log(`  ⚠️  Could not attach Continuum policy: ${attachResult.stderr}`);
+                console.log('  The eval gate workflow will skip security scanning until this is resolved.');
+            }
+        }
+        else {
+            console.log('  ℹ️  Continuum CI policy not found (deploy with --context enableSecurityAgent=true to create it).');
+            console.log('  The eval gate workflow will gracefully skip security scanning.');
+        }
         // Summary
         const roleArn = `arn:aws:iam::${accountId}:role/${roleName}`;
         console.log('\n════════════════════════════════════════════════');

package/dist/src/commands/bootstrapper/setup-github-oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,GAAG,CAAC,GAAW;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;KAC/L;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAE/E,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,2DAA2D,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,uEAAuE,WAAW,EAAE,CAAC,CAAC;QACnH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CACxB,0CAA0C;gBAC1C,oDAAoD;gBACpD,qCAAqC;gBACrC,qBAAqB,UAAU,EAAE,CAClC,CAAC;YACF,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAChB,iDAAiD,QAAQ,uBAAuB,WAAW,GAAG,CAC/F,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CACpB,mCAAmC,QAAQ,GAAG;gBAC9C,kCAAkC,WAAW,IAAI;gBACjD,+CAA+C,QAAQ,GAAG,CAC3D,CAAC;YACF,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,4BAA4B,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CACnB,uCAAuC,QAAQ,GAAG;YAClD,iBAAiB,UAAU,GAAG;YAC9B,sBAAsB,cAAc,GAAG,CACxC,CAAC;QACF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,GAAG,CACzB,qHAAqH,CACtH,CAAC;QACF,IAAI,eAAe,CAAC,EAAE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,GAAG,CACtB,0CAA0C,QAAQ,iBAAiB,eAAe,CAAC,MAAM,EAAE,CAC5F,CAAC;YACF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oGAAoG,CAAC,CAAC;YAClH,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {