@prism-d1/cli 1.0.77 → 1.0.80

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -27,6 +27,8 @@ export class MetricsPipelineStack extends cdk.Stack {
   public readonly guardrail: BedrockGuardrailConstruct;
   public readonly securityAgent?: SecurityAgentConstruct;
   public readonly otelCollector?: OtelCollectorConstruct;
+  /** ARN of the Team Velocity custom-widget Lambda (DDB-backed panels). */
+  public velocityWidgetArn!: string;
 
   constructor(scope: Construct, id: string, props?: cdk.StackProps) {
     super(scope, id, props);
@@ -165,6 +167,10 @@ export class MetricsPipelineStack extends cdk.Stack {
       ['by-pr', 'gsi_pr', 'gsi_pr_sk'],
       ['by-commit', 'gsi_commit', 'gsi_commit_sk'],
       ['by-date', 'gsi_date', 'gsi_date_sk'],
+      // Sparse index over commit attribution items (only they carry gsi_user):
+      // pk USER#<email>, sk COMMIT#<iso-timestamp>. Powers per-developer
+      // commit queries for GET /v1/productivity without scanning.
+      ['by-user', 'gsi_user', 'gsi_user_sk'],
     ] as const) {
       this.aiUsageTable.addGlobalSecondaryIndex({
         indexName,
@@ -243,6 +249,15 @@ export class MetricsPipelineStack extends cdk.Stack {
       description: 'Processes PRISM D1 metric events from EventBridge into DynamoDB and CloudWatch',
     });
 
+    // Cap Lambda's own async retry of function errors (default 2, up to 6h).
+    // EventBridge target retries are bounded separately below; together these
+    // prevent the unbounded retry amplification behind the July 2026 storm.
+    new lambda.EventInvokeConfig(this, 'MetricsProcessorInvokeConfig', {
+      function: metricsProcessor,
+      retryAttempts: 1,
+      maxEventAge: cdk.Duration.hours(1),
+    });
+
     // -------------------------------------------------------
     // IAM permissions for the processor
     // -------------------------------------------------------
@@ -284,6 +299,26 @@ export class MetricsPipelineStack extends cdk.Stack {
       'prism.d1.quality',
     ];
 
+    // DLQ for events the processor fails to handle. Combined with
+    // retryAttempts: 1 this caps the blast radius of a poison event or a
+    // downstream outage — the July 2026 retry storm (~108M invocations/day,
+    // 445 GB of logs) was driven by unbounded async retries against a
+    // throttling failure. Events land here for inspection instead of looping.
+    const processorDlq = new sqs.Queue(this, 'MetricsProcessorDlq', {
+      queueName: 'prism-d1-metrics-processor-dlq',
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: prismKmsKey,
+      retentionPeriod: cdk.Duration.days(14),
+      enforceSSL: true,
+    });
+    // EventBridge needs KMS grants to write to the CMK-encrypted DLQ —
+    // without them messages are dropped silently (no error, no metric).
+    prismKmsKey.grant(
+      new iam.ServicePrincipal('events.amazonaws.com'),
+      'kms:GenerateDataKey',
+      'kms:Decrypt',
+    );
+
     for (const detailType of detailTypes) {
       const ruleName = detailType.replace(/\./g, '-');
       new events.Rule(this, `Rule-${ruleName}`, {
@@ -293,7 +328,13 @@ export class MetricsPipelineStack extends cdk.Stack {
           source: ['prism.d1.velocity'],
           detailType: [detailType],
         },
-        targets: [new targets.LambdaFunction(metricsProcessor)],
+        targets: [
+          new targets.LambdaFunction(metricsProcessor, {
+            deadLetterQueue: processorDlq,
+            retryAttempts: 1,
+            maxEventAge: cdk.Duration.hours(1),
+          }),
+        ],
         description: `Routes ${detailType} events to the metrics processor`,
       });
     }
@@ -411,7 +452,141 @@ export class MetricsPipelineStack extends cdk.Stack {
           ],
         }),
       );
+
+      // Attribution metrics publisher — commit attribution → CloudWatch
+      const attrPublisherDlq = new sqs.Queue(this, 'AttrPublisherDlq', {
+        retentionPeriod: cdk.Duration.days(7),
+        encryption: sqs.QueueEncryption.KMS,
+        encryptionMasterKey: prismKmsKey,
+        enforceSSL: true,
+      });
+
+      const attrMetricsPublisher = new lambda.Function(this, 'AttributionMetricsPublisher', {
+        functionName: 'prism-d1-attribution-metrics-publisher',
+        runtime: lambda.Runtime.NODEJS_22_X,
+        handler: 'attribution-metrics-publisher.handler',
+        timeout: cdk.Duration.seconds(60),
+        memorySize: 256,
+        environment: {
+          METRIC_NAMESPACE: 'PRISM/D1/Velocity',
+          AI_USAGE_TABLE: this.aiUsageTable.tableName,
+        },
+        code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
+          bundling: {
+            image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+            command: [
+              'bash', '-c',
+              `npx esbuild attribution-metrics-publisher.ts --bundle --platform=node --target=node22 --outfile=/asset-output/attribution-metrics-publisher.js --external:@aws-sdk/*`,
+            ],
+            local: {
+              tryBundle(outputDir: string): boolean {
+                try {
+                  require('child_process').execSync(
+                    `npx esbuild ${path.join(__dirname, 'lambda', 'attribution-metrics-publisher.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'attribution-metrics-publisher.js')} --external:@aws-sdk/*`,
+                    { stdio: 'pipe' },
+                  );
+                  return true;
+                } catch { return false; }
+              },
+            },
+          },
+        }),
+      });
+
+      // Grant permissions
+      this.aiUsageTable.grantReadWriteData(attrMetricsPublisher);
+      attrMetricsPublisher.addToRolePolicy(new iam.PolicyStatement({
+        actions: ['cloudwatch:PutMetricData'],
+        resources: ['*'],
+        conditions: { StringEquals: { 'cloudwatch:namespace': 'PRISM/D1/Velocity' } },
+      }));
+
+      // DDB stream trigger — only COMMIT# items (pk begins_with REPO#)
+      attrMetricsPublisher.addEventSource(
+        new eventsources.DynamoEventSource(this.aiUsageTable, {
+          startingPosition: lambda.StartingPosition.LATEST,
+          batchSize: 50,
+          maxBatchingWindow: cdk.Duration.seconds(15),
+          bisectBatchOnError: true,
+          retryAttempts: 3,
+          onFailure: new eventsources.SqsDlq(attrPublisherDlq),
+          filters: [
+            lambda.FilterCriteria.filter({
+              eventName: lambda.FilterRule.or('INSERT', 'MODIFY'),
+              dynamodb: {
+                Keys: {
+                  pk: { S: lambda.FilterRule.beginsWith('REPO#') },
+                  sk: { S: lambda.FilterRule.beginsWith('COMMIT#') },
+                },
+              },
+            }),
+          ],
+        }),
+      );
+
+      NagSuppressions.addResourceSuppressions(
+        attrMetricsPublisher,
+        [{ id: 'AwsSolutions-IAM5', reason: 'CloudWatch PutMetricData requires * resource, scoped by namespace condition' }],
+        true,
+      );
+    }
+
+    // -------------------------------------------------------
+    // Velocity custom-widget Lambda — DDB-backed panels for the
+    // Team Velocity dashboard. Reads the events table via the
+    // by-detail-type GSI (full history, no metric-dimension matching).
+    // Invoked by CloudWatch dashboards with the viewing user's IAM creds.
+    // -------------------------------------------------------
+    const velocityWidget = new lambda.Function(this, 'VelocityWidget', {
+      functionName: 'prism-d1-velocity-widget',
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: 'velocity-widget.handler',
+      code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
+        bundling: {
+          image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+          command: [
+            'bash', '-c',
+            [
+              'npm init -y > /dev/null 2>&1',
+              'npm install --save @aws-sdk/client-dynamodb @aws-sdk/client-lambda esbuild > /dev/null 2>&1',
+              'npx esbuild velocity-widget.ts --bundle --platform=node --target=node22 --outfile=/asset-output/velocity-widget.js --external:@aws-sdk/*',
+            ].join(' && '),
+          ],
+          local: {
+            tryBundle(outputDir: string): boolean {
+              try {
+                require('child_process').execSync(
+                  `npx esbuild ${path.join(__dirname, 'lambda', 'velocity-widget.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'velocity-widget.js')} --external:@aws-sdk/*`,
+                  { stdio: 'pipe' },
+                );
+                return true;
+              } catch { return false; }
+            },
+          },
+        },
+      }),
+      timeout: cdk.Duration.seconds(30),
+      memorySize: 256,
+      environment: {
+        EVENTS_TABLE: this.eventsTable.tableName,
+        RECEIVER_FUNCTION: 'prism-d1-otel-receiver',
+      },
+      logRetention: logs.RetentionDays.ONE_MONTH,
+      description: 'CloudWatch custom widget: Team Velocity panels from the PRISM events table',
+    });
+    this.eventsTable.grantReadData(velocityWidget);
+    if (this.otelCollector) {
+      // aidora view delegates attribution KPIs to the receiver; without the
+      // collector the view degrades gracefully (eval KPI only).
+      this.otelCollector.receiverFunction.grantInvoke(velocityWidget);
     }
+    this.velocityWidgetArn = velocityWidget.functionArn;
+    NagSuppressions.addResourceSuppressions(
+      velocityWidget,
+      [{ id: 'AwsSolutions-IAM4', reason: 'AWSLambdaBasicExecutionRole for CloudWatch Logs' },
+       { id: 'AwsSolutions-IAM5', reason: 'Table read grant includes index ARNs (table/*/index/*)' }],
+      true,
+    );
 
     // -------------------------------------------------------
     // AWS Security Agent (opt-in — requires Security Agent access)
@@ -605,125 +780,22 @@ export class MetricsPipelineStack extends cdk.Stack {
     });
 
     // -------------------------------------------------------
-    // Defect Correlator (Pillar 7)
-    // -------------------------------------------------------
-    const defectCorrelator = new lambda.Function(this, 'DefectCorrelator', {
-      functionName: 'prism-d1-defect-correlator',
-      runtime: lambda.Runtime.NODEJS_22_X,
-      handler: 'defect-correlator.handler',
-      ...lambdaVpcProps,
-      code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
-        bundling: {
-          image: lambda.Runtime.NODEJS_22_X.bundlingImage,
-          command: [
-            'bash', '-c',
-            [
-              'npm init -y > /dev/null 2>&1',
-              'npm install --save @aws-sdk/client-dynamodb @aws-sdk/client-eventbridge esbuild > /dev/null 2>&1',
-              'npx esbuild defect-correlator.ts --bundle --platform=node --target=node22 --outfile=/asset-output/defect-correlator.js --external:@aws-sdk/*',
-            ].join(' && '),
-          ],
-          local: {
-            tryBundle(outputDir: string): boolean {
-              try {
-                const { execSync } = require('child_process');
-                execSync(
-                  `npx esbuild ${path.join(__dirname, 'lambda', 'defect-correlator.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'defect-correlator.js')} --external:@aws-sdk/*`,
-                  { stdio: 'pipe' },
-                );
-                return true;
-              } catch {
-                return false;
-              }
-            },
-          },
-        },
-      }),
-      timeout: cdk.Duration.seconds(30),
-      memorySize: 256,
-      environment: {
-        EVENTS_TABLE: this.eventsTable.tableName,
-        EVENT_BUS_NAME: this.eventBus.eventBusName,
-        LOOKBACK_HOURS: '24',
-      },
-      logRetention: logs.RetentionDays.ONE_MONTH,
-      description: 'Correlates deployment failures with AI vs human commit origins',
-    });
-
-    this.eventsTable.grantReadData(defectCorrelator);
-    this.eventBus.grantPutEventsTo(defectCorrelator);
-
-    // Trigger defect correlator on failed deploy events
-    new events.Rule(this, 'DeployToDefectCorrelatorRule', {
-      ruleName: 'prism-d1-deploy-to-defect-correlator',
-      eventBus: this.eventBus,
-      eventPattern: {
-        source: ['prism.d1.velocity'],
-        detailType: ['prism.d1.deploy'],
-      },
-      targets: [new targets.LambdaFunction(defectCorrelator)],
-      description: 'Triggers defect correlation on deployment events',
-    });
-
+    // REMOVED: Defect Correlator + Spec-to-Code Calculator
+    //
+    // Both were permanent no-ops. Each keyed off `prism.d1.commit`, which no
+    // DEPLOYED producer emits — the only emitters are the demo-data generator
+    // and docs/reference/github-webhook-handler/, which CDK never deploys.
+    // defect-correlator skipped every event via `detailType !==
+    // 'prism.d1.commit'` and returned early; spec-to-code-calculator queried
+    // for the same type (with a Limit:1 + FilterExpression bug on top, so the
+    // filter never ran) and found nothing. They consumed IAM, VPC attachments,
+    // and log groups while implying capability the pipeline did not have.
+    //
+    // Their metrics (PostMergeDefectRate, SpecToCodeHours) and the
+    // prism.d1.quality event type went with them. The working equivalent of
+    // post-merge defect rate is RevertedAICommits / MergedAICommits from the
+    // attribution store, already on the dashboards.
     // -------------------------------------------------------
-    // Spec-to-Code Calculator (Pillar 7)
-    // -------------------------------------------------------
-    const specToCodeCalc = new lambda.Function(this, 'SpecToCodeCalculator', {
-      functionName: 'prism-d1-spec-to-code-calculator',
-      runtime: lambda.Runtime.NODEJS_22_X,
-      handler: 'spec-to-code-calculator.handler',
-      ...lambdaVpcProps,
-      code: lambda.Code.fromAsset(path.join(__dirname, 'lambda'), {
-        bundling: {
-          image: lambda.Runtime.NODEJS_22_X.bundlingImage,
-          command: [
-            'bash', '-c',
-            [
-              'npm init -y > /dev/null 2>&1',
-              'npm install --save @aws-sdk/client-dynamodb @aws-sdk/client-eventbridge esbuild > /dev/null 2>&1',
-              'npx esbuild spec-to-code-calculator.ts --bundle --platform=node --target=node22 --outfile=/asset-output/spec-to-code-calculator.js --external:@aws-sdk/*',
-            ].join(' && '),
-          ],
-          local: {
-            tryBundle(outputDir: string): boolean {
-              try {
-                const { execSync } = require('child_process');
-                execSync(
-                  `npx esbuild ${path.join(__dirname, 'lambda', 'spec-to-code-calculator.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'spec-to-code-calculator.js')} --external:@aws-sdk/*`,
-                  { stdio: 'pipe' },
-                );
-                return true;
-              } catch {
-                return false;
-              }
-            },
-          },
-        },
-      }),
-      timeout: cdk.Duration.seconds(30),
-      memorySize: 256,
-      environment: {
-        EVENTS_TABLE: this.eventsTable.tableName,
-        EVENT_BUS_NAME: this.eventBus.eventBusName,
-      },
-      logRetention: logs.RetentionDays.ONE_MONTH,
-      description: 'Calculates spec-to-code hours for merged PRs with spec references',
-    });
-
-    this.eventsTable.grantReadData(specToCodeCalc);
-    this.eventBus.grantPutEventsTo(specToCodeCalc);
-
-    // Trigger spec-to-code calculator on merged PR events
-    new events.Rule(this, 'PrToSpecCalcRule', {
-      ruleName: 'prism-d1-pr-to-spec-calc',
-      eventBus: this.eventBus,
-      eventPattern: {
-        source: ['prism.d1.velocity'],
-        detailType: ['prism.d1.pr'],
-      },
-      targets: [new targets.LambdaFunction(specToCodeCalc)],
-      description: 'Triggers spec-to-code calculation on merged PR events',
-    });
 
     // -------------------------------------------------------
     // AWS Security Agent Integration

package/dist/assets/infra/package.json

@@ -8,7 +8,8 @@
     "cdk": "cdk",
     "synth": "cdk synth",
     "deploy": "cdk deploy --all",
-    "diff": "cdk diff"
+    "diff": "cdk diff",
+    "check:metrics": "tsx scripts/check-metric-coverage.ts"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.170.0",

package/dist/assets/infra/tsconfig.json

@@ -2,7 +2,9 @@
   "compilerOptions": {
     "target": "ES2022",
     "module": "commonjs",
-    "lib": ["es2022"],
+    "lib": [
+      "es2022"
+    ],
     "declaration": true,
     "strict": true,
     "noImplicitAny": true,
@@ -20,5 +22,10 @@
     "outDir": "./dist",
     "rootDir": "."
   },
-  "exclude": ["node_modules", "dist", "lib/lambda"]
+  "exclude": [
+    "node_modules",
+    "dist",
+    "lib/lambda",
+    "scripts"
+  ]
 }

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts

@@ -1,14 +1,20 @@
 declare const _default: {
     description: string;
-    options: {
+    options: ({
         flags: string;
         description: string;
-    }[];
+        default?: undefined;
+    } | {
+        flags: string;
+        description: string;
+        default: string;
+    })[];
     action(opts: {
         mode?: string;
         withRubrics?: boolean;
         model?: string;
         threshold?: string;
+        region?: string;
         uninstall?: boolean;
     }): Promise<void>;
 };

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;iBAyBqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AATtH,wBAmCE"}
+{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;;;;;;iBA2DqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AAVvI,wBAoCE"}

package/dist/src/commands/bootstrapper/install-eval-harness.js

@@ -1,9 +1,35 @@
-import { existsSync, mkdirSync, writeFileSync, copyFileSync, chmodSync, readdirSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, readdirSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { getAssetPath } from '../../utils/root.js';
+import { applyRegion, findDefaultRegionRefs, DEFAULT_REGION } from '../../utils/region.js';
+/**
+ * Copies a workflow asset into the repo with the region templated.
+ *
+ * Must not be a bare copyFileSync: these assets are authored against
+ * DEFAULT_REGION, and an unsubstituted copy sends the Continuum scan and
+ * event-emission calls to a region where the agent space and scan bucket do
+ * not exist -- which fails the gate closed and blocks merges.
+ */
+async function writeWorkflow(src, dest, region, label, ask) {
+    if (existsSync(dest)) {
+        const overwrite = await ask('Workflow already exists. Overwrite? [y/N]', 'n');
+        if (overwrite.toLowerCase() !== 'y') {
+            console.log('  Skipped workflow.');
+            return;
+        }
+    }
+    const content = applyRegion(readFileSync(src, 'utf-8'), region);
+    const stragglers = findDefaultRegionRefs(content, label);
+    if (stragglers.length > 0) {
+        console.warn(`  ⚠ ${stragglers.length} unconverted region reference(s):`);
+        stragglers.forEach(s => console.warn(`      ${s}`));
+    }
+    writeFileSync(dest, content);
+    console.log(`✓ Installed ${label} (region: ${region})`);
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const EVAL_SOURCE = getAssetPath(import.meta.url, 'bootstrapper/eval-harness');
 function prompt(question, defaultValue) {
@@ -18,6 +44,7 @@ export default {
         { flags: '--with-rubrics', description: 'Include production rubrics (bedrock mode only)' },
         { flags: '--model <id>', description: 'Bedrock model ID for evaluation (bedrock mode only)' },
         { flags: '--threshold <n>', description: 'Pass threshold (0-1)' },
+        { flags: '--region <region>', description: 'AWS region for EventBridge/CloudWatch/Continuum', default: DEFAULT_REGION },
         { flags: '--uninstall', description: 'Remove eval-harness directory and steering files' },
     ],
     async action(opts) {
@@ -46,6 +73,7 @@ export default {
     },
 };
 async function installKiroMode(gitRoot, opts) {
+    const region = opts.region || DEFAULT_REGION;
     // --- Install steering file ---
     const steeringDir = resolve(gitRoot, '.kiro/steering');
     mkdirSync(steeringDir, { recursive: true });
@@ -70,21 +98,7 @@ async function installKiroMode(gitRoot, opts) {
     const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate-kiro.yml');
     if (existsSync(workflowSrc)) {
         mkdirSync(workflowsDir, { recursive: true });
-        const dest = resolve(workflowsDir, 'prism-eval-gate.yml');
-        if (existsSync(dest)) {
-            const overwrite = await prompt('Workflow already exists. Overwrite? [y/N]', 'n');
-            if (overwrite.toLowerCase() !== 'y') {
-                console.log('  Skipped workflow.');
-            }
-            else {
-                copyFileSync(workflowSrc, dest);
-                console.log('✓ Updated .github/workflows/prism-eval-gate.yml');
-            }
-        }
-        else {
-            copyFileSync(workflowSrc, dest);
-            console.log('✓ Installed .github/workflows/prism-eval-gate.yml');
-        }
+        await writeWorkflow(workflowSrc, resolve(workflowsDir, 'prism-eval-gate.yml'), region, '.github/workflows/prism-eval-gate.yml', prompt);
     }
     console.log('\n════════════════════════════════════════════════');
     console.log('  ✅ Kiro eval gate installed!');
@@ -101,7 +115,7 @@ async function installBedrockMode(gitRoot, targetDir, opts) {
     // --- Config ---
     const model = opts.model || await prompt('Eval model ID', 'us.anthropic.claude-haiku-4-5-20251001-v1:0');
     const threshold = opts.threshold || await prompt('Pass threshold', '0.82');
-    const region = await prompt('AWS region', 'us-west-2');
+    const region = opts.region || await prompt('AWS region', DEFAULT_REGION);
     // --- Install script + config ---
     mkdirSync(resolve(targetDir, 'rubrics'), { recursive: true });
     // Copy run-eval.sh
@@ -134,21 +148,7 @@ async function installBedrockMode(gitRoot, targetDir, opts) {
     const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate.yml');
     if (existsSync(workflowSrc)) {
         mkdirSync(workflowsDir, { recursive: true });
-        const dest = resolve(workflowsDir, 'prism-eval-gate.yml');
-        if (existsSync(dest)) {
-            const overwrite = await prompt('Workflow already exists. Overwrite? [y/N]', 'n');
-            if (overwrite.toLowerCase() !== 'y') {
-                console.log('  Skipped workflow.');
-            }
-            else {
-                copyFileSync(workflowSrc, dest);
-                console.log('✓ Updated .github/workflows/prism-eval-gate.yml');
-            }
-        }
-        else {
-            copyFileSync(workflowSrc, dest);
-            console.log('✓ Installed .github/workflows/prism-eval-gate.yml');
-        }
+        await writeWorkflow(workflowSrc, resolve(workflowsDir, 'prism-eval-gate.yml'), region, '.github/workflows/prism-eval-gate.yml', prompt);
     }
     console.log('\n════════════════════════════════════════════════');
     console.log('  ✅ Eval harness installed (legacy Bedrock mode)!');

package/dist/src/commands/bootstrapper/install-eval-harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAgB,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC/H,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC1F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAAuG;QAClH,MAAM,OAAO,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAEnG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAA4B;IAC1E,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAmE;IACvI,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEvD,kCAAkC;IAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,mBAAmB;IACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YACjF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAY,EACZ,MAAc,EACd,KAAa,EACb,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;QAC1E,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,aAAa,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,2DAA2D;IACxE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC/H,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gDAAgD,EAAE;QAC1F,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACjE,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,iDAAiD,EAAE,OAAO,EAAE,cAAc,EAAE;QACvH,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAAwH;QACnI,MAAM,OAAO,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAEnG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAA6C;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAoF;IACxJ,iBAAiB;IACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEzE,kCAAkC;IAClC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,mBAAmB;IACnB,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAE9D,kBAAkB;IAClB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACrG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,mBAAmB;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;IACvG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/src/commands/bootstrapper/install-github-workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":";;;;;;;iBAUqB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAN3D,wBAkCE"}
+{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":";;;;;;;iBAWqB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAN3D,wBAsCE"}

package/dist/src/commands/bootstrapper/install-github-workflows.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getAssetPath } from '../../utils/root.js';
+import { applyRegion, findDefaultRegionRefs } from '../../utils/region.js';
 export default {
     description: 'Install GitHub Actions workflow templates into the current repo',
     options: [
@@ -18,8 +19,12 @@ export default {
         const files = readdirSync(assetDir).filter(f => f.endsWith('.yml'));
         for (const file of files) {
             let content = readFileSync(join(assetDir, file), 'utf-8');
-            content = content.replace(/aws-region: us-west-2/g, `aws-region: ${region}`);
-            content = content.replace(/--region us-west-2/g, `--region ${region}`);
+            content = applyRegion(content, region);
+            const stragglers = findDefaultRegionRefs(content, file);
+            if (stragglers.length > 0) {
+                console.warn(`  ⚠ ${file}: ${stragglers.length} unconverted region reference(s):`);
+                stragglers.forEach(s => console.warn(`      ${s}`));
+            }
             writeFileSync(join(outputDir, file), content);
             console.log(`  ✓ ${file}`);
         }

package/dist/src/commands/bootstrapper/install-github-workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,eAAe;IACb,WAAW,EAAE,iEAAiE;IAC9E,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;QAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;KAC/F;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,KAAK,CAAC,CAAC;QAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,eAAe,MAAM,EAAE,CAAC,CAAC;YAC7E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;YACvE,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE3E,eAAe;IACb,WAAW,EAAE,iEAAiE;IAC9E,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;QAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;KAC/F;IACD,KAAK,CAAC,MAAM,CAAC,IAA4C;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,KAAK,CAAC,CAAC;QAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,UAAU,CAAC,MAAM,mCAAmC,CAAC,CAAC;gBACnF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/src/commands/bootstrapper/install-gitlab-workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-gitlab-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":";;;;;;;iBAuBqB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP/E,wBA+CE"}
+{"version":3,"file":"install-gitlab-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":";;;;;;;iBAwBqB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP/E,wBAoDE"}

package/dist/src/commands/bootstrapper/install-gitlab-workflows.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { getAssetPath } from '../../utils/root.js';
+import { applyRegion, findDefaultRegionRefs } from '../../utils/region.js';
 function prompt(question, defaultValue) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     const suffix = defaultValue ? ` [${defaultValue}]` : '';
@@ -34,7 +35,12 @@ export default {
             let content = readFileSync(join(assetDir, file), 'utf-8');
             // Template the audience and region
             content = content.replace(/aud: https:\/\/gitlab\.com/g, `aud: ${gitlabUrl}`);
-            content = content.replace(/AWS_DEFAULT_REGION: us-west-2/g, `AWS_DEFAULT_REGION: ${region}`);
+            content = applyRegion(content, region);
+            const stragglers = findDefaultRegionRefs(content, file);
+            if (stragglers.length > 0) {
+                console.warn(`  ⚠ ${file}: ${stragglers.length} unconverted region reference(s):`);
+                stragglers.forEach(s => console.warn(`      ${s}`));
+            }
             writeFileSync(join(outputDir, file), content);
             console.log(`  ✓ ${file}`);
         }