@prism-d1/cli 1.0.93 → 1.0.95

package/dist/src/utils/audit.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Shared result model and reporter for the audit commands
+ * (`scan-account`, `bedrock-protection`, `scan-repo`).
+ *
+ * This lives under utils/ rather than alongside the commands because
+ * `commands/<category>/*.js` is the command auto-discovery path -- every file in
+ * a category directory is registered as a subcommand, so a shared module placed
+ * there would appear in `--help` as a bogus command.
+ */
+export type Severity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+/**
+ * INDETERMINATE is a first-class outcome, not an error case.
+ *
+ * A check that could not run has told you nothing, and folding it into the pass
+ * count is how an audit ends up certifying an account or repo it never
+ * examined. Cost Explorer being switched off, a missing IAM permission, or an
+ * absent gitleaks binary all produce INDETERMINATE -- never PASS.
+ */
+export type Status = 'PASS' | 'FAIL' | 'INDETERMINATE';
+export interface Finding {
+    id: string;
+    /** Report grouping key; each command supplies its own headings. */
+    category: string;
+    title: string;
+    status: Status;
+    severity: Severity;
+    detail: string;
+    remediation?: string;
+}
+export declare const SEVERITY_ORDER: Severity[];
+export declare function severityRank(s: Severity): number;
+export interface ReportOptions {
+    title: string;
+    /** Rendered under the title, e.g. "Account: 1234    Region: us-west-2". */
+    subtitle: string;
+    /** Ordered [categoryKey, heading] pairs. Categories not listed are omitted. */
+    groups: Array<[string, string]>;
+    json: boolean;
+    /** Extra fields merged into the JSON envelope alongside `findings`. */
+    jsonContext?: Record<string, unknown>;
+}
+export declare function renderReport(findings: Finding[], opts: ReportOptions): void;
+/** Parse and validate a --fail-on value. Returns null for "none". */
+export declare function parseFailOn(value: string | undefined): Severity | null;
+/**
+ * Apply --fail-on to the findings, setting process.exitCode when breached.
+ * Only FAIL counts -- an INDETERMINATE check has not established a violation,
+ * and exiting non-zero on it would make a missing permission indistinguishable
+ * from a real finding.
+ */
+export declare function applyFailOn(findings: Finding[], failOn: Severity | null, quiet: boolean): void;
+export declare const FAIL_ON_OPTION: {
+    flags: string;
+    description: string;
+    default: string;
+};
+export declare const JSON_OPTION: {
+    flags: string;
+    description: string;
+};
+//# sourceMappingURL=audit.d.ts.map

package/dist/src/utils/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/utils/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,eAAe,CAAC;AAEvD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,cAAc,EAAE,QAAQ,EAAkD,CAAC;AAIxF,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAuC3E;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,CAOtE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAS9F;AAED,eAAO,MAAM,cAAc;;;;CAI1B,CAAC;AAEF,eAAO,MAAM,WAAW;;;CAGvB,CAAC"}

package/dist/src/utils/audit.js

@@ -0,0 +1,90 @@
+/**
+ * Shared result model and reporter for the audit commands
+ * (`scan-account`, `bedrock-protection`, `scan-repo`).
+ *
+ * This lives under utils/ rather than alongside the commands because
+ * `commands/<category>/*.js` is the command auto-discovery path -- every file in
+ * a category directory is registered as a subcommand, so a shared module placed
+ * there would appear in `--help` as a bogus command.
+ */
+export const SEVERITY_ORDER = ['INFO', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+const ICON = { PASS: '✅', FAIL: '❌', INDETERMINATE: '❓' };
+export function severityRank(s) {
+    return SEVERITY_ORDER.indexOf(s);
+}
+export function renderReport(findings, opts) {
+    if (opts.json) {
+        console.log(JSON.stringify({
+            ...(opts.jsonContext ?? {}),
+            generated_at: new Date().toISOString(),
+            findings,
+        }, null, 2));
+        return;
+    }
+    console.log(`\n${opts.title}`);
+    if (opts.subtitle)
+        console.log(`   ${opts.subtitle}`);
+    console.log(`   Audit only — this command makes no changes.\n`);
+    for (const [key, heading] of opts.groups) {
+        const rows = findings.filter((f) => f.category === key);
+        if (!rows.length)
+            continue;
+        console.log(`── ${heading} ──\n`);
+        rows.sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+        for (const f of rows) {
+            console.log(`  ${ICON[f.status]} [${f.severity}] ${f.title}`);
+            console.log(`     ${f.detail}`);
+            if (f.status !== 'PASS' && f.remediation)
+                console.log(`     → ${f.remediation}`);
+            console.log('');
+        }
+    }
+    const fail = findings.filter((f) => f.status === 'FAIL');
+    const indet = findings.filter((f) => f.status === 'INDETERMINATE');
+    const bySev = (s) => fail.filter((f) => f.severity === s).length;
+    console.log('── Summary ──\n');
+    console.log(`  ${findings.length} checks: ${findings.length - fail.length - indet.length} pass, ${fail.length} fail, ${indet.length} indeterminate`);
+    console.log(`  Findings by severity: CRITICAL ${bySev('CRITICAL')}, HIGH ${bySev('HIGH')}, MEDIUM ${bySev('MEDIUM')}, LOW ${bySev('LOW')}\n`);
+    if (indet.length) {
+        console.log(`  ❓ ${indet.length} check(s) could not run and are NOT passes: ${indet.map((f) => f.id).join(', ')}`);
+        console.log(`     Treat the result as a floor, not a clean bill of health.\n`);
+    }
+}
+/** Parse and validate a --fail-on value. Returns null for "none". */
+export function parseFailOn(value) {
+    const v = (value ?? 'none').toUpperCase();
+    if (v === 'NONE')
+        return null;
+    if (!SEVERITY_ORDER.includes(v)) {
+        throw new Error(`--fail-on must be one of CRITICAL, HIGH, MEDIUM, LOW, none (got "${value}")`);
+    }
+    return v;
+}
+/**
+ * Apply --fail-on to the findings, setting process.exitCode when breached.
+ * Only FAIL counts -- an INDETERMINATE check has not established a violation,
+ * and exiting non-zero on it would make a missing permission indistinguishable
+ * from a real finding.
+ */
+export function applyFailOn(findings, failOn, quiet) {
+    if (!failOn)
+        return;
+    const threshold = severityRank(failOn);
+    const breaching = findings.filter((f) => f.status === 'FAIL' && severityRank(f.severity) >= threshold);
+    if (!breaching.length)
+        return;
+    if (!quiet) {
+        console.error(`❌ ${breaching.length} finding(s) at or above ${failOn}: ${breaching.map((f) => f.id).join(', ')}\n`);
+    }
+    process.exitCode = 1;
+}
+export const FAIL_ON_OPTION = {
+    flags: '--fail-on <severity>',
+    description: 'Exit non-zero if any finding is at or above this severity (CRITICAL|HIGH|MEDIUM|LOW|none)',
+    default: 'none',
+};
+export const JSON_OPTION = {
+    flags: '--json',
+    description: 'Emit machine-readable JSON instead of the report',
+};
+//# sourceMappingURL=audit.js.map

package/dist/src/utils/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/utils/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAyBH,MAAM,CAAC,MAAM,cAAc,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAExF,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAElF,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAaD,MAAM,UAAU,YAAY,CAAC,QAAmB,EAAE,IAAmB;IACnE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,QAAQ;SACT,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAEhE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAE3E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,UAAU,IAAI,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACrJ,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9I,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,+CAA+C,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnH,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAa,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oEAAoE,KAAK,IAAI,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAmB,EAAE,MAAuB,EAAE,KAAc;IACtF,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC;IACvG,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,2BAA2B,MAAM,KAAK,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,2FAA2F;IACxG,OAAO,EAAE,MAAM;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,kDAAkD;CAChE,CAAC"}

package/dist/src/utils/aws.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Thin JSON wrapper over the AWS CLI for the audit commands.
+ *
+ * Uses `run()` (execFileSync with an args array, no shell), so nothing here is
+ * exposed to shell interpretation even though callers pass a user-supplied
+ * --profile and --region.
+ */
+export interface AwsResult {
+    ok: boolean;
+    json: any;
+    /** AWS error code parsed from stderr, e.g. NoSuchEntity, when ok === false. */
+    errorCode: string;
+    /** stderr on failure, stdout on an unparseable success. */
+    raw: string;
+}
+/**
+ * Several AWS commands exit 0 with a COMPLETELY EMPTY body when the thing being
+ * described does not exist -- measured on `budgets describe-budgets` with no
+ * budgets, and on `bedrock get-model-invocation-logging-configuration` with
+ * logging disabled. `JSON.parse('')` throws, so a naive wrapper crashes on
+ * precisely the accounts that most need auditing. Empty output is normalised to
+ * {} here and interpreted by each individual check.
+ */
+export declare function aws(args: string[], profile?: string): AwsResult;
+/**
+ * Resolve the caller's account id, or print guidance and return null.
+ *
+ * Not every failure is an AWS API error with a parseable code -- an unknown
+ * --profile fails in the CLI's own config layer and never reaches the service,
+ * so fall back to its stderr rather than reporting "unknown error".
+ */
+export declare function resolveAccount(profile?: string): string | null;
+export declare function daysSince(iso: string): number | null;
+export declare const PROFILE_OPTION: {
+    flags: string;
+    description: string;
+};
+//# sourceMappingURL=aws.d.ts.map

package/dist/src/utils/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAe/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS9D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,eAAO,MAAM,cAAc;;;CAG1B,CAAC"}

package/dist/src/utils/aws.js

@@ -0,0 +1,61 @@
+/**
+ * Thin JSON wrapper over the AWS CLI for the audit commands.
+ *
+ * Uses `run()` (execFileSync with an args array, no shell), so nothing here is
+ * exposed to shell interpretation even though callers pass a user-supplied
+ * --profile and --region.
+ */
+import { run } from './exec.js';
+/**
+ * Several AWS commands exit 0 with a COMPLETELY EMPTY body when the thing being
+ * described does not exist -- measured on `budgets describe-budgets` with no
+ * budgets, and on `bedrock get-model-invocation-logging-configuration` with
+ * logging disabled. `JSON.parse('')` throws, so a naive wrapper crashes on
+ * precisely the accounts that most need auditing. Empty output is normalised to
+ * {} here and interpreted by each individual check.
+ */
+export function aws(args, profile) {
+    const argv = profile ? [...args, '--profile', profile] : args;
+    const res = run('aws', [...argv, '--output', 'json']);
+    const body = (res.stdout || '').trim();
+    if (!res.ok) {
+        const m = /An error occurred \(([A-Za-z0-9.]+)\)/.exec(res.stderr || '');
+        return { ok: false, json: null, errorCode: m ? m[1] : '', raw: res.stderr || '' };
+    }
+    if (!body)
+        return { ok: true, json: {}, errorCode: '', raw: '' };
+    try {
+        return { ok: true, json: JSON.parse(body), errorCode: '', raw: body };
+    }
+    catch {
+        return { ok: false, json: null, errorCode: 'UnparseableResponse', raw: body };
+    }
+}
+/**
+ * Resolve the caller's account id, or print guidance and return null.
+ *
+ * Not every failure is an AWS API error with a parseable code -- an unknown
+ * --profile fails in the CLI's own config layer and never reaches the service,
+ * so fall back to its stderr rather than reporting "unknown error".
+ */
+export function resolveAccount(profile) {
+    const who = aws(['sts', 'get-caller-identity'], profile);
+    if (who.ok)
+        return who.json?.Account ?? null;
+    const reason = who.errorCode
+        || (who.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() ?? 'unknown error');
+    console.error(`\n❌ Cannot resolve AWS identity: ${reason}`);
+    console.error(`   Configure credentials, or pass --profile <name>.\n`);
+    return null;
+}
+export function daysSince(iso) {
+    const t = Date.parse(iso);
+    if (Number.isNaN(t))
+        return null;
+    return Math.floor((Date.now() - t) / 86_400_000);
+}
+export const PROFILE_OPTION = {
+    flags: '--profile <name>',
+    description: 'AWS CLI profile to audit (defaults to the ambient credentials)',
+};
+//# sourceMappingURL=aws.js.map

package/dist/src/utils/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/utils/aws.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAWhC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAE7C,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS;WACvB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,CAAC;IACzF,OAAO,CAAC,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,gEAAgE;CAC9E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.93",
+  "version": "1.0.95",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {