@prism-d1/cli 1.0.99 → 1.2.0

package/dist/src/dashboard/page.js

@@ -0,0 +1,315 @@
+/**
+ * The dashboard's single-page app: one self-contained HTML document with
+ * inline CSS and JS (nonce-gated by the CSP), no CDN and no network fetch
+ * other than its own GET /api/data, so it works offline.
+ *
+ * Every value from the payload is placed with textContent or a DOM attribute;
+ * innerHTML is never used for data.
+ */
+const STYLE = `
+:root { color-scheme: light dark; --bg:#f7f7f8; --card:#fff; --text:#1d1d1f; --muted:#6b6b73; --line:#e3e3e8;
+  --ok:#1a7f37; --warn:#9a6700; --bad:#cf222e; --high:#cf222e; --medium:#bf8700; --low:#57606a; --accent:#0969da; }
+@media (prefers-color-scheme: dark) { :root { --bg:#0d1117; --card:#161b22; --text:#e6edf3; --muted:#8b949e; --line:#30363d;
+  --ok:#3fb950; --warn:#d29922; --bad:#f85149; --high:#f85149; --medium:#d29922; --low:#8b949e; --accent:#58a6ff; } }
+* { box-sizing: border-box; }
+body { margin:0; font:14px/1.45 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:var(--bg); color:var(--text); }
+header { display:flex; align-items:center; gap:12px; padding:14px 20px; border-bottom:1px solid var(--line); background:var(--card); }
+header h1 { font-size:17px; margin:0; } header .meta { color:var(--muted); font-size:12px; margin-left:auto; }
+button { font:inherit; padding:4px 10px; border:1px solid var(--line); border-radius:6px; background:var(--bg); color:var(--text); cursor:pointer; }
+main { padding:16px 20px; display:grid; gap:16px; grid-template-columns: repeat(auto-fit, minmax(420px, 1fr)); }
+section.card { background:var(--card); border:1px solid var(--line); border-radius:10px; padding:14px 16px; min-width:0; }
+section.wide { grid-column: 1 / -1; }
+h2 { font-size:15px; margin:0 0 10px; } h3 { font-size:13px; margin:14px 0 6px; color:var(--muted); text-transform:uppercase; letter-spacing:.04em; }
+.empty { color:var(--muted); padding:8px 0; } code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size:12px; background:var(--bg); padding:1px 4px; border-radius:4px; }
+.tablewrap { overflow-x:auto; }
+table { width:100%; border-collapse:collapse; font-size:13px; } th, td { text-align:left; padding:5px 6px; border-bottom:1px solid var(--line); vertical-align:top; overflow-wrap:break-word; }
+th { white-space:nowrap; } td.msg { min-width:280px; } td.count { font-variant-numeric:tabular-nums; font-weight:600; } td code { white-space:normal; overflow-wrap:anywhere; }
+th { color:var(--muted); font-weight:600; } td.num { text-align:right; font-variant-numeric: tabular-nums; }
+.pill { white-space:nowrap; display:inline-block; padding:0 7px; border-radius:10px; font-size:12px; font-weight:600; border:1px solid currentColor; }
+.s-ok { color:var(--ok); } .s-warn, .s-findings, .s-skipped { color:var(--warn); } .s-missing, .s-error { color:var(--bad); }
+.sev-high { color:var(--high); } .sev-medium { color:var(--medium); } .sev-low { color:var(--low); }
+.stats { display:flex; gap:18px; flex-wrap:wrap; margin:6px 0; } .stat b { display:block; font-size:20px; } .stat span { color:var(--muted); font-size:12px; }
+.fix { color:var(--muted); font-size:12px; overflow-wrap:anywhere; }
+.tag { margin-left:6px; font-size:11px; padding:0 6px; border-radius:8px; background:var(--bg); border:1px solid var(--line); color:var(--muted); white-space:nowrap; }
+details.missing-group > summary { cursor:pointer; padding:8px 0; color:var(--muted); font-weight:600; }
+details.repo { border-top:1px solid var(--line); padding:8px 0; } details.repo > summary { cursor:pointer; padding:4px 0; } details.repo .detail { padding-left:14px; }
+.callout { border:1px solid var(--accent); border-left-width:4px; border-radius:6px; padding:10px 12px; margin:6px 0 10px; background:color-mix(in srgb, var(--accent) 8%, var(--card)); }
+.callout.warn { border-color:var(--warn); background:color-mix(in srgb, var(--warn) 10%, var(--card)); } .callout code { white-space:normal; overflow-wrap:anywhere; }
+.crow { display:grid; grid-template-columns: 6.5em minmax(10em,2.2fr) minmax(5em,0.8fr) 10.5em 7.5em minmax(11em,1.6fr); gap:8px; padding:6px 6px; border-bottom:1px solid var(--line); align-items:start; font-size:13px; overflow-wrap:anywhere; }
+.chead { color:var(--muted); font-weight:600; } summary.crow { cursor:pointer; list-style:none; } summary.crow::-webkit-details-marker { display:none; } details.cdetails[open] > summary.crow { background:var(--bg); } details.cdetails > .tablewrap { padding:4px 0 8px 18px; }
+@media (max-width: 760px) { .crow { grid-template-columns: 1fr 1fr; } .chead { display:none; } }
+a.rlink { color:var(--accent); } a.rlink:hover { text-decoration:underline; }
+.banner { border:1px solid var(--warn); border-left-width:4px; border-radius:6px; padding:10px 12px; margin:4px 0 12px; background:color-mix(in srgb, var(--warn) 10%, var(--card)); }
+.banner strong { color:var(--text); display:block; margin-bottom:4px; } .banner .fix code { white-space:normal; overflow-wrap:anywhere; } .note { color:var(--muted); font-size:12px; margin-top:10px; }
+svg.trend rect.high { fill:var(--high); } svg.trend rect.medium { fill:var(--medium); } svg.trend rect.low { fill:var(--low); } svg.trend rect.zero { fill:var(--ok); }
+svg.trend line { stroke:var(--line); }
+.repo-title { font-size:12px; color:var(--muted); margin-bottom:6px; word-break:break-all; }
+`;
+const SCRIPT = `
+'use strict';
+const SVG = 'http://www.w3.org/2000/svg';
+function el(tag, attrs, ...kids) {
+  const n = document.createElement(tag);
+  for (const [k, v] of Object.entries(attrs || {})) { if (v !== null && v !== undefined) n.setAttribute(k, String(v)); }
+  for (const c of kids.flat()) { if (c === null || c === undefined || c === false) continue; n.append(c instanceof Node ? c : document.createTextNode(String(c))); }
+  return n;
+}
+const txt = (v) => (v === null || v === undefined ? '' : String(v));
+const pill = (status, label) => el('span', { class: 'pill s-' + txt(status).replace(/[^a-z-]/g, '') }, label || status);
+const sev = (s) => el('span', { class: 'sev-' + txt(s).replace(/[^a-z]/g, '') }, s);
+const when = (iso) => { const d = new Date(iso); return isNaN(d) ? txt(iso) : d.toLocaleString(); };
+const short = (sha) => (sha ? txt(sha).slice(0, 8) : '');
+function money(n, cur) { try { return new Intl.NumberFormat(undefined, { style: 'currency', currency: cur || 'USD' }).format(n || 0); } catch { return '$' + (n || 0).toFixed(2); } }
+function table(head, rows) {
+  return el('div', { class: 'tablewrap' }, el('table', {}, el('thead', {}, el('tr', {}, head.map((h) => el('th', {}, h)))),
+    el('tbody', {}, rows.map((r) => el('tr', {}, r.map((c) => (c instanceof Node && c.nodeName === 'TD') ? c : el('td', {}, c)))))));
+}
+const num = (v) => el('td', { class: 'num' }, txt(v));
+
+function trendSvg(trend) {
+  const w = Math.max(trend.length * 14, 140), h = 48, svg = document.createElementNS(SVG, 'svg');
+  svg.setAttribute('class', 'trend'); svg.setAttribute('width', String(w)); svg.setAttribute('height', String(h + 2));
+  svg.setAttribute('role', 'img'); svg.setAttribute('aria-label', 'findings per run, oldest first');
+  const max = Math.max(1, ...trend.map((r) => r.high + r.medium + r.low));
+  const base = document.createElementNS(SVG, 'line');
+  base.setAttribute('x1', '0'); base.setAttribute('x2', String(w)); base.setAttribute('y1', String(h)); base.setAttribute('y2', String(h)); svg.append(base);
+  trend.forEach((r, i) => {
+    let y = h; const parts = [['high', r.high], ['medium', r.medium], ['low', r.low]];
+    const total = r.high + r.medium + r.low;
+    if (total === 0) parts.push(['zero', 0]);
+    for (const [cls, n] of parts) {
+      const bh = cls === 'zero' ? 3 : Math.round((n / max) * (h - 4)); if (!bh) continue;
+      y -= bh; const rect = document.createElementNS(SVG, 'rect');
+      rect.setAttribute('x', String(i * 14 + 2)); rect.setAttribute('y', String(y)); rect.setAttribute('width', '10'); rect.setAttribute('height', String(bh)); rect.setAttribute('class', cls);
+      const t = document.createElementNS(SVG, 'title'); t.textContent = when(r.started_at) + ' ' + r.kind + ' ' + r.status + ' (' + r.tool + '): ' + r.high + ' high, ' + r.medium + ' medium, ' + r.low + ' low';
+      rect.append(t); svg.append(rect);
+    }
+  });
+  return svg;
+}
+
+function scanBanner(ss) {
+  if (!ss || !ss.banner) return null;
+  return el('div', { class: 'banner', role: 'alert' },
+    el('strong', {}, ss.banner),
+    el('div', { class: 'fix' }, 'Install: ', el('code', {}, ss.installHint)));
+}
+
+function repoName(r) {
+  return el('span', { title: r.path }, r.name, r.current ? el('span', { class: 'tag' }, 'this repo') : null);
+}
+
+const SCAN_LABEL = { ok: ['ok', 'ok'], 'not-scanned': ['warn', 'not scanned'], 'no-verify': ['warn', 'no-verify'], flagged: ['missing', 'secrets found'], none: ['skipped', '-'] };
+
+/** Link to a scan report. Ids come from the server's own listing; encodeURIComponent keeps them literal. */
+const reportLink = (id, label) => el('a', { href: '/report/' + encodeURIComponent(id), class: 'rlink' }, label);
+
+function reviewCell(rv) {
+  if (rv.state === 'not-reviewed') return el('span', { class: 'fix' }, 'not reviewed');
+  const link = rv.reportId ? [' ', reportLink(rv.reportId, 'report')] : [];
+  if (rv.state === 'failed') return el('span', { title: txt(rv.reason) }, pill('error', 'review failed'), link);
+  const who = el('span', { class: 'fix' }, ' ' + txt(rv.tool || '') + (rv.model ? ' / ' + rv.model : '') + (rv.reviewCount > 1 ? ' · reviewed ' + rv.reviewCount + 'x' : ''));
+  if (rv.state === 'clean') return el('span', {}, pill('ok', 'reviewed, clean'), who, link);
+  const counts = el('span', {},
+    rv.high ? el('b', { class: 'sev-high' }, rv.high + ' high ') : null,
+    rv.medium ? el('b', { class: 'sev-medium' }, rv.medium + ' medium ') : null,
+    rv.low ? el('b', { class: 'sev-low' }, rv.low + ' low') : null);
+  return el('span', {}, counts, who, link);
+}
+
+/** The newest reviews, each linking to its report. */
+function scansList(scans) {
+  if (!scans || !scans.length) return el('p', { class: 'empty' }, 'No pre-push reviews yet.');
+  return table(['When', 'Branch', 'Reviewer', 'Result', 'Findings', ''], scans.map((s) => [
+    when(s.started_at), txt(s.branch || '-'), txt(s.tool) + (s.model ? ' / ' + s.model : ''),
+    pill(s.status === 'ok' ? 'ok' : s.status === 'findings' ? 'findings' : s.status === 'error' ? 'error' : 'skipped', s.status === 'ok' ? 'clean' : s.status),
+    el('span', {}, s.high ? el('b', { class: 'sev-high' }, s.high + ' high ') : null, s.medium ? el('b', { class: 'sev-medium' }, s.medium + ' medium ') : null, s.low ? el('b', { class: 'sev-low' }, s.low + ' low') : null, (s.high + s.medium + s.low) ? null : '-'),
+    reportLink(s.id, 'Report'),
+  ]));
+}
+
+/** Commits as rows; a row with findings expands to list them. */
+function commitsList(c) {
+  const wrap = el('div', { class: 'commits' });
+  if (!c || !c.rows.length) { wrap.append(el('p', { class: 'empty' }, 'No commits recorded yet.')); return wrap; }
+  wrap.append(el('div', { class: 'crow chead' }, el('span', {}, 'Commit'), el('span', {}, 'Subject'), el('span', {}, 'Branch'), el('span', {}, 'Date'), el('span', {}, 'Secret scan'), el('span', {}, 'Review')));
+  for (const r of c.rows) {
+    const scan = SCAN_LABEL[r.secretScan.state] || ['skipped', r.secretScan.state];
+    const cells = [
+      el('code', {}, r.short),
+      el('span', { class: r.inHistory ? '' : 'fix' }, r.inHistory ? txt(r.subject) : '(no longer in history)'),
+      el('span', {}, txt(r.branch || '-')),
+      el('span', {}, r.authorDate ? when(r.authorDate) : '-'),
+      r.secretScan.state === 'none' ? el('span', { class: 'fix' }, '-') : el('span', { title: txt(r.secretScan.reason) }, pill(scan[0], scan[1])),
+      reviewCell(r.review),
+    ];
+    if (!r.findings.length) { wrap.append(el('div', { class: 'crow' }, cells)); continue; }
+    const d = el('details', { class: 'cdetails' }, el('summary', { class: 'crow' }, cells));
+    d.append(table(['Severity', 'Category', 'Location', 'Rule', 'Message'], r.findings.map((f) => [
+      sev(f.severity), f.category, el('code', {}, f.file + (f.line ? ':' + f.line : '')), f.rule,
+      el('td', { class: 'msg' }, f.message, f.inPushOf ? el('div', { class: 'fix' }, 'in push of ' + txt(f.inPushOf).slice(0, 8) + ' (blame could not place this line)') : null)])));
+    wrap.append(d);
+  }
+  if (c.truncated) wrap.append(el('p', { class: 'note' }, 'showing ' + c.rows.length + ' of ' + c.total + ' commits'));
+  return wrap;
+}
+
+/** One repo's detail, shown inside its <details>. */
+function codewatchDetail(repo) {
+  const cw = repo.codewatch, s = el('div', { class: 'detail' });
+  if (!cw.hasResults) {
+    const fix = repo.setup && repo.setup.fix ? repo.setup.fix : 'prism-cli enable codewatch';
+    s.append(el('p', { class: 'empty' }, 'No codewatch results yet. Run ', el('code', {}, fix), ', then commit and push.'));
+    return s;
+  }
+  s.append(el('div', { class: 'stats' },
+    el('div', { class: 'stat' }, el('b', {}, cw.byCategory.security), el('span', {}, 'security')),
+    el('div', { class: 'stat' }, el('b', {}, cw.byCategory.quality), el('span', {}, 'quality')),
+    el('div', { class: 'stat' }, el('b', {}, cw.gitleaksBlocks.length), el('span', {}, 'gitleaks blocks')),
+    el('div', { class: 'stat' }, el('b', {}, cw.skipped.length), el('span', {}, 'pushed without a scan'))));
+
+  s.append(el('h3', {}, 'Commits'));
+  s.append(commitsList(cw.commits));
+
+  s.append(el('h3', {}, 'Scans (last ' + cw.scans.length + ')'));
+  s.append(scansList(cw.scans));
+
+  s.append(el('h3', {}, 'Trend (last ' + cw.trend.length + ' runs)'));
+  s.append(trendSvg(cw.trend));
+
+  s.append(el('h3', {}, 'Gitleaks blocks'));
+  if (!cw.gitleaksBlocks.length) s.append(el('p', { class: 'empty' }, 'No commits blocked.'));
+  else s.append(table(['When', 'Branch', 'Result', 'Secrets'], cw.gitleaksBlocks.slice(0, 20).map((r) => [when(r.started_at), txt(r.branch), pill(r.status), r.status === 'findings' ? r.high : txt(r.reason)])));
+
+  s.append(el('h3', {}, 'Commits pushed without a pre-commit scan'));
+  if (!cw.skipped.length) s.append(el('p', { class: 'empty' }, 'None.'));
+  else {
+    s.append(table(['Commit', 'Branch', 'Recorded'], cw.skipped.slice(0, 20).map((r) => [el('code', {}, short(r.commit)), txt(r.branch), when(r.started_at)])));
+    s.append(el('p', { class: 'note' }, 'Usually git commit --no-verify; rebases and cherry-picks also show up here.'));
+  }
+  return s;
+}
+
+function codewatchPanel(data) {
+  const s = el('section', { class: 'card wide' }, el('h2', {}, 'Codewatch'));
+  const banner = scanBanner(data.machine.secretScanning);
+  if (banner) s.append(banner);
+  const rows = data.overview.codewatch;
+  if (!rows.length) {
+    const sg = (data.suggestions || []).find((x) => x.id === 'codewatch-global');
+    if (sg) s.append(el('p', { class: 'empty' }, "Codewatch isn't enabled in any repo yet. Cover every repo at once: ", el('code', {}, sg.command), ', or run ', el('code', {}, 'prism-cli enable codewatch'), ' inside one repo.'));
+    else s.append(el('p', { class: 'empty' }, "Codewatch isn't enabled in any repo yet. Run ", el('code', {}, 'prism-cli enable codewatch'), ' inside a repo.'));
+    return s;
+  }
+  const count = (n, cls) => el('td', { class: 'count' + (n ? ' ' + cls : '') }, n);
+  s.append(table(['Repo', 'High', 'Medium', 'Low', 'Last run', 'Reviewer', 'Unscanned', 'Gitleaks'], rows.map((r) => [
+    repoName(r), count(r.high, 'sev-high'), count(r.medium, 'sev-medium'), count(r.low, 'sev-low'),
+    r.lastRunAt ? (r.lastReviewId ? reportLink(r.lastReviewId, when(r.lastRunAt)) : when(r.lastRunAt)) : 'never', txt(r.reviewer || '-'), count(r.unscannedCommits, 'sev-medium'),
+    r.gitleaksWarning ? pill('warn', 'not scanned') : '-',
+  ])));
+  const byPath = Object.fromEntries(data.repos.map((r) => [r.path, r]));
+  s.append(el('h3', {}, 'Per repo'));
+  for (const row of rows) {
+    const repo = byPath[row.path]; if (!repo) continue;
+    const total = row.high + row.medium + row.low;
+    const d = el('details', repo.current ? { class: 'repo', open: '' } : { class: 'repo' },
+      el('summary', {}, el('b', {}, repo.name), ' ', el('span', { class: 'fix' }, repo.codewatch.hasResults ? total + ' finding' + (total === 1 ? '' : 's') + ' in the latest reviews' : 'no results yet'),
+        repo.current ? el('span', { class: 'tag' }, 'this repo') : null),
+      el('div', { class: 'repo-title' }, repo.path));
+    d.append(codewatchDetail(repo));
+    s.append(d);
+  }
+  return s;
+}
+
+function usagePanel(u) {
+  const s = el('section', { class: 'card' }, el('h2', {}, 'Usage (codeburn)'));
+  if (u.status !== 'ok') {
+    s.append(el('p', { class: 'empty' }, pill(u.status === 'no-data' ? 'warn' : 'missing', u.status), ' ', txt(u.message)));
+  } else {
+    s.append(el('div', { class: 'stats' },
+      el('div', { class: 'stat' }, el('b', {}, money(u.today.cost, u.currency)), el('span', {}, 'today, ' + u.today.calls + ' calls')),
+      el('div', { class: 'stat' }, el('b', {}, money(u.month.cost, u.currency)), el('span', {}, 'this month, ' + u.month.calls + ' calls, ' + u.month.sessions + ' sessions'))));
+    s.append(el('h3', {}, 'Top models this month'));
+    s.append(table(['Model', 'Cost', 'Calls'], u.topModels.map((m) => [m.name, num(money(m.cost, u.currency)), num(m.calls)])));
+    s.append(el('h3', {}, 'Top projects this month'));
+    s.append(table(['Project', 'Cost', 'Sessions'], u.topProjects.map((p) => [el('span', { title: p.path }, p.name), num(money(p.cost, u.currency)), num(p.sessions)])));
+  }
+  s.append(el('p', { class: 'note' }, 'Full charts: run ', el('code', {}, txt(u.fullView)), ' in a terminal.'));
+  return s;
+}
+
+/** Info (or warn) callout for the global install. Text only: the page never runs anything. */
+function suggestionCallout(sg) {
+  if (sg.style === 'warn') {
+    return el('div', { class: 'callout warn', role: 'note' },
+      el('strong', {}, sg.missing + " repos don't have codewatch."),
+      el('div', {}, 'Your global core.hooksPath is set to ', el('code', {}, txt(sg.currentHooksPath)), ', so the plain global install would refuse. Use ',
+        el('code', {}, sg.command), ': it saves that value and still runs its hooks after codewatch.'));
+  }
+  return el('div', { class: 'callout info', role: 'note' },
+    el('strong', {}, sg.missing + " repos don't have codewatch. Cover all of them at once: "), el('code', {}, sg.command),
+    el('div', { class: 'fix' }, 'Applies to every repo on this machine, including new clones. Repos can opt out with ', el('code', {}, 'git config prism.codewatch false'), '.'));
+}
+
+function setupPanel(data) {
+  const s = el('section', { class: 'card' }, el('h2', {}, 'Setup checklist'));
+  const rows = (items) => items.map((i) => [pill(i.status), i.label, el('div', {}, i.detail, i.fix ? el('div', { class: 'fix' }, 'Fix: ' + i.fix) : null)]);
+  s.append(el('h3', {}, 'This machine'), table(['', 'Check', 'Detail'], rows(data.machine.setup)));
+  const repos = data.overview.setup, c = data.overview.counts;
+  s.append(el('h3', {}, 'Codewatch per repo (' + c.codewatch + ' of ' + c.repos + ' installed)'));
+  const label = { ok: 'ok', warn: 'warn', missing: 'missing', 'opted-out': 'opted out' };
+  const pillClass = { ok: 'ok', warn: 'warn', missing: 'missing', 'opted-out': 'skipped' };
+  const rowOf = (r) => [
+    repoName(r),
+    el('div', {}, pill(pillClass[r.status] || 'missing', (label[r.status] || r.status) + (r.status === 'ok' && r.global ? ' (global)' : '')), ' ',
+      r.status === 'ok' ? 'reviewer ' + txt(r.reviewer || 'none') : txt(r.detail),
+      r.fix ? el('div', { class: 'fix' }, 'Fix: ', el('code', {}, r.fix)) : null),
+  ];
+  const sg = (data.suggestions || []).find((x) => x.id === 'codewatch-global');
+  if (sg) s.append(suggestionCallout(sg));
+  // Always shown: the current repo (installed or not) and every installed repo.
+  const shown = repos.filter((r) => !r.collapsed);
+  const hidden = repos.filter((r) => r.collapsed);
+  if (shown.length) s.append(table(['Repo', 'Codewatch'], shown.map(rowOf)));
+  else if (!hidden.length) s.append(el('p', { class: 'empty' }, 'No git repositories found under ' + txt(data.scope.root_display) + '.'));
+  if (hidden.length) {
+    s.append(el('details', { class: 'missing-group' },
+      el('summary', {}, hidden.length + ' repo' + (hidden.length === 1 ? '' : 's') + ' without codewatch'),
+      table(['Repo', 'Codewatch'], hidden.map(rowOf))));
+  }
+  return s;
+}
+
+function securityPanel(sec) {
+  return el('section', { class: 'card' }, el('h2', {}, 'Security findings'), el('p', { class: 'empty' }, sec.status === 'coming-soon' ? ['Coming with ', el('code', {}, 'prism-cli security findings'), '.'] : txt(sec.message)));
+}
+
+async function load() {
+  const main = document.getElementById('main'), meta = document.getElementById('meta');
+  meta.textContent = 'loading...';
+  let data;
+  try {
+    const res = await fetch('/api/data', { credentials: 'same-origin', cache: 'no-store' });
+    if (!res.ok) throw new Error('HTTP ' + res.status);
+    data = await res.json();
+  } catch (e) { meta.textContent = 'failed to load: ' + e.message; return; }
+  main.replaceChildren();
+  if (data.scope.error) main.append(el('section', { class: 'card wide' }, pill('error'), ' ', data.scope.error));
+  main.append(codewatchPanel(data), usagePanel(data.usage), setupPanel(data), securityPanel(data.security));
+  const c = data.overview.counts;
+  meta.textContent = c.repos + ' repos under ' + txt(data.scope.root_display) + ' · ' + c.codewatch + ' with codewatch' + (data.scope.truncated ? ' (scan capped)' : '') + ' · updated ' + when(data.generated_at);
+}
+document.getElementById('refresh').addEventListener('click', load);
+load();
+`;
+export function renderPage(nonce) {
+    // The nonce is base64 generated server-side; nothing user-derived is interpolated here.
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>PRISM dashboard</title><style nonce="${nonce}">${STYLE}</style></head>
+<body><header><h1>PRISM dashboard</h1><button id="refresh" type="button">Refresh</button><span class="meta" id="meta"></span></header>
+<main id="main"></main>
+<script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+//# sourceMappingURL=page.js.map

package/dist/src/dashboard/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCb,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,wFAAwF;IACxF,OAAO;;8CAEqC,KAAK,KAAK,KAAK;;;iBAG5C,KAAK,KAAK,MAAM,yBAAyB,CAAC;AAC3D,CAAC"}

package/dist/src/dashboard/payload.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The one data document behind both `prism-cli dashboard --json` and the
+ * web UI's /api/data, so the two can never disagree. The overview rows are
+ * sorted here, not in the page, so `--json` carries the same order.
+ */
+import { type CodewatchPanel, type SecretScanning } from './codewatch.js';
+import { type DiscoverOptions } from './repos.js';
+import { type CheckItem, type CodewatchSetup, type MachineDeps } from './setup.js';
+import { type GlobalStatus } from '../codewatch/globalHooks.js';
+export declare function tildeHome(p: string, home: string): string;
+import { type CodeburnExport, type UsagePanel } from './usage.js';
+export declare const PAYLOAD_SCHEMA = "prism.dashboard.v2";
+export interface RepoPayload {
+    name: string;
+    path: string;
+    current: boolean;
+    hasPrism: boolean;
+    codewatch: CodewatchPanel;
+    setup: CodewatchSetup;
+}
+/** One row of the setup table. */
+export interface SetupRow {
+    name: string;
+    path: string;
+    current: boolean;
+    status: CodewatchSetup['status'];
+    reviewer: string | null;
+    detail: string;
+    fix: string;
+    /** Global hooks cover this repo. */
+    global: boolean;
+    /** Shown inside the collapsed "repos without codewatch" group: missing or opted out, and not the current repo. */
+    collapsed: boolean;
+}
+/** One row of the codewatch summary table. */
+export interface CodewatchRow {
+    name: string;
+    path: string;
+    current: boolean;
+    high: number;
+    medium: number;
+    low: number;
+    lastRunAt: string | null;
+    /** Report id of the newest review, linked from the Last run cell. */
+    lastReviewId: string | null;
+    /** Reviewer of the last review, else the one that would run now. */
+    reviewer: string | null;
+    unscannedCommits: number;
+    /** Commits here were made while gitleaks was missing. */
+    gitleaksWarning: boolean;
+}
+/** A next step the page suggests. Read-only: the page shows the command, it never runs it. */
+export interface Suggestion {
+    id: 'codewatch-global';
+    /** info: a suggestion. warn: a foreign global core.hooksPath is in the way. */
+    style: 'info' | 'warn';
+    command: string;
+    reason: string;
+    /** Repos without codewatch (status missing; opted-out repos are not counted). */
+    missing: number;
+    /** The foreign global core.hooksPath, for the warn variant. */
+    currentHooksPath: string | null;
+}
+/** Minimum missing repos before the global install is suggested; one repo is served by its own fix line. */
+export declare const SUGGEST_GLOBAL_MIN_MISSING = 2;
+export declare function globalSuggestion(g: GlobalStatus, missing: number): Suggestion | null;
+export interface DashboardPayload {
+    /** repos: every repo found. codewatch: repos with both codewatch hooks installed. */
+    schema: typeof PAYLOAD_SCHEMA;
+    generated_at: string;
+    scope: {
+        root: string; /** root with the home directory shown as ~ */
+        root_display: string;
+        current_repo: string | null;
+        scan_ms: number;
+        truncated: boolean;
+        error: string | null;
+    };
+    repos: RepoPayload[];
+    overview: {
+        counts: {
+            repos: number;
+            codewatch: number;
+        };
+        setup: SetupRow[];
+        codewatch: CodewatchRow[];
+    };
+    machine: {
+        setup: CheckItem[];
+        secretScanning: SecretScanning;
+        globalHooks: GlobalStatus;
+    };
+    suggestions: Suggestion[];
+    usage: UsagePanel;
+    security: {
+        status: 'coming-soon';
+        message: string;
+    };
+}
+export interface PayloadOptions extends DiscoverOptions {
+    trendRuns?: number;
+    exporter?: CodeburnExport;
+    machineDeps?: MachineDeps;
+    pathEnv?: string;
+}
+/** The current repo first, then installed, bypassed (warn), missing and opted-out repos, each by name. */
+export declare function sortSetupRows(rows: SetupRow[]): SetupRow[];
+/** Most high findings first, then medium, then low, then by name. */
+export declare function sortCodewatchRows(rows: CodewatchRow[]): CodewatchRow[];
+export declare function buildPayload(opts: PayloadOptions): Promise<DashboardPayload>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/src/dashboard/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/dashboard/payload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA2C,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAuE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACxJ,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAK9E,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzD;AACD,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,cAAc,CAAC;IAC1B,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,kHAAkH;IAClH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qEAAqE;IACrE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,4GAA4G;AAC5G,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAYpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,MAAM,EAAE,OAAO,cAAc,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,CAAC,8CAA8C;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrL,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE;QAAE,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QAAC,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IACzG,OAAO,EAAE;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,cAAc,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3F,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAG1D;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAEtE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8ClF"}

package/dist/src/dashboard/payload.js

@@ -0,0 +1,93 @@
+/**
+ * The one data document behind both `prism-cli dashboard --json` and the
+ * web UI's /api/data, so the two can never disagree. The overview rows are
+ * sorted here, not in the page, so `--json` carries the same order.
+ */
+import { collectCodewatch, combineSecretScanning } from './codewatch.js';
+import { discoverRepos } from './repos.js';
+import { codewatchSetup, GLOBAL_FORCE_CMD, GLOBAL_INSTALL_CMD, machineChecks } from './setup.js';
+import { globalStatus } from '../codewatch/globalHooks.js';
+import { findOnPath } from '../utils/tool-check.js';
+import { homedir } from 'node:os';
+import { sep } from 'node:path';
+export function tildeHome(p, home) {
+    if (p === home)
+        return '~';
+    return p.startsWith(home + sep) ? '~' + p.slice(home.length) : p;
+}
+import { collectUsage } from './usage.js';
+export const PAYLOAD_SCHEMA = 'prism.dashboard.v2';
+/** Minimum missing repos before the global install is suggested; one repo is served by its own fix line. */
+export const SUGGEST_GLOBAL_MIN_MISSING = 2;
+export function globalSuggestion(g, missing) {
+    if (g.state === 'installed' || missing < SUGGEST_GLOBAL_MIN_MISSING)
+        return null;
+    if (g.state === 'elsewhere') {
+        return {
+            id: 'codewatch-global', style: 'warn', command: GLOBAL_FORCE_CMD, missing, currentHooksPath: g.hooksPath,
+            reason: `${missing} repos don't have codewatch. Your global core.hooksPath is set to ${g.hooksPath}, so --global alone would refuse; --force saves that value and still runs its hooks after codewatch.`,
+        };
+    }
+    return {
+        id: 'codewatch-global', style: 'info', command: GLOBAL_INSTALL_CMD, missing, currentHooksPath: null,
+        reason: `${missing} repos don't have codewatch. Cover all of them at once.`,
+    };
+}
+const byName = (a, b) => a.name.localeCompare(b.name) || a.path.localeCompare(b.path);
+const STATUS_ORDER = { ok: 0, warn: 1, missing: 2, 'opted-out': 3 };
+/** The current repo first, then installed, bypassed (warn), missing and opted-out repos, each by name. */
+export function sortSetupRows(rows) {
+    return [...rows].sort((a, b) => Number(b.current) - Number(a.current) || STATUS_ORDER[a.status] - STATUS_ORDER[b.status] || byName(a, b));
+}
+/** Most high findings first, then medium, then low, then by name. */
+export function sortCodewatchRows(rows) {
+    return [...rows].sort((a, b) => b.high - a.high || b.medium - a.medium || b.low - a.low || byName(a, b));
+}
+export async function buildPayload(opts) {
+    const d = discoverRepos(opts);
+    const usage = await collectUsage({ exporter: opts.exporter, pathEnv: opts.pathEnv });
+    const gitleaksAvailable = findOnPath('gitleaks', opts.pathEnv) !== null;
+    const g = globalStatus(opts.home || homedir());
+    const repos = d.repos.map((r) => ({
+        name: r.name,
+        path: r.path,
+        current: r.current,
+        hasPrism: r.hasPrism,
+        codewatch: collectCodewatch(r.path, opts.trendRuns, gitleaksAvailable),
+        setup: codewatchSetup(r.path, { pathEnv: opts.pathEnv, global: g }),
+    }));
+    const setupRows = sortSetupRows(repos.map((r) => ({
+        name: r.name, path: r.path, current: r.current, status: r.setup.status, reviewer: r.setup.reviewer, detail: r.setup.detail, fix: r.setup.fix,
+        global: r.setup.global,
+        // Bypassed repos (warn) need attention, so they stay visible.
+        collapsed: !r.current && (r.setup.status === 'missing' || r.setup.status === 'opted-out'),
+    })));
+    // The summary lists only repos where codewatch is installed or has left
+    // results; the rest have nothing to summarize and appear in the setup list.
+    const active = repos.filter((r) => r.setup.status === 'ok' || r.codewatch.hasResults);
+    const cwRows = sortCodewatchRows(active.map((r) => ({
+        name: r.name, path: r.path, current: r.current,
+        high: r.codewatch.bySeverity.high, medium: r.codewatch.bySeverity.medium, low: r.codewatch.bySeverity.low,
+        lastRunAt: r.codewatch.lastRunAt,
+        lastReviewId: r.codewatch.lastReviewId,
+        reviewer: r.codewatch.lastReviewer ?? r.setup.reviewer,
+        unscannedCommits: r.codewatch.secretScanning.unscannedCommits,
+        gitleaksWarning: r.codewatch.secretScanning.unscannedCommits > 0,
+    })));
+    return {
+        schema: PAYLOAD_SCHEMA,
+        generated_at: new Date().toISOString(),
+        scope: { root: d.scannedRoot, root_display: tildeHome(d.scannedRoot, opts.home || homedir()), current_repo: d.currentRepo, scan_ms: d.scanMs, truncated: d.truncated, error: d.error },
+        repos,
+        overview: { counts: { repos: repos.length, codewatch: setupRows.filter((r) => r.status === 'ok').length }, setup: setupRows, codewatch: cwRows },
+        machine: {
+            setup: machineChecks({ pathEnv: opts.pathEnv, global: g, ...opts.machineDeps }),
+            globalHooks: g,
+            secretScanning: combineSecretScanning(repos.map((r) => r.codewatch.secretScanning), gitleaksAvailable),
+        },
+        suggestions: [globalSuggestion(g, setupRows.filter((r) => r.status === 'missing').length)].filter((x) => x !== null),
+        usage,
+        security: { status: 'coming-soon', message: 'Coming with prism-cli security findings.' },
+    };
+}
+//# sourceMappingURL=payload.js.map

package/dist/src/dashboard/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../src/dashboard/payload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAA4C,MAAM,gBAAgB,CAAC;AACnH,OAAO,EAAE,aAAa,EAAwB,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAyD,MAAM,YAAY,CAAC;AACxJ,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,IAAY;IAC/C,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AACD,OAAO,EAAE,YAAY,EAAwC,MAAM,YAAY,CAAC;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAyDnD,4GAA4G;AAC5G,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,UAAU,gBAAgB,CAAC,CAAe,EAAE,OAAe;IAC/D,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,GAAG,0BAA0B;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,SAAS;YACxG,MAAM,EAAE,GAAG,OAAO,qEAAqE,CAAC,CAAC,SAAS,sGAAsG;SACzM,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI;QACnG,MAAM,EAAE,GAAG,OAAO,yDAAyD;KAC5E,CAAC;AACJ,CAAC;AAsBD,MAAM,MAAM,GAAG,CAAC,CAAiC,EAAE,CAAiC,EAAE,EAAE,CACtF,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE/D,MAAM,YAAY,GAAuC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAExG,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAoB;IACrD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;QACtE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG;QAC5I,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;QACtB,8DAA8D;QAC9D,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;KAC1F,CAAC,CAAC,CAAC,CAAC;IACL,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;QAC9C,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG;QACzG,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;QAChC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY;QACtC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ;QACtD,gBAAgB,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,gBAAgB;QAC7D,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,gBAAgB,GAAG,CAAC;KACjE,CAAC,CAAC,CAAC,CAAC;IACL,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;QACtL,KAAK;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;QAChJ,OAAO,EAAE;YACP,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/E,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;SACvG;QACD,WAAW,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QACrI,KAAK;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE;KACzF,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/report.d.ts

@@ -0,0 +1,99 @@
+import { type PrismResult, type ResultEntry, type Severity } from '../codewatch/results.js';
+import { Blamer, type CommitFinding, type LogEntry, type SecretScanState } from './commits.js';
+/** The listing entry whose id equals `id`, or null. Unknown, malformed and traversal ids all return null. */
+export declare function findResultById(repoRoot: string, id: string, entries?: ResultEntry[]): ResultEntry | null;
+/** Newest review entries, newest first. */
+export declare function reviewEntries(entries: ResultEntry[]): ResultEntry[];
+export interface ReportCommit {
+    sha: string;
+    short: string;
+    subject: string | null;
+    authorDate: string | null;
+    secretScan: SecretScanState;
+    secretScanReason: string | null;
+    high: number;
+    medium: number;
+    low: number;
+}
+export interface ReportFinding extends CommitFinding {
+    commit: string | null;
+    commitSubject: string | null;
+}
+export interface ReportBlock {
+    at: string;
+    branch: string | null;
+    /** rule id and location only; never the secret. */
+    items: {
+        rule: string;
+        file: string;
+        line: number | null;
+    }[];
+}
+export interface ScanReport {
+    schema: 'prism.codewatch.report.v1';
+    id: string;
+    repo: {
+        name: string;
+        path: string;
+    };
+    branch: string | null;
+    upstream: string | null;
+    range: {
+        base: string | null;
+        tip: string;
+        commits: number;
+    };
+    reviewer: {
+        tool: string;
+        version: string | null;
+        model: string | null;
+    };
+    startedAt: string;
+    finishedAt: string;
+    durationSeconds: number | null;
+    status: PrismResult['status'];
+    /** Display state: findings, clean, error or skipped. */
+    state: 'findings' | 'clean' | 'error' | 'skipped';
+    reason: string | null;
+    score: number | null;
+    truncated: boolean;
+    summary: string | null;
+    totals: {
+        severity: Record<Severity, number>;
+        category: {
+            security: number;
+            quality: number;
+        };
+        findings: number;
+    };
+    files: {
+        file: string;
+        findings: ReportFinding[];
+    }[];
+    secretScans: ReportCommit[];
+    gitleaksBlocks: ReportBlock[];
+    commits: ReportCommit[];
+}
+/** Resolves `--commit <sha>`: the newest review whose range includes it (prefix match allowed). */
+export declare function reviewForCommit(entries: ResultEntry[], sha: string, log: Map<string, LogEntry>): ResultEntry | null;
+export declare function buildReport(repoRoot: string, entry: ResultEntry, all: ResultEntry[], deps?: {
+    log?: Map<string, LogEntry>;
+    blamer?: Blamer;
+}): ScanReport;
+export declare function renderReportJson(r: ScanReport): string;
+export declare function renderReportMarkdown(r: ScanReport): string;
+export declare function escapeHtml(s: unknown): string;
+export interface HtmlOptions {
+    /** CSP nonce for the inline style, when served by the dashboard. */
+    nonce?: string;
+    /** Show the back and Download Markdown links (served page only). */
+    links?: {
+        back: string;
+        markdown: string;
+    };
+}
+/** Self-contained HTML: inline CSS, no script, every value escaped. */
+export declare function renderReportHtml(r: ScanReport, opts?: HtmlOptions): string;
+/** Finds `id` in any of `repos` and builds its report; null when unknown or not a review. */
+export declare function reportFromRepos(repos: string[], id: string): ScanReport | null;
+//# sourceMappingURL=report.d.ts.map