@prism-d1/cli 1.0.99 → 1.2.0

package/dist/assets/infra/lib/lambda/velocity-widget.ts

@@ -27,6 +27,8 @@ const RECEIVER_FUNCTION = process.env.RECEIVER_FUNCTION || 'prism-d1-otel-receiv
 interface WidgetEvent {
   describe?: boolean;
   view?: string;
+  /** Developer filter for views that support it; 'all' or unset = organization. */
+  user?: string;
   widgetContext?: { timeRange?: { start: number; end: number }; theme?: string };
 }
 
@@ -37,7 +39,8 @@ the attribution store. Full history, real event timestamps.
 ### Parameters
 | Name | Type | Default | Description |
 |------|------|---------|-------------|
-| view | string | dora | dora, aidora, repos, eval, governance, agents, security, exec, exec-security, ciso-exposure, ciso-sla, ciso-risk, ciso-shiftleft, ciso-classes |
+| view | string | dora | dora, aidora, repos, eval, governance, agents, security, exec, exec-security, ciso-exposure, ciso-sla, ciso-risk, ciso-shiftleft, ciso-classes, tool-usage-top, tool-usage-trend |
+| user | string | all | Developer identity for tool-usage-* views |
 
 The \`exec\` view additionally computes an **observed** PRISM level from
 outcome metrics (capped at L4 — L5 requires an autonomy signal that no
@@ -1648,6 +1651,275 @@ async function renderMergeRateKpi(fromIso: string, toIso: string, p: Palette): P
   `;
 }
 
+// ---- View: cost-per-commit-kpi (single big-number KPI for $ / shipped commit) ----
+
+/**
+ * Replaces a CloudWatch `AICostUSD / MergedAICommits` ratio tile.
+ *
+ * Three things were wrong with the metric-math version, and all three are
+ * properties of CloudWatch rather than of the expression:
+ *
+ * 1. CloudWatch rejects datapoints older than two weeks, so a backfill lands
+ *    partially outside the ingestion window. Measured on a live 30-day range,
+ *    the metric path saw $1,387.61 / 141 commits where the store held
+ *    $1,496.24 / 164 — both terms short, in the same direction.
+ * 2. AICostUSD and MergedAICommits carry no user dimension, so the tile stayed
+ *    org-wide while the attribution-backed tile beside it scoped to the
+ *    dashboard's Developer variable. Same screen, near-identical labels, one
+ *    responding to the filter and one not.
+ * 3. The metrics are timestamped at ingest, not at commit time.
+ *
+ * Reading the store fixes all three, and makes this tile agree with the
+ * `$ / Shipped Commit` cells on Team Velocity and the Executive Readout, which
+ * already read the same field.
+ */
+async function renderCostPerCommitKpi(fromIso: string, toIso: string, p: Palette): Promise<string> {
+  let report: any;
+  try {
+    report = await fetchProductivity(fromIso, toIso);
+  } catch {
+    return emptyState('cost per shipped commit', 'Attribution store unreachable.', p);
+  }
+  const costPer = report?.totals?.ratios?.costPerShippedCommit ?? null;
+  const cost = report?.totals?.usage?.costUsd ?? null;
+  const mergedAi = report?.totals?.commits?.mergedAi ?? 0;
+  // Deliberately uncoloured: unit economics has no org-independent "good"
+  // threshold the way merge rate does, and a red/green here would invent one.
+  const sub = mergedAi > 0 && cost !== null
+    ? `$${num(Math.round(cost))} / ${num(mergedAi)} merged AI commits`
+    : cost !== null
+      ? `$${num(Math.round(cost))} spend · no merged AI commits attributed yet`
+      : 'no attribution data in range';
+  return `
+    <div style="text-align:center;padding:12px">
+      <div style="color:${p.mut};font-size:11px">$ / Shipped Commit</div>
+      <div style="color:${p.fg};font-size:36px;font-weight:700;margin:4px 0">${costPer !== null ? `$${costPer.toFixed(2)}` : '—'}</div>
+      <div style="color:${p.mut};font-size:10px">${sub}</div>
+    </div>
+  `;
+}
+
+// ---- View: ai-spend-kpi (single big-number KPI for total AI spend in range) ----
+
+/**
+ * Replaces a CloudWatch `Sum(AICostUSD)` tile, for the same ingestion-window
+ * reason as the ratio above: the metric sum is short by whatever part of the
+ * range predates CloudWatch's two-week cutoff, so a tile labelled "range"
+ * silently reports less than the range holds.
+ */
+async function renderAiSpendKpi(fromIso: string, toIso: string, p: Palette): Promise<string> {
+  let report: any;
+  try {
+    report = await fetchProductivity(fromIso, toIso);
+  } catch {
+    return emptyState('AI spend', 'Attribution store unreachable.', p);
+  }
+  const usage = report?.totals?.usage ?? null;
+  const cost = usage?.costUsd ?? null;
+  const calls = usage?.calls ?? 0;
+  const tokens = (usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0);
+  return `
+    <div style="text-align:center;padding:12px">
+      <div style="color:${p.mut};font-size:11px">AI Spend (range)</div>
+      <div style="color:${p.fg};font-size:36px;font-weight:700;margin:4px 0">${cost !== null ? `$${num(Math.round(cost))}` : '—'}</div>
+      <div style="color:${p.mut};font-size:10px">${cost !== null ? `${num(calls)} calls · ${num(Math.round(tokens / 1000))}k tokens` : 'no usage data in range'}</div>
+    </div>
+  `;
+}
+
+// ---- View: ai-spend-trend (AI spend over time) ----
+
+/**
+ * Replaces the CloudWatch `Sum(AICostUSD)` spend graphs.
+ *
+ * Same reason as the KPI tiles: CloudWatch drops datapoints older than two
+ * weeks, so a graph titled "spend trend" showed a flat or absent left-hand side
+ * for any range longer than that — not because spend was low then, but because
+ * the datapoints were refused at ingest. Reading OTEL_DAY rollups gives the real
+ * curve over full history, and puts this graph on the same source as the
+ * cost-per-commit trend beside it so the two can be read together.
+ */
+async function renderAiSpendTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
+  let data: any;
+  try {
+    data = await invokeReceiver('/v1/commits-daily', `from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+  } catch (err) {
+    return emptyState('AI spend trend', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+
+  const dayBuckets: Array<{ date: string; costUsd: number }> = data?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('AI spend trend', 'No usage data in range.', p);
+  }
+
+  const useWeekly = days > 21;
+  let buckets: Array<{ label: string; costUsd: number }>;
+  if (useWeekly) {
+    const weeks = new Map<string, { label: string; costUsd: number }>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      const weekStart = new Date(dt);
+      weekStart.setDate(dt.getDate() - dt.getDay());
+      const key = weekStart.toISOString().slice(0, 10);
+      let w = weeks.get(key);
+      if (!w) { w = { label: key, costUsd: 0 }; weeks.set(key, w); }
+      w.costUsd += d.costUsd ?? 0;
+    }
+    buckets = [...weeks.values()].sort((a, b) => a.label.localeCompare(b.label));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, costUsd: d.costUsd ?? 0 }));
+  }
+
+  const total = buckets.reduce((s, b) => s + b.costUsd, 0);
+  const maxC = Math.max(...buckets.map(b => b.costUsd), 0);
+  if (maxC === 0) {
+    return emptyState('AI spend trend', 'No AI spend recorded in range.', p);
+  }
+
+  // Bars rather than a line: spend is a per-bucket quantity, and a line implies
+  // interpolation between buckets that a sum does not have.
+  const chartW = 500;
+  const chartH = 100;
+  const slot = chartW / buckets.length;
+  const barW = Math.max(2, slot * 0.7);
+  const bars = buckets.map((b, i) => {
+    const h = (b.costUsd / maxC) * (chartH - 10);
+    return `<rect x="${i * slot + (slot - barW) / 2}" y="${chartH - h}" width="${barW}" height="${h}" fill="${p.accent}" opacity="0.85" />`;
+  }).join('');
+
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">AI Spend (${useWeekly ? 'weekly' : 'daily'})</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">$${num(Math.round(total))} total</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${bars}
+        <text x="2" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 2}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      <div style="color:${p.mut};font-size:10px;margin-top:2px">peak $${maxC.toFixed(2)} per ${useWeekly ? 'week' : 'day'} · attribution store, full history</div>
+    </div>
+  `;
+}
+
+// ---- View: cost-per-commit-trend (cost per shipped commit over time) ----
+
+/**
+ * Replaces the CloudWatch "Cost per Shipped Commit (Weekly)" graph.
+ *
+ * That graph divided two ingest-timestamped metrics, which made it report
+ * efficiency changes that never happened. Measured on a live 30-day range the
+ * day attribution was first backfilled: the two earlier weeks plotted as gaps
+ * (spend, zero commits) and the current week read $0.55, because 141 commits
+ * spanning months were all stamped with their ingest time and divided into that
+ * one week's $77.33 of spend. The graph's premise — "spend can rise while this
+ * falls, which means AI is getting more efficient" — inverts under that
+ * artifact, so a reader draws exactly the wrong conclusion.
+ *
+ * Bucketing both terms by when the work happened is what makes the trend mean
+ * what its title says. A bucket with spend but no merged commits renders as a
+ * gap rather than as zero: no commits shipped is not a cost of zero per commit,
+ * and FILL(..., 0) on the metric version drew it as a floor.
+ */
+async function renderCostPerCommitTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
+  let data: any;
+  try {
+    data = await invokeReceiver('/v1/commits-daily', `from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+  } catch (err) {
+    return emptyState('cost per commit trend', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+
+  const dayBuckets: Array<{ date: string; mergedAi: number; costUsd: number }> = data?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('cost per commit trend', 'No commit or usage data in range.', p);
+  }
+
+  // Same weekly/daily threshold as renderMergeRateTrend, so the two trends on a
+  // dashboard share an x-axis granularity.
+  const useWeekly = days > 21;
+  type Bucket = { label: string; mergedAi: number; costUsd: number };
+  let buckets: Bucket[];
+  if (useWeekly) {
+    const weeks = new Map<string, Bucket>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      const weekStart = new Date(dt);
+      weekStart.setDate(dt.getDate() - dt.getDay());
+      const key = weekStart.toISOString().slice(0, 10);
+      let w = weeks.get(key);
+      if (!w) { w = { label: key, mergedAi: 0, costUsd: 0 }; weeks.set(key, w); }
+      w.mergedAi += d.mergedAi ?? 0;
+      w.costUsd += d.costUsd ?? 0;
+    }
+    buckets = [...weeks.values()].sort((a, b) => a.label.localeCompare(b.label));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, mergedAi: d.mergedAi ?? 0, costUsd: d.costUsd ?? 0 }));
+  }
+
+  const ratios = buckets.map(b => (b.mergedAi > 0 ? b.costUsd / b.mergedAi : null));
+  const present = ratios.filter((r): r is number => r !== null);
+  if (present.length === 0) {
+    const spend = buckets.reduce((s, b) => s + b.costUsd, 0);
+    return emptyState(
+      'cost per commit trend',
+      spend > 0
+        ? `$${num(Math.round(spend))} of AI spend in range with no merged AI commits attributed — run \`codeburn sync push --attribution\`.`
+        : 'No AI spend or merged commits in range.',
+      p,
+    );
+  }
+
+  const chartW = 500;
+  const chartH = 100;
+  const step = buckets.length > 1 ? (chartW - 20) / (buckets.length - 1) : 0;
+  const maxR = Math.max(...present);
+  const yOf = (r: number): number => chartH - (maxR > 0 ? (r / maxR) * (chartH - 10) : 0);
+
+  // Gaps break the polyline into segments instead of interpolating across a
+  // bucket that shipped nothing, which would draw a slope the data does not have.
+  const segments: string[] = [];
+  let current: string[] = [];
+  ratios.forEach((r, i) => {
+    if (r === null) {
+      if (current.length > 1) segments.push(current.join(' '));
+      current = [];
+      return;
+    }
+    current.push(`${10 + i * step},${yOf(r)}`);
+  });
+  if (current.length > 1) segments.push(current.join(' '));
+
+  const dots = ratios.map((r, i) => r === null ? '' :
+    `<circle cx="${10 + i * step}" cy="${yOf(r)}" r="2.5" fill="${p.accent}" />`).join('');
+  const lines = segments.map(s =>
+    `<polyline points="${s}" fill="none" stroke="${p.accent}" stroke-width="2" />`).join('');
+
+  const first = present[0];
+  const last = present[present.length - 1];
+  const delta = first > 0 ? ((last - first) / first) * 100 : null;
+  const gaps = ratios.filter(r => r === null).length;
+
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">Cost per Shipped Commit (${useWeekly ? 'weekly' : 'daily'})</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">$${last.toFixed(2)}${
+          delta !== null ? ` <span style="color:${delta <= 0 ? p.ok : p.warn};font-size:11px">${delta <= 0 ? '▼' : '▲'} ${Math.abs(delta).toFixed(0)}%</span>` : ''
+        }</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${lines}${dots}
+        <text x="10" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 10}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      <div style="color:${p.mut};font-size:10px;margin-top:2px">
+        peak $${maxR.toFixed(2)} · attribution store, bucketed by commit date${gaps > 0 ? ` · ${gaps} ${useWeekly ? 'week' : 'day'}(s) with spend but no merged AI commits shown as gaps` : ''}
+      </div>
+    </div>
+  `;
+}
+
 // ---- View: merge-rate-trend (line chart of merge rate over time) ----
 
 async function renderMergeRateTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
@@ -1721,6 +1993,124 @@ async function renderMergeRateTrend(fromIso: string, toIso: string, days: number
 
 // ---- Handler ----
 
+// ---- Views: tool-usage-top / tool-usage-trend (tools the model invoked) ----
+
+/** Dashboard PATTERN token left unreplaced, or blank, means org scope. */
+function widgetUser(user: string | undefined): string {
+  const u = (user ?? '').trim();
+  return !u || u === 'PRISM_USER_FILTER_TOKEN' ? 'all' : u;
+}
+
+async function fetchToolUsage(fromIso: string, toIso: string, user: string): Promise<any> {
+  return invokeReceiver('/v1/tool-usage',
+    `user=${encodeURIComponent(user)}&from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+}
+
+const TOOL_USAGE_NOTE =
+  'Counts model calls that invoked each tool (codeburn ai.tools), by the day of the call. ' +
+  'Providers that do not report tool calls contribute nothing here.';
+
+/**
+ * Top tools and MCP servers. Reads the receiver's OTEL#TOOLDAY rollups rather
+ * than a CloudWatch metric for the same reasons as the spend tiles: full
+ * history, bucketed by call date, and scoped by the Developer variable.
+ */
+async function renderToolUsageTop(fromIso: string, toIso: string, user: string, p: Palette): Promise<string> {
+  let r: any;
+  try {
+    r = await fetchToolUsage(fromIso, toIso, user);
+  } catch (err) {
+    return emptyState('tool usage', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+  const tools: Array<{ name: string; mcpServer: string; calls: number; byAiTool: Record<string, number> }> = r?.tools ?? [];
+  if (tools.length === 0) {
+    return emptyState('tool usage', 'Run `codeburn sync push` with a codeburn version that sends ai.tools.', p);
+  }
+  const servers: Array<{ server: string; calls: number; tools: number }> = r?.mcpServers ?? [];
+  const mcpCalls = servers.reduce((s, x) => s + x.calls, 0);
+  const total = r?.totalToolCalls ?? 0;
+
+  const top = tools.slice(0, 12);
+  const maxT = top[0]?.calls ?? 0;
+  const toolRows = top.map(t => [
+    `${esc(t.name)}${bar(t.calls, maxT, p.accent)}`,
+    esc(Object.entries(t.byAiTool).sort((a, b) => b[1] - a[1]).map(([k]) => k).join(', ')),
+    num(t.calls),
+  ]);
+  const topS = servers.slice(0, 8);
+  const maxS = topS[0]?.calls ?? 0;
+  const serverRows = topS.map(s => [`${esc(s.server)}${bar(s.calls, maxS, p.ok)}`, num(s.tools), num(s.calls)]);
+
+  return `
+    ${kpiRow([
+      { label: 'Tool calls', value: num(total), note: user === 'all' ? 'organization' : user },
+      { label: 'Distinct tools', value: num(tools.length) },
+      { label: 'MCP share', value: pct(total > 0 ? (mcpCalls / total) * 100 : null), note: `${num(servers.length)} MCP servers` },
+    ], p)}
+    <div style="display:flex;gap:16px;flex-wrap:wrap">
+      <div style="flex:3;min-width:280px">${table(['Tool', 'AI tools', 'Calls'], toolRows, p, 2)}</div>
+      <div style="flex:2;min-width:220px">${serverRows.length > 0
+        ? table(['MCP server', 'Tools', 'Calls'], serverRows, p, 1)
+        : `<div style="color:${p.mut};font-size:11px;margin-top:14px">No MCP tool calls in range.</div>`}</div>
+    </div>
+    ${footnote(TOOL_USAGE_NOTE, p)}
+  `;
+}
+
+/** Daily (or weekly, past 21 days) tool calls, same bucketing as ai-spend-trend. */
+async function renderToolUsageTrend(fromIso: string, toIso: string, days: number, user: string, p: Palette): Promise<string> {
+  let r: any;
+  try {
+    r = await fetchToolUsage(fromIso, toIso, user);
+  } catch (err) {
+    return emptyState('tool usage', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+  const dayBuckets: Array<{ date: string; calls: number }> = r?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('tool usage', 'Run `codeburn sync push` with a codeburn version that sends ai.tools.', p);
+  }
+  const useWeekly = days > 21;
+  let buckets: Array<{ label: string; calls: number }>;
+  if (useWeekly) {
+    const weeks = new Map<string, number>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      dt.setDate(dt.getDate() - dt.getDay());
+      const key = dt.toISOString().slice(0, 10);
+      weeks.set(key, (weeks.get(key) ?? 0) + d.calls);
+    }
+    buckets = [...weeks.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([label, calls]) => ({ label, calls }));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, calls: d.calls }));
+  }
+  const total = buckets.reduce((s, b) => s + b.calls, 0);
+  const maxC = Math.max(...buckets.map(b => b.calls), 0);
+  const chartW = 500;
+  const chartH = 100;
+  const slot = chartW / buckets.length;
+  const barW = Math.max(2, slot * 0.7);
+  const bars = buckets.map((b, i) => {
+    const h = maxC > 0 ? (b.calls / maxC) * (chartH - 10) : 0;
+    return `<rect x="${i * slot + (slot - barW) / 2}" y="${chartH - h}" width="${barW}" height="${h}" fill="${p.accent}" opacity="0.85" />`;
+  }).join('');
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">Tool calls (${useWeekly ? 'weekly' : 'daily'})${user === 'all' ? '' : ` · ${esc(user)}`}</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">${num(total)} total</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${bars}
+        <text x="2" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 2}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      ${footnote(TOOL_USAGE_NOTE, p)}
+    </div>
+  `;
+}
+
+// ---- Handler ----
+
 export async function handler(event: WidgetEvent): Promise<string> {
   if (event.describe) return DOCS;
 
@@ -1754,7 +2144,13 @@ export async function handler(event: WidgetEvent): Promise<string> {
       case 'commits-bar': body = await renderCommitsBar(fromIso, toIso, days, p); break;
       case 'ai-share-kpi': body = await renderAiShareKpi(fromIso, toIso, p); break;
       case 'merge-rate-kpi': body = await renderMergeRateKpi(fromIso, toIso, p); break;
+      case 'cost-per-commit-kpi': body = await renderCostPerCommitKpi(fromIso, toIso, p); break;
+      case 'ai-spend-kpi': body = await renderAiSpendKpi(fromIso, toIso, p); break;
+      case 'cost-per-commit-trend': body = await renderCostPerCommitTrend(fromIso, toIso, days, p); break;
+      case 'ai-spend-trend': body = await renderAiSpendTrend(fromIso, toIso, days, p); break;
       case 'merge-rate-trend': body = await renderMergeRateTrend(fromIso, toIso, days, p); break;
+      case 'tool-usage-top': body = await renderToolUsageTop(fromIso, toIso, widgetUser(event.user), p); break;
+      case 'tool-usage-trend': body = await renderToolUsageTrend(fromIso, toIso, days, widgetUser(event.user), p); break;
       default: body = `<div style="color:${p.danger}">Unknown view: ${esc(view)}</div>`;
     }
     return `<div style="font-family:'Amazon Ember',Helvetica,Arial,sans-serif;color:${p.fg};font-size:13px">${body}</div>`;

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -355,6 +355,13 @@ export class MetricsPipelineStack extends cdk.Stack {
     // OTEL Collector (on by default — server side of `codeburn sync`)
     // Skip with:   npx cdk deploy --context skipOtelCollector=true
     // BYO IdP:     -c otelIssuer=... -c otelClientId=... [-c otelIdentityClaim=email]
+    // Federated IdP behind Cognito (keeps the M2M agent client):
+    //              -c otelIdpName=CorpIdP
+    //              -c otelIdpIssuer=https://idp.example.com
+    //              -c otelIdpClientId=...
+    //              -c otelIdpClientSecretArn=<secretsmanager name or arn>
+    //              [-c otelIdpClientSecretJsonKey=clientSecret]
+    //              [-c otelIdpScopes='openid email']  (default: openid email)
     // Per-user AI usage flows directly from codeburn sync to the
     // ai-usage table (spans + daily aggregates).
     // -------------------------------------------------------
@@ -366,6 +373,12 @@ export class MetricsPipelineStack extends cdk.Stack {
         externalIssuer: this.node.tryGetContext('otelIssuer') as string | undefined,
         externalClientId: this.node.tryGetContext('otelClientId') as string | undefined,
         identityClaim: this.node.tryGetContext('otelIdentityClaim') as string | undefined,
+        idpName: this.node.tryGetContext('otelIdpName') as string | undefined,
+        idpIssuer: this.node.tryGetContext('otelIdpIssuer') as string | undefined,
+        idpClientId: this.node.tryGetContext('otelIdpClientId') as string | undefined,
+        idpClientSecretArn: this.node.tryGetContext('otelIdpClientSecretArn') as string | undefined,
+        idpClientSecretJsonKey: this.node.tryGetContext('otelIdpClientSecretJsonKey') as string | undefined,
+        idpScopes: this.node.tryGetContext('otelIdpScopes') as string | undefined,
       });
 
       // ---------------------------------------------------

package/dist/assets/infra/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-d1-velocity-infra",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "PRISM D1 Velocity - AWS CDK Infrastructure for AI-DORA Metrics Platform",
   "scripts": {
     "build": "tsc",
@@ -11,7 +11,10 @@
     "diff": "cdk diff",
     "check:metrics": "tsx scripts/check-metric-coverage.ts",
     "check:attribution": "tsx scripts/check-attribution-contract.ts",
-    "check:transitions": "tsx scripts/check-commit-transitions.ts"
+    "check:transitions": "tsx scripts/check-commit-transitions.ts",
+    "check:pricing": "tsx scripts/check-pricing.ts",
+    "check:tools": "tsx scripts/check-tool-usage.ts",
+    "pricing:snapshot": "tsx scripts/refresh-pricing-snapshot.ts"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.170.0",

package/dist/assets/metric-hooks/prepare-commit-msg

@@ -6,7 +6,9 @@
 # (Linux/macOS/Windows Git Bash) with NO dependency on jq, bc, sed, or grep -P.
 # Token tracking powered by codeburn / prism-cli.
 #
-# Installation: prism-cli bootstrapper install-git-hooks
+# RETIRED: no command installs this hook any more. `prism-cli enable codewatch`
+# (and its deprecated alias `bootstrapper install-git-hooks`) removes it when found.
+# Kept for reference only.
 
 set -uo pipefail
 

package/dist/src/codewatch/config.d.ts

@@ -0,0 +1,17 @@
+export declare const CONFIG_PATH = ".prism/config.json";
+export declare const RULES_PATH = ".prism/review/rules.md";
+export declare const GITLEAKS_BASELINE_PATH = ".prism/gitleaks-baseline.json";
+export declare const GITLEAKS_CONFIG_PATH = ".gitleaks.toml";
+/** Per-clone override of the team's reviewer choice: `git config prism.reviewer claude`. */
+export declare const REVIEWER_GIT_CONFIG_KEY = "prism.reviewer";
+export declare const DEFAULT_REVIEW_TIMEOUT_SECONDS = 300;
+export interface EvalConfig {
+    reviewer?: string;
+    model?: string;
+    timeout_seconds?: number;
+}
+export declare function readPrismConfig(repoRoot: string): Record<string, any>;
+export declare function readEvalConfig(repoRoot: string): EvalConfig;
+/** Merges `patch` into the `eval` block, keeping every other key in the file. */
+export declare function writeEvalConfig(repoRoot: string, patch: EvalConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/codewatch/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/codewatch/config.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,UAAU,2BAA2B,CAAC;AACnD,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AACtE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AACxD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAG3D;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAMzE"}

package/dist/src/codewatch/config.js

@@ -0,0 +1,40 @@
+/**
+ * `.prism/config.json` access for codewatch (the local git-hook gate).
+ *
+ * The file is shared with other PRISM installers (team_id etc.) and is usually
+ * committed, so reads tolerate any shape and writes merge rather than replace.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+export const CONFIG_PATH = '.prism/config.json';
+export const RULES_PATH = '.prism/review/rules.md';
+export const GITLEAKS_BASELINE_PATH = '.prism/gitleaks-baseline.json';
+export const GITLEAKS_CONFIG_PATH = '.gitleaks.toml';
+/** Per-clone override of the team's reviewer choice: `git config prism.reviewer claude`. */
+export const REVIEWER_GIT_CONFIG_KEY = 'prism.reviewer';
+export const DEFAULT_REVIEW_TIMEOUT_SECONDS = 300;
+export function readPrismConfig(repoRoot) {
+    const p = resolve(repoRoot, CONFIG_PATH);
+    if (!existsSync(p))
+        return {};
+    try {
+        const v = JSON.parse(readFileSync(p, 'utf8'));
+        return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function readEvalConfig(repoRoot) {
+    const e = readPrismConfig(repoRoot).eval;
+    return e && typeof e === 'object' ? e : {};
+}
+/** Merges `patch` into the `eval` block, keeping every other key in the file. */
+export function writeEvalConfig(repoRoot, patch) {
+    const p = resolve(repoRoot, CONFIG_PATH);
+    const cfg = readPrismConfig(repoRoot);
+    cfg.eval = { ...(cfg.eval && typeof cfg.eval === 'object' ? cfg.eval : {}), ...patch };
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(cfg, null, 2) + '\n');
+}
+//# sourceMappingURL=config.js.map

package/dist/src/codewatch/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/codewatch/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAQlD,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACzC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAiB;IACjE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IACvF,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/codewatch/gitleaks.d.ts

@@ -0,0 +1,49 @@
+import { type Finding, type PrismResult } from './results.js';
+/**
+ * Starter gitleaks config, written only when the repo has none.
+ *
+ * The secret-scan step in the workflow runs with or without this file --
+ * gitleaks ships usable defaults. What the defaults do not know is which
+ * credential-shaped strings in THIS repo are deliberate, so the first PR that
+ * touches a test fixture fails the gate on a fake key. A team that hits that
+ * with no obvious place to record the exception tends to delete the gate rather
+ * than tune it, so the tuning surface ships up front and is documented inline.
+ *
+ * `useDefault = true` is what keeps this additive: without it, declaring a
+ * config REPLACES the entire default ruleset and the gate silently stops
+ * detecting anything it does not name explicitly.
+ */
+export declare const GITLEAKS_STARTER_CONFIG = "# gitleaks configuration for the PRISM eval gate.\n#\n# The gate scans only the commits a PR introduces, so anything flagged here is\n# something this PR added. Two ways to handle a false positive:\n#\n#   1. Allowlist the path or pattern below (preferred -- reviewable, and it\n#      keeps working as the file changes).\n#   2. Add an inline \"gitleaks:allow\" comment on the offending line.\n#\n# A real exposure is NOT a false positive: rotate the credential first, because\n# deleting it from the branch does not un-expose what was already pushed.\n\n[extend]\n# Keep gitleaks' built-in ruleset. Removing this line replaces the defaults\n# entirely rather than adding to them, which turns the gate into a no-op for\n# every credential type not restated in this file.\nuseDefault = true\n\n[[allowlists]]\ndescription = \"Test fixtures and documented examples\"\npaths = [\n  '''(^|/)tests?/''',\n  '''(^|/)__fixtures__/''',\n  '''(^|/)__tests__/''',\n  '''\\.example($|\\.)''',\n]\n";
+/**
+ * One-line, platform-specific gitleaks install hint. Never a curl-piped-to-shell.
+ * Single source for the installer, the pre-commit warning and the dashboard.
+ */
+export declare function gitleaksInstallHint(platform?: NodeJS.Platform): string;
+/** Writes the starter config unless the repo already has one. Returns true when written. */
+export declare function installGitleaksConfig(gitRoot: string): boolean;
+/**
+ * Converts a gitleaks JSON report to schema findings.
+ *
+ * Only location and rule fields are projected. `Secret` and `Match` are never
+ * read, so a result file cannot carry the credential even if --redact was lost.
+ */
+export declare function parseGitleaksReport(json: string): Finding[];
+export interface PreCommitOutcome {
+    /** Process exit code for the hook: 1 blocks the commit. */
+    exitCode: number;
+    result: PrismResult;
+    resultPath: string | null;
+}
+/**
+ * `gitleaks protect --staged` against the repo config and baseline.
+ *
+ * Blocks (exit 1) on a finding and when gitleaks runs but cannot produce a
+ * verdict (bad config, unreadable report): a broken secret scan should be
+ * fixed, not silently passed. A MISSING gitleaks does not block -- it warns and
+ * records a `skipped` result with reason `gitleaks-missing`; CI's gitleaks
+ * step remains the backstop.
+ */
+export declare function runPreCommit(repoRoot: string, gitleaksBin?: string): PreCommitOutcome;
+/** A result that cannot be written must never change the hook's verdict. */
+export declare function safeWrite(repoRoot: string, r: PrismResult): string | null;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/src/codewatch/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/gitleaks.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoD,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,g+BA0BnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAKxF;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAW3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAOD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAa,GAAG,gBAAgB,CAyCzF;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAEzE"}