@prism-d1/cli 1.1.2 → 1.2.0

package/dist/src/dashboard/codewatch.js

@@ -0,0 +1,119 @@
+/**
+ * Codewatch panel data, from `.prism/results/` (see codewatch/results.ts).
+ */
+import { readResultEntries, REASON_GITLEAKS_MISSING, countBySeverity } from '../codewatch/results.js';
+import { gitleaksInstallHint } from './setup.js';
+import { localDate } from './usage.js';
+import { collectCommits } from './commits.js';
+export const DEFAULT_TREND_RUNS = 20;
+/** Cap on findings listed per repo, so one noisy branch cannot flood the page. */
+export const MAX_FINDINGS = 200;
+export const MAX_SCANS = 20;
+const isMissingSkip = (r) => r.kind === 'secrets' && r.hook === 'pre-commit' && r.status === 'skipped' && r.reason === REASON_GITLEAKS_MISSING;
+/** A pre-commit that actually ran gitleaks (any verdict). */
+const ranGitleaks = (r) => r.kind === 'secrets' && r.hook === 'pre-commit' && (r.status === 'ok' || r.status === 'findings' || (r.status === 'error' && !/not on PATH/.test(r.reason || '')));
+/** Local calendar day, so the banner reads "since 2026-11-03". */
+function day(iso) {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? iso.slice(0, 10) : localDate(d);
+}
+function bannerText(gitleaksAvailable, count, since) {
+    if (gitleaksAvailable)
+        return null;
+    return count
+        ? `Secret scanning is off: gitleaks is not installed. ${count} commit${count === 1 ? '' : 's'} since ${day(since)} ${count === 1 ? 'was' : 'were'} not scanned.`
+        : 'Secret scanning is off: gitleaks is not installed. No unscanned commits recorded yet.';
+}
+export function secretScanning(sorted, gitleaksAvailable, hint = gitleaksInstallHint()) {
+    let lastRan = -1;
+    sorted.forEach((r, i) => { if (ranGitleaks(r))
+        lastRan = i; });
+    const streak = sorted.slice(lastRan + 1).filter(isMissingSkip);
+    const since = streak.length ? streak[0].started_at : null;
+    return { gitleaksAvailable, unscannedCommits: streak.length, unscannedSince: since, installHint: hint, banner: bannerText(gitleaksAvailable, streak.length, since) };
+}
+/**
+ * gitleaks is a machine tool, so the banner is machine-level: it sums each
+ * repo's unscanned commits and dates them from the earliest.
+ */
+export function combineSecretScanning(perRepo, gitleaksAvailable, hint = gitleaksInstallHint()) {
+    const count = perRepo.reduce((n, s) => n + s.unscannedCommits, 0);
+    const since = perRepo.map((s) => s.unscannedSince).filter((x) => !!x).sort()[0] ?? null;
+    return { gitleaksAvailable, unscannedCommits: count, unscannedSince: since, installHint: hint, banner: bannerText(gitleaksAvailable, count, since) };
+}
+function summarize(r) {
+    const c = countBySeverity(r.findings || []);
+    return {
+        started_at: r.started_at, kind: r.kind, hook: r.hook, status: r.status, tool: r.tool, model: r.model ?? null,
+        commit: r.commit ?? null, branch: r.branch ?? null, high: c.high, medium: c.medium, low: c.low, reason: r.reason ?? null,
+    };
+}
+/**
+ * A pre-commit run that stopped a commit: a finding, or a scan that ran but
+ * gave no verdict. A missing gitleaks is an error that did NOT block.
+ */
+function isBlock(r) {
+    if (r.kind !== 'secrets' || r.hook !== 'pre-commit')
+        return false;
+    if (r.status === 'findings')
+        return true;
+    return r.status === 'error' && !/not on PATH/.test(r.reason || '');
+}
+const byTime = (a, b) => String(a.started_at).localeCompare(String(b.started_at));
+export function collectCodewatch(repoRoot, trendRuns = DEFAULT_TREND_RUNS, gitleaksAvailable = true) {
+    const entries = readResultEntries(repoRoot).filter((e) => e.result && typeof e.result.started_at === 'string');
+    const idOf = new Map(entries.map((e) => [e.result, e.id]));
+    const all = entries.map((e) => e.result).sort(byTime);
+    const latest = new Map();
+    const latestReview = new Map();
+    for (const r of all) {
+        const branch = r.branch || '(detached)';
+        const entry = latest.get(branch) || { branch, review: null, secrets: null };
+        if (r.kind === 'review' && r.hook === 'pre-push') {
+            entry.review = summarize(r);
+            latestReview.set(branch, r);
+        }
+        if (r.kind === 'secrets' && r.hook === 'pre-commit')
+            entry.secrets = summarize(r);
+        latest.set(branch, entry);
+    }
+    const findings = [];
+    for (const r of latestReview.values()) {
+        for (const f of r.findings || [])
+            findings.push({ ...f, branch: r.branch, commit: r.commit, tool: r.tool, started_at: r.started_at });
+    }
+    const order = { high: 0, medium: 1, low: 2 };
+    findings.sort((a, b) => order[a.severity] - order[b.severity] || a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0));
+    const bySeverity = { high: 0, medium: 0, low: 0 };
+    const byCategory = { quality: 0, security: 0 };
+    for (const f of findings) {
+        bySeverity[f.severity]++;
+        byCategory[f.category]++;
+    }
+    const reviews = all.filter((r) => r.kind === 'review' && r.tool && r.tool !== 'none');
+    const allReviews = all.filter((r) => r.kind === 'review' && r.hook === 'pre-push');
+    const lastReview = allReviews.length ? allReviews[allReviews.length - 1] : null;
+    return {
+        hasResults: all.length > 0,
+        lastRunAt: all.length ? all[all.length - 1].started_at : null,
+        lastReviewer: reviews.length ? reviews[reviews.length - 1].tool : null,
+        lastReviewId: lastReview ? idOf.get(lastReview) ?? null : null,
+        scans: allReviews.slice(-MAX_SCANS).reverse().map((r) => {
+            const c = countBySeverity(r.findings || []);
+            return { id: idOf.get(r), started_at: r.started_at, branch: r.branch ?? null, tool: r.tool, model: r.model ?? null, status: r.status, high: c.high, medium: c.medium, low: c.low, reason: r.reason ?? null };
+        }),
+        totalRuns: all.length,
+        latestByBranch: [...latest.values()].sort((a, b) => a.branch.localeCompare(b.branch)),
+        findings: findings.slice(0, MAX_FINDINGS),
+        findingsTruncated: findings.length > MAX_FINDINGS,
+        bySeverity,
+        byCategory,
+        gitleaksBlocks: all.filter(isBlock).map(summarize).reverse(),
+        // --no-verify and other unhooked commits; gitleaks-missing ones are counted in secretScanning.
+        skipped: all.filter((r) => r.kind === 'secrets' && r.status === 'skipped' && !isMissingSkip(r)).map(summarize).reverse(),
+        trend: all.filter((r) => r.status !== 'skipped').slice(-trendRuns).map(summarize),
+        secretScanning: secretScanning(all, gitleaksAvailable),
+        commits: all.length ? collectCommits(repoRoot, all, { idOf: (r) => idOf.get(r) ?? null }) : { rows: [], total: 0, truncated: false, timing: { logMs: 0, blameMs: 0, blameCalls: 0 } },
+    };
+}
+//# sourceMappingURL=codewatch.js.map

package/dist/src/dashboard/codewatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codewatch.js","sourceRoot":"","sources":["../../../src/dashboard/codewatch.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAqD,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,cAAc,EAAqB,MAAM,cAAc,CAAC;AAEjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AA6EhC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAe5B,MAAM,aAAa,GAAG,CAAC,CAAc,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC;AAEpH,6DAA6D;AAC7D,MAAM,WAAW,GAAG,CAAC,CAAc,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAErK,kEAAkE;AAClE,SAAS,GAAG,CAAC,GAAW;IACtB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,iBAA0B,EAAE,KAAa,EAAE,KAAoB;IACjF,IAAI,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,KAAK;QACV,CAAC,CAAC,sDAAsD,KAAK,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC,KAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,eAAe;QACjK,CAAC,CAAC,uFAAuF,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,iBAA0B,EAAE,IAAI,GAAG,mBAAmB,EAAE;IAC5G,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AACvK,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAyB,EAAE,iBAA0B,EAAE,IAAI,GAAG,mBAAmB,EAAE;IACvH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrG,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AACvJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAc;IAC/B,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QAC5G,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;KACzH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,CAAc;IAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,CAAc,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAE5G,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAS,GAAG,kBAAkB,EAAE,iBAAiB,GAAG,IAAI;IACzG,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAW,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAEhI,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACtE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;QAC9D,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtD,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACzN,CAAC,CAAC;QACF,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,cAAc,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrF,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;QACzC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,GAAG,YAAY;QACjD,UAAU;QACV,UAAU;QACV,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QAC5D,+FAA+F;QAC/F,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QACxH,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QACjF,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC;QACtD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE;KACtL,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/commits.d.ts

@@ -0,0 +1,96 @@
+import { type Finding, type PrismResult } from '../codewatch/results.js';
+export declare const MAX_COMMIT_ROWS = 50;
+/** History read per repo; ranges reaching further are cut there. */
+export declare const LOG_LIMIT = 5000;
+export interface LogEntry {
+    sha: string;
+    parents: string[];
+    tree: string;
+    authorDate: string;
+    subject: string;
+}
+export interface CommitFinding extends Finding {
+    /** blame: the commit introduced this line. tip: blame could not say; shown on the push's tip. */
+    attributed: 'blame' | 'tip';
+    /** Tip of the push the finding was reported in, when attributed to the tip. */
+    inPushOf: string | null;
+}
+export type SecretScanState = 'ok' | 'not-scanned' | 'no-verify' | 'flagged' | 'none';
+export type ReviewState = 'clean' | 'findings' | 'failed' | 'not-reviewed';
+export interface CommitRow {
+    sha: string;
+    short: string;
+    /** null when the commit is no longer reachable from any ref (amended, rebased away). */
+    subject: string | null;
+    inHistory: boolean;
+    branch: string | null;
+    authorDate: string | null;
+    secretScan: {
+        state: SecretScanState;
+        reason: string | null;
+    };
+    review: {
+        state: ReviewState;
+        tool: string | null;
+        model: string | null;
+        /** Reviews whose range included this commit; the newest one is shown. */
+        reviewCount: number;
+        reviewedAt: string | null;
+        tip: string | null;
+        /** Result id of the review shown, for the report link. */
+        reportId: string | null;
+        high: number;
+        medium: number;
+        low: number;
+        reason: string | null;
+    };
+    findings: CommitFinding[];
+}
+export interface CommitsPanel {
+    rows: CommitRow[];
+    total: number;
+    truncated: boolean;
+    /** Measured cost of building the table. */
+    timing: {
+        logMs: number;
+        blameMs: number;
+        blameCalls: number;
+    };
+}
+/** One `git log --all` for the repo, newest first. */
+export declare function readLog(repo: string, limit?: number): Map<string, LogEntry>;
+/**
+ * Commits a push of `tip` over `base` introduced: `git rev-list base..tip`,
+ * computed from the log. With no base, just the tip.
+ */
+export declare function expandRange(log: Map<string, LogEntry>, base: string | null, tip: string): string[];
+/** Per-request blame cache: `${tip}\0${file}\0${line}` -> introducing commit or null. */
+export declare class Blamer {
+    private repo;
+    private cache;
+    calls: number;
+    ms: number;
+    constructor(repo: string);
+    blame(tip: string, file: string, line: number | null): string | null;
+}
+export interface CollectCommitsOptions {
+    log?: Map<string, LogEntry>;
+    blamer?: Blamer;
+    maxRows?: number;
+    /** Result id lookup, for report links. */
+    idOf?: (r: PrismResult) => string | null;
+}
+export interface Attribution {
+    /** All commits the push introduced. */
+    range: string[];
+    /** Findings per commit they were attributed to. */
+    byCommit: Map<string, CommitFinding[]>;
+}
+/**
+ * Attributes one review's findings to commits: the commit `git blame` names at
+ * the review's tip, when it is inside the pushed range; otherwise the tip,
+ * marked "in push of <tip>". Shared by the Commits table and the scan report.
+ */
+export declare function attributeFindings(rev: PrismResult, log: Map<string, LogEntry>, blamer: Blamer): Attribution;
+export declare function collectCommits(repo: string, results: PrismResult[], opts?: CollectCommitsOptions): CommitsPanel;
+//# sourceMappingURL=commits.d.ts.map

package/dist/src/dashboard/commits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commits.d.ts","sourceRoot":"","sources":["../../../src/dashboard/commits.ts"],"names":[],"mappings":"AAkBA,OAAO,EAA2B,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAElG,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,oEAAoE;AACpE,eAAO,MAAM,SAAS,OAAO,CAAC;AAE9B,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,iGAAiG;IACjG,UAAU,EAAE,OAAO,GAAG,KAAK,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AACtF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE;QAAE,KAAK,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9D,MAAM,EAAE;QACN,KAAK,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,0DAA0D;QAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,2CAA2C;IAC3C,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AASD,sDAAsD;AACtD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAY,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAU9E;AAeD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAKlG;AAID,yFAAyF;AACzF,qBAAa,MAAM;IAIL,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,KAAK,CAAoC;IACjD,KAAK,SAAK;IACV,EAAE,SAAK;gBACa,IAAI,EAAE,MAAM;IAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;CAarE;AAYD,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAa3G;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,GAAE,qBAA0B,GAAG,YAAY,CA4EnH"}

package/dist/src/dashboard/commits.js

@@ -0,0 +1,207 @@
+/**
+ * Codewatch results per commit, for the dashboard's Commits table.
+ *
+ * Results are recorded per hook run, not per commit: a pre-commit scan knows
+ * only the staged tree, and a pre-push review covers a range. This module maps
+ * both back onto commits:
+ *
+ * - one `git log --all` per repo gives every commit's parents, tree, author
+ *   date and subject; review ranges (`base..tip`, the commits the push
+ *   introduced) are expanded from it in memory, so no per-review rev-list;
+ * - pre-commit scans match commits by tree id (a commit's tree is the staged
+ *   tree it was scanned as);
+ * - each review finding is attributed to the commit that introduced its line
+ *   with `git blame` at the review's tip, once per distinct location; when
+ *   blame fails or names a commit outside the range, the finding stays on the
+ *   tip, marked "in push of <tip>".
+ */
+import { spawnSync } from 'node:child_process';
+import { REASON_GITLEAKS_MISSING } from '../codewatch/results.js';
+export const MAX_COMMIT_ROWS = 50;
+/** History read per repo; ranges reaching further are cut there. */
+export const LOG_LIMIT = 5000;
+function git(repo, args) {
+    const r = spawnSync('git', ['-C', repo, ...args], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
+    return { ok: r.status === 0, out: r.stdout || '' };
+}
+const SEP = '\x1f';
+/** One `git log --all` for the repo, newest first. */
+export function readLog(repo, limit = LOG_LIMIT) {
+    const r = git(repo, ['log', '--all', `--max-count=${limit}`, `--format=%H${SEP}%P${SEP}%T${SEP}%aI${SEP}%s`]);
+    const m = new Map();
+    if (!r.ok)
+        return m;
+    for (const line of r.out.split('\n')) {
+        if (!line)
+            continue;
+        const [sha, parents, tree, authorDate, subject] = line.split(SEP);
+        m.set(sha, { sha, parents: parents ? parents.split(' ') : [], tree, authorDate, subject: subject ?? '' });
+    }
+    return m;
+}
+/** Commits reachable from `sha` within the log (inclusive). */
+function ancestors(log, sha) {
+    const seen = new Set();
+    const stack = [sha];
+    while (stack.length) {
+        const c = stack.pop();
+        if (seen.has(c) || !log.has(c))
+            continue;
+        seen.add(c);
+        for (const p of log.get(c).parents)
+            stack.push(p);
+    }
+    return seen;
+}
+/**
+ * Commits a push of `tip` over `base` introduced: `git rev-list base..tip`,
+ * computed from the log. With no base, just the tip.
+ */
+export function expandRange(log, base, tip) {
+    if (!log.has(tip))
+        return [tip];
+    if (!base)
+        return [tip];
+    const exclude = ancestors(log, base);
+    return [...ancestors(log, tip)].filter((c) => !exclude.has(c));
+}
+const byTime = (a, b) => String(a.started_at).localeCompare(String(b.started_at));
+/** Per-request blame cache: `${tip}\0${file}\0${line}` -> introducing commit or null. */
+export class Blamer {
+    repo;
+    cache = new Map();
+    calls = 0;
+    ms = 0;
+    constructor(repo) {
+        this.repo = repo;
+    }
+    blame(tip, file, line) {
+        if (!file || !line || line < 1)
+            return null;
+        const key = `${tip}\0${file}\0${line}`;
+        if (this.cache.has(key))
+            return this.cache.get(key);
+        const t0 = Date.now();
+        this.calls++;
+        const r = git(this.repo, ['blame', '-l', '-s', '-L', `${line},${line}`, tip, '--', file]);
+        this.ms += Date.now() - t0;
+        const m = r.ok ? /^\^?([0-9a-f]{40})/.exec(r.out) : null;
+        const sha = m ? m[1] : null;
+        this.cache.set(key, sha);
+        return sha;
+    }
+}
+function emptyRow(sha, log) {
+    const e = log.get(sha);
+    return {
+        sha, short: sha.slice(0, 8), subject: e ? e.subject : null, inHistory: !!e, branch: null, authorDate: e ? e.authorDate : null,
+        secretScan: { state: 'none', reason: null },
+        review: { state: 'not-reviewed', tool: null, model: null, reviewCount: 0, reviewedAt: null, tip: null, reportId: null, high: 0, medium: 0, low: 0, reason: null },
+        findings: [],
+    };
+}
+/**
+ * Attributes one review's findings to commits: the commit `git blame` names at
+ * the review's tip, when it is inside the pushed range; otherwise the tip,
+ * marked "in push of <tip>". Shared by the Commits table and the scan report.
+ */
+export function attributeFindings(rev, log, blamer) {
+    const tip = rev.commit;
+    const range = expandRange(log, rev.base, tip);
+    const inRange = new Set(range);
+    const byCommit = new Map();
+    for (const f of rev.findings || []) {
+        const who = blamer.blame(tip, f.file, f.line);
+        const target = who && inRange.has(who) ? who : tip;
+        const cf = { ...f, attributed: target === who ? 'blame' : 'tip', inPushOf: target === who ? null : tip };
+        if (!byCommit.has(target))
+            byCommit.set(target, []);
+        byCommit.get(target).push(cf);
+    }
+    return { range, byCommit };
+}
+export function collectCommits(repo, results, opts = {}) {
+    const t0 = Date.now();
+    const log = opts.log ?? readLog(repo);
+    const logMs = Date.now() - t0;
+    const blamer = opts.blamer ?? new Blamer(repo);
+    const sorted = results.filter((r) => r && typeof r.started_at === 'string').sort(byTime);
+    const rows = new Map();
+    const row = (sha) => {
+        let r = rows.get(sha);
+        if (!r) {
+            r = emptyRow(sha, log);
+            rows.set(sha, r);
+        }
+        return r;
+    };
+    // Pre-push reviews: every commit in each range, newest review wins.
+    for (const rev of sorted.filter((r) => r.kind === 'review' && r.hook === 'pre-push' && r.commit)) {
+        if (rev.status === 'skipped')
+            continue; // nothing was pushed to review
+        const tip = rev.commit;
+        const { range, byCommit } = attributeFindings(rev, log, blamer);
+        for (const sha of range) {
+            const r = row(sha);
+            const fs = byCommit.get(sha) || [];
+            const count = (s) => fs.filter((f) => f.severity === s).length;
+            r.branch = rev.branch ?? r.branch;
+            r.review = {
+                state: rev.status === 'error' ? 'failed' : fs.length ? 'findings' : 'clean',
+                tool: rev.tool && rev.tool !== 'none' ? rev.tool : null,
+                model: rev.model ?? null,
+                reviewCount: r.review.reviewCount + 1,
+                reviewedAt: rev.started_at,
+                tip,
+                high: count('high'), medium: count('medium'), low: count('low'),
+                reason: rev.status === 'error' ? rev.reason : null,
+                reportId: opts.idOf ? opts.idOf(rev) : null,
+            };
+            r.findings = fs;
+        }
+    }
+    // Pre-commit scans, matched by tree. Newest scan of a tree wins.
+    const scanByTree = new Map();
+    for (const s of sorted.filter((r) => r.kind === 'secrets' && r.hook === 'pre-commit' && r.tree))
+        scanByTree.set(s.tree, s);
+    if (scanByTree.size) {
+        for (const e of log.values()) {
+            const s = scanByTree.get(e.tree);
+            if (!s)
+                continue;
+            const r = row(e.sha);
+            r.branch = r.branch ?? s.branch ?? null;
+            if (s.status === 'ok')
+                r.secretScan = { state: 'ok', reason: null };
+            else if (s.status === 'skipped' && s.reason === REASON_GITLEAKS_MISSING)
+                r.secretScan = { state: 'not-scanned', reason: 'gitleaks was not installed' };
+            else if (s.status === 'findings')
+                r.secretScan = { state: 'flagged', reason: 'committed although the scan found secrets (--no-verify)' };
+            else
+                r.secretScan = { state: 'not-scanned', reason: s.reason };
+        }
+    }
+    // Commits pre-push found with no pre-commit scan.
+    for (const s of sorted.filter((r) => r.kind === 'secrets' && r.hook === 'pre-push' && r.status === 'skipped' && r.commit)) {
+        const r = row(s.commit);
+        r.branch = r.branch ?? s.branch ?? null;
+        if (r.secretScan.state === 'none')
+            r.secretScan = { state: 'no-verify', reason: 'pushed with no matching pre-commit scan (--no-verify, rebase or cherry-pick)' };
+    }
+    // Newest first. Commits made in the same second keep git log order (children
+    // before parents); commits no longer in history sort after those that are.
+    const order = new Map();
+    let i = 0;
+    for (const sha of log.keys())
+        order.set(sha, i++);
+    const pos = (r) => order.get(r.sha) ?? Number.MAX_SAFE_INTEGER;
+    const all = [...rows.values()].sort((a, b) => String(b.authorDate ?? b.review.reviewedAt ?? '').localeCompare(String(a.authorDate ?? a.review.reviewedAt ?? '')) || pos(a) - pos(b) || a.sha.localeCompare(b.sha));
+    const max = opts.maxRows ?? MAX_COMMIT_ROWS;
+    return {
+        rows: all.slice(0, max),
+        total: all.length,
+        truncated: all.length > max,
+        timing: { logMs, blameMs: blamer.ms, blameCalls: blamer.calls },
+    };
+}
+//# sourceMappingURL=commits.js.map

package/dist/src/dashboard/commits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commits.js","sourceRoot":"","sources":["../../../src/dashboard/commits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAkC,MAAM,yBAAyB,CAAC;AAElG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,oEAAoE;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAuD9B,SAAS,GAAG,CAAC,IAAY,EAAE,IAAc;IACvC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1I,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,GAAG,GAAG,MAAM,CAAC;AAEnB,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAK,GAAG,SAAS;IACrD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,KAAK,EAAE,EAAE,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9G,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+DAA+D;AAC/D,SAAS,SAAS,CAAC,GAA0B,EAAE,GAAW;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAA0B,EAAE,IAAmB,EAAE,GAAW;IACtF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,CAAc,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAE5G,yFAAyF;AACzF,MAAM,OAAO,MAAM;IAIG;IAHZ,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,KAAK,GAAG,CAAC,CAAC;IACV,EAAE,GAAG,CAAC,CAAC;IACP,YAAoB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IACpC,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,IAAmB;QAClD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,IAAI,KAAK,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAA0B;IACvD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7H,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAC3C,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QACjK,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAgB,EAAE,GAA0B,EAAE,MAAc;IAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAgB,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnD,MAAM,EAAE,GAAkB,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAsB,EAAE,OAA8B,EAAE;IACnG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,oEAAoE;IACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS,CAAC,+BAA+B;QACvE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAgB,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAChE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,MAAM,GAAG;gBACT,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;gBAC3E,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACvD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;gBACxB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC;gBACrC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG;gBACH,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBAC/D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aAC5C,CAAC;YACF,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAc,EAAE,CAAC,CAAC,CAAC;IACrI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YACxC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,CAAC,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;iBAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,uBAAuB;gBAAE,CAAC,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;iBAClJ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;gBAAE,CAAC,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;;gBACpI,CAAC,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1H,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAClC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,MAAM;YAAE,CAAC,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IACnK,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC3C,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvK,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACvB,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG;QAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE;KAChE,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/page.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The dashboard's single-page app: one self-contained HTML document with
+ * inline CSS and JS (nonce-gated by the CSP), no CDN and no network fetch
+ * other than its own GET /api/data, so it works offline.
+ *
+ * Every value from the payload is placed with textContent or a DOM attribute;
+ * innerHTML is never used for data.
+ */
+export declare function renderPage(nonce: string): string;
+//# sourceMappingURL=page.d.ts.map

package/dist/src/dashboard/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6SH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQhD"}