@prism-d1/cli 1.1.2 → 1.3.0

package/dist/src/dashboard/page.js

@@ -0,0 +1,470 @@
+/**
+ * The dashboard's single-page app: one self-contained HTML document with
+ * inline CSS and JS (nonce-gated by the CSP), no CDN and no network fetch
+ * other than its own GET /api/data, so it works offline.
+ *
+ * Every value from the payload is placed with textContent or a DOM attribute;
+ * innerHTML is never used for data.
+ */
+const STYLE = `
+:root { color-scheme: light dark; --bg:#f7f7f8; --card:#fff; --text:#1d1d1f; --muted:#6b6b73; --line:#e3e3e8;
+  --ok:#1a7f37; --warn:#9a6700; --bad:#cf222e; --high:#cf222e; --medium:#bf8700; --low:#57606a; --accent:#0969da; }
+@media (prefers-color-scheme: dark) { :root { --bg:#0d1117; --card:#161b22; --text:#e6edf3; --muted:#8b949e; --line:#30363d;
+  --ok:#3fb950; --warn:#d29922; --bad:#f85149; --high:#f85149; --medium:#d29922; --low:#8b949e; --accent:#58a6ff; } }
+* { box-sizing: border-box; }
+body { margin:0; font:14px/1.45 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:var(--bg); color:var(--text); }
+header { display:flex; align-items:center; gap:12px; padding:14px 20px; border-bottom:1px solid var(--line); background:var(--card); }
+header h1 { font-size:17px; margin:0; } header .meta { color:var(--muted); font-size:12px; margin-left:auto; }
+button { font:inherit; padding:4px 10px; border:1px solid var(--line); border-radius:6px; background:var(--bg); color:var(--text); cursor:pointer; }
+main { padding:16px 20px; display:grid; gap:16px; grid-template-columns: repeat(auto-fit, minmax(420px, 1fr)); }
+section.card { background:var(--card); border:1px solid var(--line); border-radius:10px; padding:14px 16px; min-width:0; }
+section.wide { grid-column: 1 / -1; }
+.sec-repo { border-top:1px solid var(--line); padding:10px 0; } .sec-repo:first-of-type { border-top:none; padding-top:0; } .sec-head { display:flex; gap:6px; align-items:baseline; flex-wrap:wrap; overflow-wrap:anywhere; }
+.sec-pills { display:flex; gap:6px; flex-wrap:wrap; margin:6px 0; } ul.sec-findings { list-style:none; margin:4px 0 0; padding:0; } ul.sec-findings li { padding:6px 0; border-top:1px dashed var(--line); font-size:13px; overflow-wrap:anywhere; } .sec-title { font-weight:600; } ul.sec-findings code { white-space:normal; overflow-wrap:anywhere; }
+h2 { font-size:15px; margin:0 0 10px; } h3 { font-size:13px; margin:14px 0 6px; color:var(--muted); text-transform:uppercase; letter-spacing:.04em; }
+.empty { color:var(--muted); padding:8px 0; } code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size:12px; background:var(--bg); padding:1px 4px; border-radius:4px; }
+.tablewrap { overflow-x:auto; }
+table { width:100%; border-collapse:collapse; font-size:13px; } th, td { text-align:left; padding:5px 6px; border-bottom:1px solid var(--line); vertical-align:top; overflow-wrap:break-word; }
+th { white-space:nowrap; } td.msg { min-width:280px; } td.count { font-variant-numeric:tabular-nums; font-weight:600; } td code { white-space:normal; overflow-wrap:anywhere; }
+th { color:var(--muted); font-weight:600; } td.num { text-align:right; font-variant-numeric: tabular-nums; }
+.pill { white-space:nowrap; display:inline-block; padding:0 7px; border-radius:10px; font-size:12px; font-weight:600; border:1px solid currentColor; }
+.s-ok { color:var(--ok); } .s-warn, .s-findings, .s-skipped { color:var(--warn); } .s-missing, .s-error { color:var(--bad); }
+.sev-high { color:var(--high); } .sev-medium { color:var(--medium); } .sev-low { color:var(--low); }
+.stats { display:flex; gap:18px; flex-wrap:wrap; margin:6px 0; } .stat b { display:block; font-size:20px; } .stat span { color:var(--muted); font-size:12px; }
+.fix { color:var(--muted); font-size:12px; overflow-wrap:anywhere; }
+.tag { margin-left:6px; font-size:11px; padding:0 6px; border-radius:8px; background:var(--bg); border:1px solid var(--line); color:var(--muted); white-space:nowrap; }
+details.missing-group > summary { cursor:pointer; padding:8px 0; color:var(--muted); font-weight:600; }
+details.repo { border-top:1px solid var(--line); padding:8px 0; } details.repo > summary { cursor:pointer; padding:4px 0; } details.repo .detail { padding-left:14px; }
+.callout { border:1px solid var(--accent); border-left-width:4px; border-radius:6px; padding:10px 12px; margin:6px 0 10px; background:color-mix(in srgb, var(--accent) 8%, var(--card)); }
+.callout.warn { border-color:var(--warn); background:color-mix(in srgb, var(--warn) 10%, var(--card)); } .callout code { white-space:normal; overflow-wrap:anywhere; }
+.crow { display:grid; grid-template-columns: 6.5em minmax(10em,2.2fr) minmax(5em,0.8fr) 10.5em 7.5em minmax(11em,1.6fr); gap:8px; padding:6px 6px; border-bottom:1px solid var(--line); align-items:start; font-size:13px; overflow-wrap:anywhere; }
+.chead { color:var(--muted); font-weight:600; } summary.crow { cursor:pointer; list-style:none; } summary.crow::-webkit-details-marker { display:none; } details.cdetails[open] > summary.crow { background:var(--bg); } details.cdetails > .tablewrap { padding:4px 0 8px 18px; }
+@media (max-width: 760px) { .crow { grid-template-columns: 1fr 1fr; } .chead { display:none; } }
+a.rlink { color:var(--accent); } a.rlink:hover { text-decoration:underline; }
+.banner { border:1px solid var(--warn); border-left-width:4px; border-radius:6px; padding:10px 12px; margin:4px 0 12px; background:color-mix(in srgb, var(--warn) 10%, var(--card)); }
+.banner strong { color:var(--text); display:block; margin-bottom:4px; } .banner .fix code { white-space:normal; overflow-wrap:anywhere; } .note { color:var(--muted); font-size:12px; margin-top:10px; }
+svg.trend rect.high { fill:var(--high); } svg.trend rect.medium { fill:var(--medium); } svg.trend rect.low { fill:var(--low); } svg.trend rect.zero { fill:var(--ok); }
+svg.trend line { stroke:var(--line); }
+.repo-title { font-size:12px; color:var(--muted); margin-bottom:6px; word-break:break-all; }
+`;
+const SCRIPT = `
+'use strict';
+const SVG = 'http://www.w3.org/2000/svg';
+function el(tag, attrs, ...kids) {
+  const n = document.createElement(tag);
+  for (const [k, v] of Object.entries(attrs || {})) { if (v !== null && v !== undefined) n.setAttribute(k, String(v)); }
+  for (const c of kids.flat()) { if (c === null || c === undefined || c === false) continue; n.append(c instanceof Node ? c : document.createTextNode(String(c))); }
+  return n;
+}
+const txt = (v) => (v === null || v === undefined ? '' : String(v));
+const pill = (status, label) => el('span', { class: 'pill s-' + txt(status).replace(/[^a-z-]/g, '') }, label || status);
+const sev = (s) => el('span', { class: 'sev-' + txt(s).replace(/[^a-z]/g, '') }, s);
+const when = (iso) => { const d = new Date(iso); return isNaN(d) ? txt(iso) : d.toLocaleString(); };
+const short = (sha) => (sha ? txt(sha).slice(0, 8) : '');
+function money(n, cur) { try { return new Intl.NumberFormat(undefined, { style: 'currency', currency: cur || 'USD' }).format(n || 0); } catch { return '$' + (n || 0).toFixed(2); } }
+function table(head, rows) {
+  return el('div', { class: 'tablewrap' }, el('table', {}, el('thead', {}, el('tr', {}, head.map((h) => el('th', {}, h)))),
+    el('tbody', {}, rows.map((r) => el('tr', {}, r.map((c) => (c instanceof Node && c.nodeName === 'TD') ? c : el('td', {}, c)))))));
+}
+const num = (v) => el('td', { class: 'num' }, txt(v));
+
+function trendSvg(trend) {
+  const w = Math.max(trend.length * 14, 140), h = 48, svg = document.createElementNS(SVG, 'svg');
+  svg.setAttribute('class', 'trend'); svg.setAttribute('width', String(w)); svg.setAttribute('height', String(h + 2));
+  svg.setAttribute('role', 'img'); svg.setAttribute('aria-label', 'findings per run, oldest first');
+  const max = Math.max(1, ...trend.map((r) => r.high + r.medium + r.low));
+  const base = document.createElementNS(SVG, 'line');
+  base.setAttribute('x1', '0'); base.setAttribute('x2', String(w)); base.setAttribute('y1', String(h)); base.setAttribute('y2', String(h)); svg.append(base);
+  trend.forEach((r, i) => {
+    let y = h; const parts = [['high', r.high], ['medium', r.medium], ['low', r.low]];
+    const total = r.high + r.medium + r.low;
+    if (total === 0) parts.push(['zero', 0]);
+    for (const [cls, n] of parts) {
+      const bh = cls === 'zero' ? 3 : Math.round((n / max) * (h - 4)); if (!bh) continue;
+      y -= bh; const rect = document.createElementNS(SVG, 'rect');
+      rect.setAttribute('x', String(i * 14 + 2)); rect.setAttribute('y', String(y)); rect.setAttribute('width', '10'); rect.setAttribute('height', String(bh)); rect.setAttribute('class', cls);
+      const t = document.createElementNS(SVG, 'title'); t.textContent = when(r.started_at) + ' ' + r.kind + ' ' + r.status + ' (' + r.tool + '): ' + r.high + ' high, ' + r.medium + ' medium, ' + r.low + ' low';
+      rect.append(t); svg.append(rect);
+    }
+  });
+  return svg;
+}
+
+function scanBanner(ss) {
+  if (!ss || !ss.banner) return null;
+  return el('div', { class: 'banner', role: 'alert' },
+    el('strong', {}, ss.banner),
+    el('div', { class: 'fix' }, 'Install: ', el('code', {}, ss.installHint)));
+}
+
+function repoName(r) {
+  return el('span', { title: r.path }, r.name, r.current ? el('span', { class: 'tag' }, 'this repo') : null);
+}
+
+const SCAN_LABEL = { ok: ['ok', 'ok'], 'not-scanned': ['warn', 'not scanned'], 'no-verify': ['warn', 'no-verify'], flagged: ['missing', 'secrets found'], none: ['skipped', '-'] };
+
+/** Link to a scan report. Ids come from the server's own listing; encodeURIComponent keeps them literal. */
+const reportLink = (id, label) => el('a', { href: '/report/' + encodeURIComponent(id), class: 'rlink' }, label);
+
+function reviewCell(rv) {
+  if (rv.state === 'not-reviewed') return el('span', { class: 'fix' }, 'not reviewed');
+  const link = rv.reportId ? [' ', reportLink(rv.reportId, 'report')] : [];
+  if (rv.state === 'failed') return el('span', { title: txt(rv.reason) }, pill('error', 'review failed'), link);
+  const who = el('span', { class: 'fix' }, ' ' + txt(rv.tool || '') + (rv.model ? ' / ' + rv.model : '') + (rv.reviewCount > 1 ? ' · reviewed ' + rv.reviewCount + 'x' : ''));
+  if (rv.state === 'clean') return el('span', {}, pill('ok', 'reviewed, clean'), who, link);
+  const counts = el('span', {},
+    rv.high ? el('b', { class: 'sev-high' }, rv.high + ' high ') : null,
+    rv.medium ? el('b', { class: 'sev-medium' }, rv.medium + ' medium ') : null,
+    rv.low ? el('b', { class: 'sev-low' }, rv.low + ' low') : null);
+  return el('span', {}, counts, who, link);
+}
+
+/** The newest reviews, each linking to its report. */
+function scansList(scans) {
+  if (!scans || !scans.length) return el('p', { class: 'empty' }, 'No pre-push reviews yet.');
+  return table(['When', 'Branch', 'Reviewer', 'Result', 'Findings', ''], scans.map((s) => [
+    when(s.started_at), txt(s.branch || '-'), txt(s.tool) + (s.model ? ' / ' + s.model : ''),
+    pill(s.status === 'ok' ? 'ok' : s.status === 'findings' ? 'findings' : s.status === 'error' ? 'error' : 'skipped', s.status === 'ok' ? 'clean' : s.status),
+    el('span', {}, s.high ? el('b', { class: 'sev-high' }, s.high + ' high ') : null, s.medium ? el('b', { class: 'sev-medium' }, s.medium + ' medium ') : null, s.low ? el('b', { class: 'sev-low' }, s.low + ' low') : null, (s.high + s.medium + s.low) ? null : '-'),
+    reportLink(s.id, 'Report'),
+  ]));
+}
+
+/** Commits as rows; a row with findings expands to list them. */
+function commitsList(c) {
+  const wrap = el('div', { class: 'commits' });
+  if (!c || !c.rows.length) { wrap.append(el('p', { class: 'empty' }, 'No commits recorded yet.')); return wrap; }
+  wrap.append(el('div', { class: 'crow chead' }, el('span', {}, 'Commit'), el('span', {}, 'Subject'), el('span', {}, 'Branch'), el('span', {}, 'Date'), el('span', {}, 'Secret scan'), el('span', {}, 'Review')));
+  for (const r of c.rows) {
+    const scan = SCAN_LABEL[r.secretScan.state] || ['skipped', r.secretScan.state];
+    const cells = [
+      el('code', {}, r.short),
+      el('span', { class: r.inHistory ? '' : 'fix' }, r.inHistory ? txt(r.subject) : '(no longer in history)'),
+      el('span', {}, txt(r.branch || '-')),
+      el('span', {}, r.authorDate ? when(r.authorDate) : '-'),
+      r.secretScan.state === 'none' ? el('span', { class: 'fix' }, '-') : el('span', { title: txt(r.secretScan.reason) }, pill(scan[0], scan[1])),
+      reviewCell(r.review),
+    ];
+    if (!r.findings.length) { wrap.append(el('div', { class: 'crow' }, cells)); continue; }
+    const d = el('details', { class: 'cdetails' }, el('summary', { class: 'crow' }, cells));
+    d.append(table(['Severity', 'Category', 'Location', 'Rule', 'Message'], r.findings.map((f) => [
+      sev(f.severity), f.category, el('code', {}, f.file + (f.line ? ':' + f.line : '')), f.rule,
+      el('td', { class: 'msg' }, f.message, f.inPushOf ? el('div', { class: 'fix' }, 'in push of ' + txt(f.inPushOf).slice(0, 8) + ' (blame could not place this line)') : null)])));
+    wrap.append(d);
+  }
+  if (c.truncated) wrap.append(el('p', { class: 'note' }, 'showing ' + c.rows.length + ' of ' + c.total + ' commits'));
+  return wrap;
+}
+
+/** One repo's detail, shown inside its <details>. */
+function codewatchDetail(repo) {
+  const cw = repo.codewatch, s = el('div', { class: 'detail' });
+  if (!cw.hasResults) {
+    const fix = repo.setup && repo.setup.fix ? repo.setup.fix : 'prism-cli enable codewatch';
+    s.append(el('p', { class: 'empty' }, 'No codewatch results yet. Run ', el('code', {}, fix), ', then commit and push.'));
+    return s;
+  }
+  s.append(el('div', { class: 'stats' },
+    el('div', { class: 'stat' }, el('b', {}, cw.byCategory.security), el('span', {}, 'security')),
+    el('div', { class: 'stat' }, el('b', {}, cw.byCategory.quality), el('span', {}, 'quality')),
+    el('div', { class: 'stat' }, el('b', {}, cw.gitleaksBlocks.length), el('span', {}, 'gitleaks blocks')),
+    el('div', { class: 'stat' }, el('b', {}, cw.skipped.length), el('span', {}, 'pushed without a scan'))));
+
+  s.append(el('h3', {}, 'Commits'));
+  s.append(commitsList(cw.commits));
+
+  s.append(el('h3', {}, 'Scans (last ' + cw.scans.length + ')'));
+  s.append(scansList(cw.scans));
+
+  s.append(el('h3', {}, 'Trend (last ' + cw.trend.length + ' runs)'));
+  s.append(trendSvg(cw.trend));
+
+  s.append(el('h3', {}, 'Gitleaks blocks'));
+  if (!cw.gitleaksBlocks.length) s.append(el('p', { class: 'empty' }, 'No commits blocked.'));
+  else s.append(table(['When', 'Branch', 'Result', 'Secrets'], cw.gitleaksBlocks.slice(0, 20).map((r) => [when(r.started_at), txt(r.branch), pill(r.status), r.status === 'findings' ? r.high : txt(r.reason)])));
+
+  s.append(el('h3', {}, 'Commits pushed without a pre-commit scan'));
+  if (!cw.skipped.length) s.append(el('p', { class: 'empty' }, 'None.'));
+  else {
+    s.append(table(['Commit', 'Branch', 'Recorded'], cw.skipped.slice(0, 20).map((r) => [el('code', {}, short(r.commit)), txt(r.branch), when(r.started_at)])));
+    s.append(el('p', { class: 'note' }, 'Usually git commit --no-verify; rebases and cherry-picks also show up here.'));
+  }
+  return s;
+}
+
+function codewatchPanel(data) {
+  const s = el('section', { class: 'card wide' }, el('h2', {}, 'Codewatch'));
+  const banner = scanBanner(data.machine.secretScanning);
+  if (banner) s.append(banner);
+  const rows = data.overview.codewatch;
+  if (!rows.length) {
+    const sg = (data.suggestions || []).find((x) => x.id === 'codewatch-global');
+    if (sg) s.append(el('p', { class: 'empty' }, "Codewatch isn't enabled in any repo yet. Cover every repo at once: ", el('code', {}, sg.command), ', or run ', el('code', {}, 'prism-cli enable codewatch'), ' inside one repo.'));
+    else s.append(el('p', { class: 'empty' }, "Codewatch isn't enabled in any repo yet. Run ", el('code', {}, 'prism-cli enable codewatch'), ' inside a repo.'));
+    return s;
+  }
+  const count = (n, cls) => el('td', { class: 'count' + (n ? ' ' + cls : '') }, n);
+  s.append(table(['Repo', 'High', 'Medium', 'Low', 'Last run', 'Reviewer', 'Unscanned', 'Gitleaks'], rows.map((r) => [
+    repoName(r), count(r.high, 'sev-high'), count(r.medium, 'sev-medium'), count(r.low, 'sev-low'),
+    r.lastRunAt ? (r.lastReviewId ? reportLink(r.lastReviewId, when(r.lastRunAt)) : when(r.lastRunAt)) : 'never', txt(r.reviewer || '-'), count(r.unscannedCommits, 'sev-medium'),
+    r.gitleaksWarning ? pill('warn', 'not scanned') : '-',
+  ])));
+  const byPath = Object.fromEntries(data.repos.map((r) => [r.path, r]));
+  s.append(el('h3', {}, 'Per repo'));
+  for (const row of rows) {
+    const repo = byPath[row.path]; if (!repo) continue;
+    const total = row.high + row.medium + row.low;
+    const d = el('details', repo.current ? { class: 'repo', open: '' } : { class: 'repo' },
+      el('summary', {}, el('b', {}, repo.name), ' ', el('span', { class: 'fix' }, repo.codewatch.hasResults ? total + ' finding' + (total === 1 ? '' : 's') + ' in the latest reviews' : 'no results yet'),
+        repo.current ? el('span', { class: 'tag' }, 'this repo') : null),
+      el('div', { class: 'repo-title' }, repo.path));
+    d.append(codewatchDetail(repo));
+    s.append(d);
+  }
+  return s;
+}
+
+function usagePanel(u) {
+  const s = el('section', { class: 'card' }, el('h2', {}, 'Usage (codeburn)'));
+  if (u.status !== 'ok') {
+    s.append(el('p', { class: 'empty' }, pill(u.status === 'no-data' ? 'warn' : 'missing', u.status), ' ', txt(u.message)));
+  } else {
+    s.append(el('div', { class: 'stats' },
+      el('div', { class: 'stat' }, el('b', {}, money(u.today.cost, u.currency)), el('span', {}, 'today, ' + u.today.calls + ' calls')),
+      el('div', { class: 'stat' }, el('b', {}, money(u.month.cost, u.currency)), el('span', {}, 'this month, ' + u.month.calls + ' calls, ' + u.month.sessions + ' sessions'))));
+    s.append(el('h3', {}, 'Top models this month'));
+    s.append(table(['Model', 'Cost', 'Calls'], u.topModels.map((m) => [m.name, num(money(m.cost, u.currency)), num(m.calls)])));
+    s.append(el('h3', {}, 'Top projects this month'));
+    s.append(table(['Project', 'Cost', 'Sessions'], u.topProjects.map((p) => [el('span', { title: p.path }, p.name), num(money(p.cost, u.currency)), num(p.sessions)])));
+  }
+  s.append(el('p', { class: 'note' }, 'Full charts: run ', el('code', {}, txt(u.fullView)), ' in a terminal.'));
+  return s;
+}
+
+/** Info (or warn) callout for the global install. Text only: the page never runs anything. */
+function suggestionCallout(sg) {
+  if (sg.style === 'warn') {
+    return el('div', { class: 'callout warn', role: 'note' },
+      el('strong', {}, sg.missing + " repos don't have codewatch."),
+      el('div', {}, 'Your global core.hooksPath is set to ', el('code', {}, txt(sg.currentHooksPath)), ', so the plain global install would refuse. Use ',
+        el('code', {}, sg.command), ': it saves that value and still runs its hooks after codewatch.'));
+  }
+  return el('div', { class: 'callout info', role: 'note' },
+    el('strong', {}, sg.missing + " repos don't have codewatch. Cover all of them at once: "), el('code', {}, sg.command),
+    el('div', { class: 'fix' }, 'Applies to every repo on this machine, including new clones. Repos can opt out with ', el('code', {}, 'git config prism.codewatch false'), '.'));
+}
+
+function setupPanel(data) {
+  const s = el('section', { class: 'card' }, el('h2', {}, 'Setup checklist'));
+  const rows = (items) => items.map((i) => [pill(i.status), i.label, el('div', {}, i.detail, i.fix ? el('div', { class: 'fix' }, 'Fix: ' + i.fix) : null)]);
+  s.append(el('h3', {}, 'This machine'), table(['', 'Check', 'Detail'], rows(data.machine.setup)));
+  const repos = data.overview.setup, c = data.overview.counts;
+  s.append(el('h3', {}, 'Per repo: codewatch (' + c.codewatch + ' of ' + c.repos + ' installed)'));
+  const label = { ok: 'ok', warn: 'warn', missing: 'missing', 'opted-out': 'opted out' };
+  const pillClass = { ok: 'ok', warn: 'warn', missing: 'missing', 'opted-out': 'skipped' };
+  const rowOf = (r) => [
+    repoName(r),
+    el('div', {}, pill(pillClass[r.status] || 'missing', (label[r.status] || r.status) + (r.status === 'ok' && r.global ? ' (global)' : '')), ' ',
+      r.status === 'ok' ? 'reviewer ' + txt(r.reviewer || 'none') : txt(r.detail),
+      r.fix ? el('div', { class: 'fix' }, 'Fix: ', el('code', {}, r.fix)) : null),
+    securityCell(r.security),
+  ];
+  const sg = (data.suggestions || []).find((x) => x.id === 'codewatch-global');
+  if (sg) s.append(suggestionCallout(sg));
+  // Always shown: the current repo (installed or not) and every installed repo.
+  const shown = repos.filter((r) => !r.collapsed);
+  const hidden = repos.filter((r) => r.collapsed);
+  if (shown.length) s.append(table(['Repo', 'Codewatch', 'Security Agent'], shown.map(rowOf)));
+  else if (!hidden.length) s.append(el('p', { class: 'empty' }, 'No git repositories found under ' + txt(data.scope.root_display) + '.'));
+  if (hidden.length) {
+    s.append(el('details', { class: 'missing-group' },
+      el('summary', {}, hidden.length + ' repo' + (hidden.length === 1 ? '' : 's') + ' without codewatch'),
+      table(['Repo', 'Codewatch', 'Security Agent'], hidden.map(rowOf))));
+  }
+  return s;
+}
+
+/** Security Agent per repo, from the enable security marker (local evidence; the page makes no AWS calls). */
+function securityCell(sec) {
+  if (!sec) return el('span', { class: 'fix' }, '-');
+  return el('div', {}, pill(sec.status === 'ok' ? 'ok' : 'missing', sec.status), ' ', sec.status === 'ok' ? txt(sec.detail) : '',
+    sec.fix ? el('div', { class: 'fix' }, 'Fix: ', el('code', {}, sec.fix)) : null);
+}
+
+/** Cached Security Agent code review results; the page only reads them. */
+const RISKS = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFORMATIONAL', 'UNKNOWN'];
+const RISK_CLASS = { CRITICAL: 'sev-high', HIGH: 'sev-high', MEDIUM: 'sev-medium', LOW: 'sev-low' };
+/** A risk-level pill; colour follows the codewatch severity colours. */
+const riskPill = (level, label) => el('span', { class: 'pill ' + (RISK_CLASS[level] || 'fix') }, label);
+
+/** One column wide (fits beside Usage and Setup): a compact block per repo, findings as wrapping rows. */
+function securityPanel(sec) {
+  const s = el('section', { class: 'card' }, el('h2', {}, 'Security findings'));
+  const rows = (sec && sec.repos) || [];
+  const tms = (sec && sec.threat_models) || [];
+  const pts = (sec && sec.pentests) || [];
+  if (!rows.length && !tms.length && !pts.length) {
+    s.append(el('p', { class: 'empty' }, 'No Security Agent code reviews, threat models or penetration tests yet. Run ', el('code', {}, (sec && sec.hint) || 'prism-cli security code-review'), ', ', el('code', {}, 'prism-cli security threat-model'), ' or ', el('code', {}, 'prism-cli security pentest'), ' in a repo set up with ', el('code', {}, 'prism-cli enable security'), '.'));
+    return s;
+  }
+  for (const r of rows) {
+    const counts = r.counts || {};
+    const b = el('div', { class: 'sec-repo' });
+    b.append(el('div', { class: 'sec-head' }, el('b', {}, txt(r.name)), r.current ? el('span', { class: 'tag' }, 'this repo') : null));
+    b.append(el('div', { class: 'fix' },
+      (r.pending ? 'started ' + when(r.started_at) : when(r.finished_at)) + ' · ' + (r.scope === 'diff' ? 'branch diff' : r.scope === 'full' ? 'whole repo' : 'fetched') + ' · job ' + txt(r.job_id).slice(0, 12)));
+    const pills = el('div', { class: 'sec-pills' });
+    if (r.pending) {
+      // Results are local: the page only knows the job was started, not whether it has finished since.
+      pills.append(pill('warn', 'review running'));
+      if (r.stale) pills.append(pill('skipped', 'stale?'));
+      b.append(pills, el('p', { class: 'note' }, r.stale ? 'Started over 2 h ago and not fetched yet; it has most likely finished. ' : '', 'Fetch the results with ', el('code', {}, (sec && sec.pending_hint) || 'prism-cli security findings'), '.'));
+      s.append(b);
+      continue;
+    }
+    if (r.status === 'error') pills.append(pill('error', txt(r.job_status).toLowerCase()));
+    else {
+      const shown = RISKS.filter((k) => (counts[k] || 0) > 0);
+      if (!shown.length) pills.append(pill('ok', 'no findings'));
+      for (const k of shown) pills.append(riskPill(k, counts[k] + ' ' + k.toLowerCase()));
+    }
+    b.append(pills);
+    if (r.reason) b.append(el('p', { class: 'note' }, txt(r.reason)));
+    if (r.status === 'error' && !r.findings.length) b.append(el('p', { class: 'empty' }, 'The job did not complete.'));
+    if (r.findings.length) {
+      const list = el('ul', { class: 'sec-findings' });
+      for (const f of r.findings) {
+        list.append(el('li', {},
+          riskPill(f.risk_level, txt(f.risk_level).toLowerCase()), ' ',
+          el('span', { class: 'sec-title' }, txt(f.title)),
+          el('div', { class: 'fix' }, el('code', {}, f.file ? f.file + (f.line ? ':' + f.line : '') : 'no location'), f.cwe ? ' · ' + txt(f.cwe) : '')));
+      }
+      b.append(list);
+    }
+    if (r.truncated) b.append(el('p', { class: 'note' }, 'showing the first ' + r.findings.length + '; run prism-cli security findings for all'));
+    s.append(b);
+  }
+  securityPentestRows(s, sec);
+  if (tms.length) {
+    s.append(el('h3', {}, 'Threat models'));
+    for (const t of tms) s.append(threatModelBlock(t, (sec && sec.threats_hint) || 'prism-cli security threats'));
+  }
+  return s;
+}
+
+const THREAT_LEVELS = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+/** "INFORMATION_DISCLOSURE" -> "information disclosure". */
+const strideText = (list) => (list || []).map((x) => txt(x).toLowerCase().replace(/_/g, ' ')).join(', ');
+
+/** One cached threat model per repo, in the code review blocks' compact style. */
+function threatModelBlock(t, hint) {
+  const b = el('div', { class: 'sec-repo' });
+  b.append(el('div', { class: 'sec-head' }, el('b', {}, txt(t.name)), t.current ? el('span', { class: 'tag' }, 'this repo') : null));
+  const docs = (t.scope_docs || []).length;
+  b.append(el('div', { class: 'fix' },
+    (t.pending ? 'started ' + when(t.started_at) : when(t.finished_at)) + ' · commit ' + txt(t.commit).slice(0, 12)
+    + ' · ' + (docs ? docs + ' scope doc' + (docs === 1 ? '' : 's') : 'source only') + ' · job ' + txt(t.job_id).slice(0, 12)));
+  const pills = el('div', { class: 'sec-pills' });
+  if (t.pending) {
+    // Results are local: the page only knows the job was started, not whether it has finished since.
+    pills.append(pill('warn', 'threat model running'));
+    if (t.stale) pills.append(pill('skipped', 'stale?'));
+    b.append(pills, el('p', { class: 'note' }, t.stale ? 'Started over 2 h ago and not fetched yet; it has most likely finished. ' : '', 'Fetch the threats with ', el('code', {}, hint), '.'));
+    return b;
+  }
+  if (t.status === 'error') pills.append(pill('error', txt(t.job_status).toLowerCase()));
+  else {
+    const counts = t.counts || {};
+    const shown = THREAT_LEVELS.filter((k) => (counts[k] || 0) > 0);
+    if (!shown.length) pills.append(pill('ok', 'no threats'));
+    for (const k of shown) pills.append(riskPill(k, counts[k] + ' ' + k.toLowerCase()));
+  }
+  b.append(pills);
+  if (t.reason) b.append(el('p', { class: 'note' }, txt(t.reason)));
+  if (t.overview) b.append(el('p', { class: 'note' }, txt(t.overview)));
+  if ((t.threats || []).length) {
+    const list = el('ul', { class: 'sec-findings' });
+    for (const x of t.threats) {
+      list.append(el('li', {},
+        riskPill(x.severity, txt(x.severity).toLowerCase()), ' ',
+        el('span', { class: 'sec-title' }, txt(x.title)),
+        (x.stride || []).length ? el('div', { class: 'fix' }, strideText(x.stride)) : null));
+    }
+    b.append(list);
+  }
+  if (t.more) b.append(el('p', { class: 'note' }, t.more + ' more; run ' + hint + ' for all'));
+  return b;
+}
+
+/** Penetration-test rows, in the same Security card below the code-review rows. */
+function securityPentestRows(s, sec) {
+  const rows = (sec && sec.pentests) || [];
+  if (!rows.length) return;
+  s.append(el('h3', {}, 'Penetration tests'));
+  for (const r of rows) {
+    const counts = r.counts || {};
+    const b = el('div', { class: 'sec-repo' });
+    b.append(el('div', { class: 'sec-head' }, el('b', {}, txt(r.name)), r.current ? el('span', { class: 'tag' }, 'this repo') : null));
+    b.append(el('div', { class: 'fix' },
+      (r.pending ? 'started ' + when(r.started_at) : when(r.finished_at)) + ' · ' + txt(r.target_host) + ' · job ' + txt(r.job_id).slice(0, 12)));
+    const pills = el('div', { class: 'sec-pills' });
+    if (r.pending) {
+      pills.append(pill('warn', 'pentest running'));
+      if (r.stale) pills.append(pill('skipped', 'stale?'));
+      b.append(pills, el('p', { class: 'note' }, r.stale ? 'Started over 6 h ago and not refreshed. ' : '', 'Refresh with ', el('code', {}, (sec && sec.pentest_hint) || 'prism-cli security pentest --status'), '.'));
+      s.append(b);
+      continue;
+    }
+    if (r.status === 'error') pills.append(pill('error', txt(r.job_status).toLowerCase()));
+    else {
+      const shown = RISKS.filter((k) => (counts[k] || 0) > 0);
+      if (!shown.length) pills.append(pill('ok', 'no findings'));
+      for (const k of shown) pills.append(riskPill(k, counts[k] + ' ' + k.toLowerCase()));
+    }
+    if (r.teardown_failed) pills.append(pill('error', 'teardown failed'));
+    b.append(pills);
+    if (r.reason) b.append(el('p', { class: 'note' }, txt(r.reason)));
+    if (r.teardown_failed) b.append(el('p', { class: 'note' }, 'The environment is still up (' + txt(r.teardown_failed.reason) + '). Retry with ', el('code', {}, 'prism-cli security pentest --cleanup'), '.'));
+    if (r.findings.length) {
+      const list = el('ul', { class: 'sec-findings' });
+      for (const f of r.findings) {
+        list.append(el('li', {},
+          riskPill(f.risk_level, txt(f.risk_level).toLowerCase()), ' ',
+          el('span', { class: 'sec-title' }, txt(f.title)),
+          f.confidence ? el('div', { class: 'fix' }, txt(f.confidence).toLowerCase() + ' confidence') : null));
+      }
+      b.append(list);
+    }
+    if (r.truncated) b.append(el('p', { class: 'note' }, 'showing the first ' + r.findings.length + '; run prism-cli security findings --pentest for all'));
+    s.append(b);
+  }
+}
+
+async function load() {
+  const main = document.getElementById('main'), meta = document.getElementById('meta');
+  meta.textContent = 'loading...';
+  let data;
+  try {
+    const res = await fetch('/api/data', { credentials: 'same-origin', cache: 'no-store' });
+    if (!res.ok) throw new Error('HTTP ' + res.status);
+    data = await res.json();
+  } catch (e) { meta.textContent = 'failed to load: ' + e.message; return; }
+  main.replaceChildren();
+  if (data.scope.error) main.append(el('section', { class: 'card wide' }, pill('error'), ' ', data.scope.error));
+  main.append(codewatchPanel(data), usagePanel(data.usage), setupPanel(data), securityPanel(data.security));
+  const c = data.overview.counts;
+  meta.textContent = c.repos + ' repos under ' + txt(data.scope.root_display) + ' · ' + c.codewatch + ' with codewatch' + (data.scope.truncated ? ' (scan capped)' : '') + ' · updated ' + when(data.generated_at);
+}
+document.getElementById('refresh').addEventListener('click', load);
+load();
+`;
+export function renderPage(nonce) {
+    // The nonce is base64 generated server-side; nothing user-derived is interpolated here.
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>PRISM dashboard</title><style nonce="${nonce}">${STYLE}</style></head>
+<body><header><h1>PRISM dashboard</h1><button id="refresh" type="button">Refresh</button><span class="meta" id="meta"></span></header>
+<main id="main"></main>
+<script nonce="${nonce}">${SCRIPT}</script></body></html>`;
+}
+//# sourceMappingURL=page.js.map

package/dist/src/dashboard/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCb,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Zd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,wFAAwF;IACxF,OAAO;;8CAEqC,KAAK,KAAK,KAAK;;;iBAG5C,KAAK,KAAK,MAAM,yBAAyB,CAAC;AAC3D,CAAC"}

package/dist/src/dashboard/payload.d.ts

@@ -0,0 +1,114 @@
+/**
+ * The one data document behind both `prism-cli dashboard --json` and the
+ * web UI's /api/data, so the two can never disagree. The overview rows are
+ * sorted here, not in the page, so `--json` carries the same order.
+ */
+import { type CodewatchPanel, type SecretScanning } from './codewatch.js';
+import { type DiscoverOptions } from './repos.js';
+import { type CheckItem, type CodewatchSetup, type MachineDeps, type SecuritySetup } from './setup.js';
+import { type GlobalStatus } from '../codewatch/globalHooks.js';
+export declare function tildeHome(p: string, home: string): string;
+import { type CodeburnExport, type UsagePanel } from './usage.js';
+import { type SecurityPanel } from './security.js';
+export declare const PAYLOAD_SCHEMA = "prism.dashboard.v2";
+export interface RepoPayload {
+    name: string;
+    path: string;
+    current: boolean;
+    hasPrism: boolean;
+    codewatch: CodewatchPanel;
+    setup: CodewatchSetup;
+    /** Security Agent, from the enable security marker. */
+    security: SecuritySetup;
+}
+/** One row of the setup table. */
+export interface SetupRow {
+    name: string;
+    path: string;
+    current: boolean;
+    status: CodewatchSetup['status'];
+    reviewer: string | null;
+    detail: string;
+    fix: string;
+    /** Global hooks cover this repo. */
+    global: boolean;
+    /** Security Agent row for this repo. */
+    security: SecuritySetup;
+    /** Shown inside the collapsed "repos without codewatch" group: missing or opted out, and not the current repo. */
+    collapsed: boolean;
+}
+/** One row of the codewatch summary table. */
+export interface CodewatchRow {
+    name: string;
+    path: string;
+    current: boolean;
+    high: number;
+    medium: number;
+    low: number;
+    lastRunAt: string | null;
+    /** Report id of the newest review, linked from the Last run cell. */
+    lastReviewId: string | null;
+    /** Reviewer of the last review, else the one that would run now. */
+    reviewer: string | null;
+    unscannedCommits: number;
+    /** Commits here were made while gitleaks was missing. */
+    gitleaksWarning: boolean;
+}
+/** A next step the page suggests. Read-only: the page shows the command, it never runs it. */
+export interface Suggestion {
+    id: 'codewatch-global';
+    /** info: a suggestion. warn: a foreign global core.hooksPath is in the way. */
+    style: 'info' | 'warn';
+    command: string;
+    reason: string;
+    /** Repos without codewatch (status missing; opted-out repos are not counted). */
+    missing: number;
+    /** The foreign global core.hooksPath, for the warn variant. */
+    currentHooksPath: string | null;
+}
+/** Minimum missing repos before the global install is suggested; one repo is served by its own fix line. */
+export declare const SUGGEST_GLOBAL_MIN_MISSING = 2;
+export declare function globalSuggestion(g: GlobalStatus, missing: number): Suggestion | null;
+export interface DashboardPayload {
+    /** repos: every repo found. codewatch: repos with both codewatch hooks installed. */
+    schema: typeof PAYLOAD_SCHEMA;
+    generated_at: string;
+    scope: {
+        root: string; /** root with the home directory shown as ~ */
+        root_display: string;
+        current_repo: string | null;
+        scan_ms: number;
+        truncated: boolean;
+        error: string | null;
+    };
+    repos: RepoPayload[];
+    overview: {
+        counts: {
+            repos: number;
+            codewatch: number;
+        };
+        setup: SetupRow[];
+        codewatch: CodewatchRow[];
+    };
+    machine: {
+        setup: CheckItem[];
+        secretScanning: SecretScanning;
+        globalHooks: GlobalStatus;
+    };
+    suggestions: Suggestion[];
+    usage: UsagePanel;
+    /** Cached Security Agent code review results (security-review), per repo. */
+    security: SecurityPanel;
+}
+export interface PayloadOptions extends DiscoverOptions {
+    trendRuns?: number;
+    exporter?: CodeburnExport;
+    machineDeps?: MachineDeps;
+    pathEnv?: string;
+}
+/** The current repo first, then installed, bypassed (warn), missing and opted-out repos, each by name. */
+export declare function sortSetupRows(rows: SetupRow[]): SetupRow[];
+/** Most high findings first, then medium, then low, then by name. */
+export declare function sortCodewatchRows(rows: CodewatchRow[]): CodewatchRow[];
+export declare function buildPayload(opts: PayloadOptions): Promise<DashboardPayload>;
+//# sourceMappingURL=payload.d.ts.map

package/dist/src/dashboard/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../src/dashboard/payload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA2C,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnH,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAsF,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3L,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAK9E,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGzD;AACD,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpE,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,cAAc,CAAC;IAC1B,KAAK,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,wCAAwC;IACxC,QAAQ,EAAE,aAAa,CAAC;IACxB,kHAAkH;IAClH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qEAAqE;IACrE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,4GAA4G;AAC5G,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAYpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,MAAM,EAAE,OAAO,cAAc,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,CAAC,8CAA8C;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACrL,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE;QAAE,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QAAC,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IACzG,OAAO,EAAE;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,cAAc,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,YAAY,CAAA;KAAE,CAAC;IAC3F,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,CAAC;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,eAAe;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAG1D;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAEtE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgDlF"}