@prism-d1/cli 1.1.2 → 1.3.0

package/dist/assets/infra/lib/lambda/pricing-refresh.ts

@@ -0,0 +1,352 @@
+/**
+ * PRISM D1 — daily price-table refresh and $0-span reprice.
+ *
+ * Runs once a day on an EventBridge schedule:
+ *
+ *   1. Refresh. Fetch LiteLLM's price file, trim it to four rates per model,
+ *      validate it against the table currently in S3, and write it to
+ *      s3://<archive>/pricing/litellm-prices.json. A refused or failed fetch
+ *      keeps the previous table in service and fails the invocation at the end,
+ *      so the Lambda Errors metric shows it.
+ *
+ *   2. Reprice. Scan for usage spans stored with cost 0 but tokens > 0. These
+ *      are spans no price table matched when they arrived; a model is often
+ *      added to LiteLLM days after people start using it. Each one that now
+ *      matches is corrected in one transaction with its OTEL#DAY aggregate, so
+ *      the dashboards and the CloudWatch metrics (via the table stream) pick up
+ *      the difference.
+ *
+ * Spans written before the receiver stored cache-token counts lack them. For
+ * those, the cache counts are recovered from the raw OTLP archive; without
+ * them, cached input would go unpriced or be billed at the full input rate.
+ *
+ * Invoke manually with {"skipRefresh": true} to reprice without fetching, or
+ * {"dryRun": true} to report what would change without writing.
+ */
+import {
+  DynamoDBClient,
+  ScanCommand,
+  TransactWriteItemsCommand,
+  TransactionCanceledException,
+  type ScanCommandOutput,
+} from '@aws-sdk/client-dynamodb';
+import {
+  S3Client,
+  GetObjectCommand,
+  PutObjectCommand,
+  ListObjectsV2Command,
+  NoSuchKey,
+} from '@aws-sdk/client-s3';
+import {
+  LITELLM_PRICES_URL, slimLiteLLM, validateTable, toDocument, parseDocument, PriceDocument,
+} from './pricing/price-table';
+import { PRICES_KEY, BUNDLED_PRICES } from './pricing/price-source';
+import { planReprice, lacksCacheCounts, groupByAggregate, RepricePlan, SpanItem } from './pricing/reprice';
+
+const dynamo = new DynamoDBClient({});
+const s3 = new S3Client({});
+
+const TABLE = process.env.AI_USAGE_TABLE || 'prism-d1-ai-usage';
+const BUCKET = process.env.ARCHIVE_BUCKET || '';
+const FETCH_TIMEOUT_MS = 30_000;
+const WRITE_CONCURRENCY = 10;
+/** Upper bound on the raw download; LiteLLM's file is about 3 MB today. */
+const MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024;
+
+interface RefreshEvent {
+  skipRefresh?: boolean;
+  dryRun?: boolean;
+}
+
+async function readCurrentTable(): Promise<PriceDocument | null> {
+  try {
+    const res = await s3.send(new GetObjectCommand({ Bucket: BUCKET, Key: PRICES_KEY }));
+    return parseDocument(JSON.parse(await res.Body!.transformToString()));
+  } catch (e) {
+    if (e instanceof NoSuchKey) return null;
+    throw e;
+  }
+}
+
+async function fetchLiteLLM(): Promise<unknown> {
+  const res = await fetch(LITELLM_PRICES_URL, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+  if (!res.ok) throw new Error(`HTTP ${res.status} from ${LITELLM_PRICES_URL}`);
+  const len = Number(res.headers.get('content-length') ?? 0);
+  if (len > MAX_DOWNLOAD_BYTES) throw new Error(`response is ${len} bytes, over the ${MAX_DOWNLOAD_BYTES} limit`);
+  const text = await res.text();
+  if (text.length > MAX_DOWNLOAD_BYTES) throw new Error(`response over the ${MAX_DOWNLOAD_BYTES} byte limit`);
+  return JSON.parse(text);
+}
+
+/** Step 1. Returns the table to reprice with and, if the refresh failed, why. */
+async function refresh(dryRun: boolean): Promise<{ doc: PriceDocument; failure: string | null }> {
+  const current = await readCurrentTable();
+  const fallback = current ?? BUNDLED_PRICES;
+  let next;
+  try {
+    next = slimLiteLLM(await fetchLiteLLM());
+  } catch (e) {
+    return { doc: fallback, failure: `fetch failed: ${(e as Error).message}` };
+  }
+  // Validate against the S3 table, or the bundled snapshot on first run, so
+  // even the first write is checked against something.
+  const v = validateTable(next, fallback.entries);
+  if (!v.ok) {
+    return { doc: fallback, failure: `refused new table: ${v.reasons.join('; ')}` };
+  }
+  const doc = toDocument(next, new Date().toISOString());
+  const added = Object.keys(next).filter((k) => !fallback.entries[k]);
+  console.log(JSON.stringify({
+    msg: 'price table refreshed',
+    entries: doc.entryCount,
+    previousEntries: fallback.entryCount,
+    previousFetchedAt: fallback.fetchedAt,
+    added: added.length,
+    addedSample: added.slice(0, 20),
+    rateJumps: v.jumps.slice(0, 20),
+    dryRun,
+  }));
+  if (!dryRun) {
+    await s3.send(new PutObjectCommand({
+      Bucket: BUCKET,
+      Key: PRICES_KEY,
+      Body: JSON.stringify(doc),
+      ContentType: 'application/json',
+    }));
+  }
+  return { doc, failure: null };
+}
+
+/** Every span item stored at cost 0. Usage spans only; tokens are checked in planReprice. */
+async function scanZeroCostSpans(): Promise<SpanItem[]> {
+  const items: SpanItem[] = [];
+  let key: ScanCommandOutput['LastEvaluatedKey'];
+  do {
+    const res = await dynamo.send(new ScanCommand({
+      TableName: TABLE,
+      // Every attribute name is a placeholder: several (timestamp, model) are
+      // or may become DynamoDB reserved words, and a missed one fails the scan.
+      FilterExpression: '#rt = :span AND #cost = :zero',
+      ProjectionExpression: '#pk, #sk, #rt, #cost, #tool, #model, #ts, #in, #out, #cr, #cw',
+      ExpressionAttributeNames: {
+        '#pk': 'pk', '#sk': 'sk', '#rt': 'record_type', '#cost': 'cost_usd', '#tool': 'tool',
+        '#model': 'model', '#ts': 'timestamp', '#in': 'input_tokens', '#out': 'output_tokens',
+        '#cr': 'cache_read_tokens', '#cw': 'cache_write_tokens',
+      },
+      ExpressionAttributeValues: { ':span': { S: 'OTEL_SPAN' }, ':zero': { N: '0' } },
+      ...(key ? { ExclusiveStartKey: key } : {}),
+    }));
+    items.push(...((res.Items ?? []) as SpanItem[]));
+    key = res.LastEvaluatedKey;
+  } while (key);
+  return items;
+}
+
+/**
+ * Recover cache-token counts for the given span ids from the raw OTLP archive.
+ * Reads only partitions on or after the earliest span's date (a span is
+ * archived when pushed, which is never before it happened), and stops once
+ * every id is found.
+ */
+async function cacheCountsFromArchive(
+  spanIds: Set<string>,
+  earliestDay: string,
+): Promise<Map<string, { cacheReadTokens: number; cacheWriteTokens: number }>> {
+  const found = new Map<string, { cacheReadTokens: number; cacheWriteTokens: number }>();
+  let token: string | undefined;
+  let objects = 0;
+  do {
+    const page = await s3.send(new ListObjectsV2Command({
+      Bucket: BUCKET,
+      Prefix: 'otlp/',
+      StartAfter: `otlp/dt=${earliestDay}`,
+      ContinuationToken: token,
+    }));
+    for (const obj of page.Contents ?? []) {
+      if (!obj.Key) continue;
+      objects++;
+      const res = await s3.send(new GetObjectCommand({ Bucket: BUCKET, Key: obj.Key }));
+      let payload: { resourceSpans?: Array<{ scopeSpans?: Array<{ spans?: Array<Record<string, unknown>> }> }> };
+      try {
+        payload = JSON.parse(await res.Body!.transformToString());
+      } catch {
+        continue;
+      }
+      for (const rs of payload.resourceSpans ?? []) {
+        for (const ss of rs.scopeSpans ?? []) {
+          for (const sp of ss.spans ?? []) {
+            const id = String(sp.spanId ?? '').toLowerCase();
+            if (!spanIds.has(id) || found.has(id)) continue;
+            const attrs = (sp.attributes ?? []) as Array<{ key: string; value: { intValue?: string | number } }>;
+            const get = (k: string) => Math.max(0, Number(attrs.find((a) => a.key === k)?.value?.intValue ?? 0) || 0);
+            found.set(id, {
+              cacheReadTokens: get('ai.cache_read_tokens'),
+              cacheWriteTokens: get('ai.cache_write_tokens'),
+            });
+          }
+        }
+      }
+      if (found.size === spanIds.size) {
+        console.log(`[archive] found all ${found.size} spans after ${objects} objects`);
+        return found;
+      }
+    }
+    token = page.NextContinuationToken;
+  } while (token);
+  console.log(`[archive] found ${found.size} of ${spanIds.size} spans in ${objects} objects`);
+  return found;
+}
+
+type WriteOutcome = 'repriced' | 'alreadyPriced' | 'aggregateMissing';
+
+/**
+ * One transaction: set the span's cost (only if it is still 0) and add the
+ * same amount to its daily aggregate. The condition makes a re-run, or two
+ * overlapping runs, a no-op instead of a double count.
+ */
+async function applyPlan(p: RepricePlan, now: string): Promise<WriteOutcome> {
+  try {
+    await dynamo.send(new TransactWriteItemsCommand({
+      TransactItems: [
+        {
+          Update: {
+            TableName: TABLE,
+            Key: { pk: { S: p.pk }, sk: { S: p.sk } },
+            UpdateExpression:
+              'SET #cost = :cost, #est = :t, #src = :src, #key = :key, #cr = :cr, #cw = :cw, #at = :now',
+            ConditionExpression: '#cost = :zero',
+            ExpressionAttributeNames: {
+              '#cost': 'cost_usd', '#est': 'cost_estimated', '#src': 'cost_source', '#key': 'priced_key',
+              '#cr': 'cache_read_tokens', '#cw': 'cache_write_tokens', '#at': 'repriced_at',
+            },
+            ExpressionAttributeValues: {
+              ':cost': { N: String(p.costUsd) }, ':t': { BOOL: true }, ':src': { S: 'reprice' },
+              ':key': { S: p.pricedKey }, ':cr': { N: String(p.cacheReadTokens) },
+              ':cw': { N: String(p.cacheWriteTokens) }, ':now': { S: now }, ':zero': { N: '0' },
+            },
+          },
+        },
+        {
+          Update: {
+            TableName: TABLE,
+            Key: { pk: { S: p.pk }, sk: { S: p.aggregateSk } },
+            UpdateExpression: 'ADD #cost :cost SET #upd = :now',
+            ConditionExpression: 'attribute_exists(#pk)',
+            ExpressionAttributeNames: { '#cost': 'cost_usd', '#upd': 'updated_at', '#pk': 'pk' },
+            ExpressionAttributeValues: { ':cost': { N: String(p.costUsd) }, ':now': { S: now } },
+          },
+        },
+      ],
+    }));
+    return 'repriced';
+  } catch (e) {
+    if (e instanceof TransactionCanceledException) {
+      const [span, agg] = e.CancellationReasons ?? [];
+      if (span?.Code === 'ConditionalCheckFailed') return 'alreadyPriced';
+      if (agg?.Code === 'ConditionalCheckFailed') return 'aggregateMissing';
+    }
+    throw e;
+  }
+}
+
+const CONFLICT_RETRIES = 5;
+
+/**
+ * The receiver can still update the same aggregate while a reprice runs, so a
+ * TransactionConflict is retried with backoff. Retrying is safe: the span's
+ * `cost_usd = 0` condition means a write that did land is never applied twice.
+ */
+async function applyPlanWithRetry(p: RepricePlan, now: string): Promise<WriteOutcome> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await applyPlan(p, now);
+    } catch (e) {
+      const conflict = e instanceof TransactionCanceledException
+        && (e.CancellationReasons ?? []).some((r) => r?.Code === 'TransactionConflict');
+      if (!conflict || attempt >= CONFLICT_RETRIES) throw e;
+      await new Promise((r) => setTimeout(r, 100 * 2 ** attempt + Math.random() * 100));
+    }
+  }
+}
+
+/** Step 2. */
+async function reprice(doc: PriceDocument, dryRun: boolean) {
+  const items = await scanZeroCostSpans();
+
+  // Price once without archive data to learn which legacy spans are worth
+  // the archive read: only spans whose model now has a price.
+  const legacy = items.filter((i) => lacksCacheCounts(i) && planReprice(i, doc.entries));
+  let archived = new Map<string, { cacheReadTokens: number; cacheWriteTokens: number }>();
+  if (legacy.length > 0 && BUCKET) {
+    const ids = new Set(legacy.map((i) => i.sk!.S!.slice(i.sk!.S!.lastIndexOf('#') + 1)));
+    const earliest = legacy.map((i) => i.timestamp!.S!.slice(0, 10)).sort()[0];
+    archived = await cacheCountsFromArchive(ids, earliest);
+  }
+
+  const plans = items.map((i) => planReprice(i, doc.entries, archived)).filter((p): p is RepricePlan => p !== null);
+  const unmatched = new Map<string, number>();
+  for (const i of items) {
+    if (!planReprice(i, doc.entries, archived)) {
+      const tokens = Number(i.input_tokens?.N ?? 0) + Number(i.output_tokens?.N ?? 0);
+      if (tokens > 0) {
+        const m = i.model?.S || 'unknown';
+        unmatched.set(m, (unmatched.get(m) ?? 0) + 1);
+      }
+    }
+  }
+
+  const counts: Record<WriteOutcome, number> = { repriced: 0, alreadyPriced: 0, aggregateMissing: 0 };
+  let addedUsd = 0;
+  const byModel: Record<string, { spans: number; usd: number; key: string }> = {};
+  const cacheSources: Record<string, number> = {};
+  const now = new Date().toISOString();
+
+  const record = (p: RepricePlan, o: WriteOutcome) => {
+    counts[o]++;
+    if (o !== 'repriced') return;
+    addedUsd += p.costUsd;
+    const m = (byModel[p.model || 'unknown'] ??= { spans: 0, usd: 0, key: p.pricedKey });
+    m.spans++;
+    m.usd += p.costUsd;
+    cacheSources[p.cacheSource] = (cacheSources[p.cacheSource] ?? 0) + 1;
+  };
+
+  // Every span of one user-day adds to the same OTEL#DAY item, and DynamoDB
+  // cancels concurrent transactions that touch one item (TransactionConflict).
+  // So spans sharing an aggregate are written one after another, while
+  // different aggregates run in parallel.
+  const groups = [...groupByAggregate(plans).values()];
+  for (let i = 0; i < groups.length; i += WRITE_CONCURRENCY) {
+    const chunk = groups.slice(i, i + WRITE_CONCURRENCY);
+    await Promise.all(chunk.map(async (group) => {
+      for (const p of group) record(p, dryRun ? 'repriced' : await applyPlanWithRetry(p, now));
+    }));
+  }
+  for (const m of Object.values(byModel)) m.usd = Math.round(m.usd * 100) / 100;
+
+  return {
+    zeroCostSpans: items.length,
+    ...counts,
+    addedUsd: Math.round(addedUsd * 100) / 100,
+    byModel,
+    cacheSources,
+    stillUnpriced: Object.fromEntries([...unmatched.entries()].slice(0, 30)),
+  };
+}
+
+export async function handler(event: RefreshEvent = {}): Promise<Record<string, unknown>> {
+  const dryRun = event.dryRun === true;
+  const { doc, failure } = event.skipRefresh
+    ? { doc: (await readCurrentTable()) ?? BUNDLED_PRICES, failure: null }
+    : await refresh(dryRun);
+  if (failure) console.error(`[pricing] ${failure}; repricing with table from ${doc.fetchedAt || 'bundle'}`);
+
+  const result = await reprice(doc, dryRun);
+  const summary = { msg: 'reprice complete', dryRun, tableFetchedAt: doc.fetchedAt, ...result };
+  console.log(JSON.stringify(summary));
+
+  // Fail after repricing, not before: a stale table still prices what it can,
+  // and the error makes the stale table visible on the Lambda Errors metric.
+  if (failure) throw new Error(`price refresh failed: ${failure}`);
+  return summary;
+}

package/dist/assets/infra/lib/lambda/velocity-widget.ts

@@ -27,6 +27,8 @@ const RECEIVER_FUNCTION = process.env.RECEIVER_FUNCTION || 'prism-d1-otel-receiv
 interface WidgetEvent {
   describe?: boolean;
   view?: string;
+  /** Developer filter for views that support it; 'all' or unset = organization. */
+  user?: string;
   widgetContext?: { timeRange?: { start: number; end: number }; theme?: string };
 }
 
@@ -37,7 +39,8 @@ the attribution store. Full history, real event timestamps.
 ### Parameters
 | Name | Type | Default | Description |
 |------|------|---------|-------------|
-| view | string | dora | dora, aidora, repos, eval, governance, agents, security, exec, exec-security, ciso-exposure, ciso-sla, ciso-risk, ciso-shiftleft, ciso-classes |
+| view | string | dora | dora, aidora, repos, eval, governance, agents, security, exec, exec-security, ciso-exposure, ciso-sla, ciso-risk, ciso-shiftleft, ciso-classes, tool-usage-top, tool-usage-trend |
+| user | string | all | Developer identity for tool-usage-* views |
 
 The \`exec\` view additionally computes an **observed** PRISM level from
 outcome metrics (capped at L4 — L5 requires an autonomy signal that no
@@ -1990,6 +1993,124 @@ async function renderMergeRateTrend(fromIso: string, toIso: string, days: number
 
 // ---- Handler ----
 
+// ---- Views: tool-usage-top / tool-usage-trend (tools the model invoked) ----
+
+/** Dashboard PATTERN token left unreplaced, or blank, means org scope. */
+function widgetUser(user: string | undefined): string {
+  const u = (user ?? '').trim();
+  return !u || u === 'PRISM_USER_FILTER_TOKEN' ? 'all' : u;
+}
+
+async function fetchToolUsage(fromIso: string, toIso: string, user: string): Promise<any> {
+  return invokeReceiver('/v1/tool-usage',
+    `user=${encodeURIComponent(user)}&from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+}
+
+const TOOL_USAGE_NOTE =
+  'Counts model calls that invoked each tool (codeburn ai.tools), by the day of the call. ' +
+  'Providers that do not report tool calls contribute nothing here.';
+
+/**
+ * Top tools and MCP servers. Reads the receiver's OTEL#TOOLDAY rollups rather
+ * than a CloudWatch metric for the same reasons as the spend tiles: full
+ * history, bucketed by call date, and scoped by the Developer variable.
+ */
+async function renderToolUsageTop(fromIso: string, toIso: string, user: string, p: Palette): Promise<string> {
+  let r: any;
+  try {
+    r = await fetchToolUsage(fromIso, toIso, user);
+  } catch (err) {
+    return emptyState('tool usage', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+  const tools: Array<{ name: string; mcpServer: string; calls: number; byAiTool: Record<string, number> }> = r?.tools ?? [];
+  if (tools.length === 0) {
+    return emptyState('tool usage', 'Run `codeburn sync push` with a codeburn version that sends ai.tools.', p);
+  }
+  const servers: Array<{ server: string; calls: number; tools: number }> = r?.mcpServers ?? [];
+  const mcpCalls = servers.reduce((s, x) => s + x.calls, 0);
+  const total = r?.totalToolCalls ?? 0;
+
+  const top = tools.slice(0, 12);
+  const maxT = top[0]?.calls ?? 0;
+  const toolRows = top.map(t => [
+    `${esc(t.name)}${bar(t.calls, maxT, p.accent)}`,
+    esc(Object.entries(t.byAiTool).sort((a, b) => b[1] - a[1]).map(([k]) => k).join(', ')),
+    num(t.calls),
+  ]);
+  const topS = servers.slice(0, 8);
+  const maxS = topS[0]?.calls ?? 0;
+  const serverRows = topS.map(s => [`${esc(s.server)}${bar(s.calls, maxS, p.ok)}`, num(s.tools), num(s.calls)]);
+
+  return `
+    ${kpiRow([
+      { label: 'Tool calls', value: num(total), note: user === 'all' ? 'organization' : user },
+      { label: 'Distinct tools', value: num(tools.length) },
+      { label: 'MCP share', value: pct(total > 0 ? (mcpCalls / total) * 100 : null), note: `${num(servers.length)} MCP servers` },
+    ], p)}
+    <div style="display:flex;gap:16px;flex-wrap:wrap">
+      <div style="flex:3;min-width:280px">${table(['Tool', 'AI tools', 'Calls'], toolRows, p, 2)}</div>
+      <div style="flex:2;min-width:220px">${serverRows.length > 0
+        ? table(['MCP server', 'Tools', 'Calls'], serverRows, p, 1)
+        : `<div style="color:${p.mut};font-size:11px;margin-top:14px">No MCP tool calls in range.</div>`}</div>
+    </div>
+    ${footnote(TOOL_USAGE_NOTE, p)}
+  `;
+}
+
+/** Daily (or weekly, past 21 days) tool calls, same bucketing as ai-spend-trend. */
+async function renderToolUsageTrend(fromIso: string, toIso: string, days: number, user: string, p: Palette): Promise<string> {
+  let r: any;
+  try {
+    r = await fetchToolUsage(fromIso, toIso, user);
+  } catch (err) {
+    return emptyState('tool usage', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+  const dayBuckets: Array<{ date: string; calls: number }> = r?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('tool usage', 'Run `codeburn sync push` with a codeburn version that sends ai.tools.', p);
+  }
+  const useWeekly = days > 21;
+  let buckets: Array<{ label: string; calls: number }>;
+  if (useWeekly) {
+    const weeks = new Map<string, number>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      dt.setDate(dt.getDate() - dt.getDay());
+      const key = dt.toISOString().slice(0, 10);
+      weeks.set(key, (weeks.get(key) ?? 0) + d.calls);
+    }
+    buckets = [...weeks.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([label, calls]) => ({ label, calls }));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, calls: d.calls }));
+  }
+  const total = buckets.reduce((s, b) => s + b.calls, 0);
+  const maxC = Math.max(...buckets.map(b => b.calls), 0);
+  const chartW = 500;
+  const chartH = 100;
+  const slot = chartW / buckets.length;
+  const barW = Math.max(2, slot * 0.7);
+  const bars = buckets.map((b, i) => {
+    const h = maxC > 0 ? (b.calls / maxC) * (chartH - 10) : 0;
+    return `<rect x="${i * slot + (slot - barW) / 2}" y="${chartH - h}" width="${barW}" height="${h}" fill="${p.accent}" opacity="0.85" />`;
+  }).join('');
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">Tool calls (${useWeekly ? 'weekly' : 'daily'})${user === 'all' ? '' : ` · ${esc(user)}`}</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">${num(total)} total</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${bars}
+        <text x="2" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 2}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      ${footnote(TOOL_USAGE_NOTE, p)}
+    </div>
+  `;
+}
+
+// ---- Handler ----
+
 export async function handler(event: WidgetEvent): Promise<string> {
   if (event.describe) return DOCS;
 
@@ -2028,6 +2149,8 @@ export async function handler(event: WidgetEvent): Promise<string> {
       case 'cost-per-commit-trend': body = await renderCostPerCommitTrend(fromIso, toIso, days, p); break;
       case 'ai-spend-trend': body = await renderAiSpendTrend(fromIso, toIso, days, p); break;
       case 'merge-rate-trend': body = await renderMergeRateTrend(fromIso, toIso, days, p); break;
+      case 'tool-usage-top': body = await renderToolUsageTop(fromIso, toIso, widgetUser(event.user), p); break;
+      case 'tool-usage-trend': body = await renderToolUsageTrend(fromIso, toIso, days, widgetUser(event.user), p); break;
       default: body = `<div style="color:${p.danger}">Unknown view: ${esc(view)}</div>`;
     }
     return `<div style="font-family:'Amazon Ember',Helvetica,Arial,sans-serif;color:${p.fg};font-size:13px">${body}</div>`;

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -15,6 +15,7 @@ import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import { PrismVpcConstruct } from './constructs/prism-vpc-construct';
 import { GuardrailEnforcerConstruct } from './constructs/guardrail-enforcer-construct';
 import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+import { addSecurityAgentResources } from './security-agent-resources';
 import { OtelCollectorConstruct } from './constructs/otel-collector-construct';
 import { NagSuppressions } from 'cdk-nag';
 
@@ -613,116 +614,7 @@ export class MetricsPipelineStack extends cdk.Stack {
     // -------------------------------------------------------
     const enableSecurityAgent = this.node.tryGetContext('enableSecurityAgent') === 'true';
     if (enableSecurityAgent) {
-      this.securityAgent = new SecurityAgentConstruct(this, 'SecurityAgent', {
-        agentSpaceName: 'prism-d1-security',
-        description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
-        kmsKey: prismKmsKey,
-        codeRemediationStrategy: 'DISABLED',
-        tags: {
-          'prism:pillar': 'security',
-        },
-      });
-
-      // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
-      // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
-      // with name pattern prism-d1-github-oidc-*.
-      this.securityAgent.scanBucket.addToResourcePolicy(
-        new iam.PolicyStatement({
-          effect: iam.Effect.ALLOW,
-          principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
-          actions: ['s3:PutObject', 's3:GetObject'],
-          resources: [this.securityAgent.scanBucket.arnForObjects('*')],
-          conditions: {
-            ArnLike: {
-              'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
-            },
-          },
-        }),
-      );
-
-      // Create a managed policy for Continuum scan API access.
-      // Attached to the OIDC role by the bootstrapper setup script.
-      const continuumCiPolicy = new iam.ManagedPolicy(this, 'ContinuumCiPolicy', {
-        managedPolicyName: 'prism-d1-continuum-ci-scan',
-        description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
-        statements: [
-          new iam.PolicyStatement({
-            sid: 'ContinuumScanAPIs',
-            effect: iam.Effect.ALLOW,
-            actions: [
-              'securityagent:StartCodeReviewJob',
-              'securityagent:BatchGetCodeReviewJobs',
-              'securityagent:BatchGetCodeReviewJobTasks',
-              'securityagent:ListFindings',
-              'securityagent:BatchGetFindings',
-              'securityagent:CreateCodeReview',
-              'securityagent:ListCodeReviews',
-            ],
-            resources: [
-              `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
-            ],
-          }),
-          new iam.PolicyStatement({
-            sid: 'PassRoleForCodeReview',
-            effect: iam.Effect.ALLOW,
-            actions: ['iam:PassRole'],
-            resources: [this.securityAgent.serviceRole.roleArn],
-            conditions: {
-              StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
-            },
-          }),
-          new iam.PolicyStatement({
-            sid: 'ScanBucketWrite',
-            effect: iam.Effect.ALLOW,
-            actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
-            resources: [
-              this.securityAgent.scanBucket.bucketArn,
-              this.securityAgent.scanBucket.arnForObjects('*'),
-            ],
-          }),
-          new iam.PolicyStatement({
-            sid: 'KMSForScanBucket',
-            effect: iam.Effect.ALLOW,
-            actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
-            resources: [prismKmsKey.keyArn],
-          }),
-          new iam.PolicyStatement({
-            sid: 'SSMReadConfig',
-            effect: iam.Effect.ALLOW,
-            actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
-            resources: [
-              `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
-            ],
-          }),
-        ],
-      });
-
-      NagSuppressions.addResourceSuppressions(
-        continuumCiPolicy,
-        [
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
-            appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
-          },
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
-            appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
-          },
-          {
-            id: 'AwsSolutions-IAM5',
-            reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
-            appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
-          },
-        ],
-        true,
-      );
-
-      new cdk.CfnOutput(this, 'ContinuumCiPolicyArn', {
-        value: continuumCiPolicy.managedPolicyArn,
-        description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
-      });
+      this.securityAgent = addSecurityAgentResources(this, prismKmsKey);
     }
 
     // -------------------------------------------------------