@prism-d1/cli 1.2.0 → 1.3.0

package/dist/src/commands/enable/security.d.ts

@@ -0,0 +1,41 @@
+import { type Deps, type SecurityOptions } from '../../security/setup.js';
+export declare function defaultDeps(opts: SecurityOptions): Deps;
+export declare const SECURITY_OPTIONS: {
+    flags: string;
+    description: string;
+    default?: string;
+    parser?: (v: string, prev?: string[]) => string[];
+}[];
+/** Test seams: everything else uses the real runners, console and process. */
+export interface RunHooks {
+    deps?: (opts: SecurityOptions) => Deps;
+    error?: (line: string) => void;
+    exit?: (code: number) => void;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * The one entry point for `enable security` and its `securityagent setup`
+ * alias. Abort errors are already printed by enableSecurity; anything else
+ * (a failed npm or cdk run, a JSON parse, git or fs) is caught here and
+ * printed as one redacted line plus a hint, never as a raw stack or an
+ * unhandled rejection. PRISM_DEBUG=1 adds the redacted stack.
+ */
+export declare function runEnableSecurity(opts: SecurityOptions, hooks?: RunHooks): Promise<void>;
+/**
+ * Shared by every Security Agent command (enable security, its alias,
+ * security code-review, security findings): runs `body`, turns any error that
+ * is not an Abort into one redacted line plus a hint, and exits non-zero.
+ */
+export declare function runGuarded(body: () => Promise<number>, hooks?: Pick<RunHooks, 'error' | 'exit' | 'env'>): Promise<void>;
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+        default?: string;
+        parser?: (v: string, prev?: string[]) => string[];
+    }[];
+    action: typeof runEnableSecurity;
+};
+export default _default;
+//# sourceMappingURL=security.d.ts.map

package/dist/src/commands/enable/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../src/commands/enable/security.ts"],"names":[],"mappings":"AASA,OAAO,EAA+C,KAAK,IAAI,EAAE,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAqDvH,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAqBvD;AAID,eAAO,MAAM,gBAAgB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,EAQzI,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,GAAE,QAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlG;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,GAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjI;;;;eAhDuC,MAAM;qBAAe,MAAM;kBAAY,MAAM;iBAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE;;;;AAkDxI,wBAIE"}

package/dist/src/commands/enable/security.js

@@ -0,0 +1,130 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
+import { aws } from '../../utils/aws.js';
+import { run } from '../../utils/exec.js';
+import { getAssetPath } from '../../utils/root.js';
+import { describeUnexpectedError } from '../../security/errors.js';
+import { enableSecurity } from '../../security/setup.js';
+/** Room for the full synth and diff output of the whole app. */
+const CDK_OUTPUT_MAX_BUFFER = 64 * 1024 * 1024;
+/** Resolved on first use, so importing this module (tests, --help) needs no built assets. */
+let infraDir = null;
+const INFRA = () => (infraDir ??= getAssetPath(import.meta.url, 'infra'));
+/** npm_* variables from the outer `npm` would leak into the infra project's own npm/cdk runs. */
+function cleanEnv(extra) {
+    const env = { ...process.env, ...extra };
+    for (const k of Object.keys(env))
+        if (k.startsWith('npm_'))
+            delete env[k];
+    return env;
+}
+function ensureInfraDeps() {
+    if (existsSync(resolve(INFRA(), 'node_modules')))
+        return;
+    console.log('Installing the CDK app dependencies (local, one time)...');
+    execFileSync('npm', ['install', '--no-audit', '--no-fund'], { cwd: INFRA(), stdio: 'inherit', env: cleanEnv({}) });
+}
+/**
+ * CDK runs with the default credential chain unless --profile was given, and
+ * always in the resolved region, so every step works in the same place.
+ */
+function cdkRunner(opts) {
+    const bin = () => resolve(INFRA(), 'node_modules/.bin/cdk');
+    const profile = opts.profile ? ['--profile', opts.profile] : [];
+    const env = (e) => cleanEnv({ CDK_DEFAULT_ACCOUNT: e.account, CDK_DEFAULT_REGION: e.region, AWS_DEFAULT_REGION: e.region, AWS_REGION: e.region, AWS_PAGER: '' });
+    return {
+        synth(outDir, context, e) {
+            ensureInfraDeps();
+            const ctx = Object.entries(context).flatMap(([k, v]) => ['-c', `${k}=${v}`]);
+            const r = spawnSync(bin(), ['synth', '--quiet', '-o', outDir, ...ctx, ...profile], { cwd: INFRA(), env: env(e), encoding: 'utf8', maxBuffer: CDK_OUTPUT_MAX_BUFFER });
+            return { ok: r.status === 0, stdout: r.stdout || '', stderr: `${r.stderr || ''}${r.error ? r.error.message : ''}` };
+        },
+        diff(outDir, stack, e) {
+            // cdk diff prints to stderr; keep both streams.
+            const r = spawnSync(bin(), ['diff', '--app', outDir, stack, '--exclusively', '--no-color', ...profile], { cwd: INFRA(), env: env(e), encoding: 'utf8', maxBuffer: CDK_OUTPUT_MAX_BUFFER });
+            return { ok: r.status === 0, output: `${r.stdout || ''}${r.stderr || ''}` };
+        },
+        deploy(outDir, stack, e, { approveAll }) {
+            // Interactive: CDK's own default (--require-approval broadening) also asks
+            // before IAM/security-group broadening. --yes is the user's explicit
+            // approval, given after seeing the plan, so CDK is not asked again.
+            const approval = approveAll ? ['--require-approval', 'never'] : [];
+            const r = spawnSync(bin(), ['deploy', '--app', outDir, stack, '--exclusively', ...approval, ...profile], { cwd: INFRA(), env: env(e), stdio: 'inherit' });
+            return r.status === 0;
+        },
+    };
+}
+export function defaultDeps(opts) {
+    const target = opts.profile ? { profile: opts.profile } : {};
+    return {
+        aws: (args, region) => aws([...args, '--region', region], { ...target, env: { AWS_PAGER: '' } }),
+        configRegion: (profile) => {
+            const r = run('aws', ['configure', 'get', 'region', ...(profile ? ['--profile', profile] : [])]);
+            return r.ok && r.stdout ? r.stdout : null;
+        },
+        env: process.env,
+        awsVersion: () => { const r = run('aws', ['--version']); return r.ok ? r.stdout : null; },
+        cdk: cdkRunner(opts),
+        git: (args) => run('git', args),
+        makeTempDir: () => mkdtempSync(join(tmpdir(), 'prism-enable-security-')),
+        isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
+        ask: (q) => new Promise((done) => {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            rl.question(q, (a) => { rl.close(); done(a); });
+        }),
+        log: (line = '') => console.log(line),
+        now: () => new Date(),
+    };
+}
+const collect = (v, prev = []) => [...prev, v];
+export const SECURITY_OPTIONS = [
+    { flags: '--profile <name>', description: 'AWS CLI profile (default: none; the standard credential chain, e.g. AWS_PROFILE, env keys, SSO, instance role)' },
+    { flags: '--region <region>', description: 'AWS region (default: AWS_REGION, AWS_DEFAULT_REGION, else the profile\'s configured region; refuses when none is set)' },
+    { flags: '--yes', description: 'Approve the changes without a prompt (CI and other non-interactive use)' },
+    { flags: '--dry-run', description: 'Run every read-only step and print the plan, including the exact calls; change nothing' },
+    { flags: '--status', description: 'Read-only report: credentials, stack, agent space, application, code review, SSM, CI step' },
+    { flags: '--repo <host/owner/name>', description: 'Repo id for the code review, as the CI gate names it (default: from the origin remote)' },
+    { flags: '--context <key=value>', description: 'Extra cdk context, repeatable (match how the stack was deployed, e.g. skipVpc=true)', parser: collect },
+];
+/**
+ * The one entry point for `enable security` and its `securityagent setup`
+ * alias. Abort errors are already printed by enableSecurity; anything else
+ * (a failed npm or cdk run, a JSON parse, git or fs) is caught here and
+ * printed as one redacted line plus a hint, never as a raw stack or an
+ * unhandled rejection. PRISM_DEBUG=1 adds the redacted stack.
+ */
+export async function runEnableSecurity(opts, hooks = {}) {
+    await runGuarded(() => {
+        const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+        return enableSecurity(o, (hooks.deps ?? defaultDeps)(o));
+    }, hooks);
+}
+/**
+ * Shared by every Security Agent command (enable security, its alias,
+ * security code-review, security findings): runs `body`, turns any error that
+ * is not an Abort into one redacted line plus a hint, and exits non-zero.
+ */
+export async function runGuarded(body, hooks = {}) {
+    const exit = hooks.exit ?? ((c) => process.exit(c));
+    const error = hooks.error ?? ((l) => console.error(l));
+    let code;
+    try {
+        code = await body();
+    }
+    catch (e) {
+        for (const l of describeUnexpectedError(e, hooks.env ?? process.env))
+            error(l);
+        code = 1;
+    }
+    if (code !== 0)
+        exit(code);
+}
+export default {
+    description: 'Set up AWS Security Agent: deploy only its stack (after a diff and your confirmation), then the application, the code review for this repo and its SSM pointer',
+    options: SECURITY_OPTIONS,
+    action: runEnableSecurity,
+};
+//# sourceMappingURL=security.js.map

package/dist/src/commands/enable/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../../src/commands/enable/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAgE,MAAM,yBAAyB,CAAC;AAEvH,gEAAgE;AAChE,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,6FAA6F;AAC7F,IAAI,QAAQ,GAAkB,IAAI,CAAC;AACnC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1E,iGAAiG;AACjG,SAAS,QAAQ,CAAC,KAA6B;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO;IACzD,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IACxE,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAqB;IACtC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACzK,OAAO;QACL,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACtB,eAAe,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACtK,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACnB,gDAAgD;YAChD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3L,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE;YACrC,2EAA2E;YAC3E,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1J,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC;QAChG,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC;QACD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC;QACpB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC/B,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACxE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACtD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,gBAAgB,GAAkH;IAC7I,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gHAAgH,EAAE;IAC5J,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uHAAuH,EAAE;IACpK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yEAAyE,EAAE;IAC1G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,wFAAwF,EAAE;IAC7H,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,2FAA2F,EAAE;IAC/H,EAAE,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,wFAAwF,EAAE;IAC5I,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,qFAAqF,EAAE,MAAM,EAAE,OAAO,EAAE;CACxJ,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAqB,EAAE,QAAkB,EAAE;IACjF,MAAM,UAAU,CAAC,GAAG,EAAE;QACpB,MAAM,CAAC,GAAoB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC7G,OAAO,cAAc,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAA2B,EAAE,QAAkD,EAAE;IAChH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,eAAe;IACb,WAAW,EAAE,gKAAgK;IAC7K,OAAO,EAAE,gBAAgB;IACzB,MAAM,EAAE,iBAAiB;CAC1B,CAAC"}

package/dist/src/commands/export/otel.d.ts

@@ -0,0 +1,31 @@
+export interface ExportOtelDeps {
+    findCodeburn: () => string | null;
+    home: string;
+    stream: (file: string, args: string[]) => number;
+    log: (line: string) => void;
+    error: (line: string) => void;
+}
+export declare function defaultDeps(): ExportOtelDeps;
+export declare function exportOtel(opts: {
+    since?: string;
+}, d: ExportOtelDeps): Promise<number>;
+/** Test seams, as in enable codeburn. */
+export interface ExportOtelHooks {
+    deps?: () => ExportOtelDeps;
+    error?: (line: string) => void;
+    exit?: (code: number) => void;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function runExportOtel(opts: {
+    since?: string;
+}, hooks?: ExportOtelHooks): Promise<void>;
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action: typeof runExportOtel;
+};
+export default _default;
+//# sourceMappingURL=otel.d.ts.map

package/dist/src/commands/export/otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../../../src/commands/export/otel.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED,wBAAgB,WAAW,IAAI,cAAc,CAQ5C;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB7F;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,cAAc,CAAC;IAC5B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAExG;;;;;;;;;AAED,wBAME"}

package/dist/src/commands/export/otel.js

@@ -0,0 +1,52 @@
+/**
+ * `prism-cli export otel`: push codeburn's unsent telemetry to the configured
+ * PRISM OTEL collector now, with the same argv the schedule runs.
+ *
+ * Output is codeburn's own, streamed, and the exit code is codeburn's.
+ */
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { runStreaming } from '../../utils/exec.js';
+import { codeburnSyncConfigPath, ENABLE_CODEBURN_CMD, SYNC_SINCE, syncArgs } from '../../utils/otel-sync-schedule.js';
+import { getCodeburnPath } from '../enable/codeburn.js';
+import { runGuarded } from '../enable/security.js';
+export function defaultDeps() {
+    return {
+        findCodeburn: getCodeburnPath,
+        home: homedir(),
+        stream: runStreaming,
+        log: (l) => console.log(l),
+        error: (l) => console.error(l),
+    };
+}
+export async function exportOtel(opts, d) {
+    const cb = d.findCodeburn();
+    if (!cb) {
+        d.error('Error: codeburn is not installed.');
+        d.error(`  Run "${ENABLE_CODEBURN_CMD}" to install it and set up the sync.`);
+        return 1;
+    }
+    if (!existsSync(codeburnSyncConfigPath(d.home))) {
+        d.error('Error: codeburn sync is not set up (no endpoint configured).');
+        d.error(`  Run "${ENABLE_CODEBURN_CMD} --url <OtelCollectorUrl>" first.`);
+        return 1;
+    }
+    const since = opts.since || SYNC_SINCE;
+    const args = syncArgs(since);
+    d.log(`Running: codeburn ${args.join(' ')}`);
+    const code = d.stream(cb, args);
+    if (code !== 0)
+        d.error(`codeburn sync push exited with ${code}. Check "codeburn sync status", or re-run "${ENABLE_CODEBURN_CMD}".`);
+    return code;
+}
+export async function runExportOtel(opts, hooks = {}) {
+    await runGuarded(() => exportOtel(opts, (hooks.deps ?? defaultDeps)()), hooks);
+}
+export default {
+    description: 'Push AI usage and commit attribution to the PRISM OTEL collector now (codeburn sync push, as the schedule runs it)',
+    options: [
+        { flags: '--since <window>', description: `Time window passed to codeburn: today, 7d, 30d, month, all (default: ${SYNC_SINCE}, as the schedule)` },
+    ],
+    action: runExportOtel,
+};
+//# sourceMappingURL=otel.js.map

package/dist/src/commands/export/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../../../src/commands/export/otel.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAUnD,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,YAAY,EAAE,eAAe;QAC7B,IAAI,EAAE,OAAO,EAAE;QACf,MAAM,EAAE,YAAY;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAwB,EAAE,CAAiB;IAC1E,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,UAAU,mBAAmB,sCAAsC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC,UAAU,mBAAmB,mCAAmC,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC;QAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,8CAA8C,mBAAmB,IAAI,CAAC,CAAC;IACrI,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAwB,EAAE,QAAyB,EAAE;IACvF,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,eAAe;IACb,WAAW,EAAE,oHAAoH;IACjI,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,wEAAwE,UAAU,oBAAoB,EAAE;KACnJ;IACD,MAAM,EAAE,aAAa;CACtB,CAAC"}

package/dist/src/commands/security/code-review.d.ts

@@ -0,0 +1,22 @@
+import { type RunHooks } from '../enable/security.js';
+import { type CodeReviewOptions, type ReviewDeps } from '../../security/review.js';
+import type { SecurityOptions } from '../../security/setup.js';
+/** The real runtime: enable security's runners plus a timer, Ctrl-C and the ticker. */
+export declare function reviewDeps(opts: SecurityOptions): ReviewDeps;
+export declare const REVIEW_TARGET_OPTIONS: {
+    flags: string;
+    description: string;
+}[];
+export interface ReviewHooks extends RunHooks {
+    reviewDeps?: (opts: SecurityOptions) => ReviewDeps;
+}
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: CodeReviewOptions, hooks?: ReviewHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=code-review.d.ts.map

package/dist/src/commands/security/code-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-review.d.ts","sourceRoot":"","sources":["../../../../src/commands/security/code-review.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAsC,KAAK,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACvH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,UAAU,CAc5D;AAED,eAAO,MAAM,qBAAqB;;;GAKjC,CAAC;AAEF,MAAM,WAAW,WAAY,SAAQ,QAAQ;IAAG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,UAAU,CAAA;CAAE;;;;;;;iBAY/E,iBAAiB,UAAS,WAAW;;AAV1D,wBAgBE"}

package/dist/src/commands/security/code-review.js

@@ -0,0 +1,43 @@
+import { defaultDeps, runGuarded } from '../enable/security.js';
+import { FAIL_ON_LEVELS, securityCodeReview } from '../../security/review.js';
+/** The real runtime: enable security's runners plus a timer, Ctrl-C and the ticker. */
+export function reviewDeps(opts) {
+    return {
+        ...defaultDeps(opts),
+        sleep: (ms, signal) => new Promise((done) => {
+            if (signal.aborted)
+                return done();
+            const t = setTimeout(done, ms);
+            signal.addEventListener('abort', () => { clearTimeout(t); done(); }, { once: true });
+        }),
+        onInterrupt: (handler) => { process.once('SIGINT', handler); return () => { process.removeListener('SIGINT', handler); }; },
+        ticker: (line) => { process.stderr.write(`\r\u001b[2K${line}`); },
+        err: (line = '') => console.error(line),
+        out: (text) => { process.stdout.write(text); },
+        cwd: () => process.cwd(),
+    };
+}
+export const REVIEW_TARGET_OPTIONS = [
+    { flags: '--profile <name>', description: 'AWS CLI profile (default: none; the standard credential chain)' },
+    { flags: '--region <region>', description: 'AWS region (default: AWS_REGION, AWS_DEFAULT_REGION, else the profile\'s configured region)' },
+    { flags: '--path <dir>', description: 'The repository top level to work on (default: the current directory, which must be the top level)' },
+    { flags: '--repo <host/owner/name>', description: 'Repo id (not a path) for the code review, as the CI gate names it (default: from the origin remote)' },
+];
+export default {
+    description: 'Run an AWS Security Agent code review of this branch (or --full repo) now, wait for it and print the findings',
+    options: [
+        ...REVIEW_TARGET_OPTIONS,
+        { flags: '--full', description: 'Review the whole repo at HEAD instead of the branch diff' },
+        { flags: '--timeout <minutes>', description: 'How long to wait for the job (default: 30)' },
+        { flags: '--fail-on <level>', description: `Exit 1 when any finding is at or above this level: ${FAIL_ON_LEVELS.join(' | ')}` },
+        { flags: '--json', description: 'Print only the final result JSON (progress goes to stderr)' },
+        { flags: '--no-wait', description: 'Start the job, print its id and exit' },
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(() => {
+            const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+            return securityCodeReview(o, (hooks.reviewDeps ?? reviewDeps)(o));
+        }, hooks);
+    },
+};
+//# sourceMappingURL=code-review.js.map

package/dist/src/commands/security/code-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-review.js","sourceRoot":"","sources":["../../../../src/commands/security/code-review.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAA2C,MAAM,0BAA0B,CAAC;AAGvH,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAqB;IAC9C,OAAO;QACL,GAAG,WAAW,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;YAChD,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC,CAAC;QACF,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gEAAgE,EAAE;IAC5G,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,6FAA6F,EAAE;IAC1I,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,mGAAmG,EAAE;IAC3I,EAAE,KAAK,EAAE,0BAA0B,EAAE,WAAW,EAAE,qGAAqG,EAAE;CAC1J,CAAC;AAIF,eAAe;IACb,WAAW,EAAE,+GAA+G;IAC5H,OAAO,EAAE;QACP,GAAG,qBAAqB;QACxB,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,0DAA0D,EAAE;QAC5F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,4CAA4C,EAAE;QAC3F,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,sDAAsD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;QAC/H,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4DAA4D,EAAE;QAC9F,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,sCAAsC,EAAE;KAC5E;IACD,KAAK,CAAC,MAAM,CAAC,IAAuB,EAAE,QAAqB,EAAE;QAC3D,MAAM,UAAU,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,GAAsB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/G,OAAO,kBAAkB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/src/commands/security/findings.d.ts

@@ -0,0 +1,15 @@
+import { type FindingsOptions } from '../../security/review.js';
+import { type ReviewHooks } from './code-review.js';
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: FindingsOptions & {
+        pentest?: boolean | string;
+        includeFalsePositives?: boolean;
+    }, hooks?: ReviewHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=findings.d.ts.map

package/dist/src/commands/security/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../../../src/commands/security/findings.ts"],"names":[],"mappings":"AACA,OAAO,EAAoC,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAElG,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;;;;;;;iBAelE,eAAe,GAAG;QAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,UAAS,WAAW;;AAb1H,wBAyBE"}

package/dist/src/commands/security/findings.js

@@ -0,0 +1,31 @@
+import { runGuarded } from '../enable/security.js';
+import { FAIL_ON_LEVELS, securityFindings } from '../../security/review.js';
+import { securityPentestFindings } from '../../security/pentest.js';
+import { REVIEW_TARGET_OPTIONS, reviewDeps } from './code-review.js';
+export default {
+    description: 'List the findings of this repo\'s latest AWS Security Agent code review (or, with --pentest, its penetration test) and cache them for the dashboard (read-only)',
+    options: [
+        ...REVIEW_TARGET_OPTIONS,
+        { flags: '--job <id>', description: 'A specific code review job (default: the latest for this repo)' },
+        { flags: '--latest', description: 'The latest job for this repo (the default)' },
+        { flags: '--severity <level>', description: `Show only findings at or above: ${FAIL_ON_LEVELS.join(' | ')}` },
+        { flags: '--pentest [job]', description: 'Read the latest (or given) penetration-test job instead of a code review' },
+        { flags: '--include-false-positives', description: 'With --pentest: show findings the agent rated FALSE_POSITIVE confidence' },
+        { flags: '--wait', description: 'If the job is still running, wait for it' },
+        { flags: '--timeout <minutes>', description: 'How long --wait waits (code review: 30; pentest: 360)' },
+        { flags: '--json', description: 'Print only the result JSON' },
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(() => {
+            const deps = (hooks.reviewDeps ?? reviewDeps)(opts);
+            if (opts.pentest !== undefined && opts.pentest !== false) {
+                const job = typeof opts.pentest === 'string' ? opts.pentest : opts.job;
+                const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined, job };
+                return securityPentestFindings(o, deps);
+            }
+            const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+            return securityFindings(o, deps);
+        }, hooks);
+    },
+};
+//# sourceMappingURL=findings.js.map

package/dist/src/commands/security/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../../../src/commands/security/findings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAwB,MAAM,0BAA0B,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAuB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEvF,eAAe;IACb,WAAW,EAAE,iKAAiK;IAC9K,OAAO,EAAE;QACP,GAAG,qBAAqB;QACxB,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,gEAAgE,EAAE;QACtG,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,4CAA4C,EAAE;QAChF,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;QAC7G,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,0EAA0E,EAAE;QACrH,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC9H,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC5E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,uDAAuD,EAAE;QACtG,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;KAC/D;IACD,KAAK,CAAC,MAAM,CAAC,IAAuF,EAAE,QAAqB,EAAE;QAC3H,MAAM,UAAU,CAAC,GAAG,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACzD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvE,MAAM,CAAC,GAAmB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;gBACjH,OAAO,uBAAuB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,GAAoB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC7G,OAAO,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/src/commands/security/pentest.d.ts

@@ -0,0 +1,18 @@
+import { type RunHooks } from '../enable/security.js';
+import { type PentestApp, type PentestOptions } from '../../security/pentest.js';
+import type { ReviewDeps } from '../../security/review.js';
+export interface PentestHooks extends RunHooks {
+    reviewDeps?: (opts: PentestOptions) => ReviewDeps;
+    /** Test seam: inject a fake adapter so the orchestration runs with no cdk/docker. */
+    app?: (opts: PentestOptions) => PentestApp;
+}
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: PentestOptions, hooks?: PentestHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=pentest.d.ts.map

package/dist/src/commands/security/pentest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest.d.ts","sourceRoot":"","sources":["../../../../src/commands/security/pentest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAmC,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAElH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,UAAU,CAAC;IAClD,qFAAqF;IACrF,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,UAAU,CAAC;CAC5C;;;;;;;iBAqBoB,cAAc,UAAS,YAAY;;AAnBxD,wBA0BE"}

package/dist/src/commands/security/pentest.js

@@ -0,0 +1,32 @@
+import { runGuarded } from '../enable/security.js';
+import { reviewDeps } from './code-review.js';
+import { FAIL_ON_LEVELS, securityPentest } from '../../security/pentest.js';
+import { dockerfileApp } from '../../security/pentest-dockerfile.js';
+export default {
+    description: 'Deploy this repo\'s app into a temporary private VPC and run an AWS Security Agent penetration test against it',
+    options: [
+        { flags: '--app-type <type>', description: 'How to build and deploy the app (default: dockerfile; v1 ships only dockerfile)' },
+        { flags: '--path <dir>', description: 'The repository top level (default: the current directory)' },
+        { flags: '--app-dir <dir>', description: 'Docker build context, relative to the repo root (default: "path" in .prism/pentest.json, else .)' },
+        { flags: '--dockerfile <file>', description: 'Dockerfile, relative to the repo root (default: "dockerfile" in .prism/pentest.json, else <app-dir>/Dockerfile)' },
+        { flags: '--wait', description: 'Wait for the job and print findings (default: do not wait — a run takes hours)' },
+        { flags: '--timeout <minutes>', description: 'How long --wait waits (default: 360)' },
+        { flags: '--keep', description: 'Do not tear the environment down after the job (remove it later with --cleanup)' },
+        { flags: '--status', description: 'Refresh and print the latest pentest job; tear down once it has finished. No deploy' },
+        { flags: '--cleanup', description: 'Tear down a prior run\'s environment now and exit. No deploy' },
+        { flags: '--dry-run', description: 'Show the plan, target and cost; deploy and start nothing' },
+        { flags: '--yes', description: 'Approve the deploy and the pentest without a prompt (CI and other non-interactive use)' },
+        { flags: '--include-false-positives', description: 'Show findings the agent rated FALSE_POSITIVE confidence (hidden by default)' },
+        { flags: '--fail-on <level>', description: `Exit 1 on a non-false-positive finding at or above this level: ${FAIL_ON_LEVELS.join(' | ')}` },
+        { flags: '--profile <name>', description: 'AWS CLI profile (default: none; the standard credential chain)' },
+        { flags: '--region <region>', description: 'AWS region (default: AWS_REGION, AWS_DEFAULT_REGION, else the profile\'s configured region)' },
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(() => {
+            const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+            const app = (hooks.app ?? ((x) => dockerfileApp({ profile: x.profile })))(o);
+            return securityPentest(o, (hooks.reviewDeps ?? reviewDeps)(o), app);
+        }, hooks);
+    },
+};
+//# sourceMappingURL=pentest.js.map

package/dist/src/commands/security/pentest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest.js","sourceRoot":"","sources":["../../../../src/commands/security/pentest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAwC,MAAM,2BAA2B,CAAC;AAClH,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AASrE,eAAe;IACb,WAAW,EAAE,gHAAgH;IAC7H,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,iFAAiF,EAAE;QAC9H,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACnG,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,kGAAkG,EAAE;QAC7I,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,iHAAiH,EAAE;QAChK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gFAAgF,EAAE;QAClH,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,sCAAsC,EAAE;QACrF,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iFAAiF,EAAE;QACnH,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,qFAAqF,EAAE;QACzH,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,8DAA8D,EAAE;QACnG,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,0DAA0D,EAAE;QAC/F,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,wFAAwF,EAAE;QACzH,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,6EAA6E,EAAE;QAClI,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,kEAAkE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;QAC3I,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC5G,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,6FAA6F,EAAE;KAC3I;IACD,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,QAAsB,EAAE;QACzD,MAAM,UAAU,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,GAAmB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC5G,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/src/commands/security/threat-model.d.ts

@@ -0,0 +1,16 @@
+import { type ThreatModelOptions } from '../../security/threat-model.js';
+import { type ReviewHooks } from './code-review.js';
+declare const _default: {
+    description: string;
+    options: ({
+        flags: string;
+        description: string;
+    } | {
+        flags: string;
+        description: string;
+        parser: (v: string, prev?: string[]) => string[];
+    })[];
+    action(opts: ThreatModelOptions, hooks?: ReviewHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=threat-model.d.ts.map

package/dist/src/commands/security/threat-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model.d.ts","sourceRoot":"","sources":["../../../../src/commands/security/threat-model.ts"],"names":[],"mappings":"AAEA,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;;;;;;;;;oBAEnE,MAAM,SAAQ,MAAM,EAAE;;iBAarB,kBAAkB,UAAS,WAAW;;AAX3D,wBAiBE"}

package/dist/src/commands/security/threat-model.js

@@ -0,0 +1,24 @@
+import { runGuarded } from '../enable/security.js';
+import { FAIL_ON_LEVELS } from '../../security/review.js';
+import { DEFAULT_TM_TIMEOUT_MIN, securityThreatModel } from '../../security/threat-model.js';
+import { REVIEW_TARGET_OPTIONS, reviewDeps } from './code-review.js';
+const collect = (v, prev = []) => [...prev, v];
+export default {
+    description: 'Run an AWS Security Agent threat model of this repo at HEAD, focused by design docs, wait for it and print the threats',
+    options: [
+        ...REVIEW_TARGET_OPTIONS,
+        { flags: '--doc <path>', description: 'A design doc (scope doc) committed in HEAD, repeatable (default: .kiro/specs/*/design.md and requirements.md)', parser: collect },
+        { flags: '--no-docs', description: 'Model the source alone, with no scope docs' },
+        { flags: '--timeout <minutes>', description: `How long to wait for the job (default: ${DEFAULT_TM_TIMEOUT_MIN})` },
+        { flags: '--fail-on <level>', description: `Exit 1 when any threat is at or above this level: ${FAIL_ON_LEVELS.join(' | ')}` },
+        { flags: '--json', description: 'Print only the final result JSON (progress goes to stderr)' },
+        { flags: '--no-wait', description: 'Start the job, print its id and exit' },
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(() => {
+            const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+            return securityThreatModel(o, (hooks.reviewDeps ?? reviewDeps)(o));
+        }, hooks);
+    },
+};
+//# sourceMappingURL=threat-model.js.map

package/dist/src/commands/security/threat-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model.js","sourceRoot":"","sources":["../../../../src/commands/security/threat-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAA2B,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEvF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAEjE,eAAe;IACb,WAAW,EAAE,wHAAwH;IACrI,OAAO,EAAE;QACP,GAAG,qBAAqB;QACxB,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,+GAA+G,EAAE,MAAM,EAAE,OAAO,EAAE;QACxK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACjF,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,0CAA0C,sBAAsB,GAAG,EAAE;QAClH,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,qDAAqD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;QAC9H,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4DAA4D,EAAE;QAC9F,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,sCAAsC,EAAE;KAC5E;IACD,KAAK,CAAC,MAAM,CAAC,IAAwB,EAAE,QAAqB,EAAE;QAC5D,MAAM,UAAU,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,GAAuB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAChH,OAAO,mBAAmB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/src/commands/security/threats.d.ts

@@ -0,0 +1,12 @@
+import { type ThreatsOptions } from '../../security/threat-model.js';
+import { type ReviewHooks } from './code-review.js';
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: ThreatsOptions, hooks?: ReviewHooks): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=threats.d.ts.map

package/dist/src/commands/security/threats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threats.d.ts","sourceRoot":"","sources":["../../../../src/commands/security/threats.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;;;;;;;iBAalE,cAAc,UAAS,WAAW;;AAXvD,wBAiBE"}

package/dist/src/commands/security/threats.js

@@ -0,0 +1,23 @@
+import { runGuarded } from '../enable/security.js';
+import { FAIL_ON_LEVELS } from '../../security/review.js';
+import { DEFAULT_TM_TIMEOUT_MIN, securityThreats } from '../../security/threat-model.js';
+import { REVIEW_TARGET_OPTIONS, reviewDeps } from './code-review.js';
+export default {
+    description: 'List the threats of this repo\'s pending or latest (or --job) AWS Security Agent threat model and cache them for the dashboard (read-only)',
+    options: [
+        ...REVIEW_TARGET_OPTIONS,
+        { flags: '--job <id>', description: 'A specific threat model job (default: the pending one, else the latest for this repo)' },
+        { flags: '--latest', description: 'The latest job for this repo (the default)' },
+        { flags: '--severity <level>', description: `Show only threats at or above: ${FAIL_ON_LEVELS.join(' | ')}` },
+        { flags: '--wait', description: 'If the job is still running, wait for it' },
+        { flags: '--timeout <minutes>', description: `How long --wait waits (default: ${DEFAULT_TM_TIMEOUT_MIN})` },
+        { flags: '--json', description: 'Print only the result JSON' },
+    ],
+    async action(opts, hooks = {}) {
+        await runGuarded(() => {
+            const o = { ...opts, profile: opts.profile || undefined, region: opts.region || undefined };
+            return securityThreats(o, (hooks.reviewDeps ?? reviewDeps)(o));
+        }, hooks);
+    },
+};
+//# sourceMappingURL=threats.js.map

package/dist/src/commands/security/threats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threats.js","sourceRoot":"","sources":["../../../../src/commands/security/threats.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAuB,MAAM,gCAAgC,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEvF,eAAe;IACb,WAAW,EAAE,4IAA4I;IACzJ,OAAO,EAAE;QACP,GAAG,qBAAqB;QACxB,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,uFAAuF,EAAE;QAC7H,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,4CAA4C,EAAE;QAChF,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kCAAkC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;QAC5G,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC5E,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,mCAAmC,sBAAsB,GAAG,EAAE;QAC3G,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;KAC/D;IACD,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,QAAqB,EAAE;QACxD,MAAM,UAAU,CAAC,GAAG,EAAE;YACpB,MAAM,CAAC,GAAmB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC5G,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/src/commands/securityagent/setup.d.ts

@@ -1,14 +1,28 @@
+import { type RunHooks } from '../enable/security.js';
+import type { SecurityOptions } from '../../security/setup.js';
+/**
+ * DEPRECATED alias for `prism-cli enable security`.
+ *
+ * The old command ran `cdk deploy --all --require-approval never`, always
+ * re-attached the application role, and wrote the code review id to an SSM
+ * parameter the CI eval gate never read. `enable security` replaces it: it
+ * deploys only the Security Agent stack after a diff and a confirmation, is
+ * idempotent, and writes the per-repo parameter the gate uses. The command is
+ * kept so existing scripts and docs keep working; it takes the same flags as
+ * `enable security`, so a script that relied on the old unattended run needs
+ * --yes now.
+ */
+export declare const DEPRECATION: string[];
 declare const _default: {
     description: string;
     options: {
         flags: string;
         description: string;
-        default: string;
+        default?: string;
+        parser?: (v: string, prev?: string[]) => string[];
     }[];
-    action(options: {
-        profile: string;
-        region: string;
-    }): void;
+    /** Errors are handled once, in runEnableSecurity, for this alias too. `hooks` is for tests. */
+    action(opts: SecurityOptions, hooks?: RunHooks): Promise<void>;
 };
 export default _default;
 //# sourceMappingURL=setup.d.ts.map