@prism-d1/cli 1.2.0 → 1.4.0

package/dist/src/aws/run-check.d.ts

@@ -0,0 +1,31 @@
+import type { RunResult } from '../utils/exec.js';
+import { type PrismResult } from '../codewatch/results.js';
+import { type SecurityOptions } from '../security/setup.js';
+export declare const CHECK_NOTICE = "Read-only (aws check): every AWS call is a describe, get or list; nothing in AWS is changed. The result is saved to .prism/results/.";
+export interface CheckOptions extends Pick<SecurityOptions, 'profile' | 'region' | 'profileSource' | 'connection'> {
+    section?: string[];
+    failOn?: string;
+    json?: boolean;
+    /** false: save the result but print no report (aws recommend --refresh --json). */
+    report?: boolean;
+}
+export interface CheckRunDeps {
+    env: NodeJS.ProcessEnv;
+    home: string;
+    cwd(): string;
+    configRegion(profile?: string): string | null;
+    awsVersion(): string | null;
+    git(args: string[]): RunResult;
+    log(line?: string): void;
+    err(line?: string): void;
+    now(): Date;
+}
+export interface CheckOutcome {
+    code: number;
+    result?: PrismResult;
+    path?: string;
+}
+/** Where results go: the repo of the working directory, else ~ (so ~/.prism/results/). */
+export declare function resultsRoot(d: Pick<CheckRunDeps, 'cwd' | 'git' | 'home'>): string;
+export declare function awsCheck(input: CheckOptions, d: CheckRunDeps): CheckOutcome;
+//# sourceMappingURL=run-check.d.ts.map

package/dist/src/aws/run-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-check.d.ts","sourceRoot":"","sources":["../../../src/aws/run-check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAkE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI5H,eAAO,MAAM,YAAY,yIAAyI,CAAC;AAEnK,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,GAAG,YAAY,CAAC;IAChH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mFAAmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,IAAI,MAAM,CAAC;IACd,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,UAAU,IAAI,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,IAAI,IAAI,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAEnF,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAEjF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CA+D3E"}

package/dist/src/aws/run-check.js

@@ -0,0 +1,91 @@
+/**
+ * Runs `prism-cli aws check`: resolve the target, print the identity header,
+ * run the selected sections, save the result (kind aws-check) and print the
+ * report. Synchronous on purpose: every AWS call is a blocking CLI read, and
+ * the tests drive it through the fake `aws` binary.
+ */
+import { aws } from '../utils/aws.js';
+import { parseFailOn, renderReport } from '../utils/audit.js';
+import { makeResult, writeResult } from '../codewatch/results.js';
+import { NO_REGION_MESSAGE, printIdentity, resolveRegion } from '../security/setup.js';
+import { repoRootOf } from './connection.js';
+import { breaching, countFindings, failBySeverity, securityContext, selectSections } from './check.js';
+export const CHECK_NOTICE = 'Read-only (aws check): every AWS call is a describe, get or list; nothing in AWS is changed. The result is saved to .prism/results/.';
+/** Where results go: the repo of the working directory, else ~ (so ~/.prism/results/). */
+export function resultsRoot(d) {
+    return repoRootOf(d.cwd(), d.git) ?? d.home;
+}
+export function awsCheck(input, d) {
+    const say = input.json ? d.err : d.log;
+    say(CHECK_NOTICE);
+    say('');
+    let failOn;
+    try {
+        failOn = parseFailOn(input.failOn);
+    }
+    catch (e) {
+        say(`Error: ${e.message}`);
+        return { code: 1 };
+    }
+    const sections = selectSections(input.section);
+    if ('error' in sections) {
+        say(`Error: ${sections.error}`);
+        return { code: 1 };
+    }
+    const r = resolveRegion(input, d);
+    if (!r) {
+        say(`Error: ${NO_REGION_MESSAGE} Or save one with prism-cli aws connect.`);
+        return { code: 1 };
+    }
+    const region = r.region;
+    // The region is pinned in the child env too, so global-endpoint calls (IAM, budgets) never depend on profile config.
+    const target = { profile: input.profile, env: { AWS_PAGER: '', AWS_REGION: region, AWS_DEFAULT_REGION: region } };
+    const who = aws(['sts', 'get-caller-identity'], target);
+    const account = who.ok ? String(who.json?.Account || '') : '';
+    if (!account) {
+        const why = who.errorCode || who.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'no account in the response';
+        say(`Error: cannot resolve the AWS identity: ${why}. Sign in (e.g. aws sso login), pass --profile, or run prism-cli aws connect.`);
+        return { code: 1 };
+    }
+    const a = aws(['iam', 'list-account-aliases'], target);
+    const alias = a.ok && a.json?.AccountAliases?.[0] ? String(a.json.AccountAliases[0]) : null;
+    const opts = { ...input, region, regionSource: r.source };
+    const security = securityContext(opts, (args, rg) => aws([...args, '--region', rg], target), d.env, d.awsVersion, say);
+    printIdentity(security, { account, arn: String(who.json?.Arn || ''), alias });
+    say('');
+    const started = d.now().toISOString();
+    const ctx = { target, account, region, home: d.home, security };
+    const findings = sections.flatMap((s) => s.run(ctx));
+    const info = {
+        account, alias, region, profile: input.profile ?? null, profile_source: input.profileSource ?? null,
+        sections: sections.map((s) => s.name),
+        section_counts: Object.fromEntries(sections.map((s) => [s.name, countFindings(findings.filter((f) => f.category === s.name))])),
+        counts: countFindings(findings),
+        fail_by_severity: failBySeverity(findings),
+        checks: findings,
+    };
+    const result = makeResult({
+        kind: 'aws-check', hook: 'manual', tool: 'prism-cli', started_at: started, finished_at: d.now().toISOString(),
+        status: info.counts.fail || info.counts.indeterminate ? 'findings' : 'ok',
+        summary: `${info.counts.pass} pass, ${info.counts.fail} fail, ${info.counts.indeterminate} indeterminate`,
+        aws_check: info,
+    });
+    const path = writeResult(resultsRoot(d), result);
+    if (input.report !== false)
+        renderReport(findings, {
+            title: '☁️  AWS account check',
+            subtitle: `Account: ${account}${alias ? ` (${alias})` : ''}    Region: ${region}`,
+            groups: sections.map((s) => [s.name, s.heading]),
+            json: !!input.json,
+            jsonContext: { account, alias, region, sections: info.sections, section_counts: info.section_counts, result_path: path },
+        });
+    say(`Saved ${path}`);
+    say('Next: prism-cli aws recommend (turns these results into a ranked fix list; no AWS calls).');
+    const breach = breaching(findings, failOn);
+    if (breach.length) {
+        d.err(`❌ ${breach.length} finding(s) at or above ${failOn}: ${breach.map((f) => f.id).join(', ')}`);
+        return { code: 1, result, path };
+    }
+    return { code: 0, result, path };
+}
+//# sourceMappingURL=run-check.js.map

package/dist/src/aws/run-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-check.js","sourceRoot":"","sources":["../../../src/aws/run-check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,GAAG,EAAkB,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAuC,MAAM,yBAAyB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAuC,MAAM,sBAAsB,CAAC;AAC5H,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAE1H,MAAM,CAAC,MAAM,YAAY,GAAG,sIAAsI,CAAC;AAwBnK,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,CAA6C;IACvE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAmB,EAAE,CAAe;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClB,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAW,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,iBAAiB,0CAA0C,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,qHAAqH;IACrH,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC;IAE7H,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,4BAA4B,CAAC;QAC5H,GAAG,CAAC,2CAA2C,GAAG,+EAA+E,CAAC,CAAC;QACnI,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,IAAI,GAAa,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvH,aAAa,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAc,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAiB;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QACnG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;QAC/B,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,QAAQ;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC;QACxB,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC7G,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACzE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,gBAAgB;QACzG,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEjD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,YAAY,CAAC,QAAQ,EAAE;YACjD,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,YAAY,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,MAAM,EAAE;YACjF,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE;SACzH,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACrB,GAAG,CAAC,2FAA2F,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,2BAA2B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/codewatch/results.d.ts

@@ -1,3 +1,4 @@
+import type { Finding as AuditFinding, Severity as AuditSeverity } from '../utils/audit.js';
 export declare const RESULT_SCHEMA_VERSION = 1;
 export declare const RESULTS_DIR = ".prism/results";
 /** Pre-commit ran with no gitleaks on PATH: the commit was allowed but not secret-scanned. */
@@ -12,17 +13,155 @@ export interface Finding {
     file: string;
     line: number | null;
     message: string;
+    /** security-review / security-pentest: the Security Agent risk level (CRITICAL ... UNKNOWN), finding title, CWE and id. */
+    risk_level?: string;
+    title?: string;
+    cwe?: string | null;
+    finding_id?: string;
+    /** security-review only: the path exactly as the service reported it (file is repo-relative). */
+    raw_file?: string;
+    /** security-threat-model only: the threat's id, STRIDE categories, mitigation and every evidence path (repo-relative). */
+    threat_id?: string;
+    stride?: string[];
+    recommendation?: string;
+    evidence?: string[];
+    /** security-pentest only: the agent's confidence (HIGH | MEDIUM | LOW | FALSE_POSITIVE). */
+    confidence?: string;
+}
+/**
+ * `secrets` = gitleaks; `review` = the reviewer (kiro-cli / Claude Code);
+ * `security-review` = an AWS Security Agent code review job;
+ * `security-threat-model` = an AWS Security Agent threat model job;
+ * `security-pentest` = an AWS Security Agent penetration test job.
+ */
+export type ResultKind = 'secrets' | 'review' | 'security-review' | 'security-threat-model' | 'security-pentest' | 'aws-check';
+/**
+ * aws-check only: one `prism-cli aws check` run. The audit findings live in
+ * `checks` (their shape differs from a code finding); `findings` stays empty.
+ */
+export interface AwsCheckInfo {
+    account: string;
+    alias: string | null;
+    region: string;
+    profile: string | null;
+    /** Where the profile came from, e.g. "--profile" or "aws connect, user". */
+    profile_source: string | null;
+    /** The sections that ran, in order. */
+    sections: string[];
+    /** PASS / FAIL / INDETERMINATE counts per section. */
+    section_counts: Record<string, {
+        pass: number;
+        fail: number;
+        indeterminate: number;
+    }>;
+    counts: {
+        pass: number;
+        fail: number;
+        indeterminate: number;
+    };
+    /** FAIL findings per severity. */
+    fail_by_severity: Record<AuditSeverity, number>;
+    checks: AuditFinding[];
+}
+/** security-threat-model only: the job behind the result. */
+export interface ThreatModelInfo {
+    job_id: string;
+    threat_model_id: string;
+    agent_space_id: string;
+    region: string;
+    account?: string;
+    job_status: string;
+    /** Threats per severity (CRITICAL ... INFO). */
+    counts: Record<string, number>;
+    /** Threats per STRIDE category. */
+    stride_counts: Record<string, number>;
+    /** Repo paths of the scope docs, as read from the commit. */
+    scope_docs: string[];
+    /** The agent's system overview, in full; null until the job completes. */
+    system_overview: string | null;
+    service_created_at?: string | null;
+    service_updated_at?: string | null;
+}
+/** security-review only: the job behind the result. */
+export interface SecurityReviewInfo {
+    job_id: string;
+    code_review_id: string;
+    agent_space_id: string;
+    region: string;
+    /** The AWS account the job ran in, so `security findings` only completes its own account's pending records. */
+    account?: string;
+    /** diff: the branch diff base...tip. full: the whole repo at tip. unknown: fetched later by `security findings`. */
+    scope: 'diff' | 'full' | 'unknown';
+    /**
+     * The commit the code review's source asset (repo/<slug>/latest.zip) held
+     * when the job started: the code a diff job reads around the patch. null
+     * when unknown (a job `security findings` fetched with no pending record).
+     */
+    context_commit?: string | null;
+    job_status: string;
+    /** Findings per Security Agent risk level. */
+    counts: Record<string, number>;
+    /** The service's job timestamps, and updatedAt - createdAt (queue plus run time), when it reported them. */
+    service_created_at?: string | null;
+    service_updated_at?: string | null;
+    service_duration_s?: number | null;
+    /** Our wall time from starting the job to seeing it finish (code-review only; includes polling). */
+    wall_s?: number | null;
+}
+/**
+ * security-pentest only: the penetration-test job behind the result, and the
+ * temporary environment it ran against. Mirrors SecurityReviewInfo; a pentest
+ * finding has no file/line, carries a `confidence`, and the environment handle
+ * is what `security pentest --cleanup` tears down.
+ */
+export interface PentestInfo {
+    job_id: string;
+    pentest_id: string;
+    agent_space_id: string;
+    /** True when this run created a dedicated agent space (teardown deletes it); false when it reused a shared one. */
+    agent_space_dedicated: boolean;
+    region: string;
+    /** The AWS account the job ran in, so findings only completes its own account's pending records. */
+    account?: string;
+    /** The verified target domain the pentest ran against (app.<zone>). */
+    target_host: string;
+    job_status: string;
+    /** Findings per Security Agent risk level, after dropping FALSE_POSITIVE confidence (unless --include-false-positives). */
+    counts: Record<string, number>;
+    /** First paragraph of the job's `overview` text, when the service reported one. */
+    overview?: string | null;
+    /** The CloudFormation stack and run slug of the temporary environment, for --cleanup. */
+    stack?: string | null;
+    slug?: string | null;
+    /** When the environment is set to auto-expire (the prism:expires-at tag), ISO. */
+    expires_at?: string | null;
+    /** The agent ENIs' security group id: teardown waits for its ENIs to drain before destroying the stack. */
+    agent_security_group_id?: string | null;
+    /** The app container's log group, for debugging hints. */
+    app_log_group?: string | null;
+    /** The PRIVATE_VPC target domain this run created; teardown deletes it. */
+    target_domain_id?: string | null;
+    /** Set when the last teardown left the stack up (destroy failed twice); --cleanup retries it. */
+    teardown_failed?: {
+        at: string;
+        reason: string;
+    } | null;
+    service_created_at?: string | null;
+    service_updated_at?: string | null;
+    service_duration_s?: number | null;
+    wall_s?: number | null;
 }
-/** `secrets` = gitleaks; `review` = the reviewer (kiro-cli / Claude Code). */
-export type ResultKind = 'secrets' | 'review';
 export type ResultHook = 'pre-commit' | 'pre-push' | 'ci' | 'manual';
 /**
  * ok        ran, nothing found
  * findings  ran, found something
  * error     could not produce a verdict (tool missing, crashed, unparseable output)
  * skipped   did not run: no changes to review, or the hook was bypassed (`--no-verify`)
+ * pending   security-review / security-pentest: the job was started and has no
+ *           verdict yet. finished_at equals started_at until the record is
+ *           completed in place.
  */
-export type ResultStatus = 'ok' | 'findings' | 'error' | 'skipped';
+export type ResultStatus = 'ok' | 'findings' | 'error' | 'skipped' | 'pending';
 export interface PrismResult {
     schema_version: typeof RESULT_SCHEMA_VERSION;
     kind: ResultKind;
@@ -55,6 +194,14 @@ export interface PrismResult {
      * consumers (the dashboard, CI) match on exactly: see REASON_*.
      */
     reason: string | null;
+    /** Present on kind security-review. */
+    security?: SecurityReviewInfo;
+    /** Present on kind security-threat-model. */
+    threat_model?: ThreatModelInfo;
+    /** Present on kind security-pentest. */
+    pentest?: PentestInfo;
+    /** Present on kind aws-check. */
+    aws_check?: AwsCheckInfo;
 }
 export type ResultInit = Omit<PrismResult, 'schema_version' | 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'> & Partial<Pick<PrismResult, 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'>>;
 export declare function makeResult(init: ResultInit): PrismResult;
@@ -76,7 +223,11 @@ export declare function resultFileName(r: PrismResult): string;
  * clean without touching any tracked file. Outside a git repo it does nothing.
  */
 export declare function ensureResultsExcluded(repoRoot: string): boolean;
-export declare function writeResult(repoRoot: string, r: PrismResult): string;
+/**
+ * `id` (a ResultEntry id) rewrites that existing file in place instead of
+ * naming a new one: how a pending security-review record is completed.
+ */
+export declare function writeResult(repoRoot: string, r: PrismResult, id?: string): string;
 export interface ResultEntry {
     /** File name without `.json`: the result's stable id (used by report links). */
     id: string;

package/dist/src/codewatch/results.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC9C,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,CAWpE;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}
+{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,IAAI,YAAY,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,2HAA2H;IAC3H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/H;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oHAAoH;IACpH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,mHAAmH;IACnH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2GAA2G;IAC3G,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iGAAiG;IACjG,eAAe,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,wCAAwC;IACxC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iCAAiC;IACjC,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAYjF;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}

package/dist/src/codewatch/results.js

@@ -47,6 +47,10 @@ export function compactTimestamp(iso) {
  * no commit yet (pre-commit).
  */
 export function resultFileName(r) {
+    // An account check is not tied to a commit: `aws-<account>-<region>-<time>-aws-check.json`.
+    if (r.kind === 'aws-check' && r.aws_check) {
+        return `aws-${safePart(r.aws_check.account)}-${safePart(r.aws_check.region)}-${compactTimestamp(r.started_at)}-${safePart(r.kind)}.json`;
+    }
     const id = r.commit ? safePart(r.commit.slice(0, 12)) : r.tree ? `tree-${safePart(r.tree.slice(0, 12))}` : 'nocommit';
     return `${id}-${compactTimestamp(r.started_at)}-${safePart(r.hook)}-${safePart(r.kind)}.json`;
 }
@@ -72,7 +76,13 @@ export function ensureResultsExcluded(repoRoot) {
     appendFileSync(p.stdout, `${prefix}# prism-cli codewatch results (local)\n/${RESULTS_DIR}/\n`);
     return true;
 }
-export function writeResult(repoRoot, r) {
+/**
+ * `id` (a ResultEntry id) rewrites that existing file in place instead of
+ * naming a new one: how a pending security-review record is completed.
+ */
+export function writeResult(repoRoot, r, id) {
+    if (id !== undefined && !/^[A-Za-z0-9_-]{1,200}$/.test(id))
+        throw new Error(`invalid result id: ${id}`);
     const dir = resolve(repoRoot, RESULTS_DIR);
     if (!fileExists(dir)) {
         try {
@@ -81,7 +91,7 @@ export function writeResult(repoRoot, r) {
         catch { /* never fail a write over this */ }
     }
     mkdirSync(dir, { recursive: true });
-    const dest = join(dir, resultFileName(r));
+    const dest = join(dir, id !== undefined ? `${id}.json` : resultFileName(r));
     const tmp = `${dest}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(r, null, 2) + '\n', { mode: 0o600 });
     renameSync(tmp, dest);

package/dist/src/codewatch/results.js.map

@@ -1 +1 @@
-{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AA+D1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAGvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AA0M1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,4FAA4F;IAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3I,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc,EAAE,EAAW;IACvE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/commands/_top/version.d.ts

@@ -0,0 +1,62 @@
+export declare const PACKAGE_NAME = "@prism-d1/cli";
+export interface Install {
+    /** The PATH entry. */
+    path: string;
+    /** Where it resolves after symlinks. */
+    realpath: string;
+    /** From the package.json next to it; null when it cannot be found. */
+    version: string | null;
+    /** True when it is this running CLI. */
+    isThis: boolean;
+}
+export interface VersionReport {
+    schema: 'prism.version.v1';
+    version: string;
+    node: string;
+    latest: string | null;
+    updateAvailable: boolean | null;
+    /** Why latest is null: 'offline', or the npm failure. */
+    latestNote: string | null;
+    onPath: Install[];
+    warnings: string[];
+}
+export interface VersionDeps {
+    /** The directory holding this CLI's package.json. */
+    ownPackageDir: string;
+    pathEnv: string;
+    /** `npm view @prism-d1/cli version`: the version, or an error message. */
+    npmLatest: () => {
+        version: string | null;
+        error?: string;
+    };
+}
+/** Walks up from `start` to the package.json of @prism-d1/cli, at most 6 levels. */
+export declare function findPackageDir(start: string): string | null;
+/** -1, 0 or 1, comparing dotted numeric versions; pre-release tags are ignored. */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Every prism-cli on PATH, in PATH order, deduplicated by real path (e.g.
+ * /bin -> /usr/bin).
+ *
+ * shortcut: on Windows, npm's .cmd shims do not resolve to their package, so
+ * other installs there show version unknown; parse the shim if that matters.
+ */
+export declare function installsOnPath(pathEnv: string, ownPackageDir: string): Install[];
+export declare function buildReport(opts: {
+    offline?: boolean;
+}, d: VersionDeps): VersionReport;
+export declare function defaultDeps(): VersionDeps;
+export declare function printReport(r: VersionReport, log?: (l: string) => void): void;
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: {
+        json?: boolean;
+        offline?: boolean;
+    }): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=version.d.ts.map

package/dist/src/commands/_top/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../../../src/commands/_top/version.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAK5C,MAAM,WAAW,OAAO;IACtB,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wCAAwC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAWD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,EAAE,CAoBhF;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,CAAC,EAAE,WAAW,GAAG,aAAa,CA4BtF;AAeD,wBAAgB,WAAW,IAAI,WAAW,CAMzC;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAkB,GAAG,IAAI,CAO1F;;;;;;;iBAQoB;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;;AAN1D,wBAWE"}

package/dist/src/commands/_top/version.js

@@ -0,0 +1,175 @@
+/**
+ * `prism-cli version`: this CLI's version, whether npm has a newer one, and
+ * any other prism-cli on PATH that shadows this one or differs from it (an old
+ * /usr/bin/prism-cli under a system Node is the usual case).
+ *
+ * The npm check never fails the command: a timeout, no network or no npm is
+ * reported as "not checked". `--offline` skips it. `prism-cli --version` stays
+ * the bare version string from commander.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const PACKAGE_NAME = '@prism-d1/cli';
+const BIN_NAME = 'prism-cli';
+/** Short: this runs on every `version` call and must not stall a terminal. */
+const NPM_TIMEOUT_MS = 5000;
+/** Walks up from `start` to the package.json of @prism-d1/cli, at most 6 levels. */
+export function findPackageDir(start) {
+    let dir = start;
+    for (let i = 0; i < 6; i++) {
+        const pkg = join(dir, 'package.json');
+        if (existsSync(pkg)) {
+            try {
+                if (JSON.parse(readFileSync(pkg, 'utf8')).name === PACKAGE_NAME)
+                    return dir;
+            }
+            catch { /* not ours */ }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function packageVersion(dir) {
+    if (!dir)
+        return null;
+    try {
+        return String(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).version);
+    }
+    catch {
+        return null;
+    }
+}
+/** -1, 0 or 1, comparing dotted numeric versions; pre-release tags are ignored. */
+export function compareVersions(a, b) {
+    const pa = a.split(/[.-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0);
+    const pb = b.split(/[.-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++)
+        if (pa[i] !== pb[i])
+            return pa[i] > pb[i] ? 1 : -1;
+    return 0;
+}
+/**
+ * Every prism-cli on PATH, in PATH order, deduplicated by real path (e.g.
+ * /bin -> /usr/bin).
+ *
+ * shortcut: on Windows, npm's .cmd shims do not resolve to their package, so
+ * other installs there show version unknown; parse the shim if that matters.
+ */
+export function installsOnPath(pathEnv, ownPackageDir) {
+    const seen = new Set();
+    const out = [];
+    const exts = process.platform === 'win32' ? ['.cmd', ''] : [''];
+    const own = realOrSelf(ownPackageDir);
+    for (const dir of pathEnv.split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const p = join(dir, BIN_NAME + ext);
+            try {
+                if (!statSync(p).isFile())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            const real = realOrSelf(p);
+            if (seen.has(real))
+                continue;
+            seen.add(real);
+            const pkgDir = findPackageDir(dirname(real));
+            out.push({ path: p, realpath: real, version: packageVersion(pkgDir), isThis: !!pkgDir && realOrSelf(pkgDir) === own });
+        }
+    }
+    return out;
+}
+function realOrSelf(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+export function buildReport(opts, d) {
+    const version = packageVersion(d.ownPackageDir) ?? 'unknown';
+    const warnings = [];
+    const onPath = installsOnPath(d.pathEnv, d.ownPackageDir);
+    const first = onPath[0];
+    if (!first) {
+        warnings.push(`${BIN_NAME} is not on PATH; this copy runs only by its full path.`);
+    }
+    else if (!first.isThis) {
+        warnings.push(`"${BIN_NAME}" on PATH runs ${first.path} (${first.version ?? 'version unknown'}), not this CLI (${version}, ${d.ownPackageDir}).`);
+    }
+    const others = onPath.filter((i, n) => !i.isThis && n > 0 && i.version !== version);
+    for (const o of others) {
+        warnings.push(`Another ${BIN_NAME} on PATH: ${o.path} (${o.version ?? 'version unknown'}), shadowed by ${first.path}. A different Node or shell may run it; remove it with that Node's "npm uninstall -g ${PACKAGE_NAME}".`);
+    }
+    let latest = null;
+    let latestNote = null;
+    if (opts.offline) {
+        latestNote = 'offline';
+    }
+    else {
+        const r = d.npmLatest();
+        latest = r.version;
+        if (!latest)
+            latestNote = r.error || 'npm returned no version';
+    }
+    const updateAvailable = latest && version !== 'unknown' ? compareVersions(latest, version) > 0 : null;
+    return { schema: 'prism.version.v1', version, node: process.version, latest, updateAvailable, latestNote, onPath, warnings };
+}
+function realNpmLatest() {
+    const o = { encoding: 'utf8', timeout: NPM_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'] };
+    // Windows resolves npm.cmd only through a shell. The command is a constant
+    // with no user input, so the shell parses nothing it was given.
+    const r = process.platform === 'win32'
+        ? spawnSync(`npm view ${PACKAGE_NAME} version`, { ...o, shell: true })
+        : spawnSync('npm', ['view', PACKAGE_NAME, 'version'], o);
+    if (r.error)
+        return { version: null, error: r.error.code === 'ETIMEDOUT' ? `npm did not answer within ${NPM_TIMEOUT_MS / 1000}s` : r.error.message };
+    if (r.status !== 0)
+        return { version: null, error: (r.stderr || '').trim().split('\n')[0] || `npm exited ${r.status}` };
+    const v = (r.stdout || '').trim();
+    return /^\d+\.\d+\.\d+/.test(v) ? { version: v } : { version: null, error: 'unexpected npm output' };
+}
+export function defaultDeps() {
+    return {
+        ownPackageDir: findPackageDir(dirname(fileURLToPath(import.meta.url))) ?? process.cwd(),
+        pathEnv: process.env.PATH || '',
+        npmLatest: realNpmLatest,
+    };
+}
+export function printReport(r, log = console.log) {
+    log(`${BIN_NAME} ${r.version} (Node ${r.node})`);
+    if (r.updateAvailable)
+        log(`Update available: ${r.latest}. Run: npm install -g ${PACKAGE_NAME}`);
+    else if (r.latest)
+        log(`Up to date (latest on npm: ${r.latest}).`);
+    else if (r.latestNote === 'offline')
+        log('Update check skipped (--offline).');
+    else
+        log(`Update check: not checked (${r.latestNote}).`);
+    for (const w of r.warnings)
+        log(`⚠  ${w}`);
+}
+export default {
+    description: 'Print the CLI version, check npm for a newer release, and warn about other prism-cli copies on PATH',
+    options: [
+        { flags: '--json', description: 'Print the report as JSON' },
+        { flags: '--offline', description: 'Skip the npm check' },
+    ],
+    async action(opts) {
+        const report = buildReport(opts, defaultDeps());
+        if (opts.json)
+            console.log(JSON.stringify(report, null, 2));
+        else
+            printReport(report);
+    },
+};
+//# sourceMappingURL=version.js.map