@prism-d1/cli 1.6.0 → 1.7.1

package/dist/src/dashboard/aws-identity.d.ts

@@ -0,0 +1,115 @@
+import { aws } from '../utils/aws.js';
+import { writeConnectionFile, type SavedConnection } from '../aws/connection.js';
+/** Section name -> its key names (lower case), plus the region value: the only value kept. */
+export type IniKeys = Map<string, {
+    keys: Set<string>;
+    region?: string;
+}>;
+/**
+ * Key names per section. Values are discarded line by line; `region` is kept
+ * only when it looks like a region name. Indented lines are nested settings
+ * (e.g. s3 = ...) and are skipped.
+ */
+export declare function iniKeys(text: string, kind: 'config' | 'credentials'): IniKeys;
+export type CredentialType = 'credential_process' | 'sso' | 'static-credentials-file' | 'static-config-file' | 'assume-role' | 'web-identity' | 'env' | 'container' | 'none';
+export declare const CREDENTIAL_TYPE_LABEL: Record<CredentialType, string>;
+/**
+ * The type the AWS CLI would use for `profile`, in its provider order within a
+ * profile: role_arn, web identity, SSO, keys in the credentials file,
+ * credential_process, keys in the config file. `shadowed` lists the types that
+ * are configured but lose.
+ */
+export declare function classifyProfile(profile: string, config: IniKeys, creds: IniKeys): {
+    type: CredentialType;
+    shadowed: CredentialType[];
+};
+export interface ResolutionStep {
+    id: 'flags' | 'env' | 'repo' | 'user' | 'default';
+    label: string;
+    /** used: this step chose the credentials. skipped: set, but an earlier step won. */
+    state: 'used' | 'skipped' | 'not-set' | 'n/a';
+    detail: string;
+}
+export interface AwsIdentityView {
+    /** Profile name the AWS CLI is given, or null (env keys, container, or nothing). */
+    profile: string | null;
+    /** Why: "AWS_PROFILE", "aws connect, repo", "default chain", ... */
+    source: string;
+    credentialType: CredentialType;
+    credentialLabel: string;
+    region: {
+        value: string;
+        source: string;
+    } | null;
+    steps: ResolutionStep[];
+    /** The saved aws connect connection (the repo file, else the user file), whether or not it is in use. */
+    saved: null | {
+        scope: 'repo' | 'user';
+        path: string;
+        profile: string;
+        region: string;
+        account: string;
+        alias: string | null;
+        verifiedAt: string;
+        inUse: boolean;
+    };
+    warnings: string[];
+    files: {
+        config: string;
+        credentials: string;
+        configFound: boolean;
+        credentialsFound: boolean;
+    };
+}
+export interface IdentityDeps {
+    env: NodeJS.ProcessEnv;
+    home: string;
+    /** The repo the dashboard runs in (for .prism/aws.local.json), or null. */
+    repoRoot: string | null;
+    /** File reader; null when the file is missing or unreadable. */
+    readText?: (path: string) => string | null;
+}
+export declare const STATIC_DEFAULT_WARNING = "The default profile has static keys in ~/.aws/credentials. Static keys win over a credential_process or SSO setting for the same profile, and they often expire. If you sign in with credential_process or SSO, remove the keys from [default] in ~/.aws/credentials.";
+export declare const NO_CREDENTIALS_WARNING = "No AWS credentials found: no AWS env var, no saved aws connect profile, and no default profile in ~/.aws/config or ~/.aws/credentials. Set one up with aws configure sso (or aws configure), then run prism-cli aws connect.";
+/** What prism-cli would use, from local files and env only. No AWS call, no aws CLI call. */
+export declare function resolveAwsIdentity(d: IdentityDeps): AwsIdentityView;
+export type CheckNowResult = {
+    ok: true;
+    account: string;
+    arn: string;
+    region: string | null;
+    profile: string | null;
+    savedAccount: string | null;
+    matches: boolean | null;
+    updated: boolean;
+    note: string;
+} | {
+    ok: false;
+    expired: boolean;
+    error: string;
+    profile: string | null;
+    region: string | null;
+    fixes: string[];
+};
+export interface CheckNowDeps {
+    identity: AwsIdentityView;
+    /** The saved connection behind identity.saved (with its real path), or null. */
+    saved: SavedConnection | null;
+    /** Same shape as aws connect's deps.aws: one read-only `aws <args>` call. */
+    aws(args: string[], profile: string, region: string): ReturnType<typeof aws>;
+    now(): Date;
+    write?: typeof writeConnectionFile;
+    redact(s: string): string;
+}
+/** The fixes to suggest for a failed check, by credential type. */
+export declare function checkFixes(v: AwsIdentityView): string[];
+/** The default `aws` call for Check now: aws connect's call, with the region optional and a timeout. */
+export declare const CHECK_NOW_TIMEOUT_MS = 30000;
+export declare function checkNowAws(args: string[], profile: string, region: string): import("../utils/aws.js").AwsResult;
+/**
+ * One read-only `sts get-caller-identity`, through aws connect's callerIdentity.
+ * On a match with the saved connection (same profile and region), the saved
+ * file's verifiedAt is refreshed; nothing else is written.
+ */
+export declare function checkNow(d: CheckNowDeps): CheckNowResult;
+//# sourceMappingURL=aws-identity.d.ts.map

package/dist/src/dashboard/aws-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-identity.d.ts","sourceRoot":"","sources":["../../../src/dashboard/aws-identity.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,OAAO,EAA+D,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI9I,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAyB7E;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,KAAK,GAAG,yBAAyB,GAAG,oBAAoB,GACxG,aAAa,GAAG,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;AAElE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAUhE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAYtI;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,yGAAyG;IACzG,KAAK,EAAE,IAAI,GAAG;QACZ,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7G,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC5C;AAID,eAAO,MAAM,sBAAsB,0QAA0Q,CAAC;AAC9S,eAAO,MAAM,sBAAsB,iOAAiO,CAAC;AAErQ,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,eAAe,CAwEnE;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/K;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IAC7E,GAAG,IAAI,IAAI,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACnC,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAID,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CASvD;AAED,wGAAwG;AACxG,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uCAE1E;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,cAAc,CAsBxD"}

package/dist/src/dashboard/aws-identity.js

@@ -0,0 +1,240 @@
+/**
+ * The Setup page's AWS section: which credentials prism-cli would use and why,
+ * with no AWS call, and the one read-only "Check now" call.
+ *
+ * Resolution follows the order every AWS command uses (aws/connection.ts):
+ * flags (none here), env credentials, .prism/aws.local.json, ~/.prism/aws.json,
+ * then the default chain. The credential TYPE comes from the KEY NAMES in
+ * ~/.aws/config and ~/.aws/credentials. The parser drops every value as it
+ * reads a line, except `region`, so no secret is kept, returned or shown.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { aws } from '../utils/aws.js';
+import { callerIdentity } from '../aws/connect.js';
+import { applyConnection, connectionLabel, loadConnection, REGION_RE, writeConnectionFile } from '../aws/connection.js';
+import { resolveRegion } from '../security/setup.js';
+import { tildeHome } from './payload.js';
+/**
+ * Key names per section. Values are discarded line by line; `region` is kept
+ * only when it looks like a region name. Indented lines are nested settings
+ * (e.g. s3 = ...) and are skipped.
+ */
+export function iniKeys(text, kind) {
+    const out = new Map();
+    let cur = null;
+    for (const raw of text.split(/\r?\n/)) {
+        if (/^\s/.test(raw))
+            continue;
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const sec = /^\[\s*([^\]]+?)\s*\]$/.exec(line);
+        if (sec) {
+            // config: [default] and [profile name]; [sso-session x] and others are not profiles.
+            const name = kind === 'credentials' ? sec[1] : sec[1] === 'default' ? 'default' : /^profile\s+(.+)$/.exec(sec[1])?.[1]?.trim();
+            cur = name ? (out.get(name) ?? { keys: new Set() }) : null;
+            if (name && cur)
+                out.set(name, cur);
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (!cur || eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim().toLowerCase();
+        cur.keys.add(key);
+        if (key === 'region') {
+            const v = line.slice(eq + 1).trim();
+            if (REGION_RE.test(v))
+                cur.region = v;
+        }
+    }
+    return out;
+}
+export const CREDENTIAL_TYPE_LABEL = {
+    credential_process: 'credential_process',
+    sso: 'IAM Identity Center (SSO)',
+    'static-credentials-file': 'static keys in ~/.aws/credentials',
+    'static-config-file': 'static keys in ~/.aws/config',
+    'assume-role': 'assume role (role_arn)',
+    'web-identity': 'web identity token',
+    env: 'environment variables',
+    container: 'container credentials',
+    none: 'none found',
+};
+/**
+ * The type the AWS CLI would use for `profile`, in its provider order within a
+ * profile: role_arn, web identity, SSO, keys in the credentials file,
+ * credential_process, keys in the config file. `shadowed` lists the types that
+ * are configured but lose.
+ */
+export function classifyProfile(profile, config, creds) {
+    const c = config.get(profile)?.keys ?? new Set();
+    const k = creds.get(profile)?.keys ?? new Set();
+    const present = [];
+    if (c.has('role_arn') && (c.has('web_identity_token_file')))
+        present.push('web-identity');
+    else if (c.has('role_arn') || k.has('role_arn'))
+        present.push('assume-role');
+    if (c.has('sso_session') || c.has('sso_start_url') || c.has('sso_account_id'))
+        present.push('sso');
+    if (k.has('aws_access_key_id'))
+        present.push('static-credentials-file');
+    if (c.has('credential_process') || k.has('credential_process'))
+        present.push('credential_process');
+    if (c.has('aws_access_key_id'))
+        present.push('static-config-file');
+    if (!present.length)
+        return { type: 'none', shadowed: [] };
+    return { type: present[0], shadowed: present.slice(1) };
+}
+const readTextFile = (p) => { try {
+    return readFileSync(p, 'utf8');
+}
+catch {
+    return null;
+} };
+export const STATIC_DEFAULT_WARNING = 'The default profile has static keys in ~/.aws/credentials. Static keys win over a credential_process or SSO setting for the same profile, and they often expire. If you sign in with credential_process or SSO, remove the keys from [default] in ~/.aws/credentials.';
+export const NO_CREDENTIALS_WARNING = 'No AWS credentials found: no AWS env var, no saved aws connect profile, and no default profile in ~/.aws/config or ~/.aws/credentials. Set one up with aws configure sso (or aws configure), then run prism-cli aws connect.';
+/** What prism-cli would use, from local files and env only. No AWS call, no aws CLI call. */
+export function resolveAwsIdentity(d) {
+    const read = d.readText ?? readTextFile;
+    const env = d.env;
+    const configPath = env.AWS_CONFIG_FILE || join(d.home, '.aws', 'config');
+    const credsPath = env.AWS_SHARED_CREDENTIALS_FILE || join(d.home, '.aws', 'credentials');
+    const configText = read(configPath), credsText = read(credsPath);
+    const config = iniKeys(configText ?? '', 'config');
+    const creds = iniKeys(credsText ?? '', 'credentials');
+    const saved = loadConnection(d.home, d.repoRoot);
+    const applied = applyConnection({}, saved, env);
+    const warnings = [];
+    let profile = null, source, type, shadowed = [];
+    let envDetail = 'no AWS credential env var set';
+    let decided;
+    if (env.AWS_ACCESS_KEY_ID) {
+        type = 'env';
+        source = 'AWS_ACCESS_KEY_ID';
+        decided = 'env';
+        envDetail = `AWS_ACCESS_KEY_ID is set${env.AWS_PROFILE ? ' (it wins over AWS_PROFILE)' : ''}`;
+    }
+    else if (env.AWS_PROFILE) {
+        profile = env.AWS_PROFILE;
+        source = 'AWS_PROFILE';
+        decided = 'env';
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+        envDetail = `AWS_PROFILE=${profile}`;
+    }
+    else if (env.AWS_WEB_IDENTITY_TOKEN_FILE) {
+        type = 'web-identity';
+        source = 'AWS_WEB_IDENTITY_TOKEN_FILE';
+        decided = 'env';
+        envDetail = 'AWS_WEB_IDENTITY_TOKEN_FILE is set';
+    }
+    else if (env.AWS_CONTAINER_CREDENTIALS_FULL_URI || env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
+        type = 'container';
+        source = 'container credentials env var';
+        decided = 'env';
+        envDetail = 'a container credentials env var is set';
+    }
+    else if (saved && applied.profileSource) {
+        profile = saved.profile;
+        source = connectionLabel(saved);
+        decided = saved.scope;
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+    }
+    else {
+        profile = 'default';
+        source = 'default chain';
+        decided = 'default';
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+    }
+    const repoFile = d.repoRoot ? join(d.repoRoot, '.prism', 'aws.local.json') : null;
+    const savedStep = (scope) => decided === scope ? 'used' : saved?.scope === scope ? 'skipped' : 'not-set';
+    const steps = [
+        { id: 'flags', label: '--profile / --region', state: 'n/a', detail: 'not used by the dashboard' },
+        { id: 'env', label: 'Environment', state: decided === 'env' ? 'used' : 'not-set', detail: envDetail },
+        { id: 'repo', label: 'Repo: .prism/aws.local.json', state: savedStep('repo'),
+            detail: !repoFile ? 'the dashboard is not running in a git repo' : saved?.scope === 'repo' ? `profile ${saved.profile}` : 'not set' },
+        { id: 'user', label: 'User: ~/.prism/aws.json', state: savedStep('user'),
+            detail: saved?.scope === 'user' ? `profile ${saved.profile}` : saved?.scope === 'repo' ? 'the repo file wins' : 'not set' },
+        { id: 'default', label: 'Default chain', state: decided === 'default' ? 'used' : 'not-set', detail: 'the [default] profile' },
+    ];
+    const configRegion = (p) => config.get(p ?? env.AWS_PROFILE ?? 'default')?.region ?? null;
+    const region = resolveRegion({ profile: profile && profile !== 'default' ? profile : undefined, connection: applied.connection }, { env, configRegion });
+    if (creds.get('default')?.keys.has('aws_access_key_id'))
+        warnings.push(STATIC_DEFAULT_WARNING);
+    if (profile && profile !== 'default' && type === 'static-credentials-file' && shadowed.length) {
+        warnings.push(`Profile ${profile} has static keys in ~/.aws/credentials, and they win over its ${shadowed.map((t) => CREDENTIAL_TYPE_LABEL[t]).join(' and ')}. Remove the keys if they are stale.`);
+    }
+    if (type === 'none') {
+        warnings.push(profile && profile !== 'default'
+            ? `Profile ${profile} (${source}) is not configured in ~/.aws/config or ~/.aws/credentials. Create it with aws configure sso --profile ${profile}, or re-run prism-cli aws connect.`
+            : NO_CREDENTIALS_WARNING);
+    }
+    if (saved && !applied.profileSource)
+        warnings.push(`The saved aws connect profile ${saved.profile} is not used: ${source} is set in the dashboard's environment and wins.`);
+    return {
+        profile, source, credentialType: type, credentialLabel: CREDENTIAL_TYPE_LABEL[type],
+        region: region ? { value: region.region, source: region.source } : null,
+        steps,
+        saved: saved ? {
+            scope: saved.scope, path: tildeHome(saved.path, d.home), profile: saved.profile, region: saved.region, account: saved.account,
+            alias: saved.alias, verifiedAt: saved.verifiedAt, inUse: !!applied.profileSource,
+        } : null,
+        warnings,
+        files: { config: tildeHome(configPath, d.home), credentials: tildeHome(credsPath, d.home), configFound: configText !== null, credentialsFound: credsText !== null },
+    };
+}
+const EXPIRED_RE = /expired|ExpiredToken|InvalidClientTokenId|UnrecognizedClient|RequestExpired|SignatureDoesNotMatch|AuthFailure|Unable to locate credentials|NoCredentialProviders|refresh|sso|credential_process|custom-process/i;
+/** The fixes to suggest for a failed check, by credential type. */
+export function checkFixes(v) {
+    const p = v.profile && v.profile !== 'default' ? ` --profile ${v.profile}` : '';
+    const out = [];
+    if (v.credentialType === 'credential_process')
+        out.push('Sign in again with the tool your credential_process runs, then Check now again');
+    if (v.credentialType === 'sso')
+        out.push(`aws sso login${p}`);
+    if (v.credentialType === 'static-credentials-file' || v.warnings.includes(STATIC_DEFAULT_WARNING))
+        out.push('Remove or rotate the stale static keys in ~/.aws/credentials');
+    if (v.credentialType === 'none')
+        out.push(`aws configure sso${p}`);
+    out.push('prism-cli aws connect');
+    return out;
+}
+/** The default `aws` call for Check now: aws connect's call, with the region optional and a timeout. */
+export const CHECK_NOW_TIMEOUT_MS = 30_000;
+export function checkNowAws(args, profile, region) {
+    return aws(region ? [...args, '--region', region] : args, { profile: profile || undefined, env: { AWS_PAGER: '' }, timeoutMs: CHECK_NOW_TIMEOUT_MS });
+}
+/**
+ * One read-only `sts get-caller-identity`, through aws connect's callerIdentity.
+ * On a match with the saved connection (same profile and region), the saved
+ * file's verifiedAt is refreshed; nothing else is written.
+ */
+export function checkNow(d) {
+    const v = d.identity;
+    // --profile only for a saved aws connect profile; env and the default chain are left to the AWS CLI, as every AWS command does.
+    const profile = d.saved && v.saved?.inUse ? d.saved.profile : '';
+    const region = v.region?.value ?? '';
+    const id = callerIdentity({ aws: d.aws }, profile, region);
+    if ('error' in id) {
+        const error = d.redact(id.error);
+        return { ok: false, expired: EXPIRED_RE.test(error), error, profile: v.profile, region: region || null, fixes: checkFixes(v) };
+    }
+    const s = d.saved;
+    const matches = s ? s.account === id.account : null;
+    let updated = false, note;
+    if (!s)
+        note = 'No saved aws connect connection; nothing was written. Save one with prism-cli aws connect.';
+    else if (!matches)
+        note = `Does not match the saved account ${s.account}. The saved file was not changed; check the profile, then re-run prism-cli aws connect${s.scope === 'repo' ? ' --repo' : ''}.`;
+    else if (s.profile !== v.profile || s.region !== region)
+        note = `Matches the saved account, but the check used ${v.profile ? `profile ${v.profile}` : v.source} in ${region || 'no region'}, not the saved pair; the saved file was not changed.`;
+    else {
+        (d.write ?? writeConnectionFile)(s.path, { profile: s.profile, region: s.region, account: s.account, alias: s.alias, verifiedAt: d.now().toISOString() });
+        updated = true;
+        note = `Matches the saved account; updated the verified time in ${v.saved?.path ?? s.path}.`;
+    }
+    return { ok: true, account: id.account, arn: id.arn, region: region || null, profile: v.profile, savedAccount: s?.account ?? null, matches, updated, note };
+}
+//# sourceMappingURL=aws-identity.js.map

package/dist/src/dashboard/aws-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-identity.js","sourceRoot":"","sources":["../../../src/dashboard/aws-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AAC9I,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAKzC;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAA8B;IAClE,MAAM,GAAG,GAAY,IAAI,GAAG,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAkD,IAAI,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,GAAG,EAAE,CAAC;YACR,qFAAqF;YACrF,MAAM,IAAI,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC/H,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,IAAI,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD,MAAM,CAAC,MAAM,qBAAqB,GAAmC;IACnE,kBAAkB,EAAE,oBAAoB;IACxC,GAAG,EAAE,2BAA2B;IAChC,yBAAyB,EAAE,mCAAmC;IAC9D,oBAAoB,EAAE,8BAA8B;IACpD,aAAa,EAAE,wBAAwB;IACvC,cAAc,EAAE,oBAAoB;IACpC,GAAG,EAAE,uBAAuB;IAC5B,SAAS,EAAE,uBAAuB;IAClC,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAe,EAAE,KAAc;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,IAAI,GAAG,EAAU,CAAC;IACzD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,IAAI,GAAG,EAAU,CAAC;IACxD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SACrF,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAqCD,MAAM,YAAY,GAAG,CAAC,CAAS,EAAiB,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,IAAI,CAAC;AAAC,CAAC,CAAC,CAAC,CAAC;AAEtH,MAAM,CAAC,MAAM,sBAAsB,GAAG,uQAAuQ,CAAC;AAC9S,MAAM,CAAC,MAAM,sBAAsB,GAAG,8NAA8N,CAAC;AAErQ,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,CAAe;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,GAAkB,IAAI,EAAE,MAAc,EAAE,IAAoB,EAAE,QAAQ,GAAqB,EAAE,CAAC;IACzG,IAAI,SAAS,GAAG,+BAA+B,CAAC;IAChD,IAAI,OAA6B,CAAC;IAClC,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,CAAC;QAAC,MAAM,GAAG,mBAAmB,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC;QAC5D,SAAS,GAAG,2BAA2B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;SAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC;QAAC,MAAM,GAAG,aAAa,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC;QACnE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/D,SAAS,GAAG,eAAe,OAAO,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC3C,IAAI,GAAG,cAAc,CAAC;QAAC,MAAM,GAAG,6BAA6B,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC;QAAC,SAAS,GAAG,oCAAoC,CAAC;IACnI,CAAC;SAAM,IAAI,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,sCAAsC,EAAE,CAAC;QAChG,IAAI,GAAG,WAAW,CAAC;QAAC,MAAM,GAAG,+BAA+B,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC;QAAC,SAAS,GAAG,wCAAwC,CAAC;IACtI,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1C,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;QAChF,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,SAAS,CAAC;QAAC,MAAM,GAAG,eAAe,CAAC;QAAC,OAAO,GAAG,SAAS,CAAC;QACnE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,SAAS,GAAG,CAAC,KAAsB,EAA2B,EAAE,CACpE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,KAAK,GAAqB;QAC9B,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE;QACjG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;QACrG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;YAC1E,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE;QACvI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;YACtE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE;QAC7H,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE;KAC9H,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IACnG,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAEzJ,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,yBAAyB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC9F,QAAQ,CAAC,IAAI,CAAC,WAAW,OAAO,iEAAiE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACtM,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;YAC5C,CAAC,CAAC,WAAW,OAAO,KAAK,MAAM,0GAA0G,OAAO,oCAAoC;YACpL,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,OAAO,iBAAiB,MAAM,kDAAkD,CAAC,CAAC;IAE5K,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,qBAAqB,CAAC,IAAI,CAAC;QACnF,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QACvE,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACb,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;YAC7H,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa;SACjF,CAAC,CAAC,CAAC,IAAI;QACR,QAAQ;QACR,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI,EAAE,gBAAgB,EAAE,SAAS,KAAK,IAAI,EAAE;KACpK,CAAC;AACJ,CAAC;AAiBD,MAAM,UAAU,GAAG,iNAAiN,CAAC;AAErO,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAC,CAAkB;IAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,CAAC,cAAc,KAAK,oBAAoB;QAAE,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC1I,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,cAAc,KAAK,yBAAyB,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC5K,IAAI,CAAC,CAAC,cAAc,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,OAAe,EAAE,MAAc;IACzE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACxJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAe;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrB,gIAAgI;IAChI,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,EAAE,IAAY,CAAC;IAClC,IAAI,CAAC,CAAC;QAAE,IAAI,GAAG,4FAA4F,CAAC;SACvG,IAAI,CAAC,OAAO;QAAE,IAAI,GAAG,oCAAoC,CAAC,CAAC,OAAO,yFAAyF,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;SAClM,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,IAAI,GAAG,iDAAiD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,MAAM,IAAI,WAAW,uDAAuD,CAAC;SAC7O,CAAC;QACJ,CAAC,CAAC,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1J,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,GAAG,2DAA2D,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9J,CAAC"}

package/dist/src/dashboard/page.d.ts

@@ -1,10 +1,10 @@
 /**
  * The dashboard's single-page app: one self-contained HTML document with
  * inline CSS and JS (nonce-gated by the CSP), no CDN and no network fetch
- * other than its own GET /api/data, so it works offline.
+ * other than its own GET routes (/api/data, then /api/usage), so it works offline.
  *
  * Every value from the payload is placed with textContent or a DOM attribute;
  * innerHTML is never used for data.
  */
-export declare function renderPage(nonce: string): string;
+export declare function renderPage(nonce: string, csrf?: string): string;
 //# sourceMappingURL=page.d.ts.map

package/dist/src/dashboard/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6nBH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQhD"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAqqBH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAgB3D"}

package/dist/src/dashboard/page.js

@@ -1,16 +1,19 @@
 /**
  * The dashboard's single-page app: one self-contained HTML document with
  * inline CSS and JS (nonce-gated by the CSP), no CDN and no network fetch
- * other than its own GET /api/data, so it works offline.
+ * other than its own GET routes (/api/data, then /api/usage), so it works offline.
  *
  * Every value from the payload is placed with textContent or a DOM attribute;
  * innerHTML is never used for data.
  */
+import { SETUP_SCRIPT, SETUP_STYLE, THEME_BOOT, THEME_SCRIPT } from './setup-page.js';
+/** Colour tokens; the dark set applies by system preference unless the toggle picks Light, and always with Dark. */
+const LIGHT_VARS = '--bg:#f7f7f8; --card:#fff; --text:#1d1d1f; --muted:#6b6b73; --line:#e3e3e8; --ok:#1a7f37; --warn:#9a6700; --bad:#cf222e; --high:#cf222e; --medium:#bf8700; --low:#3d6fa8; --accent:#0969da; --raised:var(--bg);';
+const DARK_VARS = '--bg:#0d1117; --card:#161b22; --text:#e6edf3; --muted:#8b949e; --line:#30363d; --ok:#3fb950; --warn:#d29922; --bad:#f85149; --high:#f85149; --medium:#d29922; --low:#a5d6ff; --accent:#58a6ff; --raised:#21262d;';
 const STYLE = `
-:root { color-scheme: light dark; --bg:#f7f7f8; --card:#fff; --text:#1d1d1f; --muted:#6b6b73; --line:#e3e3e8;
-  --ok:#1a7f37; --warn:#9a6700; --bad:#cf222e; --high:#cf222e; --medium:#bf8700; --low:#3d6fa8; --accent:#0969da; --raised:var(--bg); }
-@media (prefers-color-scheme: dark) { :root { --bg:#0d1117; --card:#161b22; --text:#e6edf3; --muted:#8b949e; --line:#30363d;
-  --ok:#3fb950; --warn:#d29922; --bad:#f85149; --high:#f85149; --medium:#d29922; --low:#a5d6ff; --accent:#58a6ff; --raised:#21262d; } }
+:root { color-scheme: light; ${LIGHT_VARS} }
+@media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { color-scheme: dark; ${DARK_VARS} } }
+:root[data-theme="dark"] { color-scheme: dark; ${DARK_VARS} }
 * { box-sizing: border-box; }
 body { margin:0; font:14px/1.45 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:var(--bg); color:var(--text); }
 header { display:flex; flex-wrap:wrap; align-items:center; gap:8px 12px; padding:14px 20px; border-bottom:1px solid var(--line); background:var(--card); }
@@ -59,8 +62,10 @@ svg.trend line { stroke:var(--line); }
 .slim-line { padding:5px 0; border-top:1px solid var(--line); font-size:13px; overflow-wrap:anywhere; } .slim-line:first-of-type { border-top:none; } .slim-line code { white-space:normal; overflow-wrap:anywhere; }
 .empty-line { color:var(--muted); margin:10px 0 4px; font-size:13px; overflow-wrap:anywhere; } .empty-line b { color:var(--text); }
 .changed { outline:2px solid var(--accent); outline-offset:1px; border-radius:4px; }
+.loading { color:var(--muted); }
 @keyframes prism-flash { from { background-color:color-mix(in srgb, var(--accent) 35%, transparent); } to { background-color:transparent; } }
 @media (prefers-reduced-motion: no-preference) { .changed { animation:prism-flash 2.5s ease-out 1; } }
+${SETUP_STYLE}
 `;
 const SCRIPT = `
 'use strict';
@@ -165,9 +170,11 @@ function summaryPanel(sum) {
   }
   const sp = sum && sum.spend;
   const ok = sp && sp.status === 'ok';
+  const loadingUsage = sp && sp.status === 'loading';
+  const updated = sp && sp.updatedAt ? ' · updated ' + when(sp.updatedAt) : '';
   const spendCard = (label, key, n, det) => scard(label,
-    ok ? track(key, n, el('div', { class: 'v' }, money(n, sp.currency))) : el('div', { class: 'v' }, '-'),
-    detail(ok ? det : txt((sp && sp.message) || (sp && sp.status) || 'no codeburn data')));
+    ok ? track(key, n, el('div', { class: 'v' }, money(n, sp.currency))) : el('div', { class: 'v' + (loadingUsage ? ' loading' : '') }, loadingUsage ? 'loading' : '-'),
+    detail(ok ? det + updated : txt((sp && sp.message) || (sp && sp.status) || 'no codeburn data')));
   box.append(spendCard('Spend today', 'sum:today', sp && sp.today, 'codeburn, all projects'));
   box.append(spendCard('Spend this month', 'sum:month', sp && sp.month, 'codeburn, this calendar month'));
   const w = (sum && sum.warnings) || { count: 0, first: null };
@@ -326,7 +333,17 @@ function codewatchPanel(data) {
   return s;
 }
 
+/** "updated <time>", and whether a refresh is running or the last one failed. */
+function usageUpdated(u) {
+  if (!u.updatedAt) return null;
+  return el('p', { class: 'note' }, 'updated ' + when(u.updatedAt)
+    + (u.refreshError ? ' · refresh failed: ' + txt(u.refreshError) : u.stale ? ' · refreshing in the background' : ''));
+}
+
 function usagePanel(u) {
+  if (u.status === 'loading') {
+    return el('section', { class: 'card' }, el('h2', {}, 'Usage (codeburn)'), el('p', { class: 'empty loading' }, txt(u.message)));
+  }
   if (u.status === 'not-installed' || u.status === 'no-data') {
     return emptyLine('Usage (codeburn)', txt(u.message), u.status === 'not-installed' ? '' : el('span', {}, ' Usage appears once a coding tool records sessions; full charts: ', el('code', {}, txt(u.fullView)), '.'));
   }
@@ -342,7 +359,7 @@ function usagePanel(u) {
     s.append(el('h3', {}, 'Top projects this month'));
     s.append(table(['Project', 'Cost', 'Sessions'], u.topProjects.map((p) => [el('span', { title: p.path }, p.name), num(money(p.cost, u.currency)), num(p.sessions)])));
   }
-  s.append(el('p', { class: 'note' }, 'Full charts: run ', el('code', {}, txt(u.fullView)), ' in a terminal.'));
+  s.append(usageUpdated(u) || '', el('p', { class: 'note' }, 'Full charts: run ', el('code', {}, txt(u.fullView)), ' in a terminal.'));
   return s;
 }
 
@@ -591,10 +608,29 @@ function awsPanel(aws) {
 const AUTO_REFRESH_MS = 60000;
 let lastLoad = 0, loading = false;
 
-async function load() {
+/**
+ * Two stages: /api/data (local checks, with cached usage or "loading") paints
+ * at once; then /api/usage, and when its usage differs from what was painted,
+ * /api/data again (cheap: the server rebuilds it from the cache). fresh: the
+ * Refresh button, which runs new codeburn exports; auto-refresh uses the cache.
+ */
+async function load(fresh) {
   if (loading) return;
   loading = true;
-  try { await render(); } finally { loading = false; lastLoad = Date.now(); }
+  try {
+    const data = await render();
+    if (!data) return;
+    let u;
+    try { u = await getJson('/api/usage' + (fresh ? '?fresh=1' : '')); } catch (e) { return; }
+    const was = data.usage || {};
+    if (u && u.usage && (u.usage.updatedAt !== was.updatedAt || u.usage.status !== was.status)) await render();
+  } finally { loading = false; lastLoad = Date.now(); }
+}
+
+async function getJson(path) {
+  const res = await fetch(path, { credentials: 'same-origin', cache: 'no-store' });
+  if (!res.ok) throw new Error('HTTP ' + res.status);
+  return res.json();
 }
 
 async function render() {
@@ -603,13 +639,11 @@ async function render() {
   meta.textContent = 'loading...';
   let data;
   try {
-    const res = await fetch('/api/data', { credentials: 'same-origin', cache: 'no-store' });
-    if (!res.ok) throw new Error('HTTP ' + res.status);
-    data = await res.json();
+    data = await getJson('/api/data');
   } catch (e) {
     // Keep the last good view; say the refresh failed.
     meta.textContent = 'failed to load: ' + e.message + (before && before !== 'loading...' ? ' · showing ' + before : '');
-    return;
+    return null;
   }
   // Open/closed state of keyed <details> survives the redraw.
   const openState = new Map([...main.querySelectorAll('details[data-key]')].map((d) => [d.getAttribute('data-key'), d.open]));
@@ -633,19 +667,32 @@ async function render() {
   const c = data.overview.counts;
   meta.textContent = c.repos + ' repos under ' + txt(data.scope.root_display) + ' · ' + c.codewatch + ' with codewatch' + (data.scope.truncated ? ' (scan capped)' : '')
     + ' · updated ' + when(data.generated_at) + (changed.size ? ' · ' + changed.size + ' value' + (changed.size === 1 ? '' : 's') + ' changed (outlined)' : '') + ' · refreshes every minute while visible';
+  await renderSetup(data);
+  return data;
 }
-document.getElementById('refresh').addEventListener('click', load);
-setInterval(() => { if (document.visibilityState === 'visible' && Date.now() - lastLoad >= AUTO_REFRESH_MS - 1000) load(); }, AUTO_REFRESH_MS / 4);
-document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible' && Date.now() - lastLoad >= AUTO_REFRESH_MS) load(); });
-load();
+${SETUP_SCRIPT}
+${THEME_SCRIPT}
+document.getElementById('refresh').addEventListener('click', () => load(true));
+setInterval(() => { if (document.visibilityState === 'visible' && Date.now() - lastLoad >= AUTO_REFRESH_MS - 1000) load(false); }, AUTO_REFRESH_MS / 4);
+document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible' && Date.now() - lastLoad >= AUTO_REFRESH_MS) load(false); });
+load(false);
 `;
-export function renderPage(nonce) {
-    // The nonce is base64 generated server-side; nothing user-derived is interpolated here.
+export function renderPage(nonce, csrf = '') {
+    // The nonce and the CSRF token are base64/base64url generated server-side; nothing user-derived is interpolated here.
+    if (!/^[A-Za-z0-9_-]*$/.test(csrf))
+        throw new Error('bad CSRF token');
     return `<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="prism-csrf" content="${csrf}">
+<script nonce="${nonce}">${THEME_BOOT}</script>
 <title>PRISM dashboard</title><style nonce="${nonce}">${STYLE}</style></head>
-<body><header><h1>PRISM dashboard</h1><button id="refresh" type="button">Refresh</button><span class="meta" id="meta"></span></header>
+<body><header><h1>PRISM dashboard</h1>
+<nav class="tabs" aria-label="Views"><a href="#" data-view="dashboard">Dashboard</a><a href="#setup" data-view="setup">Setup</a></nav>
+<button id="refresh" type="button">Refresh</button>
+<div class="theme" role="group" aria-label="Theme"><button type="button" data-theme-set="light">Light</button><button type="button" data-theme-set="dark">Dark</button><button type="button" data-theme-set="system">System</button></div>
+<span class="meta" id="meta"></span></header>
 <main id="main"></main>
+<main id="setup" hidden></main>
 <script nonce="${nonce}">${SCRIPT}</script></body></html>`;
 }
 //# sourceMappingURL=page.js.map

package/dist/src/dashboard/page.js.map

@@ -1 +1 @@
-{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDb,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgkBd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,wFAAwF;IACxF,OAAO;;8CAEqC,KAAK,KAAK,KAAK;;;iBAG5C,KAAK,KAAK,MAAM,yBAAyB,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEtF,oHAAoH;AACpH,MAAM,UAAU,GAAG,iNAAiN,CAAC;AACrO,MAAM,SAAS,GAAG,kNAAkN,CAAC;AAErO,MAAM,KAAK,GAAG;+BACiB,UAAU;8FACqD,SAAS;iDACtD,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoDxD,WAAW;CACZ,CAAC;AAEF,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2lBb,YAAY;EACZ,YAAY;;;;;CAKb,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAI,GAAG,EAAE;IACjD,sHAAsH;IACtH,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,OAAO;;mCAE0B,IAAI;iBACtB,KAAK,KAAK,UAAU;8CACS,KAAK,KAAK,KAAK;;;;;;;;iBAQ5C,KAAK,KAAK,MAAM,yBAAyB,CAAC;AAC3D,CAAC"}

package/dist/src/dashboard/payload.d.ts

@@ -5,7 +5,7 @@
  */
 import { type CodewatchPanel, type SecretScanning } from './codewatch.js';
 import { type DiscoverOptions } from './repos.js';
-import { type CheckItem, type CodewatchSetup, type MachineDeps, type SecuritySetup } from './setup.js';
+import { type GitRunner, type CheckItem, type CodewatchSetup, type MachineDeps, type SecuritySetup } from './setup.js';
 import { type DashboardSummary } from './summary.js';
 import { type CheckHelp, type SyncMode, type SyncModeSource } from '../utils/sync-mode.js';
 import { type GlobalStatus } from '../codewatch/globalHooks.js';
@@ -129,10 +129,37 @@ export interface DashboardPayload {
     aws: AwsPanel;
     /** The one-glance summary shown at the top of the page (buildSummary). */
     summary: DashboardSummary;
+    /**
+     * Milliseconds per stage, for diagnosis (`dashboard --json --timing`). scan:
+     * repo discovery. setup: checks and codewatch results for every repo and
+     * this machine. usage: codeburn (runs alongside setup). cacheHit: usage came
+     * from the cache.
+     */
+    timing: PayloadTiming;
 }
+export interface PayloadTiming {
+    scan: number;
+    setup: number;
+    usage: number;
+    total: number;
+    cacheHit: boolean;
+}
+/** The usage panel and whether it came from the cache (usage-cache.ts). */
+export type UsageSource = () => Promise<{
+    usage: UsagePanel;
+    cacheHit: boolean;
+}>;
+/** At most this many repos are checked at once (each check is one git process). */
+export declare const GIT_CONCURRENCY = 8;
+/** fn over items, at most `limit` running at a time; results keep the input order. */
+export declare function mapLimit<T, R>(items: T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]>;
 export interface PayloadOptions extends DiscoverOptions {
     trendRuns?: number;
     exporter?: CodeburnExport;
+    /** Default: collectUsage with `exporter`, uncached. */
+    usage?: UsageSource;
+    /** Runs the per-repo git calls; injected in tests. */
+    git?: GitRunner;
     machineDeps?: MachineDeps;
     pathEnv?: string;
 }