@knpkv/codecommit-core 0.5.1 → 0.6.0

package/dist/AwsClient/AwsClientGated.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @title AwsClientGated — transparent permission proxy
+ *
+ * Wraps every AwsClient method with permission check + audit logging.
+ * Returns the same `AwsClient.Service` type — callers don't know it exists.
+ *
+ * Two patterns:
+ *   1. InnerAwsClient tag — holds the real implementation, avoids circular dep
+ *   2. Service capture at Layer construction — all services yielded once,
+ *      closed over in gate/wrapEffect/wrapStream, no R leakage
+ *
+ * PermissionDeniedError → AwsApiError at the boundary for type transparency.
+ * The actual PermissionDeniedError is preserved as the AwsApiError's `cause`.
+ *
+ * @module
+ */
+import { Context, Layer } from "effect";
+import { AuditLogRepo } from "../PermissionService/AuditLog.js";
+import { PermissionService } from "../PermissionService/index.js";
+import { PermissionGate } from "../PermissionService/PermissionGate.js";
+import { AwsClient } from "./index.js";
+declare const InnerAwsClient_base: Context.TagClass<InnerAwsClient, "@knpkv/codecommit-core/InnerAwsClient", AwsClient.Service>;
+export declare class InnerAwsClient extends InnerAwsClient_base {
+}
+export declare const AwsClientGatedLive: Layer.Layer<AwsClient, never, InnerAwsClient | PermissionService | PermissionGate | AuditLogRepo>;
+export {};
+//# sourceMappingURL=AwsClientGated.d.ts.map

package/dist/AwsClient/AwsClientGated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsClientGated.d.ts","sourceRoot":"","sources":["../../src/AwsClient/AwsClientGated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAU,KAAK,EAAiB,MAAM,QAAQ,CAAA;AAG9D,OAAO,EAAE,YAAY,EAAyB,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAuB,MAAM,YAAY,CAAA;;AAG3D,qBAAa,cAAe,SAAQ,mBAGjC;CAAG;AAiBN,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAC1C,SAAS,EACT,KAAK,EACL,cAAc,GAAG,iBAAiB,GAAG,cAAc,GAAG,YAAY,CAmKnE,CAAA"}

package/dist/AwsClient/AwsClientGated.js

@@ -0,0 +1,105 @@
+/**
+ * @title AwsClientGated — transparent permission proxy
+ *
+ * Wraps every AwsClient method with permission check + audit logging.
+ * Returns the same `AwsClient.Service` type — callers don't know it exists.
+ *
+ * Two patterns:
+ *   1. InnerAwsClient tag — holds the real implementation, avoids circular dep
+ *   2. Service capture at Layer construction — all services yielded once,
+ *      closed over in gate/wrapEffect/wrapStream, no R leakage
+ *
+ * PermissionDeniedError → AwsApiError at the boundary for type transparency.
+ * The actual PermissionDeniedError is preserved as the AwsApiError's `cause`.
+ *
+ * @module
+ */
+import { Context, Effect, Layer, Match, Stream } from "effect";
+import { AwsApiError, PermissionDeniedError } from "../Errors.js";
+import { AuditLogRepo } from "../PermissionService/AuditLog.js";
+import { PermissionService } from "../PermissionService/index.js";
+import { getOperationMeta } from "../PermissionService/operations.js";
+import { PermissionGate } from "../PermissionService/PermissionGate.js";
+import { AwsClient } from "./index.js";
+// Layer composition: AwsClientLive → InnerAwsClient (rename) → AwsClientGated → AwsClient
+export class InnerAwsClient extends Context.Tag("@knpkv/codecommit-core/InnerAwsClient")() {
+}
+const toDeniedError = (p, reason) => new AwsApiError({
+    operation: p.operation,
+    profile: p.accountProfile,
+    region: p.region,
+    cause: new PermissionDeniedError({ operation: p.operation, reason })
+});
+export const AwsClientGatedLive = Layer.effect(AwsClient, Effect.gen(function* () {
+    const inner = yield* InnerAwsClient;
+    const permService = yield* PermissionService;
+    const gateService = yield* PermissionGate;
+    const auditLog = yield* AuditLogRepo;
+    // --- Core gate logic (captured services, no R leakage) ---
+    // Reads auditEnabled dynamically from Ref on each call —
+    // toggling audit in settings takes effect without restart
+    const logAudit = (params, permissionState, durationMs) => permService.isAuditEnabled().pipe(Effect.flatMap((enabled) => enabled
+        ? auditLog.log({
+            timestamp: new Date().toISOString(),
+            operation: params.operation,
+            accountProfile: params.accountProfile,
+            region: params.region,
+            permissionState,
+            context: params.context,
+            durationMs
+        })
+        : Effect.void), Effect.catchAll(() => Effect.void));
+    const promptUser = (params) => Effect.gen(function* () {
+        const meta = getOperationMeta(params.operation);
+        const response = yield* gateService.request({
+            id: globalThis.crypto.randomUUID(),
+            operation: params.operation,
+            category: meta.category,
+            context: params.context
+        }).pipe(Effect.mapError(() => toDeniedError(params, "timeout")));
+        return yield* Match.value(response).pipe(Match.when("always_allow", () => permService.set(params.operation, "always_allow").pipe(Effect.as("always_allowed"))), Match.when("deny", () => Effect.gen(function* () {
+            yield* permService.set(params.operation, "deny");
+            yield* logAudit(params, "denied", null);
+            return yield* toDeniedError(params, "denied");
+        })), Match.when("allow_once", () => Effect.succeed("allowed")), Match.exhaustive);
+    });
+    const checkPermission = (params) => Effect.gen(function* () {
+        const state = yield* permService.check(params.operation);
+        return yield* Match.value(state).pipe(Match.when("always_allow", () => Effect.succeed("always_allowed")), Match.when("deny", () => logAudit(params, "denied", null).pipe(Effect.zipRight(toDeniedError(params, "denied")))), Match.when("allow", () => promptUser(params)), Match.exhaustive);
+    });
+    // --- Declarative wrapping: gated(op, ctx, acct, method) → wrapped method ---
+    // P inferred from `method` (last arg) — `acct` and `ctx` just extract strings
+    const gated = (op, ctx, acct, method) => (params) => {
+        const a = acct(params);
+        const g = { operation: op, context: ctx(params), accountProfile: a.profile, region: a.region };
+        return Effect.gen(function* () {
+            const ps = yield* checkPermission(g);
+            const start = Date.now();
+            const result = yield* method(params);
+            yield* logAudit(g, ps, Date.now() - start);
+            return result;
+        });
+    };
+    const gatedStream = (op, ctx, acct, method) => (params) => {
+        const a = acct(params);
+        const g = { operation: op, context: ctx(params), accountProfile: a.profile, region: a.region };
+        return Stream.unwrap(checkPermission(g).pipe(Effect.map((ps) => {
+            const start = Date.now();
+            return method(params).pipe(Stream.onDone(() => logAudit(g, ps, Date.now() - start)));
+        })));
+    };
+    const self = (a) => a;
+    const nested = (p) => p.account;
+    return {
+        getPullRequests: gatedStream("getPullRequests", (a) => `List PRs for ${a.profile}`, self, (a) => inner.getPullRequests(a)),
+        getCallerIdentity: gated("getCallerIdentity", (a) => `Get identity for ${a.profile}`, self, inner.getCallerIdentity),
+        createPullRequest: gated("createPullRequest", (p) => `Create PR on ${p.repositoryName}`, nested, inner.createPullRequest),
+        listBranches: gated("listBranches", (p) => `List branches in ${p.repositoryName}`, nested, inner.listBranches),
+        getCommentsForPullRequest: gated("getCommentsForPullRequest", (p) => `Comments for PR #${p.pullRequestId}`, nested, inner.getCommentsForPullRequest),
+        updatePullRequestTitle: gated("updatePullRequestTitle", (p) => `Edit title of PR #${p.pullRequestId}`, nested, inner.updatePullRequestTitle),
+        updatePullRequestDescription: gated("updatePullRequestDescription", (p) => `Edit desc of PR #${p.pullRequestId}`, nested, inner.updatePullRequestDescription),
+        getPullRequest: gated("getPullRequest", (p) => `Fetch PR #${p.pullRequestId}`, nested, inner.getPullRequest),
+        getDifferences: gated("getDifferences", (p) => `Diff for ${p.repositoryName}`, nested, inner.getDifferences)
+    };
+}));
+//# sourceMappingURL=AwsClientGated.js.map

package/dist/AwsClient/AwsClientGated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsClientGated.js","sourceRoot":"","sources":["../../src/AwsClient/AwsClientGated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,YAAY,EAAyB,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAA;AACvE,OAAO,EAAE,SAAS,EAAuB,MAAM,YAAY,CAAA;AAE3D,0FAA0F;AAC1F,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,EAGrF;CAAG;AASN,MAAM,aAAa,GAAG,CAAC,CAAa,EAAE,MAA4B,EAAE,EAAE,CACpE,IAAI,WAAW,CAAC;IACd,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,OAAO,EAAE,CAAC,CAAC,cAAgC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAmB;IAC7B,KAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrE,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAI3B,KAAK,CAAC,MAAM,CACd,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAA;IACnC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,cAAc,CAAA;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACpC,4DAA4D;IAE5D,yDAAyD;IACzD,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,CACf,MAAkB,EAClB,eAAoD,EACpD,UAAyB,EACJ,EAAE,CACvB,WAAW,CAAC,cAAc,EAAE,CAAC,IAAI,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO;QACL,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,eAAe;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU;SACX,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACnC,CAAA;IAEH,MAAM,UAAU,GAAG,CAAC,MAAkB,EAA+D,EAAE,CACrG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;YAC1C,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;QAEhE,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAC9B,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,EAAE,CAAC,gBAAyB,CAAC,CACrC,CAAC,EACJ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChD,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACvC,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAC,EACL,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAkB,CAAC,CAAC,EAClE,KAAK,CAAC,UAAU,CACjB,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM,eAAe,GAAG,CACtB,MAAkB,EAC2C,EAAE,CAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CACnC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAyB,CAAC,CAAC,EAC3E,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CACnC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CACjD,CAAC,EACJ,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAC7C,KAAK,CAAC,UAAU,CACjB,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,8EAA8E;IAE9E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,CACZ,EAAU,EACV,GAA8B,EAC9B,IAA4D,EAC5D,MAAkD,EAClD,EAAE,CACJ,CAAC,MAAS,EAAoC,EAAE;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,MAAM,CAAC,GAAe,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QAC1G,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACpC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;YAC1C,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAClB,EAAU,EACV,GAA8B,EAC9B,IAA4D,EAC5D,MAAkD,EAClD,EAAE,CACJ,CAAC,MAAS,EAAoC,EAAE;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,MAAM,CAAC,GAAe,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;QAC1G,OAAO,MAAM,CAAC,MAAM,CAClB,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CACrB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACxB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACxB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CACzD,CAAA;QACH,CAAC,CAAC,CACH,CACF,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,CAAsC,EAAE,EAAE,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAmD,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAEjF,OAAO;QACL,eAAe,EAAE,WAAW,CAC1B,iBAAiB,EACjB,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAClC,IAAI,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAChC;QACD,iBAAiB,EAAE,KAAK,CACtB,mBAAmB,EACnB,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,EACtC,IAAI,EACJ,KAAK,CAAC,iBAAiB,CACxB;QACD,iBAAiB,EAAE,KAAK,CACtB,mBAAmB,EACnB,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,cAAc,EAAE,EACzC,MAAM,EACN,KAAK,CAAC,iBAAiB,CACxB;QACD,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC;QAC9G,yBAAyB,EAAE,KAAK,CAC9B,2BAA2B,EAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,EAC5C,MAAM,EACN,KAAK,CAAC,yBAAyB,CAChC;QACD,sBAAsB,EAAE,KAAK,CAC3B,wBAAwB,EACxB,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,EAC7C,MAAM,EACN,KAAK,CAAC,sBAAsB,CAC7B;QACD,4BAA4B,EAAE,KAAK,CACjC,8BAA8B,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,EAC5C,MAAM,EACN,KAAK,CAAC,4BAA4B,CACnC;QACD,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;QAC5G,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;KACjF,CAAA;AAC/B,CAAC,CAAC,CACH,CAAA"}

package/dist/CacheService/Database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Database.d.ts","sourceRoot":"","sources":["../../src/CacheService/Database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,KAAK,YAAY,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,cAAc,MAAM,mCAAmC,CAAA;AACnE,OAAO,EAAkB,KAAK,EAAE,MAAM,QAAQ,CAAA;AA4B9C,eAAO,MAAM,UAAU,qJAMW,CAAA;AAElC,eAAO,MAAM,cAAc,wIAazB,CAAA;AAEF,eAAO,MAAM,YAAY,+NAAsD,CAAA"}
+{"version":3,"file":"Database.d.ts","sourceRoot":"","sources":["../../src/CacheService/Database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,KAAK,YAAY,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,cAAc,MAAM,mCAAmC,CAAA;AACnE,OAAO,EAAkB,KAAK,EAAE,MAAM,QAAQ,CAAA;AA8B9C,eAAO,MAAM,UAAU,qJAMW,CAAA;AAElC,eAAO,MAAM,cAAc,wIAezB,CAAA;AAEF,eAAO,MAAM,YAAY,+NAAsD,CAAA"}

package/dist/CacheService/Database.js

@@ -17,6 +17,8 @@ import migration0007 from "./migrations/0007_stats_columns.js";
 import migration0008 from "./migrations/0008_merged_by.js";
 import migration0009 from "./migrations/0009_approved_by.js";
 import migration0010 from "./migrations/0010_commented_by.js";
+import migration0011 from "./migrations/0011_audit_log.js";
+import migration0012 from "./migrations/0012_audit_log_indexes.js";
 const homeDir = Config.string("HOME").pipe(Config.orElse(() => Config.string("USERPROFILE")));
 const dbUrl = homeDir.pipe(Config.map((h) => `file:${h}/.codecommit/cache.db`));
 const EnsureDbDir = Layer.effectDiscard(Effect.gen(function* () {
@@ -39,7 +41,9 @@ export const MigrationsLive = LibsqlMigrator.layer({
         "0007_stats_columns": migration0007,
         "0008_merged_by": migration0008,
         "0009_approved_by": migration0009,
-        "0010_commented_by": migration0010
+        "0010_commented_by": migration0010,
+        "0011_audit_log": migration0011,
+        "0012_audit_log_indexes": migration0012
     })
 });
 export const DatabaseLive = MigrationsLive.pipe(Layer.provideMerge(LibsqlLive));

package/dist/CacheService/Database.js.map

@@ -1 +1 @@
-{"version":3,"file":"Database.js","sourceRoot":"","sources":["../../src/CacheService/Database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,KAAK,YAAY,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,cAAc,MAAM,mCAAmC,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,aAAa,MAAM,8BAA8B,CAAA;AACxD,OAAO,aAAa,MAAM,8BAA8B,CAAA;AACxD,OAAO,aAAa,MAAM,uCAAuC,CAAA;AACjE,OAAO,aAAa,MAAM,0CAA0C,CAAA;AACpE,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,aAAa,MAAM,mCAAmC,CAAA;AAC7D,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,aAAa,MAAM,gCAAgC,CAAA;AAC1D,OAAO,aAAa,MAAM,kCAAkC,CAAA;AAC5D,OAAO,aAAa,MAAM,mCAAmC,CAAA;AAE7D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAClD,CAAA;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAE/E,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAA;IACxB,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACnC,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACxB,YAAY,CAAC,KAAK,CAAC;IACjB,GAAG;IACH,oBAAoB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;CAC/F,CAAC,CAAC,CACN,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC;IACjD,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAChC,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,uBAAuB,EAAE,aAAa;QACtC,0BAA0B,EAAE,aAAa;QACzC,oBAAoB,EAAE,aAAa;QACnC,mBAAmB,EAAE,aAAa;QAClC,oBAAoB,EAAE,aAAa;QACnC,gBAAgB,EAAE,aAAa;QAC/B,kBAAkB,EAAE,aAAa;QACjC,mBAAmB,EAAE,aAAa;KACnC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Database.js","sourceRoot":"","sources":["../../src/CacheService/Database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,KAAK,YAAY,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,cAAc,MAAM,mCAAmC,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,aAAa,MAAM,8BAA8B,CAAA;AACxD,OAAO,aAAa,MAAM,8BAA8B,CAAA;AACxD,OAAO,aAAa,MAAM,uCAAuC,CAAA;AACjE,OAAO,aAAa,MAAM,0CAA0C,CAAA;AACpE,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,aAAa,MAAM,mCAAmC,CAAA;AAC7D,OAAO,aAAa,MAAM,oCAAoC,CAAA;AAC9D,OAAO,aAAa,MAAM,gCAAgC,CAAA;AAC1D,OAAO,aAAa,MAAM,kCAAkC,CAAA;AAC5D,OAAO,aAAa,MAAM,mCAAmC,CAAA;AAC7D,OAAO,aAAa,MAAM,gCAAgC,CAAA;AAC1D,OAAO,aAAa,MAAM,wCAAwC,CAAA;AAElE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAClD,CAAA;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAE/E,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAA;IACxB,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACnC,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CACxB,YAAY,CAAC,KAAK,CAAC;IACjB,GAAG;IACH,oBAAoB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;CAC/F,CAAC,CAAC,CACN,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC;IACjD,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QAChC,cAAc,EAAE,aAAa;QAC7B,cAAc,EAAE,aAAa;QAC7B,uBAAuB,EAAE,aAAa;QACtC,0BAA0B,EAAE,aAAa;QACzC,oBAAoB,EAAE,aAAa;QACnC,mBAAmB,EAAE,aAAa;QAClC,oBAAoB,EAAE,aAAa;QACnC,gBAAgB,EAAE,aAAa;QAC/B,kBAAkB,EAAE,aAAa;QACjC,mBAAmB,EAAE,aAAa;QAClC,gBAAgB,EAAE,aAAa;QAC/B,wBAAwB,EAAE,aAAa;KACxC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA"}

package/dist/CacheService/EventsHub.d.ts

@@ -8,6 +8,8 @@ export type RepoChange = Data.TaggedEnum<{
     AppState: {};
     SystemNotifications: {};
     Sandboxes: {};
+    PermissionRequired: {};
+    PermissionResolved: {};
 }>;
 export declare const RepoChange: {
     readonly Comments: Data.Case.Constructor<{
@@ -34,7 +36,13 @@ export declare const RepoChange: {
     readonly Sandboxes: Data.Case.Constructor<{
         readonly _tag: "Sandboxes";
     }, "_tag">;
-    readonly $is: <Tag extends "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes">(tag: Tag) => (u: unknown) => u is Extract<{
+    readonly PermissionRequired: Data.Case.Constructor<{
+        readonly _tag: "PermissionRequired";
+    }, "_tag">;
+    readonly PermissionResolved: Data.Case.Constructor<{
+        readonly _tag: "PermissionResolved";
+    }, "_tag">;
+    readonly $is: <Tag extends "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes" | "PermissionRequired" | "PermissionResolved">(tag: Tag) => (u: unknown) => u is Extract<{
         readonly _tag: "Comments";
     }, {
         readonly _tag: Tag;
@@ -66,6 +74,14 @@ export declare const RepoChange: {
         readonly _tag: "Sandboxes";
     }, {
         readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "PermissionRequired";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "PermissionResolved";
+    }, {
+        readonly _tag: Tag;
     }>;
     readonly $match: {
         <const Cases extends {
@@ -93,7 +109,13 @@ export declare const RepoChange: {
             readonly Sandboxes: (args: {
                 readonly _tag: "Sandboxes";
             }) => any;
-        }>(cases: Cases & { [K in Exclude<keyof Cases, "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes">]: never; }): (value: {
+            readonly PermissionRequired: (args: {
+                readonly _tag: "PermissionRequired";
+            }) => any;
+            readonly PermissionResolved: (args: {
+                readonly _tag: "PermissionResolved";
+            }) => any;
+        }>(cases: Cases & { [K in Exclude<keyof Cases, "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes" | "PermissionRequired" | "PermissionResolved">]: never; }): (value: {
             readonly _tag: "Comments";
         } | {
             readonly _tag: "PullRequests";
@@ -109,7 +131,11 @@ export declare const RepoChange: {
             readonly _tag: "SystemNotifications";
         } | {
             readonly _tag: "Sandboxes";
-        }) => import("effect/Unify").Unify<ReturnType<Cases["Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes"]>>;
+        } | {
+            readonly _tag: "PermissionRequired";
+        } | {
+            readonly _tag: "PermissionResolved";
+        }) => import("effect/Unify").Unify<ReturnType<Cases["Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes" | "PermissionRequired" | "PermissionResolved"]>>;
         <const Cases extends {
             readonly Comments: (args: {
                 readonly _tag: "Comments";
@@ -135,6 +161,12 @@ export declare const RepoChange: {
             readonly Sandboxes: (args: {
                 readonly _tag: "Sandboxes";
             }) => any;
+            readonly PermissionRequired: (args: {
+                readonly _tag: "PermissionRequired";
+            }) => any;
+            readonly PermissionResolved: (args: {
+                readonly _tag: "PermissionResolved";
+            }) => any;
         }>(value: {
             readonly _tag: "Comments";
         } | {
@@ -151,7 +183,11 @@ export declare const RepoChange: {
             readonly _tag: "SystemNotifications";
         } | {
             readonly _tag: "Sandboxes";
-        }, cases: Cases & { [K in Exclude<keyof Cases, "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes">]: never; }): import("effect/Unify").Unify<ReturnType<Cases["Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes"]>>;
+        } | {
+            readonly _tag: "PermissionRequired";
+        } | {
+            readonly _tag: "PermissionResolved";
+        }, cases: Cases & { [K in Exclude<keyof Cases, "Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes" | "PermissionRequired" | "PermissionResolved">]: never; }): import("effect/Unify").Unify<ReturnType<Cases["Comments" | "PullRequests" | "Notifications" | "Subscriptions" | "Config" | "AppState" | "SystemNotifications" | "Sandboxes" | "PermissionRequired" | "PermissionResolved"]>>;
     };
 };
 declare const EventsHub_base: Effect.Service.Class<EventsHub, "EventsHub", {
@@ -174,6 +210,10 @@ declare const EventsHub_base: Effect.Service.Class<EventsHub, "EventsHub", {
             readonly _tag: "SystemNotifications";
         } | {
             readonly _tag: "Sandboxes";
+        } | {
+            readonly _tag: "PermissionRequired";
+        } | {
+            readonly _tag: "PermissionResolved";
         }, never, never>;
     }, never, never>;
 }>;

package/dist/CacheService/EventsHub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EventsHub.d.ts","sourceRoot":"","sources":["../../src/CacheService/EventsHub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE1D,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvC,YAAY,EAAE,EAAE,CAAA;IAChB,aAAa,EAAE,EAAE,CAAA;IACjB,aAAa,EAAE,EAAE,CAAA;IACjB,QAAQ,EAAE,EAAE,CAAA;IACZ,MAAM,EAAE,EAAE,CAAA;IACV,QAAQ,EAAE,EAAE,CAAA;IACZ,mBAAmB,EAAE,EAAE,CAAA;IACvB,SAAS,EAAE,EAAE,CAAA;CACd,CAAC,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAgC,CAAA;;;0BAS1B,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAS1C,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;AAhBnF,qBAAa,SAAU,SAAQ,cAyC7B;CAAG"}
+{"version":3,"file":"EventsHub.d.ts","sourceRoot":"","sources":["../../src/CacheService/EventsHub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE1D,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvC,YAAY,EAAE,EAAE,CAAA;IAChB,aAAa,EAAE,EAAE,CAAA;IACjB,aAAa,EAAE,EAAE,CAAA;IACjB,QAAQ,EAAE,EAAE,CAAA;IACZ,MAAM,EAAE,EAAE,CAAA;IACV,QAAQ,EAAE,EAAE,CAAA;IACZ,mBAAmB,EAAE,EAAE,CAAA;IACvB,SAAS,EAAE,EAAE,CAAA;IACb,kBAAkB,EAAE,EAAE,CAAA;IACtB,kBAAkB,EAAE,EAAE,CAAA;CACvB,CAAC,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAgC,CAAA;;;0BAS1B,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAS1C,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAhBnF,qBAAa,SAAU,SAAQ,cAyC7B;CAAG"}

package/dist/CacheService/EventsHub.js.map

@@ -1 +1 @@
-{"version":3,"file":"EventsHub.js","sourceRoot":"","sources":["../../src/CacheService/EventsHub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAa1D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAc,CAAA;AAEvD,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,OAAO,EAAa,CAAC,WAAW,EAAE;IACtE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAc,CAAA;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAsB,CAAC,CAAA;QACrE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAErD,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAuB,EAAE,CAC1D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CACvB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;YACN,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvD,CACF,CAAA;QAEH,MAAM,KAAK,GAAG,CAAU,MAA8B,EAA0B,EAAE,CAChF,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,EAAsB,CAAC,CAAC,EACvE,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,QAAQ,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC3C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YAClC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,CAAC,GAAG,IAAI,CAAC,EACT,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAClD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAA;QACH,CAAC,CAAC,CACH,CACF,CACF,CACF,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACtC,CAAC,CAAC;CACH,CAAC;CAAG"}
+{"version":3,"file":"EventsHub.js","sourceRoot":"","sources":["../../src/CacheService/EventsHub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAe1D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAc,CAAA;AAEvD,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,OAAO,EAAa,CAAC,WAAW,EAAE;IACtE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAc,CAAA;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAsB,CAAC,CAAA;QACrE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAErD,MAAM,OAAO,GAAG,CAAC,MAAkB,EAAuB,EAAE,CAC1D,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CACvB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;YACN,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACvD,CACF,CAAA;QAEH,MAAM,KAAK,GAAG,CAAU,MAA8B,EAA0B,EAAE,CAChF,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAC3B,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,EAAsB,CAAC,CAAC,EACvE,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,QAAQ,CACb,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YAC3C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;YAClC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,CAAC,GAAG,IAAI,CAAC,EACT,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAClD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAA;QACH,CAAC,CAAC,CACH,CACF,CACF,CACF,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACtC,CAAC,CAAC;CACH,CAAC;CAAG"}

package/dist/CacheService/migrations/0011_audit_log.d.ts

@@ -0,0 +1,5 @@
+import * as SqlClient from "@effect/sql/SqlClient";
+import * as Effect from "effect/Effect";
+declare const _default: Effect.Effect<void, never, SqlClient.SqlClient>;
+export default _default;
+//# sourceMappingURL=0011_audit_log.d.ts.map

package/dist/CacheService/migrations/0011_audit_log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0011_audit_log.d.ts","sourceRoot":"","sources":["../../../src/CacheService/migrations/0011_audit_log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;;AAEvC,wBAmBC"}

package/dist/CacheService/migrations/0011_audit_log.js

@@ -0,0 +1,19 @@
+import * as SqlClient from "@effect/sql/SqlClient";
+import * as Effect from "effect/Effect";
+export default Effect.flatMap(SqlClient.SqlClient, (sql) => Effect.all([
+    sql `CREATE TABLE IF NOT EXISTS audit_log (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        timestamp TEXT NOT NULL DEFAULT (datetime('now')),
+        operation TEXT NOT NULL,
+        account_profile TEXT NOT NULL DEFAULT '',
+        region TEXT NOT NULL DEFAULT '',
+        permission_state TEXT NOT NULL,
+        context TEXT NOT NULL DEFAULT '',
+        duration_ms INTEGER
+      )`,
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp)`,
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_operation ON audit_log(operation)`,
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_permission_state ON audit_log(permission_state)`,
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_account_profile ON audit_log(account_profile)`
+]).pipe(Effect.asVoid, Effect.catchAll(() => Effect.void)));
+//# sourceMappingURL=0011_audit_log.js.map

package/dist/CacheService/migrations/0011_audit_log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0011_audit_log.js","sourceRoot":"","sources":["../../../src/CacheService/migrations/0011_audit_log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,eAAe,MAAM,CAAC,OAAO,CAC3B,SAAS,CAAC,SAAS,EACnB,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,CAAA;;;;;;;;;QASD;IACF,GAAG,CAAA,4EAA4E;IAC/E,GAAG,CAAA,4EAA4E;IAC/E,GAAG,CAAA,0FAA0F;IAC7F,GAAG,CAAA,wFAAwF;CAC5F,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAA"}

package/dist/CacheService/migrations/0012_audit_log_indexes.d.ts

@@ -0,0 +1,5 @@
+import * as SqlClient from "@effect/sql/SqlClient";
+import * as Effect from "effect/Effect";
+declare const _default: Effect.Effect<void, never, SqlClient.SqlClient>;
+export default _default;
+//# sourceMappingURL=0012_audit_log_indexes.d.ts.map

package/dist/CacheService/migrations/0012_audit_log_indexes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0012_audit_log_indexes.d.ts","sourceRoot":"","sources":["../../../src/CacheService/migrations/0012_audit_log_indexes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;;AAEvC,wBAOC"}

package/dist/CacheService/migrations/0012_audit_log_indexes.js

@@ -0,0 +1,7 @@
+import * as SqlClient from "@effect/sql/SqlClient";
+import * as Effect from "effect/Effect";
+export default Effect.flatMap(SqlClient.SqlClient, (sql) => Effect.all([
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_permission_state ON audit_log(permission_state)`,
+    sql `CREATE INDEX IF NOT EXISTS idx_audit_log_account_profile ON audit_log(account_profile)`
+]).pipe(Effect.asVoid, Effect.catchAll(() => Effect.void)));
+//# sourceMappingURL=0012_audit_log_indexes.js.map

package/dist/CacheService/migrations/0012_audit_log_indexes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0012_audit_log_indexes.js","sourceRoot":"","sources":["../../../src/CacheService/migrations/0012_audit_log_indexes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,eAAe,MAAM,CAAC,OAAO,CAC3B,SAAS,CAAC,SAAS,EACnB,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,CAAA,0FAA0F;IAC7F,GAAG,CAAA,wFAAwF;CAC5F,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAA"}

package/dist/Errors.d.ts

@@ -146,6 +146,19 @@ declare const SandboxError_base: Schema.TaggedErrorClass<SandboxError, "SandboxE
  */
 export declare class SandboxError extends SandboxError_base {
 }
+declare const PermissionDeniedError_base: Schema.TaggedErrorClass<PermissionDeniedError, "PermissionDeniedError", {
+    readonly _tag: Schema.tag<"PermissionDeniedError">;
+} & {
+    operation: typeof Schema.String;
+    reason: Schema.Literal<["denied", "timeout"]>;
+}>;
+/**
+ * API call blocked by permission gate.
+ *
+ * @category Errors
+ */
+export declare class PermissionDeniedError extends PermissionDeniedError_base {
+}
 /**
  * Union of errors from AwsClient methods.
  *
@@ -157,6 +170,6 @@ export type AwsClientError = AwsCredentialError | AwsThrottleError | AwsApiError
  *
  * @category Errors
  */
-export type CodeCommitError = AwsCredentialError | AwsThrottleError | AwsApiError | ConfigError | ConfigParseError | ProfileDetectionError | RefreshError | DockerError | SandboxError;
+export type CodeCommitError = AwsCredentialError | AwsThrottleError | AwsApiError | ConfigError | ConfigParseError | ProfileDetectionError | RefreshError | DockerError | SandboxError | PermissionDeniedError;
 export {};
 //# sourceMappingURL=Errors.d.ts.map

package/dist/Errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Errors.d.ts","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;;;;;;;AAG/B;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,uBAOvC;CAAG;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAOrC;CAAG;;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAQhC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAMhC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAMrC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,0BAM1C;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAMjC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAMhC;CAAG;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAOjC;CAAG;AAEJ;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,WAAW,CAAA;AAEhF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,gBAAgB,GAChB,WAAW,GACX,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,YAAY,GACZ,WAAW,GACX,YAAY,CAAA"}
+{"version":3,"file":"Errors.d.ts","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;;;;;;;AAG/B;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,uBAOvC;CAAG;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAOrC;CAAG;;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAQhC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAMhC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,qBAMrC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,0BAM1C;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAMjC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,gBAMhC;CAAG;;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,iBAOjC;CAAG;;;;;;;AAEJ;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,0BAM1C;CAAG;AAEJ;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,WAAW,CAAA;AAEhF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,gBAAgB,GAChB,WAAW,GACX,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,qBAAqB,CAAA"}

package/dist/Errors.js

@@ -120,4 +120,14 @@ export class SandboxError extends Schema.TaggedError()("SandboxError", {
     cause: Schema.optional(Schema.Defect)
 }) {
 }
+/**
+ * API call blocked by permission gate.
+ *
+ * @category Errors
+ */
+export class PermissionDeniedError extends Schema.TaggedError()("PermissionDeniedError", {
+    operation: Schema.String,
+    reason: Schema.Literal("denied", "timeout")
+}) {
+}
 //# sourceMappingURL=Errors.js.map

package/dist/Errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"Errors.js","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAElE;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB;IACE,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB;IACE,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,uBAAuB,EACvB;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAClE,cAAc,EACd;IACE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAClE,cAAc,EACd;IACE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG"}
+{"version":3,"file":"Errors.js","sourceRoot":"","sources":["../src/Errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAElE;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB;IACE,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB;IACE,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,uBAAuB,EACvB;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAClE,cAAc,EACd;IACE,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAChE,aAAa,EACb;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAClE,cAAc,EACd;IACE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACtC,CACF;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,uBAAuB,EACvB;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC5C,CACF;CAAG"}

package/dist/PermissionService/AuditLog.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @title AuditLogRepo — records every AWS API call
+ *
+ * Every call through the permission gate gets recorded — allowed, denied,
+ * or timed out.
+ *
+ * Design constraints:
+ *   - MUST never block API calls (catchAll on write failures at call site)
+ *   - MUST handle high volume (~17 ops per refresh × every 5min)
+ *   - MUST auto-prune (150k entries/month without pruning)
+ *   - MUST support filtered queries (for the audit log UI page)
+ *
+ * `durationMs` is null when the API call was denied/timed out (never ran).
+ * When present, it reflects actual AWS API latency — not permission prompt wait.
+ *
+ * @module
+ */
+import * as SqlClient from "@effect/sql/SqlClient";
+import { Effect, Schema } from "effect";
+import { CacheError } from "../CacheService/CacheError.js";
+export declare const AuditLogEntry: Schema.Struct<{
+    id: typeof Schema.Number;
+    timestamp: typeof Schema.String;
+    operation: typeof Schema.String;
+    accountProfile: typeof Schema.String;
+    region: typeof Schema.String;
+    permissionState: Schema.Literal<["allowed", "always_allowed", "denied", "timed_out"]>;
+    context: typeof Schema.String;
+    durationMs: Schema.NullOr<typeof Schema.Number>;
+}>;
+export type AuditLogEntry = typeof AuditLogEntry.Type;
+export type NewAuditLogEntry = Omit<AuditLogEntry, "id">;
+export interface PaginatedAuditLog {
+    readonly items: ReadonlyArray<AuditLogEntry>;
+    readonly total: number;
+    readonly nextCursor?: number;
+}
+declare const AuditLogRepo_base: Effect.Service.Class<AuditLogRepo, "AuditLogRepo", {
+    readonly dependencies: readonly [import("effect/Layer").Layer<SqlClient.SqlClient | import("@effect/sql-libsql/LibsqlClient").LibsqlClient, import("@effect/sql/SqlError").SqlError | import("effect/ConfigError").ConfigError | import("@effect/sql/Migrator").MigrationError, import("@effect/platform/FileSystem").FileSystem>];
+    readonly effect: Effect.Effect<{
+        log: (entry: NewAuditLogEntry) => Effect.Effect<void, CacheError, never>;
+        findAll: (opts?: {
+            readonly limit?: number | undefined;
+            readonly offset?: number | undefined;
+            readonly operation?: string | undefined;
+            readonly accountProfile?: string | undefined;
+            readonly permissionState?: string | undefined;
+            readonly from?: string | undefined;
+            readonly to?: string | undefined;
+            readonly search?: string | undefined;
+        }) => Effect.Effect<PaginatedAuditLog, CacheError>;
+        prune: (retentionDays: number) => Effect.Effect<number, CacheError>;
+        exportAll: (opts?: {
+            readonly from?: string | undefined;
+            readonly to?: string | undefined;
+        }) => Effect.Effect<ReadonlyArray<AuditLogEntry>, CacheError>;
+    }, never, SqlClient.SqlClient>;
+}>;
+export declare class AuditLogRepo extends AuditLogRepo_base {
+}
+export {};
+//# sourceMappingURL=AuditLog.d.ts.map

package/dist/PermissionService/AuditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLog.d.ts","sourceRoot":"","sources":["../../src/PermissionService/AuditLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG1D,eAAO,MAAM,aAAa;;;;;;;;;EASxB,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;;;;qBA6BkB,gBAAgB;yBAQZ;YACf,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;SACrC,KAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC;+BAuDzB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;2BAY9C;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;YAClC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;SACjC,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;;;AA5GjE,qBAAa,YAAa,SAAQ,iBA8HhC;CAAG"}

package/dist/PermissionService/AuditLog.js

@@ -0,0 +1,113 @@
+/**
+ * @title AuditLogRepo — records every AWS API call
+ *
+ * Every call through the permission gate gets recorded — allowed, denied,
+ * or timed out.
+ *
+ * Design constraints:
+ *   - MUST never block API calls (catchAll on write failures at call site)
+ *   - MUST handle high volume (~17 ops per refresh × every 5min)
+ *   - MUST auto-prune (150k entries/month without pruning)
+ *   - MUST support filtered queries (for the audit log UI page)
+ *
+ * `durationMs` is null when the API call was denied/timed out (never ran).
+ * When present, it reflects actual AWS API latency — not permission prompt wait.
+ *
+ * @module
+ */
+import * as SqlClient from "@effect/sql/SqlClient";
+import * as SqlSchema from "@effect/sql/SqlSchema";
+import { Effect, Schema } from "effect";
+import { CacheError } from "../CacheService/CacheError.js";
+import { DatabaseLive } from "../CacheService/Database.js";
+export const AuditLogEntry = Schema.Struct({
+    id: Schema.Number,
+    timestamp: Schema.String,
+    operation: Schema.String,
+    accountProfile: Schema.String,
+    region: Schema.String,
+    permissionState: Schema.Literal("allowed", "always_allowed", "denied", "timed_out"),
+    context: Schema.String,
+    durationMs: Schema.NullOr(Schema.Number)
+});
+const cacheError = (op) => (effect) => effect.pipe(Effect.mapError((cause) => new CacheError({ operation: `AuditLogRepo.${op}`, cause })), Effect.withSpan(`AuditLogRepo.${op}`, { captureStackTrace: false }));
+export class AuditLogRepo extends Effect.Service()("AuditLogRepo", {
+    dependencies: [DatabaseLive],
+    effect: Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const findAll_ = SqlSchema.findAll({
+            Result: AuditLogEntry,
+            Request: Schema.Struct({
+                limit: Schema.Number,
+                offset: Schema.Number
+            }),
+            execute: (req) => sql `SELECT * FROM audit_log ORDER BY id DESC LIMIT ${req.limit} OFFSET ${req.offset}`
+        });
+        const countAll = SqlSchema.single({
+            Result: Schema.Struct({ count: Schema.Number }),
+            Request: Schema.Void,
+            execute: () => sql `SELECT count(*) as count FROM audit_log`
+        });
+        return {
+            log: (entry) => sql `INSERT INTO audit_log (timestamp, operation, account_profile, region, permission_state, context, duration_ms)
+            VALUES (${entry.timestamp}, ${entry.operation}, ${entry.accountProfile}, ${entry.region}, ${entry.permissionState}, ${entry.context}, ${entry.durationMs})`
+                .pipe(Effect.asVoid, cacheError("log")),
+            findAll: (opts) => {
+                // Clamp numeric params to prevent injection via malformed input
+                const limit = Math.max(1, Math.min(200, Math.floor(opts?.limit ?? 50)));
+                const offset = Math.max(0, Math.floor(opts?.offset ?? 0));
+                // For filtered queries, build dynamic SQL
+                if (opts?.operation || opts?.accountProfile || opts?.permissionState || opts?.from || opts?.to || opts?.search) {
+                    const conditions = [];
+                    if (opts?.operation)
+                        conditions.push(`operation = '${opts.operation.replace(/'/g, "''")}'`);
+                    if (opts?.accountProfile) {
+                        conditions.push(`account_profile = '${opts.accountProfile.replace(/'/g, "''")}'`);
+                    }
+                    if (opts?.permissionState) {
+                        conditions.push(`permission_state = '${opts.permissionState.replace(/'/g, "''")}'`);
+                    }
+                    if (opts?.from)
+                        conditions.push(`timestamp >= '${opts.from.replace(/'/g, "''")}'`);
+                    if (opts?.to)
+                        conditions.push(`timestamp <= '${opts.to.replace(/'/g, "''")}'`);
+                    if (opts?.search) {
+                        const escaped = opts.search.replace(/'/g, "''");
+                        conditions.push(`(operation LIKE '%${escaped}%' OR context LIKE '%${escaped}%')`);
+                    }
+                    const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+                    return Effect.all([
+                        sql.unsafe(`SELECT * FROM audit_log ${where} ORDER BY id DESC LIMIT ${limit} OFFSET ${offset}`).pipe(Effect.map((rows) => rows.map((r) => r))),
+                        sql.unsafe(`SELECT count(*) as count FROM audit_log ${where}`).pipe(Effect.map((rows) => rows[0]?.count ?? 0))
+                    ]).pipe(Effect.map(([items, total]) => ({
+                        items,
+                        total,
+                        ...(items.length === limit ? { nextCursor: offset + limit } : {})
+                    })), cacheError("findAll"));
+                }
+                return Effect.all([
+                    findAll_({ limit, offset }),
+                    countAll(undefined)
+                ]).pipe(Effect.map(([items, { count }]) => ({
+                    items,
+                    total: count,
+                    ...(items.length === limit ? { nextCursor: offset + limit } : {})
+                })), cacheError("findAll"));
+            },
+            prune: (retentionDays) => {
+                const days = Math.max(1, Math.floor(retentionDays));
+                return sql.unsafe(`DELETE FROM audit_log WHERE timestamp < datetime('now', '-${days} days')`).pipe(
+                // DELETE returns no rows — use changes() to get actual deleted count
+                Effect.flatMap(() => sql `SELECT changes() as n`), Effect.map((rows) => rows[0]?.n ?? 0), cacheError("prune"));
+            },
+            exportAll: (opts) => {
+                if (opts?.from && opts?.to) {
+                    return sql.unsafe(`SELECT * FROM audit_log WHERE timestamp >= '${opts.from.replace(/'/g, "''")}' AND timestamp <= '${opts.to.replace(/'/g, "''")}' ORDER BY id DESC`).pipe(Effect.map((rows) => rows.map((r) => r)), cacheError("exportAll"));
+                }
+                return sql.unsafe("SELECT * FROM audit_log ORDER BY id DESC").pipe(Effect.map((rows) => rows.map((r) => r)), cacheError("exportAll"));
+            }
+        };
+    })
+}) {
+}
+//# sourceMappingURL=AuditLog.js.map

package/dist/PermissionService/AuditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLog.js","sourceRoot":"","sources":["../../src/PermissionService/AuditLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,cAAc,EAAE,MAAM,CAAC,MAAM;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC;IACnF,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;CACzC,CAAC,CAAA;AAYF,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAU,MAA8B,EAAE,EAAE,CAC7E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EACtF,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CACpE,CAAA;AAEH,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,OAAO,EAAgB,CAAC,cAAc,EAAE;IAC/E,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;QAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;YACjC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACrB,KAAK,EAAE,MAAM,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAA,kDAAkD,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,MAAM,EAAE;SACxG,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAA,yCAAyC;SAC5D,CAAC,CAAA;QAEF,OAAO;YACL,GAAG,EAAE,CAAC,KAAuB,EAAE,EAAE,CAC/B,GAAG,CAAA;sBACW,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,GAAG;iBAC5J,IAAI,CACH,MAAM,CAAC,MAAM,EACb,UAAU,CAAC,KAAK,CAAC,CAClB;YAEL,OAAO,EAAE,CAAC,IAST,EAAgD,EAAE;gBACjD,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;gBACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAA;gBAEzD,0CAA0C;gBAC1C,IACE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,EAAE,eAAe,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,EAC1G,CAAC;oBACD,MAAM,UAAU,GAAkB,EAAE,CAAA;oBACpC,IAAI,IAAI,EAAE,SAAS;wBAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC3F,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC;wBACzB,UAAU,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;oBACnF,CAAC;oBACD,IAAI,IAAI,EAAE,eAAe,EAAE,CAAC;wBAC1B,UAAU,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;oBACrF,CAAC;oBACD,IAAI,IAAI,EAAE,IAAI;wBAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;oBAClF,IAAI,IAAI,EAAE,EAAE;wBAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC9E,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;wBACjB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;wBAC/C,UAAU,CAAC,IAAI,CAAC,qBAAqB,OAAO,wBAAwB,OAAO,KAAK,CAAC,CAAA;oBACnF,CAAC;oBACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;oBAE9E,OAAO,MAAM,CAAC,GAAG,CAAC;wBAChB,GAAG,CAAC,MAAM,CAAC,2BAA2B,KAAK,2BAA2B,KAAK,WAAW,MAAM,EAAE,CAAC,CAAC,IAAI,CAClG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAA6B,CAAC,CAAC,CACrE;wBACD,GAAG,CAAC,MAAM,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAAI,CAAC,CAAC,CAAkC,EAAE,KAAK,IAAI,CAAC,CAAC,CAC5E;qBACF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC9B,KAAK;wBACL,KAAK;wBACL,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClE,CAAC,CAAC,EACH,UAAU,CAAC,SAAS,CAAC,CACtB,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,GAAG,CAAC;oBAChB,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;oBAC3B,QAAQ,CAAC,SAAiB,CAAC;iBAC5B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClC,KAAK;oBACL,KAAK,EAAE,KAAK;oBACZ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClE,CAAC,CAAC,EACH,UAAU,CAAC,SAAS,CAAC,CACtB,CAAA;YACH,CAAC;YAED,KAAK,EAAE,CAAC,aAAqB,EAAqC,EAAE;gBAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;gBACnD,OAAO,GAAG,CAAC,MAAM,CACf,6DAA6D,IAAI,SAAS,CAC3E,CAAC,IAAI;gBACJ,qEAAqE;gBACrE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAe,uBAAuB,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EACrC,UAAU,CAAC,OAAO,CAAC,CACpB,CAAA;YACH,CAAC;YAED,SAAS,EAAE,CAAC,IAGX,EAA2D,EAAE;gBAC5D,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;oBAC3B,OAAO,GAAG,CAAC,MAAM,CACf,+CAA+C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,uBAC1E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAC5B,oBAAoB,CACrB,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAA6B,CAAC,CAAC,EACpE,UAAU,CAAC,WAAW,CAAC,CACxB,CAAA;gBACH,CAAC;gBACD,OAAO,GAAG,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAA6B,CAAC,CAAC,EACpE,UAAU,CAAC,WAAW,CAAC,CACxB,CAAA;YACH,CAAC;SACF,CAAA;IACH,CAAC,CAAC;CACH,CAAC;CAAG"}

package/dist/PermissionService/PermissionGate.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @title PermissionGate — abstract "ask the user" interface
+ *
+ * Context.Tag (not Effect.Service) so different environments can
+ * provide different implementations:
+ *   - Web: Deferred + SSE push (PermissionGateLive.ts)
+ *   - TUI: stdin prompt (future)
+ *   - Test: auto-allow Layer
+ *
+ * Only exposes `request` — the caller's view. The concrete implementation
+ * (PermissionGateLive) adds `resolve` and `getFirstPending` for the
+ * HTTP handler and SSE builder.
+ *
+ * @module
+ */
+import type { Effect } from "effect";
+import { Context, Schema } from "effect";
+import type { PermissionDeniedError } from "../Errors.js";
+declare const PermissionPrompt_base: Schema.Class<PermissionPrompt, {
+    id: typeof Schema.String;
+    operation: typeof Schema.String;
+    category: Schema.Literal<["read", "write"]>;
+    context: typeof Schema.String;
+}, Schema.Struct.Encoded<{
+    id: typeof Schema.String;
+    operation: typeof Schema.String;
+    category: Schema.Literal<["read", "write"]>;
+    context: typeof Schema.String;
+}>, never, {
+    readonly id: string;
+} & {
+    readonly operation: string;
+} & {
+    readonly context: string;
+} & {
+    readonly category: "read" | "write";
+}, {}, {}>;
+export declare class PermissionPrompt extends PermissionPrompt_base {
+}
+export type PermissionResponse = "allow_once" | "always_allow" | "deny";
+declare const PermissionGate_base: Context.TagClass<PermissionGate, "@knpkv/codecommit-core/PermissionGate", {
+    readonly request: (prompt: PermissionPrompt) => Effect.Effect<PermissionResponse, PermissionDeniedError>;
+}>;
+export declare class PermissionGate extends PermissionGate_base {
+}
+export {};
+//# sourceMappingURL=PermissionGate.d.ts.map

package/dist/PermissionService/PermissionGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGate.d.ts","sourceRoot":"","sources":["../../src/PermissionService/PermissionGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;;;;;;;;;;;;;;;;;;;;AAGzD,qBAAa,gBAAiB,SAAQ,qBAKpC;CAAG;AAEL,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,cAAc,GAAG,MAAM,CAAA;;sBAOjD,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;;AAH5G,qBAAa,cAAe,SAAQ,mBAKjC;CAAG"}

package/dist/PermissionService/PermissionGate.js

@@ -0,0 +1,14 @@
+import { Context, Schema } from "effect";
+// UUID correlates the SSE prompt → client modal → POST response
+export class PermissionPrompt extends Schema.Class("PermissionPrompt")({
+    id: Schema.String,
+    operation: Schema.String,
+    category: Schema.Literal("read", "write"),
+    context: Schema.String
+}) {
+}
+// Blocks the calling fiber until user responds or 30s timeout.
+// Returns the response, or fails with PermissionDeniedError.
+export class PermissionGate extends Context.Tag("@knpkv/codecommit-core/PermissionGate")() {
+}
+//# sourceMappingURL=PermissionGate.js.map

package/dist/PermissionService/PermissionGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGate.js","sourceRoot":"","sources":["../../src/PermissionService/PermissionGate.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGxC,gEAAgE;AAChE,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,KAAK,CAAmB,kBAAkB,CAAC,CAAC;IACvF,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAIL,+DAA+D;AAC/D,6DAA6D;AAC7D,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,EAKrF;CAAG"}

package/dist/PermissionService/PermissionGateLive.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @title PermissionGateLive — Deferred-based prompt flow
+ *
+ * One `Deferred<PermissionResponse>` per prompt.
+ *
+ * Flow:
+ *   1. API call fiber creates Deferred, stores in pending Map
+ *   2. Publishes PermissionRequired → SSE rebuilds payload with prompt
+ *   3. Fiber blocks on Deferred.await (up to 30s)
+ *   4. User clicks modal → POST /api/permissions/respond
+ *   5. HTTP handler calls resolve() → Deferred.succeed → fiber unblocks
+ *   6. Publishes PermissionResolved → SSE removes prompt from payload
+ *
+ * Multi-tab: Deferred.succeed is idempotent — first responder wins,
+ * second tab's POST is a no-op. Both see prompt disappear via SSE.
+ *
+ * Separate Effect.Service tag (not just PermissionGate) because the
+ * HTTP handler and SSE builder need `resolve` and `getFirstPending`
+ * which the abstract interface doesn't expose.
+ *
+ * @module
+ */
+import { Effect, Layer } from "effect";
+import { EventsHub } from "../CacheService/EventsHub.js";
+import { PermissionDeniedError } from "../Errors.js";
+import { PermissionGate, type PermissionPrompt, type PermissionResponse } from "./PermissionGate.js";
+export interface PermissionGateLive {
+    readonly request: (prompt: PermissionPrompt) => Effect.Effect<PermissionResponse, PermissionDeniedError>;
+    readonly resolve: (promptId: string, response: PermissionResponse) => Effect.Effect<void>;
+    readonly getFirstPending: () => Effect.Effect<PermissionPrompt | undefined>;
+}
+export declare const PermissionGateLiveTag: Effect.Service.Class<PermissionGateLive, "PermissionGateLive", {
+    readonly dependencies: readonly [Layer.Layer<EventsHub, never, never>];
+    readonly effect: Effect.Effect<{
+        request: (prompt: PermissionPrompt) => Effect.Effect<PermissionResponse, PermissionDeniedError>;
+        resolve: (promptId: string, response: PermissionResponse) => Effect.Effect<void>;
+        getFirstPending: () => Effect.Effect<PermissionPrompt | undefined>;
+    }, never, EventsHub>;
+}>;
+export declare const PermissionGateLiveLayer: Layer.Layer<PermissionGate, never, PermissionGateLive>;
+//# sourceMappingURL=PermissionGateLive.d.ts.map

package/dist/PermissionService/PermissionGateLive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGateLive.d.ts","sourceRoot":"","sources":["../../src/PermissionService/PermissionGateLive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAY,MAAM,EAAE,KAAK,EAAO,MAAM,QAAQ,CAAA;AACrD,OAAO,EAAE,SAAS,EAAc,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAOpG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;IACxG,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzF,QAAQ,CAAC,eAAe,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAC5E;AAED,eAAO,MAAM,qBAAqB;;;0BAWL,gBAAgB,KAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;4BAqCzE,MAAM,YAAY,kBAAkB,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;+BAUzD,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC;;EAUzE,CAAA;AAKF,eAAO,MAAM,uBAAuB,wDAGnC,CAAA"}

package/dist/PermissionService/PermissionGateLive.js

@@ -0,0 +1,83 @@
+/**
+ * @title PermissionGateLive — Deferred-based prompt flow
+ *
+ * One `Deferred<PermissionResponse>` per prompt.
+ *
+ * Flow:
+ *   1. API call fiber creates Deferred, stores in pending Map
+ *   2. Publishes PermissionRequired → SSE rebuilds payload with prompt
+ *   3. Fiber blocks on Deferred.await (up to 30s)
+ *   4. User clicks modal → POST /api/permissions/respond
+ *   5. HTTP handler calls resolve() → Deferred.succeed → fiber unblocks
+ *   6. Publishes PermissionResolved → SSE removes prompt from payload
+ *
+ * Multi-tab: Deferred.succeed is idempotent — first responder wins,
+ * second tab's POST is a no-op. Both see prompt disappear via SSE.
+ *
+ * Separate Effect.Service tag (not just PermissionGate) because the
+ * HTTP handler and SSE builder need `resolve` and `getFirstPending`
+ * which the abstract interface doesn't expose.
+ *
+ * @module
+ */
+import { Deferred, Effect, Layer, Ref } from "effect";
+import { EventsHub, RepoChange } from "../CacheService/EventsHub.js";
+import { PermissionDeniedError } from "../Errors.js";
+import { PermissionGate } from "./PermissionGate.js";
+export const PermissionGateLiveTag = Effect.Service()("PermissionGateLive", {
+    // EventsHub needed to publish PermissionRequired/Resolved events
+    // that trigger SSE payload rebuilds
+    dependencies: [EventsHub.Default],
+    effect: Effect.gen(function* () {
+        const hub = yield* EventsHub;
+        // Map<promptId, { deferred, prompt }>. Concurrent-safe via Ref.
+        // Multiple prompts can be pending simultaneously (e.g. initial
+        // refresh triggers getCallerIdentity + listRepositories at once).
+        const pending = yield* Ref.make(new Map());
+        const request = (prompt) => Effect.gen(function* () {
+            const deferred = yield* Deferred.make();
+            yield* Ref.update(pending, (m) => new Map(m).set(prompt.id, { deferred, prompt }));
+            yield* hub.publish(RepoChange.PermissionRequired());
+            const response = yield* Deferred.await(deferred).pipe(Effect.timeout("30 seconds"), Effect.catchTag("TimeoutException", () => {
+                return Effect.gen(function* () {
+                    yield* Ref.update(pending, (m) => {
+                        const n = new Map(m);
+                        n.delete(prompt.id);
+                        return n;
+                    });
+                    yield* hub.publish(RepoChange.PermissionResolved());
+                    return yield* new PermissionDeniedError({ operation: prompt.operation, reason: "timeout" });
+                });
+            }));
+            yield* Ref.update(pending, (m) => {
+                const n = new Map(m);
+                n.delete(prompt.id);
+                return n;
+            });
+            yield* hub.publish(RepoChange.PermissionResolved());
+            if (response === "deny") {
+                return yield* new PermissionDeniedError({ operation: prompt.operation, reason: "denied" });
+            }
+            return response;
+        });
+        // Called by POST /api/permissions/respond handler.
+        // Deferred.succeed is idempotent — second call is a no-op.
+        // This is how multi-tab "first responder wins" works.
+        const resolve = (promptId, response) => Ref.get(pending).pipe(Effect.flatMap((m) => {
+            const entry = m.get(promptId);
+            return entry ? Deferred.succeed(entry.deferred, response) : Effect.void;
+        }));
+        // For SSE payload builder — shows one prompt at a time (FIFO).
+        // Remaining prompts queue behind; they'll surface as each resolves.
+        const getFirstPending = () => Ref.get(pending).pipe(Effect.map((m) => {
+            const first = m.values().next();
+            return first.done ? undefined : first.value.prompt;
+        }));
+        return { request, resolve, getFirstPending };
+    })
+});
+// Bridge: concrete service → abstract Context.Tag.
+// Handlers use PermissionGateLiveTag (for resolve/getFirstPending),
+// AwsClientGated uses PermissionGate (for request only).
+export const PermissionGateLiveLayer = Layer.effect(PermissionGate, Effect.map(PermissionGateLiveTag, (live) => ({ request: live.request })));
+//# sourceMappingURL=PermissionGateLive.js.map

package/dist/PermissionService/PermissionGateLive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionGateLive.js","sourceRoot":"","sources":["../../src/PermissionService/PermissionGateLive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,cAAc,EAAkD,MAAM,qBAAqB,CAAA;AAapG,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,EAAsB,CAAC,oBAAoB,EAAE;IAC9F,iEAAiE;IACjE,oCAAoC;IACpC,YAAY,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;QAC5B,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAwB,CAAC,CAAA;QAEhE,MAAM,OAAO,GAAG,CAAC,MAAwB,EAA4D,EAAE,CACrG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAsB,CAAA;YAC3D,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAClF,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAA;YAEnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;gBACvC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACzB,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;wBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;wBACpB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;wBACnB,OAAO,CAAC,CAAA;oBACV,CAAC,CAAC,CAAA;oBACF,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAA;oBACnD,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC7F,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CACH,CAAA;YAED,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;gBACpB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACnB,OAAO,CAAC,CAAA;YACV,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAA;YAEnD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5F,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CAAA;QAEJ,mDAAmD;QACnD,2DAA2D;QAC3D,sDAAsD;QACtD,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,QAA4B,EAAuB,EAAE,CACtF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QACzE,CAAC,CAAC,CACH,CAAA;QAEH,+DAA+D;QAC/D,oEAAoE;QACpE,MAAM,eAAe,GAAG,GAAgD,EAAE,CACxE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CACnB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAA;YAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAA;QACpD,CAAC,CAAC,CACH,CAAA;QAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAA+B,CAAA;IAC3E,CAAC,CAAC;CACH,CAAC,CAAA;AAEF,mDAAmD;AACnD,oEAAoE;AACpE,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,CACjD,cAAc,EACd,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CACzE,CAAA"}

package/dist/PermissionService/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @title PermissionService — permission state management
+ *
+ * Ref<Config> backed by `~/.codecommit/permissions.json`.
+ *
+ * On construction (Layer build time), reads the file
+ * into a Ref. All subsequent `check()` calls are O(1) Ref lookups — no disk
+ * I/O. Only `set()` mutates the Ref AND writes to disk (atomic: tmp → rename).
+ *
+ * Key invariant: an operation missing from the file defaults to `"allow"`,
+ * which means "prompt the user". A fresh install with empty permissions.json
+ * prompts for every API call — zero-trust by default.
+ *
+ * @module
+ */
+import { FileSystem } from "@effect/platform";
+import { Effect, Schema } from "effect";
+import { allOperations, getOperationMeta, type OperationName, registerOperation } from "./operations.js";
+export type { BuiltinOperation, OperationMeta, OperationName } from "./operations.js";
+export { allOperations, getOperationMeta, registerOperation };
+export declare const PermissionState: Schema.Literal<["always_allow", "allow", "deny"]>;
+export type PermissionState = typeof PermissionState.Type;
+declare const PermissionService_base: Effect.Service.Class<PermissionService, "PermissionService", {
+    readonly effect: Effect.Effect<{
+        check: (operation: OperationName) => Effect.Effect<PermissionState>;
+        set: (operation: OperationName, state: PermissionState) => Effect.Effect<void>;
+        getAll: () => Effect.Effect<Record<string, PermissionState>>;
+        resetAll: () => Effect.Effect<void>;
+        isAuditEnabled: () => Effect.Effect<boolean>;
+        getAuditRetention: () => Effect.Effect<number>;
+        setAudit: (opts: {
+            enabled?: boolean | undefined;
+            retentionDays?: number | undefined;
+        }) => Effect.Effect<void>;
+    }, never, FileSystem.FileSystem>;
+}>;
+export declare class PermissionService extends PermissionService_base {
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/PermissionService/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/PermissionService/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAU,MAAM,EAAO,MAAM,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAExG,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAA;AAK7D,eAAO,MAAM,eAAe,mDAAkD,CAAA;AAC9E,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;;;2BA6D3B,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;yBAGhD,aAAa,SAAS,eAAe,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;sBAShE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;wBAG5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;8BAMb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;iCAEnB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;yBAI3C;YAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;SAAE,KAC1E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;;AAzC1B,qBAAa,iBAAkB,SAAQ,sBAuDrC;CAAG"}

package/dist/PermissionService/index.js

@@ -0,0 +1,87 @@
+/**
+ * @title PermissionService — permission state management
+ *
+ * Ref<Config> backed by `~/.codecommit/permissions.json`.
+ *
+ * On construction (Layer build time), reads the file
+ * into a Ref. All subsequent `check()` calls are O(1) Ref lookups — no disk
+ * I/O. Only `set()` mutates the Ref AND writes to disk (atomic: tmp → rename).
+ *
+ * Key invariant: an operation missing from the file defaults to `"allow"`,
+ * which means "prompt the user". A fresh install with empty permissions.json
+ * prompts for every API call — zero-trust by default.
+ *
+ * @module
+ */
+import { FileSystem } from "@effect/platform";
+import { Config, Effect, Ref, Schema } from "effect";
+import { allOperations, getOperationMeta, registerOperation } from "./operations.js";
+export { allOperations, getOperationMeta, registerOperation };
+// On-disk format. Schema.decodeUnknownSync with defaults means
+// corrupt or missing files gracefully degrade to empty state (everything prompts).
+export const PermissionState = Schema.Literal("always_allow", "allow", "deny");
+const AuditConfig = Schema.Struct({
+    enabled: Schema.Boolean.pipe(Schema.optionalWith({ default: () => true })),
+    retentionDays: Schema.Number.pipe(Schema.optionalWith({ default: () => 30 }))
+});
+const PermissionsConfig = Schema.Struct({
+    permissions: Schema.Record({ key: Schema.String, value: PermissionState }).pipe(Schema.optionalWith({ default: () => ({}) })),
+    audit: AuditConfig.pipe(Schema.optionalWith({ default: () => Schema.decodeSync(AuditConfig)({}) }))
+});
+const decodeConfig = Schema.decodeUnknownSync(PermissionsConfig);
+// Uses @effect/platform FileSystem — works in Bun, Node, tests.
+// Atomic write: write to .tmp, then rename. Prevents corruption on crash.
+const resolvePermissionsPath = Config.string("HOME").pipe(Config.orElse(() => Config.string("USERPROFILE")), Config.map((h) => `${h}/.codecommit/permissions.json`));
+const loadFromDisk = (fs, path) => fs.readFileString(path).pipe(Effect.map((content) => decodeConfig(JSON.parse(content))), 
+// Any failure → empty config → everything prompts
+Effect.catchAll(() => Effect.succeed(decodeConfig({}))));
+const saveToDisk = (fs, path, config) => Effect.gen(function* () {
+    const dir = path.replace(/\/[^/]+$/, "");
+    yield* fs.makeDirectory(dir, { recursive: true }).pipe(Effect.catchAll(() => Effect.void));
+    const tmpPath = `${path}.tmp`;
+    yield* fs.writeFileString(tmpPath, JSON.stringify(config, null, 2));
+    yield* fs.rename(tmpPath, path);
+}).pipe(Effect.catchAll(() => Effect.void));
+// Effect.Service (not Context.Tag) — auto-generates `.Default` layer.
+// The effect block runs once at Layer construction: reads file, creates Ref.
+// FileSystem comes from the providing layer (PlatformLive in Server.ts).
+export class PermissionService extends Effect.Service()("PermissionService", {
+    effect: Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const permPath = yield* Effect.configProviderWith((p) => p.load(resolvePermissionsPath)).pipe(Effect.catchAll(() => Effect.succeed("/tmp/.codecommit/permissions.json")));
+        // In-memory state. All check() calls read from here.
+        // Only set() mutates it AND writes to disk.
+        const initial = yield* loadFromDisk(fs, permPath);
+        const configRef = yield* Ref.make(initial);
+        // O(1) — Ref.get + property lookup. The "allow" default is the key invariant:
+        // missing operation → prompt the user.
+        const check = (operation) => Ref.get(configRef).pipe(Effect.map((c) => c.permissions[operation] ?? "allow"));
+        const set = (operation, state) => Effect.gen(function* () {
+            yield* Ref.update(configRef, (c) => ({
+                ...c,
+                permissions: { ...c.permissions, [operation]: state }
+            }));
+            yield* saveToDisk(fs, permPath, yield* Ref.get(configRef));
+        });
+        const getAll = () => Ref.get(configRef).pipe(Effect.map((c) => c.permissions));
+        const resetAll = () => Effect.gen(function* () {
+            yield* Ref.update(configRef, (c) => ({ ...c, permissions: {} }));
+            yield* saveToDisk(fs, permPath, yield* Ref.get(configRef));
+        });
+        const isAuditEnabled = () => Ref.get(configRef).pipe(Effect.map((c) => c.audit.enabled));
+        const getAuditRetention = () => Ref.get(configRef).pipe(Effect.map((c) => c.audit.retentionDays));
+        const setAudit = (opts) => Effect.gen(function* () {
+            yield* Ref.update(configRef, (c) => ({
+                ...c,
+                audit: {
+                    enabled: opts.enabled ?? c.audit.enabled,
+                    retentionDays: opts.retentionDays ?? c.audit.retentionDays
+                }
+            }));
+            yield* saveToDisk(fs, permPath, yield* Ref.get(configRef));
+        });
+        return { check, set, getAll, resetAll, isAuditEnabled, getAuditRetention, setAudit };
+    })
+}) {
+}
+//# sourceMappingURL=index.js.map

package/dist/PermissionService/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/PermissionService/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAsB,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAGxG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAA;AAE7D,+DAA+D;AAC/D,mFAAmF;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AAG9E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;CAC9E,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAoC,EAAE,CAAC,CAChF;IACD,KAAK,EAAE,WAAW,CAAC,IAAI,CACrB,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAC3E;CACF,CAAC,CAAA;AAIF,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;AAEhE,gEAAgE;AAChE,0EAA0E;AAE1E,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EACjD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CACvD,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,EAAyB,EAAE,IAAY,EAAoC,EAAE,CACjG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1D,kDAAkD;AAClD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CACxD,CAAA;AAEH,MAAM,UAAU,GAAG,CAAC,EAAyB,EAAE,IAAY,EAAE,MAAyB,EAAuB,EAAE,CAC7G,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IACxC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAA;IAC7B,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACnE,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAE7C,sEAAsE;AACtE,6EAA6E;AAC7E,yEAAyE;AAEzE,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,OAAO,EAAqB,CAAC,mBAAmB,EAAE;IAC9F,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAC3F,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,CAC3E,CAAA;QACD,qDAAqD;QACrD,4CAA4C;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAoB,OAAO,CAAC,CAAA;QAE7D,8EAA8E;QAC9E,uCAAuC;QACvC,MAAM,KAAK,GAAG,CAAC,SAAwB,EAAkC,EAAE,CACzE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,IAAK,OAAiB,CAAC,CAAC,CAAA;QAE5F,MAAM,GAAG,GAAG,CAAC,SAAwB,EAAE,KAAsB,EAAuB,EAAE,CACpF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,GAAG,CAAC;gBACJ,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE;aACtD,CAAC,CAAC,CAAA;YACH,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEJ,MAAM,MAAM,GAAG,GAAmD,EAAE,CAClE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;QAE3D,MAAM,QAAQ,GAAG,GAAwB,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YAChE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEJ,MAAM,cAAc,GAAG,GAA2B,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QAEhH,MAAM,iBAAiB,GAAG,GAA0B,EAAE,CACpD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;QAEnE,MAAM,QAAQ,GAAG,CACf,IAA2E,EACtD,EAAE,CACvB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,GAAG,CAAC;gBACJ,KAAK,EAAE;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO;oBACxC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa;iBAC3D;aACF,CAAC,CAAC,CAAA;YACH,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEJ,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAA;IACtF,CAAC,CAAC;CACH,CAAC;CAAG"}

package/dist/PermissionService/operations.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @title Operation registry — maps operation names to metadata
+ *
+ * Every AWS API call has a named operation with a category (read/write)
+ * and human-readable description. The gate uses the category for UI
+ * badge color; the description appears in the permission prompt modal.
+ *
+ * `OperationName` is a union of known builtin operations + `(string & {})`
+ * for runtime extensions. This gives autocomplete for known ops while
+ * allowing `registerOperation` to add new ones (e.g. approval rule CRUD).
+ *
+ * @internal
+ */
+export interface OperationMeta {
+    readonly category: "read" | "write";
+    readonly description: string;
+}
+declare const BuiltinOperations: {
+    readonly getCallerIdentity: OperationMeta;
+    readonly listRepositories: OperationMeta;
+    readonly listPullRequests: OperationMeta;
+    readonly getPullRequests: OperationMeta;
+    readonly getPullRequest: OperationMeta;
+    readonly evaluatePullRequestApprovalRules: OperationMeta;
+    readonly getPullRequestApprovalStates: OperationMeta;
+    readonly getMergeConflicts: OperationMeta;
+    readonly getCommentsForPullRequest: OperationMeta;
+    readonly listBranches: OperationMeta;
+    readonly getDifferences: OperationMeta;
+    readonly createPullRequest: OperationMeta;
+    readonly updatePullRequestTitle: OperationMeta;
+    readonly updatePullRequestDescription: OperationMeta;
+};
+export type BuiltinOperation = keyof typeof BuiltinOperations;
+export type OperationName = BuiltinOperation | (string & {});
+export declare const getOperationMeta: (name: OperationName) => OperationMeta;
+export declare const allOperations: () => ReadonlyArray<readonly [string, OperationMeta]>;
+export declare const registerOperation: (name: string, meta: OperationMeta) => void;
+export {};
+//# sourceMappingURL=operations.d.ts.map

package/dist/PermissionService/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/PermissionService/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAID,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;CAe2B,CAAA;AAElD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,iBAAiB,CAAA;AAG7D,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAM5D,eAAO,MAAM,gBAAgB,GAAI,MAAM,aAAa,KAAG,aAAuD,CAAA;AAE9G,eAAO,MAAM,aAAa,QAAO,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAA8B,CAAA;AAE7G,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,EAAE,MAAM,aAAa,KAAG,IAErE,CAAA"}

package/dist/PermissionService/operations.js

@@ -0,0 +1,38 @@
+/**
+ * @title Operation registry — maps operation names to metadata
+ *
+ * Every AWS API call has a named operation with a category (read/write)
+ * and human-readable description. The gate uses the category for UI
+ * badge color; the description appears in the permission prompt modal.
+ *
+ * `OperationName` is a union of known builtin operations + `(string & {})`
+ * for runtime extensions. This gives autocomplete for known ops while
+ * allowing `registerOperation` to add new ones (e.g. approval rule CRUD).
+ *
+ * @internal
+ */
+const op = (category, description) => ({ category, description });
+const BuiltinOperations = {
+    getCallerIdentity: op("read", "Get current user identity"),
+    listRepositories: op("read", "List all repositories"),
+    listPullRequests: op("read", "List PR IDs for a repo"),
+    getPullRequests: op("read", "Fetch PR details"),
+    getPullRequest: op("read", "Single PR detail"),
+    evaluatePullRequestApprovalRules: op("read", "Check approval status"),
+    getPullRequestApprovalStates: op("read", "Get who approved"),
+    getMergeConflicts: op("read", "Check merge conflicts"),
+    getCommentsForPullRequest: op("read", "Fetch PR comments"),
+    listBranches: op("read", "List branches"),
+    getDifferences: op("read", "Diff stats"),
+    createPullRequest: op("write", "Create a pull request"),
+    updatePullRequestTitle: op("write", "Edit PR title"),
+    updatePullRequestDescription: op("write", "Edit PR description")
+};
+const operations = new Map(Object.entries(BuiltinOperations));
+const fallback = (name) => ({ category: "read", description: name });
+export const getOperationMeta = (name) => operations.get(name) ?? fallback(name);
+export const allOperations = () => [...operations.entries()];
+export const registerOperation = (name, meta) => {
+    operations.set(name, meta);
+};
+//# sourceMappingURL=operations.js.map

package/dist/PermissionService/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/PermissionService/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,EAAE,GAAG,CAAC,QAA0B,EAAE,WAAmB,EAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;AAE1G,MAAM,iBAAiB,GAAG;IACxB,iBAAiB,EAAE,EAAE,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC1D,gBAAgB,EAAE,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACrD,gBAAgB,EAAE,EAAE,CAAC,MAAM,EAAE,wBAAwB,CAAC;IACtD,eAAe,EAAE,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC/C,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC9C,gCAAgC,EAAE,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACrE,4BAA4B,EAAE,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5D,iBAAiB,EAAE,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACtD,yBAAyB,EAAE,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAC1D,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;IACzC,cAAc,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;IACxC,iBAAiB,EAAE,EAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC;IACvD,sBAAsB,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;IACpD,4BAA4B,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,CAAC;CAChB,CAAA;AAOlD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAwB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAEpF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;AAE3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,aAAa,GAAG,GAAoD,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAA;AAE7G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,IAAmB,EAAQ,EAAE;IAC3E,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC5B,CAAC,CAAA"}

package/dist/index.d.ts

@@ -20,6 +20,7 @@ export * as ConfigService from "./ConfigService/index.js";
 export * as DateUtils from "./DateUtils.js";
 export * as Domain from "./Domain.js";
 export * as Errors from "./Errors.js";
+export * as PermissionService from "./PermissionService/index.js";
 export * as PRService from "./PRService/index.js";
 export * as SandboxService from "./SandboxService/index.js";
 export * as StatsService from "./StatsService/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,aAAa,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AAGvD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,aAAa,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,iBAAiB,MAAM,8BAA8B,CAAA;AACjE,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AAGvD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -20,6 +20,7 @@ export * as ConfigService from "./ConfigService/index.js";
 export * as DateUtils from "./DateUtils.js";
 export * as Domain from "./Domain.js";
 export * as Errors from "./Errors.js";
+export * as PermissionService from "./PermissionService/index.js";
 export * as PRService from "./PRService/index.js";
 export * as SandboxService from "./SandboxService/index.js";
 export * as StatsService from "./StatsService/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,aAAa,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AAEvD,gDAAgD;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,eAAe,MAAM,sBAAsB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,aAAa,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,iBAAiB,MAAM,8BAA8B,CAAA;AACjE,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,cAAc,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,YAAY,MAAM,yBAAyB,CAAA;AAEvD,gDAAgD;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knpkv/codecommit-core",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Core logic for CodeCommit PR browser",
   "type": "module",
   "main": "dist/index.js",