@knpkv/codecommit-web 0.11.3 → 0.13.0

package/dist/server/internal/PermissionedReadClient.js

@@ -0,0 +1,132 @@
+/** Permission and audit boundary for Schema-decoded CodeCommit provider reads. @module */
+import { AwsApiError, PermissionDeniedError } from "@knpkv/codecommit-core/Errors.js";
+import { AuditLogRepo } from "@knpkv/codecommit-core/PermissionService/AuditLog.js";
+import { PermissionService } from "@knpkv/codecommit-core/PermissionService/index.js";
+import { getOperationMeta } from "@knpkv/codecommit-core/PermissionService/operations.js";
+import { PermissionGate } from "@knpkv/codecommit-core/PermissionService/PermissionGate.js";
+import * as ReadClient from "@knpkv/codecommit-core/ReadClient.js";
+import { Clock, Context, Effect, Option, Random, Stream } from "effect";
+const MAXIMUM_CHANGED_FILE_PAGE_REQUESTS = 1_001;
+/** Holds the decoded provider client before permission enforcement. */
+export class InnerCodeCommitReadClient extends Context.Service()("@knpkv/codecommit-web/InnerCodeCommitReadClient") {
+}
+const deniedError = (params, reason) => new AwsApiError({
+    operation: params.operation,
+    profile: params.account.profile,
+    region: params.account.region,
+    cause: new PermissionDeniedError({ operation: params.operation, reason })
+});
+/** Construct a read client that checks permission and audits before every provider call. */
+export const makePermissionedReadClient = Effect.fn("PermissionedReadClient.make")(function* (inner) {
+    const permissions = yield* PermissionService;
+    const permissionGate = yield* PermissionGate;
+    const auditLog = yield* AuditLogRepo;
+    const audit = (params, permissionState, durationMs) => permissions.isAuditEnabled().pipe(Effect.flatMap((enabled) => enabled
+        ? Clock.currentTimeMillis.pipe(Effect.flatMap((now) => auditLog.log({
+            timestamp: new Date(now).toISOString(),
+            operation: params.operation,
+            accountProfile: params.account.profile,
+            region: params.account.region,
+            permissionState,
+            context: params.context,
+            durationMs
+        })))
+        : Effect.void), Effect.ignore);
+    const check = (params) => Effect.gen(function* () {
+        const state = yield* permissions.check(params.operation);
+        if (state === "always_allow")
+            return "always_allowed";
+        if (state === "deny") {
+            yield* audit(params, "denied", null);
+            return yield* deniedError(params, "denied");
+        }
+        const now = yield* Clock.currentTimeMillis;
+        const nonce = yield* Random.nextIntBetween(0, 999_999_999);
+        const response = yield* permissionGate.request({
+            id: `gate-${now}-${nonce}`,
+            operation: params.operation,
+            category: getOperationMeta(params.operation).category,
+            context: params.context
+        }).pipe(Effect.catchTag("PermissionDeniedError", (error) => Effect.gen(function* () {
+            if (error.reason === "denied") {
+                yield* permissions.set(params.operation, "deny");
+                yield* audit(params, "denied", null);
+            }
+            else {
+                yield* audit(params, "timed_out", null);
+            }
+            return yield* deniedError(params, error.reason);
+        })));
+        if (response === "always_allow") {
+            yield* permissions.set(params.operation, "always_allow");
+            return "always_allowed";
+        }
+        if (response === "deny") {
+            yield* permissions.set(params.operation, "deny");
+            yield* audit(params, "denied", null);
+            return yield* deniedError(params, "denied");
+        }
+        return "allowed";
+    });
+    const gated = (operation, context, account, method) => (request) => {
+        const params = { operation, context: context(request), account: account(request) };
+        return Effect.gen(function* () {
+            const permissionState = yield* check(params);
+            const startedAt = yield* Clock.currentTimeMillis;
+            return yield* method(request).pipe(Effect.ensuring(Clock.currentTimeMillis.pipe(Effect.flatMap((completedAt) => audit(params, permissionState, completedAt - startedAt)))));
+        });
+    };
+    const self = (account) => account;
+    const nested = (request) => request.account;
+    const listPullRequestIdsPage = gated("listPullRequests", (request) => `List pull requests in ${request.repositoryName}`, nested, inner.listPullRequestIdsPage);
+    const getPullRequest = gated("getPullRequest", (request) => `Fetch PR #${request.pullRequestId}`, nested, inner.getPullRequest);
+    const listPullRequestsPage = (request) => Effect.gen(function* () {
+        const page = yield* listPullRequestIdsPage(request);
+        const pullRequests = yield* Effect.forEach(page.pullRequestIds, (pullRequestId) => getPullRequest({ account: request.account, pullRequestId }));
+        return new ReadClient.CodeCommitPullRequestPage({ pullRequests, nextToken: page.nextToken });
+    });
+    const getChangedFilesPage = gated("getDifferences", (request) => `Read differences in ${request.repositoryName}`, nested, inner.getChangedFilesPage);
+    const initialPageToken = () => null;
+    const streamPullRequests = (request) => Stream.paginate(initialPageToken(), (nextToken) => listPullRequestsPage({ ...request, nextToken }).pipe(Effect.map((page) => [
+        page.pullRequests,
+        page.nextToken === null ? Option.none() : Option.some(page.nextToken)
+    ])));
+    const streamChangedFiles = (request) => Stream.paginate({ nextToken: null, pageRequests: 0, seenTokens: new Set() }, Effect.fn("PermissionedReadClient.changedFilesPage")(function* (state) {
+        if (state.pageRequests >= MAXIMUM_CHANGED_FILE_PAGE_REQUESTS) {
+            return yield* new ReadClient.CodeCommitMalformedResponseError({
+                operation: "GetDifferences",
+                diagnosticCode: "page-request-limit"
+            });
+        }
+        const page = yield* getChangedFilesPage({ ...request, nextToken: state.nextToken });
+        if (page.nextToken === null)
+            return [page.files, Option.none()];
+        if (state.seenTokens.has(page.nextToken)) {
+            return yield* new ReadClient.CodeCommitMalformedResponseError({
+                operation: "GetDifferences",
+                diagnosticCode: "repeated-page-token"
+            });
+        }
+        return [
+            page.files,
+            Option.some({
+                nextToken: page.nextToken,
+                pageRequests: state.pageRequests + 1,
+                seenTokens: new Set([...state.seenTokens, page.nextToken])
+            })
+        ];
+    }));
+    return {
+        discoverAccount: gated("getCallerIdentity", (account) => `Discover account for ${account.profile}`, self, inner.discoverAccount),
+        listRepositoriesPage: gated("listRepositories", (request) => `List repositories for ${request.account.profile}`, nested, inner.listRepositoriesPage),
+        getBlob: gated("getBlob", (request) => `Read immutable blob in ${request.repositoryName}`, nested, inner.getBlob),
+        listPullRequestIdsPage,
+        listPullRequestsPage,
+        streamPullRequests,
+        getPullRequest,
+        getRepositoryIdentity: gated("getRepository", (request) => `Read repository identity for ${request.repositoryName}`, nested, inner.getRepositoryIdentity),
+        getChangedFilesPage,
+        streamChangedFiles
+    };
+});
+//# sourceMappingURL=PermissionedReadClient.js.map

package/dist/server/internal/PermissionedReadClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionedReadClient.js","sourceRoot":"","sources":["../../../src/server/internal/PermissionedReadClient.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACrF,OAAO,EAAE,YAAY,EAAyB,MAAM,sDAAsD,CAAA;AAC1G,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAA;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,4DAA4D,CAAA;AAC3F,OAAO,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AASvE,MAAM,kCAAkC,GAAG,KAAK,CAAA;AAQhD,uEAAuE;AACvE,MAAM,OAAO,yBAA0B,SAAQ,OAAO,CAAC,OAAO,EAG3D,CAAC,iDAAiD,CAAC;CAAG;AAEzD,MAAM,WAAW,GAAG,CAAC,MAAkB,EAAE,MAA4B,EAAE,EAAE,CACvE,IAAI,WAAW,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;IAC/B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;IAC7B,KAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;CAC1E,CAAC,CAAA;AAEJ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC1F,KAA6C;IAE7C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAA;IAC5C,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,cAAc,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAEpC,MAAM,KAAK,GAAG,CACZ,MAAkB,EAClB,eAAoD,EACpD,UAAyB,EACJ,EAAE,CACvB,WAAW,CAAC,cAAc,EAAE,CAAC,IAAI,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO;QACL,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC5B,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACrB,QAAQ,CAAC,GAAG,CAAC;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;YACtC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,eAAe;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU;SACX,CAAC,CACH,CACF;QACD,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,MAAM,CACd,CAAA;IAEH,MAAM,KAAK,GAAG,CAAC,MAAkB,EAA+D,EAAE,CAChG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,KAAK,KAAK,cAAc;YAAE,OAAO,gBAAgB,CAAA;QACrD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;YAC7C,EAAE,EAAE,QAAQ,GAAG,IAAI,KAAK,EAAE;YAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ;YACrD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBAChD,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACtC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACzC,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACjD,CAAC,CAAC,CAAC,CACN,CAAA;QACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;YACxD,OAAO,gBAAgB,CAAA;QACzB,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChD,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IAEJ,MAAM,KAAK,GAAG,CACZ,SAAiB,EACjB,OAAwC,EACxC,OAAkE,EAClE,MAAwE,EACxE,EAAE,CACJ,CAAC,OAAU,EAAoD,EAAE;QAC/D,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAA;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;YAChD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAChC,MAAM,CAAC,QAAQ,CACb,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC,CACzF,CACF,CACF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,OAAyC,EAAE,EAAE,CAAC,OAAO,CAAA;IACnE,MAAM,MAAM,GAAG,CAAC,OAA+D,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAA;IAEnG,MAAM,sBAAsB,GAAG,KAAK,CAClC,kBAAkB,EAClB,CAAC,OAAwF,EAAE,EAAE,CAC3F,yBAAyB,OAAO,CAAC,cAAc,EAAE,EACnD,MAAM,EACN,KAAK,CAAC,sBAAsB,CAC7B,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,CAC1B,gBAAgB,EAChB,CAAC,OAAgF,EAAE,EAAE,CACnF,aAAa,OAAO,CAAC,aAAa,EAAE,EACtC,MAAM,EACN,KAAK,CAAC,cAAc,CACrB,CAAA;IACD,MAAM,oBAAoB,GAAmE,CAAC,OAAO,EAAE,EAAE,CACvG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,cAAc,EACnB,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,CAC/E,CAAA;QACD,OAAO,IAAI,UAAU,CAAC,yBAAyB,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IACJ,MAAM,mBAAmB,GAAG,KAAK,CAC/B,gBAAgB,EAChB,CAAC,OAAqF,EAAE,EAAE,CACxF,uBAAuB,OAAO,CAAC,cAAc,EAAE,EACjD,MAAM,EACN,KAAK,CAAC,mBAAmB,CAC1B,CAAA;IACD,MAAM,gBAAgB,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAA;IAElD,MAAM,kBAAkB,GAAiE,CAAC,OAAO,EAAE,EAAE,CACnG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAChD,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAgB,IAAI,CAAC,SAAS,CAAC;KACpG,CAAC,CACH,CAAC,CAAA;IAEN,MAAM,kBAAkB,GAAiE,CAAC,OAAO,EAAE,EAAE,CACnG,MAAM,CAAC,QAAQ,CACb,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,EAC3D,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAAC,QAAQ,CAAC,EAAC,KAAK;QAClE,IAAI,KAAK,CAAC,YAAY,IAAI,kCAAkC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,gCAAgC,CAAC;gBAC5D,SAAS,EAAE,gBAAgB;gBAC3B,cAAc,EAAE,oBAAoB;aACrC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;QACnF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAA8B,CAAC,CAAA;QAC3F,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,gCAAgC,CAAC;gBAC5D,SAAS,EAAE,gBAAgB;gBAC3B,cAAc,EAAE,qBAAqB;aACtC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO;YACL,IAAI,CAAC,KAAK;YACV,MAAM,CAAC,IAAI,CAA6B;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,CAAC;gBACpC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aAC3D,CAAC;SACH,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAEH,OAAO;QACL,eAAe,EAAE,KAAK,CACpB,mBAAmB,EACnB,CAAC,OAAO,EAAE,EAAE,CAAC,wBAAwB,OAAO,CAAC,OAAO,EAAE,EACtD,IAAI,EACJ,KAAK,CAAC,eAAe,CACtB;QACD,oBAAoB,EAAE,KAAK,CACzB,kBAAkB,EAClB,CAAC,OAAO,EAAE,EAAE,CAAC,yBAAyB,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAC/D,MAAM,EACN,KAAK,CAAC,oBAAoB,CAC3B;QACD,OAAO,EAAE,KAAK,CACZ,SAAS,EACT,CAAC,OAAO,EAAE,EAAE,CAAC,0BAA0B,OAAO,CAAC,cAAc,EAAE,EAC/D,MAAM,EACN,KAAK,CAAC,OAAO,CACd;QACD,sBAAsB;QACtB,oBAAoB;QACpB,kBAAkB;QAClB,cAAc;QACd,qBAAqB,EAAE,KAAK,CAC1B,eAAe,EACf,CAAC,OAAO,EAAE,EAAE,CAAC,gCAAgC,OAAO,CAAC,cAAc,EAAE,EACrE,MAAM,EACN,KAAK,CAAC,qBAAqB,CAC5B;QACD,mBAAmB;QACnB,kBAAkB;KAC8B,CAAA;AACpD,CAAC,CAAC,CAAA"}

package/dist/server/review/PullRequestReview.d.ts

@@ -0,0 +1,311 @@
+import type * as Domain from "@knpkv/codecommit-core/Domain.js";
+import type * as ReadClient from "@knpkv/codecommit-core/ReadClient.js";
+import { createTwoFilesPatch } from "diff";
+import { Cause, Effect, Option, Schema, Stream } from "effect";
+import * as Crypto from "effect/Crypto";
+import * as FileSystem from "effect/FileSystem";
+import type * as Semaphore from "effect/Semaphore";
+import type * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import { type PullRequestRelayReviewResponse, type RelayReviewConversationTurn, type RelayReviewKind, type RelayReviewProgressPhase, RelayReviewResult, type RelayReviewStreamEvent } from "../Api.js";
+import type { RelayFindingPublisherService } from "./RelayFindingPublisher.js";
+declare const PullRequestReviewError_base: Schema.Class<PullRequestReviewError, Schema.TaggedStruct<"PullRequestReviewError", {
+    readonly operation: Schema.String;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Defect>;
+}>, Cause.YieldableError>;
+export declare class PullRequestReviewError extends PullRequestReviewError_base {
+}
+interface ExactReviewScope {
+    readonly account: ReadClient.CodeCommitReadAccount;
+    readonly pullRequest: Domain.PullRequest;
+    readonly revision: ReadClient.CodeCommitPullRequestRevision;
+}
+interface ExpectedReviewRevision {
+    readonly revisionId: string;
+    readonly baseCommit: string;
+    readonly headCommit: string;
+}
+/** Group-lifetime source for exact-revision changed-file inventories. */
+export interface PullRequestChangedFilesSource {
+    readonly get: (account: ReadClient.CodeCommitReadAccount, revision: ReadClient.CodeCommitPullRequestRevision) => Effect.Effect<ReadonlyArray<ReadClient.CodeCommitChangedFile>, PullRequestReviewError>;
+}
+interface RelayFileAnchors {
+    readonly beforePath: string | null;
+    readonly afterPath: string | null;
+    readonly beforeLines: ReadonlySet<number>;
+    readonly afterLines: ReadonlySet<number>;
+}
+interface RelayPatchEvidence {
+    readonly patch: string;
+    readonly anchors: ReadonlyArray<RelayFileAnchors>;
+}
+export interface RelayReviewProgress {
+    readonly phase: RelayReviewProgressPhase;
+    readonly message: string;
+    readonly detail?: string;
+}
+export type RelayReviewProgressReporter = (progress: RelayReviewProgress) => Effect.Effect<void>;
+/** Build one bounded cache shared by the PR handler group. */
+export declare const makePullRequestChangedFilesSource: (client: ReadClient.CodeCommitReadClientService) => Effect.Effect<{
+    get: (account: {
+        readonly profile: string & import("effect/Brand").Brand<"AwsProfileName">;
+        readonly region: string & import("effect/Brand").Brand<"AwsRegion">;
+    }, revision: ReadClient.CodeCommitPullRequestRevision) => Effect.Effect<ReadClient.CodeCommitChangedFile[], PullRequestReviewError, never>;
+}, never, never>;
+/** Load the complete changed-file inventory without exposing provider blob locators. */
+export declare const loadPullRequestDiff: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, changedFiles?: PullRequestChangedFilesSource | undefined) => Effect.Effect<{
+    readonly pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
+    readonly revisionId: string;
+    readonly baseCommit: string;
+    readonly headCommit: string;
+    readonly files: readonly {
+        readonly index: number;
+        readonly status: "added" | "deleted" | "modified" | "renamed";
+        readonly path: string;
+        readonly previousPath: string | null;
+        readonly beforeMode: string | null;
+        readonly afterMode: string | null;
+    }[];
+}, PullRequestReviewError, never>;
+/** Load both text sides for one indexed file after an exact-revision preflight. */
+export declare const loadPullRequestDiffContent: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, fileIndex: number, changedFiles?: PullRequestChangedFilesSource | undefined) => Effect.Effect<{
+    readonly fileIndex: number;
+    readonly revisionId: string;
+    readonly state: "binary" | "oversized" | "text";
+    readonly before: string | null;
+    readonly after: string | null;
+}, PullRequestReviewError, never>;
+/** Build one bounded exact patch and its changed-line evidence from Schema-decoded provider blobs. */
+export declare const collectRelayPatchEvidence: (client: ReadClient.CodeCommitReadClientService, scope: ExactReviewScope, files: readonly ReadClient.CodeCommitChangedFile[], renderPatch?: typeof createTwoFilesPatch | undefined) => Effect.Effect<RelayPatchEvidence, PullRequestReviewError, never>;
+/** Build one bounded exact patch from Schema-decoded provider blobs. */
+export declare const collectRelayPatch: (client: ReadClient.CodeCommitReadClientService, scope: ExactReviewScope, files: readonly ReadClient.CodeCommitChangedFile[], renderPatch?: typeof createTwoFilesPatch | undefined) => Effect.Effect<string, PullRequestReviewError, never>;
+/** Reject Relay locations that are not exact changed-line or changed-file evidence. */
+export declare const validateRelayReviewAnchors: (result: RelayReviewResult, evidence: RelayPatchEvidence) => Effect.Effect<void, PullRequestReviewError>;
+/** Run Relay only when the group-level execution slot is immediately available. */
+export declare const withRelayReviewPermit: <A, E, R>(semaphore: Semaphore.Semaphore, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | PullRequestReviewError, R>;
+/** Hold the review slot for the complete streamed agent lifetime. */
+export declare const withRelayReviewStreamPermit: <A, E, R>(semaphore: Semaphore.Semaphore, stream: Stream.Stream<A, E, R>) => Stream.Stream<A, E | PullRequestReviewError, R>;
+/** Host-authored Relay prompt; repository content is isolated as untrusted evidence. */
+export declare const makeRelayReviewPrompt: (scope: ExactReviewScope, kind: RelayReviewKind, patch: string, skillPrompt?: string) => string;
+export declare const parseRelayReviewResult: (message: string, kind: RelayReviewKind) => Option.Option<RelayReviewResult>;
+/** Execute one ephemeral, read-only Relay pass over the exact provider patch. */
+export declare const runPullRequestRelayReview: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, kind: "explain" | "review" | "security" | "tests", changedFiles?: PullRequestChangedFilesSource | undefined, skillPrompt?: string | undefined, reportProgress?: RelayReviewProgressReporter | undefined) => Effect.Effect<{
+    readonly pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
+    readonly revisionId: string;
+    readonly baseCommit: string;
+    readonly headCommit: string;
+    readonly kind: "explain" | "review" | "security" | "tests";
+    readonly result: {
+        readonly findings: readonly {
+            readonly id: string;
+            readonly priority: "P1" | "P2" | "P3" | "P4";
+            readonly title: string;
+            readonly summary: string;
+            readonly details: string;
+            readonly recommendation: string;
+            readonly verification: string;
+            readonly publicationTarget: "line-comment" | "pr-comment";
+            readonly location: {
+                readonly scope: "general";
+            } | {
+                readonly scope: "file";
+                readonly filePath: string;
+            } | {
+                readonly scope: "line";
+                readonly filePath: string;
+                readonly line: number;
+                readonly side: "after" | "before";
+            };
+        }[];
+        readonly verdict: string;
+        readonly explanation?: string | undefined;
+    };
+}, PullRequestReviewError, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem>;
+export declare const makeRelayConversationPrompt: (scope: ExactReviewScope, kind: RelayReviewKind, patch: string, skillPrompt: string, currentReview: typeof RelayReviewResult.Type, turns: ReadonlyArray<RelayReviewConversationTurn>, findingId: string, message: string) => string;
+/** Continue a finding conversation while reconciling the complete deck against one exact revision. */
+export declare const continuePullRequestRelayReview: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, kind: "explain" | "review" | "security" | "tests", currentReview: {
+    readonly findings: readonly {
+        readonly id: string;
+        readonly priority: "P1" | "P2" | "P3" | "P4";
+        readonly title: string;
+        readonly summary: string;
+        readonly details: string;
+        readonly recommendation: string;
+        readonly verification: string;
+        readonly publicationTarget: "line-comment" | "pr-comment";
+        readonly location: {
+            readonly scope: "general";
+        } | {
+            readonly scope: "file";
+            readonly filePath: string;
+        } | {
+            readonly scope: "line";
+            readonly filePath: string;
+            readonly line: number;
+            readonly side: "after" | "before";
+        };
+    }[];
+    readonly verdict: string;
+    readonly explanation?: string | undefined;
+}, turns: readonly {
+    readonly findingId: string;
+    readonly role: "assistant" | "user";
+    readonly message: string;
+}[], findingId: string, message: string, changedFiles?: PullRequestChangedFilesSource | undefined, skillPrompt?: string | undefined, reportProgress?: RelayReviewProgressReporter | undefined) => Effect.Effect<{
+    review: {
+        pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
+        revisionId: string;
+        baseCommit: string & import("effect/Brand").Brand<"CodeCommitCommitId">;
+        headCommit: string & import("effect/Brand").Brand<"CodeCommitCommitId">;
+        kind: "explain" | "review" | "security" | "tests";
+        result: {
+            readonly findings: readonly {
+                readonly id: string;
+                readonly priority: "P1" | "P2" | "P3" | "P4";
+                readonly title: string;
+                readonly summary: string;
+                readonly details: string;
+                readonly recommendation: string;
+                readonly verification: string;
+                readonly publicationTarget: "line-comment" | "pr-comment";
+                readonly location: {
+                    readonly scope: "general";
+                } | {
+                    readonly scope: "file";
+                    readonly filePath: string;
+                } | {
+                    readonly scope: "line";
+                    readonly filePath: string;
+                    readonly line: number;
+                    readonly side: "after" | "before";
+                };
+            }[];
+            readonly verdict: string;
+            readonly explanation?: string | undefined;
+        };
+    };
+    reply: string;
+}, PullRequestReviewError, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem>;
+/** Convert one Relay worker into a stream with exactly one terminal event. */
+export declare const streamRelayReviewEventsFrom: <E, R>(run: (report: RelayReviewProgressReporter) => Effect.Effect<{
+    readonly review: PullRequestRelayReviewResponse;
+    readonly reply?: string;
+}, E, R>) => Stream.Stream<RelayReviewStreamEvent, never, R>;
+/** Stream sanitized progress and one terminal review event. */
+export declare const streamPullRequestRelayReview: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, kind: RelayReviewKind, changedFiles: PullRequestChangedFilesSource | undefined, skillPrompt: string) => Stream.Stream<{
+    readonly type: "progress";
+    readonly phase: "agent" | "files" | "patch" | "posting" | "revision" | "validation";
+    readonly message: string;
+    readonly detail?: string | undefined;
+} | {
+    readonly type: "complete";
+    readonly review: {
+        readonly pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
+        readonly revisionId: string;
+        readonly baseCommit: string;
+        readonly headCommit: string;
+        readonly kind: "explain" | "review" | "security" | "tests";
+        readonly result: {
+            readonly findings: readonly {
+                readonly id: string;
+                readonly priority: "P1" | "P2" | "P3" | "P4";
+                readonly title: string;
+                readonly summary: string;
+                readonly details: string;
+                readonly recommendation: string;
+                readonly verification: string;
+                readonly publicationTarget: "line-comment" | "pr-comment";
+                readonly location: {
+                    readonly scope: "general";
+                } | {
+                    readonly scope: "file";
+                    readonly filePath: string;
+                } | {
+                    readonly scope: "line";
+                    readonly filePath: string;
+                    readonly line: number;
+                    readonly side: "after" | "before";
+                };
+            }[];
+            readonly verdict: string;
+            readonly explanation?: string | undefined;
+        };
+    };
+    readonly reply?: string | undefined;
+} | {
+    readonly type: "error";
+    readonly message: string;
+}, never, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem>;
+/** Stream sanitized progress and one terminal reconciled conversation event. */
+export declare const streamPullRequestRelayConversation: (client: ReadClient.CodeCommitReadClientService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, kind: RelayReviewKind, currentReview: typeof RelayReviewResult.Type, turns: ReadonlyArray<RelayReviewConversationTurn>, findingId: string, message: string, changedFiles: PullRequestChangedFilesSource | undefined, skillPrompt: string) => Stream.Stream<{
+    readonly type: "progress";
+    readonly phase: "agent" | "files" | "patch" | "posting" | "revision" | "validation";
+    readonly message: string;
+    readonly detail?: string | undefined;
+} | {
+    readonly type: "complete";
+    readonly review: {
+        readonly pullRequestId: string & import("effect/Brand").Brand<"PullRequestId">;
+        readonly revisionId: string;
+        readonly baseCommit: string;
+        readonly headCommit: string;
+        readonly kind: "explain" | "review" | "security" | "tests";
+        readonly result: {
+            readonly findings: readonly {
+                readonly id: string;
+                readonly priority: "P1" | "P2" | "P3" | "P4";
+                readonly title: string;
+                readonly summary: string;
+                readonly details: string;
+                readonly recommendation: string;
+                readonly verification: string;
+                readonly publicationTarget: "line-comment" | "pr-comment";
+                readonly location: {
+                    readonly scope: "general";
+                } | {
+                    readonly scope: "file";
+                    readonly filePath: string;
+                } | {
+                    readonly scope: "line";
+                    readonly filePath: string;
+                    readonly line: number;
+                    readonly side: "after" | "before";
+                };
+            }[];
+            readonly verdict: string;
+            readonly explanation?: string | undefined;
+        };
+    };
+    readonly reply?: string | undefined;
+} | {
+    readonly type: "error";
+    readonly message: string;
+}, never, ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem>;
+/** Accept and immediately post one unchanged finding through the exact-revision review client. */
+export declare const postPullRequestRelayFinding: (client: ReadClient.CodeCommitReadClientService, publisher: RelayFindingPublisherService, pullRequest: Domain.PullRequest, expectedRevision: ExpectedReviewRevision, finding: {
+    readonly id: string;
+    readonly priority: "P1" | "P2" | "P3" | "P4";
+    readonly title: string;
+    readonly summary: string;
+    readonly details: string;
+    readonly recommendation: string;
+    readonly verification: string;
+    readonly publicationTarget: "line-comment" | "pr-comment";
+    readonly location: {
+        readonly scope: "general";
+    } | {
+        readonly scope: "file";
+        readonly filePath: string;
+    } | {
+        readonly scope: "line";
+        readonly filePath: string;
+        readonly line: number;
+        readonly side: "after" | "before";
+    };
+}, changedFiles?: PullRequestChangedFilesSource | undefined) => Effect.Effect<{
+    findingId: string;
+    operationId: string;
+    summary: string;
+}, PullRequestReviewError, Crypto.Crypto>;
+export {};
+//# sourceMappingURL=PullRequestReview.d.ts.map

package/dist/server/review/PullRequestReview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PullRequestReview.d.ts","sourceRoot":"","sources":["../../../src/server/review/PullRequestReview.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,MAAM,kCAAkC,CAAA;AAC/D,OAAO,KAAK,KAAK,UAAU,MAAM,sCAAsC,CAAA;AAEvE,OAAO,EAAE,mBAAmB,EAAc,MAAM,MAAM,CAAA;AACtD,OAAO,EAAS,KAAK,EAAQ,MAAM,EAAQ,MAAM,EAAoB,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACnG,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAA;AAEvF,OAAO,EAGL,KAAK,8BAA8B,EAEnC,KAAK,2BAA2B,EAEhC,KAAK,eAAe,EAEpB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;;;;;;AAU9E,qBAAa,sBAAuB,SAAQ,2BAO3C;CAAG;AAEJ,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,CAAA;CAC5D;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAWD,yEAAyE;AACzE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,CACZ,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,QAAQ,EAAE,UAAU,CAAC,6BAA6B,KAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,sBAAsB,CAAC,CAAA;CAC5F;AAaD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACzC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,mBAAmB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAsEhG,8DAA8D;AAC9D,eAAO,MAAM,iCAAiC;;;;;gBAwB5C,CAAA;AA6CF,wFAAwF;AACxF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;iCAc9B,CAAA;AA4CF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B;;;;;;iCAwBrC,CAAA;AAsLF,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,yPA0CpC,CAAA;AAEF,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,6OAO5B,CAAA;AAEF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B,WAC7B,iBAAiB,YACf,kBAAkB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAmB5C,CAAA;AAED,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aAChC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAU9C,CAAA;AAEH,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,aACtC,SAAS,CAAC,SAAS,UACtB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC,CAgB9C,CAAA;AAgBH,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,UACzB,gBAAgB,QACjB,eAAe,SACd,MAAM,gBACA,MAAM,KAClB,MAkCF,CAAA;AAiBD,eAAO,MAAM,sBAAsB,YACxB,MAAM,QACT,eAAe,KACpB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAOjC,CAAA;AAED,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FAqFpC,CAAA;AAmBF,eAAO,MAAM,2BAA2B,UAC/B,gBAAgB,QACjB,eAAe,SACd,MAAM,eACA,MAAM,iBACJ,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,KACd,MAgCF,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2FA2FzC,CAAA;AAQF,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,GAAI,CAAC,EAAE,CAAC,OACzC,CAAC,MAAM,EAAE,2BAA2B,KAAK,MAAM,CAAC,MAAM,CACzD;IAAE,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5E,CAAC,EACD,CAAC,CACF,KACA,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAqB5C,CAAA;AAEL,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B,WAC/B,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,QAClC,eAAe,gBACP,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAYlB,CAAA;AAEH,gFAAgF;AAChF,eAAO,MAAM,kCAAkC,WACrC,UAAU,CAAC,2BAA2B,eACjC,MAAM,CAAC,WAAW,oBACb,sBAAsB,QAClC,eAAe,iBACN,OAAO,iBAAiB,CAAC,IAAI,SACrC,aAAa,CAAC,2BAA2B,CAAC,aACtC,MAAM,WACR,MAAM,gBACD,6BAA6B,GAAG,SAAS,eAC1C,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EAgBlB,CAAA;AA8CH,kGAAkG;AAClG,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;yCA4CtC,CAAA"}