@de-otio/trellis 0.4.0

package/dist/db.d.ts

@@ -0,0 +1,36 @@
+import type { PrismaClient } from "@prisma/client";
+export interface EnvWithDb {
+    DATABASE_URL: string;
+    LOG_LEVEL?: string;
+    DATABASE_CONNECTION_TIMEOUT_MS?: string;
+    DATABASE_STATEMENT_TIMEOUT_MS?: string;
+}
+export type ManagedPrismaClient = PrismaClient & {
+    release: () => Promise<void>;
+};
+export declare function createPrisma(env: EnvWithDb, region?: string): ManagedPrismaClient;
+export declare function withPrisma<T>(env: EnvWithDb, fn: (client: PrismaClient) => Promise<T>, region?: string): Promise<T>;
+export declare function withPrismaRetry<T>(env: EnvWithDb, queryFn: (client: PrismaClient) => Promise<T>, options?: {
+    region?: string;
+    timeoutMs?: number;
+    retryTimeoutMs?: number;
+    maxRetries?: number;
+    baseDelayMs?: number;
+    defaultValue?: T;
+    context?: Record<string, any>;
+}): Promise<T>;
+export declare function createPrismaForRegion(region: string, env: EnvWithDb): ManagedPrismaClient;
+export declare class DatabaseClient {
+    static clearPoolCache(): void;
+    static getPoolStatus(): {
+        key: string;
+        totalCount: number;
+        idleCount: number;
+        waitingCount: number;
+        age: number;
+        errorCount: number;
+    }[];
+    static createForRegion(region: string, env: EnvWithDb): ManagedPrismaClient;
+    static create(env: EnvWithDb, region?: string): ManagedPrismaClient;
+}
+//# sourceMappingURL=db.d.ts.map

package/dist/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG;IAC/C,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAEF,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,GAAE,MAAa,GAAG,mBAAmB,CAMvF;AAED,wBAAsB,UAAU,CAAC,CAAC,EAChC,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,EACxC,MAAM,GAAE,MAAa,GACpB,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,EAC7C,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC1B,GACL,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,mBAAmB,CAEzF;AAED,qBAAa,cAAc;IACzB,MAAM,CAAC,cAAc,IAAI,IAAI;IAC7B,MAAM,CAAC,aAAa;;;;;;;;IACpB,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,mBAAmB;IAC3E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,GAAE,MAAa,GAAG,mBAAmB;CAC1E"}

package/dist/db.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseClient = void 0;
+exports.createPrisma = createPrisma;
+exports.withPrisma = withPrisma;
+exports.withPrismaRetry = withPrismaRetry;
+exports.createPrismaForRegion = createPrismaForRegion;
+const database_connection_manager_1 = require("./lib/database-connection-manager");
+function createPrisma(env, region = "US") {
+    const managed = database_connection_manager_1.sharedDatabaseConnectionManager.acquireClient(region, env);
+    const prisma = managed.client;
+    // No-op release — pool lifecycle managed by DatabaseConnectionManager.shutdown()
+    prisma.release = async () => { };
+    return prisma;
+}
+async function withPrisma(env, fn, region = "US") {
+    const client = createPrisma(env, region);
+    try {
+        return await fn(client);
+    }
+    finally {
+        await client.release();
+    }
+}
+async function withPrismaRetry(env, queryFn, options = {}) {
+    const { region = "US", ...rest } = options;
+    return database_connection_manager_1.sharedDatabaseConnectionManager.executeWithRetry(region, env, queryFn, rest);
+}
+function createPrismaForRegion(region, env) {
+    return createPrisma(env, region);
+}
+class DatabaseClient {
+    static clearPoolCache() { database_connection_manager_1.sharedDatabaseConnectionManager.clearPools(); }
+    static getPoolStatus() { return database_connection_manager_1.sharedDatabaseConnectionManager.getPoolStatus(); }
+    static createForRegion(region, env) { return createPrisma(env, region); }
+    static create(env, region = "US") { return createPrisma(env, region); }
+}
+exports.DatabaseClient = DatabaseClient;
+//# sourceMappingURL=db.js.map

package/dist/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":";;;AAcA,oCAMC;AAED,gCAWC;AAED,0CAeC;AAED,sDAEC;AArDD,mFAAoF;AAapF,SAAgB,YAAY,CAAC,GAAc,EAAE,SAAiB,IAAI;IAChE,MAAM,OAAO,GAAG,6DAA+B,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,MAA6B,CAAC;IACrD,iFAAiF;IACjF,MAAM,CAAC,OAAO,GAAG,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,GAAc,EACd,EAAwC,EACxC,SAAiB,IAAI;IAErB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,OAA6C,EAC7C,UAQI,EAAE;IAEN,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3C,OAAO,6DAA+B,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAc,EAAE,GAAc;IAClE,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAa,cAAc;IACzB,MAAM,CAAC,cAAc,KAAW,6DAA+B,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,aAAa,KAAK,OAAO,6DAA+B,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,eAAe,CAAC,MAAc,EAAE,GAAc,IAAyB,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACjH,MAAM,CAAC,MAAM,CAAC,GAAc,EAAE,SAAiB,IAAI,IAAyB,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAChH;AALD,wCAKC"}

package/dist/env.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Environment Configuration
+ *
+ * Builds the application environment from process.env + AWS service adapters.
+ * Shaped to be compatible with the existing handler code that expects CF-style bindings.
+ */
+import type { KVNamespace, CloudflareQueue, R2Bucket, AnalyticsEngineDataset } from "./types/cloudflare-compat";
+/** Application environment — available to all route handlers */
+export interface Env {
+    DATABASE_URL: string;
+    DATABASE_URL_CN?: string;
+    DIRECT_URL?: string;
+    DATABASE_POOL_MAX?: string;
+    DATABASE_CONNECTION_TIMEOUT_MS?: string;
+    DATABASE_STATEMENT_TIMEOUT_MS?: string;
+    SESSION_SECRET: string;
+    SESSION_SECRET_FALLBACK?: string;
+    SESSION_SALT?: string;
+    COGNITO_USER_POOL_ID?: string;
+    COGNITO_APP_CLIENT_ID?: string;
+    COGNITO_REGION?: string;
+    SUPABASE_URL?: string;
+    SUPABASE_PUBLISHABLE_KEY?: string;
+    SUPABASE_URL_CN?: string;
+    SUPABASE_PUBLISHABLE_KEY_CN?: string;
+    SUPABASE_SERVICE_ROLE_KEY?: string;
+    ENTRA_TENANT_ID?: string;
+    ENTRA_CHINA_TENANT_ID?: string;
+    INTERNAL_TENANT_ID?: string;
+    APP_DOMAIN?: string;
+    APP_URL?: string;
+    ALLOWED_ORIGINS?: string;
+    ACTIVITYPUB_BASE_URL?: string;
+    CSP_CONNECT_SRC?: string;
+    CSP_SCRIPT_SRC?: string;
+    CSP_STYLE_SRC?: string;
+    IP_GEOLOCATION_API_KEY?: string;
+    IP_GEOLOCATION_SERVICE?: "ipapi" | "ip-api" | "cloudflare";
+    DEFAULT_REGION?: string;
+    ENABLE_IP_GEOLOCATION?: string;
+    INTERNAL_EMAIL_DOMAINS?: string;
+    OPENAI_API_KEY?: string;
+    GOOGLE_SAFE_BROWSING_API_KEY?: string;
+    RECAPTCHA_SITE_KEY?: string;
+    RECAPTCHA_SECRET_KEY?: string;
+    EMAIL_SERVICE?: "aws-ses" | "resend" | "alibaba-directmail" | "tencent-ses";
+    EMAIL_SERVICE_REGION?: string;
+    FROM_EMAIL?: string;
+    AWS_SES_REGION?: string;
+    RESEND_API_KEY?: string;
+    ALIBABA_ACCESS_KEY_ID?: string;
+    ALIBABA_ACCESS_KEY_SECRET?: string;
+    ALIBABA_REGION?: string;
+    ALIBABA_ACCOUNT_NAME?: string;
+    TENCENT_SECRET_ID?: string;
+    TENCENT_SECRET_KEY?: string;
+    TENCENT_REGION?: string;
+    TENCENT_FROM_EMAIL?: string;
+    SECURITY_WEBHOOK_URL?: string;
+    ANALYTICS?: AnalyticsEngineDataset;
+    OPENAI_BUDGET_ENABLED?: string;
+    OPENAI_BUDGET_HOURLY_MAX?: string;
+    OPENAI_BUDGET_DAILY_MAX?: string;
+    COST_LIMIT_DAILY_TOTAL?: string;
+    COST_LIMIT_DAILY_OPENAI?: string;
+    COST_LIMIT_DAILY_SES?: string;
+    ENVIRONMENT?: string;
+    DEPLOY_ENV?: string;
+    APP_VERSION?: string;
+    LOG_LEVEL?: string;
+    NODE_ENV?: string;
+    CI?: string;
+    GITHUB_ACTIONS?: string;
+    STAGE?: string;
+    AWS_REGION?: string;
+    AWS_ACCOUNT_ID?: string;
+    AWS_ACCESS_KEY_ID?: string;
+    AWS_SECRET_ACCESS_KEY?: string;
+    IMAGES?: any;
+    RATE_LIMIT_KV: KVNamespace;
+    PRIVACY_PREFERENCES_KV: KVNamespace;
+    FRIENDS_KV: KVNamespace;
+    CONNECTION_CODES_KV: KVNamespace;
+    FEED_CACHE_KV: KVNamespace;
+    MODERATION_CACHE_KV: KVNamespace;
+    COMMENTS_KV: KVNamespace;
+    THREAT_INTEL_CACHE_KV: KVNamespace;
+    TAXONOMY_CACHE_KV: KVNamespace;
+    FOLLOWERS_KV: KVNamespace;
+    EXPORT_JOBS_KV: KVNamespace;
+    DELETE_JOBS_KV: KVNamespace;
+    CSRF_TOKENS_KV: KVNamespace;
+    SESSION_BLOCKLIST_KV: KVNamespace;
+    INVITATIONS_KV: KVNamespace;
+    EXPORT_QUEUE: CloudflareQueue;
+    DELETE_ACCOUNT_QUEUE: CloudflareQueue;
+    FOLLOWERS_EVENTS_QUEUE: CloudflareQueue;
+    LINK_CHECK_QUEUE: CloudflareQueue;
+    MEDIA_PROCESSING_QUEUE: CloudflareQueue;
+    MEDIA_BUCKET_R2: R2Bucket;
+    EXPORT_FILES_R2: R2Bucket;
+}
+/** S1.4 — Validate critical environment variables at startup */
+export declare function validateEnv(env: Env): string[];
+/** Build the application environment — fetches secrets from AWS if needed */
+export declare function buildEnv(): Promise<Env>;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,QAAQ,EAER,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAUnC,gEAAgE;AAChE,MAAM,WAAW,GAAG;IAElB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAGvC,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAGnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAGhC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,oBAAoB,GAAG,aAAa,CAAC;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAG5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAGnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAG9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,MAAM,CAAC,EAAE,GAAG,CAAC;IAGb,aAAa,EAAE,WAAW,CAAC;IAC3B,sBAAsB,EAAE,WAAW,CAAC;IACpC,UAAU,EAAE,WAAW,CAAC;IACxB,mBAAmB,EAAE,WAAW,CAAC;IACjC,aAAa,EAAE,WAAW,CAAC;IAC3B,mBAAmB,EAAE,WAAW,CAAC;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,qBAAqB,EAAE,WAAW,CAAC;IACnC,iBAAiB,EAAE,WAAW,CAAC;IAC/B,YAAY,EAAE,WAAW,CAAC;IAC1B,cAAc,EAAE,WAAW,CAAC;IAC5B,cAAc,EAAE,WAAW,CAAC;IAC5B,cAAc,EAAE,WAAW,CAAC;IAC5B,oBAAoB,EAAE,WAAW,CAAC;IAClC,cAAc,EAAE,WAAW,CAAC;IAG5B,YAAY,EAAE,eAAe,CAAC;IAC9B,oBAAoB,EAAE,eAAe,CAAC;IACtC,sBAAsB,EAAE,eAAe,CAAC;IACxC,gBAAgB,EAAE,eAAe,CAAC;IAClC,sBAAsB,EAAE,eAAe,CAAC;IAGxC,eAAe,EAAE,QAAQ,CAAC;IAC1B,eAAe,EAAE,QAAQ,CAAC;CAC3B;AA8FD,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,CAkB9C;AAED,6EAA6E;AAC7E,wBAAsB,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAuI7C"}

package/dist/env.js

@@ -0,0 +1,268 @@
+"use strict";
+/**
+ * Environment Configuration
+ *
+ * Builds the application environment from process.env + AWS service adapters.
+ * Shaped to be compatible with the existing handler code that expects CF-style bindings.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateEnv = validateEnv;
+exports.buildEnv = buildEnv;
+const dynamodb_kv_1 = require("./lib/kv/dynamodb-kv");
+const sqs_queue_1 = require("./lib/queue/sqs-queue");
+const s3_storage_1 = require("./lib/storage/s3-storage");
+const stage = process.env.STAGE || "dev";
+function sqsUrl(queueName) {
+    const base = process.env.SQS_ENDPOINT || `https://sqs.${process.env.AWS_REGION || "us-east-1"}.amazonaws.com`;
+    const accountId = process.env.AWS_ACCOUNT_ID || "000000000000";
+    return `${base}/${accountId}/${stage}-${queueName}`;
+}
+/**
+ * Assemble a Postgres URL from Secrets Manager at runtime.
+ *
+ * The secret is fetched with the AWS SDK. Credentials live on the returned
+ * string only — process.env is never mutated, so child processes, core dumps,
+ * and `ecs execute-command` → `env` do not leak the password.
+ *
+ * Cached at module scope after first resolution.
+ */
+let cachedDatabaseUrl;
+async function resolveDatabaseUrl() {
+    if (cachedDatabaseUrl)
+        return cachedDatabaseUrl;
+    // Local dev / migrations: DATABASE_URL in env wins (already the typical pattern
+    // for prisma migrate scripts). Not a security regression because local dev isn't
+    // prod, and migration jobs are short-lived processes.
+    if (process.env.DATABASE_URL) {
+        cachedDatabaseUrl = process.env.DATABASE_URL;
+        return cachedDatabaseUrl;
+    }
+    // AWS path: task role has secretsmanager:GetSecretValue on the ARN.
+    const secretArn = process.env.DB_SECRET_ARN;
+    if (secretArn) {
+        const region = process.env.AWS_REGION ?? "eu-central-1";
+        const { SecretsManagerClient, GetSecretValueCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-secrets-manager")));
+        const client = new SecretsManagerClient({ region });
+        const response = await client.send(new GetSecretValueCommand({ SecretId: secretArn }));
+        if (!response.SecretString) {
+            throw new Error(`Secret ${secretArn} has no SecretString value`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(response.SecretString);
+        }
+        catch {
+            throw new Error(`Secret ${secretArn} is not valid JSON`);
+        }
+        const user = parsed.username;
+        const pass = parsed.password;
+        const host = parsed.host;
+        const port = String(parsed.port ?? 5432);
+        const dbname = parsed.dbname ?? process.env.DB_NAME ?? "trellis";
+        if (typeof user !== "string" || typeof pass !== "string" || typeof host !== "string") {
+            throw new Error(`Secret ${secretArn} missing required fields username/password/host`);
+        }
+        if (!/^[\w.-]+$/.test(host)) {
+            throw new Error(`Invalid secret host: must match /^[\\w.-]+$/, got "${host}"`);
+        }
+        if (!/^\d+$/.test(port)) {
+            throw new Error(`Invalid secret port: must be numeric, got "${port}"`);
+        }
+        if (!/^[\w-]+$/.test(dbname)) {
+            throw new Error(`Invalid DB_NAME: must match /^[\\w-]+$/, got "${dbname}"`);
+        }
+        cachedDatabaseUrl = `postgresql://${user}:${encodeURIComponent(pass)}@${host}:${port}/${dbname}`;
+        return cachedDatabaseUrl;
+    }
+    // Legacy env-var path (pre-runtime-fetch). Kept for tests and any caller that
+    // still injects these directly. Prefer DATABASE_URL or DB_SECRET_ARN.
+    const user = process.env.DB_SECRET_USERNAME;
+    const pass = process.env.DB_SECRET_PASSWORD;
+    const host = process.env.DB_SECRET_HOST;
+    const port = process.env.DB_SECRET_PORT || "5432";
+    const dbname = process.env.DB_NAME || "trellis";
+    if (!user || !pass || !host) {
+        throw new Error("Database config missing: set DATABASE_URL (local), DB_SECRET_ARN (AWS), or DB_SECRET_USERNAME/PASSWORD/HOST");
+    }
+    if (!/^[\w.-]+$/.test(host)) {
+        throw new Error(`Invalid DB_SECRET_HOST: must match /^[\\w.-]+$/, got "${host}"`);
+    }
+    if (!/^\d+$/.test(port)) {
+        throw new Error(`Invalid DB_SECRET_PORT: must be numeric, got "${port}"`);
+    }
+    if (!/^[\w-]+$/.test(dbname)) {
+        throw new Error(`Invalid DB_NAME: must match /^[\\w-]+$/, got "${dbname}"`);
+    }
+    cachedDatabaseUrl = `postgresql://${user}:${encodeURIComponent(pass)}@${host}:${port}/${dbname}`;
+    return cachedDatabaseUrl;
+}
+/** S1.4 — Validate critical environment variables at startup */
+function validateEnv(env) {
+    const errors = [];
+    if (!env.SESSION_SECRET) {
+        errors.push("SESSION_SECRET is required");
+    }
+    else if (env.SESSION_SECRET.length < 32) {
+        errors.push("SESSION_SECRET must be at least 32 characters");
+    }
+    if (!env.COGNITO_USER_POOL_ID) {
+        errors.push("COGNITO_USER_POOL_ID is required");
+    }
+    if (!env.COGNITO_APP_CLIENT_ID) {
+        errors.push("COGNITO_APP_CLIENT_ID is required");
+    }
+    return errors;
+}
+/** Build the application environment — fetches secrets from AWS if needed */
+async function buildEnv() {
+    const appName = process.env.APP_NAME || "trellis";
+    const mediaBucket = process.env.MEDIA_BUCKET_NAME || `${stage}-${appName}-media`;
+    const exportsBucket = process.env.EXPORTS_BUCKET_NAME || `${stage}-${appName}-exports`;
+    // Resolve DB URL: local DATABASE_URL wins; else fetch from Secrets Manager at
+    // runtime. The resulting string stays on the returned Env object only — we do
+    // NOT write it to process.env so it can't leak through env-var exposure.
+    const databaseUrl = await resolveDatabaseUrl();
+    return {
+        DATABASE_URL: databaseUrl,
+        DATABASE_URL_CN: process.env.DATABASE_URL_CN,
+        DIRECT_URL: process.env.DIRECT_URL,
+        DATABASE_POOL_MAX: process.env.DATABASE_POOL_MAX,
+        DATABASE_CONNECTION_TIMEOUT_MS: process.env.DATABASE_CONNECTION_TIMEOUT_MS,
+        DATABASE_STATEMENT_TIMEOUT_MS: process.env.DATABASE_STATEMENT_TIMEOUT_MS,
+        // Auth
+        SESSION_SECRET: process.env.SESSION_SECRET,
+        SESSION_SECRET_FALLBACK: process.env.SESSION_SECRET_FALLBACK,
+        SESSION_SALT: process.env.SESSION_SALT,
+        COGNITO_USER_POOL_ID: process.env.COGNITO_USER_POOL_ID,
+        COGNITO_APP_CLIENT_ID: process.env.COGNITO_APP_CLIENT_ID,
+        COGNITO_REGION: process.env.COGNITO_REGION || process.env.AWS_REGION || "us-east-1",
+        // Supabase
+        SUPABASE_URL: process.env.SUPABASE_URL,
+        SUPABASE_PUBLISHABLE_KEY: process.env.SUPABASE_PUBLISHABLE_KEY,
+        SUPABASE_URL_CN: process.env.SUPABASE_URL_CN,
+        SUPABASE_PUBLISHABLE_KEY_CN: process.env.SUPABASE_PUBLISHABLE_KEY_CN,
+        SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY,
+        // Microsoft Entra
+        ENTRA_TENANT_ID: process.env.ENTRA_TENANT_ID,
+        ENTRA_CHINA_TENANT_ID: process.env.ENTRA_CHINA_TENANT_ID,
+        INTERNAL_TENANT_ID: process.env.INTERNAL_TENANT_ID,
+        // App config
+        APP_DOMAIN: process.env.APP_DOMAIN,
+        APP_URL: process.env.APP_URL,
+        ALLOWED_ORIGINS: process.env.ALLOWED_ORIGINS,
+        ACTIVITYPUB_BASE_URL: process.env.ACTIVITYPUB_BASE_URL,
+        // CSP
+        CSP_CONNECT_SRC: process.env.CSP_CONNECT_SRC,
+        CSP_SCRIPT_SRC: process.env.CSP_SCRIPT_SRC,
+        CSP_STYLE_SRC: process.env.CSP_STYLE_SRC,
+        // Region
+        IP_GEOLOCATION_API_KEY: process.env.IP_GEOLOCATION_API_KEY,
+        IP_GEOLOCATION_SERVICE: process.env.IP_GEOLOCATION_SERVICE,
+        DEFAULT_REGION: process.env.DEFAULT_REGION || "EU",
+        ENABLE_IP_GEOLOCATION: process.env.ENABLE_IP_GEOLOCATION,
+        INTERNAL_EMAIL_DOMAINS: process.env.INTERNAL_EMAIL_DOMAINS,
+        // External APIs
+        OPENAI_API_KEY: process.env.OPENAI_API_KEY,
+        GOOGLE_SAFE_BROWSING_API_KEY: process.env.GOOGLE_SAFE_BROWSING_API_KEY,
+        RECAPTCHA_SITE_KEY: process.env.RECAPTCHA_SITE_KEY,
+        RECAPTCHA_SECRET_KEY: process.env.RECAPTCHA_SECRET_KEY,
+        // Email
+        EMAIL_SERVICE: process.env.EMAIL_SERVICE || "aws-ses",
+        EMAIL_SERVICE_REGION: process.env.EMAIL_SERVICE_REGION,
+        FROM_EMAIL: process.env.FROM_EMAIL,
+        AWS_SES_REGION: process.env.AWS_SES_REGION || process.env.AWS_REGION || "us-east-1",
+        RESEND_API_KEY: process.env.RESEND_API_KEY,
+        ALIBABA_ACCESS_KEY_ID: process.env.ALIBABA_ACCESS_KEY_ID,
+        ALIBABA_ACCESS_KEY_SECRET: process.env.ALIBABA_ACCESS_KEY_SECRET,
+        ALIBABA_REGION: process.env.ALIBABA_REGION,
+        ALIBABA_ACCOUNT_NAME: process.env.ALIBABA_ACCOUNT_NAME,
+        TENCENT_SECRET_ID: process.env.TENCENT_SECRET_ID,
+        TENCENT_SECRET_KEY: process.env.TENCENT_SECRET_KEY,
+        TENCENT_REGION: process.env.TENCENT_REGION,
+        TENCENT_FROM_EMAIL: process.env.TENCENT_FROM_EMAIL,
+        // Admin
+        SECURITY_WEBHOOK_URL: process.env.SECURITY_WEBHOOK_URL,
+        // Cost protection
+        OPENAI_BUDGET_ENABLED: process.env.OPENAI_BUDGET_ENABLED || "true",
+        OPENAI_BUDGET_HOURLY_MAX: process.env.OPENAI_BUDGET_HOURLY_MAX || "500",
+        OPENAI_BUDGET_DAILY_MAX: process.env.OPENAI_BUDGET_DAILY_MAX || "5000",
+        COST_LIMIT_DAILY_TOTAL: process.env.COST_LIMIT_DAILY_TOTAL || "10",
+        COST_LIMIT_DAILY_OPENAI: process.env.COST_LIMIT_DAILY_OPENAI || "5",
+        COST_LIMIT_DAILY_SES: process.env.COST_LIMIT_DAILY_SES || "2",
+        // Deployment
+        ENVIRONMENT: process.env.ENVIRONMENT || process.env.NODE_ENV,
+        DEPLOY_ENV: process.env.DEPLOY_ENV,
+        APP_VERSION: process.env.APP_VERSION || "0.1.0",
+        LOG_LEVEL: process.env.LOG_LEVEL,
+        NODE_ENV: process.env.NODE_ENV,
+        CI: process.env.CI,
+        GITHUB_ACTIONS: process.env.GITHUB_ACTIONS,
+        STAGE: stage,
+        // AWS
+        AWS_REGION: process.env.AWS_REGION,
+        AWS_ACCOUNT_ID: process.env.AWS_ACCOUNT_ID,
+        AWS_ACCESS_KEY_ID: process.env.AWS_ACCESS_KEY_ID,
+        AWS_SECRET_ACCESS_KEY: process.env.AWS_SECRET_ACCESS_KEY,
+        // Cloudflare Images shim (no-op in AWS)
+        IMAGES: undefined,
+        // DynamoDB-backed KV namespaces
+        RATE_LIMIT_KV: new dynamodb_kv_1.DynamoDbKvNamespace("ratelimit"),
+        PRIVACY_PREFERENCES_KV: new dynamodb_kv_1.DynamoDbKvNamespace("privacy"),
+        FRIENDS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("friends"),
+        CONNECTION_CODES_KV: new dynamodb_kv_1.DynamoDbKvNamespace("connections"),
+        FEED_CACHE_KV: new dynamodb_kv_1.DynamoDbKvNamespace("feed"),
+        MODERATION_CACHE_KV: new dynamodb_kv_1.DynamoDbKvNamespace("moderation"),
+        COMMENTS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("comments"),
+        THREAT_INTEL_CACHE_KV: new dynamodb_kv_1.DynamoDbKvNamespace("threatintel"),
+        TAXONOMY_CACHE_KV: new dynamodb_kv_1.DynamoDbKvNamespace("taxonomy"),
+        FOLLOWERS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("followers"),
+        EXPORT_JOBS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("export"),
+        DELETE_JOBS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("delete"),
+        CSRF_TOKENS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("csrf"),
+        SESSION_BLOCKLIST_KV: new dynamodb_kv_1.DynamoDbKvNamespace("session"),
+        INVITATIONS_KV: new dynamodb_kv_1.DynamoDbKvNamespace("invitations"),
+        // SQS queues
+        EXPORT_QUEUE: new sqs_queue_1.SqsQueue(sqsUrl("user-export")),
+        DELETE_ACCOUNT_QUEUE: new sqs_queue_1.SqsQueue(sqsUrl("delete-account")),
+        FOLLOWERS_EVENTS_QUEUE: new sqs_queue_1.SqsQueue(sqsUrl("followers-events")),
+        LINK_CHECK_QUEUE: new sqs_queue_1.SqsQueue(sqsUrl("link-check")),
+        MEDIA_PROCESSING_QUEUE: new sqs_queue_1.SqsQueue(sqsUrl("media-processing")),
+        // S3 buckets (R2 interface)
+        MEDIA_BUCKET_R2: new s3_storage_1.S3Storage(mediaBucket),
+        EXPORT_FILES_R2: new s3_storage_1.S3Storage(exportsBucket),
+    };
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqPH,kCAkBC;AAGD,4BAuIC;AA/YD,sDAA2D;AAC3D,qDAAiD;AACjD,yDAAqD;AASrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;AAEzC,SAAS,MAAM,CAAC,SAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,eAAe,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,gBAAgB,CAAC;IAC9G,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC;IAC/D,OAAO,GAAG,IAAI,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;AACtD,CAAC;AAqID;;;;;;;;GAQG;AACH,IAAI,iBAAqC,CAAC;AAE1C,KAAK,UAAU,kBAAkB;IAC/B,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IAEhD,gFAAgF;IAChF,iFAAiF;IACjF,sDAAsD;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,oEAAoE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAc,CAAC;QACxD,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,GAAG,wDACtD,iCAAiC,GAClC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACnD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,4BAA4B,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,oBAAoB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAI,MAAM,CAAC,MAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QAEzF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,iDAAiD,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,iBAAiB,GAAG,gBAAgB,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACjG,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,iBAAiB,GAAG,gBAAgB,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;IACjG,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,SAAgB,WAAW,CAAC,GAAQ;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;SAAM,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,QAAQ;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,GAAG,KAAK,IAAI,OAAO,QAAQ,CAAC;IACjF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,GAAG,KAAK,IAAI,OAAO,UAAU,CAAC;IAEvF,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE/C,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAChD,8BAA8B,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC1E,6BAA6B,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;QAExE,OAAO;QACP,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAe;QAC3C,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAC5D,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACtC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACxD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;QAEnF,WAAW;QACX,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACtC,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;QAC9D,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,2BAA2B,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACpE,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAEhE,kBAAkB;QAClB,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACxD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAElD,aAAa;QACb,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QAC5B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAEtD,MAAM;QACN,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;QAExC,SAAS;QACT,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAC1D,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAuE;QAC3G,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI;QAClD,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACxD,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB;QAE1D,gBAAgB;QAChB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,4BAA4B,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACtE,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAClD,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAEtD,QAAQ;QACR,aAAa,EAAG,OAAO,CAAC,GAAG,CAAC,aAAqB,IAAI,SAAS;QAC9D,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;QACnF,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACxD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAChE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAChD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAClD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAElD,QAAQ;QACR,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAEtD,kBAAkB;QAClB,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,MAAM;QAClE,wBAAwB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,KAAK;QACvE,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM;QACtE,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI;QAClE,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG;QACnE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG;QAE7D,aAAa;QACb,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC5D,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;QAC/C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC9B,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;QAClB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,KAAK,EAAE,KAAK;QAEZ,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAChD,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAExD,wCAAwC;QACxC,MAAM,EAAE,SAAS;QAEjB,gCAAgC;QAChC,aAAa,EAAE,IAAI,iCAAmB,CAAC,WAAW,CAAC;QACnD,sBAAsB,EAAE,IAAI,iCAAmB,CAAC,SAAS,CAAC;QAC1D,UAAU,EAAE,IAAI,iCAAmB,CAAC,SAAS,CAAC;QAC9C,mBAAmB,EAAE,IAAI,iCAAmB,CAAC,aAAa,CAAC;QAC3D,aAAa,EAAE,IAAI,iCAAmB,CAAC,MAAM,CAAC;QAC9C,mBAAmB,EAAE,IAAI,iCAAmB,CAAC,YAAY,CAAC;QAC1D,WAAW,EAAE,IAAI,iCAAmB,CAAC,UAAU,CAAC;QAChD,qBAAqB,EAAE,IAAI,iCAAmB,CAAC,aAAa,CAAC;QAC7D,iBAAiB,EAAE,IAAI,iCAAmB,CAAC,UAAU,CAAC;QACtD,YAAY,EAAE,IAAI,iCAAmB,CAAC,WAAW,CAAC;QAClD,cAAc,EAAE,IAAI,iCAAmB,CAAC,QAAQ,CAAC;QACjD,cAAc,EAAE,IAAI,iCAAmB,CAAC,QAAQ,CAAC;QACjD,cAAc,EAAE,IAAI,iCAAmB,CAAC,MAAM,CAAC;QAC/C,oBAAoB,EAAE,IAAI,iCAAmB,CAAC,SAAS,CAAC;QACxD,cAAc,EAAE,IAAI,iCAAmB,CAAC,aAAa,CAAC;QAEtD,aAAa;QACb,YAAY,EAAE,IAAI,oBAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,oBAAoB,EAAE,IAAI,oBAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5D,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAChE,gBAAgB,EAAE,IAAI,oBAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAEhE,4BAA4B;QAC5B,eAAe,EAAE,IAAI,sBAAS,CAAC,WAAW,CAAC;QAC3C,eAAe,EAAE,IAAI,sBAAS,CAAC,aAAa,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/extensions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Extension Registry
+ *
+ * Manages registered extensions. Extensions are registered at startup
+ * by the application entry point (server.ts), not statically imported here.
+ * This keeps the core free of extension-specific dependencies.
+ */
+import type { TrellisExtension } from "@de-otio/trellis-extension-api";
+/** Register an extension. Call at startup before the server starts. */
+export declare function registerExtension(ext: TrellisExtension): void;
+/** Look up an extension by entity type */
+export declare function getExtension(entityType: string): TrellisExtension | undefined;
+/** Return all registered extensions */
+export declare function getExtensions(): readonly TrellisExtension[];
+//# sourceMappingURL=extensions.d.ts.map

package/dist/extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../src/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAIvE,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAe7D;AAED,0CAA0C;AAC1C,wBAAgB,YAAY,CAC1B,UAAU,EAAE,MAAM,GACjB,gBAAgB,GAAG,SAAS,CAE9B;AAED,uCAAuC;AACvC,wBAAgB,aAAa,IAAI,SAAS,gBAAgB,EAAE,CAE3D"}

package/dist/extensions.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Extension Registry
+ *
+ * Manages registered extensions. Extensions are registered at startup
+ * by the application entry point (server.ts), not statically imported here.
+ * This keeps the core free of extension-specific dependencies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerExtension = registerExtension;
+exports.getExtension = getExtension;
+exports.getExtensions = getExtensions;
+const extensions = [];
+/** Register an extension. Call at startup before the server starts. */
+function registerExtension(ext) {
+    extensions.push(ext);
+    if (ext.entityRelationshipTypes && ext.entityRelationshipTypes.length > 0) {
+        console.log(`[extensions] "${ext.id}" registered entityRelationshipTypes: ${ext.entityRelationshipTypes.join(", ")}`);
+    }
+    if (ext.discoveryFacets && ext.discoveryFacets.length > 0) {
+        const facetSummary = ext.discoveryFacets
+            .map((f) => `${f.field}(${f.type})`)
+            .join(", ");
+        console.log(`[extensions] "${ext.id}" registered discoveryFacets: ${facetSummary}`);
+    }
+}
+/** Look up an extension by entity type */
+function getExtension(entityType) {
+    return extensions.find((e) => e.id === entityType);
+}
+/** Return all registered extensions */
+function getExtensions() {
+    return extensions;
+}
+//# sourceMappingURL=extensions.js.map

package/dist/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../src/extensions.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAOH,8CAeC;AAGD,oCAIC;AAGD,sCAEC;AA9BD,MAAM,UAAU,GAAuB,EAAE,CAAC;AAE1C,uEAAuE;AACvE,SAAgB,iBAAiB,CAAC,GAAqB;IACrD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,GAAG,CACT,iBAAiB,GAAG,CAAC,EAAE,yCAAyC,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,CACT,iBAAiB,GAAG,CAAC,EAAE,iCAAiC,YAAY,EAAE,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,SAAgB,YAAY,CAC1B,UAAkB;IAElB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,uCAAuC;AACvC,SAAgB,aAAa;IAC3B,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @de-otio/trellis — Public API
+ *
+ * Verticals import from this module to register extensions and start the server.
+ */
+export { startServer } from "./server";
+export { registerExtension, getExtension, getExtensions } from "./extensions";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * @de-otio/trellis — Public API
+ *
+ * Verticals import from this module to register extensions and start the server.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getExtensions = exports.getExtension = exports.registerExtension = exports.startServer = void 0;
+var server_1 = require("./server");
+Object.defineProperty(exports, "startServer", { enumerable: true, get: function () { return server_1.startServer; } });
+var extensions_1 = require("./extensions");
+Object.defineProperty(exports, "registerExtension", { enumerable: true, get: function () { return extensions_1.registerExtension; } });
+Object.defineProperty(exports, "getExtension", { enumerable: true, get: function () { return extensions_1.getExtension; } });
+Object.defineProperty(exports, "getExtensions", { enumerable: true, get: function () { return extensions_1.getExtensions; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AACpB,2CAA8E;AAArE,+GAAA,iBAAiB,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,2GAAA,aAAa,OAAA"}

package/dist/lambda/cleanup-cron.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: () => Promise<void>;
+//# sourceMappingURL=cleanup-cron.d.ts.map

package/dist/lambda/cleanup-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup-cron.d.ts","sourceRoot":"","sources":["../../src/lambda/cleanup-cron.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,OAAO,QAAa,OAAO,CAAC,IAAI,CA8B5C,CAAC"}

package/dist/lambda/cleanup-cron.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+const handler = async () => {
+    const now = Math.floor(Date.now() / 1000);
+    // DynamoDB TTL handles most cleanup automatically.
+    // This cron handles cleanup that TTL alone can't do.
+    // Acquire cron lock (prevent overlapping executions)
+    try {
+        await dynamo.send({
+            ...new (require("@aws-sdk/client-dynamodb").PutItemCommand)({
+                TableName: TABLE,
+                Item: (0, util_dynamodb_1.marshall)({
+                    pk: "cron:cleanup",
+                    sk: "lock",
+                    ttl: now + 300, // 5 min TTL
+                    lockedAt: now,
+                }),
+                ConditionExpression: "attribute_not_exists(pk) OR #ttl < :now",
+                ExpressionAttributeNames: { "#ttl": "ttl" },
+                ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":now": now }),
+            }),
+        });
+    }
+    catch {
+        console.log(JSON.stringify({ level: "info", msg: "Cleanup cron already running, skipping" }));
+        return;
+    }
+    console.log(JSON.stringify({ level: "info", msg: "Cleanup cron started" }));
+    // Additional cleanup logic goes here
+    console.log(JSON.stringify({ level: "info", msg: "Cleanup cron complete" }));
+};
+exports.handler = handler;
+//# sourceMappingURL=cleanup-cron.js.map

package/dist/lambda/cleanup-cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup-cron.js","sourceRoot":"","sources":["../../src/lambda/cleanup-cron.ts"],"names":[],"mappings":";;;AAAA,8DAA2F;AAC3F,0DAAkD;AAElD,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAEnC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,mDAAmD;IACnD,qDAAqD;IAErD,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,cAAc,CAAC,CAAC;gBAC1D,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,IAAA,wBAAQ,EAAC;oBACb,EAAE,EAAE,cAAc;oBAClB,EAAE,EAAE,MAAM;oBACV,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,YAAY;oBAC5B,QAAQ,EAAE,GAAG;iBACd,CAAC;gBACF,mBAAmB,EAAE,yCAAyC;gBAC9D,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;aACrD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,wCAAwC,EAAE,CAAC,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IAC5E,qCAAqC;IACrC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC,CAAC;AA9BW,QAAA,OAAO,WA8BlB"}

package/dist/lambda/create-auth-challenge.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: (event: any) => Promise<any>;
+//# sourceMappingURL=create-auth-challenge.d.ts.map

package/dist/lambda/create-auth-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-auth-challenge.d.ts","sourceRoot":"","sources":["../../src/lambda/create-auth-challenge.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,OAAO,GAAU,OAAO,GAAG,iBAmGvC,CAAC"}