@de-otio/trellis 0.4.0

package/dist/lambda/create-auth-challenge.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const node_crypto_1 = require("node:crypto");
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const client_ses_1 = require("@aws-sdk/client-ses");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const ses = new client_ses_1.SESClient({ region: process.env.SES_REGION || process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+const DOMAIN = process.env.DOMAIN;
+const RATE_LIMIT_MAX = 5;
+const RATE_LIMIT_WINDOW_SECONDS = 900; // 15 minutes
+const handler = async (event) => {
+    const email = event.request.userAttributes?.email;
+    if (!email) {
+        throw new Error("Email attribute is required for magic link authentication");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    // Bot protection is handled by AWS WAF at the infrastructure layer.
+    // Rate limiting below is defence-in-depth at the application level.
+    const ratePk = `magic-rate:${email}`;
+    try {
+        const rateResult = await dynamo.send(new client_dynamodb_1.GetItemCommand({
+            TableName: TABLE,
+            Key: { pk: { S: ratePk }, sk: { S: "v" } },
+        }));
+        if (rateResult.Item) {
+            const count = parseInt(rateResult.Item.count?.N || "0", 10);
+            const ttl = parseInt(rateResult.Item.ttl?.N || "0", 10);
+            if (count >= RATE_LIMIT_MAX && ttl > now) {
+                throw new Error("RATE_LIMIT_EXCEEDED: Too many magic link requests. Please wait before trying again.");
+            }
+        }
+        // Increment or create rate limit counter
+        await dynamo.send(new client_dynamodb_1.UpdateItemCommand({
+            TableName: TABLE,
+            Key: { pk: { S: ratePk }, sk: { S: "v" } },
+            UpdateExpression: "SET #count = if_not_exists(#count, :zero) + :one, #ttl = if_not_exists(#ttl, :ttl)",
+            ExpressionAttributeNames: { "#count": "count", "#ttl": "ttl" },
+            ExpressionAttributeValues: {
+                ":zero": { N: "0" },
+                ":one": { N: "1" },
+                ":ttl": { N: String(now + RATE_LIMIT_WINDOW_SECONDS) },
+            },
+        }));
+    }
+    catch (err) {
+        if (err?.message?.startsWith("RATE_LIMIT_EXCEEDED")) {
+            throw err;
+        }
+        console.error("Rate limit check failed, proceeding with token generation", err);
+    }
+    const token = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+    // S1.1 — Hash the token before storing in DynamoDB
+    const tokenHash = (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+    // Store hashed token in DynamoDB with 5-minute TTL
+    try {
+        await dynamo.send(new client_dynamodb_1.PutItemCommand({
+            TableName: TABLE,
+            Item: {
+                pk: { S: `magic-link:${tokenHash}` },
+                sk: { S: "v" },
+                email: { S: email },
+                createdAt: { N: String(now) },
+                ttl: { N: String(now + 300) },
+            },
+        }));
+    }
+    catch (err) {
+        console.error("Failed to store magic link token", err);
+        throw err;
+    }
+    // Send magic link email via SES
+    const magicLink = `https://${DOMAIN}/auth/verify?token=${token}&email=${encodeURIComponent(email)}`;
+    try {
+        await ses.send(new client_ses_1.SendEmailCommand({
+            Source: `Trellis <noreply@${DOMAIN}>`,
+            Destination: { ToAddresses: [email] },
+            Message: {
+                Subject: { Data: "Sign in to Trellis" },
+                Body: {
+                    Html: {
+                        Data: `
+              <div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 480px; margin: 0 auto; padding: 32px;">
+                <h2 style="color: #1a1a1a; margin-bottom: 24px;">Sign in to Trellis</h2>
+                <p style="color: #4a4a4a; font-size: 16px; line-height: 1.5;">Click the button below to sign in. This link expires in 5 minutes.</p>
+                <a href="${magicLink}" style="display: inline-block; background: #2563eb; color: #fff; padding: 14px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; font-size: 16px; margin: 24px 0;">Sign in to Trellis</a>
+                <p style="color: #9a9a9a; font-size: 13px; margin-top: 32px;">If you didn't request this, you can safely ignore this email.</p>
+              </div>`,
+                    },
+                    Text: {
+                        Data: `Sign in to Trellis\n\nClick this link to sign in (expires in 5 minutes):\n${magicLink}\n\nIf you didn't request this, ignore this email.`,
+                    },
+                },
+            },
+        }));
+    }
+    catch (err) {
+        console.error("Failed to send magic link email", err);
+        throw err;
+    }
+    event.response.privateChallengeParameters = { token };
+    event.response.publicChallengeParameters = { email };
+    event.response.challengeMetadata = "MAGIC_LINK";
+    return event;
+};
+exports.handler = handler;
+//# sourceMappingURL=create-auth-challenge.js.map

package/dist/lambda/create-auth-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-auth-challenge.js","sourceRoot":"","sources":["../../src/lambda/create-auth-challenge.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AACtD,8DAA6G;AAC7G,oDAAkE;AAElE,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACxF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC;AAEnC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,yBAAyB,GAAG,GAAG,CAAC,CAAC,aAAa;AAE7C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,MAAM,GAAG,cAAc,KAAK,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAc,CAAC;YACtD,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;SAC3C,CAAC,CAAC,CAAC;QAEJ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,cAAc,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mCAAiB,CAAC;YACtC,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;YAC1C,gBAAgB,EAAE,oFAAoF;YACtG,wBAAwB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YAC9D,yBAAyB,EAAE;gBACzB,OAAO,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;gBACnB,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,yBAAyB,CAAC,EAAE;aACvD;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACpD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2DAA2D,EAAE,GAAG,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpD,mDAAmD;IACnD,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnE,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAc,CAAC;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE;gBACJ,EAAE,EAAE,EAAE,CAAC,EAAE,cAAc,SAAS,EAAE,EAAE;gBACpC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;gBACd,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE;gBACnB,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC7B,GAAG,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE;aAC9B;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,gCAAgC;IAChC,MAAM,SAAS,GAAG,WAAW,MAAM,sBAAsB,KAAK,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,6BAAgB,CAAC;YAClC,MAAM,EAAE,oBAAoB,MAAM,GAAG;YACrC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE;YACrC,OAAO,EAAE;gBACP,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE;gBACvC,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,IAAI,EAAE;;;;2BAIS,SAAS;;qBAEf;qBACV;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,6EAA6E,SAAS,oDAAoD;qBACjJ;iBACF;aACF;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,0BAA0B,GAAG,EAAE,KAAK,EAAE,CAAC;IACtD,KAAK,CAAC,QAAQ,CAAC,yBAAyB,GAAG,EAAE,KAAK,EAAE,CAAC;IACrD,KAAK,CAAC,QAAQ,CAAC,iBAAiB,GAAG,YAAY,CAAC;IAEhD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAnGW,QAAA,OAAO,WAmGlB"}

package/dist/lambda/custom-message.d.ts

@@ -0,0 +1,3 @@
+import type { CustomMessageTriggerHandler } from "aws-lambda";
+export declare const handler: CustomMessageTriggerHandler;
+//# sourceMappingURL=custom-message.d.ts.map

package/dist/lambda/custom-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-message.d.ts","sourceRoot":"","sources":["../../src/lambda/custom-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA6B,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAIzF,eAAO,MAAM,OAAO,EAAE,2BAyBrB,CAAC"}

package/dist/lambda/custom-message.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const APP_DOMAIN = process.env.APP_DOMAIN || "example.com";
+const handler = async (event) => {
+    const { codeParameter, usernameParameter } = event.request;
+    switch (event.triggerSource) {
+        case "CustomMessage_SignUp":
+        case "CustomMessage_ResendCode":
+            event.response.emailSubject = "Verify your Trellis account";
+            event.response.emailMessage = `
+        <p>Welcome to Trellis!</p>
+        <p>Your verification code is: <strong>${codeParameter}</strong></p>
+        <p>This code expires in 24 hours.</p>
+      `;
+            break;
+        case "CustomMessage_ForgotPassword":
+            event.response.emailSubject = "Reset your Trellis password";
+            event.response.emailMessage = `
+        <p>You requested a password reset.</p>
+        <p>Your reset code is: <strong>${codeParameter}</strong></p>
+        <p>If you didn't request this, you can safely ignore this email.</p>
+      `;
+            break;
+    }
+    return event;
+};
+exports.handler = handler;
+//# sourceMappingURL=custom-message.js.map

package/dist/lambda/custom-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-message.js","sourceRoot":"","sources":["../../src/lambda/custom-message.ts"],"names":[],"mappings":";;;AAEA,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC;AAEpD,MAAM,OAAO,GAAgC,KAAK,EAAE,KAAK,EAAE,EAAE;IAClE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAE3D,QAAQ,KAAK,CAAC,aAAa,EAAE,CAAC;QAC5B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,0BAA0B;YAC7B,KAAK,CAAC,QAAQ,CAAC,YAAY,GAAG,6BAA6B,CAAC;YAC5D,KAAK,CAAC,QAAQ,CAAC,YAAY,GAAG;;gDAEY,aAAa;;OAEtD,CAAC;YACF,MAAM;QAER,KAAK,8BAA8B;YACjC,KAAK,CAAC,QAAQ,CAAC,YAAY,GAAG,6BAA6B,CAAC;YAC5D,KAAK,CAAC,QAAQ,CAAC,YAAY,GAAG;;yCAEK,aAAa;;OAE/C,CAAC;YACF,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAzBW,QAAA,OAAO,WAyBlB"}

package/dist/lambda/define-auth-challenge.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: (event: any) => Promise<any>;
+//# sourceMappingURL=define-auth-challenge.d.ts.map

package/dist/lambda/define-auth-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-auth-challenge.d.ts","sourceRoot":"","sources":["../../src/lambda/define-auth-challenge.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,GAAU,OAAO,GAAG,iBAuBvC,CAAC"}

package/dist/lambda/define-auth-challenge.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const handler = async (event) => {
+    const session = event.request.session;
+    if (session.length === 0) {
+        // No attempts yet — issue a custom challenge
+        event.response.issueTokens = false;
+        event.response.failAuthentication = false;
+        event.response.challengeName = "CUSTOM_CHALLENGE";
+    }
+    else if (session.length === 1 &&
+        session[0].challengeName === "CUSTOM_CHALLENGE" &&
+        session[0].challengeResult === true) {
+        // Challenge answered correctly — issue tokens
+        event.response.issueTokens = true;
+        event.response.failAuthentication = false;
+    }
+    else {
+        // Unexpected state — fail
+        event.response.issueTokens = false;
+        event.response.failAuthentication = true;
+    }
+    return event;
+};
+exports.handler = handler;
+//# sourceMappingURL=define-auth-challenge.js.map

package/dist/lambda/define-auth-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-auth-challenge.js","sourceRoot":"","sources":["../../src/lambda/define-auth-challenge.ts"],"names":[],"mappings":";;;AAAO,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IAEtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,6CAA6C;QAC7C,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAC1C,KAAK,CAAC,QAAQ,CAAC,aAAa,GAAG,kBAAkB,CAAC;IACpD,CAAC;SAAM,IACL,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,kBAAkB;QAC/C,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,EACnC,CAAC;QACD,8CAA8C;QAC9C,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC;QAClC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,KAAK,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAvBW,QAAA,OAAO,WAuBlB"}

package/dist/lambda/delete-account-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=delete-account-worker.d.ts.map

package/dist/lambda/delete-account-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-account-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/delete-account-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA8C7C,eAAO,MAAM,OAAO,EAAE,UAiDrB,CAAC"}

package/dist/lambda/delete-account-worker.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_1 = require("@prisma/client");
+const client_s3_1 = require("@aws-sdk/client-s3");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const s3 = new client_s3_1.S3Client({ region: process.env.AWS_REGION });
+const secretsClient = new client_secrets_manager_1.SecretsManagerClient({ region: process.env.AWS_REGION });
+const MAX_PAGES = 100;
+let prisma = null;
+async function getPrisma() {
+    if (prisma)
+        return prisma;
+    const secret = await secretsClient.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN }));
+    const { username, password, host, port, dbname } = JSON.parse(secret.SecretString);
+    prisma = new client_1.PrismaClient({
+        datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+    });
+    return prisma;
+}
+async function deleteUserMedia(userId, mediaBucket) {
+    const prefix = `originals/user-${userId}/`;
+    let continuationToken;
+    let pages = 0;
+    do {
+        if (pages >= MAX_PAGES) {
+            console.log(JSON.stringify({ level: "warn", msg: "S3 pagination circuit breaker hit", userId, pages: MAX_PAGES }));
+            break;
+        }
+        const list = await s3.send(new client_s3_1.ListObjectsV2Command({
+            Bucket: mediaBucket, Prefix: prefix, ContinuationToken: continuationToken,
+        }));
+        if (list.Contents?.length) {
+            await s3.send(new client_s3_1.DeleteObjectsCommand({
+                Bucket: mediaBucket,
+                Delete: { Objects: list.Contents.map((o) => ({ Key: o.Key })) },
+            }));
+        }
+        continuationToken = list.NextContinuationToken;
+        pages++;
+    } while (continuationToken);
+}
+const handler = async (event) => {
+    const failedIds = [];
+    const db = await getPrisma();
+    for (const record of event.Records) {
+        try {
+            const { userId } = JSON.parse(record.body);
+            // 1. Look up user email before deleting DB records (needed for Cognito)
+            const user = await db.user.findUnique({
+                where: { id: userId },
+                select: { email: true },
+            });
+            if (!user) {
+                console.log(JSON.stringify({ level: "warn", msg: "User not found, may already be deleted", userId }));
+                continue;
+            }
+            // 2. Delete all database records
+            const { deleteUserData } = await Promise.resolve().then(() => __importStar(require("../lib/services/user-data-deletion")));
+            const result = await deleteUserData(db, userId);
+            // 3. Delete S3 media files
+            await deleteUserMedia(userId, process.env.MEDIA_BUCKET_NAME);
+            // 4. Delete Cognito identity
+            if (process.env.COGNITO_USER_POOL_ID) {
+                try {
+                    const cognito = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({ region: process.env.AWS_REGION });
+                    await cognito.send(new client_cognito_identity_provider_1.AdminDeleteUserCommand({
+                        UserPoolId: process.env.COGNITO_USER_POOL_ID,
+                        Username: user.email,
+                    }));
+                }
+                catch (cognitoErr) {
+                    console.warn(JSON.stringify({ level: "warn", msg: "Cognito deletion failed", userId, error: String(cognitoErr) }));
+                }
+            }
+            console.log(JSON.stringify({ level: "info", msg: "Account deleted", userId, itemsDeleted: result }));
+        }
+        catch (err) {
+            console.error(JSON.stringify({ level: "error", msg: "Failed to delete account", err, messageId: record.messageId }));
+            failedIds.push(record.messageId);
+        }
+    }
+    if (failedIds.length > 0) {
+        return { batchItemFailures: failedIds.map((id) => ({ itemIdentifier: id })) };
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=delete-account-worker.js.map

package/dist/lambda/delete-account-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-account-worker.js","sourceRoot":"","sources":["../../src/lambda/delete-account-worker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,2CAA8C;AAC9C,kDAA0F;AAC1F,4EAA8F;AAC9F,gGAAkH;AAElH,MAAM,EAAE,GAAG,IAAI,oBAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC5D,MAAM,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAEnF,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAc,EAAE,CAAC,CAAC,CAAC;IAC7G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;IACpF,MAAM,GAAG,IAAI,qBAAY,CAAC;QACxB,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,qBAAqB,EAAE,EAAE;KACtI,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB;IAChE,MAAM,MAAM,GAAG,kBAAkB,MAAM,GAAG,CAAC;IAC3C,IAAI,iBAAqC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,GAAG,CAAC;QACF,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACnH,MAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,gCAAoB,CAAC;YAClD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB;SAC1E,CAAC,CAAC,CAAC;QACJ,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,gCAAoB,CAAC;gBACrC,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAI,EAAE,CAAC,CAAC,EAAE;aACjE,CAAC,CAAC,CAAC;QACN,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC/C,KAAK,EAAE,CAAC;IACV,CAAC,QAAQ,iBAAiB,EAAE;AAC9B,CAAC;AAEM,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;IAE7B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAuB,CAAC;YAEjE,wEAAwE;YACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;gBACrB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,wCAAwC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtG,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,oCAAoC,GAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEhD,2BAA2B;YAC3B,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAkB,CAAC,CAAC;YAE9D,6BAA6B;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,gEAA6B,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;oBACtF,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC;wBAC5C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;wBAC5C,QAAQ,EAAE,IAAI,CAAC,KAAK;qBACrB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrH,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACrH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC,CAAC;AAjDW,QAAA,OAAO,WAiDlB"}

package/dist/lambda/diagnostics-proxy.d.ts

@@ -0,0 +1,6 @@
+export declare const handler: (event: {
+    Records: any[];
+}) => Promise<{
+    processed: number;
+}>;
+//# sourceMappingURL=diagnostics-proxy.d.ts.map

package/dist/lambda/diagnostics-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics-proxy.d.ts","sourceRoot":"","sources":["../../src/lambda/diagnostics-proxy.ts"],"names":[],"mappings":"AAwEA,eAAO,MAAM,OAAO,GAAU,OAAO;IAAE,OAAO,EAAE,GAAG,EAAE,CAAA;CAAE;;EAkEtD,CAAC"}

package/dist/lambda/diagnostics-proxy.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const RUNTIME_ID = process.env.RUNTIME_ID;
+const TABLE = process.env.DYNAMODB_TABLE;
+const MAX_DAILY = parseInt(process.env.MAX_DAILY_INVOCATIONS ?? "50", 10);
+const COOLDOWN_SECONDS = parseInt(process.env.COOLDOWN_SECONDS ?? "300", 10);
+function sanitizeAlarmName(raw) {
+    // Truncate to 256 chars and strip non-printable characters
+    return raw.slice(0, 256).replace(/[^\x20-\x7E]/g, "");
+}
+function getDateKey() {
+    return new Date().toISOString().slice(0, 10);
+}
+async function checkCooldown(alarmName) {
+    const now = Math.floor(Date.now() / 1000);
+    try {
+        await dynamo.send(new client_dynamodb_1.PutItemCommand({
+            TableName: TABLE,
+            Item: {
+                pk: { S: `diag-cooldown:${alarmName}` },
+                sk: { S: "v" },
+                ttl: { N: String(now + COOLDOWN_SECONDS) },
+                createdAt: { N: String(now) },
+            },
+            ConditionExpression: "attribute_not_exists(pk) OR #t < :now",
+            ExpressionAttributeNames: { "#t": "ttl" },
+            ExpressionAttributeValues: { ":now": { N: String(now) } },
+        }));
+        return true; // cooldown acquired, OK to proceed
+    }
+    catch (err) {
+        if (err.name === "ConditionalCheckFailedException") {
+            return false; // still in cooldown
+        }
+        throw err;
+    }
+}
+async function incrementDailyCounter() {
+    const dateKey = getDateKey();
+    const ttl = Math.floor(Date.now() / 1000) + 86400 * 2; // 2-day TTL for cleanup
+    const result = await dynamo.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: TABLE,
+        Key: {
+            pk: { S: `diag-daily:${dateKey}` },
+            sk: { S: "v" },
+        },
+        UpdateExpression: "SET #c = if_not_exists(#c, :zero) + :one, #t = :ttl",
+        ExpressionAttributeNames: { "#c": "count", "#t": "ttl" },
+        ExpressionAttributeValues: {
+            ":zero": { N: "0" },
+            ":one": { N: "1" },
+            ":ttl": { N: String(ttl) },
+        },
+        ReturnValues: "ALL_NEW",
+    }));
+    return parseInt(result.Attributes?.count?.N ?? "1", 10);
+}
+const handler = async (event) => {
+    for (const record of event.Records) {
+        const snsMessage = record.Sns?.Message;
+        if (!snsMessage)
+            continue;
+        let alarm;
+        try {
+            alarm = JSON.parse(snsMessage);
+        }
+        catch {
+            console.warn("Failed to parse SNS message as JSON, skipping");
+            continue;
+        }
+        // Only act on ALARM state transitions
+        if (alarm.NewStateValue !== "ALARM") {
+            console.log(`Skipping non-ALARM state: ${alarm.NewStateValue}`);
+            continue;
+        }
+        const rawAlarmName = alarm.AlarmName ?? "unknown";
+        const alarmName = sanitizeAlarmName(rawAlarmName);
+        // Per-alarm cooldown
+        const cooldownOk = await checkCooldown(alarmName);
+        if (!cooldownOk) {
+            console.log(`Alarm "${alarmName}" is in cooldown, skipping`);
+            continue;
+        }
+        // Daily invocation cap
+        const dailyCount = await incrementDailyCounter();
+        if (dailyCount > MAX_DAILY) {
+            console.warn(`Daily cap reached (${dailyCount}/${MAX_DAILY}), skipping`);
+            continue;
+        }
+        // Invoke the Bedrock AgentCore runtime
+        // TODO: Replace with exact SDK call once @aws-sdk/client-bedrock-agentcore is available.
+        // The InvokeAgentRuntime API shape may differ from the placeholder below.
+        try {
+            const { BedrockAgentRuntimeClient, InvokeAgentCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-bedrock-agent-runtime")));
+            const agentClient = new BedrockAgentRuntimeClient({ region: process.env.AWS_REGION });
+            await agentClient.send(new InvokeAgentCommand({
+                agentId: RUNTIME_ID,
+                agentAliasId: "TSTALIASID",
+                sessionId: `diag-${alarmName}-${Date.now()}`,
+                inputText: JSON.stringify({
+                    alarmName,
+                    alarmDescription: alarm.AlarmDescription ?? "",
+                    newStateReason: alarm.NewStateReason ?? "",
+                    stateChangeTime: alarm.StateChangeTime ?? "",
+                    trigger: alarm.Trigger ?? {},
+                }),
+            }));
+            console.log(`Invoked agent for alarm "${alarmName}"`);
+        }
+        catch (err) {
+            console.error(`Failed to invoke agent for alarm "${alarmName}"`, err);
+            throw err;
+        }
+    }
+    return { processed: event.Records.length };
+};
+exports.handler = handler;
+//# sourceMappingURL=diagnostics-proxy.js.map

package/dist/lambda/diagnostics-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics-proxy.js","sourceRoot":"","sources":["../../src/lambda/diagnostics-proxy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAIkC;AAElC,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC;AAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;AAE7E,SAAS,iBAAiB,CAAC,GAAW;IACpC,2DAA2D;IAC3D,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE;gBACJ,EAAE,EAAE,EAAE,CAAC,EAAE,iBAAiB,SAAS,EAAE,EAAE;gBACvC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;gBACd,GAAG,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,gBAAgB,CAAC,EAAE;gBAC1C,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9B;YACD,mBAAmB,EAAE,uCAAuC;YAC5D,wBAAwB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YACzC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;SAC1D,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,mCAAmC;IAClD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC,CAAC,oBAAoB;QACpC,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,wBAAwB;IAE/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,KAAK;QAChB,GAAG,EAAE;YACH,EAAE,EAAE,EAAE,CAAC,EAAE,cAAc,OAAO,EAAE,EAAE;YAClC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;SACf;QACD,gBAAgB,EAAE,qDAAqD;QACvE,wBAAwB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;QACxD,yBAAyB,EAAE;YACzB,OAAO,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;YACnB,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;YAClB,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3B;QACD,YAAY,EAAE,SAAS;KACxB,CAAC,CACH,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,EAAE,KAAyB,EAAE,EAAE;IACzD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;QAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAElD,qBAAqB;QACrB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,UAAU,SAAS,4BAA4B,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACjD,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,sBAAsB,UAAU,IAAI,SAAS,aAAa,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,yFAAyF;QACzF,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,GAAG,wDACxD,uCAAuC,GACxC,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,yBAAyB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YACtF,MAAM,WAAW,CAAC,IAAI,CACpB,IAAI,kBAAkB,CAAC;gBACrB,OAAO,EAAE,UAAU;gBACnB,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,QAAQ,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC5C,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;oBACxB,SAAS;oBACT,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;oBAC9C,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;oBAC1C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE;oBAC5C,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;iBAC7B,CAAC;aACH,CAAC,CACH,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC7C,CAAC,CAAC;AAlEW,QAAA,OAAO,WAkElB"}

package/dist/lambda/e2e-sweeper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * E2E Test Data Sweeper (User-Scoped)
+ *
+ * Safety net for leaked test data. Runs hourly.
+ *
+ * Instead of querying the database directly, this sweeper:
+ * 1. Lists Cognito users with __e2e_ email prefix older than 2 hours
+ * 2. Queues their deletion via the delete-account SQS queue
+ *    (same pipeline used by GDPR account deletions)
+ * 3. Deletes the Cognito user
+ *
+ * The delete-account-worker handles the actual cleanup:
+ * DB cascade (deleteUserData) → S3 media → Cognito identity
+ *
+ * This approach eliminates the risk of a WHERE clause bug deleting real user data.
+ */
+export declare const handler: () => Promise<void>;
+//# sourceMappingURL=e2e-sweeper.d.ts.map

package/dist/lambda/e2e-sweeper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-sweeper.d.ts","sourceRoot":"","sources":["../../src/lambda/e2e-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8BH,eAAO,MAAM,OAAO,QAAa,OAAO,CAAC,IAAI,CA8F5C,CAAC"}