@de-otio/trellis 0.4.0

package/dist/lambda/e2e-sweeper.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * E2E Test Data Sweeper (User-Scoped)
+ *
+ * Safety net for leaked test data. Runs hourly.
+ *
+ * Instead of querying the database directly, this sweeper:
+ * 1. Lists Cognito users with __e2e_ email prefix older than 2 hours
+ * 2. Queues their deletion via the delete-account SQS queue
+ *    (same pipeline used by GDPR account deletions)
+ * 3. Deletes the Cognito user
+ *
+ * The delete-account-worker handles the actual cleanup:
+ * DB cascade (deleteUserData) → S3 media → Cognito identity
+ *
+ * This approach eliminates the risk of a WHERE clause bug deleting real user data.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const client_sqs_1 = require("@aws-sdk/client-sqs");
+const client_cloudwatch_1 = require("@aws-sdk/client-cloudwatch");
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const region = process.env.AWS_REGION || "eu-central-1";
+const stage = process.env.STAGE || "dev";
+const userPoolId = process.env.COGNITO_USER_POOL_ID;
+const deleteQueueUrl = process.env.DELETE_ACCOUNT_QUEUE_URL;
+const dynamoTable = process.env.DYNAMODB_TABLE;
+const cognito = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({ region });
+const sqs = new client_sqs_1.SQSClient({ region });
+const cloudwatch = new client_cloudwatch_1.CloudWatchClient({ region });
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region });
+const STALE_THRESHOLD_HOURS = 2;
+const E2E_PREFIX = "__e2e_";
+const MAX_PAGES = 20;
+const handler = async () => {
+    const cutoff = new Date(Date.now() - STALE_THRESHOLD_HOURS * 60 * 60 * 1000);
+    const now = Math.floor(Date.now() / 1000);
+    // Acquire distributed lock
+    try {
+        await dynamo.send(new client_dynamodb_1.PutItemCommand({
+            TableName: dynamoTable,
+            Item: (0, util_dynamodb_1.marshall)({ pk: "cron:e2e-sweeper", sk: "lock", ttl: now + 300, lockedAt: now }),
+            ConditionExpression: "attribute_not_exists(pk) OR #ttl < :now",
+            ExpressionAttributeNames: { "#ttl": "ttl" },
+            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":now": now }),
+        }));
+    }
+    catch {
+        console.log(JSON.stringify({ level: "info", msg: "E2E sweeper already running, skipping" }));
+        return;
+    }
+    console.log(JSON.stringify({ level: "info", msg: "E2E sweeper started", cutoff: cutoff.toISOString() }));
+    let totalQueued = 0;
+    // Step 1: List stale __e2e_ Cognito users
+    try {
+        let paginationToken;
+        let pages = 0;
+        do {
+            const res = await cognito.send(new client_cognito_identity_provider_1.ListUsersCommand({
+                UserPoolId: userPoolId,
+                Filter: `email ^= "${E2E_PREFIX}"`,
+                Limit: 60,
+                PaginationToken: paginationToken,
+            }));
+            for (const user of res.Users || []) {
+                if (!user.UserCreateDate || user.UserCreateDate >= cutoff)
+                    continue;
+                if (!user.Username)
+                    continue;
+                const email = user.Attributes?.find(a => a.Name === "email")?.Value || user.Username;
+                const sub = user.Attributes?.find(a => a.Name === "sub")?.Value;
+                // Step 2: Queue database + S3 deletion via delete-account worker
+                if (sub) {
+                    try {
+                        await sqs.send(new client_sqs_1.SendMessageCommand({
+                            QueueUrl: deleteQueueUrl,
+                            MessageBody: JSON.stringify({ userId: sub }),
+                        }));
+                        totalQueued++;
+                        console.log(JSON.stringify({ level: "info", msg: `Queued deletion for ${email}`, userId: sub }));
+                    }
+                    catch (err) {
+                        console.warn(JSON.stringify({ level: "warn", msg: `Failed to queue deletion for ${email}`, error: String(err) }));
+                    }
+                }
+                // Step 3: Delete Cognito user immediately
+                // (worker also tries Cognito deletion, but we do it here too
+                //  since the worker may process the message after a delay)
+                try {
+                    await cognito.send(new client_cognito_identity_provider_1.AdminDeleteUserCommand({
+                        UserPoolId: userPoolId,
+                        Username: user.Username,
+                    }));
+                    console.log(JSON.stringify({ level: "info", msg: `Deleted Cognito user ${email}` }));
+                }
+                catch (err) {
+                    console.warn(JSON.stringify({ level: "warn", msg: `Cognito delete failed for ${email}`, error: String(err) }));
+                }
+            }
+            paginationToken = res.PaginationToken;
+            pages++;
+        } while (paginationToken && pages < MAX_PAGES);
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Failed to list Cognito users", error: String(err) }));
+    }
+    // Step 4: Emit metric
+    try {
+        await cloudwatch.send(new client_cloudwatch_1.PutMetricDataCommand({
+            Namespace: "Trellis/E2E",
+            MetricData: [{
+                    MetricName: "E2eLeakedRecords",
+                    Value: totalQueued,
+                    Unit: "Count",
+                    Dimensions: [{ Name: "Stage", Value: stage }],
+                }],
+        }));
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Failed to emit metric", error: String(err) }));
+    }
+    console.log(JSON.stringify({ level: "info", msg: "E2E sweeper complete", totalQueued }));
+};
+exports.handler = handler;
+//# sourceMappingURL=e2e-sweeper.js.map

package/dist/lambda/e2e-sweeper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-sweeper.js","sourceRoot":"","sources":["../../src/lambda/e2e-sweeper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,gGAImD;AACnD,oDAAoE;AACpE,kEAGoC;AACpC,8DAA0E;AAC1E,0DAAkD;AAElD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAc,CAAC;AACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;AACzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAqB,CAAC;AACrD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAyB,CAAC;AAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAEhD,MAAM,OAAO,GAAG,IAAI,gEAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9D,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,oCAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACpD,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9C,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,SAAS,GAAG,EAAE,CAAC;AAEd,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;IAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAc,CAAC;YACnC,SAAS,EAAE,WAAW;YACtB,IAAI,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACrF,mBAAmB,EAAE,yCAAyC;YAC9D,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAEzG,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,0CAA0C;IAC1C,IAAI,CAAC;QACH,IAAI,eAAmC,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,GAAG,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,mDAAgB,CAAC;gBAClD,UAAU,EAAE,UAAU;gBACtB,MAAM,EAAE,aAAa,UAAU,GAAG;gBAClC,KAAK,EAAE,EAAE;gBACT,eAAe,EAAE,eAAe;aACjC,CAAC,CAAC,CAAC;YAEJ,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM;oBAAE,SAAS;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;gBACrF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;gBAEhE,iEAAiE;gBACjE,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,CAAC;wBACH,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,+BAAkB,CAAC;4BACpC,QAAQ,EAAE,cAAc;4BACxB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;yBAC7C,CAAC,CAAC,CAAC;wBACJ,WAAW,EAAE,CAAC;wBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;oBACnG,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACpH,CAAC;gBACH,CAAC;gBAED,0CAA0C;gBAC1C,6DAA6D;gBAC7D,2DAA2D;gBAC3D,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,yDAAsB,CAAC;wBAC5C,UAAU,EAAE,UAAU;wBACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CAAC,CAAC;oBACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,wBAAwB,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;YAED,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;YACtC,KAAK,EAAE,CAAC;QACV,CAAC,QAAQ,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;IAEjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,wCAAoB,CAAC;YAC7C,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,CAAC;oBACX,UAAU,EAAE,kBAAkB;oBAC9B,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;iBAC9C,CAAC;SACH,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC;AA9FW,QAAA,OAAO,WA8FlB"}

package/dist/lambda/federation-outbox-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=federation-outbox-worker.d.ts.map

package/dist/lambda/federation-outbox-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-outbox-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/federation-outbox-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,OAAO,EAAE,UAKrB,CAAC"}

package/dist/lambda/federation-outbox-worker.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const handler = async (event) => {
+    for (const record of event.Records) {
+        console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+        // TODO: implement
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=federation-outbox-worker.js.map

package/dist/lambda/federation-outbox-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-outbox-worker.js","sourceRoot":"","sources":["../../src/lambda/federation-outbox-worker.ts"],"names":[],"mappings":";;;AAEO,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,kBAAkB;IACpB,CAAC;AACH,CAAC,CAAC;AALW,QAAA,OAAO,WAKlB"}

package/dist/lambda/followers-events-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=followers-events-worker.d.ts.map

package/dist/lambda/followers-events-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"followers-events-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/followers-events-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,OAAO,EAAE,UAKrB,CAAC"}

package/dist/lambda/followers-events-worker.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const handler = async (event) => {
+    for (const record of event.Records) {
+        console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+        // TODO: implement
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=followers-events-worker.js.map

package/dist/lambda/followers-events-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"followers-events-worker.js","sourceRoot":"","sources":["../../src/lambda/followers-events-worker.ts"],"names":[],"mappings":";;;AAEO,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,kBAAkB;IACpB,CAAC;AACH,CAAC,CAAC;AALW,QAAA,OAAO,WAKlB"}

package/dist/lambda/hourly-cron.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: () => Promise<void>;
+//# sourceMappingURL=hourly-cron.d.ts.map

package/dist/lambda/hourly-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hourly-cron.d.ts","sourceRoot":"","sources":["../../src/lambda/hourly-cron.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,OAAO,QAAa,OAAO,CAAC,IAAI,CAiF5C,CAAC"}

package/dist/lambda/hourly-cron.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const client_1 = require("@prisma/client");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const secretsClient = new client_secrets_manager_1.SecretsManagerClient({ region: process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+let prisma = null;
+async function getPrisma() {
+    if (prisma)
+        return prisma;
+    const secret = await secretsClient.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN }));
+    const { username, password, host, port, dbname } = JSON.parse(secret.SecretString);
+    prisma = new client_1.PrismaClient({
+        datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+    });
+    return prisma;
+}
+const handler = async () => {
+    const now = Math.floor(Date.now() / 1000);
+    // Acquire cron lock (prevent overlapping executions)
+    try {
+        await dynamo.send(new client_dynamodb_1.PutItemCommand({
+            TableName: TABLE,
+            Item: (0, util_dynamodb_1.marshall)({
+                pk: "cron:hourly",
+                sk: "lock",
+                ttl: now + 3600, // 1 hour TTL
+                lockedAt: now,
+            }),
+            ConditionExpression: "attribute_not_exists(pk) OR #ttl < :now",
+            ExpressionAttributeNames: { "#ttl": "ttl" },
+            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":now": now }),
+        }));
+    }
+    catch {
+        console.log(JSON.stringify({ level: "info", msg: "Hourly cron already running, skipping" }));
+        return;
+    }
+    console.log(JSON.stringify({ level: "info", msg: "Hourly cron started" }));
+    const db = await getPrisma();
+    // 1. Clean up stale PENDING/FAILED media records (older than 1 hour)
+    try {
+        const oneHourAgo = new Date(Date.now() - 3600000);
+        const staleMedia = await db.mediaFile.findMany({
+            where: {
+                uploadStatus: { in: ["PENDING", "FAILED"] },
+                createdAt: { lt: oneHourAgo },
+            },
+            take: 100,
+            select: { id: true },
+        });
+        if (staleMedia.length > 0) {
+            const result = await db.mediaFile.deleteMany({
+                where: { id: { in: staleMedia.map((m) => m.id) } },
+            });
+            console.log(JSON.stringify({ level: "info", msg: "Stale media cleaned", deleted: result.count }));
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Stale media cleanup failed", error: String(err) }));
+    }
+    // 2. Soft-delete orphaned media past 24h grace period
+    try {
+        const gracePeriodCutoff = new Date(Date.now() - 24 * 3600000);
+        const result = await db.mediaFile.updateMany({
+            where: {
+                attachedToPost: false,
+                orphanedAt: { lte: gracePeriodCutoff },
+                deletedAt: null,
+            },
+            data: { deletedAt: new Date() },
+        });
+        if (result.count > 0) {
+            console.log(JSON.stringify({ level: "info", msg: "Orphaned media soft-deleted", count: result.count }));
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Orphaned media cleanup failed", error: String(err) }));
+    }
+    // 3. Clean up expired security events
+    try {
+        const result = await db.securityEvent.deleteMany({
+            where: {
+                retentionUntil: { lte: new Date() },
+            },
+        });
+        if (result.count > 0) {
+            console.log(JSON.stringify({ level: "info", msg: "Expired security events cleaned", deleted: result.count }));
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Security event cleanup failed", error: String(err) }));
+    }
+    console.log(JSON.stringify({ level: "info", msg: "Hourly cron complete" }));
+};
+exports.handler = handler;
+//# sourceMappingURL=hourly-cron.js.map

package/dist/lambda/hourly-cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hourly-cron.js","sourceRoot":"","sources":["../../src/lambda/hourly-cron.ts"],"names":[],"mappings":";;;AAAA,8DAA0E;AAC1E,4EAA8F;AAC9F,0DAAkD;AAClD,2CAA8C;AAE9C,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAE1C,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAc,EAAE,CAAC,CAAC,CAAC;IAC7G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;IACpF,MAAM,GAAG,IAAI,qBAAY,CAAC;QACxB,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,qBAAqB,EAAE,EAAE;KACtI,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAc,CAAC;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAA,wBAAQ,EAAC;gBACb,EAAE,EAAE,aAAa;gBACjB,EAAE,EAAE,MAAM;gBACV,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,aAAa;gBAC9B,QAAQ,EAAE,GAAG;aACd,CAAC;YACF,mBAAmB,EAAE,yCAAyC;YAC9D,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAE3E,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;IAE7B,qEAAqE;IACrE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC7C,KAAK,EAAE;gBACL,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBAC3C,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;aAC9B;YACD,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QAEH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;gBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE;gBACL,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBACtC,SAAS,EAAE,IAAI;aAChB;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC;YAC/C,KAAK,EAAE;gBACL,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;aACpC;SACF,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC;AAjFW,QAAA,OAAO,WAiFlB"}

package/dist/lambda/link-check-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=link-check-worker.d.ts.map

package/dist/lambda/link-check-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-check-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/link-check-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,OAAO,EAAE,UAKrB,CAAC"}

package/dist/lambda/link-check-worker.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const handler = async (event) => {
+    for (const record of event.Records) {
+        console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+        // TODO: implement
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=link-check-worker.js.map

package/dist/lambda/link-check-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-check-worker.js","sourceRoot":"","sources":["../../src/lambda/link-check-worker.ts"],"names":[],"mappings":";;;AAEO,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,kBAAkB;IACpB,CAAC;AACH,CAAC,CAAC;AALW,QAAA,OAAO,WAKlB"}

package/dist/lambda/maintenance-cron.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: () => Promise<void>;
+//# sourceMappingURL=maintenance-cron.d.ts.map

package/dist/lambda/maintenance-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance-cron.d.ts","sourceRoot":"","sources":["../../src/lambda/maintenance-cron.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,OAAO,QAAa,OAAO,CAAC,IAAI,CAyE5C,CAAC"}

package/dist/lambda/maintenance-cron.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const client_1 = require("@prisma/client");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const secretsClient = new client_secrets_manager_1.SecretsManagerClient({ region: process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+let prisma = null;
+async function getPrisma() {
+    if (prisma)
+        return prisma;
+    const secret = await secretsClient.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN }));
+    const { username, password, host, port, dbname } = JSON.parse(secret.SecretString);
+    prisma = new client_1.PrismaClient({
+        datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+    });
+    return prisma;
+}
+const handler = async () => {
+    const now = Math.floor(Date.now() / 1000);
+    // Acquire cron lock
+    try {
+        await dynamo.send(new client_dynamodb_1.PutItemCommand({
+            TableName: TABLE,
+            Item: (0, util_dynamodb_1.marshall)({
+                pk: "cron:maintenance",
+                sk: "lock",
+                ttl: now + 3600,
+                lockedAt: now,
+            }),
+            ConditionExpression: "attribute_not_exists(pk) OR #ttl < :now",
+            ExpressionAttributeNames: { "#ttl": "ttl" },
+            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":now": now }),
+        }));
+    }
+    catch {
+        console.log(JSON.stringify({ level: "info", msg: "Maintenance cron already running, skipping" }));
+        return;
+    }
+    console.log(JSON.stringify({ level: "info", msg: "Maintenance cron started" }));
+    const db = await getPrisma();
+    // 1. Follow counts removed — relationships now live in graph DB (AuraDB)
+    // TODO: Add graph-side consistency check when reconciliation service is wired up
+    // 2. Clean up stale DynamoDB cron locks (safety net)
+    try {
+        const lockKeys = ["cron:hourly", "cron:nightly", "cron:maintenance", "cron:cleanup"];
+        for (const pk of lockKeys) {
+            const { GetItemCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-dynamodb")));
+            const { unmarshall } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/util-dynamodb")));
+            const result = await dynamo.send(new GetItemCommand({
+                TableName: TABLE,
+                Key: (0, util_dynamodb_1.marshall)({ pk, sk: "lock" }),
+            }));
+            if (result.Item) {
+                const item = unmarshall(result.Item);
+                // If lock is older than 2 hours, it's stale — delete it
+                if (item.lockedAt && item.lockedAt < now - 7200) {
+                    const { DeleteItemCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-dynamodb")));
+                    await dynamo.send(new DeleteItemCommand({
+                        TableName: TABLE,
+                        Key: (0, util_dynamodb_1.marshall)({ pk, sk: "lock" }),
+                    }));
+                    console.log(JSON.stringify({ level: "info", msg: "Stale cron lock removed", lock: pk }));
+                }
+            }
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "Stale lock cleanup failed", error: String(err) }));
+    }
+    // 3. Vacuum analyze critical tables (via advisory lock to prevent concurrent runs)
+    try {
+        await db.$executeRaw `SELECT pg_advisory_lock(42)`;
+        try {
+            await db.$executeRawUnsafe("ANALYZE users");
+            await db.$executeRawUnsafe("ANALYZE posts");
+            await db.$executeRawUnsafe("ANALYZE media_files");
+            await db.$executeRawUnsafe("ANALYZE follows");
+            console.log(JSON.stringify({ level: "info", msg: "ANALYZE completed on critical tables" }));
+        }
+        finally {
+            await db.$executeRaw `SELECT pg_advisory_unlock(42)`;
+        }
+    }
+    catch (err) {
+        console.error(JSON.stringify({ level: "error", msg: "ANALYZE failed", error: String(err) }));
+    }
+    console.log(JSON.stringify({ level: "info", msg: "Maintenance cron complete" }));
+};
+exports.handler = handler;
+//# sourceMappingURL=maintenance-cron.js.map

package/dist/lambda/maintenance-cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance-cron.js","sourceRoot":"","sources":["../../src/lambda/maintenance-cron.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAA0E;AAC1E,4EAA8F;AAC9F,0DAAkD;AAClD,2CAA8C;AAE9C,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,aAAa,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAE1C,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAc,EAAE,CAAC,CAAC,CAAC;IAC7G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC;IACpF,MAAM,GAAG,IAAI,qBAAY,CAAC;QACxB,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,qBAAqB,EAAE,EAAE;KACtI,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAc,CAAC;YACnC,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAA,wBAAQ,EAAC;gBACb,EAAE,EAAE,kBAAkB;gBACtB,EAAE,EAAE,MAAM;gBACV,GAAG,EAAE,GAAG,GAAG,IAAI;gBACf,QAAQ,EAAE,GAAG;aACd,CAAC;YACF,mBAAmB,EAAE,yCAAyC;YAC9D,wBAAwB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YAC3C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;IAEhF,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;IAE7B,yEAAyE;IACzE,iFAAiF;IAEjF,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;QACrF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,0BAA0B,GAAC,CAAC;YACpE,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;gBAClD,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;aAClC,CAAC,CAAC,CAAC;YACJ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,wDAAwD;gBACxD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;oBAChD,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,0BAA0B,GAAC,CAAC;oBACvE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;wBACtC,SAAS,EAAE,KAAK;wBAChB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;qBAClC,CAAC,CAAC,CAAC;oBACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,WAAW,CAAA,6BAA6B,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAC5C,MAAM,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAC5C,MAAM,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,WAAW,CAAA,+BAA+B,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC,CAAC;AAzEW,QAAA,OAAO,WAyElB"}

package/dist/lambda/media-processing-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=media-processing-worker.d.ts.map

package/dist/lambda/media-processing-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-processing-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,eAAO,MAAM,OAAO,EAAE,UA8DrB,CAAC"}

package/dist/lambda/media-processing-worker.js

@@ -0,0 +1,95 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const s3 = new client_s3_1.S3Client({ region: process.env.AWS_REGION });
+const handler = async (event) => {
+    const failedIds = [];
+    for (const record of event.Records) {
+        try {
+            // S3 event notification comes via SQS
+            const s3Event = JSON.parse(record.body);
+            const s3Records = s3Event.Records || [];
+            for (const s3Record of s3Records) {
+                const bucket = s3Record.s3.bucket.name;
+                const key = decodeURIComponent(s3Record.s3.object.key.replace(/\+/g, " "));
+                if (!key.startsWith("originals/"))
+                    continue;
+                // Get original
+                const original = await s3.send(new client_s3_1.GetObjectCommand({ Bucket: bucket, Key: key }));
+                const chunks = [];
+                for await (const chunk of original.Body) {
+                    chunks.push(chunk);
+                }
+                const buffer = Buffer.concat(chunks);
+                // Process with Sharp (must be installed as ARM64 binary)
+                // dynamic import to avoid bundling issues
+                const sharp = (await Promise.resolve().then(() => __importStar(require("sharp")))).default;
+                const hash = key.replace("originals/", "").replace(/\.[^.]+$/, "");
+                // Thumbnail: 300px WebP
+                const thumbnail = await sharp(buffer)
+                    .resize(300, 300, { fit: "cover" })
+                    .webp({ quality: 80 })
+                    .toBuffer();
+                // Optimized: 1200px WebP
+                const optimized = await sharp(buffer)
+                    .resize(1200, 1200, { fit: "inside", withoutEnlargement: true })
+                    .webp({ quality: 85 })
+                    .toBuffer();
+                await Promise.all([
+                    s3.send(new client_s3_1.PutObjectCommand({
+                        Bucket: bucket, Key: `thumbnails/${hash}.webp`,
+                        Body: thumbnail, ContentType: "image/webp",
+                    })),
+                    s3.send(new client_s3_1.PutObjectCommand({
+                        Bucket: bucket, Key: `optimized/${hash}.webp`,
+                        Body: optimized, ContentType: "image/webp",
+                    })),
+                ]);
+                console.log(JSON.stringify({ level: "info", msg: "Media processed", key, hash }));
+            }
+        }
+        catch (err) {
+            console.error(JSON.stringify({ level: "error", msg: "Media processing failed", err, messageId: record.messageId }));
+            failedIds.push(record.messageId);
+        }
+    }
+    if (failedIds.length > 0) {
+        return { batchItemFailures: failedIds.map((id) => ({ itemIdentifier: id })) };
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=media-processing-worker.js.map

package/dist/lambda/media-processing-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-processing-worker.js","sourceRoot":"","sources":["../../src/lambda/media-processing-worker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,kDAAkF;AAElF,MAAM,EAAE,GAAG,IAAI,oBAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAErD,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAExC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;gBACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBAE3E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAE5C,eAAe;gBACf,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,4BAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAiB,EAAE,CAAC;gBAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAiC,EAAE,CAAC;oBACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAErC,yDAAyD;gBACzD,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,CAAC,wDAAa,OAAO,GAAC,CAAC,CAAC,OAAO,CAAC;gBAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAEnE,wBAAwB;gBACxB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;qBAClC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;qBAClC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;qBACrB,QAAQ,EAAE,CAAC;gBAEd,yBAAyB;gBACzB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;qBAClC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;qBAC/D,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;qBACrB,QAAQ,EAAE,CAAC;gBAEd,MAAM,OAAO,CAAC,GAAG,CAAC;oBAChB,EAAE,CAAC,IAAI,CAAC,IAAI,4BAAgB,CAAC;wBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,IAAI,OAAO;wBAC9C,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;qBAC3C,CAAC,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,4BAAgB,CAAC;wBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,IAAI,OAAO;wBAC7C,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY;qBAC3C,CAAC,CAAC;iBACJ,CAAC,CAAC;gBAEH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACpH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC,CAAC;AA9DW,QAAA,OAAO,WA8DlB"}

package/dist/lambda/media-reconciliation-worker.d.ts

@@ -0,0 +1,3 @@
+import type { SQSHandler } from "aws-lambda";
+export declare const handler: SQSHandler;
+//# sourceMappingURL=media-reconciliation-worker.d.ts.map

package/dist/lambda/media-reconciliation-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-reconciliation-worker.d.ts","sourceRoot":"","sources":["../../src/lambda/media-reconciliation-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,OAAO,EAAE,UAKrB,CAAC"}

package/dist/lambda/media-reconciliation-worker.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const handler = async (event) => {
+    for (const record of event.Records) {
+        console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+        // TODO: implement
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=media-reconciliation-worker.js.map

package/dist/lambda/media-reconciliation-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-reconciliation-worker.js","sourceRoot":"","sources":["../../src/lambda/media-reconciliation-worker.ts"],"names":[],"mappings":";;;AAEO,MAAM,OAAO,GAAe,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,kBAAkB;IACpB,CAAC;AACH,CAAC,CAAC;AALW,QAAA,OAAO,WAKlB"}

package/dist/lambda/nightly-cron.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: () => Promise<void>;
+//# sourceMappingURL=nightly-cron.d.ts.map

package/dist/lambda/nightly-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nightly-cron.d.ts","sourceRoot":"","sources":["../../src/lambda/nightly-cron.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,OAAO,QAAa,OAAO,CAAC,IAAI,CAsT5C,CAAC"}