@de-otio/trellis 0.4.0

package/dist/lambda/tools/check-health.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const API_DOMAIN = process.env.API_DOMAIN;
+const handler = async () => {
+    const url = `https://${API_DOMAIN}/health`;
+    const start = Date.now();
+    const response = await fetch(url);
+    const responseTimeMs = Date.now() - start;
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = await response.text();
+    }
+    return {
+        statusCode: response.status,
+        responseTimeMs,
+        body,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=check-health.js.map

package/dist/lambda/tools/check-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-health.js","sourceRoot":"","sources":["../../../src/lambda/tools/check-health.ts"],"names":[],"mappings":";;;AAAA,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;IAChC,MAAM,GAAG,GAAG,WAAW,UAAU,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IAE1C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,cAAc;QACd,IAAI;KACL,CAAC;AACJ,CAAC,CAAC;AAnBW,QAAA,OAAO,WAmBlB"}

package/dist/lambda/tools/describe-services.d.ts

@@ -0,0 +1,20 @@
+export declare const handler: () => Promise<{
+    serviceName: string | undefined;
+    status: string | undefined;
+    runningCount: number | undefined;
+    desiredCount: number | undefined;
+    deployments: {
+        id: string | undefined;
+        status: string | undefined;
+        runningCount: number | undefined;
+        desiredCount: number | undefined;
+        taskDefinition: string | undefined;
+        rolloutState: import("@aws-sdk/client-ecs").DeploymentRolloutState | undefined;
+        createdAt: string | undefined;
+    }[] | undefined;
+    lastEvent: {
+        message: string | undefined;
+        createdAt: string | undefined;
+    } | null;
+}>;
+//# sourceMappingURL=describe-services.d.ts.map

package/dist/lambda/tools/describe-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-services.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/describe-services.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;EAkCnB,CAAC"}

package/dist/lambda/tools/describe-services.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_ecs_1 = require("@aws-sdk/client-ecs");
+const ecs = new client_ecs_1.ECSClient({ region: process.env.AWS_REGION });
+const STAGE = process.env.STAGE;
+const CLUSTER = `trellis-${STAGE}`;
+const SERVICE = `trellis-${STAGE}-api`;
+const handler = async () => {
+    const { services } = await ecs.send(new client_ecs_1.DescribeServicesCommand({
+        cluster: CLUSTER,
+        services: [SERVICE],
+    }));
+    const svc = services?.[0];
+    if (!svc) {
+        throw new Error(`Service ${SERVICE} not found in cluster ${CLUSTER}`);
+    }
+    return {
+        serviceName: svc.serviceName,
+        status: svc.status,
+        runningCount: svc.runningCount,
+        desiredCount: svc.desiredCount,
+        deployments: svc.deployments?.map((d) => ({
+            id: d.id,
+            status: d.status,
+            runningCount: d.runningCount,
+            desiredCount: d.desiredCount,
+            taskDefinition: d.taskDefinition,
+            rolloutState: d.rolloutState,
+            createdAt: d.createdAt?.toISOString(),
+        })),
+        lastEvent: svc.events?.[0]
+            ? {
+                message: svc.events[0].message,
+                createdAt: svc.events[0].createdAt?.toISOString(),
+            }
+            : null,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=describe-services.js.map

package/dist/lambda/tools/describe-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-services.js","sourceRoot":"","sources":["../../../src/lambda/tools/describe-services.ts"],"names":[],"mappings":";;;AAAA,oDAG6B;AAE7B,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAM,CAAC;AACjC,MAAM,OAAO,GAAG,WAAW,KAAK,EAAE,CAAC;AACnC,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC;AAEhC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CACjC,IAAI,oCAAuB,CAAC;QAC1B,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC;gBACE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO;gBAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE;aAClD;YACH,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC,CAAC;AAlCW,QAAA,OAAO,WAkClB"}

package/dist/lambda/tools/get-cost-report.d.ts

@@ -0,0 +1,16 @@
+export declare const handler: (event: {
+    days?: number;
+}) => Promise<{
+    totalCost: number;
+    currency: string;
+    days: number;
+    dailyTotals: {
+        date: string;
+        cost: number;
+    }[];
+    byService: {
+        service: string;
+        cost: number;
+    }[];
+}>;
+//# sourceMappingURL=get-cost-report.d.ts.map

package/dist/lambda/tools/get-cost-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-cost-report.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/get-cost-report.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,GAAU,OAAO;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;cAqBzB,MAAM;cAAQ,MAAM;;;;;;EA+BhD,CAAC"}

package/dist/lambda/tools/get-cost-report.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_cost_explorer_1 = require("@aws-sdk/client-cost-explorer");
+const ce = new client_cost_explorer_1.CostExplorerClient({ region: "us-east-1" });
+function formatDate(d) {
+    return d.toISOString().slice(0, 10);
+}
+const handler = async (event) => {
+    const days = Math.min(Math.max(event.days ?? 7, 1), 30);
+    const end = new Date();
+    const start = new Date();
+    start.setDate(end.getDate() - days);
+    const { ResultsByTime } = await ce.send(new client_cost_explorer_1.GetCostAndUsageCommand({
+        TimePeriod: {
+            Start: formatDate(start),
+            End: formatDate(end),
+        },
+        Granularity: "DAILY",
+        Metrics: ["UnblendedCost"],
+        GroupBy: [{ Type: "DIMENSION", Key: "SERVICE" }],
+    }));
+    let totalCost = 0;
+    let currency = "USD";
+    const dailyTotals = [];
+    const serviceMap = new Map();
+    for (const period of ResultsByTime ?? []) {
+        let dayTotal = 0;
+        for (const group of period.Groups ?? []) {
+            const amount = parseFloat(group.Metrics?.UnblendedCost?.Amount ?? "0");
+            currency = group.Metrics?.UnblendedCost?.Unit ?? "USD";
+            dayTotal += amount;
+            const serviceName = group.Keys?.[0] ?? "Unknown";
+            serviceMap.set(serviceName, (serviceMap.get(serviceName) ?? 0) + amount);
+        }
+        totalCost += dayTotal;
+        dailyTotals.push({
+            date: period.TimePeriod?.Start ?? "unknown",
+            cost: Math.round(dayTotal * 100) / 100,
+        });
+    }
+    const byService = Array.from(serviceMap.entries())
+        .map(([service, cost]) => ({ service, cost: Math.round(cost * 100) / 100 }))
+        .sort((a, b) => b.cost - a.cost);
+    return {
+        totalCost: Math.round(totalCost * 100) / 100,
+        currency,
+        days,
+        dailyTotals,
+        byService,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=get-cost-report.js.map

package/dist/lambda/tools/get-cost-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-cost-report.js","sourceRoot":"","sources":["../../../src/lambda/tools/get-cost-report.ts"],"names":[],"mappings":";;;AAAA,wEAGuC;AAEvC,MAAM,EAAE,GAAG,IAAI,yCAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAE3D,SAAS,UAAU,CAAC,CAAO;IACzB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,EAAE;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEpC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CACrC,IAAI,6CAAsB,CAAC;QACzB,UAAU,EAAE;YACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;YACxB,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;SACrB;QACD,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;KACjD,CAAC,CACH,CAAC;IAEF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,WAAW,GAAqC,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;YACvE,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,IAAI,KAAK,CAAC;YACvD,QAAQ,IAAI,MAAM,CAAC;YAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,IAAI,QAAQ,CAAC;QACtB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,SAAS;YAC3C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG;SACvC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;SAC3E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;QAC5C,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AApDW,QAAA,OAAO,WAoDlB"}

package/dist/lambda/tools/get-errors.d.ts

@@ -0,0 +1,11 @@
+export declare const handler: (event: {
+    minutes?: number;
+}) => Promise<{
+    errorCount: number;
+    topErrors: {
+        message: string;
+        count: number;
+    }[];
+    periodMinutes: number;
+}>;
+//# sourceMappingURL=get-errors.d.ts.map

package/dist/lambda/tools/get-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-errors.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/get-errors.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,OAAO,GAAU,OAAO;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;;;iBAqCvB,MAAM;eAAS,MAAM;;;EAyBtD,CAAC"}

package/dist/lambda/tools/get-errors.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const cwl = new client_cloudwatch_logs_1.CloudWatchLogsClient({ region: process.env.AWS_REGION });
+const STAGE = process.env.STAGE;
+const APP_NAME = process.env.APP_NAME || "trellis";
+const LOG_GROUP = process.env.LOG_GROUP || `/${APP_NAME}/${STAGE}/api`;
+const MAX_POLL_ITERATIONS = 10;
+const POLL_DELAY_MS = 1000;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const handler = async (event) => {
+    const minutes = Math.min(event.minutes ?? 60, 120);
+    const now = Date.now();
+    const startTime = Math.floor((now - minutes * 60 * 1000) / 1000);
+    const endTime = Math.floor(now / 1000);
+    const query = `
+    fields @timestamp, @message
+    | filter @message like /ERROR/
+    | stats count(*) as errorCount by @message
+    | sort errorCount desc
+    | limit 20
+  `.trim();
+    const { queryId } = await cwl.send(new client_cloudwatch_logs_1.StartQueryCommand({
+        logGroupName: LOG_GROUP,
+        startTime,
+        endTime,
+        queryString: query,
+    }));
+    if (!queryId) {
+        throw new Error("Failed to start CloudWatch Logs Insights query");
+    }
+    for (let i = 0; i < MAX_POLL_ITERATIONS; i++) {
+        await sleep(POLL_DELAY_MS);
+        const result = await cwl.send(new client_cloudwatch_logs_1.GetQueryResultsCommand({ queryId }));
+        if (result.status === "Complete") {
+            const rows = result.results ?? [];
+            let totalErrors = 0;
+            const topErrors = [];
+            for (const row of rows) {
+                const fields = Object.fromEntries(row.map((f) => [f.field, f.value]));
+                const count = parseInt(fields.errorCount ?? "0", 10);
+                totalErrors += count;
+                topErrors.push({
+                    message: fields["@message"] ?? "unknown",
+                    count,
+                });
+            }
+            return {
+                errorCount: totalErrors,
+                topErrors,
+                periodMinutes: minutes,
+            };
+        }
+        if (result.status === "Failed" || result.status === "Cancelled") {
+            throw new Error(`Query ${result.status}`);
+        }
+    }
+    throw new Error("Query timed out after polling");
+};
+exports.handler = handler;
+//# sourceMappingURL=get-errors.js.map

package/dist/lambda/tools/get-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-errors.js","sourceRoot":"","sources":["../../../src/lambda/tools/get-errors.ts"],"names":[],"mappings":";;;AAAA,4EAIyC;AAEzC,MAAM,GAAG,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAM,CAAC;AACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,QAAQ,IAAI,KAAK,MAAM,CAAC;AACvE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7D,MAAM,OAAO,GAAG,KAAK,EAAE,KAA2B,EAAE,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG;;;;;;GAMb,CAAC,IAAI,EAAE,CAAC;IAET,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAChC,IAAI,0CAAiB,CAAC;QACpB,YAAY,EAAE,SAAS;QACvB,SAAS;QACT,OAAO;QACP,WAAW,EAAE,KAAK;KACnB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,+CAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CACxC,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YAClC,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,MAAM,SAAS,GAAyC,EAAE,CAAC;YAE3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrD,WAAW,IAAI,KAAK,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC;oBACb,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,SAAS;oBACxC,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,WAAW;gBACvB,SAAS;gBACT,aAAa,EAAE,OAAO;aACvB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACnD,CAAC,CAAC;AA9DW,QAAA,OAAO,WA8DlB"}

package/dist/lambda/tools/get-feature-flags.d.ts

@@ -0,0 +1,8 @@
+export declare const handler: () => Promise<{
+    flags: {
+        name: string;
+        enabled: boolean;
+        updatedAt: string | null;
+    }[];
+}>;
+//# sourceMappingURL=get-feature-flags.d.ts.map

package/dist/lambda/tools/get-feature-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-feature-flags.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/get-feature-flags.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,OAAO;;;;;;EAkBnB,CAAC"}

package/dist/lambda/tools/get-feature-flags.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+const handler = async () => {
+    const { Items } = await dynamo.send(new client_dynamodb_1.ScanCommand({
+        TableName: TABLE,
+        FilterExpression: "begins_with(pk, :prefix)",
+        ExpressionAttributeValues: {
+            ":prefix": { S: "feature-toggle:" },
+        },
+    }));
+    const flags = (Items ?? []).map((item) => ({
+        name: item.pk?.S?.replace("feature-toggle:", "") ?? "unknown",
+        enabled: item.enabled?.BOOL ?? false,
+        updatedAt: item.updatedAt?.S ?? null,
+    }));
+    return { flags };
+};
+exports.handler = handler;
+//# sourceMappingURL=get-feature-flags.js.map

package/dist/lambda/tools/get-feature-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-feature-flags.js","sourceRoot":"","sources":["../../../src/lambda/tools/get-feature-flags.ts"],"names":[],"mappings":";;;AAAA,8DAGkC;AAElC,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAEnC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;IAChC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,IAAI,6BAAW,CAAC;QACd,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,0BAA0B;QAC5C,yBAAyB,EAAE;YACzB,SAAS,EAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE;SACpC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,IAAI,SAAS;QAC7D,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,KAAK;QACpC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI;KACrC,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC,CAAC;AAlBW,QAAA,OAAO,WAkBlB"}

package/dist/lambda/tools/get-queue-status.d.ts

@@ -0,0 +1,9 @@
+export declare const handler: () => Promise<{
+    queues: {
+        name: string;
+        visible: number;
+        inFlight: number;
+        dlqDepth: number;
+    }[];
+}>;
+//# sourceMappingURL=get-queue-status.d.ts.map

package/dist/lambda/tools/get-queue-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-queue-status.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/get-queue-status.ts"],"names":[],"mappings":"AAsCA,eAAO,MAAM,OAAO;;;;;;;EAqBnB,CAAC"}

package/dist/lambda/tools/get-queue-status.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_sqs_1 = require("@aws-sdk/client-sqs");
+const sqs = new client_sqs_1.SQSClient({ region: process.env.AWS_REGION });
+const STAGE = process.env.STAGE;
+const QUEUE_NAMES = [
+    "delete-account",
+    "media-processing",
+    "media-reconciliation",
+    "link-check",
+    "followers-events",
+];
+async function getQueueAttributes(queueName) {
+    const { QueueUrl } = await sqs.send(new client_sqs_1.GetQueueUrlCommand({ QueueName: queueName }));
+    const { Attributes } = await sqs.send(new client_sqs_1.GetQueueAttributesCommand({
+        QueueUrl,
+        AttributeNames: [
+            "ApproximateNumberOfMessages",
+            "ApproximateNumberOfMessagesNotVisible",
+        ],
+    }));
+    return {
+        visible: parseInt(Attributes?.ApproximateNumberOfMessages ?? "0", 10),
+        inFlight: parseInt(Attributes?.ApproximateNumberOfMessagesNotVisible ?? "0", 10),
+    };
+}
+const handler = async () => {
+    const results = await Promise.all(QUEUE_NAMES.map(async (name) => {
+        const queueName = `${STAGE}-${name}`;
+        const dlqName = `${STAGE}-${name}-dlq`;
+        const [main, dlq] = await Promise.all([
+            getQueueAttributes(queueName),
+            getQueueAttributes(dlqName),
+        ]);
+        return {
+            name,
+            visible: main.visible,
+            inFlight: main.inFlight,
+            dlqDepth: dlq.visible,
+        };
+    }));
+    return { queues: results };
+};
+exports.handler = handler;
+//# sourceMappingURL=get-queue-status.js.map

package/dist/lambda/tools/get-queue-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-queue-status.js","sourceRoot":"","sources":["../../../src/lambda/tools/get-queue-status.ts"],"names":[],"mappings":";;;AAAA,oDAI6B;AAE7B,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAM,CAAC;AAEjC,MAAM,WAAW,GAAG;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;CACnB,CAAC;AAEF,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CACjC,IAAI,+BAAkB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CACjD,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CACnC,IAAI,sCAAyB,CAAC;QAC5B,QAAQ;QACR,cAAc,EAAE;YACd,6BAA6B;YAC7B,uCAAuC;SACxC;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,2BAA2B,IAAI,GAAG,EAAE,EAAE,CAAC;QACrE,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,qCAAqC,IAAI,GAAG,EAAE,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;IAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC;QAEvC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpC,kBAAkB,CAAC,SAAS,CAAC;YAC7B,kBAAkB,CAAC,OAAO,CAAC;SAC5B,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,GAAG,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AArBW,QAAA,OAAO,WAqBlB"}

package/dist/lambda/tools/search-logs.d.ts

@@ -0,0 +1,19 @@
+export declare const handler: (event: {
+    query?: string;
+    minutes?: number;
+}) => Promise<{
+    status: string;
+    matchCount: number;
+    results: any[] | undefined;
+    statistics: import("@aws-sdk/client-cloudwatch-logs").QueryStatistics | undefined;
+    queryId?: undefined;
+    message?: undefined;
+} | {
+    status: string;
+    queryId: string;
+    message: string;
+    matchCount?: undefined;
+    results?: undefined;
+    statistics?: undefined;
+}>;
+//# sourceMappingURL=search-logs.d.ts.map

package/dist/lambda/tools/search-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-logs.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/search-logs.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,OAAO,GAAU,OAAO;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;;;;;EAuDA,CAAC"}

package/dist/lambda/tools/search-logs.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const cwl = new client_cloudwatch_logs_1.CloudWatchLogsClient({ region: process.env.AWS_REGION });
+const STAGE = process.env.STAGE;
+const APP_NAME = process.env.APP_NAME || "trellis";
+const LOG_GROUP = process.env.LOG_GROUP || `/${APP_NAME}/${STAGE}/api`;
+const MAX_MINUTES = 120;
+const MAX_POLL_ITERATIONS = 10;
+const POLL_DELAY_MS = 1000;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const handler = async (event) => {
+    const minutes = Math.min(event.minutes ?? 30, MAX_MINUTES);
+    let query = event.query ?? `fields @timestamp, @message | sort @timestamp desc | limit 50`;
+    // Enforce a limit clause to prevent runaway queries
+    if (!/\|\s*limit\b/i.test(query)) {
+        query += " | limit 100";
+    }
+    const now = Date.now();
+    const startTime = Math.floor((now - minutes * 60 * 1000) / 1000);
+    const endTime = Math.floor(now / 1000);
+    const { queryId } = await cwl.send(new client_cloudwatch_logs_1.StartQueryCommand({
+        logGroupName: LOG_GROUP,
+        startTime,
+        endTime,
+        queryString: query,
+    }));
+    if (!queryId) {
+        throw new Error("Failed to start CloudWatch Logs Insights query");
+    }
+    // Poll for results
+    for (let i = 0; i < MAX_POLL_ITERATIONS; i++) {
+        await sleep(POLL_DELAY_MS);
+        const result = await cwl.send(new client_cloudwatch_logs_1.GetQueryResultsCommand({ queryId }));
+        if (result.status === "Complete") {
+            return {
+                status: "Complete",
+                matchCount: result.results?.length ?? 0,
+                results: result.results?.map((row) => Object.fromEntries(row.map((f) => [f.field, f.value]))),
+                statistics: result.statistics,
+            };
+        }
+        if (result.status === "Failed" || result.status === "Cancelled") {
+            throw new Error(`Query ${result.status}`);
+        }
+    }
+    return {
+        status: "Timeout",
+        queryId,
+        message: `Query still running after ${MAX_POLL_ITERATIONS} poll attempts. Use queryId to check later.`,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=search-logs.js.map

package/dist/lambda/tools/search-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-logs.js","sourceRoot":"","sources":["../../../src/lambda/tools/search-logs.ts"],"names":[],"mappings":";;;AAAA,4EAIyC;AAEzC,MAAM,GAAG,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAM,CAAC;AACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,QAAQ,IAAI,KAAK,MAAM,CAAC;AACvE,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE7D,MAAM,OAAO,GAAG,KAAK,EAAE,KAG7B,EAAE,EAAE;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,+DAA+D,CAAC;IAE3F,oDAAoD;IACpD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,IAAI,cAAc,CAAC;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAEvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAChC,IAAI,0CAAiB,CAAC;QACpB,YAAY,EAAE,SAAS;QACvB,SAAS;QACT,OAAO;QACP,WAAW,EAAE,KAAK;KACnB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,mBAAmB;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,+CAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CACxC,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACnC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACvD;gBACD,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO;QACP,OAAO,EAAE,6BAA6B,mBAAmB,6CAA6C;KACvG,CAAC;AACJ,CAAC,CAAC;AA1DW,QAAA,OAAO,WA0DlB"}

package/dist/lambda/tools/send-alert.d.ts

@@ -0,0 +1,8 @@
+export declare const handler: (event: {
+    subject: string;
+    message: string;
+}) => Promise<{
+    messageId: string | undefined;
+    sent: boolean;
+}>;
+//# sourceMappingURL=send-alert.d.ts.map

package/dist/lambda/tools/send-alert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-alert.d.ts","sourceRoot":"","sources":["../../../src/lambda/tools/send-alert.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,OAAO,GAAU,OAAO;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;;;EAyBA,CAAC"}

package/dist/lambda/tools/send-alert.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_sns_1 = require("@aws-sdk/client-sns");
+const sns = new client_sns_1.SNSClient({ region: process.env.AWS_REGION });
+const ALERT_TOPIC_ARN = process.env.ALERT_TOPIC_ARN;
+const handler = async (event) => {
+    const { subject, message } = event;
+    if (!subject || !message) {
+        throw new Error("subject and message are required");
+    }
+    const result = await sns.send(new client_sns_1.PublishCommand({
+        TopicArn: ALERT_TOPIC_ARN,
+        Subject: subject.slice(0, 100),
+        Message: message,
+        MessageAttributes: {
+            source: {
+                DataType: "String",
+                StringValue: "agent",
+            },
+        },
+    }));
+    return {
+        messageId: result.MessageId,
+        sent: true,
+    };
+};
+exports.handler = handler;
+//# sourceMappingURL=send-alert.js.map

package/dist/lambda/tools/send-alert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-alert.js","sourceRoot":"","sources":["../../../src/lambda/tools/send-alert.ts"],"names":[],"mappings":";;;AAAA,oDAG6B;AAE7B,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;AAE9C,MAAM,OAAO,GAAG,KAAK,EAAE,KAG7B,EAAE,EAAE;IACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEnC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,2BAAc,CAAC;QACjB,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC9B,OAAO,EAAE,OAAO;QAChB,iBAAiB,EAAE;YACjB,MAAM,EAAE;gBACN,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,OAAO;aACrB;SACF;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,OAAO,WA4BlB"}

package/dist/lambda/verify-auth-challenge.d.ts

@@ -0,0 +1,2 @@
+export declare const handler: (event: any) => Promise<any>;
+//# sourceMappingURL=verify-auth-challenge.d.ts.map

package/dist/lambda/verify-auth-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-auth-challenge.d.ts","sourceRoot":"","sources":["../../src/lambda/verify-auth-challenge.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,OAAO,GAAU,OAAO,GAAG,iBA8BvC,CAAC"}

package/dist/lambda/verify-auth-challenge.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const node_crypto_1 = require("node:crypto");
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const dynamo = new client_dynamodb_1.DynamoDBClient({ region: process.env.AWS_REGION });
+const TABLE = process.env.DYNAMODB_TABLE;
+const handler = async (event) => {
+    const answer = event.request.challengeAnswer;
+    const expected = event.request.privateChallengeParameters.token;
+    const answerBuf = Buffer.from(answer);
+    const expectedBuf = Buffer.from(expected);
+    const correct = answerBuf.length === expectedBuf.length &&
+        (0, node_crypto_1.timingSafeEqual)(answerBuf, expectedBuf);
+    event.response.answerCorrect = correct;
+    if (correct) {
+        // S1.1 — Hash the token to compute the DynamoDB key (tokens are stored hashed)
+        const tokenHash = (0, node_crypto_1.createHash)("sha256").update(expected).digest("hex");
+        try {
+            await dynamo.send(new client_dynamodb_1.DeleteItemCommand({
+                TableName: TABLE,
+                Key: {
+                    pk: { S: `magic-link:${tokenHash}` },
+                    sk: { S: "v" },
+                },
+            }));
+        }
+        catch (err) {
+            console.error("Failed to delete magic link token", err);
+        }
+    }
+    return event;
+};
+exports.handler = handler;
+//# sourceMappingURL=verify-auth-challenge.js.map

package/dist/lambda/verify-auth-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-auth-challenge.js","sourceRoot":"","sources":["../../src/lambda/verify-auth-challenge.ts"],"names":[],"mappings":";;;AAAA,6CAA0D;AAC1D,8DAA6E;AAE7E,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC;AAEnC,MAAM,OAAO,GAAG,KAAK,EAAE,KAAU,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,eAAyB,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAe,CAAC;IAE1E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE1C,MAAM,OAAO,GACX,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACvC,IAAA,6BAAe,EAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAE1C,KAAK,CAAC,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC;IAEvC,IAAI,OAAO,EAAE,CAAC;QACZ,+EAA+E;QAC/E,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mCAAiB,CAAC;gBACtC,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE;oBACH,EAAE,EAAE,EAAE,CAAC,EAAE,cAAc,SAAS,EAAE,EAAE;oBACpC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;iBACf;aACF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AA9BW,QAAA,OAAO,WA8BlB"}

package/dist/lib/abuse-metrics.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Abuse Metrics Monitor
+ *
+ * Fetches WAF, rate-limiting, and auth abuse metrics from CloudWatch
+ * for the admin abuse dashboard.
+ */
+export interface AbuseMetricPoint {
+    timestamp: string;
+    value: number;
+}
+export interface AbuseRuleMetrics {
+    name: string;
+    allowed: number;
+    blocked: number;
+    trend: AbuseMetricPoint[];
+}
+export interface AuthAbuseMetrics {
+    rateLimitExceeded: number;
+    magicLinkRequests: number;
+    failedVerifications: number;
+}
+export interface AbuseMetricsResult {
+    timeRange: string;
+    overallStatus: "low" | "moderate" | "high" | "critical";
+    summary: {
+        totalAllowed: number;
+        totalBlocked: number;
+        blockRate: number;
+    };
+    wafRules: AbuseRuleMetrics[];
+    authAbuse: AuthAbuseMetrics;
+    topBlockedIps: Array<{
+        ip: string;
+        count: number;
+    }>;
+    recommendations: string[];
+    timestamp: string;
+}
+export declare function evaluateAbuseMetrics(env: {
+    STAGE?: string;
+    AWS_REGION?: string;
+    LOG_LEVEL?: string;
+}, timeRange?: string): Promise<AbuseMetricsResult>;
+//# sourceMappingURL=abuse-metrics.d.ts.map

package/dist/lib/abuse-metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abuse-metrics.d.ts","sourceRoot":"","sources":["../../src/lib/abuse-metrics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,aAAa,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AA6PD,wBAAsB,oBAAoB,CACxC,GAAG,EAAE;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,SAAS,GAAE,MAAc,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAuH7B"}