@de-otio/trellis 0.7.1 → 0.10.0

package/dist/lib/privacy-defaults.js

@@ -1,14 +1,9 @@
-"use strict";
 /**
  * Privacy Defaults
  *
  * Age-tier-aware privacy defaults and enforcement for child safety.
  * Locked fields cannot be overridden by the user or guardian to a less restrictive value.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPrivacyDefaults = getPrivacyDefaults;
-exports.applyPrivacyLocks = applyPrivacyLocks;
-exports.isFieldLocked = isFieldLocked;
 /**
  * Fields that are locked (enforced) per age tier — cannot be overridden to less restrictive values.
  */
@@ -60,14 +55,14 @@ const DEFAULTS = {
 /**
  * Get the privacy defaults for a given age tier.
  */
-function getPrivacyDefaults(ageTier) {
+export function getPrivacyDefaults(ageTier) {
     return { ...DEFAULTS[ageTier] };
 }
 /**
  * Apply privacy locks for a given age tier.
  * Locked fields are overridden with the default value; unlocked fields pass through unchanged.
  */
-function applyPrivacyLocks(settings, ageTier) {
+export function applyPrivacyLocks(settings, ageTier) {
     const defaults = DEFAULTS[ageTier];
     const locked = LOCKED_FIELDS[ageTier];
     const result = { ...settings };
@@ -79,7 +74,7 @@ function applyPrivacyLocks(settings, ageTier) {
 /**
  * Returns true if the given field is locked (enforced) for the given age tier.
  */
-function isFieldLocked(field, ageTier) {
+export function isFieldLocked(field, ageTier) {
     return LOCKED_FIELDS[ageTier][field] === true;
 }
 //# sourceMappingURL=privacy-defaults.js.map

package/dist/lib/privacy-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-defaults.js","sourceRoot":"","sources":["../../src/lib/privacy-defaults.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAqEH,gDAEC;AAMD,8CAUC;AAKD,sCAEC;AA9ED;;GAEG;AACH,MAAM,aAAa,GAAkE;IACnF,KAAK,EAAE;QACL,uBAAuB,EAAE,IAAI;QAC7B,0BAA0B,EAAE,IAAI;QAChC,eAAe,EAAE,IAAI;QACrB,QAAQ,EAAE,IAAI;KACf;IACD,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,QAAQ,GAAqC;IACjD,KAAK,EAAE;QACL,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,SAAS;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD,IAAI,EAAE;QACJ,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,IAAI;QACzB,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,aAAa;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD,KAAK,EAAE;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,IAAI;QACzB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,KAAK;QACtB,iBAAiB,EAAE,QAAQ;QAC3B,QAAQ,EAAE,aAAa;KACxB;CACF,CAAC;AAEF;;GAEG;AACH,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAAyB,EAAE,OAAgB;IAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA8B,EAAE,CAAC;QACpE,MAAc,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,KAA4B,EAAE,OAAgB;IAC1E,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC"}
+{"version":3,"file":"privacy-defaults.js","sourceRoot":"","sources":["../../src/lib/privacy-defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH;;GAEG;AACH,MAAM,aAAa,GAAkE;IACnF,KAAK,EAAE;QACL,uBAAuB,EAAE,IAAI;QAC7B,0BAA0B,EAAE,IAAI;QAChC,eAAe,EAAE,IAAI;QACrB,QAAQ,EAAE,IAAI;KACf;IACD,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,QAAQ,GAAqC;IACjD,KAAK,EAAE;QACL,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,SAAS;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD,IAAI,EAAE;QACJ,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,IAAI;QACzB,YAAY,EAAE,KAAK;QACnB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,aAAa;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD,KAAK,EAAE;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,IAAI;QACzB,YAAY,EAAE,IAAI;QAClB,uBAAuB,EAAE,KAAK;QAC9B,0BAA0B,EAAE,CAAC;QAC7B,eAAe,EAAE,KAAK;QACtB,iBAAiB,EAAE,QAAQ;QAC3B,QAAQ,EAAE,aAAa;KACxB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAAgB;IAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA8B,EAAE,CAAC;QACpE,MAAc,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAA4B,EAAE,OAAgB;IAC1E,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC"}

package/dist/lib/privacy-handler.d.ts

@@ -1,11 +1,11 @@
-import type { KVNamespace } from "../types/cloudflare-compat";
+import type { KVNamespace } from "../types/cloudflare-compat.js";
 /**
  * Privacy Handler class for managing user privacy preferences
  *
  * This handler manages GDPR-compliant privacy preferences.
  * Currently uses KV for storage, but can be extended to use Salesforce Individual object.
  */
-import { Session } from "./session-manager";
+import { Session } from "./session-cookie.js";
 export interface PrivacyPreferences {
     hasOptedOutTracking: boolean;
     hasOptedOutProcessing: boolean;

package/dist/lib/privacy-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-handler.d.ts","sourceRoot":"","sources":["../../src/lib/privacy-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AACzF;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IACnD,cAAc,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,GAAG;IAClB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAE/B;AAED,qBAAa,cAAc;IACzB;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsBrC;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,kBAAkB,EAC/B,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAmC3B;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IA+BpB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;CA4BrB"}
+{"version":3,"file":"privacy-handler.d.ts","sourceRoot":"","sources":["../../src/lib/privacy-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,+BAA+B,CAAC;AAC5F;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG9C,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;IACnD,cAAc,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,GAAG;IAClB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAE/B;AAED,qBAAa,cAAc;IACzB;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsBrC;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,kBAAkB,EAC/B,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC;IAyBhB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAmC3B;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IA+BpB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;CA4BrB"}

package/dist/lib/privacy-handler.js

@@ -1,8 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrivacyHandler = void 0;
-const logger_1 = require("./logger");
-class PrivacyHandler {
+import { getLogger } from "./logger.js";
+export class PrivacyHandler {
     /**
      * Get privacy preferences for a user
      */
@@ -20,7 +17,7 @@ class PrivacyHandler {
             return null;
         }
         catch (error) {
-            logger_1.Logger.getInstance(env).error("Error getting privacy preferences:", error);
+            getLogger().error("Error getting privacy preferences:", error);
             return null;
         }
     }
@@ -43,7 +40,7 @@ class PrivacyHandler {
             // functions from the GDPR documentation
         }
         catch (error) {
-            logger_1.Logger.getInstance(env).error("Error updating privacy preferences:", error);
+            getLogger().error("Error updating privacy preferences:", error);
             throw error;
         }
     }
@@ -89,7 +86,7 @@ class PrivacyHandler {
             });
         }
         catch (error) {
-            logger_1.Logger.getInstance(env).error("Error handling get preferences:", error);
+            getLogger().error("Error handling get preferences:", error);
             return new Response(JSON.stringify({ error: "Failed to get privacy preferences" }), {
                 status: 500,
                 headers: { "content-type": "application/json" },
@@ -110,7 +107,7 @@ class PrivacyHandler {
             });
         }
         catch (error) {
-            logger_1.Logger.getInstance(env).error("Error handling update preferences:", error);
+            getLogger().error("Error handling update preferences:", error);
             return new Response(JSON.stringify({
                 error: error.message || "Failed to update privacy preferences",
             }), {
@@ -120,5 +117,4 @@ class PrivacyHandler {
         }
     }
 }
-exports.PrivacyHandler = PrivacyHandler;
 //# sourceMappingURL=privacy-handler.js.map

package/dist/lib/privacy-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-handler.js","sourceRoot":"","sources":["../../src/lib/privacy-handler.ts"],"names":[],"mappings":";;;AASA,qCAAkD;AAiBlD,MAAa,cAAc;IACzB;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACjE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,MAA4B,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,oCAAoC,EACpC,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAgB,EAChB,WAA+B,EAC/B,GAAQ;QAER,IAAI,CAAC;YACH,uBAAuB;YACvB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,2BAA2B;YAC3B,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,qEAAqE;YACrE,8EAA8E;YAC9E,wCAAwC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,qCAAqC,EACrC,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,WAAgB;QAEhB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,IACE,OAAO,WAAW,CAAC,mBAAmB,KAAK,SAAS;YACpD,OAAO,WAAW,CAAC,qBAAqB,KAAK,SAAS;YACtD,OAAO,WAAW,CAAC,gBAAgB,KAAK,SAAS,EACjD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4BAA4B;QAC5B,IACE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,EACxE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4BAA4B;QAC5B,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAC7C,WAAW,CAAC,cAAc,CAC3B,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE5D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC/C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YACxE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,EAC9D;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAAgB,EAChB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAA0B,CAAC;YAE/C,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAExD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;gBACrD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,oCAAoC,EACpC,KAAK,CACN,CAAC;YACF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,sCAAsC;aAC/D,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CAEF;AA5KD,wCA4KC"}
+{"version":3,"file":"privacy-handler.js","sourceRoot":"","sources":["../../src/lib/privacy-handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAiBhE,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACjE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,MAA4B,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,KAAK,CACf,oCAAoC,EACpC,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAgB,EAChB,WAA+B,EAC/B,GAAQ;QAER,IAAI,CAAC;YACH,uBAAuB;YACvB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YAED,2BAA2B;YAC3B,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;YACzE,CAAC;YAED,qEAAqE;YACrE,8EAA8E;YAC9E,wCAAwC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,KAAK,CACf,qCAAqC,EACrC,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,WAAgB;QAEhB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,IACE,OAAO,WAAW,CAAC,mBAAmB,KAAK,SAAS;YACpD,OAAO,WAAW,CAAC,qBAAqB,KAAK,SAAS;YACtD,OAAO,WAAW,CAAC,gBAAgB,KAAK,SAAS,EACjD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4BAA4B;QAC5B,IACE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,EACxE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,4BAA4B;QAC5B,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAC7C,WAAW,CAAC,cAAc,CAC3B,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAgB,EAChB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE5D,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC/C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;YAC5D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,EAC9D;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAAgB,EAChB,OAAgB,EAChB,GAAQ;QAER,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAA0B,CAAC;YAE/C,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YAExD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;gBACrD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,SAAS,EAAE,CAAC,KAAK,CACf,oCAAoC,EACpC,KAAK,CACN,CAAC;YACF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,sCAAsC;aAC/D,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CAEF"}

package/dist/lib/pseudonym.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Research pseudonym derivation.
+ *
+ * Computes `User.anonymousId`, a KEYED pseudonym derived from the user's
+ * immutable primary key. See `PSEUDONYM.md` (same directory) for the full
+ * design, rotation protocol, and security caveats. Summary:
+ *
+ *   anonymousId = base64( HMAC-SHA256( key, "trellis.user.pseudonym:" + userId ) )
+ *
+ *   - DOMAIN SEPARATION: the constant prefix `trellis.user.pseudonym:` scopes
+ *     the MAC so the same KMS key reused for another purpose can never collide
+ *     with a user pseudonym.
+ *   - INPUT is `user.id` (the immutable cuid PK) ONLY. We NEVER hash PII
+ *     (email / cognitoSub / handle) — those are mutable and dictionary-
+ *     reversible.
+ *   - KEY is a KMS HMAC key (HMAC_SHA_256). The key lives in a FIPS HSM and
+ *     never leaves KMS; we call `GenerateMac` so plaintext key material is
+ *     never in this process. SSM SecureString is only a documented fallback
+ *     (see PSEUDONYM.md) — we do NOT default to it here.
+ *   - FAIL-SAFE: if no KMS HMAC key id is configured, this THROWS. Callers
+ *     that populate anonymousId opportunistically (e.g. account creation)
+ *     should catch + skip population rather than fall back to an unkeyed hash.
+ *     An unkeyed SHA-256 of the PK would be trivially recomputable by anyone
+ *     with the (public-ish) cuid, defeating pseudonymisation.
+ */
+/** Domain-separation prefix. Changing this re-keys every pseudonym. */
+export declare const PSEUDONYM_DOMAIN = "trellis.user.pseudonym:";
+/** Minimal env shape this helper needs. */
+export interface PseudonymEnv {
+    PSEUDONYM_HMAC_KMS_KEY_ID?: string;
+    AWS_REGION?: string;
+}
+/**
+ * Injectable MAC computer. Defaults to the AWS-SDK-backed implementation
+ * (dynamic import so the API bundle has no hard `@aws-sdk/client-kms` dep —
+ * same pattern as `oauth/envelope-crypto.ts`). Tests override via
+ * `setMacComputer`.
+ *
+ * @returns the raw MAC bytes for `message` under KMS key `kmsKeyId`.
+ */
+export type MacComputer = (kmsKeyId: string, region: string, message: Uint8Array) => Promise<Uint8Array>;
+/** Wire a custom MAC computer (production override / tests). */
+export declare function setMacComputer(fn: MacComputer): void;
+/** Reset to the default AWS-SDK-backed computer (test-only). */
+export declare function _resetMacComputerForTest(): void;
+/**
+ * Compute the keyed pseudonym for a user.
+ *
+ * @param userId the immutable `User.id` (cuid) PK. NEVER pass PII.
+ * @param env    resolves the KMS HMAC key id + region.
+ * @returns base64 of the HMAC-SHA256 MAC.
+ * @throws if no KMS HMAC key id is configured (fail-safe; do not fall back to
+ *   an unkeyed hash).
+ */
+export declare function computeAnonymousId(userId: string, env: PseudonymEnv): Promise<string>;
+//# sourceMappingURL=pseudonym.d.ts.map

package/dist/lib/pseudonym.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pseudonym.d.ts","sourceRoot":"","sources":["../../src/lib/pseudonym.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAE1D,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,UAAU,CAAC,CAAC;AAmBzB,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,IAAI,CAEpD;AAED,gEAAgE;AAChE,wBAAgB,wBAAwB,IAAI,IAAI,CAc/C;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/dist/lib/pseudonym.js

@@ -0,0 +1,85 @@
+/**
+ * Research pseudonym derivation.
+ *
+ * Computes `User.anonymousId`, a KEYED pseudonym derived from the user's
+ * immutable primary key. See `PSEUDONYM.md` (same directory) for the full
+ * design, rotation protocol, and security caveats. Summary:
+ *
+ *   anonymousId = base64( HMAC-SHA256( key, "trellis.user.pseudonym:" + userId ) )
+ *
+ *   - DOMAIN SEPARATION: the constant prefix `trellis.user.pseudonym:` scopes
+ *     the MAC so the same KMS key reused for another purpose can never collide
+ *     with a user pseudonym.
+ *   - INPUT is `user.id` (the immutable cuid PK) ONLY. We NEVER hash PII
+ *     (email / cognitoSub / handle) — those are mutable and dictionary-
+ *     reversible.
+ *   - KEY is a KMS HMAC key (HMAC_SHA_256). The key lives in a FIPS HSM and
+ *     never leaves KMS; we call `GenerateMac` so plaintext key material is
+ *     never in this process. SSM SecureString is only a documented fallback
+ *     (see PSEUDONYM.md) — we do NOT default to it here.
+ *   - FAIL-SAFE: if no KMS HMAC key id is configured, this THROWS. Callers
+ *     that populate anonymousId opportunistically (e.g. account creation)
+ *     should catch + skip population rather than fall back to an unkeyed hash.
+ *     An unkeyed SHA-256 of the PK would be trivially recomputable by anyone
+ *     with the (public-ish) cuid, defeating pseudonymisation.
+ */
+/** Domain-separation prefix. Changing this re-keys every pseudonym. */
+export const PSEUDONYM_DOMAIN = "trellis.user.pseudonym:";
+let macComputer = async (kmsKeyId, region, message) => {
+    // Dynamic import: only loaded when a KMS key is actually configured.
+    const { KMSClient, GenerateMacCommand } = await import("@aws-sdk/client-kms");
+    const client = new KMSClient({ region });
+    const out = await client.send(new GenerateMacCommand({
+        KeyId: kmsKeyId,
+        MacAlgorithm: "HMAC_SHA_256",
+        Message: message,
+    }));
+    if (!out.Mac) {
+        throw new Error("KMS GenerateMac returned no MAC");
+    }
+    return out.Mac;
+};
+/** Wire a custom MAC computer (production override / tests). */
+export function setMacComputer(fn) {
+    macComputer = fn;
+}
+/** Reset to the default AWS-SDK-backed computer (test-only). */
+export function _resetMacComputerForTest() {
+    macComputer = async (kmsKeyId, region, message) => {
+        const { KMSClient, GenerateMacCommand } = await import("@aws-sdk/client-kms");
+        const client = new KMSClient({ region });
+        const out = await client.send(new GenerateMacCommand({
+            KeyId: kmsKeyId,
+            MacAlgorithm: "HMAC_SHA_256",
+            Message: message,
+        }));
+        if (!out.Mac)
+            throw new Error("KMS GenerateMac returned no MAC");
+        return out.Mac;
+    };
+}
+/**
+ * Compute the keyed pseudonym for a user.
+ *
+ * @param userId the immutable `User.id` (cuid) PK. NEVER pass PII.
+ * @param env    resolves the KMS HMAC key id + region.
+ * @returns base64 of the HMAC-SHA256 MAC.
+ * @throws if no KMS HMAC key id is configured (fail-safe; do not fall back to
+ *   an unkeyed hash).
+ */
+export async function computeAnonymousId(userId, env) {
+    if (!userId || typeof userId !== "string") {
+        throw new Error("computeAnonymousId: userId must be a non-empty string");
+    }
+    const kmsKeyId = env.PSEUDONYM_HMAC_KMS_KEY_ID;
+    if (!kmsKeyId) {
+        // Fail-safe: never derive an unkeyed pseudonym.
+        throw new Error("PSEUDONYM_HMAC_KMS_KEY_ID not configured: cannot derive a keyed " +
+            "anonymousId. Refusing to fall back to an unkeyed hash.");
+    }
+    const region = env.AWS_REGION || process.env.AWS_REGION || "us-east-1";
+    const message = new TextEncoder().encode(PSEUDONYM_DOMAIN + userId);
+    const mac = await macComputer(kmsKeyId, region, message);
+    return Buffer.from(mac).toString("base64");
+}
+//# sourceMappingURL=pseudonym.js.map

package/dist/lib/pseudonym.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pseudonym.js","sourceRoot":"","sources":["../../src/lib/pseudonym.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAsB1D,IAAI,WAAW,GAAgB,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;IACjE,qEAAqE;IACrE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,kBAAkB,CAAC;QACrB,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,cAAc;QAC5B,OAAO,EAAE,OAAO;KACjB,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,EAAe;IAC5C,WAAW,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,wBAAwB;IACtC,WAAW,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,kBAAkB,CAAC;YACrB,KAAK,EAAE,QAAQ;YACf,YAAY,EAAE,cAAc;YAC5B,OAAO,EAAE,OAAO;SACjB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,GAAG,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,GAAiB;IAEjB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,gDAAgD;QAChD,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACvE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC"}

package/dist/lib/queue-consumers/media-reconciliation-consumer.d.ts

@@ -3,7 +3,7 @@
  *
  * Processes media reconciliation messages from the queue
  */
-import type { MessageBatch } from "../../types/cloudflare-compat";
-import type { MediaReconciliationMessage } from "../types/media-reconciliation";
+import type { MessageBatch } from "../../types/cloudflare-compat.js";
+import type { MediaReconciliationMessage } from "../types/media-reconciliation.js";
 export declare function handleMediaReconciliation(batch: MessageBatch<MediaReconciliationMessage>, env: any): Promise<void>;
 //# sourceMappingURL=media-reconciliation-consumer.d.ts.map

package/dist/lib/queue-consumers/media-reconciliation-consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-reconciliation-consumer.d.ts","sourceRoot":"","sources":["../../../src/lib/queue-consumers/media-reconciliation-consumer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAGlE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,YAAY,CAAC,0BAA0B,CAAC,EAC/C,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA8Bf"}
+{"version":3,"file":"media-reconciliation-consumer.d.ts","sourceRoot":"","sources":["../../../src/lib/queue-consumers/media-reconciliation-consumer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAGrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAEnF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,YAAY,CAAC,0BAA0B,CAAC,EAC/C,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/lib/queue-consumers/media-reconciliation-consumer.js

@@ -1,19 +1,16 @@
-"use strict";
 /**
  * Media Reconciliation Queue Consumer
  *
  * Processes media reconciliation messages from the queue
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleMediaReconciliation = handleMediaReconciliation;
-const logger_1 = require("../logger");
-const media_reconciliation_service_1 = require("../services/media-reconciliation-service");
-async function handleMediaReconciliation(batch, env) {
-    const logger = logger_1.Logger.getInstance(env);
+import { getLogger } from "../logger.js";
+import { MediaReconciliationService } from "../services/media-reconciliation-service.js";
+export async function handleMediaReconciliation(batch, env) {
+    const logger = getLogger();
     logger.info("[MediaReconciliationConsumer] Processing batch", {
         batchSize: batch.messages.length,
     });
-    const service = new media_reconciliation_service_1.MediaReconciliationService(env);
+    const service = new MediaReconciliationService(env);
     try {
         // Process all messages in batch
         const messages = batch.messages.map((m) => m.body);

package/dist/lib/queue-consumers/media-reconciliation-consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-reconciliation-consumer.js","sourceRoot":"","sources":["../../../src/lib/queue-consumers/media-reconciliation-consumer.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAOH,8DAiCC;AArCD,sCAAmC;AACnC,2FAAsF;AAG/E,KAAK,UAAU,yBAAyB,CAC7C,KAA+C,EAC/C,GAAQ;IAER,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;QAC5D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,yDAA0B,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvC,mBAAmB;QACnB,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SACjC,CAAC,CAAC;QAEH,wDAAwD;QACxD,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"media-reconciliation-consumer.js","sourceRoot":"","sources":["../../../src/lib/queue-consumers/media-reconciliation-consumer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAU,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAGzF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA+C,EAC/C,GAAQ;IAER,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;QAC5D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEvC,mBAAmB;QACnB,KAAK,CAAC,MAAM,EAAE,CAAC;QAEf,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,OAAO;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;SACjC,CAAC,CAAC;QAEH,wDAAwD;QACxD,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/lib/quiet-hours.js

@@ -1,13 +1,9 @@
-"use strict";
 /**
  * Quiet Hours Module
  *
  * Determines whether the current time falls within a user's quiet hours window.
  * Provides age-tier-based defaults for quiet hours configuration.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isInQuietHours = isInQuietHours;
-exports.getDefaultQuietHours = getDefaultQuietHours;
 /**
  * Returns true if nowMinutes falls within the quiet hours window.
  *
@@ -15,7 +11,7 @@ exports.getDefaultQuietHours = getDefaultQuietHours;
  * quiet hours are active when nowMinutes >= start OR nowMinutes < end.
  * Normal range (start < end): active when start <= nowMinutes < end.
  */
-function isInQuietHours(user, nowMinutes) {
+export function isInQuietHours(user, nowMinutes) {
     if (!user.quietHoursEnabled) {
         return false;
     }
@@ -38,7 +34,7 @@ function isInQuietHours(user, nowMinutes) {
  * TEEN: 22:00-07:00, enabled by default
  * ADULT: 23:00-06:00, disabled by default
  */
-function getDefaultQuietHours(ageTier) {
+export function getDefaultQuietHours(ageTier) {
     switch (ageTier) {
         case "CHILD":
             return { start: 1200, end: 420, enabled: true };

package/dist/lib/quiet-hours.js.map

@@ -1 +1 @@
-{"version":3,"file":"quiet-hours.js","sourceRoot":"","sources":["../../src/lib/quiet-hours.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAiBH,wCAsBC;AASD,oDAaC;AAnDD;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,IAAsB,EACtB,UAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAE/B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,0DAA0D;QAC1D,OAAO,UAAU,IAAI,KAAK,IAAI,UAAU,GAAG,GAAG,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,OAAO,UAAU,IAAI,KAAK,IAAI,UAAU,GAAG,GAAG,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IAKnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM;YACT,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;AACH,CAAC"}
+{"version":3,"file":"quiet-hours.js","sourceRoot":"","sources":["../../src/lib/quiet-hours.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAsB,EACtB,UAAkB;IAElB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAE/B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAChB,0DAA0D;QAC1D,OAAO,UAAU,IAAI,KAAK,IAAI,UAAU,GAAG,GAAG,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,OAAO,UAAU,IAAI,KAAK,IAAI,UAAU,GAAG,GAAG,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IAKnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM;YACT,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/lib/rate-limit.d.ts

@@ -1,93 +1,104 @@
-import type { KVNamespace } from "../types/cloudflare-compat";
+import type { KVNamespace } from "../types/cloudflare-compat.js";
+import { type LoggerEnv } from "./logger.js";
 /**
- * Rate Limiting
+ * Environment for the async (KV/Dynamo) path.
  *
- * Simple in-memory rate limiting using request identifiers.
- *
- * ⚠️ SECURITY NOTE: This in-memory implementation has limitations:
- * - Resets on worker restart (can be bypassed)
- * - Not shared across worker instances (DDoS vulnerability)
- * - Memory leak potential with no cleanup
- *
- * For production, migrate to:
- * - Cloudflare KV (recommended for distributed rate limiting)
- * - Durable Objects (for strict per-key rate limiting)
+ * `RATE_LIMIT_KV` is retained for backward compatibility with call sites and
+ * other consumers (e.g. user-deletion-handler-enhanced) that still reference
+ * the binding directly; it is no longer used by this limiter. The new
+ * token-bucket store is selected from `RATE_LIMIT_TABLE` / `RATE_LIMIT_NAMESPACE`.
  */
-import { type LoggerEnv } from "./logger";
 interface RateLimitEnv {
     RATE_LIMIT_KV?: KVNamespace;
+    /** DynamoDB table backing the token-bucket limiter. When absent, an in-memory limiter is used (dev/test). */
+    RATE_LIMIT_TABLE?: string;
+    /** Namespace prefix for token-bucket keys within the table. Defaults to "ratelimit". */
+    RATE_LIMIT_NAMESPACE?: string;
+    AWS_REGION?: string;
 }
+/** Test seam: reset the memoized module-level limiter between tests. */
+export declare function __resetRateLimiterForTests(): void;
+/**
+ * Build the canonical 429 Response. Shared by `RateLimiter` and
+ * `rateLimitMiddleware` so every rate-limited surface returns the same shape
+ * and headers (single source of truth after the limiter consolidation).
+ */
+export declare function buildRateLimitResponse(limit: number, retryAfter: number, resetAt: number): Response;
 /**
- * Rate Limiter class for managing rate limiting
+ * Rate Limiter class for managing rate limiting.
+ *
+ * Surface preserved for ~18 consumers: `checkRateLimit`, `applyRateLimit`,
+ * `checkRateLimitKV`, `applyRateLimitKV`, and the `getRateLimitKey`
+ * IP/user/email/endpoint composition.
  */
 export declare class RateLimiter {
     private rateLimitStore;
     /**
-     * Get identifier for rate limiting
-     *
-     * PREPARATORY CHANGE: Enhanced to prefer user ID over IP address for better privacy.
-     * This makes future privacy-preserving rate limiting easier to implement.
+     * Get identifier for rate limiting.
      *
      * Priority order (most privacy-preserving first):
-     * 1. User ID (if provided) - FUTURE USE: Most privacy-preserving for authenticated users
+     * 1. User ID (if provided) — most privacy-preserving for authenticated users
      * 2. Session ID (if authenticated)
      * 3. Email (for email-based endpoints like magic links)
      * 4. IP address (fallback for unauthenticated requests)
+     *
+     * NOTE: this composition is domain logic and is preserved verbatim from the
+     * fixed-window implementation. When no identity header is present the key
+     * collapses to "...:ip:unknown", which the foundation limiters treat via
+     * their `unknownKeyStrategy` ('shared-bucket' here).
      */
     private getRateLimitKey;
     /**
-     * Check rate limit (in-memory)
-     *
-     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     * Check rate limit (synchronous, in-memory token bucket).
      *
      * @param request Request object
      * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
-     * @param limit Maximum requests allowed
-     * @param windowSeconds Time window in seconds
+     * @param limit Maximum requests (token-bucket capacity)
+     * @param windowSeconds Time window in seconds (sets refillRate = limit/window)
      * @param sessionId Optional session ID for authenticated users
      * @param email Optional email for email-based endpoints
-     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
+     * @param userId Optional user ID (preferred key)
      * @returns Rate limit result
      */
     checkRateLimit(request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): {
         allowed: boolean;
         remaining: number;
         resetAt: number;
+        retryAfter?: number;
     };
     /**
-     * Apply rate limiting to a response (in-memory)
-     * Returns 429 if rate limit exceeded
-     *
-     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     * Apply rate limiting to a response (synchronous, in-memory).
+     * Returns a 429 Response if the limit is exceeded, else null.
      */
     applyRateLimit(request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Response | null;
     /**
-     * Check rate limit using Cloudflare KV (production-ready)
-     * Falls back to in-memory implementation if KV not available (dev mode)
+     * Check rate limit using the distributed token-bucket store (async).
      *
-     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
-     *
-     * @param env Environment with optional RATE_LIMIT_KV binding
-     * @param request Request object
-     * @param endpoint Endpoint identifier (e.g., '/auth/authorize')
-     * @param limit Maximum requests allowed
-     * @param windowSeconds Time window in seconds
-     * @param sessionId Optional session ID for authenticated users
-     * @param email Optional email for email-based endpoints
-     * @param userId Optional user ID (PREPARATORY: for future privacy-preserving rate limiting)
-     * @returns Rate limit result
+     * Selects a `DynamoTokenBucketLimiter` when `RATE_LIMIT_TABLE` is configured,
+     * otherwise a `MemoryTokenBucketLimiter` (dev/test). On limiter failure it
+     * falls back to the synchronous in-memory path (graceful degradation).
      */
     checkRateLimitKV(env: RateLimitEnv, request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Promise<{
         allowed: boolean;
         remaining: number;
         resetAt: number;
+        retryAfter?: number;
     }>;
     /**
-     * Apply rate limiting with KV support (production-ready)
-     * Returns 429 if rate limit exceeded
-     * Falls back to in-memory if KV unavailable
-     *
-     * PREPARATORY CHANGE: Added userId parameter for future privacy-preserving rate limiting.
+     * Distributed token-bucket check that **propagates** limiter errors instead
+     * of degrading to the in-memory path. For callers that implement their own
+     * failure policy — e.g. `rateLimitMiddleware`, which fails CLOSED on
+     * sensitive routes (S4.2) and OPEN elsewhere when the limiter is unreachable.
+     */
+    checkRateLimitKVStrict(env: RateLimitEnv, request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Promise<{
+        allowed: boolean;
+        remaining: number;
+        resetAt: number;
+        retryAfter?: number;
+    }>;
+    /**
+     * Apply rate limiting with the distributed store (async).
+     * Returns a 429 Response if the limit is exceeded, else null.
      */
     applyRateLimitKV(env: RateLimitEnv & LoggerEnv, request: Request, endpoint: string, limit: number, windowSeconds: number, sessionId?: string, email?: string, userId?: string): Promise<Response | null>;
 }

package/dist/lib/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,4BAA4B,CAAC;AACzF;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AASlD,UAAU,YAAY;IACpB,aAAa,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,WAAW;IAGtB,OAAO,CAAC,cAAc,CAAsB;IAE5C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;IA6CvB;;;;;;;;;;;;;OAaG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAoD3D;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI;IAmClB;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAyFpE;;;;;;OAMG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,GAAG,SAAS,EAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAmD5B"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AA0CjE,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAMxD;;;;;;;GAOG;AACH,UAAU,YAAY;IACpB,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,6GAA6G;IAC7G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAwED,wEAAwE;AACxE,wBAAgB,0BAA0B,IAAI,IAAI,CAGjD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,QAAQ,CAiBV;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IAEtB,OAAO,CAAC,cAAc,CAAsB;IAE5C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAwCvB;;;;;;;;;;;OAWG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IA6BhF;;;OAGG;IACH,cAAc,CACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI;IAwBlB;;;;;;OAMG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8BzF;;;;;OAKG;IACG,sBAAsB,CAC1B,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkBzF;;;OAGG;IACG,gBAAgB,CACpB,GAAG,EAAE,YAAY,GAAG,SAAS,EAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAsC5B"}