@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/reapproval/index.js

@@ -0,0 +1,3761 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/api/services/httpErrors.ts
+var ConflictError, NotFoundError, ValidationError;
+var init_httpErrors = __esm({
+  "lambdacode/api/services/httpErrors.ts"() {
+    "use strict";
+    ConflictError = class extends Error {
+    };
+    NotFoundError = class extends Error {
+    };
+    ValidationError = class extends Error {
+    };
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/manifest.ts
+var PLUGIN_PERMISSIONS, PLUGIN_MANIFEST_SCHEMA_VERSION, PLUGIN_HOST_API_VERSION, PLUGIN_ID_PATTERN, AWS_ACCOUNT_PATTERN;
+var init_manifest = __esm({
+  "../infra-client-plugin-sdk/src/contracts/manifest.ts"() {
+    "use strict";
+    PLUGIN_PERMISSIONS = ["user", "admin"];
+    PLUGIN_MANIFEST_SCHEMA_VERSION = 1;
+    PLUGIN_HOST_API_VERSION = 1;
+    PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+    AWS_ACCOUNT_PATTERN = /^\d{12}$/;
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/validate.ts
+var init_validate = __esm({
+  "../infra-client-plugin-sdk/src/contracts/validate.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/canonical.ts
+var init_canonical = __esm({
+  "../infra-client-plugin-sdk/src/contracts/canonical.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/paths.ts
+var init_paths = __esm({
+  "../infra-client-plugin-sdk/src/contracts/paths.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/access.ts
+function pluginTargetKey(target) {
+  return `${PLUGIN_TARGET_PREFIX}${target.pluginId}#${target.accountNumber}#${target.permission}`;
+}
+function parsePluginTargetKey(key) {
+  if (!key.startsWith(PLUGIN_TARGET_PREFIX)) return null;
+  const parts = key.slice(PLUGIN_TARGET_PREFIX.length).split("#");
+  if (parts.length !== 3) return null;
+  const [pluginId, accountNumber, permission] = parts;
+  if (!PLUGIN_ID_PATTERN.test(pluginId) || !AWS_ACCOUNT_PATTERN.test(accountNumber)) return null;
+  if (!PLUGIN_PERMISSIONS.includes(permission)) return null;
+  return { pluginId, accountNumber, permission };
+}
+function pluginPermissionsImpliedBy(granted, declared) {
+  if (!declared.includes(granted)) return [];
+  if (granted === "admin" && declared.includes("user")) return ["admin", "user"];
+  return [granted];
+}
+var PLUGIN_TARGET_PREFIX;
+var init_access = __esm({
+  "../infra-client-plugin-sdk/src/contracts/access.ts"() {
+    "use strict";
+    init_manifest();
+    PLUGIN_TARGET_PREFIX = "plugin#";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/catalog.ts
+function pluginCatalogStatus(record) {
+  if (!record.installed) return "removed";
+  if (record.schemaVersion !== PLUGIN_MANIFEST_SCHEMA_VERSION || record.manifest.hostApiVersion !== PLUGIN_HOST_API_VERSION) {
+    return "unsupported";
+  }
+  return record.manifest.enabled ? "active" : "disabled";
+}
+var init_catalog = __esm({
+  "../infra-client-plugin-sdk/src/contracts/catalog.ts"() {
+    "use strict";
+    init_manifest();
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/discovery.ts
+var init_discovery = __esm({
+  "../infra-client-plugin-sdk/src/contracts/discovery.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/authorizer.ts
+var init_authorizer = __esm({
+  "../infra-client-plugin-sdk/src/contracts/authorizer.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/backend/context.ts
+var init_context = __esm({
+  "../infra-client-plugin-sdk/src/backend/context.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/backend/index.ts
+var init_backend = __esm({
+  "../infra-client-plugin-sdk/src/backend/index.ts"() {
+    "use strict";
+    init_manifest();
+    init_validate();
+    init_canonical();
+    init_paths();
+    init_access();
+    init_catalog();
+    init_discovery();
+    init_authorizer();
+    init_context();
+  }
+});
+
+// lambdacode/api/services/access.ts
+function parsePrincipal(p) {
+  if (p.startsWith("user#")) return { kind: "user", userId: p.slice(5) };
+  if (p.startsWith("group#")) return { kind: "group", groupId: p.slice(6) };
+  return null;
+}
+function parseTarget(t) {
+  if (t.startsWith("role#")) {
+    const rest = t.slice(5);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "role", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  if (t.startsWith("resource#")) return { kind: "resource", resourceId: t.slice(9) };
+  if (t.startsWith("share#")) return { kind: "share", shareId: t.slice(6) };
+  if (t.startsWith("plugin#")) {
+    const p = parsePluginTargetKey(t);
+    return p ? { kind: "plugin", ...p } : null;
+  }
+  if (t.startsWith("member#")) return { kind: "member", groupId: t.slice(7) };
+  if (t.startsWith("pref#role#")) {
+    const rest = t.slice(10);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "pref", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  return null;
+}
+function isExpired(row, now = Date.now()) {
+  return Boolean(row.expiresAt) && !(Date.parse(row.expiresAt) > now);
+}
+async function getRow(principal, target, opts = {}) {
+  const res = await ddb.send(
+    new import_lib_dynamodb.GetCommand({ TableName: ACCESS_TABLE_NAME, Key: { principal, target }, ...consistentRead(opts) })
+  );
+  return res.Item;
+}
+async function queryPrincipal(principal, targetPrefix, opts = {}) {
+  const rows = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb.send(
+      new import_lib_dynamodb.QueryCommand({
+        TableName: ACCESS_TABLE_NAME,
+        KeyConditionExpression: targetPrefix ? "principal = :p AND begins_with(#t, :pre)" : "principal = :p",
+        ExpressionAttributeValues: {
+          ":p": principal,
+          ...targetPrefix ? { ":pre": targetPrefix } : {}
+        },
+        ...targetPrefix ? { ExpressionAttributeNames: { "#t": "target" } } : {},
+        ...consistentRead(opts),
+        ExclusiveStartKey
+      })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+async function queryTarget(target) {
+  const rows = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb.send(
+      new import_lib_dynamodb.QueryCommand({
+        TableName: ACCESS_TABLE_NAME,
+        IndexName: "byTarget",
+        KeyConditionExpression: "#t = :t",
+        ExpressionAttributeNames: { "#t": "target" },
+        ExpressionAttributeValues: { ":t": target },
+        ExclusiveStartKey
+      })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+async function scanAll(opts = {}) {
+  const rows = [];
+  const prefixes = opts.targetPrefixes ?? [];
+  const filter = prefixes.length ? {
+    FilterExpression: prefixes.map((_, i) => `begins_with(#t, :p${i})`).join(" OR "),
+    ExpressionAttributeNames: { "#t": "target" },
+    ExpressionAttributeValues: Object.fromEntries(prefixes.map((p, i) => [`:p${i}`, p]))
+  } : {};
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb.send(
+      new import_lib_dynamodb.ScanCommand({ TableName: ACCESS_TABLE_NAME, ExclusiveStartKey, ...filter })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+async function putRow(row) {
+  await ddb.send(new import_lib_dynamodb.PutCommand({ TableName: ACCESS_TABLE_NAME, Item: row }));
+}
+async function deleteRow(principal, target) {
+  try {
+    await ddb.send(
+      new import_lib_dynamodb.DeleteCommand({
+        TableName: ACCESS_TABLE_NAME,
+        Key: { principal, target },
+        ConditionExpression: "attribute_exists(principal)"
+      })
+    );
+    return true;
+  } catch (err) {
+    if (err.name === CONDITION_FAILED) return false;
+    throw err;
+  }
+}
+async function updateExisting(principal, target, set, remove = []) {
+  const names = {};
+  const values = {};
+  const sets = Object.entries(set).map(([k, v], i) => {
+    names[`#s${i}`] = k;
+    values[`:s${i}`] = v;
+    return `#s${i} = :s${i}`;
+  });
+  const removes = remove.map((k, i) => {
+    names[`#r${i}`] = k;
+    return `#r${i}`;
+  });
+  const expr = [
+    sets.length ? `SET ${sets.join(", ")}` : "",
+    removes.length ? `REMOVE ${removes.join(", ")}` : ""
+  ].filter(Boolean).join(" ");
+  if (!expr) return true;
+  try {
+    await ddb.send(
+      new import_lib_dynamodb.UpdateCommand({
+        TableName: ACCESS_TABLE_NAME,
+        Key: { principal, target },
+        UpdateExpression: expr,
+        ConditionExpression: "attribute_exists(principal)",
+        ExpressionAttributeNames: names,
+        ...Object.keys(values).length ? { ExpressionAttributeValues: values } : {}
+      })
+    );
+    return true;
+  } catch (err) {
+    if (err.name === CONDITION_FAILED) return false;
+    throw err;
+  }
+}
+async function upsertPref(userId, target, set, remove = []) {
+  const names = {};
+  const values = {};
+  const sets = Object.entries(set).map(([k, v], i) => {
+    names[`#s${i}`] = k;
+    values[`:s${i}`] = v;
+    return `#s${i} = :s${i}`;
+  });
+  const removes = remove.map((k, i) => {
+    names[`#r${i}`] = k;
+    return `#r${i}`;
+  });
+  const expr = [
+    sets.length ? `SET ${sets.join(", ")}` : "",
+    removes.length ? `REMOVE ${removes.join(", ")}` : ""
+  ].filter(Boolean).join(" ");
+  if (!expr) return;
+  await ddb.send(
+    new import_lib_dynamodb.UpdateCommand({
+      TableName: ACCESS_TABLE_NAME,
+      Key: { principal: userPrincipal(userId), target },
+      UpdateExpression: expr,
+      ExpressionAttributeNames: names,
+      ...Object.keys(values).length ? { ExpressionAttributeValues: values } : {}
+    })
+  );
+}
+async function membersOf(groupId) {
+  return (await queryTarget(memberTarget(groupId))).map((r) => parsePrincipal(r.principal)).filter((p) => p?.kind === "user").map((p) => p.userId);
+}
+function entryOf(target, direct, groups, now) {
+  const d = direct ? { grantedBy: direct.grantedBy, grantedAt: direct.grantedAt, expiresAt: direct.expiresAt } : void 0;
+  const directActive = Boolean(direct && !isExpired(direct, now));
+  const active = directActive || groups.length > 0;
+  return {
+    target,
+    direct: d,
+    groups,
+    active,
+    expiresAt: groups.length === 0 && directActive ? direct?.expiresAt : void 0
+  };
+}
+async function effectiveAccess(userId) {
+  const now = Date.now();
+  const own = await queryPrincipal(userPrincipal(userId));
+  const directByTarget = /* @__PURE__ */ new Map();
+  const groupIds = [];
+  for (const r of own) {
+    if (isGrantTarget(r.target)) directByTarget.set(r.target, r);
+    else if (r.target.startsWith("member#")) groupIds.push(r.target.slice("member#".length));
+  }
+  const groupsByTarget = /* @__PURE__ */ new Map();
+  for (const g of groupIds) {
+    for (const r of await queryPrincipal(groupPrincipal(g))) {
+      if (!isGrantTarget(r.target) || isExpired(r, now)) continue;
+      const list = groupsByTarget.get(r.target) ?? [];
+      list.push(g);
+      groupsByTarget.set(r.target, list);
+    }
+  }
+  const out = /* @__PURE__ */ new Map();
+  const targets = /* @__PURE__ */ new Set([...directByTarget.keys(), ...groupsByTarget.keys()]);
+  for (const t of targets) {
+    out.set(t, entryOf(t, directByTarget.get(t), groupsByTarget.get(t) ?? [], now));
+  }
+  return out;
+}
+async function batchGetAll(table, keys, opts = {}) {
+  const out = [];
+  for (let i = 0; i < keys.length; i += 100) {
+    let chunk = keys.slice(i, i + 100);
+    for (let attempt = 0; chunk.length; attempt++) {
+      if (attempt >= BATCH_GET_ATTEMPTS) {
+        throw new Error(`${table} BatchGet left ${chunk.length} keys unprocessed after ${attempt} attempts`);
+      }
+      if (attempt) await sleep(20 * attempt);
+      const res = await ddb.send(
+        new import_lib_dynamodb.BatchGetCommand({ RequestItems: { [table]: { Keys: chunk, ...consistentRead(opts) } } })
+      );
+      out.push(...res?.Responses?.[table] ?? []);
+      chunk = res?.UnprocessedKeys?.[table]?.Keys ?? [];
+    }
+  }
+  return out;
+}
+async function effectiveForMany(userId, targets, opts = {}) {
+  const out = /* @__PURE__ */ new Map();
+  const wanted = [...new Set(targets)];
+  if (!wanted.length) return out;
+  const [ownWanted, memberships] = await Promise.all([
+    batchGetAll(ACCESS_TABLE_NAME, wanted.map((target) => ({ principal: userPrincipal(userId), target })), opts),
+    queryPrincipal(userPrincipal(userId), "member#", opts)
+  ]);
+  const direct = new Map(ownWanted.map((r) => [r.target, r]));
+  const groupIds = memberships.map((r) => r.target.slice("member#".length));
+  const holding = /* @__PURE__ */ new Map();
+  const keys = groupIds.flatMap((g) => wanted.map((target) => ({ principal: groupPrincipal(g), target })));
+  for (const it of await batchGetAll(ACCESS_TABLE_NAME, keys, opts)) {
+    const row = it;
+    const p = parsePrincipal(row.principal);
+    if (p?.kind !== "group" || isExpired(row)) continue;
+    const list = holding.get(row.target) ?? [];
+    list.push(p.groupId);
+    holding.set(row.target, list);
+  }
+  const now = Date.now();
+  for (const t of wanted) {
+    const d = direct.get(t);
+    const g = holding.get(t) ?? [];
+    if (!d && !g.length) continue;
+    out.set(t, entryOf(t, d, g, now));
+  }
+  return out;
+}
+async function holdersOf(target) {
+  const rows = await queryTarget(target);
+  const byUser = /* @__PURE__ */ new Map();
+  const now = Date.now();
+  const ensure = (userId) => {
+    let h = byUser.get(userId);
+    if (!h) {
+      h = { userId, groups: [], active: false };
+      byUser.set(userId, h);
+    }
+    return h;
+  };
+  for (const r of rows) {
+    const p = parsePrincipal(r.principal);
+    if (p?.kind === "user") {
+      const h = ensure(p.userId);
+      h.direct = { grantedBy: r.grantedBy, grantedAt: r.grantedAt, expiresAt: r.expiresAt };
+      if (!isExpired(r, now)) h.active = true;
+    } else if (p?.kind === "group" && !isExpired(r, now)) {
+      for (const userId of await membersOf(p.groupId)) {
+        const h = ensure(userId);
+        h.groups.push(p.groupId);
+        h.active = true;
+      }
+    }
+  }
+  return [...byUser.values()];
+}
+function buildSnapshot(rows, now = Date.now()) {
+  const groupTargets = /* @__PURE__ */ new Map();
+  const groupMembers = /* @__PURE__ */ new Map();
+  const directRows = /* @__PURE__ */ new Map();
+  const userRows = [];
+  const presence = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const p = parsePrincipal(r.principal);
+    if (!p) continue;
+    if (p.kind === "user" && r.target === PRESENCE_TARGET) {
+      if (typeof r.lastSeenAt === "string") presence.set(p.userId, r.lastSeenAt);
+      continue;
+    }
+    if (p.kind === "group") {
+      if (!isGrantTarget(r.target) || isExpired(r, now)) continue;
+      const list = groupTargets.get(p.groupId) ?? [];
+      list.push(r.target);
+      groupTargets.set(p.groupId, list);
+    } else if (r.target.startsWith("member#")) {
+      const g = r.target.slice("member#".length);
+      const list = groupMembers.get(g) ?? [];
+      list.push(p.userId);
+      groupMembers.set(g, list);
+    } else if (isGrantTarget(r.target)) {
+      const m = directRows.get(p.userId) ?? /* @__PURE__ */ new Map();
+      m.set(r.target, r);
+      directRows.set(p.userId, m);
+      userRows.push(r);
+    }
+  }
+  const users = /* @__PURE__ */ new Map();
+  const groupsByUserTarget = /* @__PURE__ */ new Map();
+  for (const [g, members] of groupMembers) {
+    for (const u of members) {
+      const m = groupsByUserTarget.get(u) ?? /* @__PURE__ */ new Map();
+      for (const t of groupTargets.get(g) ?? []) {
+        const list = m.get(t) ?? [];
+        list.push(g);
+        m.set(t, list);
+      }
+      groupsByUserTarget.set(u, m);
+    }
+  }
+  const userIds = /* @__PURE__ */ new Set([...directRows.keys(), ...groupsByUserTarget.keys()]);
+  for (const u of userIds) {
+    const direct = directRows.get(u) ?? /* @__PURE__ */ new Map();
+    const viaGroups = groupsByUserTarget.get(u) ?? /* @__PURE__ */ new Map();
+    const targets = /* @__PURE__ */ new Set([...direct.keys(), ...viaGroups.keys()]);
+    const m = /* @__PURE__ */ new Map();
+    for (const t of targets) m.set(t, entryOf(t, direct.get(t), viaGroups.get(t) ?? [], now));
+    users.set(u, m);
+  }
+  return { users, groupTargets, groupMembers, userRows, presence };
+}
+async function snapshot() {
+  return buildSnapshot(await scanAll());
+}
+async function deleteShareRows(shareId, rows) {
+  const target = shareTarget(shareId);
+  const all = rows ?? await queryTarget(target);
+  const grants = all.filter((r) => r.target === target && r.principal !== SHARE_DEF_PRINCIPAL);
+  for (let i = 0; i < grants.length; i += DELETE_BATCH) {
+    await Promise.all(grants.slice(i, i + DELETE_BATCH).map((r) => deleteRow(r.principal, r.target)));
+  }
+  await deleteRow(SHARE_DEF_PRINCIPAL, target);
+}
+var import_client_dynamodb, import_lib_dynamodb, ddb, ACCESS_TABLE_NAME, CONDITION_FAILED, userPrincipal, groupPrincipal, roleTarget, resourceTarget, pluginTarget, shareTarget, SHARE_DEF_PRINCIPAL, memberTarget, groupTarget, PRESENCE_TARGET, ADMIN_REVIEW_TARGET, principalOf, isGrantTarget, consistentRead, BATCH_GET_ATTEMPTS, sleep, isShareDefRow, DELETE_BATCH;
+var init_access2 = __esm({
+  "lambdacode/api/services/access.ts"() {
+    "use strict";
+    import_client_dynamodb = require("@aws-sdk/client-dynamodb");
+    init_backend();
+    import_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
+    ddb = import_lib_dynamodb.DynamoDBDocumentClient.from(new import_client_dynamodb.DynamoDBClient({}));
+    ACCESS_TABLE_NAME = process.env.ACCESS_TABLE_NAME;
+    CONDITION_FAILED = "ConditionalCheckFailedException";
+    userPrincipal = (sub) => `user#${sub}`;
+    groupPrincipal = (groupId) => `group#${groupId}`;
+    roleTarget = (accountNumber, roleName) => `role#${accountNumber}#${roleName}`;
+    resourceTarget = (resourceId) => `resource#${resourceId}`;
+    pluginTarget = (pluginId, accountNumber, permission) => pluginTargetKey({ pluginId, accountNumber, permission });
+    shareTarget = (shareId) => `share#${shareId}`;
+    SHARE_DEF_PRINCIPAL = "sharedef";
+    memberTarget = (groupId) => `member#${groupId}`;
+    groupTarget = groupPrincipal;
+    PRESENCE_TARGET = "pref#presence";
+    ADMIN_REVIEW_TARGET = "pref#adminReview";
+    principalOf = (p) => p.kind === "user" ? userPrincipal(p.userId) : groupPrincipal(p.groupId);
+    isGrantTarget = (t) => t.startsWith("role#") || t.startsWith("resource#") || t.startsWith("share#") || t.startsWith("plugin#");
+    consistentRead = (opts) => opts.consistent ? { ConsistentRead: true } : {};
+    BATCH_GET_ATTEMPTS = 5;
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    isShareDefRow = (r) => r.principal === SHARE_DEF_PRINCIPAL && typeof r.shareId === "string" && typeof r.ownerSub === "string" && typeof r.port === "number" && typeof r.siteId === "string" && typeof r.expiresAt === "string";
+    DELETE_BATCH = 25;
+  }
+});
+
+// lambdacode/api/services/pluginCatalog.ts
+function isPluginCatalogRecord(item) {
+  if (!item || typeof item !== "object") return false;
+  const r = item;
+  const m = r.manifest;
+  return typeof r.pluginId === "string" && typeof r.schemaVersion === "number" && typeof r.installed === "boolean" && typeof r.revision === "string" && !!m && typeof m === "object" && m.id === r.pluginId && typeof m.enabled === "boolean" && typeof m.hostApiVersion === "number" && Array.isArray(m.accounts) && Array.isArray(m.permissions) && Array.isArray(r.routes);
+}
+function dynamoPluginCatalog(tableName2) {
+  const accept = (item) => {
+    if (isPluginCatalogRecord(item)) return item;
+    log("WARN: malformed plugin catalog record skipped", {
+      pluginId: item?.pluginId
+    });
+    return void 0;
+  };
+  return {
+    async list(opts = {}) {
+      const out = [];
+      let ExclusiveStartKey;
+      do {
+        const page = await ddb2.send(
+          new import_lib_dynamodb2.ScanCommand({ TableName: tableName2, ExclusiveStartKey, ...opts.consistent ? { ConsistentRead: true } : {} })
+        );
+        for (const item of page?.Items ?? []) {
+          const r = accept(item);
+          if (r) out.push(r);
+        }
+        ExclusiveStartKey = page?.LastEvaluatedKey;
+      } while (ExclusiveStartKey);
+      return out;
+    },
+    async get(pluginId, opts = {}) {
+      const res = await ddb2.send(
+        new import_lib_dynamodb2.GetCommand({
+          TableName: tableName2,
+          Key: { pluginId },
+          ...opts.consistent ? { ConsistentRead: true } : {}
+        })
+      );
+      return res.Item ? accept(res.Item) : void 0;
+    }
+  };
+}
+function pluginCatalog() {
+  const table = process.env.PLUGIN_CATALOG_TABLE_NAME;
+  return table ? dynamoPluginCatalog(table) : emptyPluginCatalog;
+}
+var import_client_dynamodb2, import_lib_dynamodb2, ddb2, emptyPluginCatalog, log;
+var init_pluginCatalog = __esm({
+  "lambdacode/api/services/pluginCatalog.ts"() {
+    "use strict";
+    import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb2 = require("@aws-sdk/lib-dynamodb");
+    ddb2 = import_lib_dynamodb2.DynamoDBDocumentClient.from(new import_client_dynamodb2.DynamoDBClient({}));
+    emptyPluginCatalog = {
+      async list() {
+        return [];
+      },
+      async get() {
+        return void 0;
+      }
+    };
+    log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+  }
+});
+
+// lambdacode/api/services/pluginAccess.ts
+function pluginAvailability(record, accountNumber, permission, registeredAccounts2) {
+  if (!record) return { available: false, reason: "plugin-unknown" };
+  const status = pluginCatalogStatus(record);
+  if (status !== "active") return { available: false, reason: `plugin-${status}` };
+  if (!record.manifest.permissions.some((p) => p.id === permission)) {
+    return { available: false, reason: "permission-undeclared" };
+  }
+  if (!record.manifest.accounts.some((a) => a.accountNumber === accountNumber)) {
+    return { available: false, reason: "account-unbound" };
+  }
+  if (!registeredAccounts2.has(accountNumber)) return { available: false, reason: "account-unregistered" };
+  return { available: true };
+}
+async function loadPluginContext(opts = {}) {
+  const records = await (opts.catalog ?? pluginCatalog()).list(opts);
+  const catalog2 = new Map(records.map((r) => [r.pluginId, r]));
+  const bound = /* @__PURE__ */ new Set();
+  for (const r of records) for (const a of r.manifest.accounts) bound.add(a.accountNumber);
+  return withAccounts(catalog2, await registeredAccounts([...bound], opts));
+}
+function withAccounts(catalog2, accounts) {
+  const accountNames = /* @__PURE__ */ new Map();
+  for (const [n, meta] of accounts) if (meta.name) accountNames.set(n, meta.name);
+  return { catalog: catalog2, registeredAccounts: new Set(accounts.keys()), accountNames };
+}
+function deriveCapabilities(pluginId, accountNumber, held, ctx) {
+  const record = ctx.catalog.get(pluginId);
+  const declared = record?.manifest.permissions.map((p) => p.id) ?? [];
+  const out = [];
+  for (const permission of PLUGIN_PERMISSIONS) {
+    const sources = [...held.values()].filter(
+      (s) => s.permission === permission || pluginPermissionsImpliedBy(s.permission, declared).includes(permission)
+    );
+    if (!sources.length) continue;
+    const a = pluginAvailability(record, accountNumber, permission, ctx.registeredAccounts);
+    out.push({ pluginId, accountNumber, permission, sources, ...a.available ? { available: true } : a });
+  }
+  return out;
+}
+function resolvePluginCapabilities(entries, ctx) {
+  const byBinding = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    if (!e.active) continue;
+    const p = parseTarget(e.target);
+    if (p?.kind !== "plugin") continue;
+    const key = `${p.pluginId}#${p.accountNumber}`;
+    const b = byBinding.get(key) ?? { pluginId: p.pluginId, accountNumber: p.accountNumber, held: /* @__PURE__ */ new Map() };
+    b.held.set(p.permission, sourceOf(p.permission, e.direct, e.groups));
+    byBinding.set(key, b);
+  }
+  const out = [];
+  for (const b of byBinding.values()) out.push(...deriveCapabilities(b.pluginId, b.accountNumber, b.held, ctx));
+  return out.sort(byBindingThenPermission);
+}
+function availableCapabilityKeys(capabilities) {
+  return new Set(capabilities.filter((c) => c.available).map((c) => pluginTarget(c.pluginId, c.accountNumber, c.permission)));
+}
+async function registeredAccounts(numbers, opts = {}) {
+  const out = /* @__PURE__ */ new Map();
+  const ids = [...new Set(numbers)];
+  if (!ids.length) return out;
+  const table = process.env.ACCOUNTS_TABLE_NAME;
+  if (!table) throw new Error("ACCOUNTS_TABLE_NAME is not set (plugin catalog readers need the Accounts table)");
+  for (const item of await batchGetAll(table, ids.map((accountNumber) => ({ accountNumber })), opts)) {
+    out.set(item.accountNumber, { name: item.name || void 0 });
+  }
+  return out;
+}
+var sourceOf, byBindingThenPermission;
+var init_pluginAccess = __esm({
+  "lambdacode/api/services/pluginAccess.ts"() {
+    "use strict";
+    init_backend();
+    init_access2();
+    init_pluginCatalog();
+    sourceOf = (permission, direct, groups) => ({
+      permission,
+      ...direct && !isExpired(direct) ? { direct } : {},
+      groups
+    });
+    byBindingThenPermission = (a, b) => a.pluginId.localeCompare(b.pluginId) || a.accountNumber.localeCompare(b.accountNumber) || PLUGIN_PERMISSIONS.indexOf(a.permission) - PLUGIN_PERMISSIONS.indexOf(b.permission);
+  }
+});
+
+// lambdacode/api/services/revocationsService.ts
+function noticeItem(userId, input, revokedAt) {
+  return {
+    userId,
+    // Timestamp-first sort key: a plain descending Query returns
+    // newest-first without a GSI.
+    noticeId: `${revokedAt}#${(0, import_crypto.randomUUID)().slice(0, 8)}`,
+    change: input.change ?? "REVOKED",
+    kind: input.kind,
+    ...input.accountNumber ? { accountNumber: input.accountNumber } : {},
+    ...input.roleName ? { roleName: input.roleName } : {},
+    ...input.resourceId ? { resourceId: input.resourceId } : {},
+    ...input.resourceName ? { resourceName: input.resourceName } : {},
+    ...input.pluginId ? { pluginId: input.pluginId } : {},
+    ...input.permission ? { permission: input.permission } : {},
+    ...input.pluginName ? { pluginName: input.pluginName } : {},
+    ...input.count ? { count: input.count } : {},
+    ...input.groupId ? { groupId: input.groupId } : {},
+    ...input.groupName ? { groupName: input.groupName } : {},
+    revokedAt,
+    via: input.via,
+    seen: false,
+    ttl: Math.floor(Date.now() / 1e3) + NOTICE_RETENTION_DAYS * 24 * 60 * 60
+  };
+}
+async function recordRevocations(notices) {
+  if (!REVOCATIONS_TABLE_NAME) return;
+  const items = notices.filter((n) => n.userId).map((n) => noticeItem(n.userId, n.input, (/* @__PURE__ */ new Date()).toISOString()));
+  for (let i = 0; i < items.length; i += 25) {
+    let requests = items.slice(i, i + 25).map((Item) => ({ PutRequest: { Item } }));
+    try {
+      for (let attempt = 0; attempt < 3 && requests.length; attempt++) {
+        const res = await ddb3.send(new import_lib_dynamodb3.BatchWriteCommand({ RequestItems: { [REVOCATIONS_TABLE_NAME]: requests } }));
+        requests = res.UnprocessedItems?.[REVOCATIONS_TABLE_NAME] ?? [];
+      }
+      if (requests.length) log2("access notices left unprocessed", { count: requests.length });
+    } catch (err) {
+      log2("access notice batch write failed", { count: requests.length, error: err.message });
+    }
+  }
+  if (items.length) log2("recorded access notices", { count: items.length });
+}
+var import_crypto, import_client_dynamodb3, import_lib_dynamodb3, ddb3, REVOCATIONS_TABLE_NAME, log2, NOTICE_RETENTION_DAYS;
+var init_revocationsService = __esm({
+  "lambdacode/api/services/revocationsService.ts"() {
+    "use strict";
+    import_crypto = require("crypto");
+    import_client_dynamodb3 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb3 = require("@aws-sdk/lib-dynamodb");
+    ddb3 = import_lib_dynamodb3.DynamoDBDocumentClient.from(new import_client_dynamodb3.DynamoDBClient({}));
+    REVOCATIONS_TABLE_NAME = process.env.REVOCATIONS_TABLE_NAME;
+    log2 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    NOTICE_RETENTION_DAYS = 30;
+  }
+});
+
+// lambdacode/api/services/actorContext.ts
+function runAsActor(actor, fn) {
+  return store.run(actor, fn);
+}
+function currentActor() {
+  return store.getStore();
+}
+var import_async_hooks, store, systemActor;
+var init_actorContext = __esm({
+  "lambdacode/api/services/actorContext.ts"() {
+    "use strict";
+    import_async_hooks = require("async_hooks");
+    store = new import_async_hooks.AsyncLocalStorage();
+    systemActor = (job, name) => ({
+      kind: "system",
+      id: `system:${job}`,
+      name: name ?? job
+    });
+  }
+});
+
+// lambdacode/api/services/auditService.ts
+function retentionDays() {
+  const n = Number(process.env.AUDIT_RETENTION_DAYS);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_RETENTION_DAYS;
+}
+function tableOr() {
+  const table = tableName();
+  if (table) return table;
+  if (!warnedNoTable) {
+    warnedNoTable = true;
+    log3("WARN: AUDIT_TABLE_NAME unset \u2014 activity is not recorded");
+  }
+  return void 0;
+}
+function compact(value) {
+  if (Array.isArray(value)) return value.map(compact);
+  if (value && typeof value === "object" && !(value instanceof Set)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v !== void 0) out[k] = compact(v);
+    }
+    return out;
+  }
+  return value;
+}
+function toRow(input, now) {
+  const bound = input.actor ?? currentActor();
+  if (!bound) log3("ERROR: activity row without a bound actor (missing runAsActor?)", { action: input.action, target: input.target });
+  const actor = bound ?? UNKNOWN_ACTOR;
+  const details = input.details ? { ...input.details } : void 0;
+  if (details?.note !== void 0) details.note = String(details.note).slice(0, NOTE_MAX);
+  if (details?.affected && details.affected.length > AFFECTED_CAP) {
+    details.affectedCount = details.affected.length;
+    details.affected = details.affected.slice(0, AFFECTED_CAP);
+  }
+  if (details?.unchanged && details.unchanged.length > AFFECTED_CAP) {
+    details.unchangedCount = details.unchanged.length;
+    details.unchanged = details.unchanged.slice(0, AFFECTED_CAP);
+  }
+  const accountNumber = input.accountNumber ?? accountOf(input.target);
+  return compact({
+    ...input,
+    eventId: (0, import_crypto2.randomUUID)(),
+    outcome: input.outcome ?? "OK",
+    reason: input.reason === void 0 ? void 0 : String(input.reason).slice(0, REASON_MAX),
+    actor: { kind: actor.kind, id: actor.id, name: actor.name, claims: actor.claims && Object.keys(actor.claims).length ? actor.claims : void 0 },
+    accountNumber,
+    details,
+    at: now.toISOString(),
+    day: now.toISOString().slice(0, 10),
+    userId: input.subject?.id,
+    actorId: SESSION_ACTIONS.has(input.action) && input.subject?.kind === "user" ? input.subject.id : actor.id,
+    expiresAt: Math.floor(now.getTime() / 1e3) + retentionDays() * 24 * 60 * 60
+  });
+}
+function accountOf(target) {
+  if (!target) return void 0;
+  const p = parseTarget(target);
+  if (p?.kind === "role" || p?.kind === "plugin") return p.accountNumber;
+  if (target.startsWith("account#")) return target.slice("account#".length);
+  return void 0;
+}
+async function recordEvent(input) {
+  const table = tableOr();
+  if (!table) return;
+  const row = toRow(input, /* @__PURE__ */ new Date());
+  try {
+    await ddb4.send(new import_lib_dynamodb4.PutCommand({ TableName: table, Item: row }));
+    log3("activity recorded", { action: row.action, outcome: row.outcome, actor: row.actorId, subject: row.userId, target: row.target, eventId: row.eventId });
+  } catch (err) {
+    log3("ERROR: activity write failed (mutation unaffected)", { action: row.action, target: row.target, error: err.message });
+  }
+}
+async function recordEvents(inputs) {
+  if (!inputs.length) return;
+  const table = tableOr();
+  if (!table) return;
+  const start = Date.now();
+  const rows = inputs.map((input, i) => toRow(input, new Date(start + i)));
+  for (let i = 0; i < rows.length; i += 25) {
+    let requests = rows.slice(i, i + 25).map((Item) => ({ PutRequest: { Item } }));
+    try {
+      for (let attempt = 0; attempt < 3 && requests.length; attempt++) {
+        const res = await ddb4.send(new import_lib_dynamodb4.BatchWriteCommand({ RequestItems: { [table]: requests } }));
+        requests = res.UnprocessedItems?.[table] ?? [];
+      }
+      if (requests.length) log3("ERROR: activity batch left unprocessed rows", { count: requests.length });
+    } catch (err) {
+      log3("ERROR: activity batch write failed (mutation unaffected)", { count: requests.length, error: err.message });
+    }
+  }
+  log3("activity batch recorded", { count: rows.length, actions: [...new Set(rows.map((r) => r.action))] });
+}
+var import_crypto2, import_client_dynamodb4, import_lib_dynamodb4, ddb4, tableName, log3, DEFAULT_RETENTION_DAYS, REASON_MAX, NOTE_MAX, AFFECTED_CAP, DAY_MS, newBatchId, UNKNOWN_ACTOR, warnedNoTable, SESSION_ACTIONS;
+var init_auditService = __esm({
+  "lambdacode/api/services/auditService.ts"() {
+    "use strict";
+    import_crypto2 = require("crypto");
+    import_client_dynamodb4 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb4 = require("@aws-sdk/lib-dynamodb");
+    init_actorContext();
+    init_access2();
+    ddb4 = import_lib_dynamodb4.DynamoDBDocumentClient.from(new import_client_dynamodb4.DynamoDBClient({}));
+    tableName = () => process.env.AUDIT_TABLE_NAME ?? "";
+    log3 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    DEFAULT_RETENTION_DAYS = 400;
+    REASON_MAX = 300;
+    NOTE_MAX = 500;
+    AFFECTED_CAP = 50;
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    newBatchId = () => (0, import_crypto2.randomUUID)();
+    UNKNOWN_ACTOR = { kind: "system", id: "system:unknown" };
+    warnedNoTable = false;
+    SESSION_ACTIONS = /* @__PURE__ */ new Set(["vpn.connect", "vpn.disconnect"]);
+  }
+});
+
+// lambdacode/api/services/accessNotices.ts
+async function activeTargets(userId, plugins = loadPluginContext) {
+  const entries = await effectiveAccess(userId);
+  const out = /* @__PURE__ */ new Set();
+  const pluginEntries = [];
+  for (const [t, e] of entries) {
+    if (!e.active) continue;
+    if (parseTarget(t)?.kind === "plugin") pluginEntries.push(e);
+    else out.add(t);
+  }
+  if (pluginEntries.length) {
+    for (const k of availableCapabilityKeys(resolvePluginCapabilities(pluginEntries, await plugins()))) out.add(k);
+  }
+  return out;
+}
+async function mapLimit(items, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    for (let i = next++; i < items.length; i = next++) out[i] = await fn(items[i]);
+  };
+  await Promise.all(Array.from({ length: Math.min(DIFF_CONCURRENCY, items.length) }, worker));
+  return out;
+}
+function affectedOf(changes, only = {}) {
+  const out = [];
+  for (const c of changes) {
+    for (const [change, targets] of [["gained", c.gained], ["lost", c.lost]]) {
+      if (only.change && only.change !== change) continue;
+      for (const t of targets) {
+        if (only.target && only.target !== t) continue;
+        out.push({ userId: c.userId, change, target: t });
+      }
+    }
+  }
+  return out;
+}
+function unchangedOf(changes, only = {}) {
+  const moved = (c) => {
+    const lists = only.change === "gained" ? [c.gained] : only.change === "lost" ? [c.lost] : [c.gained, c.lost];
+    return lists.some((l) => only.target ? l.includes(only.target) : l.length > 0);
+  };
+  return changes.filter((c) => !moved(c)).map((c) => ({ userId: c.userId }));
+}
+async function activeAmong(userId, targets) {
+  const out = /* @__PURE__ */ new Set();
+  for (const [t, e] of await effectiveForMany(userId, targets)) if (e.active) out.add(t);
+  return out;
+}
+async function withAccessDiff(userIds, via, mutate, resourceNames, opts = {}) {
+  const users = [...new Set(userIds)].filter(Boolean);
+  const scoped = opts.targets?.length ? [...new Set(opts.targets)] : void 0;
+  const narrow = scoped !== void 0 && scoped.length <= NARROW_MAX_TARGETS && !scoped.some((t) => parseTarget(t)?.kind === "plugin");
+  const read = (u, plugins) => narrow ? activeAmong(u, scoped) : activeTargets(u, plugins);
+  const pluginsBefore = memo(() => loadPluginContext());
+  const before = /* @__PURE__ */ new Map();
+  for (const [i, set] of (await mapLimit(users, (u) => read(u, pluginsBefore))).entries()) before.set(users[i], set);
+  const result = await mutate();
+  const pluginsAfter = opts.catalogChanges ? memo(() => loadPluginContext({ consistent: true })) : pluginsBefore;
+  const batchId = opts.batchId ?? newBatchId();
+  const changes = [];
+  const derived = [];
+  const notices = [];
+  const afterSets = await mapLimit(users, (u) => read(u, pluginsAfter));
+  const shareLabel = memoBy(
+    async (shareId, t) => resourceNames?.get(shareId) ?? (await getRow(SHARE_DEF_PRINCIPAL, t))?.label
+  );
+  const pluginName = memoBy(async (pluginId) => {
+    const record = (await pluginsAfter()).catalog.get(pluginId) ?? (await pluginsBefore()).catalog.get(pluginId);
+    return record?.manifest.displayName;
+  });
+  for (const [i, u] of users.entries()) {
+    const after = afterSets[i];
+    const change = { userId: u, gained: [], lost: [], after };
+    for (const t of after) if (!before.get(u).has(t)) change.gained.push(t);
+    for (const t of before.get(u)) if (!after.has(t)) change.lost.push(t);
+    const notice = async (t, kind) => {
+      const parsed = parseTarget(t);
+      let input;
+      if (parsed?.kind === "role") {
+        input = { change: kind, kind: "ROLE", accountNumber: parsed.accountNumber, roleName: parsed.roleName, via };
+      } else if (parsed?.kind === "resource") {
+        input = { change: kind, kind: "RESOURCE", resourceId: parsed.resourceId, resourceName: resourceNames?.get(parsed.resourceId), via };
+      } else if (parsed?.kind === "share") {
+        input = { change: kind, kind: "SHARE", resourceId: parsed.shareId, resourceName: await shareLabel(parsed.shareId, t), via };
+      } else if (parsed?.kind === "plugin") {
+        input = {
+          change: kind,
+          kind: "PLUGIN",
+          pluginId: parsed.pluginId,
+          accountNumber: parsed.accountNumber,
+          permission: parsed.permission,
+          pluginName: await pluginName(parsed.pluginId),
+          via
+        };
+      }
+      if (input) notices.push({ userId: u, input });
+    };
+    const noticeAll = async (targets, kind) => {
+      if (bundled(via, targets)) {
+        notices.push({
+          userId: u,
+          input: {
+            change: kind,
+            kind: "BUNDLE",
+            count: targets.length,
+            ...opts.groupId ? { groupId: opts.groupId } : {},
+            ...opts.groupName ? { groupName: opts.groupName } : {},
+            via
+          }
+        });
+        return;
+      }
+      for (const t of targets) await notice(t, kind);
+    };
+    await noticeAll(change.lost, "REVOKED");
+    if (opts.gainNotices !== false) await noticeAll(change.gained, "GRANTED");
+    changes.push(change);
+    if (opts.derived !== false) {
+      for (const [list, action] of [
+        [change.gained, "access.gain"],
+        [change.lost, "access.lose"]
+      ]) {
+        const groupDetails = {
+          ...opts.groupId ? { groupId: opts.groupId } : {},
+          ...opts.groupName ? { groupName: opts.groupName } : {}
+        };
+        if (bundled(via, list)) {
+          derived.push({
+            category: "access",
+            action,
+            subject: { kind: "user", id: u },
+            details: { via, batchId, count: list.length, ...groupDetails },
+            derived: true
+          });
+          continue;
+        }
+        for (const t of list) {
+          derived.push({
+            category: "access",
+            action,
+            subject: { kind: "user", id: u },
+            target: t,
+            targetName: targetLabel(t, resourceNames),
+            details: { via, batchId, ...groupDetails },
+            derived: true
+          });
+        }
+      }
+    }
+  }
+  await recordRevocations(notices);
+  await recordEvents(derived);
+  opts.onDiff?.(changes);
+  if (notices.length || derived.length) log4("access diff", { via, users: users.length, notices: notices.length, derived: derived.length });
+  return result;
+}
+function memoBy(load) {
+  const cache = /* @__PURE__ */ new Map();
+  return (...args) => {
+    const k = args[0];
+    let p = cache.get(k);
+    if (!p) {
+      p = load(...args);
+      cache.set(k, p);
+    }
+    return p;
+  };
+}
+function targetLabel(target, names) {
+  const p = parseTarget(target);
+  if (p?.kind === "role") return p.roleName;
+  if (p?.kind === "resource") return names?.get(p.resourceId);
+  if (p?.kind === "share") return names?.get(p.shareId);
+  return void 0;
+}
+var log4, memo, DIFF_CONCURRENCY, NARROW_MAX_TARGETS, NOTICE_BUNDLE_THRESHOLD, BUNDLED_VIAS, bundled;
+var init_accessNotices = __esm({
+  "lambdacode/api/services/accessNotices.ts"() {
+    "use strict";
+    init_access2();
+    init_pluginAccess();
+    init_revocationsService();
+    init_auditService();
+    log4 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    memo = (load) => {
+      let p;
+      return () => p ??= load();
+    };
+    DIFF_CONCURRENCY = 8;
+    NARROW_MAX_TARGETS = 100;
+    NOTICE_BUNDLE_THRESHOLD = 5;
+    BUNDLED_VIAS = /* @__PURE__ */ new Set(["GROUP", "CASCADE"]);
+    bundled = (via, targets) => BUNDLED_VIAS.has(via) && targets.length > NOTICE_BUNDLE_THRESHOLD;
+  }
+});
+
+// lambdacode/api/services/grantsService.ts
+async function revokeDirectRow(userId, target, via, row, resourceNames) {
+  let stillHeld = false;
+  const removed = await withAccessDiff([userId], via, () => deleteRow(userPrincipal(userId), target), resourceNames, {
+    derived: false,
+    // No loss means something else still covers the target (a group; for plugins an admin row) — or the row
+    // had already expired; the diff's after-set tells them apart so the flag never claims access that isn't there.
+    onDiff: (changes) => {
+      stillHeld = changes.some((c) => c.userId === userId && c.after.has(target));
+    }
+  });
+  if (!removed) return false;
+  if (via !== "REAPPROVAL") await clearPendingReviews(userId, target);
+  const groups = stillHeld ? (await effectiveAccess(userId)).get(target)?.groups ?? [] : [];
+  const stillHeldVia = stillHeld ? groups.length ? groups : true : void 0;
+  await recordEvent({
+    category: "access",
+    ...row,
+    subject: { kind: "user", id: userId },
+    target,
+    details: { via, ...stillHeldVia ? { stillHeldVia } : {} }
+  });
+  return true;
+}
+async function clearPendingReviews(userId, target, targets) {
+  const { deleteRequestsForUser: deleteRequestsForUser2 } = (init_requestsService(), __toCommonJS(requestsService_exports));
+  await deleteRequestsForUser2(userId, { onlyPending: true, onlyReviews: true, target, targets });
+}
+async function assertRoleExists(accountNumber, roleName) {
+  const role = await ddb5.send(
+    new import_lib_dynamodb5.GetCommand({ TableName: ROLES_TABLE_NAME, Key: { accountNumber, roleName } })
+  );
+  if (!role.Item) {
+    throw new NotFoundError(`Role ${roleName} not found in account ${accountNumber}`);
+  }
+}
+async function assignRole(accountNumber, roleName, userId, grantedBy, expiresAt, opts) {
+  await assertRoleExists(accountNumber, roleName);
+  const target = roleTarget(accountNumber, roleName);
+  if (expiresAt) {
+    const existing = await getRow(userPrincipal(userId), target);
+    if (existing && !existing.expiresAt) {
+      log5("kept long-term grant (no downgrade)", { userId, accountNumber, roleName, requestedExpiresAt: expiresAt });
+      return { userId, accountNumber, roleName };
+    }
+  }
+  await withAccessDiff(
+    [userId],
+    "ADMIN",
+    () => putRow({
+      principal: userPrincipal(userId),
+      target,
+      grantedBy,
+      grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...expiresAt ? { expiresAt } : {}
+    }),
+    void 0,
+    { derived: false, gainNotices: !opts?.fromRequestId }
+  );
+  await recordEvent({
+    category: "access",
+    action: "role.grant",
+    subject: { kind: "user", id: userId },
+    target,
+    targetName: roleName,
+    details: { expiresAt, requestId: opts?.fromRequestId }
+  });
+  log5("assigned role", { userId, accountNumber, roleName, grantedBy, expiresAt });
+  return { userId, accountNumber, roleName, expiresAt };
+}
+async function renewRole(accountNumber, roleName, userId, grantedBy, opts) {
+  const target = roleTarget(accountNumber, roleName);
+  const renewed = await updateExisting(userPrincipal(userId), target, {
+    grantedBy,
+    grantedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (!renewed) {
+    throw new ConflictError(`${userId} no longer holds ${roleName} in ${accountNumber} \u2014 there is nothing to renew`);
+  }
+  await recordEvent({
+    category: "access",
+    action: "role.grant",
+    subject: { kind: "user", id: userId },
+    target,
+    targetName: roleName,
+    details: { requestId: opts?.fromRequestId, renewed: true }
+  });
+  log5("renewed role", { userId, accountNumber, roleName, grantedBy });
+}
+async function revokeRole(accountNumber, roleName, userId, via = "ADMIN") {
+  const target = roleTarget(accountNumber, roleName);
+  const removed = await revokeDirectRow(userId, target, via, { action: "role.revoke", targetName: roleName });
+  if (!removed) {
+    throw new NotFoundError(`No grant for user ${userId} on ${roleName} in ${accountNumber}`);
+  }
+  log5("revoked role", { userId, accountNumber, roleName });
+}
+async function listUserGrants(userId) {
+  const out = [];
+  for (const [t, e] of await effectiveAccess(userId)) {
+    const p = parseTarget(t);
+    if (p?.kind !== "role") continue;
+    out.push({
+      accountNumber: p.accountNumber,
+      roleName: p.roleName,
+      grantedBy: e.direct?.grantedBy,
+      grantedAt: e.direct?.grantedAt,
+      // Effective expiry: a temporary direct grant with a group behind it is
+      // long-term in practice, so no expiry is reported.
+      expiresAt: e.groups.length ? void 0 : e.direct?.expiresAt,
+      viaGroup: e.direct ? void 0 : e.groups[0],
+      viaGroups: e.groups
+    });
+  }
+  return out;
+}
+async function revokeAllForUser(userId) {
+  const rows = await queryPrincipal(userPrincipal(userId));
+  for (const r of rows) await deleteRow(r.principal, r.target);
+  if (rows.length) log5("removed all access rows for deleted user", { userId, removed: rows.length });
+  return rows.length;
+}
+var import_client_dynamodb5, import_lib_dynamodb5, ddb5, ROLES_TABLE_NAME, log5, EXPIRING_WINDOW_MS;
+var init_grantsService = __esm({
+  "lambdacode/api/services/grantsService.ts"() {
+    "use strict";
+    import_client_dynamodb5 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb5 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    ddb5 = import_lib_dynamodb5.DynamoDBDocumentClient.from(new import_client_dynamodb5.DynamoDBClient({}));
+    ROLES_TABLE_NAME = process.env.ROLES_TABLE_NAME;
+    log5 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    EXPIRING_WINDOW_MS = 24 * 60 * 60 * 1e3;
+  }
+});
+
+// lambdacode/api/services/accountOrder.ts
+function compareAccounts(a, b) {
+  const ao = order(a.sortOrder);
+  const bo = order(b.sortOrder);
+  if (ao !== bo) return ao - bo;
+  const an = text(a.name);
+  const bn = text(b.name);
+  if (!!an !== !!bn) return an ? -1 : 1;
+  return an.localeCompare(bn) || String(a.accountNumber).localeCompare(String(b.accountNumber));
+}
+function compareRoles(a, b) {
+  const ao = order(a.sortOrder);
+  const bo = order(b.sortOrder);
+  if (ao !== bo) return ao - bo;
+  const al = text(a.displayName) || String(a.roleName);
+  const bl = text(b.displayName) || String(b.roleName);
+  return al.localeCompare(bl) || String(a.roleName).localeCompare(String(b.roleName));
+}
+var text, order;
+var init_accountOrder = __esm({
+  "lambdacode/api/services/accountOrder.ts"() {
+    "use strict";
+    text = (v) => typeof v === "string" ? v : "";
+    order = (v) => typeof v === "number" && Number.isFinite(v) ? v : Number.MAX_SAFE_INTEGER;
+  }
+});
+
+// lambdacode/api/services/dimensions.ts
+function cleanDims(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const o = input;
+  const pick = (k) => typeof o[k] === "string" && o[k].trim() ? o[k].trim() : void 0;
+  const tenant = pick("tenant");
+  const stage = pick("stage");
+  const project = pick("project");
+  if (!tenant || !stage) return void 0;
+  return { tenant, stage, ...project ? { project } : {} };
+}
+var init_dimensions = __esm({
+  "lambdacode/api/services/dimensions.ts"() {
+    "use strict";
+  }
+});
+
+// lambdacode/api/services/catalogIndex.ts
+async function readVersion() {
+  const res = await ddb6.send(
+    new import_lib_dynamodb6.GetCommand({ TableName: RESOURCES_TABLE_NAME, Key: { resourceId: CATALOG_VERSION_KEY }, ConsistentRead: true })
+  );
+  const v = res?.Item?.version;
+  return typeof v === "number" ? v : void 0;
+}
+async function scanAll2(TableName) {
+  const items = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb6.send(new import_lib_dynamodb6.ScanCommand({ TableName, ExclusiveStartKey, ConsistentRead: true }));
+    items.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return items;
+}
+async function build(version) {
+  const started = Date.now();
+  const [accountItems, roleItems, groupItems] = await Promise.all([
+    scanAll2(ACCOUNTS_TABLE_NAME),
+    scanAll2(ROLES_TABLE_NAME2),
+    scanAll2(GROUPS_TABLE_NAME)
+  ]);
+  const byNumber = /* @__PURE__ */ new Map();
+  for (const a of accountItems) {
+    const accountNumber = String(a.accountNumber);
+    byNumber.set(accountNumber, {
+      accountNumber,
+      name: str(a.name),
+      environment: str(a.environment),
+      status: str(a.status),
+      profileName: str(a.profileName),
+      sortOrder: num(a.sortOrder),
+      main: a.notMain !== true,
+      registered: true,
+      dims: cleanDims(a.dims),
+      roles: []
+    });
+  }
+  const roleByKey = /* @__PURE__ */ new Map();
+  for (const r of roleItems) {
+    const accountNumber = String(r.accountNumber);
+    const roleName = String(r.roleName);
+    const role = {
+      accountNumber,
+      roleName,
+      roleArn: str(r.roleArn) ?? `arn:aws:iam::${accountNumber}:role/${roleName}`,
+      displayName: str(r.displayName),
+      description: str(r.description),
+      icon: str(r.icon),
+      color: str(r.color),
+      policyTier: str(r.policyTier),
+      profileName: str(r.profileName),
+      sessionDurationSeconds: num(r.sessionDurationSeconds),
+      sortOrder: num(r.sortOrder)
+    };
+    let account = byNumber.get(accountNumber);
+    if (!account) {
+      account = { accountNumber, main: true, registered: false, roles: [] };
+      byNumber.set(accountNumber, account);
+    }
+    account.roles.push(role);
+    roleByKey.set(roleKey(accountNumber, roleName), role);
+  }
+  const accounts = [...byNumber.values()].sort(compareAccounts);
+  for (const a of accounts) a.roles.sort(compareRoles);
+  const groups = groupItems.filter((g) => typeof g.groupId === "string" && typeof g.name === "string").map((g) => ({ groupId: g.groupId, name: g.name, description: str(g.description) })).sort((a, b) => a.name.localeCompare(b.name));
+  log6("catalog index built", {
+    version,
+    accounts: accounts.length,
+    roles: roleByKey.size,
+    groups: groups.length,
+    ms: Date.now() - started
+  });
+  return {
+    version,
+    builtAt: Date.now(),
+    accounts,
+    byNumber,
+    roleByKey,
+    groups,
+    groupName: new Map(groups.map((g) => [g.groupId, g.name]))
+  };
+}
+async function ensureVersionRow() {
+  try {
+    await ddb6.send(
+      new import_lib_dynamodb6.PutCommand({
+        TableName: RESOURCES_TABLE_NAME,
+        Item: { resourceId: CATALOG_VERSION_KEY, version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString() },
+        ConditionExpression: "attribute_not_exists(resourceId)"
+      })
+    );
+    return 1;
+  } catch (err) {
+    if (err.name !== "ConditionalCheckFailedException") throw err;
+    return await readVersion() ?? 1;
+  }
+}
+async function catalog() {
+  let version = await readVersion();
+  if (cached && version !== void 0 && cached.version === version) return cached;
+  if (!building) {
+    if (version === void 0) version = await ensureVersionRow();
+    building = build(version).then((c) => {
+      cached = c;
+      return c;
+    }).finally(() => {
+      building = void 0;
+    });
+  }
+  return building;
+}
+async function bumpCatalogVersion() {
+  cached = void 0;
+  try {
+    await ddb6.send(
+      new import_lib_dynamodb6.UpdateCommand({
+        TableName: RESOURCES_TABLE_NAME,
+        Key: { resourceId: CATALOG_VERSION_KEY },
+        UpdateExpression: "ADD #v :one SET updatedAt = :now",
+        ExpressionAttributeNames: { "#v": "version" },
+        ExpressionAttributeValues: { ":one": 1, ":now": (/* @__PURE__ */ new Date()).toISOString() }
+      })
+    );
+  } catch (err) {
+    log6("ERROR: catalog version bump failed \u2014 other containers list stale until the next write", {
+      error: err.message
+    });
+  }
+}
+var import_client_dynamodb6, import_lib_dynamodb6, ddb6, ACCOUNTS_TABLE_NAME, ROLES_TABLE_NAME2, GROUPS_TABLE_NAME, RESOURCES_TABLE_NAME, CATALOG_VERSION_KEY, log6, roleKey, cached, building, str, num;
+var init_catalogIndex = __esm({
+  "lambdacode/api/services/catalogIndex.ts"() {
+    "use strict";
+    import_client_dynamodb6 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb6 = require("@aws-sdk/lib-dynamodb");
+    init_accountOrder();
+    init_dimensions();
+    ddb6 = import_lib_dynamodb6.DynamoDBDocumentClient.from(new import_client_dynamodb6.DynamoDBClient({}));
+    ACCOUNTS_TABLE_NAME = process.env.ACCOUNTS_TABLE_NAME;
+    ROLES_TABLE_NAME2 = process.env.ROLES_TABLE_NAME;
+    GROUPS_TABLE_NAME = process.env.GROUPS_TABLE_NAME;
+    RESOURCES_TABLE_NAME = process.env.RESOURCES_TABLE_NAME;
+    CATALOG_VERSION_KEY = "__catalog-version__";
+    log6 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    roleKey = (accountNumber, roleName) => `${accountNumber}#${roleName}`;
+    str = (v) => typeof v === "string" && v ? v : void 0;
+    num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+  }
+});
+
+// lambdacode/api/services/groupsService.ts
+async function bundlesAndMembers() {
+  const targets = /* @__PURE__ */ new Map();
+  const members = /* @__PURE__ */ new Map();
+  for (const r of await scanAll()) {
+    const p = parsePrincipal(r.principal);
+    if (p?.kind === "group") {
+      const list = targets.get(p.groupId) ?? [];
+      list.push(r.target);
+      targets.set(p.groupId, list);
+    } else if (p?.kind === "user" && r.target.startsWith("member#")) {
+      const g = r.target.slice("member#".length);
+      const list = members.get(g) ?? [];
+      list.push(p.userId);
+      members.set(g, list);
+    }
+  }
+  return { targets, members };
+}
+function toGroup(row, targets, members) {
+  const roles = [];
+  const resources = [];
+  const plugins = [];
+  for (const t of targets) {
+    const p = parseTarget(t);
+    if (p?.kind === "role") roles.push({ accountNumber: p.accountNumber, roleName: p.roleName });
+    else if (p?.kind === "resource") resources.push(p.resourceId);
+    else if (p?.kind === "plugin") plugins.push({ pluginId: p.pluginId, accountNumber: p.accountNumber, permission: p.permission });
+  }
+  return {
+    groupId: row.groupId,
+    name: row.name,
+    description: row.description,
+    roles,
+    resources,
+    plugins,
+    members: [...members].sort(),
+    createdAt: row.createdAt,
+    createdBy: row.createdBy,
+    ...row.reviewedAt ? { reviewedAt: row.reviewedAt } : {}
+  };
+}
+async function markGroupReviewed(groupId, adminUserId) {
+  try {
+    await ddb7.send(
+      new import_lib_dynamodb7.UpdateCommand({
+        TableName: GROUPS_TABLE_NAME2,
+        Key: { groupId },
+        UpdateExpression: "SET reviewedAt = :at, reviewedBy = :by",
+        ExpressionAttributeValues: { ":at": (/* @__PURE__ */ new Date()).toISOString(), ":by": adminUserId },
+        ConditionExpression: "attribute_exists(groupId)"
+      })
+    );
+  } catch (err) {
+    if (err.name === "ConditionalCheckFailedException") throw new NotFoundError(`Group ${groupId} not found`);
+    throw err;
+  }
+  log7("group reviewed", { groupId, by: adminUserId });
+}
+async function listGroupRows() {
+  return scanAllGroups();
+}
+async function listGroups() {
+  const [rows, { targets, members }] = await Promise.all([scanAllGroups(), bundlesAndMembers()]);
+  return rows.map((r) => toGroup(r, targets.get(r.groupId) ?? [], members.get(r.groupId) ?? [])).sort((a, b) => a.name.localeCompare(b.name));
+}
+async function getGroup(groupId) {
+  const row = await getGroupRow(groupId);
+  const [targets, memberRows] = await Promise.all([
+    queryPrincipal(groupPrincipal(groupId)),
+    queryTarget(memberTarget(groupId))
+  ]);
+  return toGroup(
+    row,
+    targets.map((t) => t.target),
+    memberRows.map((r) => parsePrincipal(r.principal)).filter((p) => p?.kind === "user").map((p) => p.userId)
+  );
+}
+async function deleteGroup(groupId) {
+  const group = await getGroup(groupId);
+  const batchId = newBatchId();
+  let changes = [];
+  await withAccessDiff(
+    group.members,
+    "GROUP",
+    async () => {
+      for (const r of await queryPrincipal(groupPrincipal(groupId))) await deleteRow(r.principal, r.target);
+      for (const u of group.members) await deleteRow(userPrincipal(u), memberTarget(groupId));
+    },
+    void 0,
+    { batchId, groupId, groupName: group.name, onDiff: (c) => changes = c }
+  );
+  await ddb7.send(new import_lib_dynamodb7.DeleteCommand({ TableName: GROUPS_TABLE_NAME2, Key: { groupId } }));
+  await bumpCatalogVersion();
+  const { deleteRequestsForUser: deleteRequestsForUser2 } = (init_requestsService(), __toCommonJS(requestsService_exports));
+  await deleteRequestsForUser2(groupId, { onlyPending: true });
+  await recordEvent({
+    category: "catalog",
+    action: "group.delete",
+    subject: { kind: "group", id: groupId, name: group.name },
+    target: groupTarget(groupId),
+    targetName: group.name,
+    details: { members: group.members.length, batchId, affected: affectedOf(changes, { change: "lost" }), unchanged: unchangedOf(changes, { change: "lost" }) }
+  });
+  log7("deleted group", { groupId, name: group.name, members: group.members.length });
+}
+async function groupHoldingTarget(groupId, target) {
+  const group = await getGroup(groupId);
+  if (!targetsOf(group).has(target)) {
+    throw new NotFoundError(`Group ${groupId} does not hold ${target}`);
+  }
+  return group;
+}
+async function revokeGroupTarget(groupId, target) {
+  const group = await groupHoldingTarget(groupId, target);
+  if (targetsOf(group).size === 1) {
+    await deleteGroup(groupId);
+    return;
+  }
+  const batchId = newBatchId();
+  let changes = [];
+  await withAccessDiff(
+    group.members,
+    "GROUP",
+    async () => {
+      await deleteRow(groupPrincipal(groupId), target);
+    },
+    void 0,
+    { batchId, groupId, groupName: group.name, onDiff: (c) => changes = c }
+  );
+  await clearPendingGroupReviews(groupId);
+  await recordEvent(
+    bundleEvent("group.bundle.remove", { kind: "group", id: groupId, name: group.name }, target, {
+      via: "REAPPROVAL",
+      batchId,
+      affected: affectedOf(changes, { target, change: "lost" }),
+      unchanged: unchangedOf(changes, { target, change: "lost" })
+    })
+  );
+  log7("revoked group target", { groupId, name: group.name, target });
+}
+async function restampGroupTarget(groupId, target, adminUserId) {
+  const group = await groupHoldingTarget(groupId, target);
+  await putRow({
+    principal: groupPrincipal(groupId),
+    target,
+    grantedBy: adminUserId,
+    grantedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  log7("restamped group target", { groupId, name: group.name, target });
+}
+async function clearPendingGroupReviews(groupId) {
+  const { deleteRequestsForUser: deleteRequestsForUser2 } = (init_requestsService(), __toCommonJS(requestsService_exports));
+  await deleteRequestsForUser2(groupId, { onlyPending: true, exceptKinds: ["GROUP"] });
+}
+async function removeUserFromAllGroups(userId) {
+  const rows = await queryPrincipal(userPrincipal(userId), "member#");
+  for (const r of rows) await deleteRow(r.principal, r.target);
+  if (rows.length) log7("removed deleted user from groups", { userId, touched: rows.length });
+  return rows.length;
+}
+async function getGroupRow(groupId) {
+  const res = await ddb7.send(new import_lib_dynamodb7.GetCommand({ TableName: GROUPS_TABLE_NAME2, Key: { groupId } }));
+  if (!res.Item) throw new NotFoundError(`Group ${groupId} not found`);
+  return res.Item;
+}
+async function scanAllGroups() {
+  const rows = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb7.send(new import_lib_dynamodb7.ScanCommand({ TableName: GROUPS_TABLE_NAME2, ExclusiveStartKey }));
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+var import_client_dynamodb7, import_lib_dynamodb7, ddb7, GROUPS_TABLE_NAME2, ROLES_TABLE_NAME3, RESOURCES_TABLE_NAME2, log7, toKey, bundleEvent, targetsOf;
+var init_groupsService = __esm({
+  "lambdacode/api/services/groupsService.ts"() {
+    "use strict";
+    import_client_dynamodb7 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb7 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_catalogIndex();
+    init_resourcesService();
+    ddb7 = import_lib_dynamodb7.DynamoDBDocumentClient.from(new import_client_dynamodb7.DynamoDBClient({}));
+    GROUPS_TABLE_NAME2 = process.env.GROUPS_TABLE_NAME;
+    ROLES_TABLE_NAME3 = process.env.ROLES_TABLE_NAME;
+    RESOURCES_TABLE_NAME2 = process.env.RESOURCES_TABLE_NAME;
+    log7 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    toKey = (r) => roleTarget(r.accountNumber, r.roleName);
+    bundleEvent = (action, subject, target, details) => {
+      const p = parseTarget(target);
+      return { category: "access", action, subject, target, targetName: p?.kind === "role" ? p.roleName : void 0, details };
+    };
+    targetsOf = (group) => /* @__PURE__ */ new Set([
+      ...group.roles.map(toKey),
+      ...group.resources.map(resourceTarget),
+      ...group.plugins.map((p) => pluginTarget(p.pluginId, p.accountNumber, p.permission))
+    ]);
+  }
+});
+
+// lambdacode/api/services/resourcesService.ts
+function toResource(it) {
+  return {
+    resourceId: it.resourceId,
+    accountNumber: it.accountNumber,
+    name: it.name,
+    type: it.type,
+    cidr: it.cidr,
+    ports: it.ports,
+    dnsName: it.dnsName,
+    sshUser: it.sshUser,
+    securityGroupId: it.securityGroupId,
+    description: it.description,
+    createdAt: it.createdAt,
+    createdBy: it.createdBy
+  };
+}
+async function listResources() {
+  const items = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb8.send(
+      new import_lib_dynamodb8.ScanCommand({ TableName: RESOURCES_TABLE_NAME3, ExclusiveStartKey })
+    );
+    items.push(...page.Items ?? []);
+    ExclusiveStartKey = page.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return items.filter((it) => !isSentinelRow(it.resourceId)).map(toResource).sort((a, b) => a.name.localeCompare(b.name));
+}
+async function getResource(resourceId) {
+  if (isSentinelRow(resourceId)) {
+    throw new NotFoundError(`Resource ${resourceId} not found`);
+  }
+  const res = await ddb8.send(
+    new import_lib_dynamodb8.GetCommand({ TableName: RESOURCES_TABLE_NAME3, Key: { resourceId } })
+  );
+  if (!res.Item) throw new NotFoundError(`Resource ${resourceId} not found`);
+  return toResource(res.Item);
+}
+var import_client_dynamodb8, import_lib_dynamodb8, ddb8, RESOURCES_TABLE_NAME3, ACCOUNTS_TABLE_NAME2, isSentinelRow;
+var init_resourcesService = __esm({
+  "lambdacode/api/services/resourcesService.ts"() {
+    "use strict";
+    import_client_dynamodb8 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb8 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_resourceGrantsService();
+    init_groupsService();
+    init_access2();
+    init_auditService();
+    init_accessNotices();
+    ddb8 = import_lib_dynamodb8.DynamoDBDocumentClient.from(new import_client_dynamodb8.DynamoDBClient({}));
+    RESOURCES_TABLE_NAME3 = process.env.RESOURCES_TABLE_NAME;
+    ACCOUNTS_TABLE_NAME2 = process.env.ACCOUNTS_TABLE_NAME;
+    isSentinelRow = (resourceId) => String(resourceId).startsWith("__");
+  }
+});
+
+// lambdacode/api/services/resourceGrantsService.ts
+async function catalogRow(resourceId) {
+  if (isSentinelRow(resourceId)) return void 0;
+  const res = await ddb9.send(new import_lib_dynamodb9.GetCommand({ TableName: RESOURCES_TABLE_NAME4, Key: { resourceId } }));
+  return res.Item;
+}
+async function assignResource(resourceId, userId, grantedBy, expiresAt, opts) {
+  const resource = await catalogRow(resourceId);
+  if (!resource) throw new NotFoundError(`Resource ${resourceId} not found`);
+  const target = resourceTarget(resourceId);
+  if (expiresAt) {
+    const existing = await getRow(userPrincipal(userId), target);
+    if (existing && !existing.expiresAt) {
+      log8("kept long-term resource grant (no downgrade)", { userId, resourceId, requestedExpiresAt: expiresAt });
+      return { resourceId, grantedBy: existing.grantedBy, grantedAt: existing.grantedAt };
+    }
+  }
+  await withAccessDiff(
+    [userId],
+    "ADMIN",
+    () => putRow({
+      principal: userPrincipal(userId),
+      target,
+      grantedBy,
+      grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...expiresAt ? { expiresAt } : {}
+    }),
+    nameMap(resourceId, resource.name),
+    { derived: false, gainNotices: !opts?.fromRequestId }
+  );
+  await recordEvent({
+    category: "access",
+    action: "resource.grant",
+    subject: { kind: "user", id: userId },
+    target,
+    targetName: resource.name,
+    accountNumber: resource.accountNumber,
+    details: { expiresAt, requestId: opts?.fromRequestId }
+  });
+  log8("assigned resource", { userId, resourceId, grantedBy, expiresAt });
+  return { resourceId, grantedBy, expiresAt };
+}
+async function renewResourceGrant(resourceId, userId, grantedBy, opts) {
+  const resource = await catalogRow(resourceId);
+  if (!resource) throw new NotFoundError(`Resource ${resourceId} not found`);
+  const target = resourceTarget(resourceId);
+  const renewed = await updateExisting(userPrincipal(userId), target, {
+    grantedBy,
+    grantedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (!renewed) {
+    throw new ConflictError(`${userId} no longer has access to ${resource.name} \u2014 there is nothing to renew`);
+  }
+  await recordEvent({
+    category: "access",
+    action: "resource.grant",
+    subject: { kind: "user", id: userId },
+    target,
+    targetName: resource.name,
+    accountNumber: resource.accountNumber,
+    details: { requestId: opts?.fromRequestId, renewed: true }
+  });
+  log8("renewed resource grant", { userId, resourceId, grantedBy });
+}
+async function revokeResourceGrant(resourceId, userId, via = "ADMIN") {
+  const resource = await catalogRow(resourceId);
+  const removed = await revokeDirectRow(
+    userId,
+    resourceTarget(resourceId),
+    via,
+    { action: "resource.revoke", targetName: resource?.name, accountNumber: resource?.accountNumber },
+    nameMap(resourceId, resource?.name)
+  );
+  if (!removed) throw new NotFoundError(`No grant for user ${userId} on resource ${resourceId}`);
+  log8("revoked resource grant", { userId, resourceId });
+}
+async function listUserResourceGrants(userId) {
+  const out = [];
+  for (const [t, e] of await effectiveAccess(userId)) {
+    const p = parseTarget(t);
+    if (p?.kind !== "resource") continue;
+    out.push({
+      resourceId: p.resourceId,
+      grantedBy: e.direct?.grantedBy,
+      grantedAt: e.direct?.grantedAt,
+      expiresAt: e.groups.length ? void 0 : e.direct?.expiresAt,
+      // effective
+      viaGroup: e.direct ? void 0 : e.groups[0],
+      viaGroups: e.groups
+    });
+  }
+  return out;
+}
+async function revokeAllResourcesForUser(userId) {
+  const rows = await queryPrincipal(userPrincipal(userId), "resource#");
+  for (const r of rows) await deleteRow(r.principal, r.target);
+  if (rows.length) log8("revoked all resource grants for user", { userId, count: rows.length });
+  return rows.length;
+}
+var import_client_dynamodb9, import_lib_dynamodb9, ddb9, RESOURCES_TABLE_NAME4, log8, nameMap;
+var init_resourceGrantsService = __esm({
+  "lambdacode/api/services/resourceGrantsService.ts"() {
+    "use strict";
+    import_client_dynamodb9 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb9 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_grantsService();
+    init_resourcesService();
+    ddb9 = import_lib_dynamodb9.DynamoDBDocumentClient.from(new import_client_dynamodb9.DynamoDBClient({}));
+    RESOURCES_TABLE_NAME4 = process.env.RESOURCES_TABLE_NAME;
+    log8 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    nameMap = (resourceId, name) => name ? /* @__PURE__ */ new Map([[resourceId, name]]) : void 0;
+  }
+});
+
+// lambdacode/api/services/pluginGrantsService.ts
+function validatePluginGrantKey(key) {
+  if (!PLUGIN_ID_PATTERN.test(key.pluginId)) throw new ValidationError("pluginId is not a valid plugin id");
+  if (!AWS_ACCOUNT_PATTERN.test(key.accountNumber)) throw new ValidationError("accountNumber must be 12 digits");
+  if (!PLUGIN_PERMISSIONS.includes(key.permission)) throw new ValidationError(`permission must be "user" or "admin"`);
+}
+function toAssignment(row, ctx) {
+  const t = parseTarget(row.target);
+  const p = parsePrincipal(row.principal);
+  if (t?.kind !== "plugin" || !p) return null;
+  const a = pluginAvailability(ctx.catalog.get(t.pluginId), t.accountNumber, t.permission, ctx.registeredAccounts);
+  return {
+    pluginId: t.pluginId,
+    accountNumber: t.accountNumber,
+    permission: t.permission,
+    principal: p,
+    grantedBy: row.grantedBy,
+    grantedAt: row.grantedAt,
+    expiresAt: row.expiresAt,
+    expired: isExpired(row),
+    ...a.available ? { available: true } : a
+  };
+}
+async function assertPluginAssignable(key, ctx) {
+  validatePluginGrantKey(key);
+  const context = ctx ?? await loadPluginContext();
+  const record = context.catalog.get(key.pluginId);
+  if (!record) throw new NotFoundError(`Plugin ${key.pluginId} is not installed`);
+  const a = pluginAvailability(record, key.accountNumber, key.permission, context.registeredAccounts);
+  if (a.available) return context;
+  if (a.reason === "permission-undeclared") {
+    throw new ValidationError(`Plugin ${key.pluginId} does not declare the "${key.permission}" permission`);
+  }
+  if (a.reason === "account-unbound") {
+    throw new NotFoundError(`Plugin ${key.pluginId} is not bound to account ${key.accountNumber}`);
+  }
+  throw new ConflictError(`Plugin ${key.pluginId} is not available for account ${key.accountNumber} (${a.reason})`);
+}
+async function assignPlugin(input, ctx) {
+  if (input.expiresAt !== void 0) {
+    if (input.principal.kind === "group") throw new ValidationError("group assignments are standing \u2014 no expiry");
+    if (!(Date.parse(input.expiresAt) > Date.now())) throw new ValidationError("expiresAt must be in the future");
+  }
+  const context = await assertPluginAssignable(input, ctx);
+  const principal = principalOf(input.principal);
+  const target = pluginTarget(input.pluginId, input.accountNumber, input.permission);
+  if (input.expiresAt) {
+    const existing = await getRow(principal, target);
+    if (existing && !existing.expiresAt) {
+      log9("kept long-term plugin grant (no downgrade)", { principal, target, requestedExpiresAt: input.expiresAt });
+      return toAssignment(existing, context);
+    }
+  }
+  const row = {
+    principal,
+    target,
+    grantedBy: input.grantedBy,
+    grantedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...input.expiresAt ? { expiresAt: input.expiresAt } : {}
+  };
+  const targetName = context.catalog.get(input.pluginId)?.manifest.displayName;
+  if (input.principal.kind === "user") {
+    await withAccessDiff([input.principal.userId], "ADMIN", () => putRow(row), void 0, {
+      derived: false,
+      gainNotices: !input.fromRequestId
+    });
+    await recordEvent({
+      category: "access",
+      action: "plugin.grant",
+      subject: { kind: "user", id: input.principal.userId },
+      target,
+      targetName,
+      details: { expiresAt: input.expiresAt, requestId: input.fromRequestId }
+    });
+  } else {
+    const { groupId } = input.principal;
+    const batchId = newBatchId();
+    await withAccessDiff(await membersOf(groupId), "ADMIN", () => putRow(row), void 0, { batchId, groupId });
+    await recordEvent({
+      category: "access",
+      action: "plugin.grant",
+      subject: { kind: "group", id: groupId },
+      target,
+      targetName,
+      details: { batchId }
+    });
+  }
+  log9("assigned plugin permission", { principal, target, grantedBy: input.grantedBy, expiresAt: input.expiresAt });
+  return toAssignment(row, context);
+}
+async function revokePlugin(input) {
+  validatePluginGrantKey(input);
+  const principal = principalOf(input.principal);
+  const target = pluginTarget(input.pluginId, input.accountNumber, input.permission);
+  const via = input.via ?? "ADMIN";
+  const notFound = () => new NotFoundError(`No ${input.permission} assignment for ${describe(input.principal)} on plugin ${input.pluginId} in account ${input.accountNumber}`);
+  const targetName = await pluginCatalog().get(input.pluginId).then((r) => r?.manifest.displayName, () => void 0);
+  if (input.principal.kind === "user") {
+    if (!await revokeDirectRow(input.principal.userId, target, via, { action: "plugin.revoke", targetName })) throw notFound();
+  } else {
+    const rows = await queryPrincipal(principal);
+    const others = rows.filter((r) => r.target !== target && BUNDLE_KINDS.has(parseTarget(r.target)?.kind ?? ""));
+    if (rows.some((r) => r.target === target) && !others.length) {
+      throw new ConflictError("This is the group's last permission \u2014 delete the group instead");
+    }
+    const { groupId } = input.principal;
+    const batchId = newBatchId();
+    const affected = (await holdersOf(target)).map((h) => h.userId);
+    const removed = await withAccessDiff(affected, via, () => deleteRow(principal, target), void 0, { batchId, groupId });
+    if (!removed) throw notFound();
+    await recordEvent({
+      category: "access",
+      action: "plugin.revoke",
+      subject: { kind: "group", id: groupId },
+      target,
+      targetName,
+      details: { via, batchId }
+    });
+  }
+  log9("revoked plugin permission", { principal, target, via });
+}
+function standingPluginGrants(rows, ctx) {
+  const out = [];
+  for (const r of rows) {
+    if (r.expiresAt) continue;
+    const p = parsePrincipal(r.principal);
+    const t = parseTarget(r.target);
+    if (p?.kind !== "user" || t?.kind !== "plugin") continue;
+    const available = pluginAvailability(ctx.catalog.get(t.pluginId), t.accountNumber, t.permission, ctx.registeredAccounts).available;
+    out.push({ userId: p.userId, target: r.target, pluginId: t.pluginId, accountNumber: t.accountNumber, permission: t.permission, grantedAt: r.grantedAt, available });
+  }
+  return out;
+}
+var log9, describe, BUNDLE_KINDS;
+var init_pluginGrantsService = __esm({
+  "lambdacode/api/services/pluginGrantsService.ts"() {
+    "use strict";
+    init_backend();
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_grantsService();
+    init_pluginCatalog();
+    init_pluginAccess();
+    log9 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    describe = (p) => p.kind === "user" ? `user ${p.userId}` : `group ${p.groupId}`;
+    BUNDLE_KINDS = /* @__PURE__ */ new Set(["role", "resource", "plugin"]);
+  }
+});
+
+// lambdacode/api/services/serviceUserRegistry.ts
+async function getServiceUserName(clientId) {
+  const out = await ddb10.send(
+    new import_lib_dynamodb10.GetCommand({ TableName: SERVICE_USERS_TABLE_NAME, Key: { clientId }, ConsistentRead: true })
+  );
+  return out.Item?.name || void 0;
+}
+var import_client_dynamodb10, import_lib_dynamodb10, ddb10, SERVICE_USERS_TABLE_NAME;
+var init_serviceUserRegistry = __esm({
+  "lambdacode/api/services/serviceUserRegistry.ts"() {
+    "use strict";
+    import_client_dynamodb10 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb10 = require("@aws-sdk/lib-dynamodb");
+    ddb10 = import_lib_dynamodb10.DynamoDBDocumentClient.from(new import_client_dynamodb10.DynamoDBClient({}));
+    SERVICE_USERS_TABLE_NAME = process.env.SERVICE_USERS_TABLE_NAME;
+  }
+});
+
+// lambdacode/api/services/serviceUsersService.ts
+async function scanRegistry() {
+  const rows = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb11.send(
+      new import_lib_dynamodb11.ScanCommand({ TableName: SERVICE_USERS_TABLE_NAME2, ExclusiveStartKey })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+async function getRow2(clientId) {
+  const res = await ddb11.send(
+    new import_lib_dynamodb11.GetCommand({ TableName: SERVICE_USERS_TABLE_NAME2, Key: { clientId } })
+  );
+  return res.Item;
+}
+async function getCurrentRow(clientId) {
+  const row = await getRow2(clientId);
+  if (!row || row.retiredInto) {
+    throw new NotFoundError(`Service user ${clientId} not found`);
+  }
+  return row;
+}
+async function deleteAppClient(clientId) {
+  try {
+    await cognito.send(
+      new import_client_cognito_identity_provider.DeleteUserPoolClientCommand({ UserPoolId: USER_POOL_ID, ClientId: clientId })
+    );
+  } catch (err) {
+    if (err.name !== "ResourceNotFoundException") throw err;
+    log10("app client already gone", { clientId });
+  }
+}
+async function markReviewed(clientId) {
+  try {
+    await ddb11.send(
+      new import_lib_dynamodb11.UpdateCommand({
+        TableName: SERVICE_USERS_TABLE_NAME2,
+        Key: { clientId },
+        UpdateExpression: "SET reviewedAt = :t",
+        ConditionExpression: "attribute_exists(clientId)",
+        ExpressionAttributeValues: { ":t": (/* @__PURE__ */ new Date()).toISOString() }
+      })
+    );
+  } catch (err) {
+    if (err.name === "ConditionalCheckFailedException") {
+      throw new NotFoundError(`Service user ${clientId} not found`);
+    }
+    throw err;
+  }
+  log10("marked service user reviewed", { clientId });
+}
+async function deleteServiceUser(clientId) {
+  const row = await getCurrentRow(clientId);
+  const { deleteRequestsForUser: deleteRequestsForUser2 } = (init_requestsService(), __toCommonJS(requestsService_exports));
+  for (const id of [row.previousClientId, clientId].filter(Boolean)) {
+    await deleteAppClient(id);
+    await revokeAllForUser(id);
+    await deleteRequestsForUser2(id, { onlyPending: true });
+    await ddb11.send(
+      new import_lib_dynamodb11.DeleteCommand({ TableName: SERVICE_USERS_TABLE_NAME2, Key: { clientId: id } })
+    );
+  }
+  await recordServiceUserEvent("serviceuser.delete", clientId, row.name);
+  log10("deleted service user", { clientId, name: row.name });
+}
+async function reviewableServiceUsers() {
+  return (await scanRegistry()).filter((r) => !r.retiredInto).map((r) => ({ clientId: r.clientId, since: r.reviewedAt ?? r.createdAt }));
+}
+var import_client_dynamodb11, import_lib_dynamodb11, import_client_cognito_identity_provider, ddb11, cognito, SERVICE_USERS_TABLE_NAME2, USER_POOL_ID, log10, recordServiceUserEvent;
+var init_serviceUsersService = __esm({
+  "lambdacode/api/services/serviceUsersService.ts"() {
+    "use strict";
+    import_client_dynamodb11 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb11 = require("@aws-sdk/lib-dynamodb");
+    import_client_cognito_identity_provider = require("@aws-sdk/client-cognito-identity-provider");
+    init_httpErrors();
+    init_access2();
+    init_grantsService();
+    init_auditService();
+    init_serviceUserRegistry();
+    init_serviceUserRegistry();
+    ddb11 = import_lib_dynamodb11.DynamoDBDocumentClient.from(new import_client_dynamodb11.DynamoDBClient({}));
+    cognito = new import_client_cognito_identity_provider.CognitoIdentityProviderClient({});
+    SERVICE_USERS_TABLE_NAME2 = process.env.SERVICE_USERS_TABLE_NAME;
+    USER_POOL_ID = process.env.USER_POOL_ID;
+    log10 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    recordServiceUserEvent = (action, clientId, name, details) => recordEvent({
+      category: "users",
+      action,
+      subject: { kind: "serviceUser", id: clientId, name },
+      target: `serviceuser#${clientId}`,
+      targetName: name,
+      details
+    });
+  }
+});
+
+// lambdacode/api/services/claims.ts
+function customClaims(source) {
+  const out = {};
+  for (const [k, v] of Object.entries(source)) {
+    if (k.startsWith(CUSTOM_PREFIX) && typeof v === "string" && v !== "") {
+      out[k.slice(CUSTOM_PREFIX.length)] = v;
+    }
+  }
+  return out;
+}
+var CUSTOM_PREFIX;
+var init_claims = __esm({
+  "lambdacode/api/services/claims.ts"() {
+    "use strict";
+    CUSTOM_PREFIX = "custom:";
+  }
+});
+
+// lambdacode/api/services/directory.ts
+async function listDirectoryUsers() {
+  const users = [];
+  let PaginationToken;
+  do {
+    const page = await cognito2.send(new import_client_cognito_identity_provider2.ListUsersCommand({ UserPoolId: USER_POOL_ID2, PaginationToken }));
+    for (const u of page?.Users ?? []) {
+      const attrs = u.Attributes ?? [];
+      const sub = attrs.find((a) => a.Name === "sub")?.Value;
+      if (!sub) continue;
+      if (u.UserStatus === "EXTERNAL_PROVIDER") continue;
+      const claims = customClaims(Object.fromEntries(attrs.map((a) => [a.Name ?? "", a.Value])));
+      users.push({
+        userId: sub,
+        email: attrs.find((a) => a.Name === "email")?.Value ?? "",
+        pendingInvite: u.UserStatus === "FORCE_CHANGE_PASSWORD",
+        ...Object.keys(claims).length ? { claims } : {}
+      });
+    }
+    PaginationToken = page.PaginationToken;
+  } while (PaginationToken);
+  return users;
+}
+var import_client_cognito_identity_provider2, cognito2, USER_POOL_ID2;
+var init_directory = __esm({
+  "lambdacode/api/services/directory.ts"() {
+    "use strict";
+    import_client_cognito_identity_provider2 = require("@aws-sdk/client-cognito-identity-provider");
+    init_claims();
+    cognito2 = new import_client_cognito_identity_provider2.CognitoIdentityProviderClient({});
+    USER_POOL_ID2 = process.env.USER_POOL_ID;
+  }
+});
+
+// lambdacode/api/services/preferencesService.ts
+var import_client_dynamodb12, import_lib_dynamodb12, ddb12, PRESENCE_THROTTLE_MS;
+var init_preferencesService = __esm({
+  "lambdacode/api/services/preferencesService.ts"() {
+    "use strict";
+    import_client_dynamodb12 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb12 = require("@aws-sdk/lib-dynamodb");
+    init_access2();
+    init_httpErrors();
+    ddb12 = import_lib_dynamodb12.DynamoDBDocumentClient.from(new import_client_dynamodb12.DynamoDBClient({}));
+    PRESENCE_THROTTLE_MS = 5 * 60 * 1e3;
+  }
+});
+
+// lambdacode/api/services/sharesService.ts
+function parseConfig() {
+  const off = { enabled: false, maxDurationHours: 8, allowGroupTargets: true };
+  const raw = process.env.DEV_SHARES;
+  if (!raw) return off;
+  try {
+    const parsed = JSON.parse(raw);
+    const max = Number(parsed.maxDurationHours);
+    return {
+      enabled: parsed.enabled === true,
+      maxDurationHours: Number.isInteger(max) && max >= 1 && max <= 72 ? max : 8,
+      allowGroupTargets: parsed.allowGroupTargets !== false
+    };
+  } catch {
+    return off;
+  }
+}
+async function listShareDefs(now = Date.now()) {
+  const live = [];
+  for (const row of await queryPrincipal(SHARE_DEF_PRINCIPAL, "share#")) {
+    if (!isShareDefRow(row)) continue;
+    if (!isExpired(row, now)) {
+      live.push(row);
+      continue;
+    }
+    await deleteShareRows(row.shareId).catch(
+      (err) => log11("WARN: expired share cleanup failed", { shareId: row.shareId, error: err.message })
+    );
+  }
+  return live;
+}
+async function holdersFromRows(rows) {
+  const users = /* @__PURE__ */ new Set();
+  for (const r of rows) {
+    if (isExpired(r)) continue;
+    const p = parsePrincipal(r.principal);
+    if (p?.kind === "user") users.add(p.userId);
+    else if (p?.kind === "group") for (const u of await membersOf(p.groupId)) users.add(u);
+  }
+  return [...users];
+}
+async function endShare(def, via) {
+  const rows = await queryTarget(def.target);
+  const holders = await holdersFromRows(rows);
+  const batchId = newBatchId();
+  await withAccessDiff(holders, via, () => deleteShareRows(def.shareId, rows), /* @__PURE__ */ new Map([[def.shareId, def.label]]), { batchId });
+  await recordEvent({
+    category: "access",
+    action: "share.stop",
+    subject: { kind: "user", id: def.ownerSub, name: def.ownerName },
+    target: def.target,
+    targetName: def.label,
+    details: { via, batchId }
+  });
+}
+async function removeSharesOwnedBy(ownerSub) {
+  const mine = (await listShareDefs()).filter((d) => d.ownerSub === ownerSub);
+  for (const def of mine) await endShare(def, "ADMIN");
+  if (mine.length) log11("shares removed with owner", { ownerSub, count: mine.length });
+  return mine.length;
+}
+var log11, CONFIG, TTL_GRACE_S;
+var init_sharesService = __esm({
+  "lambdacode/api/services/sharesService.ts"() {
+    "use strict";
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_directory();
+    init_preferencesService();
+    init_groupsService();
+    init_httpErrors();
+    log11 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    CONFIG = parseConfig();
+    TTL_GRACE_S = 24 * 60 * 60;
+  }
+});
+
+// lambdacode/api/services/tempPassword.ts
+function tempPassword(len = 24) {
+  const all = TEMP_PW_SETS.join("");
+  const chars = TEMP_PW_SETS.map((s) => s[(0, import_crypto3.randomInt)(s.length)]);
+  while (chars.length < len) chars.push(all[(0, import_crypto3.randomInt)(all.length)]);
+  for (let i = chars.length - 1; i > 0; i--) {
+    const j = (0, import_crypto3.randomInt)(i + 1);
+    [chars[i], chars[j]] = [chars[j], chars[i]];
+  }
+  return chars.join("");
+}
+var import_crypto3, TEMP_PW_SETS;
+var init_tempPassword = __esm({
+  "lambdacode/api/services/tempPassword.ts"() {
+    "use strict";
+    import_crypto3 = require("crypto");
+    TEMP_PW_SETS = [
+      "ABCDEFGHJKMNPQRSTUVWXYZ",
+      "abcdefghjkmnpqrstuvwxyz",
+      "23456789",
+      "!$*._~-"
+    ];
+  }
+});
+
+// lambdacode/api/services/usersService.ts
+var usersService_exports = {};
+__export(usersService_exports, {
+  ADMIN_GROUP: () => ADMIN_GROUP,
+  LIST_CAP: () => LIST_CAP,
+  assertUserExists: () => assertUserExists,
+  capLists: () => capLists,
+  createUser: () => createUser,
+  createUsers: () => createUsers,
+  deleteUser: () => deleteUser,
+  deleteUsers: () => deleteUsers,
+  getUser: () => getUser,
+  listAdminSubs: () => listAdminSubs,
+  listUsers: () => listUsers,
+  mintSignupLink: () => mintSignupLink,
+  normalizeEmail: () => normalizeEmail,
+  resendInvite: () => resendInvite,
+  resetUserMfa: () => resetUserMfa,
+  signupLink: () => signupLink,
+  updateUser: () => updateUser
+});
+async function listUsers() {
+  const [directory, adminSubs, graph, resourceMeta, groups] = await Promise.all([
+    listDirectory(),
+    listAdminSubs(),
+    snapshot(),
+    scanResourceMeta(),
+    listGroups()
+  ]);
+  const groupName = new Map(groups.map((g) => [g.groupId, g.name]));
+  const users = directory.map((u) => {
+    const { roles, resources } = accessLists(graph.users.get(u.userId)?.values() ?? [], groupName, resourceMeta);
+    return {
+      userId: u.userId,
+      email: u.email,
+      admin: adminSubs.has(u.userId),
+      // A federated sign-in never runs the set-password step, so a user who only ever signs in
+      // that way stays FORCE_CHANGE_PASSWORD in Cognito; being seen by the API proves they got in.
+      pendingInvite: u.pendingInvite && !graph.presence.has(u.userId),
+      lastSeenAt: graph.presence.get(u.userId),
+      ...u.claims ? { claims: u.claims } : {},
+      roles,
+      roleCount: roles.length,
+      resources,
+      resourceCount: resources.length
+    };
+  });
+  log12("listed users", { count: users.length });
+  return users;
+}
+function capLists(u) {
+  const roleNames = [...new Set(u.roles.map((r) => r.roleName))].sort();
+  const groupNames = [.../* @__PURE__ */ new Set([...u.roles.flatMap((r) => r.groups), ...u.resources.flatMap((r) => r.groups)])].sort();
+  return { ...u, roles: u.roles.slice(0, LIST_CAP), resources: u.resources.slice(0, LIST_CAP), roleNames, groupNames };
+}
+function accessLists(entries, groupName, resourceMeta) {
+  const roles = [];
+  const resources = [];
+  for (const e of entries) {
+    if (!e.active) continue;
+    const p = parseTarget(e.target);
+    const teams = e.groups.map((g) => groupName.get(g) ?? g).sort();
+    const direct = Boolean(e.direct && !isExpired(e.direct));
+    if (p?.kind === "role") {
+      roles.push({ accountNumber: p.accountNumber, roleName: p.roleName, direct, groups: teams });
+    } else if (p?.kind === "resource") {
+      const meta = resourceMeta.get(p.resourceId);
+      resources.push({
+        resourceId: p.resourceId,
+        name: meta?.name ?? "(deleted resource)",
+        accountNumber: meta?.accountNumber,
+        direct,
+        groups: teams
+      });
+    }
+  }
+  roles.sort((a, b) => a.accountNumber.localeCompare(b.accountNumber) || a.roleName.localeCompare(b.roleName));
+  resources.sort((a, b) => a.name.localeCompare(b.name));
+  return { roles, resources };
+}
+async function assertUserExists(userId) {
+  if (await getServiceUserName(userId)) return;
+  try {
+    await cognito3.send(new import_client_cognito_identity_provider3.AdminGetUserCommand({ UserPoolId: USER_POOL_ID3, Username: userId }));
+  } catch (err) {
+    if (err.name === "UserNotFoundException") throw new NotFoundError(`User ${userId} not found`);
+    throw err;
+  }
+}
+async function getUser(userId) {
+  let found;
+  try {
+    found = await cognito3.send(new import_client_cognito_identity_provider3.AdminGetUserCommand({ UserPoolId: USER_POOL_ID3, Username: userId }));
+  } catch (err) {
+    if (err.name === "UserNotFoundException") throw new NotFoundError(`User ${userId} not found`);
+    throw err;
+  }
+  const attrs = Object.fromEntries((found.UserAttributes ?? []).map((a) => [a.Name ?? "", a.Value]));
+  const [adminSubs, entries, resourceMeta, index, presence] = await Promise.all([
+    listAdminSubs(),
+    effectiveAccess(userId),
+    scanResourceMeta(),
+    catalog(),
+    getRow(userPrincipal(userId), PRESENCE_TARGET)
+  ]);
+  const { roles, resources } = accessLists(entries.values(), index.groupName, resourceMeta);
+  const claims = customClaims(attrs);
+  const lastSeenAt = typeof presence?.lastSeenAt === "string" ? presence.lastSeenAt : void 0;
+  return {
+    userId,
+    email: attrs.email ?? "",
+    admin: adminSubs.has(userId),
+    pendingInvite: found.UserStatus === "FORCE_CHANGE_PASSWORD" && !lastSeenAt,
+    lastSeenAt,
+    ...Object.keys(claims).length ? { claims } : {},
+    roles,
+    roleCount: roles.length,
+    resources,
+    resourceCount: resources.length
+  };
+}
+async function listAdminSubs() {
+  const subs = /* @__PURE__ */ new Set();
+  let NextToken;
+  do {
+    const page = await cognito3.send(
+      new import_client_cognito_identity_provider3.ListUsersInGroupCommand({
+        UserPoolId: USER_POOL_ID3,
+        GroupName: ADMIN_GROUP,
+        NextToken
+      })
+    );
+    for (const u of page?.Users ?? []) {
+      const sub = (u.Attributes ?? []).find((a) => a.Name === "sub")?.Value;
+      if (sub) subs.add(sub);
+    }
+    NextToken = page?.NextToken;
+  } while (NextToken);
+  return subs;
+}
+async function scanResourceMeta() {
+  const meta = /* @__PURE__ */ new Map();
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb13.send(
+      new import_lib_dynamodb13.ScanCommand({
+        TableName: RESOURCES_TABLE_NAME5,
+        ProjectionExpression: "resourceId, #n, accountNumber",
+        ExpressionAttributeNames: { "#n": "name" },
+        // reserved word
+        ExclusiveStartKey
+      })
+    );
+    for (const it of page.Items ?? []) {
+      if (isSentinelRow(it.resourceId)) continue;
+      meta.set(it.resourceId, {
+        name: it.name,
+        accountNumber: it.accountNumber
+      });
+    }
+    ExclusiveStartKey = page.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return meta;
+}
+async function createUser(rawEmail, admin, sendEmail = true) {
+  const user = await invite(rawEmail, admin, sendEmail);
+  await recordEvent(inviteRow(user, sendEmail ? "email" : "link"));
+  return sendEmail ? withoutLink(user) : user;
+}
+async function invite(rawEmail, admin, sendEmail) {
+  const email = normalizeEmail(rawEmail);
+  const temp = tempPassword();
+  try {
+    const res = await cognito3.send(
+      new import_client_cognito_identity_provider3.AdminCreateUserCommand({
+        UserPoolId: USER_POOL_ID3,
+        Username: email,
+        UserAttributes: [
+          { Name: "email", Value: email },
+          { Name: "email_verified", Value: "true" }
+        ],
+        TemporaryPassword: temp,
+        DesiredDeliveryMediums: ["EMAIL"],
+        ...sendEmail ? {} : { MessageAction: "SUPPRESS" }
+      })
+    );
+    const userId = res.User?.Attributes?.find((a) => a.Name === SUB_ATTR)?.Value ?? "";
+    const username = res.User?.Username ?? email;
+    if (admin) {
+      await cognito3.send(
+        new import_client_cognito_identity_provider3.AdminAddUserToGroupCommand({
+          UserPoolId: USER_POOL_ID3,
+          Username: userId || email,
+          GroupName: ADMIN_GROUP
+        })
+      );
+    }
+    await linkFederatedProviders(username, email);
+    log12("created user", { userId, email, admin, sendEmail });
+    return { userId, email, admin, pendingInvite: true, roles: [], roleCount: 0, resources: [], resourceCount: 0, signupLink: signupLink(username, temp) };
+  } catch (err) {
+    throw translateCognitoError(err);
+  }
+}
+async function federatedProviders() {
+  if (providersCache && Date.now() - providersCache.at < PROVIDERS_TTL_MS) return providersCache.value;
+  const value = (async () => {
+    const names = [];
+    let NextToken;
+    do {
+      const page = await cognito3.send(
+        new import_client_cognito_identity_provider3.ListIdentityProvidersCommand({ UserPoolId: USER_POOL_ID3, MaxResults: 60, NextToken })
+      );
+      for (const p of page.Providers ?? []) if (p.ProviderName && p.ProviderType === "OIDC") names.push(p.ProviderName);
+      NextToken = page.NextToken;
+    } while (NextToken);
+    return names;
+  })();
+  providersCache = { at: Date.now(), value };
+  value.catch(() => providersCache = void 0);
+  return value;
+}
+async function linkFederatedProviders(username, email) {
+  let providers;
+  try {
+    providers = await federatedProviders();
+  } catch (err) {
+    log12("WARN: could not list federated providers (trigger links at first sign-in)", {
+      error: err.message
+    });
+    return;
+  }
+  await Promise.all(
+    providers.map(
+      (provider) => cognito3.send(
+        new import_client_cognito_identity_provider3.AdminLinkProviderForUserCommand({
+          UserPoolId: USER_POOL_ID3,
+          DestinationUser: { ProviderName: "Cognito", ProviderAttributeValue: username },
+          SourceUser: { ProviderName: provider, ProviderAttributeName: LINK_ATTRIBUTE, ProviderAttributeValue: email }
+        })
+      ).catch(
+        (err) => log12("WARN: federated link failed (trigger links at first sign-in)", {
+          provider,
+          email,
+          error: err.message
+        })
+      )
+    )
+  );
+}
+async function unlinkFederatedProviders(email) {
+  let providers;
+  try {
+    providers = await federatedProviders();
+  } catch (err) {
+    log12("WARN: could not list federated providers (old email link kept)", { error: err.message });
+    return;
+  }
+  await Promise.all(
+    providers.map(
+      (provider) => cognito3.send(
+        new import_client_cognito_identity_provider3.AdminDisableProviderForUserCommand({
+          UserPoolId: USER_POOL_ID3,
+          User: { ProviderName: provider, ProviderAttributeName: LINK_ATTRIBUTE, ProviderAttributeValue: email }
+        })
+      ).catch(
+        (err) => log12("WARN: could not drop old federated link", { provider, email, error: err.message })
+      )
+    )
+  );
+}
+async function createUsers(emails, admin, sendEmail = true) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  const batchId = newBatchId();
+  const rows = [];
+  for (const raw of emails) {
+    const email = typeof raw === "string" ? raw.trim() : "";
+    const key = email.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (!BULK_EMAIL_RE.test(email)) {
+      const message = "Not a valid email address";
+      results.push({ email: email || String(raw), status: "FAILED", message });
+      rows.push(failedInviteRow(email || String(raw), admin, message, batchId));
+      continue;
+    }
+    try {
+      const user = await invite(email, admin, sendEmail);
+      results.push({ email, status: "CREATED", userId: user.userId, ...sendEmail ? {} : { signupLink: user.signupLink } });
+      rows.push(inviteRow(user, sendEmail ? "email" : "link", batchId));
+    } catch (err) {
+      const message = err.message || "Could not create the user";
+      results.push({ email, status: "FAILED", message });
+      rows.push(failedInviteRow(email, admin, message, batchId));
+    }
+  }
+  await recordEvents(rows);
+  const created = results.filter((r) => r.status === "CREATED").length;
+  log12("bulk created users", { requested: emails.length, created, admin, sendEmail });
+  return results;
+}
+async function identityBySub(userId) {
+  try {
+    const user = await cognito3.send(new import_client_cognito_identity_provider3.AdminGetUserCommand({ UserPoolId: USER_POOL_ID3, Username: userId }));
+    const email = user.UserAttributes?.find((a) => a.Name === "email")?.Value;
+    if (!email) return void 0;
+    return { email, username: user.Username ?? email, status: user.UserStatus };
+  } catch (err) {
+    if (err.name === "UserNotFoundException") return void 0;
+    throw err;
+  }
+}
+async function mintSignupLink(userId) {
+  const who = await identityBySub(userId);
+  if (!who) throw new NotFoundError("User not found");
+  if (who.status && who.status !== "FORCE_CHANGE_PASSWORD") {
+    throw new ConflictError("This user has already set a password");
+  }
+  const temp = tempPassword();
+  try {
+    await cognito3.send(
+      new import_client_cognito_identity_provider3.AdminSetUserPasswordCommand({ UserPoolId: USER_POOL_ID3, Username: who.username, Password: temp, Permanent: false })
+    );
+  } catch (err) {
+    throw translateCognitoError(err);
+  }
+  await recordEvent({
+    category: "users",
+    action: "user.reinvite",
+    subject: { kind: "user", id: userId, name: who.email },
+    target: userTarget(userId),
+    details: { delivery: "link" }
+  });
+  log12("minted sign-up link", { userId });
+  return signupLink(who.username, temp);
+}
+async function resendInvite(userId) {
+  const email = await emailBySub(userId);
+  if (!email) {
+    throw new NotFoundError("User not found");
+  }
+  try {
+    await cognito3.send(
+      new import_client_cognito_identity_provider3.AdminCreateUserCommand({
+        UserPoolId: USER_POOL_ID3,
+        Username: email,
+        MessageAction: "RESEND",
+        // Without this, RESEND regenerates with Cognito's own alphabet,
+        // which isn't URL-fragment-safe (see tempPassword).
+        TemporaryPassword: tempPassword(),
+        DesiredDeliveryMediums: ["EMAIL"]
+      })
+    );
+  } catch (err) {
+    throw translateCognitoError(err);
+  }
+  await recordEvent({
+    category: "users",
+    action: "user.reinvite",
+    subject: { kind: "user", id: userId, name: email },
+    target: userTarget(userId),
+    details: { delivery: "email" }
+  });
+  log12("resent invite", { userId, email });
+}
+async function resetUserMfa(userId) {
+  const email = await emailBySub(userId);
+  if (!email) {
+    throw new NotFoundError("User not found");
+  }
+  await cognito3.send(
+    new import_client_cognito_identity_provider3.AdminSetUserMFAPreferenceCommand({
+      UserPoolId: USER_POOL_ID3,
+      Username: email,
+      SoftwareTokenMfaSettings: { Enabled: false, PreferredMfa: false }
+    })
+  );
+  await recordEvent({
+    category: "users",
+    action: "user.mfa.reset",
+    subject: { kind: "user", id: userId, name: email },
+    target: userTarget(userId)
+  });
+  log12("reset MFA", { userId, email });
+}
+async function signOutEverywhere(userId) {
+  try {
+    await cognito3.send(new import_client_cognito_identity_provider3.AdminUserGlobalSignOutCommand({ UserPoolId: USER_POOL_ID3, Username: userId }));
+  } catch (err) {
+    if (err.name !== "UserNotFoundException") throw err;
+  }
+}
+async function assertNotLastAdmin(userId, admins) {
+  admins ??= await listAdminSubs();
+  if (admins.has(userId) && admins.size <= 1) {
+    throw new ConflictError(
+      "That would remove the last admin \u2014 make another user an admin first"
+    );
+  }
+}
+async function updateUser(userId, changes) {
+  const admins = changes.admin === void 0 ? void 0 : await listAdminSubs();
+  if (changes.admin === false) await assertNotLastAdmin(userId, admins);
+  const rows = [];
+  try {
+    if (changes.email !== void 0) {
+      const email = normalizeEmail(changes.email);
+      const previous = await emailBySub(userId).catch(() => void 0);
+      await cognito3.send(
+        new import_client_cognito_identity_provider3.AdminUpdateUserAttributesCommand({
+          UserPoolId: USER_POOL_ID3,
+          Username: userId,
+          UserAttributes: [
+            { Name: "email", Value: email },
+            { Name: "email_verified", Value: "true" }
+          ]
+        })
+      );
+      if (previous && previous !== email) await unlinkFederatedProviders(previous);
+      await linkFederatedProviders(userId, email);
+      if (previous !== email) {
+        rows.push({
+          category: "users",
+          action: "user.email.change",
+          subject: { kind: "user", id: userId, name: email },
+          target: userTarget(userId),
+          details: { changed: { email: { from: previous, to: email } } }
+        });
+      }
+    }
+    if (changes.admin !== void 0) {
+      const cmd = changes.admin ? new import_client_cognito_identity_provider3.AdminAddUserToGroupCommand({
+        UserPoolId: USER_POOL_ID3,
+        Username: userId,
+        GroupName: ADMIN_GROUP
+      }) : new import_client_cognito_identity_provider3.AdminRemoveUserFromGroupCommand({
+        UserPoolId: USER_POOL_ID3,
+        Username: userId,
+        GroupName: ADMIN_GROUP
+      });
+      await cognito3.send(cmd);
+      if (!changes.admin && admins.has(userId)) {
+        await signOutEverywhere(userId).catch(
+          (err) => log12("WARN: could not end the demoted admin's sessions", { userId, error: err.message })
+        );
+      }
+      if (changes.admin !== admins.has(userId)) {
+        rows.push({
+          category: "users",
+          action: changes.admin ? "user.admin.grant" : "user.admin.revoke",
+          subject: { kind: "user", id: userId },
+          target: userTarget(userId)
+        });
+      }
+    }
+  } catch (err) {
+    throw translateCognitoError(err);
+  }
+  await recordEvents(rows);
+  log12("updated user", { userId, ...changes });
+}
+async function deleteUser(userId) {
+  await assertNotLastAdmin(userId);
+  await removeSharesOwnedBy(userId);
+  const email = await emailBySub(userId).catch(() => void 0);
+  let alreadyGone = false;
+  try {
+    await signOutEverywhere(userId);
+    await cognito3.send(
+      new import_client_cognito_identity_provider3.AdminDeleteUserCommand({
+        UserPoolId: USER_POOL_ID3,
+        Username: userId
+      })
+    );
+  } catch (err) {
+    const translated = translateCognitoError(err);
+    if (!(translated instanceof NotFoundError)) throw translated;
+    alreadyGone = true;
+  }
+  await revokeAllForUser(userId);
+  await revokeAllResourcesForUser(userId);
+  await deleteRequestsForUser(userId);
+  await removeUserFromAllGroups(userId);
+  await recordEvent({
+    category: "users",
+    action: "user.delete",
+    subject: { kind: "user", id: userId, name: email },
+    target: userTarget(userId),
+    targetName: email
+  });
+  if (alreadyGone) {
+    log12("re-swept deleted user", { userId });
+    throw new NotFoundError(`User ${userId} not found`);
+  }
+  log12("deleted user", { userId });
+}
+async function deleteUsers(userIds, actingUserId) {
+  const results = [];
+  for (const userId of [...new Set(userIds)].filter(Boolean)) {
+    if (userId === actingUserId) {
+      results.push({
+        userId,
+        status: "FAILED",
+        message: "You can't delete your own account"
+      });
+      continue;
+    }
+    try {
+      await deleteUser(userId);
+      results.push({ userId, status: "DELETED" });
+    } catch (err) {
+      results.push({
+        userId,
+        status: "FAILED",
+        message: err.message || "Could not delete the user"
+      });
+    }
+  }
+  const deleted = results.filter((r) => r.status === "DELETED").length;
+  log12("bulk deleted users", { requested: userIds.length, deleted });
+  return results;
+}
+function emailLimitMessage(err) {
+  if (err.name !== "LimitExceededException" || !/email/i.test(err.message)) return null;
+  return process.env.EMAIL_CONFIGURED === "1" ? "The email service has reached its daily sending limit, so this invite was not sent and the user was not created. Check the SES sending quota in the AWS console (a sandboxed SES also delivers only to verified addresses) and try again tomorrow." : "Cognito's built-in email sender has reached its daily limit \u2014 about 50 messages per AWS account, shared by invites, sign-in codes and password resets \u2014 so this invite was not sent and the user was not created. Try again tomorrow, or set the `email` block in the deployment config so mail goes through SES from your own domain (see the Email deliverability runbook).";
+}
+function translateCognitoError(err) {
+  const name = err.name;
+  switch (name) {
+    case "LimitExceededException": {
+      const friendly = emailLimitMessage(err);
+      return friendly ? new ValidationError(friendly) : err;
+    }
+    case "UsernameExistsException":
+      return new ConflictError("A user with that email already exists");
+    case "UserNotFoundException":
+      return new NotFoundError("User not found");
+    case "AliasExistsException":
+      return new ConflictError("That email is already in use by another user");
+    case "UnsupportedUserStateException":
+      return new ConflictError("User has already completed account setup");
+    case "InvalidParameterException":
+    case "InvalidPasswordException":
+    case "CodeDeliveryFailureException":
+      return new ValidationError(err.message);
+    default:
+      return err;
+  }
+}
+var import_client_dynamodb13, import_lib_dynamodb13, import_client_cognito_identity_provider3, ddb13, cognito3, RESOURCES_TABLE_NAME5, USER_POOL_ID3, APP_URL, ADMIN_GROUP, log12, listDirectory, LIST_CAP, SUB_ATTR, normalizeEmail, userTarget, inviteRow, signupLink, failedInviteRow, withoutLink, PROVIDERS_TTL_MS, providersCache, LINK_ATTRIBUTE, BULK_EMAIL_RE, emailBySub;
+var init_usersService = __esm({
+  "lambdacode/api/services/usersService.ts"() {
+    "use strict";
+    import_client_dynamodb13 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb13 = require("@aws-sdk/lib-dynamodb");
+    import_client_cognito_identity_provider3 = require("@aws-sdk/client-cognito-identity-provider");
+    init_grantsService();
+    init_directory();
+    init_sharesService();
+    init_access2();
+    init_catalogIndex();
+    init_claims();
+    init_resourceGrantsService();
+    init_groupsService();
+    init_requestsService();
+    init_serviceUserRegistry();
+    init_auditService();
+    init_httpErrors();
+    init_tempPassword();
+    init_resourcesService();
+    ddb13 = import_lib_dynamodb13.DynamoDBDocumentClient.from(new import_client_dynamodb13.DynamoDBClient({}));
+    cognito3 = new import_client_cognito_identity_provider3.CognitoIdentityProviderClient({});
+    RESOURCES_TABLE_NAME5 = process.env.RESOURCES_TABLE_NAME;
+    USER_POOL_ID3 = process.env.USER_POOL_ID;
+    APP_URL = process.env.APP_URL ?? "";
+    ADMIN_GROUP = "admins";
+    log12 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    listDirectory = listDirectoryUsers;
+    LIST_CAP = 50;
+    SUB_ATTR = "sub";
+    normalizeEmail = (email) => email.trim();
+    userTarget = (userId) => `user#${userId}`;
+    inviteRow = (user, delivery, batchId) => ({
+      category: "users",
+      action: "user.invite",
+      subject: { kind: "user", id: user.userId, name: user.email },
+      target: userTarget(user.userId),
+      details: { admin: user.admin, batchId, delivery }
+    });
+    signupLink = (username, temp) => `${APP_URL}/login#inv=${username}:${temp}`;
+    failedInviteRow = (email, admin, reason, batchId) => ({
+      category: "users",
+      action: "user.invite",
+      outcome: "FAILED",
+      reason,
+      subject: { kind: "user", id: email, name: email },
+      details: { admin, batchId }
+    });
+    withoutLink = ({ signupLink: _link, ...user }) => user;
+    PROVIDERS_TTL_MS = 5 * 60 * 1e3;
+    LINK_ATTRIBUTE = "email";
+    BULK_EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    emailBySub = async (userId) => (await identityBySub(userId))?.email;
+  }
+});
+
+// lambdacode/api/services/requestsService.ts
+var requestsService_exports = {};
+__export(requestsService_exports, {
+  ADMIN_REVIEW_REASON: () => ADMIN_REVIEW_REASON,
+  DURATION_PRESET_HOURS: () => DURATION_PRESET_HOURS,
+  GROUP_REVIEW_REASON: () => GROUP_REVIEW_REASON,
+  REAPPROVAL_GRACE_DAYS: () => REAPPROVAL_GRACE_DAYS,
+  REAPPROVAL_INTERVAL_MONTHS: () => REAPPROVAL_INTERVAL_MONTHS,
+  REAPPROVAL_REASON: () => REAPPROVAL_REASON,
+  SERVICE_USER_REVIEW_REASON: () => SERVICE_USER_REVIEW_REASON,
+  approveRequest: () => approveRequest,
+  closePendingRequestsFor: () => closePendingRequestsFor,
+  createPluginReapprovalRequest: () => createPluginReapprovalRequest,
+  createReapprovalRequest: () => createReapprovalRequest,
+  createRequest: () => createRequest,
+  createResourceReapprovalRequest: () => createResourceReapprovalRequest,
+  createResourceRequest: () => createResourceRequest,
+  createReviewRequest: () => createReviewRequest,
+  deleteRequestsForUser: () => deleteRequestsForUser,
+  denyRequest: () => denyRequest,
+  groupTargetOf: () => groupTargetOf,
+  isDurationPreset: () => isDurationPreset,
+  listMyRequests: () => listMyRequests,
+  listRequestableResources: () => listRequestableResources,
+  listRequestableRoles: () => listRequestableRoles,
+  listRequests: () => listRequests,
+  markRequestsSeen: () => markRequestsSeen,
+  targetOfRequest: () => targetOfRequest
+});
+function isDurationPreset(hours) {
+  return DURATION_PRESET_HOURS.includes(hours);
+}
+async function listRequestableRoles(userId) {
+  const [index, held, pending] = await Promise.all([
+    catalog(),
+    listHeldAccountRoles(userId),
+    listPendingAccountRoles(userId)
+  ]);
+  const byAccount = /* @__PURE__ */ new Map();
+  for (const role of index.roleByKey.values()) {
+    const key = `${role.accountNumber}#${role.roleName}`;
+    const grant = held.get(key);
+    if (grant && !isExpired(grant) || pending.has(key)) continue;
+    const account = index.byNumber.get(role.accountNumber);
+    const entry = byAccount.get(role.accountNumber) ?? {
+      accountNumber: role.accountNumber,
+      name: account?.name,
+      ...account?.dims ? { dims: account.dims } : {},
+      roles: []
+    };
+    entry.roles.push({
+      roleName: role.roleName,
+      displayName: role.displayName,
+      description: role.description
+    });
+    byAccount.set(role.accountNumber, entry);
+  }
+  const accounts = [...byAccount.values()].sort(
+    (a, b) => (a.name ?? a.accountNumber).localeCompare(b.name ?? b.accountNumber)
+  );
+  for (const a of accounts) {
+    a.roles.sort((x, y) => x.roleName.localeCompare(y.roleName));
+  }
+  log13("listed requestable roles", { userId, accountCount: accounts.length });
+  return accounts;
+}
+async function createRequest(userId, accountNumber, roleName, reason, requestedDurationHours) {
+  const role = await ddb14.send(
+    new import_lib_dynamodb14.GetCommand({
+      TableName: ROLES_TABLE_NAME4,
+      Key: { accountNumber, roleName }
+    })
+  );
+  if (!role.Item) {
+    throw new NotFoundError(
+      `Role ${roleName} not found in account ${accountNumber}`
+    );
+  }
+  if (requestedDurationHours !== void 0 && !isDurationPreset(requestedDurationHours)) {
+    throw new ValidationError(
+      `duration must be one of ${DURATION_PRESET_HOURS.join(", ")} hours`
+    );
+  }
+  const key = `${accountNumber}#${roleName}`;
+  const [held, pending] = await Promise.all([
+    listHeldAccountRoles(userId),
+    listPendingAccountRoles(userId)
+  ]);
+  const heldGrant = held.get(key);
+  if (heldGrant && !heldGrant.expiresAt) {
+    throw new ConflictError(`You already have ${roleName} in ${accountNumber}`);
+  }
+  if (pending.has(key)) {
+    throw new ConflictError(
+      `You already have a pending request for ${roleName} in ${accountNumber}`
+    );
+  }
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId,
+    accountNumber,
+    roleName,
+    reason: reason?.trim() || void 0,
+    ...requestedDurationHours !== void 0 ? { requestedDurationHours } : {},
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(
+    new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request })
+  );
+  await recordEvent({
+    category: "request",
+    action: "request.create",
+    ...auditShape(request),
+    details: { requestId: request.requestId, requestedDurationHours, note: request.reason }
+  });
+  log13("created request", {
+    requestId: request.requestId,
+    userId,
+    key,
+    requestedDurationHours
+  });
+  return request;
+}
+async function listRequestableResources(userId) {
+  const [resources, index, held, pending] = await Promise.all([
+    listResources(),
+    catalog(),
+    listUserResourceGrants(userId),
+    listPendingResourceIds(userId)
+  ]);
+  const accountNames = new Map([...index.byNumber.values()].filter((a) => a.name).map((a) => [a.accountNumber, a.name]));
+  const heldById = new Map(held.map((g) => [g.resourceId, g]));
+  const out = [];
+  for (const r of resources) {
+    const grant = heldById.get(r.resourceId);
+    if (grant && !isExpired(grant) || pending.has(r.resourceId)) continue;
+    out.push({
+      resourceId: r.resourceId,
+      name: r.name,
+      type: r.type,
+      description: r.description,
+      accountNumber: r.accountNumber,
+      accountName: accountNames.get(r.accountNumber)
+    });
+  }
+  log13("listed requestable resources", { userId, count: out.length });
+  return out;
+}
+async function createResourceRequest(userId, resourceId, reason, requestedDurationHours) {
+  const resource = await getResource(resourceId);
+  if (requestedDurationHours !== void 0 && !isDurationPreset(requestedDurationHours)) {
+    throw new ValidationError(
+      `duration must be one of ${DURATION_PRESET_HOURS.join(", ")} hours`
+    );
+  }
+  const [held, pending] = await Promise.all([
+    listUserResourceGrants(userId),
+    listPendingResourceIds(userId)
+  ]);
+  const heldGrant = held.find((g) => g.resourceId === resourceId);
+  if (heldGrant && !heldGrant.expiresAt) {
+    throw new ConflictError(`You already have access to ${resource.name}`);
+  }
+  if (pending.has(resourceId)) {
+    throw new ConflictError(
+      `You already have a pending request for ${resource.name}`
+    );
+  }
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId,
+    kind: "RESOURCE",
+    resourceId,
+    reason: reason?.trim() || void 0,
+    ...requestedDurationHours !== void 0 ? { requestedDurationHours } : {},
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(
+    new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request })
+  );
+  await recordEvent({
+    category: "request",
+    action: "request.create",
+    ...auditShape(request),
+    targetName: resource.name,
+    accountNumber: resource.accountNumber,
+    details: { requestId: request.requestId, requestedDurationHours, note: request.reason }
+  });
+  log13("created resource request", {
+    requestId: request.requestId,
+    userId,
+    resourceId,
+    requestedDurationHours
+  });
+  return request;
+}
+async function createResourceReapprovalRequest(userId, resourceId) {
+  let resource;
+  try {
+    resource = await getResource(resourceId);
+  } catch (err) {
+    if (err instanceof NotFoundError) return null;
+    throw err;
+  }
+  const pending = await listPendingResourceIds(userId);
+  if (pending.has(resourceId)) return null;
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId,
+    kind: "RESOURCE",
+    resourceId,
+    type: "REAPPROVAL",
+    reason: REAPPROVAL_REASON,
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(
+    new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request })
+  );
+  await recordReviewRaised(request, { targetName: resource.name, accountNumber: resource.accountNumber });
+  log13("created resource reapproval request", {
+    requestId: request.requestId,
+    userId,
+    resourceId
+  });
+  return request;
+}
+async function createPluginReapprovalRequest(userId, pluginId, accountNumber, permission) {
+  const pending = await listPendingRows(userId);
+  const dup = pending.some(
+    (it) => it.kind === "PLUGIN" && it.pluginId === pluginId && it.accountNumber === accountNumber && it.permission === permission
+  );
+  if (dup) return null;
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId,
+    kind: "PLUGIN",
+    pluginId,
+    accountNumber,
+    permission,
+    type: "REAPPROVAL",
+    reason: REAPPROVAL_REASON,
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request }));
+  await recordReviewRaised(request);
+  log13("created plugin reapproval request", { requestId: request.requestId, userId, pluginId, accountNumber, permission });
+  return request;
+}
+async function createReapprovalRequest(userId, accountNumber, roleName) {
+  const key = `${accountNumber}#${roleName}`;
+  const pending = await listPendingAccountRoles(userId);
+  if (pending.has(key)) return null;
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId,
+    accountNumber,
+    roleName,
+    type: "REAPPROVAL",
+    reason: REAPPROVAL_REASON,
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(
+    new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request })
+  );
+  await recordReviewRaised(request);
+  log13("created reapproval request", { requestId: request.requestId, userId, key });
+  return request;
+}
+async function createReviewRequest(subjectId, kind) {
+  const pending = await listPendingRows(subjectId);
+  if (pending.some((it) => it.kind === kind)) return null;
+  const request = {
+    requestId: (0, import_crypto4.randomUUID)(),
+    userId: subjectId,
+    kind,
+    // A GROUP review is the whole bundle at once (one question per group, however many roles it holds).
+    ...kind === "GROUP" ? { groupId: subjectId } : {},
+    type: "REAPPROVAL",
+    reason: kind === "ADMIN" ? ADMIN_REVIEW_REASON : kind === "SERVICE_USER" ? SERVICE_USER_REVIEW_REASON : GROUP_REVIEW_REASON,
+    status: "PENDING",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await ddb14.send(
+    new import_lib_dynamodb14.PutCommand({ TableName: REQUESTS_TABLE_NAME, Item: request })
+  );
+  await recordReviewRaised(request);
+  log13("created review request", {
+    requestId: request.requestId,
+    subjectId,
+    kind
+  });
+  return request;
+}
+async function listMyRequests(userId) {
+  const items = await queryAll({
+    TableName: REQUESTS_TABLE_NAME,
+    IndexName: "byUser",
+    KeyConditionExpression: "userId = :u",
+    ExpressionAttributeValues: { ":u": userId },
+    ScanIndexForward: false
+    // newest first
+  });
+  log13("listed my requests", { userId, count: items.length });
+  return items;
+}
+async function markRequestsSeen(userId) {
+  const mine = await listMyRequests(userId);
+  const unseen = mine.filter((r) => r.status !== "PENDING" && !r.seen);
+  for (const r of unseen) {
+    try {
+      await ddb14.send(
+        new import_lib_dynamodb14.UpdateCommand({
+          TableName: REQUESTS_TABLE_NAME,
+          Key: { requestId: r.requestId },
+          UpdateExpression: "SET seen = :true",
+          // The condition means a mismatched id can never touch someone else's row.
+          ConditionExpression: "userId = :u",
+          ExpressionAttributeValues: { ":true": true, ":u": userId }
+        })
+      );
+    } catch (err) {
+      if (err.name !== CONDITION_FAILED2) throw err;
+    }
+  }
+  if (unseen.length) log13("marked requests seen", { userId, count: unseen.length });
+  return unseen.length;
+}
+async function listRequests(status) {
+  if (!status) {
+    const all = await scanAll3({ TableName: REQUESTS_TABLE_NAME });
+    return all.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  }
+  const items = await queryAll({
+    TableName: REQUESTS_TABLE_NAME,
+    IndexName: "byStatus",
+    KeyConditionExpression: "#s = :s",
+    ExpressionAttributeNames: STATUS_ALIAS,
+    ExpressionAttributeValues: { ":s": status },
+    ScanIndexForward: true
+    // oldest first — longest wait at the top
+  });
+  log13("listed requests", { status, count: items.length });
+  return items;
+}
+async function approveRequest(requestId, adminUserId, note, durationHours) {
+  if (durationHours !== void 0 && !isDurationPreset(durationHours)) {
+    throw new ValidationError(
+      `duration must be one of ${DURATION_PRESET_HOURS.join(", ")} hours`
+    );
+  }
+  if (durationHours !== void 0) {
+    const current = await ddb14.send(
+      new import_lib_dynamodb14.GetCommand({ TableName: REQUESTS_TABLE_NAME, Key: { requestId } })
+    );
+    if (current.Item?.type === "REAPPROVAL") {
+      throw new ValidationError("A reapproval renews the existing grant as it is \u2014 a duration does not apply");
+    }
+  }
+  const claimed = await decide(
+    requestId,
+    "APPROVED",
+    adminUserId,
+    note,
+    durationHours
+  );
+  const expiresAt = durationHours !== void 0 && claimed.decidedAt ? new Date(
+    Date.parse(claimed.decidedAt) + durationHours * 60 * 60 * 1e3
+  ).toISOString() : void 0;
+  try {
+    if (claimed.kind === "GROUP") {
+      await markGroupReviewed(claimed.userId, adminUserId);
+    } else if (claimed.kind === "ADMIN") {
+      await upsertPref(claimed.userId, ADMIN_REVIEW_TARGET, {
+        reviewedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    } else if (claimed.kind === "SERVICE_USER") {
+      await markReviewed(claimed.userId);
+    } else if (claimed.groupId) {
+      if (claimed.kind === "PLUGIN") await assertPluginAssignable(pluginKeyOf(claimed));
+      await restampGroupTarget(claimed.groupId, groupTargetOf(claimed), adminUserId);
+    } else if (claimed.kind === "PLUGIN") {
+      if (claimed.type === "REAPPROVAL") await assertStillHeld(claimed);
+      await assignPlugin({ ...pluginKeyOf(claimed), principal: { kind: "user", userId: claimed.userId }, grantedBy: adminUserId, fromRequestId: requestId });
+    } else if (claimed.type === "REAPPROVAL" && claimed.kind === "RESOURCE") {
+      await renewResourceGrant(claimed.resourceId, claimed.userId, adminUserId, { fromRequestId: requestId });
+    } else if (claimed.type === "REAPPROVAL") {
+      await renewRole(claimed.accountNumber, claimed.roleName, claimed.userId, adminUserId, { fromRequestId: requestId });
+    } else if (claimed.kind === "RESOURCE") {
+      await assignResource(
+        claimed.resourceId,
+        claimed.userId,
+        adminUserId,
+        expiresAt,
+        { fromRequestId: requestId }
+      );
+    } else {
+      await assignRole(
+        claimed.accountNumber,
+        claimed.roleName,
+        claimed.userId,
+        adminUserId,
+        expiresAt,
+        { fromRequestId: requestId }
+      );
+    }
+  } catch (err) {
+    await releaseClaim(requestId);
+    log13("ERROR: approve failed, request returned to pending", {
+      requestId,
+      error: err.message
+    });
+    throw err;
+  }
+  await recordEvent({
+    category: "request",
+    action: "request.approve",
+    ...auditShape(claimed),
+    details: { requestId, durationHours, note, expiresAt, ...reviewFlag(claimed) }
+  });
+  log13("approved request", {
+    requestId,
+    userId: claimed.userId,
+    accountNumber: claimed.accountNumber,
+    roleName: claimed.roleName,
+    adminUserId
+  });
+  return claimed;
+}
+async function denyRequest(requestId, adminUserId, note) {
+  const decided = await decide(requestId, "DENIED", adminUserId, note);
+  if (decided.type === "REAPPROVAL") {
+    if (decided.kind === "ADMIN" || decided.kind === "SERVICE_USER" || decided.kind === "GROUP") {
+      try {
+        if (decided.kind === "ADMIN") {
+          await lazyUsers().updateUser(decided.userId, { admin: false });
+        } else if (decided.kind === "GROUP") {
+          await deleteGroup(decided.userId);
+        } else {
+          await deleteServiceUser(decided.userId);
+        }
+      } catch (err) {
+        if (!(err instanceof NotFoundError)) {
+          await releaseClaim(requestId);
+          throw err;
+        }
+      }
+    } else {
+      try {
+        if (decided.groupId) {
+          await revokeGroupTarget(decided.groupId, groupTargetOf(decided));
+        } else if (decided.kind === "PLUGIN") {
+          await revokePlugin({ ...pluginKeyOf(decided), principal: { kind: "user", userId: decided.userId }, via: "REAPPROVAL" });
+        } else if (decided.kind === "RESOURCE") {
+          await revokeResourceGrant(
+            decided.resourceId,
+            decided.userId,
+            "REAPPROVAL"
+          );
+        } else {
+          await revokeRole(
+            decided.accountNumber,
+            decided.roleName,
+            decided.userId,
+            "REAPPROVAL"
+          );
+        }
+      } catch (err) {
+        if (!(err instanceof NotFoundError) && !(err instanceof ConflictError)) {
+          await releaseClaim(requestId);
+          throw err;
+        }
+      }
+    }
+  }
+  await recordEvent({
+    category: "request",
+    action: "request.deny",
+    reason: note || void 0,
+    ...auditShape(decided),
+    details: { requestId, note: note || void 0, ...reviewFlag(decided) }
+  });
+  log13("denied request", {
+    requestId,
+    userId: decided.userId,
+    adminUserId,
+    type: decided.type ?? "ACCESS"
+  });
+  return decided;
+}
+function groupTargetOf(req) {
+  if (req.kind === "RESOURCE") return resourceTarget(req.resourceId);
+  if (req.kind === "PLUGIN") return pluginTarget(req.pluginId, req.accountNumber, req.permission);
+  return roleTarget(req.accountNumber, req.roleName);
+}
+function auditShape(req) {
+  const subject = req.groupId ? { kind: "group", id: req.groupId } : { kind: req.kind === "SERVICE_USER" ? "serviceUser" : "user", id: req.userId };
+  const hasTarget = req.kind === "RESOURCE" ? Boolean(req.resourceId) : req.kind === "PLUGIN" ? Boolean(req.pluginId && req.accountNumber && req.permission) : req.kind !== "ADMIN" && req.kind !== "SERVICE_USER" && req.kind !== "GROUP" && Boolean(req.accountNumber && req.roleName);
+  return hasTarget ? { subject, target: groupTargetOf(req), targetName: req.roleName } : { subject };
+}
+async function recordReviewRaised(request, snapshot2 = {}) {
+  await recordEvent({
+    category: "request",
+    action: "review.raise",
+    ...auditShape(request),
+    ...snapshot2,
+    details: { requestId: request.requestId }
+  });
+}
+async function decide(requestId, status, adminUserId, note, grantedDurationHours) {
+  const current = await ddb14.send(
+    new import_lib_dynamodb14.GetCommand({ TableName: REQUESTS_TABLE_NAME, Key: { requestId } })
+  );
+  const pending = current.Item;
+  if (pending?.kind === "ADMIN" && pending.userId === adminUserId) {
+    const admins = await lazyUsers().listAdminSubs();
+    if (admins.size > 1) {
+      throw new ConflictError(
+        "This is your own admin review \u2014 another admin must decide it."
+      );
+    }
+  }
+  try {
+    const res = await ddb14.send(
+      new import_lib_dynamodb14.UpdateCommand({
+        TableName: REQUESTS_TABLE_NAME,
+        Key: { requestId },
+        UpdateExpression: "SET #s = :next, decidedAt = :at, decidedBy = :by, seen = :false" + (note ? ", decisionNote = :note" : "") + (grantedDurationHours !== void 0 ? ", grantedDurationHours = :dur" : ""),
+        ConditionExpression: "attribute_exists(requestId) AND #s = :pending",
+        ExpressionAttributeNames: STATUS_ALIAS,
+        ExpressionAttributeValues: {
+          ":next": status,
+          ":pending": "PENDING",
+          ":at": (/* @__PURE__ */ new Date()).toISOString(),
+          ":by": adminUserId,
+          ":false": false,
+          ...note ? { ":note": note } : {},
+          ...grantedDurationHours !== void 0 ? { ":dur": grantedDurationHours } : {}
+        },
+        ReturnValues: "ALL_NEW"
+      })
+    );
+    return res.Attributes;
+  } catch (err) {
+    if (err.name === CONDITION_FAILED2) {
+      const current2 = await ddb14.send(
+        new import_lib_dynamodb14.GetCommand({
+          TableName: REQUESTS_TABLE_NAME,
+          Key: { requestId }
+        })
+      );
+      if (!current2.Item) {
+        throw new NotFoundError(`Request ${requestId} not found`);
+      }
+      throw new ConflictError(
+        `Request was already ${String(current2.Item.status).toLowerCase()}`
+      );
+    }
+    throw err;
+  }
+}
+async function releaseClaim(requestId) {
+  try {
+    await ddb14.send(
+      new import_lib_dynamodb14.UpdateCommand({
+        TableName: REQUESTS_TABLE_NAME,
+        Key: { requestId },
+        UpdateExpression: "SET #s = :pending REMOVE decidedAt, decidedBy, seen, decisionNote, grantedDurationHours",
+        ConditionExpression: "attribute_exists(requestId)",
+        ExpressionAttributeNames: STATUS_ALIAS,
+        ExpressionAttributeValues: { ":pending": "PENDING" }
+      })
+    );
+  } catch (err) {
+    if (err.name !== CONDITION_FAILED2) {
+      log13("ERROR: could not roll back request claim", {
+        requestId,
+        error: err.message
+      });
+    }
+  }
+}
+async function deleteRequestsForUser(userId, opts = {}) {
+  const targets = opts.targets ? new Set(opts.targets) : void 0;
+  const except = new Set(opts.exceptKinds ?? []);
+  const rows = await queryAll({
+    TableName: REQUESTS_TABLE_NAME,
+    IndexName: "byUser",
+    KeyConditionExpression: "userId = :u",
+    ExpressionAttributeValues: { ":u": userId },
+    ProjectionExpression: "requestId, #s, #t, #k, accountNumber, roleName, resourceId, pluginId, #p",
+    ExpressionAttributeNames: { ...STATUS_ALIAS, "#t": "type", "#k": "kind", "#p": "permission" }
+  });
+  const mine = rows.filter(
+    (r) => (!opts.onlyPending || r.status === "PENDING") && (!opts.onlyReviews || r.type === "REAPPROVAL") && !(r.kind && except.has(r.kind)) && (!opts.target || targetOfRequest(r) === opts.target) && (!targets || targets.has(targetOfRequest(r) ?? ""))
+  );
+  for (const r of mine) {
+    await ddb14.send(
+      new import_lib_dynamodb14.DeleteCommand({
+        TableName: REQUESTS_TABLE_NAME,
+        Key: { requestId: r.requestId }
+      })
+    );
+  }
+  if (mine.length) {
+    log13("deleted requests", { userId, removed: mine.length, ...opts });
+  }
+  return mine.length;
+}
+async function closePendingRequestsFor(targets, note) {
+  const wanted = new Set(Array.isArray(targets) ? targets : [targets]);
+  if (!wanted.size) return 0;
+  const pending = (await listRequests("PENDING")).filter((r) => {
+    const t = targetOfRequest(r);
+    return t !== void 0 && wanted.has(t);
+  });
+  const by = currentActor()?.id ?? "system:catalog";
+  let closed = 0;
+  for (const r of pending) {
+    const reason = typeof note === "function" ? note(targetOfRequest(r)) : note;
+    try {
+      const decided = await decide(r.requestId, "DENIED", by, reason);
+      await recordEvent({
+        category: "request",
+        action: "request.deny",
+        reason,
+        ...auditShape(decided),
+        details: { requestId: r.requestId, note: reason, ...reviewFlag(decided), catalogCascade: true }
+      });
+      closed++;
+    } catch (err) {
+      if (!(err instanceof ConflictError) && !(err instanceof NotFoundError)) throw err;
+    }
+  }
+  if (closed) log13("closed pending requests for removed targets", { targets: [...wanted], closed });
+  return closed;
+}
+function targetOfRequest(r) {
+  if (r.kind === "ADMIN" || r.kind === "SERVICE_USER" || r.kind === "GROUP") return void 0;
+  if (r.kind === "RESOURCE") return r.resourceId ? resourceTarget(r.resourceId) : void 0;
+  if (r.kind === "PLUGIN") {
+    return r.pluginId && r.accountNumber && r.permission ? pluginTarget(r.pluginId, r.accountNumber, r.permission) : void 0;
+  }
+  return r.accountNumber && r.roleName ? roleTarget(r.accountNumber, r.roleName) : void 0;
+}
+async function assertStillHeld(req) {
+  const target = targetOfRequest(req);
+  if (!target || !await getRow(userPrincipal(req.userId), target)) {
+    throw new ConflictError("This review's access was already revoked \u2014 there is nothing to renew");
+  }
+}
+async function listHeldAccountRoles(userId) {
+  const grants = await listUserGrants(userId);
+  return new Map(
+    grants.map((g) => [`${g.accountNumber}#${g.roleName}`, { expiresAt: g.expiresAt }])
+  );
+}
+async function listPendingAccountRoles(userId) {
+  const items = await listPendingRows(userId);
+  return new Set(
+    items.filter((it) => it.kind !== "RESOURCE" && it.kind !== "PLUGIN" && it.accountNumber).map((it) => `${it.accountNumber}#${it.roleName}`)
+  );
+}
+async function listPendingResourceIds(userId) {
+  const items = await listPendingRows(userId);
+  return new Set(
+    items.filter((it) => it.kind === "RESOURCE").map((it) => it.resourceId)
+  );
+}
+async function listPendingRows(userId) {
+  return queryAll({
+    TableName: REQUESTS_TABLE_NAME,
+    IndexName: "byUser",
+    KeyConditionExpression: "userId = :u",
+    FilterExpression: "#s = :pending",
+    ExpressionAttributeNames: STATUS_ALIAS,
+    ExpressionAttributeValues: { ":u": userId, ":pending": "PENDING" }
+  });
+}
+async function queryAll(input) {
+  const all = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb14.send(
+      new import_lib_dynamodb14.QueryCommand({ ...input, ExclusiveStartKey })
+    );
+    all.push(...page.Items ?? []);
+    ExclusiveStartKey = page.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return all;
+}
+async function scanAll3(input) {
+  const all = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb14.send(
+      new import_lib_dynamodb14.ScanCommand({ ...input, ExclusiveStartKey })
+    );
+    all.push(...page.Items ?? []);
+    ExclusiveStartKey = page.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return all;
+}
+var import_crypto4, import_client_dynamodb14, import_lib_dynamodb14, lazyUsers, ddb14, REQUESTS_TABLE_NAME, ROLES_TABLE_NAME4, log13, CONDITION_FAILED2, STATUS_ALIAS, REAPPROVAL_INTERVAL_MONTHS, REAPPROVAL_GRACE_DAYS, REAPPROVAL_REASON, DURATION_PRESET_HOURS, ADMIN_REVIEW_REASON, SERVICE_USER_REVIEW_REASON, GROUP_REVIEW_REASON, pluginKeyOf, reviewFlag;
+var init_requestsService = __esm({
+  "lambdacode/api/services/requestsService.ts"() {
+    "use strict";
+    import_crypto4 = require("crypto");
+    import_client_dynamodb14 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb14 = require("@aws-sdk/lib-dynamodb");
+    init_grantsService();
+    init_resourceGrantsService();
+    init_resourcesService();
+    init_access2();
+    init_pluginGrantsService();
+    init_groupsService();
+    init_serviceUsersService();
+    init_auditService();
+    init_actorContext();
+    init_httpErrors();
+    init_catalogIndex();
+    lazyUsers = () => (init_usersService(), __toCommonJS(usersService_exports));
+    ddb14 = import_lib_dynamodb14.DynamoDBDocumentClient.from(new import_client_dynamodb14.DynamoDBClient({}));
+    REQUESTS_TABLE_NAME = process.env.REQUESTS_TABLE_NAME;
+    ROLES_TABLE_NAME4 = process.env.ROLES_TABLE_NAME;
+    log13 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    CONDITION_FAILED2 = "ConditionalCheckFailedException";
+    STATUS_ALIAS = { "#s": "status" };
+    REAPPROVAL_INTERVAL_MONTHS = 12;
+    REAPPROVAL_GRACE_DAYS = 14;
+    REAPPROVAL_REASON = "12-month reapproval \u2014 standing access is due for periodic review.";
+    DURATION_PRESET_HOURS = [1, 12, 24, 72, 168, 720];
+    ADMIN_REVIEW_REASON = "12-month review \u2014 should this user remain an admin?";
+    SERVICE_USER_REVIEW_REASON = "12-month review \u2014 is this automation still needed?";
+    GROUP_REVIEW_REASON = "12-month review \u2014 is this group's standing access still needed?";
+    pluginKeyOf = (req) => ({ pluginId: req.pluginId, accountNumber: req.accountNumber, permission: req.permission });
+    reviewFlag = (req) => req.type === "REAPPROVAL" ? { review: true } : {};
+  }
+});
+
+// lambdacode/reapproval/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(handler_exports);
+
+// lambdacode/api/services/reapprovalService.ts
+init_requestsService();
+init_access2();
+init_serviceUsersService();
+init_groupsService();
+init_pluginAccess();
+init_pluginGrantsService();
+init_usersService();
+init_auditService();
+init_actorContext();
+init_httpErrors();
+var SYSTEM_ACTOR = "system:reapproval";
+var AUTO_REVOKE_NOTE = "Auto-revoked: 12-month reapproval was not completed within the grace period.";
+var log14 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+function addMonths(iso, months) {
+  const d = new Date(iso);
+  d.setMonth(d.getMonth() + months);
+  return d.getTime();
+}
+var pendingKey = (r) => r.kind === "GROUP" ? `${r.userId}#GROUP` : `${r.groupId ?? r.userId}#${groupTargetOf(r)}`;
+async function sweepReapprovals(now = Date.now()) {
+  const pending = (await listRequests("PENDING")).filter((r) => r.type === "REAPPROVAL");
+  const pendingByKey = /* @__PURE__ */ new Map();
+  for (const r of pending) {
+    if (r.kind === "ADMIN" || r.kind === "SERVICE_USER") continue;
+    pendingByKey.set(pendingKey(r), r);
+  }
+  const graceMs = REAPPROVAL_GRACE_DAYS * 24 * 60 * 60 * 1e3;
+  const lapsed = (req) => Boolean(req.createdAt) && now >= Date.parse(req.createdAt) + graceMs;
+  const rows = await scanAll();
+  const expired = await logExpiries(rows, now);
+  const plugins = await loadPluginContext();
+  const direct = standingDirectGrants(rows, plugins);
+  const groups = standingGroups(rows, await listGroupRows());
+  let raised = 0;
+  let revoked = 0;
+  const review = async (items, msg) => {
+    for (const g of items) {
+      if (!g.grantedAt) continue;
+      if (now < addMonths(g.grantedAt, REAPPROVAL_INTERVAL_MONTHS)) continue;
+      const req = pendingByKey.get(g.key);
+      if (req) {
+        if (!lapsed(req)) continue;
+        try {
+          await denyRequest(req.requestId, SYSTEM_ACTOR, AUTO_REVOKE_NOTE);
+        } catch (err) {
+          if (!(err instanceof NotFoundError) && !(err instanceof ConflictError)) throw err;
+          continue;
+        }
+        revoked++;
+        log14(msg.lapsed, { key: g.key });
+      } else if (g.available) {
+        const created = await g.raise();
+        if (created) {
+          raised++;
+          log14(msg.raised, { key: g.key });
+        }
+      }
+    }
+  };
+  await review(direct.roles, { raised: "reapproval raised", lapsed: "reapproval lapsed \u2014 access revoked" });
+  await review(direct.resources, { raised: "resource reapproval raised", lapsed: "resource reapproval lapsed \u2014 access revoked" });
+  await review(direct.plugins, { raised: "plugin reapproval raised", lapsed: "plugin reapproval lapsed \u2014 access revoked" });
+  await review(groups, { raised: "group review raised", lapsed: "group review lapsed \u2014 group removed" });
+  const pendingReviewSubjects = new Set(
+    pending.filter((r) => r.kind === "ADMIN" || r.kind === "SERVICE_USER").map((r) => `${r.kind}#${r.userId}`)
+  );
+  for (const su of await reviewableServiceUsers()) {
+    if (now < addMonths(su.since, REAPPROVAL_INTERVAL_MONTHS)) continue;
+    if (pendingReviewSubjects.has(`SERVICE_USER#${su.clientId}`)) continue;
+    const created = await createReviewRequest(su.clientId, "SERVICE_USER");
+    if (created) {
+      raised++;
+      log14("service-user review raised", { clientId: su.clientId });
+    }
+  }
+  for (const sub of await listAdminSubs()) {
+    if (pendingReviewSubjects.has(`ADMIN#${sub}`)) continue;
+    const stamp = await getRow(userPrincipal(sub), ADMIN_REVIEW_TARGET);
+    const since = typeof stamp?.reviewedAt === "string" ? stamp.reviewedAt : void 0;
+    if (since && now < addMonths(since, REAPPROVAL_INTERVAL_MONTHS)) continue;
+    const created = await createReviewRequest(sub, "ADMIN");
+    if (created) {
+      raised++;
+      log14("admin review raised", { userId: sub });
+    }
+  }
+  const all = [...direct.roles, ...direct.resources, ...direct.plugins, ...groups];
+  const result = { scanned: all.filter((g) => g.available).length, raised, revoked, expired };
+  log14("reapproval sweep complete", result);
+  return result;
+}
+async function logExpiries(rows, now) {
+  const due = rows.filter(
+    (r) => parsePrincipal(r.principal)?.kind === "user" && isGrantTarget(r.target) && parseTarget(r.target)?.kind !== "share" && r.expiryLoggedAt === void 0 && isExpired(r, now)
+  );
+  if (!due.length) return 0;
+  await runAsActor(
+    systemActor("expiry", "expiry sweep"),
+    () => recordEvents(
+      due.map((r) => {
+        const t = parseTarget(r.target);
+        return {
+          category: "access",
+          action: "access.expire",
+          subject: { kind: "user", id: r.principal.slice("user#".length) },
+          target: r.target,
+          targetName: t?.kind === "role" ? t.roleName : void 0,
+          details: { via: "EXPIRY", expiresAt: r.expiresAt }
+        };
+      })
+    )
+  );
+  const loggedAt = new Date(now).toISOString();
+  for (const r of due) await updateExisting(r.principal, r.target, { expiryLoggedAt: loggedAt });
+  log14("expired grants logged", { count: due.length });
+  return due.length;
+}
+function standingDirectGrants(rows, plugins) {
+  const roles = [];
+  const resources = [];
+  for (const r of rows) {
+    if (r.expiresAt) continue;
+    const p = parsePrincipal(r.principal);
+    const t = parseTarget(r.target);
+    if (p?.kind !== "user") continue;
+    const key = `${p.userId}#${r.target}`;
+    if (t?.kind === "role") {
+      roles.push({ key, grantedAt: r.grantedAt, available: true, raise: () => createReapprovalRequest(p.userId, t.accountNumber, t.roleName) });
+    } else if (t?.kind === "resource") {
+      resources.push({ key, grantedAt: r.grantedAt, available: true, raise: () => createResourceReapprovalRequest(p.userId, t.resourceId) });
+    }
+  }
+  const pluginRows = standingPluginGrants(rows, plugins).map((g) => ({
+    key: `${g.userId}#${g.target}`,
+    grantedAt: g.grantedAt,
+    available: g.available,
+    raise: () => createPluginReapprovalRequest(g.userId, g.pluginId, g.accountNumber, g.permission)
+  }));
+  return { roles, resources, plugins: pluginRows };
+}
+function standingGroups(rows, groups) {
+  const newestRow = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const p = parsePrincipal(r.principal);
+    if (p?.kind !== "group" || !isGrantTarget(r.target) || !r.grantedAt) continue;
+    const seen = newestRow.get(p.groupId);
+    if (!seen || r.grantedAt > seen) newestRow.set(p.groupId, r.grantedAt);
+  }
+  const latest = (...stamps) => stamps.filter((s) => Boolean(s)).sort().at(-1);
+  return groups.filter((g) => newestRow.has(g.groupId)).map((g) => ({
+    key: `${g.groupId}#GROUP`,
+    grantedAt: latest(g.reviewedAt, newestRow.get(g.groupId)) ?? g.createdAt,
+    available: true,
+    raise: () => createReviewRequest(g.groupId, "GROUP")
+  }));
+}
+
+// lambdacode/reapproval/handler.ts
+init_actorContext();
+var handler = async () => {
+  return runAsActor(systemActor("reapproval", "yearly review"), () => sweepReapprovals());
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});