@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/acl-reconciler/index.js

@@ -0,0 +1,1604 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../infra-client-plugin-sdk/src/contracts/manifest.ts
+var PLUGIN_PERMISSIONS, PLUGIN_ID_PATTERN, AWS_ACCOUNT_PATTERN;
+var init_manifest = __esm({
+  "../infra-client-plugin-sdk/src/contracts/manifest.ts"() {
+    "use strict";
+    PLUGIN_PERMISSIONS = ["user", "admin"];
+    PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+    AWS_ACCOUNT_PATTERN = /^\d{12}$/;
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/validate.ts
+var init_validate = __esm({
+  "../infra-client-plugin-sdk/src/contracts/validate.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/canonical.ts
+var init_canonical = __esm({
+  "../infra-client-plugin-sdk/src/contracts/canonical.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/paths.ts
+var init_paths = __esm({
+  "../infra-client-plugin-sdk/src/contracts/paths.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/access.ts
+function parsePluginTargetKey(key) {
+  if (!key.startsWith(PLUGIN_TARGET_PREFIX)) return null;
+  const parts = key.slice(PLUGIN_TARGET_PREFIX.length).split("#");
+  if (parts.length !== 3) return null;
+  const [pluginId, accountNumber, permission] = parts;
+  if (!PLUGIN_ID_PATTERN.test(pluginId) || !AWS_ACCOUNT_PATTERN.test(accountNumber)) return null;
+  if (!PLUGIN_PERMISSIONS.includes(permission)) return null;
+  return { pluginId, accountNumber, permission };
+}
+var PLUGIN_TARGET_PREFIX;
+var init_access = __esm({
+  "../infra-client-plugin-sdk/src/contracts/access.ts"() {
+    "use strict";
+    init_manifest();
+    PLUGIN_TARGET_PREFIX = "plugin#";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/catalog.ts
+var init_catalog = __esm({
+  "../infra-client-plugin-sdk/src/contracts/catalog.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/discovery.ts
+var init_discovery = __esm({
+  "../infra-client-plugin-sdk/src/contracts/discovery.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/contracts/authorizer.ts
+var init_authorizer = __esm({
+  "../infra-client-plugin-sdk/src/contracts/authorizer.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/backend/context.ts
+var init_context = __esm({
+  "../infra-client-plugin-sdk/src/backend/context.ts"() {
+    "use strict";
+  }
+});
+
+// ../infra-client-plugin-sdk/src/backend/index.ts
+var init_backend = __esm({
+  "../infra-client-plugin-sdk/src/backend/index.ts"() {
+    "use strict";
+    init_manifest();
+    init_validate();
+    init_canonical();
+    init_paths();
+    init_access();
+    init_catalog();
+    init_discovery();
+    init_authorizer();
+    init_context();
+  }
+});
+
+// lambdacode/api/services/access.ts
+function parsePrincipal(p) {
+  if (p.startsWith("user#")) return { kind: "user", userId: p.slice(5) };
+  if (p.startsWith("group#")) return { kind: "group", groupId: p.slice(6) };
+  return null;
+}
+function parseTarget(t) {
+  if (t.startsWith("role#")) {
+    const rest = t.slice(5);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "role", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  if (t.startsWith("resource#")) return { kind: "resource", resourceId: t.slice(9) };
+  if (t.startsWith("share#")) return { kind: "share", shareId: t.slice(6) };
+  if (t.startsWith("plugin#")) {
+    const p = parsePluginTargetKey(t);
+    return p ? { kind: "plugin", ...p } : null;
+  }
+  if (t.startsWith("member#")) return { kind: "member", groupId: t.slice(7) };
+  if (t.startsWith("pref#role#")) {
+    const rest = t.slice(10);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "pref", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  return null;
+}
+function isExpired(row, now = Date.now()) {
+  return Boolean(row.expiresAt) && !(Date.parse(row.expiresAt) > now);
+}
+async function scanAll(opts = {}) {
+  const rows = [];
+  const prefixes = opts.targetPrefixes ?? [];
+  const filter = prefixes.length ? {
+    FilterExpression: prefixes.map((_, i) => `begins_with(#t, :p${i})`).join(" OR "),
+    ExpressionAttributeNames: { "#t": "target" },
+    ExpressionAttributeValues: Object.fromEntries(prefixes.map((p, i) => [`:p${i}`, p]))
+  } : {};
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb.send(
+      new import_lib_dynamodb.ScanCommand({ TableName: ACCESS_TABLE_NAME, ExclusiveStartKey, ...filter })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+function entryOf(target, direct, groups, now) {
+  const d = direct ? { grantedBy: direct.grantedBy, grantedAt: direct.grantedAt, expiresAt: direct.expiresAt } : void 0;
+  const directActive = Boolean(direct && !isExpired(direct, now));
+  const active = directActive || groups.length > 0;
+  return {
+    target,
+    direct: d,
+    groups,
+    active,
+    expiresAt: groups.length === 0 && directActive ? direct?.expiresAt : void 0
+  };
+}
+function buildSnapshot(rows, now = Date.now()) {
+  const groupTargets = /* @__PURE__ */ new Map();
+  const groupMembers = /* @__PURE__ */ new Map();
+  const directRows = /* @__PURE__ */ new Map();
+  const userRows = [];
+  const presence = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const p = parsePrincipal(r.principal);
+    if (!p) continue;
+    if (p.kind === "user" && r.target === PRESENCE_TARGET) {
+      if (typeof r.lastSeenAt === "string") presence.set(p.userId, r.lastSeenAt);
+      continue;
+    }
+    if (p.kind === "group") {
+      if (!isGrantTarget(r.target) || isExpired(r, now)) continue;
+      const list = groupTargets.get(p.groupId) ?? [];
+      list.push(r.target);
+      groupTargets.set(p.groupId, list);
+    } else if (r.target.startsWith("member#")) {
+      const g = r.target.slice("member#".length);
+      const list = groupMembers.get(g) ?? [];
+      list.push(p.userId);
+      groupMembers.set(g, list);
+    } else if (isGrantTarget(r.target)) {
+      const m = directRows.get(p.userId) ?? /* @__PURE__ */ new Map();
+      m.set(r.target, r);
+      directRows.set(p.userId, m);
+      userRows.push(r);
+    }
+  }
+  const users = /* @__PURE__ */ new Map();
+  const groupsByUserTarget = /* @__PURE__ */ new Map();
+  for (const [g, members] of groupMembers) {
+    for (const u of members) {
+      const m = groupsByUserTarget.get(u) ?? /* @__PURE__ */ new Map();
+      for (const t of groupTargets.get(g) ?? []) {
+        const list = m.get(t) ?? [];
+        list.push(g);
+        m.set(t, list);
+      }
+      groupsByUserTarget.set(u, m);
+    }
+  }
+  const userIds = /* @__PURE__ */ new Set([...directRows.keys(), ...groupsByUserTarget.keys()]);
+  for (const u of userIds) {
+    const direct = directRows.get(u) ?? /* @__PURE__ */ new Map();
+    const viaGroups = groupsByUserTarget.get(u) ?? /* @__PURE__ */ new Map();
+    const targets = /* @__PURE__ */ new Set([...direct.keys(), ...viaGroups.keys()]);
+    const m = /* @__PURE__ */ new Map();
+    for (const t of targets) m.set(t, entryOf(t, direct.get(t), viaGroups.get(t) ?? [], now));
+    users.set(u, m);
+  }
+  return { users, groupTargets, groupMembers, userRows, presence };
+}
+var import_client_dynamodb, import_lib_dynamodb, ddb, ACCESS_TABLE_NAME, SHARE_DEF_PRINCIPAL, PRESENCE_TARGET, isGrantTarget, isShareDefRow;
+var init_access2 = __esm({
+  "lambdacode/api/services/access.ts"() {
+    "use strict";
+    import_client_dynamodb = require("@aws-sdk/client-dynamodb");
+    init_backend();
+    import_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
+    ddb = import_lib_dynamodb.DynamoDBDocumentClient.from(new import_client_dynamodb.DynamoDBClient({}));
+    ACCESS_TABLE_NAME = process.env.ACCESS_TABLE_NAME;
+    SHARE_DEF_PRINCIPAL = "sharedef";
+    PRESENCE_TARGET = "pref#presence";
+    isGrantTarget = (t) => t.startsWith("role#") || t.startsWith("resource#") || t.startsWith("share#") || t.startsWith("plugin#");
+    isShareDefRow = (r) => r.principal === SHARE_DEF_PRINCIPAL && typeof r.shareId === "string" && typeof r.ownerSub === "string" && typeof r.port === "number" && typeof r.siteId === "string" && typeof r.expiresAt === "string";
+  }
+});
+
+// lambdacode/api/services/actorContext.ts
+function runAsActor(actor, fn) {
+  return store.run(actor, fn);
+}
+function currentActor() {
+  return store.getStore();
+}
+var import_async_hooks, store, systemActor;
+var init_actorContext = __esm({
+  "lambdacode/api/services/actorContext.ts"() {
+    "use strict";
+    import_async_hooks = require("async_hooks");
+    store = new import_async_hooks.AsyncLocalStorage();
+    systemActor = (job, name) => ({
+      kind: "system",
+      id: `system:${job}`,
+      name: name ?? job
+    });
+  }
+});
+
+// lambdacode/api/services/httpErrors.ts
+var init_httpErrors = __esm({
+  "lambdacode/api/services/httpErrors.ts"() {
+    "use strict";
+  }
+});
+
+// lambdacode/api/services/pluginCatalog.ts
+var import_client_dynamodb2, import_lib_dynamodb2, ddb2;
+var init_pluginCatalog = __esm({
+  "lambdacode/api/services/pluginCatalog.ts"() {
+    "use strict";
+    import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb2 = require("@aws-sdk/lib-dynamodb");
+    ddb2 = import_lib_dynamodb2.DynamoDBDocumentClient.from(new import_client_dynamodb2.DynamoDBClient({}));
+  }
+});
+
+// lambdacode/api/services/pluginAccess.ts
+var init_pluginAccess = __esm({
+  "lambdacode/api/services/pluginAccess.ts"() {
+    "use strict";
+    init_access2();
+    init_pluginCatalog();
+  }
+});
+
+// lambdacode/api/services/revocationsService.ts
+var import_client_dynamodb3, import_lib_dynamodb3, ddb3, REVOCATIONS_TABLE_NAME;
+var init_revocationsService = __esm({
+  "lambdacode/api/services/revocationsService.ts"() {
+    "use strict";
+    import_client_dynamodb3 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb3 = require("@aws-sdk/lib-dynamodb");
+    ddb3 = import_lib_dynamodb3.DynamoDBDocumentClient.from(new import_client_dynamodb3.DynamoDBClient({}));
+    REVOCATIONS_TABLE_NAME = process.env.REVOCATIONS_TABLE_NAME;
+  }
+});
+
+// lambdacode/api/services/auditService.ts
+function retentionDays() {
+  const n = Number(process.env.AUDIT_RETENTION_DAYS);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_RETENTION_DAYS;
+}
+function tableOr() {
+  const table = tableName();
+  if (table) return table;
+  if (!warnedNoTable) {
+    warnedNoTable = true;
+    log("WARN: AUDIT_TABLE_NAME unset \u2014 activity is not recorded");
+  }
+  return void 0;
+}
+function compact(value) {
+  if (Array.isArray(value)) return value.map(compact);
+  if (value && typeof value === "object" && !(value instanceof Set)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v !== void 0) out[k] = compact(v);
+    }
+    return out;
+  }
+  return value;
+}
+function toRow(input, now) {
+  const bound = input.actor ?? currentActor();
+  if (!bound) log("ERROR: activity row without a bound actor (missing runAsActor?)", { action: input.action, target: input.target });
+  const actor = bound ?? UNKNOWN_ACTOR;
+  const details = input.details ? { ...input.details } : void 0;
+  if (details?.note !== void 0) details.note = String(details.note).slice(0, NOTE_MAX);
+  if (details?.affected && details.affected.length > AFFECTED_CAP) {
+    details.affectedCount = details.affected.length;
+    details.affected = details.affected.slice(0, AFFECTED_CAP);
+  }
+  if (details?.unchanged && details.unchanged.length > AFFECTED_CAP) {
+    details.unchangedCount = details.unchanged.length;
+    details.unchanged = details.unchanged.slice(0, AFFECTED_CAP);
+  }
+  const accountNumber = input.accountNumber ?? accountOf(input.target);
+  return compact({
+    ...input,
+    eventId: (0, import_crypto.randomUUID)(),
+    outcome: input.outcome ?? "OK",
+    reason: input.reason === void 0 ? void 0 : String(input.reason).slice(0, REASON_MAX),
+    actor: { kind: actor.kind, id: actor.id, name: actor.name, claims: actor.claims && Object.keys(actor.claims).length ? actor.claims : void 0 },
+    accountNumber,
+    details,
+    at: now.toISOString(),
+    day: now.toISOString().slice(0, 10),
+    userId: input.subject?.id,
+    actorId: SESSION_ACTIONS.has(input.action) && input.subject?.kind === "user" ? input.subject.id : actor.id,
+    expiresAt: Math.floor(now.getTime() / 1e3) + retentionDays() * 24 * 60 * 60
+  });
+}
+function accountOf(target) {
+  if (!target) return void 0;
+  const p = parseTarget(target);
+  if (p?.kind === "role" || p?.kind === "plugin") return p.accountNumber;
+  if (target.startsWith("account#")) return target.slice("account#".length);
+  return void 0;
+}
+async function recordEvents(inputs) {
+  if (!inputs.length) return;
+  const table = tableOr();
+  if (!table) return;
+  const start = Date.now();
+  const rows = inputs.map((input, i) => toRow(input, new Date(start + i)));
+  for (let i = 0; i < rows.length; i += 25) {
+    let requests = rows.slice(i, i + 25).map((Item) => ({ PutRequest: { Item } }));
+    try {
+      for (let attempt = 0; attempt < 3 && requests.length; attempt++) {
+        const res = await ddb4.send(new import_lib_dynamodb4.BatchWriteCommand({ RequestItems: { [table]: requests } }));
+        requests = res.UnprocessedItems?.[table] ?? [];
+      }
+      if (requests.length) log("ERROR: activity batch left unprocessed rows", { count: requests.length });
+    } catch (err) {
+      log("ERROR: activity batch write failed (mutation unaffected)", { count: requests.length, error: err.message });
+    }
+  }
+  log("activity batch recorded", { count: rows.length, actions: [...new Set(rows.map((r) => r.action))] });
+}
+var import_crypto, import_client_dynamodb4, import_lib_dynamodb4, ddb4, tableName, log, DEFAULT_RETENTION_DAYS, REASON_MAX, NOTE_MAX, AFFECTED_CAP, DAY_MS, newBatchId, UNKNOWN_ACTOR, warnedNoTable, SESSION_ACTIONS;
+var init_auditService = __esm({
+  "lambdacode/api/services/auditService.ts"() {
+    "use strict";
+    import_crypto = require("crypto");
+    import_client_dynamodb4 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb4 = require("@aws-sdk/lib-dynamodb");
+    init_actorContext();
+    init_access2();
+    ddb4 = import_lib_dynamodb4.DynamoDBDocumentClient.from(new import_client_dynamodb4.DynamoDBClient({}));
+    tableName = () => process.env.AUDIT_TABLE_NAME ?? "";
+    log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+    DEFAULT_RETENTION_DAYS = 400;
+    REASON_MAX = 300;
+    NOTE_MAX = 500;
+    AFFECTED_CAP = 50;
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    newBatchId = () => (0, import_crypto.randomUUID)();
+    UNKNOWN_ACTOR = { kind: "system", id: "system:unknown" };
+    warnedNoTable = false;
+    SESSION_ACTIONS = /* @__PURE__ */ new Set(["vpn.connect", "vpn.disconnect"]);
+  }
+});
+
+// lambdacode/api/services/accessNotices.ts
+var init_accessNotices = __esm({
+  "lambdacode/api/services/accessNotices.ts"() {
+    "use strict";
+    init_access2();
+    init_pluginAccess();
+    init_revocationsService();
+    init_auditService();
+  }
+});
+
+// lambdacode/api/services/grantsService.ts
+var import_client_dynamodb5, import_lib_dynamodb5, ddb5, ROLES_TABLE_NAME, EXPIRING_WINDOW_MS;
+var init_grantsService = __esm({
+  "lambdacode/api/services/grantsService.ts"() {
+    "use strict";
+    import_client_dynamodb5 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb5 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    ddb5 = import_lib_dynamodb5.DynamoDBDocumentClient.from(new import_client_dynamodb5.DynamoDBClient({}));
+    ROLES_TABLE_NAME = process.env.ROLES_TABLE_NAME;
+    EXPIRING_WINDOW_MS = 24 * 60 * 60 * 1e3;
+  }
+});
+
+// lambdacode/api/services/resourceGrantsService.ts
+var import_client_dynamodb6, import_lib_dynamodb6, ddb6, RESOURCES_TABLE_NAME;
+var init_resourceGrantsService = __esm({
+  "lambdacode/api/services/resourceGrantsService.ts"() {
+    "use strict";
+    import_client_dynamodb6 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb6 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_grantsService();
+    init_resourcesService();
+    ddb6 = import_lib_dynamodb6.DynamoDBDocumentClient.from(new import_client_dynamodb6.DynamoDBClient({}));
+    RESOURCES_TABLE_NAME = process.env.RESOURCES_TABLE_NAME;
+  }
+});
+
+// lambdacode/api/services/accountOrder.ts
+var init_accountOrder = __esm({
+  "lambdacode/api/services/accountOrder.ts"() {
+    "use strict";
+  }
+});
+
+// lambdacode/api/services/dimensions.ts
+var init_dimensions = __esm({
+  "lambdacode/api/services/dimensions.ts"() {
+    "use strict";
+  }
+});
+
+// lambdacode/api/services/catalogIndex.ts
+var import_client_dynamodb7, import_lib_dynamodb7, ddb7, ACCOUNTS_TABLE_NAME, ROLES_TABLE_NAME2, GROUPS_TABLE_NAME, RESOURCES_TABLE_NAME2;
+var init_catalogIndex = __esm({
+  "lambdacode/api/services/catalogIndex.ts"() {
+    "use strict";
+    import_client_dynamodb7 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb7 = require("@aws-sdk/lib-dynamodb");
+    init_accountOrder();
+    init_dimensions();
+    ddb7 = import_lib_dynamodb7.DynamoDBDocumentClient.from(new import_client_dynamodb7.DynamoDBClient({}));
+    ACCOUNTS_TABLE_NAME = process.env.ACCOUNTS_TABLE_NAME;
+    ROLES_TABLE_NAME2 = process.env.ROLES_TABLE_NAME;
+    GROUPS_TABLE_NAME = process.env.GROUPS_TABLE_NAME;
+    RESOURCES_TABLE_NAME2 = process.env.RESOURCES_TABLE_NAME;
+  }
+});
+
+// lambdacode/api/services/groupsService.ts
+var import_client_dynamodb8, import_lib_dynamodb8, ddb8, GROUPS_TABLE_NAME2, ROLES_TABLE_NAME3, RESOURCES_TABLE_NAME3;
+var init_groupsService = __esm({
+  "lambdacode/api/services/groupsService.ts"() {
+    "use strict";
+    import_client_dynamodb8 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb8 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_access2();
+    init_accessNotices();
+    init_auditService();
+    init_catalogIndex();
+    init_resourcesService();
+    ddb8 = import_lib_dynamodb8.DynamoDBDocumentClient.from(new import_client_dynamodb8.DynamoDBClient({}));
+    GROUPS_TABLE_NAME2 = process.env.GROUPS_TABLE_NAME;
+    ROLES_TABLE_NAME3 = process.env.ROLES_TABLE_NAME;
+    RESOURCES_TABLE_NAME3 = process.env.RESOURCES_TABLE_NAME;
+  }
+});
+
+// lambdacode/api/services/resourcesService.ts
+var import_client_dynamodb9, import_lib_dynamodb9, ddb9, RESOURCES_TABLE_NAME4, ACCOUNTS_TABLE_NAME2, isSentinelRow;
+var init_resourcesService = __esm({
+  "lambdacode/api/services/resourcesService.ts"() {
+    "use strict";
+    import_client_dynamodb9 = require("@aws-sdk/client-dynamodb");
+    import_lib_dynamodb9 = require("@aws-sdk/lib-dynamodb");
+    init_httpErrors();
+    init_resourceGrantsService();
+    init_groupsService();
+    init_access2();
+    init_auditService();
+    init_accessNotices();
+    ddb9 = import_lib_dynamodb9.DynamoDBDocumentClient.from(new import_client_dynamodb9.DynamoDBClient({}));
+    RESOURCES_TABLE_NAME4 = process.env.RESOURCES_TABLE_NAME;
+    ACCOUNTS_TABLE_NAME2 = process.env.ACCOUNTS_TABLE_NAME;
+    isSentinelRow = (resourceId) => String(resourceId).startsWith("__");
+  }
+});
+
+// lambdacode/network/acl-reconciler.ts
+var acl_reconciler_exports = {};
+__export(acl_reconciler_exports, {
+  RECONCILER_STATUS_KEY: () => RECONCILER_STATUS_KEY,
+  cidrContains: () => cidrContains,
+  handler: () => handler,
+  isPrivateCidr: () => isPrivateCidr
+});
+module.exports = __toCommonJS(acl_reconciler_exports);
+var import_client_dynamodb10 = require("@aws-sdk/client-dynamodb");
+
+// lambdacode/network/headscale-http.ts
+var https = __toESM(require("node:https"));
+var import_client_ssm = require("@aws-sdk/client-ssm");
+var ssm = new import_client_ssm.SSMClient({});
+var sources = /* @__PURE__ */ new Map();
+var cached = /* @__PURE__ */ new Map();
+var CERT_TTL_MS = 6e4;
+function trustHeadscale(url, certParam) {
+  if (certParam) sources.set(new URL(url).origin, certParam);
+}
+async function certificateFor(origin, fresh) {
+  const param = sources.get(origin);
+  if (!param) throw new Error(`no certificate source registered for ${origin}`);
+  const hit = cached.get(param);
+  if (!fresh && hit && Date.now() - hit.at < CERT_TTL_MS) return hit.pem;
+  const out = await ssm.send(new import_client_ssm.GetParameterCommand({ Name: param }));
+  const pem = out.Parameter?.Value;
+  if (!pem) throw new Error(`certificate parameter ${param} is empty`);
+  cached.set(param, { pem, at: Date.now() });
+  return pem;
+}
+var TLS_FAILURES = /* @__PURE__ */ new Set([
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "CERT_SIGNATURE_FAILURE",
+  "CERT_HAS_EXPIRED",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+var isTlsFailure = (err) => TLS_FAILURES.has(String(err?.code));
+function request2(url, init, ca) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    new Headers(init.headers ?? {}).forEach((v, k) => headers[k] = v);
+    const req = https.request(
+      url,
+      { method: init.method ?? "GET", headers, ca: [ca] },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("error", reject);
+        res.on(
+          "end",
+          () => resolve(
+            new Response(Buffer.concat(chunks), {
+              status: res.statusCode ?? 0,
+              headers: Object.entries(res.headers).flatMap(
+                ([k, v]) => v === void 0 ? [] : [v].flat().map((x) => [k, x])
+              )
+            })
+          )
+        );
+      }
+    );
+    req.on("error", reject);
+    const signal = init.signal;
+    if (signal) {
+      const abort = () => req.destroy(
+        signal.reason instanceof Error ? signal.reason : new Error("aborted")
+      );
+      if (signal.aborted) abort();
+      else signal.addEventListener("abort", abort, { once: true });
+    }
+    if (init.body !== void 0 && init.body !== null)
+      req.write(init.body);
+    req.end();
+  });
+}
+async function headscaleFetch(url, init = {}) {
+  if (!url.startsWith("https:")) return fetch(url, init);
+  const origin = new URL(url).origin;
+  try {
+    return await request2(url, init, await certificateFor(origin, false));
+  } catch (err) {
+    if (!isTlsFailure(err)) throw err;
+    return request2(url, init, await certificateFor(origin, true));
+  }
+}
+
+// lambdacode/network/acl-reconciler.ts
+var import_lib_dynamodb10 = require("@aws-sdk/lib-dynamodb");
+var import_client_servicediscovery = require("@aws-sdk/client-servicediscovery");
+var import_client_lambda2 = require("@aws-sdk/client-lambda");
+var import_promises = require("node:dns/promises");
+init_access2();
+
+// lambdacode/network/naming.ts
+var headscaleUserName = (cognitoSub) => `u-${cognitoSub}`;
+var DEFAULT_RESOURCE_PREFIX = "infra-client";
+var parseConnectorVpcs = (json) => new Map(
+  Object.entries(JSON.parse(json ?? "{}")).filter(
+    ([, v]) => Array.isArray(v)
+  )
+);
+var connectorHostname = (account, name) => name ? `connector-${account}-${name}` : `connector-${account}`;
+var sgManagerFnName = (prefix, name) => name ? `${prefix}-sg-manager-${name}` : `${prefix}-sg-manager`;
+var tailnetResolverFnName = (prefix, siteId, name) => name ? `${prefix}-tailnet-resolver-${siteId}-${name}` : `${prefix}-tailnet-resolver-${siteId}`;
+var aclReconcilerRelayFnName = (prefix) => `${prefix}-acl-reconciler-relay`;
+
+// lambdacode/network/invoke.ts
+var import_client_lambda = require("@aws-sdk/client-lambda");
+var INVOKE_TIMEOUT_MS = 1e4;
+async function invokeParsed(client, functionName, payload, timeoutMs) {
+  try {
+    const res = await client.send(
+      new import_client_lambda.InvokeCommand({ FunctionName: functionName, Payload: JSON.stringify(payload) }),
+      { abortSignal: AbortSignal.timeout(timeoutMs) }
+    );
+    if (res.FunctionError) return { error: `function error: ${res.FunctionError}` };
+    return { body: JSON.parse(new TextDecoder().decode(res.Payload)) };
+  } catch (err) {
+    return { error: err.message };
+  }
+}
+
+// lambdacode/network/acl-reconciler.ts
+init_actorContext();
+init_resourcesService();
+init_auditService();
+var PREFIX = process.env.RESOURCE_PREFIX ?? DEFAULT_RESOURCE_PREFIX;
+var HUB_ACCOUNT = process.env.HUB_ACCOUNT;
+var RELAY_FN = aclReconcilerRelayFnName(PREFIX);
+var connectorVpcs = /* @__PURE__ */ new Map();
+var UNNAMED_HUB_VPC = [{}];
+var inConfig = (account) => connectorVpcs.has(account);
+var targetsOf = (account) => connectorVpcs.get(account) ?? UNNAMED_HUB_VPC;
+var regionOfTarget = (t) => t.region ?? process.env.AWS_REGION;
+var vpcNameOf = (account, nodeName) => targetsOf(account).find((t) => {
+  if (!t.name) return false;
+  const host = connectorHostname(account, t.name);
+  return nodeName === host || nodeName.startsWith(`${host}-`);
+})?.name;
+var approvedRoutesByVpc = /* @__PURE__ */ new Map();
+var vpcKey = (account, name) => `${account}#${name ?? ""}`;
+var ownerOf = (account, cidr) => {
+  const targets = targetsOf(account);
+  if (targets.length === 1) return targets[0];
+  return targets.find(
+    (t) => (approvedRoutesByVpc.get(vpcKey(account, t.name)) ?? []).some(
+      (route) => cidrContains(cidr, route)
+    )
+  );
+};
+var declaredRoutesByVpc = /* @__PURE__ */ new Map();
+var declaredRoutesOf = (siteAccounts, account, nodeName) => {
+  const own = declaredRoutesByVpc.get(vpcKey(account, vpcNameOf(account, nodeName)));
+  if (own) return own;
+  const siteDeclares = [...declaredRoutesByVpc.keys()].some(
+    (k) => siteAccounts === null || siteAccounts.has(k.slice(0, k.indexOf("#")))
+  );
+  return siteDeclares ? [] : void 0;
+};
+var ddb10 = import_lib_dynamodb10.DynamoDBDocumentClient.from(new import_client_dynamodb10.DynamoDBClient({}));
+var sd = new import_client_servicediscovery.ServiceDiscoveryClient({});
+var lambda = new import_client_lambda2.LambdaClient({});
+var RECONCILER_STATUS_KEY = "__reconciler-status__";
+var RESOURCES_TABLE_NAME5 = process.env.RESOURCES_TABLE_NAME;
+var STALE_CONNECTOR_MS = 15 * 60 * 1e3;
+var CONNECTOR_PRUNE_MS = 24 * 60 * 60 * 1e3;
+var DEVICE_IDLE_EXPIRE_MS = 7 * 24 * 60 * 60 * 1e3;
+var log2 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+function newPassAudit() {
+  const enabled = Boolean(process.env.AUDIT_TABLE_NAME);
+  const batchId = enabled ? newBatchId() : "";
+  const rows = [];
+  return {
+    enabled,
+    observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    rows,
+    push(input) {
+      if (!enabled) return;
+      rows.push({ ...input, category: "network", details: { ...input.details, batchId } });
+    }
+  };
+}
+function sitesFromEnv() {
+  const raw = process.env.HEADSCALE_SITES;
+  if (!raw) {
+    trustHeadscale(process.env.HEADSCALE_API_URL, process.env.HEADSCALE_TLS_PARAM);
+    return [
+      {
+        id: "",
+        apiUrl: process.env.HEADSCALE_API_URL,
+        auth: { Authorization: `Bearer ${process.env.HEADSCALE_API_KEY}` },
+        accounts: null,
+        resolvers: (process.env.SPLIT_DNS_RESOLVERS ?? "").split(",").map((ip) => ip.trim()).filter(Boolean),
+        sentinelKey: RECONCILER_STATUS_KEY
+      }
+    ];
+  }
+  const planes = JSON.parse(raw);
+  for (const p of Object.values(planes)) trustHeadscale(p.url, p.certParam);
+  const siteOfAccount = JSON.parse(process.env.SITE_ACCOUNTS ?? "{}");
+  const splitBySite = JSON.parse(
+    process.env.SPLIT_DNS_BY_SITE ?? "{}"
+  );
+  const names = JSON.parse(process.env.SITE_NAMES ?? "{}");
+  return Object.keys(planes).sort().map((id) => ({
+    id,
+    displayName: typeof names[id] === "string" ? names[id] : void 0,
+    apiUrl: planes[id].url,
+    auth: { Authorization: `Bearer ${planes[id].key}` },
+    accounts: new Set(
+      Object.entries(siteOfAccount).filter(([, s]) => s === id).map(([a]) => a)
+    ),
+    resolvers: splitBySite[id] ?? [],
+    sentinelKey: `${RECONCILER_STATUS_KEY}${id}`
+  }));
+}
+var HEADSCALE_TIMEOUT_MS = 1e4;
+var HEADSCALE_POLICY_TIMEOUT_MS = 3e4;
+var DNS_HOLD_MS = 24 * 60 * 60 * 1e3;
+var headscaleFetch2 = (url, init = {}, timeoutMs = HEADSCALE_TIMEOUT_MS) => headscaleFetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+var POLICY_MAX_BYTES = 39e5;
+var CIDR_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/;
+function parseCidr(cidr) {
+  if (typeof cidr !== "string") return null;
+  const m = cidr.trim().match(CIDR_RE);
+  if (!m) return null;
+  const octets = m.slice(1, 5).map(Number);
+  const prefix = Number(m[5]);
+  if (octets.some((o) => o > 255) || prefix > 32) return null;
+  const base = (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+  return { base, prefix };
+}
+function cidrContains(inner, outer) {
+  const a = parseCidr(inner);
+  const b = parseCidr(outer);
+  if (!a || !b) return false;
+  if (a.prefix < b.prefix) return false;
+  const mask = b.prefix === 0 ? 0 : ~0 << 32 - b.prefix >>> 0;
+  return (a.base & mask) >>> 0 === (b.base & mask) >>> 0;
+}
+var PRIVATE_SPACE = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+function isPrivateCidr(cidr) {
+  return PRIVATE_SPACE.some((space) => cidrContains(cidr, space));
+}
+function isIpv4(s) {
+  const m = s.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  return m !== null && m.slice(1).every((o) => Number(o) <= 255);
+}
+async function resolveCloudMapIps(dnsName) {
+  const dot = dnsName.indexOf(".");
+  if (dot <= 0) return [];
+  try {
+    const res = await Promise.race([
+      sd.send(
+        new import_client_servicediscovery.DiscoverInstancesCommand({
+          ServiceName: dnsName.slice(0, dot),
+          NamespaceName: dnsName.slice(dot + 1),
+          MaxResults: 10
+        })
+      ),
+      new Promise(
+        (_, reject) => setTimeout(() => reject(new Error("cloud map timeout")), 3e3)
+      )
+    ]);
+    return (res.Instances ?? []).map((i) => i.Attributes?.AWS_INSTANCE_IPV4).filter((ip) => Boolean(ip));
+  } catch {
+    return [];
+  }
+}
+async function resolveDnsIps(dnsName) {
+  try {
+    const ips = await Promise.race([
+      (0, import_promises.resolve4)(dnsName),
+      new Promise(
+        (_, reject) => setTimeout(() => reject(new Error("dns timeout")), 3e3)
+      )
+    ]);
+    return ips.slice(0, 8);
+  } catch {
+    return [];
+  }
+}
+async function invokeByName(account, fnName, payload, region) {
+  if (region === process.env.AWS_REGION) {
+    return invokeParsed(
+      lambda,
+      `arn:aws:lambda:${region}:${account}:function:${fnName}`,
+      payload,
+      INVOKE_TIMEOUT_MS
+    );
+  }
+  const { body, error } = await invokeParsed(
+    lambda,
+    RELAY_FN,
+    { region, account, fnName, payload },
+    INVOKE_TIMEOUT_MS + 3e3
+  );
+  return error ? { error } : body;
+}
+var RESOLVER_BATCH = 64;
+async function resolveRemoteIps(account, fnName, names, region) {
+  const out = {};
+  for (let i = 0; i < names.length; i += RESOLVER_BATCH) {
+    const { body, error } = await invokeByName(
+      account,
+      fnName,
+      { names: names.slice(i, i + RESOLVER_BATCH) },
+      region
+    );
+    if (error) {
+      log2("WARN: tailnet-resolver invoke failed", { account, fnName, error });
+      return out;
+    }
+    const ips = body?.ips ?? {};
+    for (const [name, list] of Object.entries(ips)) {
+      const clean = (Array.isArray(list) ? list : []).filter(isIpv4).slice(0, 8);
+      if (clean.length) out[name] = clean;
+    }
+  }
+  return out;
+}
+var SG_FAILURE_REASON = {
+  error: "the connector account's firewall manager could not update the group",
+  "sg-sync-failed": "the connector account's firewall manager could not be reached",
+  "not-found": "security group not found in the connector account",
+  invalid: "malformed security group id"
+};
+async function syncSecurityGroups(resources, statusByResource, prior, audit) {
+  const hub = process.env.AWS_REGION;
+  const byAccount = /* @__PURE__ */ new Map();
+  for (const r of resources) {
+    if (!r.securityGroupId) continue;
+    const list = byAccount.get(r.accountNumber) ?? [];
+    list.push(r);
+    byAccount.set(r.accountNumber, list);
+  }
+  const keep = new Set(byAccount.keys());
+  for (const account of prior.accounts) {
+    if (!byAccount.has(account)) byAccount.set(account, []);
+  }
+  const sameTarget = (a, b) => (a.name ?? null) === (b.name ?? null) && regionOfTarget(a) === regionOfTarget(b);
+  const targetsByAccount = /* @__PURE__ */ new Map();
+  for (const [account, rs] of byAccount) {
+    const configured = inConfig(account);
+    const wanted = rs.length || configured ? targetsOf(account) : prior.targets[account] ?? UNNAMED_HUB_VPC;
+    const reachable = wanted.filter((t) => configured || regionOfTarget(t) === hub);
+    for (const t of wanted) {
+      if (reachable.includes(t)) continue;
+      log2("ERROR: departed connector VPC in another region is unreachable \u2014 revoke its managed SG rules by hand", {
+        account,
+        ...t
+      });
+    }
+    if (configured) {
+      for (const before of prior.targets[account] ?? []) {
+        if (wanted.some((t) => sameTarget(t, before))) continue;
+        log2("WARN: a connector VPC left config \u2014 managed SG rules left there must be revoked by hand", {
+          account,
+          ...before
+        });
+      }
+    }
+    if (!reachable.length) {
+      byAccount.delete(account);
+      continue;
+    }
+    targetsByAccount.set(account, reachable);
+  }
+  const RANK = { ok: 3, "other-vpc": 0 };
+  const rank = (status) => RANK[status] ?? 1;
+  const toRule = (r) => ({
+    securityGroupId: r.securityGroupId,
+    // Same bounds as the ACL dst filter — the manager re-validates anyway.
+    ports: (Array.isArray(r.ports) ? r.ports : []).filter(
+      (p) => Number.isInteger(p) && p >= 1 && p <= 65535
+    )
+  });
+  await Promise.all(
+    [...byAccount].map(async ([account, rs]) => {
+      const targets2 = targetsByAccount.get(account);
+      const ownerOfResource = /* @__PURE__ */ new Map();
+      const rulesFor = new Map(targets2.map((t) => [t, []]));
+      for (const r of rs) {
+        const owner = ownerOf(account, r.cidr);
+        ownerOfResource.set(r.resourceId, owner);
+        for (const t of owner ? [owner] : targets2) rulesFor.get(t)?.push(toRule(r));
+      }
+      const verdicts = /* @__PURE__ */ new Map();
+      const failed = /* @__PURE__ */ new Map();
+      await Promise.all(
+        targets2.map(async (t) => {
+          const { body, error: failure } = await invokeByName(
+            account,
+            sgManagerFnName(PREFIX, t.name),
+            { rules: rulesFor.get(t) ?? [] },
+            regionOfTarget(t)
+          );
+          if (failure) {
+            failed.set(t, failure);
+            log2("WARN: sg-manager sync failed", { account, ...t, error: failure });
+            return;
+          }
+          verdicts.set(
+            t,
+            body?.statuses ?? {}
+          );
+        })
+      );
+      if (failed.size) keep.add(account);
+      for (const t of targets2) {
+        for (const [sgId, v] of Object.entries(verdicts.get(t) ?? {})) {
+          if (v?.status !== "ok") continue;
+          const served = rs.filter((r) => r.securityGroupId === sgId);
+          const base = {
+            target: `sg#${sgId}`,
+            targetName: served.map((r) => r.name).join(", ") || void 0,
+            accountNumber: account,
+            details: {
+              ...served.length === 1 ? { resourceId: served[0].resourceId } : {},
+              resourceIds: served.map((r) => r.resourceId),
+              vpcName: t.name,
+              protocol: "tcp"
+            }
+          };
+          if (typeof v.added === "number" && v.added > 0) {
+            const ports = [...new Set((rulesFor.get(t) ?? []).filter((x) => x.securityGroupId === sgId).flatMap((x) => x.ports))];
+            audit.push({ ...base, action: "sg.rule.add", details: { ...base.details, ports, added: v.added } });
+          }
+          if (typeof v.removed === "number" && v.removed > 0) {
+            audit.push({ ...base, action: "sg.rule.remove", details: { ...base.details, removed: v.removed } });
+          }
+        }
+      }
+      for (const r of rs) {
+        const entry = statusByResource[r.resourceId] ??= { status: "unknown" };
+        const owner = ownerOfResource.get(r.resourceId);
+        const asked = owner ? [owner] : targets2;
+        let best;
+        for (const t of asked) {
+          const status = verdicts.get(t)?.[r.securityGroupId]?.status;
+          if (status !== void 0 && (best === void 0 || rank(status) > rank(best))) best = status;
+        }
+        entry.sg = best !== void 0 && (best !== "other-vpc" || !asked.some((t) => failed.has(t))) ? best : "sg-sync-failed";
+        entry.sgId = r.securityGroupId;
+        const reason = SG_FAILURE_REASON[entry.sg];
+        const before = prior.sgVerdicts.get(r.resourceId);
+        if (!reason || before?.sg === entry.sg && before.sgId === r.securityGroupId) continue;
+        const error = entry.sg === "sg-sync-failed" ? asked.map((t) => failed.get(t)).find(Boolean) : asked.map((t) => verdicts.get(t)?.[r.securityGroupId]).find((v) => v?.status === entry.sg)?.error;
+        audit.push({
+          action: "sg.rule.add",
+          outcome: "FAILED",
+          reason,
+          target: `sg#${r.securityGroupId}`,
+          targetName: r.name,
+          accountNumber: account,
+          details: { resourceId: r.resourceId, vpcName: owner?.name, protocol: "tcp", ports: toRule(r).ports, error }
+        });
+      }
+    })
+  );
+  const accounts = [...keep].sort();
+  const targets = {};
+  for (const account of accounts) targets[account] = targetsByAccount.get(account) ?? [];
+  return { accounts, targets };
+}
+function recordSiteActivity(audit, o, prev) {
+  if (!audit.enabled) return;
+  const target = `site#${o.site.id}`;
+  const targetName = o.site.displayName ?? o.site.id;
+  const connectorDetails = (c) => ({
+    nodeName: c.name,
+    nodeId: c.nodeId,
+    accountNumber: c.account,
+    vpcName: c.vpcName,
+    trusted: c.trusted
+  });
+  for (const c of o.pruned) {
+    audit.push({ action: "connector.prune", target, targetName, accountNumber: c.account, details: connectorDetails(c) });
+  }
+  if (!prev || typeof prev !== "object") return;
+  const now = o.topology.devices;
+  const was = prev.devices && typeof prev.devices === "object" ? prev.devices : {};
+  const session = (sub, action) => audit.push({
+    action,
+    subject: { kind: "user", id: sub },
+    target,
+    targetName,
+    details: { siteId: o.site.id, devices: now[sub]?.count ?? 0, observedAt: audit.observedAt, granularity: "5m" }
+  });
+  for (const [sub, d] of Object.entries(now)) {
+    if (d.online && was[sub]?.online !== true) session(sub, "vpn.connect");
+  }
+  for (const [sub, d] of Object.entries(was)) {
+    if (d?.online === true && now[sub]?.online !== true) session(sub, "vpn.disconnect");
+  }
+  const key = (c) => c.nodeId ?? c.name;
+  const onlineBefore = new Set((Array.isArray(prev.connectors) ? prev.connectors : []).filter((c) => c?.online === true).map(key));
+  for (const c of o.topology.connectors) {
+    if (c.online && !onlineBefore.has(key(c))) {
+      audit.push({ action: "connector.online", target, targetName, accountNumber: c.account, details: connectorDetails(c) });
+    }
+  }
+}
+var handler = () => runAsActor(systemActor("reconciler"), reconcile);
+async function reconcile() {
+  const audit = newPassAudit();
+  const sites = sitesFromEnv();
+  if (!sites.length) throw new Error("no sites configured (HEADSCALE_SITES empty)");
+  connectorVpcs = parseConnectorVpcs(process.env.CONNECTOR_VPCS);
+  declaredRoutesByVpc = new Map(
+    Object.entries(JSON.parse(process.env.CONNECTOR_ROUTES ?? "{}")).filter(
+      ([, v]) => Array.isArray(v)
+    )
+  );
+  approvedRoutesByVpc = /* @__PURE__ */ new Map();
+  const usersByResource = /* @__PURE__ */ new Map();
+  const usersByShare = /* @__PURE__ */ new Map();
+  const accessRows = await scanAll({ targetPrefixes: ["resource#", "share#", "member#"] });
+  const graph = buildSnapshot(accessRows);
+  const liveShares = accessRows.filter(isShareDefRow).filter((d) => !isExpired(d));
+  for (const [userId, entries] of graph.users) {
+    for (const e of entries.values()) {
+      const parsed = parseTarget(e.target);
+      if (!e.active) continue;
+      if (parsed?.kind === "resource") {
+        if (!usersByResource.has(parsed.resourceId)) usersByResource.set(parsed.resourceId, /* @__PURE__ */ new Set());
+        usersByResource.get(parsed.resourceId).add(userId);
+      } else if (parsed?.kind === "share") {
+        if (!usersByShare.has(parsed.shareId)) usersByShare.set(parsed.shareId, /* @__PURE__ */ new Set());
+        usersByShare.get(parsed.shareId).add(userId);
+      }
+    }
+  }
+  let cursor;
+  const resources = [];
+  const priorSgAccounts = /* @__PURE__ */ new Set();
+  const priorSgTargets = {};
+  const seenSentinelIds = [];
+  const priorTopology = /* @__PURE__ */ new Map();
+  const priorSgVerdicts = /* @__PURE__ */ new Map();
+  const priorAddrs = /* @__PURE__ */ new Map();
+  const passStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+  cursor = void 0;
+  do {
+    const page = await ddb10.send(
+      new import_lib_dynamodb10.ScanCommand({
+        TableName: RESOURCES_TABLE_NAME5,
+        ExclusiveStartKey: cursor,
+        ProjectionExpression: "resourceId, accountNumber, #name, cidr, ports, dnsName, securityGroupId, sgAccounts, sgTargets, sgRegions, topology, #statuses",
+        ExpressionAttributeNames: { "#name": "name", "#statuses": "statuses" }
+      })
+    );
+    for (const row of page.Items ?? []) {
+      const rid = String(row.resourceId ?? "");
+      if (rid.startsWith("__") && !rid.startsWith(RECONCILER_STATUS_KEY)) continue;
+      if (rid.startsWith(RECONCILER_STATUS_KEY)) {
+        if (row.topology && typeof row.topology === "object") {
+          priorTopology.set(rid, row.topology);
+        }
+        if (row.statuses && typeof row.statuses === "object") {
+          for (const [id, s] of Object.entries(row.statuses)) {
+            if (s?.sg) priorSgVerdicts.set(id, { sg: s.sg, sgId: s.sgId });
+            const recorded = Array.isArray(s?.addrIps) ? s.addrIps : s?.addr === "dns" ? [s.addrIp] : [];
+            const ips = recorded.filter((ip) => typeof ip === "string" && isIpv4(ip));
+            if (s?.addrName && ips.length) {
+              priorAddrs.set(id, { name: s.addrName, ips, at: typeof s.addrAt === "string" ? s.addrAt : passStartedAt });
+            }
+          }
+        }
+        if (Array.isArray(row.sgAccounts)) {
+          for (const a of row.sgAccounts) priorSgAccounts.add(a);
+        }
+        if (row.sgTargets && typeof row.sgTargets === "object") {
+          for (const [a, list] of Object.entries(row.sgTargets)) {
+            if (Array.isArray(list)) priorSgTargets[a] = list;
+          }
+        }
+        if (row.sgRegions && typeof row.sgRegions === "object") {
+          for (const [a, region] of Object.entries(row.sgRegions)) {
+            priorSgTargets[a] ??= [{ region }];
+          }
+        }
+        seenSentinelIds.push(rid);
+        continue;
+      }
+      if (isSentinelRow(rid)) continue;
+      resources.push(row);
+    }
+    cursor = page.LastEvaluatedKey;
+  } while (cursor);
+  const statusByResource = {};
+  const skipped = [];
+  const notEnrolled = /* @__PURE__ */ new Set();
+  const autoApproved = [];
+  const expiredDevices = [];
+  const prunedConnectors = [];
+  const outcomes = [];
+  const mappedAccounts = sites[0].accounts === null ? null : new Set(sites.flatMap((s) => [...s.accounts]));
+  for (const r of resources) {
+    if (mappedAccounts && !mappedAccounts.has(r.accountNumber)) {
+      statusByResource[r.resourceId] = { status: "no-site" };
+      skipped.push({ resourceId: r.resourceId, reason: "no-site" });
+    }
+  }
+  for (const site of sites) {
+    const outcome = {
+      site,
+      acls: [],
+      resourcesLive: 0,
+      sharesLive: 0,
+      shareStatuses: {},
+      staleConnectors: [],
+      pruned: [],
+      resourceIds: /* @__PURE__ */ new Set(),
+      topology: { connectors: [], devices: {} }
+    };
+    outcomes.push(outcome);
+    const siteResources = site.accounts === null ? resources : resources.filter((r) => site.accounts.has(r.accountNumber));
+    for (const r of siteResources) outcome.resourceIds.add(r.resourceId);
+    try {
+      const nodesRes = await headscaleFetch2(`${site.apiUrl}/api/v1/node`, {
+        headers: site.auth
+      });
+      if (!nodesRes.ok) throw new Error(`node list: ${nodesRes.status}`);
+      const { nodes = [] } = await nodesRes.json();
+      const usersRes = await headscaleFetch2(`${site.apiUrl}/api/v1/user`, {
+        headers: site.auth
+      });
+      if (!usersRes.ok) throw new Error(`user list: ${usersRes.status}`);
+      const { users = [] } = await usersRes.json();
+      const enrolledUsers = new Set(
+        users.map((u) => u.name).filter((n) => Boolean(n))
+      );
+      const approvedByAccount = /* @__PURE__ */ new Map();
+      const ipsByOwner = /* @__PURE__ */ new Map();
+      for (const node of nodes) {
+        const name = node.givenName || node.name || "";
+        const owner = node.user?.name;
+        const expired = Boolean(
+          node.expiry && Date.parse(node.expiry) <= Date.now()
+        );
+        if (owner?.startsWith("u-") && !expired) {
+          const set = ipsByOwner.get(owner) ?? /* @__PURE__ */ new Set();
+          for (const ip of (node.ipAddresses ?? []).filter(isIpv4)) set.add(ip);
+          if (set.size) ipsByOwner.set(owner, set);
+        }
+        if (owner?.startsWith("u-") && !expired) {
+          const sub = owner.slice(2);
+          const d = outcome.topology.devices[sub] ?? { count: 0, online: false };
+          d.count++;
+          d.online = d.online || node.online === true;
+          if (node.lastSeen && (!d.lastSeen || node.lastSeen > d.lastSeen)) {
+            d.lastSeen = node.lastSeen;
+          }
+          outcome.topology.devices[sub] = d;
+        }
+        if (owner && owner !== "infra" && node.id) {
+          const idleSince = node.lastSeen ? Date.parse(node.lastSeen) : NaN;
+          if (node.online === false && !expired && !Number.isNaN(idleSince) && Date.now() - idleSince > DEVICE_IDLE_EXPIRE_MS) {
+            const res2 = await headscaleFetch2(
+              `${site.apiUrl}/api/v1/node/${node.id}/expire`,
+              { method: "POST", headers: site.auth }
+            );
+            if (res2.ok) expiredDevices.push(name);
+            else log2("WARN: device expiry failed", { name, status: res2.status });
+          }
+        }
+        const m = name.match(/^connector-(\d+)(?:-|$)/);
+        if (!m) continue;
+        const account = m[1];
+        if (site.accounts !== null && !site.accounts.has(account)) {
+          log2("WARN: connector account not in this site", {
+            site: site.id,
+            name,
+            account
+          });
+          continue;
+        }
+        let approved = node.approvedRoutes ?? [];
+        const advertised = node.availableRoutes ?? node.subnetRoutes ?? [];
+        const unapproved = advertised.filter((r) => !approved.includes(r));
+        const declared = declaredRoutesOf(site.accounts, account, name);
+        const allowed = (r) => isPrivateCidr(r) && (declared === void 0 || declared.some((d) => cidrContains(r, d)));
+        const wanted = unapproved.filter(allowed);
+        const refused = unapproved.filter((r) => !allowed(r));
+        if (node.user?.name === "infra" && refused.length) {
+          log2("WARN: connector advertises routes that are not private or not declared for its VPC; not approved", { name, refused });
+        }
+        const undeclared = node.user?.name === "infra" ? approved.filter((r) => !allowed(r)) : [];
+        if (undeclared.length) {
+          log2("WARN: connector holds approved routes outside its VPC's declared ones", { name, undeclared });
+        }
+        if (node.user?.name === "infra" && node.id && wanted.length) {
+          const res2 = await headscaleFetch2(
+            `${site.apiUrl}/api/v1/node/${node.id}/approve_routes`,
+            {
+              method: "POST",
+              headers: { ...site.auth, "Content-Type": "application/json" },
+              body: JSON.stringify({ routes: [...approved, ...wanted] })
+            }
+          );
+          if (res2.ok) {
+            approved = [...approved, ...wanted];
+            autoApproved.push(`${name}:${wanted.join("|")}`);
+          } else {
+            log2("WARN: route auto-approval failed", { name, status: res2.status });
+          }
+        }
+        const vpcName = vpcNameOf(account, name);
+        outcome.topology.connectors.push({
+          account,
+          name,
+          ...vpcName ? { vpcName } : {},
+          nodeId: node.id,
+          trusted: node.user?.name === "infra",
+          online: node.online === true,
+          lastSeen: node.lastSeen,
+          advertisedRoutes: advertised,
+          approvedRoutes: approved
+        });
+        if (!approved.length) continue;
+        const lastSeen = node.lastSeen ? Date.parse(node.lastSeen) : NaN;
+        if (node.online === false && !Number.isNaN(lastSeen) && Date.now() - lastSeen > STALE_CONNECTOR_MS) {
+          outcome.staleConnectors.push(name);
+        }
+        const prior = approvedByAccount.get(account) ?? [];
+        approvedByAccount.set(account, [.../* @__PURE__ */ new Set([...prior, ...approved])]);
+        const key = vpcKey(account, vpcName);
+        approvedRoutesByVpc.set(key, [.../* @__PURE__ */ new Set([...approvedRoutesByVpc.get(key) ?? [], ...approved])]);
+      }
+      const prunedHere = [];
+      for (const c of outcome.topology.connectors) {
+        if (!c.trusted || c.online || !c.nodeId) continue;
+        const replacement = outcome.topology.connectors.some(
+          (o) => o.account === c.account && o.vpcName === c.vpcName && o.trusted && o.online
+        );
+        const seen = c.lastSeen ? Date.parse(c.lastSeen) : NaN;
+        if (!replacement || Number.isNaN(seen) || Date.now() - seen < CONNECTOR_PRUNE_MS) {
+          continue;
+        }
+        const res2 = await headscaleFetch2(`${site.apiUrl}/api/v1/node/${c.nodeId}`, {
+          method: "DELETE",
+          headers: site.auth
+        });
+        if (res2.ok) prunedHere.push(c);
+        else log2("WARN: connector prune failed", { name: c.name, status: res2.status });
+      }
+      if (prunedHere.length) {
+        outcome.pruned = prunedHere;
+        prunedConnectors.push(...prunedHere.map((c) => c.name));
+        outcome.staleConnectors = outcome.staleConnectors.filter((n) => !prunedHere.some((c) => c.name === n));
+        outcome.topology.connectors = outcome.topology.connectors.filter((c) => !prunedHere.includes(c));
+      }
+      const namesByTarget = /* @__PURE__ */ new Map();
+      if (site.id) {
+        for (const r of siteResources) {
+          if (!r.dnsName || !usersByResource.has(r.resourceId)) continue;
+          if (!approvedByAccount.has(r.accountNumber)) continue;
+          const owner = ownerOf(r.accountNumber, r.cidr);
+          const perTarget = namesByTarget.get(r.accountNumber) ?? /* @__PURE__ */ new Map();
+          for (const t of owner ? [owner] : targetsOf(r.accountNumber)) {
+            const set = perTarget.get(t) ?? /* @__PURE__ */ new Set();
+            set.add(r.dnsName);
+            perTarget.set(t, set);
+          }
+          namesByTarget.set(r.accountNumber, perTarget);
+        }
+      }
+      const remoteIps = /* @__PURE__ */ new Map();
+      await Promise.all(
+        [...namesByTarget].flatMap(
+          ([account, perTarget]) => [...perTarget].map(async ([t, names]) => {
+            const m = await resolveRemoteIps(
+              account,
+              tailnetResolverFnName(PREFIX, site.id, t.name),
+              [...names],
+              regionOfTarget(t)
+            );
+            for (const [n, ips] of Object.entries(m)) {
+              const key = `${account}#${n}`;
+              if (!remoteIps.has(key)) remoteIps.set(key, ips);
+            }
+          })
+        )
+      );
+      for (const r of siteResources) {
+        const prior = priorAddrs.get(r.resourceId);
+        const remembered = prior && prior.name === r.dnsName ? { addrName: prior.name, addrIps: prior.ips, addrAt: prior.at } : {};
+        const users2 = usersByResource.get(r.resourceId);
+        if (!users2) {
+          statusByResource[r.resourceId] = { status: "no-grants", ...remembered };
+          continue;
+        }
+        const approved = approvedByAccount.get(r.accountNumber);
+        if (!approved) {
+          skipped.push({ resourceId: r.resourceId, reason: "no-connector" });
+          statusByResource[r.resourceId] = { status: "no-connector", ...remembered };
+          continue;
+        }
+        let dstCidrs = [r.cidr];
+        const addrInfo = {};
+        if (r.dnsName) {
+          addrInfo.addrName = r.dnsName;
+          const hubOwned = r.accountNumber === HUB_ACCOUNT;
+          let live = hubOwned ? await resolveCloudMapIps(r.dnsName) : [];
+          if (!live.length) {
+            live = remoteIps.get(`${r.accountNumber}#${r.dnsName}`) ?? [];
+          }
+          if (!live.length && (hubOwned || !(await resolveCloudMapIps(r.dnsName)).length)) {
+            live = await resolveDnsIps(r.dnsName);
+          }
+          if (live.length) {
+            dstCidrs = live.map((ip) => `${ip}/32`);
+            addrInfo.addr = "dns";
+          } else {
+            addrInfo.addr = "dns-stale";
+            const expired = !(Date.now() - Date.parse(remembered.addrAt ?? "") <= DNS_HOLD_MS);
+            if (!remembered.addrIps || expired) {
+              skipped.push({ resourceId: r.resourceId, reason: "dns-unresolved" });
+              statusByResource[r.resourceId] = { status: "dns-unresolved", ...addrInfo };
+              continue;
+            }
+            dstCidrs = remembered.addrIps.map((ip) => `${ip}/32`);
+            addrInfo.addrIps = remembered.addrIps;
+            addrInfo.addrAt = remembered.addrAt;
+          }
+        }
+        const contained = dstCidrs.filter(
+          (c) => approved.some((route) => cidrContains(c, route))
+        );
+        if (addrInfo.addr) {
+          addrInfo.addrIp = (contained[0] ?? dstCidrs[0]).replace(/\/\d+$/, "");
+          if (addrInfo.addr === "dns" && contained.length) {
+            addrInfo.addrIps = contained.map((c) => c.replace(/\/\d+$/, ""));
+            addrInfo.addrAt = passStartedAt;
+          }
+        }
+        if (!contained.length) {
+          skipped.push({
+            resourceId: r.resourceId,
+            reason: "outside-approved-routes"
+          });
+          statusByResource[r.resourceId] = { status: "outside-approved-routes", ...addrInfo };
+          continue;
+        }
+        const ports = (Array.isArray(r.ports) ? r.ports : []).filter(
+          (p) => Number.isInteger(p) && p >= 1 && p <= 65535
+        );
+        if (!ports.length) {
+          skipped.push({ resourceId: r.resourceId, reason: "no-valid-ports" });
+          statusByResource[r.resourceId] = { status: "no-valid-ports", ...addrInfo };
+          continue;
+        }
+        outcome.resourcesLive++;
+        statusByResource[r.resourceId] = {
+          status: "live",
+          users: [...users2].filter(
+            (u) => enrolledUsers.has(headscaleUserName(u))
+          ).length,
+          ...addrInfo
+        };
+        for (const user of users2) {
+          if (!enrolledUsers.has(headscaleUserName(user))) {
+            notEnrolled.add(user);
+            continue;
+          }
+          outcome.acls.push({
+            action: "accept",
+            src: [`${headscaleUserName(user)}@`],
+            dst: contained.flatMap((c) => ports.map((p) => `${c}:${p}`))
+          });
+        }
+      }
+      const siteShares = site.accounts === null ? liveShares : liveShares.filter((sh) => sh.siteId === site.id);
+      for (const sh of siteShares) {
+        const entry = { status: "live" };
+        outcome.shareStatuses[sh.shareId] = entry;
+        const port = sh.port;
+        if (!Number.isInteger(port) || port < 1 || port > 65535) {
+          entry.status = "invalid-port";
+          continue;
+        }
+        const ownerIps = [...ipsByOwner.get(headscaleUserName(sh.ownerSub)) ?? []];
+        if (!ownerIps.length) {
+          entry.status = "owner-not-enrolled";
+          continue;
+        }
+        const grantees = [...usersByShare.get(sh.shareId) ?? []].filter((u) => u !== sh.ownerSub);
+        const enrolled = grantees.filter((u) => enrolledUsers.has(headscaleUserName(u)));
+        for (const u of grantees) if (!enrolledUsers.has(headscaleUserName(u))) notEnrolled.add(u);
+        if (!enrolled.length) {
+          entry.status = grantees.length ? "no-enrolled-grantees" : "no-grantees";
+          continue;
+        }
+        entry.users = enrolled.length;
+        outcome.sharesLive++;
+        for (const u of enrolled) {
+          outcome.acls.push({
+            action: "accept",
+            src: [`${headscaleUserName(u)}@`],
+            dst: ownerIps.map((ip) => `${ip}/32:${port}`)
+          });
+        }
+      }
+      for (const ip of site.resolvers) {
+        if (!isIpv4(ip)) {
+          log2("WARN: skipping non-IPv4 split-DNS resolver", {
+            site: site.id,
+            value: ip
+          });
+          continue;
+        }
+        outcome.acls.push({ action: "accept", src: ["*"], dst: [`${ip}/32:53`] });
+      }
+      const policy = JSON.stringify({ acls: outcome.acls });
+      const policyBytes = Buffer.byteLength(policy);
+      if (policyBytes > POLICY_MAX_BYTES) {
+        throw new Error(
+          `policy is ${policyBytes} bytes, over the control server's ${POLICY_MAX_BYTES}-byte limit; grant through fewer, wider resources or split the site`
+        );
+      }
+      if (policyBytes > POLICY_MAX_BYTES * 0.75) {
+        log2("WARN: policy is near the control server's size limit", { site: site.id, policyBytes, limit: POLICY_MAX_BYTES });
+      }
+      const res = await headscaleFetch2(`${site.apiUrl}/api/v1/policy`, {
+        method: "PUT",
+        headers: { ...site.auth, "Content-Type": "application/json" },
+        body: JSON.stringify({ policy })
+      }, HEADSCALE_POLICY_TIMEOUT_MS);
+      if (!res.ok) {
+        const detail = await res.text().catch(() => "");
+        throw new Error(`policy put: ${res.status} ${detail}`);
+      }
+    } catch (err) {
+      outcome.putError = err.message;
+      log2("ERROR: site pass failed", { site: site.id, error: outcome.putError });
+    }
+  }
+  const sg = await syncSecurityGroups(
+    resources,
+    statusByResource,
+    { accounts: [...priorSgAccounts].sort(), targets: priorSgTargets, sgVerdicts: priorSgVerdicts },
+    audit
+  );
+  const carrierSiteId = outcomes.find((o) => !o.putError)?.site.id;
+  for (const o of outcomes) {
+    if (o.putError) continue;
+    recordSiteActivity(audit, o, priorTopology.get(o.site.sentinelKey));
+    const isCarrier = o.site.id === carrierSiteId;
+    const siteStatuses = {};
+    for (const [rid, entry] of Object.entries(statusByResource)) {
+      const noSite = entry.status === "no-site";
+      if (o.resourceIds.has(rid) || noSite && isCarrier) {
+        siteStatuses[rid] = entry;
+      }
+    }
+    try {
+      await ddb10.send(
+        new import_lib_dynamodb10.PutCommand({
+          TableName: RESOURCES_TABLE_NAME5,
+          Item: {
+            resourceId: o.site.sentinelKey,
+            ...o.site.id ? { siteId: o.site.id } : {},
+            at: (/* @__PURE__ */ new Date()).toISOString(),
+            statuses: siteStatuses,
+            staleConnectors: o.staleConnectors,
+            resourcesLive: o.resourcesLive,
+            rules: o.acls.length,
+            sharesLive: o.sharesLive,
+            shares: o.shareStatuses,
+            topology: o.topology,
+            // Accounts (possibly still) holding our managed SG rules (+ which named / foreign-region VPCs) —
+            // read back next pass to sweep departed ones. One carrier row (SG sync is global; reads union all rows).
+            ...isCarrier ? { sgAccounts: sg.accounts, sgTargets: sg.targets } : {}
+          }
+        })
+      );
+    } catch (err) {
+      log2("WARN: status write failed", {
+        site: o.site.id,
+        error: err.message
+      });
+    }
+  }
+  const currentKeys = new Set(sites.map((s) => s.sentinelKey));
+  for (const rid of seenSentinelIds) {
+    if (currentKeys.has(rid)) continue;
+    try {
+      await ddb10.send(
+        new import_lib_dynamodb10.DeleteCommand({
+          TableName: RESOURCES_TABLE_NAME5,
+          Key: { resourceId: rid }
+        })
+      );
+      log2("removed stale reconciler sentinel", { resourceId: rid });
+    } catch (err) {
+      log2("WARN: stale sentinel delete failed", {
+        resourceId: rid,
+        error: err.message
+      });
+    }
+  }
+  if (audit.rows.length) await recordEvents(audit.rows);
+  const staleConnectors = outcomes.flatMap((o) => o.staleConnectors);
+  console.log(
+    JSON.stringify({
+      _aws: {
+        Timestamp: Date.now(),
+        CloudWatchMetrics: [
+          {
+            Namespace: "InfraClient/Network",
+            Dimensions: [[]],
+            Metrics: [{ Name: "StaleConnectors", Unit: "Count" }]
+          }
+        ]
+      },
+      StaleConnectors: staleConnectors.length,
+      staleConnectors
+    })
+  );
+  const rules = outcomes.reduce((n, o) => n + o.acls.length, 0);
+  log2("reconciled", {
+    sites: outcomes.map((o) => ({
+      site: o.site.id,
+      rules: o.acls.length,
+      resourcesLive: o.resourcesLive,
+      sharesLive: o.sharesLive,
+      shares: o.shareStatuses,
+      error: o.putError
+    })),
+    resources: resources.length,
+    resourcesSkipped: skipped,
+    usersNotEnrolled: [...notEnrolled],
+    autoApprovedRoutes: autoApproved,
+    expiredIdleDevices: expiredDevices,
+    prunedConnectors,
+    staleConnectors,
+    usersWithGrants: new Set(
+      [...usersByResource.values()].flatMap((s) => [...s])
+    ).size,
+    rules,
+    activityRows: audit.rows.length
+  });
+  const failed = outcomes.filter((o) => o.putError);
+  if (failed.length) {
+    throw new Error(
+      failed.map((o) => `${o.site.id ? `site ${o.site.id}: ` : ""}${o.putError}`).join("; ")
+    );
+  }
+  return { rules };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RECONCILER_STATUS_KEY,
+  cidrContains,
+  handler,
+  isPrivateCidr
+});