quidproquo-actionprocessor-awslambda 0.0.262 → 0.1.0

package/lib/commonjs/getActionProcessor/core/keyValueStore/getKeyValueStoreQueryActionProcessor.js

@@ -24,8 +24,16 @@ const getProcessKeyValueStoreQuery = (qpqConfig) => {
         if (!storeConfig) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.NotFound, `Could not find key value store with name "${keyValueStoreName}"`);
         }
-        const items = yield (0, dynamo_1.query)(dynamoTableName, region, keyCondition, options === null || options === void 0 ? void 0 : options.filter, options === null || options === void 0 ? void 0 : options.nextPageKey, (0, qpqDynamoOrm_1.getDynamoTableIndexByConfigAndQuery)(storeConfig, keyCondition), options === null || options === void 0 ? void 0 : options.limit, options === null || options === void 0 ? void 0 : options.sortAscending);
-        return (0, quidproquo_core_2.actionResult)(items);
+        try {
+            const items = yield (0, dynamo_1.query)(dynamoTableName, region, keyCondition, options === null || options === void 0 ? void 0 : options.filter, options === null || options === void 0 ? void 0 : options.nextPageKey, (0, qpqDynamoOrm_1.getDynamoTableIndexByConfigAndQuery)(storeConfig, keyCondition), options === null || options === void 0 ? void 0 : options.limit, options === null || options === void 0 ? void 0 : options.sortAscending);
+            return (0, quidproquo_core_2.actionResult)(items);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                InternalServerError: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_2.KeyValueStoreQueryErrorTypeEnum.ServiceUnavailable, 'KVS Service Unavailable'),
+                ResourceNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_2.KeyValueStoreQueryErrorTypeEnum.ResourceNotFound, 'KVS Resource Not Found'),
+            });
+        }
     });
 };
 const getKeyValueStoreQueryActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/keyValueStore/getKeyValueStoreScanActionProcessor.js

@@ -12,19 +12,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getKeyValueStoreScanActionProcessor = void 0;
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_1 = require("quidproquo-core");
+const quidproquo_core_2 = require("quidproquo-core");
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
 const scan_1 = require("../../../logic/dynamo/scan");
 const getProcessKeyValueStoreScan = (qpqConfig) => {
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ keyValueStoreName, filterCondition, nextPageKey }) {
         const dynamoTableName = (0, awsNamingUtils_1.getKvsDynamoTableNameFromConfig)(keyValueStoreName, qpqConfig, 'kvs');
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        const items = yield (0, scan_1.scan)(dynamoTableName, region, filterCondition, nextPageKey);
-        return (0, quidproquo_core_1.actionResult)(items);
+        try {
+            const items = yield (0, scan_1.scan)(dynamoTableName, region, filterCondition, nextPageKey);
+            return (0, quidproquo_core_2.actionResult)(items);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                InternalServerError: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_2.KeyValueStoreScanErrorTypeEnum.ServiceUnavailable, 'KVS Service Unavailable'),
+                ResourceNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_2.KeyValueStoreScanErrorTypeEnum.ResourceNotFound, 'KVS Resource Not Found'),
+            });
+        }
     });
 };
 const getKeyValueStoreScanActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {
     return ({
-        [quidproquo_core_1.KeyValueStoreActionType.Scan]: getProcessKeyValueStoreScan(qpqConfig),
+        [quidproquo_core_2.KeyValueStoreActionType.Scan]: getProcessKeyValueStoreScan(qpqConfig),
     });
 });
 exports.getKeyValueStoreScanActionProcessor = getKeyValueStoreScanActionProcessor;

package/lib/commonjs/getActionProcessor/core/keyValueStore/getKeyValueStoreUpdateActionProcessor.js

@@ -21,8 +21,16 @@ const getProcessKeyValueStoreUpdate = (qpqConfig) => {
         const dynamoTableName = (0, awsNamingUtils_1.getKvsDynamoTableNameFromConfig)(keyValueStoreName, qpqConfig, 'kvs');
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const storeConfig = quidproquo_core_1.qpqCoreUtils.getKeyValueStoreByName(qpqConfig, keyValueStoreName);
-        const item = yield (0, dynamo_1.updateItem)(dynamoTableName, region, updates, storeConfig.partitionKey.key, key, (_b = storeConfig.sortKeys[0]) === null || _b === void 0 ? void 0 : _b.key, sortKey);
-        return (0, quidproquo_core_2.actionResult)(item);
+        try {
+            const item = yield (0, dynamo_1.updateItem)(dynamoTableName, region, updates, storeConfig.partitionKey.key, key, (_b = storeConfig.sortKeys[0]) === null || _b === void 0 ? void 0 : _b.key, sortKey);
+            return (0, quidproquo_core_2.actionResult)(item);
+        }
+        catch (error) {
+            return (0, quidproquo_core_2.actionResultErrorFromCaughtError)(error, {
+                InternalServerError: () => (0, quidproquo_core_2.actionResultError)(quidproquo_core_2.KeyValueStoreUpdateErrorTypeEnum.ServiceUnavailable, 'KVS Service Unavailable'),
+                ResourceNotFoundException: () => (0, quidproquo_core_2.actionResultError)(quidproquo_core_2.KeyValueStoreUpdateErrorTypeEnum.ResourceNotFound, 'KVS Resource Not Found'),
+            });
+        }
     });
 };
 const getKeyValueStoreUpdateActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/queue/getQueueSendMessageActionProcessor.js

@@ -15,15 +15,25 @@ const quidproquo_core_1 = require("quidproquo-core");
 const sendMessages_1 = require("../../../logic/sqs/sendMessages");
 const qpqAwsLambdaRuntimeConfigUtils_1 = require("../../../runtimeConfig/qpqAwsLambdaRuntimeConfigUtils");
 const getProcessQueueSendMessage = (qpqConfig) => {
-    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ queueName, queueMessages, context }, session) {
+    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ queueName, queueMessages }, session) {
         // While we have some uuids
         const sqsQueueName = (0, qpqAwsLambdaRuntimeConfigUtils_1.resolveResourceName)(queueName, qpqConfig);
-        yield (0, sendMessages_1.sendMessages)(sqsQueueName, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), queueMessages.map((message) => {
-            // Add the session info to the message
-            const queueMessageWithSession = Object.assign(Object.assign({}, message), { storySession: Object.assign(Object.assign({}, session), { context }) });
-            return JSON.stringify(queueMessageWithSession);
-        }));
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, sendMessages_1.sendMessages)(sqsQueueName, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), queueMessages.map((message) => {
+                // Add the session info to the message
+                const queueMessageWithSession = Object.assign(Object.assign({}, message), { storySession: (0, quidproquo_core_1.toCrossServiceSession)(session) });
+                return JSON.stringify(queueMessageWithSession);
+            }));
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                AccessDenied: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.QueueSendMessagesErrorTypeEnum.AccessDenied, 'Access denied sending to queue'),
+                AccessDeniedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.QueueSendMessagesErrorTypeEnum.AccessDenied, 'Access denied sending to queue'),
+                QueueDoesNotExist: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.QueueSendMessagesErrorTypeEnum.QueueNotFound, `Queue not found: ${queueName}`),
+                RequestThrottled: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.QueueSendMessagesErrorTypeEnum.ServiceUnavailable, 'Queue throttled'),
+            });
+        }
     });
 };
 const getQueueSendMessagesActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/system/getSystemExecuteStoryActionProcessor.js

@@ -17,7 +17,7 @@ exports.getDateNow = getDateNow;
 const getProcessExecuteStory = (qpqConfig) => {
     const moduleName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
     return (payload, session, actionProcessors, logger, updateSession, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         let story = yield dynamicModuleLoader(payload.runtime);
         if (!story) {
             return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.NotFound, `Unable to dynamically load: [${payload.runtime}]`);
@@ -25,9 +25,10 @@ const getProcessExecuteStory = (qpqConfig) => {
         const functionKey = (0, quidproquo_core_1.getUniqueKeyFromQpqFunctionRuntime)(payload.runtime);
         const resolveStory = (0, quidproquo_core_1.createRuntime)(qpqConfig, {
             context: ((_a = payload.storySession) === null || _a === void 0 ? void 0 : _a.context) || session.context,
-            depth: (((_b = payload.storySession) === null || _b === void 0 ? void 0 : _b.depth) || session.depth || 0) + 1,
-            decodedAccessToken: ((_c = payload.storySession) === null || _c === void 0 ? void 0 : _c.decodedAccessToken) || session.decodedAccessToken,
-            correlation: ((_d = payload.storySession) === null || _d === void 0 ? void 0 : _d.correlation) || session.correlation,
+            localContext: ((_b = payload.storySession) === null || _b === void 0 ? void 0 : _b.localContext) || session.localContext,
+            depth: (((_c = payload.storySession) === null || _c === void 0 ? void 0 : _c.depth) || session.depth || 0) + 1,
+            decodedAccessToken: ((_d = payload.storySession) === null || _d === void 0 ? void 0 : _d.decodedAccessToken) || session.decodedAccessToken,
+            correlation: ((_e = payload.storySession) === null || _e === void 0 ? void 0 : _e.correlation) || session.correlation,
         }, () => __awaiter(void 0, void 0, void 0, function* () { return actionProcessors; }), exports.getDateNow, logger, 
         // TODO: Share this logic.
         `${moduleName}::${(0, awsLambdaUtils_1.randomGuid)()}`, quidproquo_core_1.QpqRuntimeType.EXECUTE_STORY, dynamicModuleLoader, payload.runtime, []);

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryAssociateSoftwareTokenActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getUserDirectoryAssociateSoftwareTokenActionProcessor: ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryAssociateSoftwareTokenActionProcessor.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserDirectoryAssociateSoftwareTokenActionProcessor = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const associateSoftwareToken_1 = require("../../../logic/cognito/associateSoftwareToken");
+const getProcessAssociateSoftwareToken = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ session }) {
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        const response = yield (0, associateSoftwareToken_1.associateSoftwareToken)(region, session);
+        return (0, quidproquo_core_1.actionResult)(response);
+    });
+};
+const getUserDirectoryAssociateSoftwareTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {
+    return ({
+        [quidproquo_core_1.UserDirectoryActionType.AssociateSoftwareToken]: getProcessAssociateSoftwareToken(qpqConfig),
+    });
+});
+exports.getUserDirectoryAssociateSoftwareTokenActionProcessor = getUserDirectoryAssociateSoftwareTokenActionProcessor;

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryChangePasswordActionProcessor.js

@@ -16,8 +16,17 @@ const changePassword_1 = require("../../../logic/cognito/changePassword");
 const getProcessChangePassword = (qpqConfig) => {
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ oldPassword, newPassword, accessToken }) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        yield (0, changePassword_1.changePassword)(accessToken, oldPassword, newPassword, region);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, changePassword_1.changePassword)(accessToken, oldPassword, newPassword, region);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryChangePasswordErrorTypeEnum.IncorrectPassword, 'Current password is incorrect'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryChangePasswordErrorTypeEnum.InvalidNewPassword, 'New password does not meet the password policy'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryChangePasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryChangePasswordActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryConfirmEmailVerificationActionProcessor.js

@@ -16,8 +16,17 @@ const verifyUserEmail_1 = require("../../../logic/cognito/verifyUserEmail");
 const getProcessConfirmEmailVerification = (qpqConfig) => {
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ code, accessToken }) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        yield (0, verifyUserEmail_1.verifyUserEmail)(region, accessToken, code);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, verifyUserEmail_1.verifyUserEmail)(region, accessToken, code);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                CodeMismatchException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmEmailVerificationErrorTypeEnum.InvalidCode, 'Verification code is incorrect'),
+                ExpiredCodeException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmEmailVerificationErrorTypeEnum.ExpiredCode, 'Verification code has expired'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmEmailVerificationErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryConfirmEmailVerificationActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryConfirmForgotPasswordActionProcessor.js

@@ -22,8 +22,18 @@ const getProcessConfirmForgotPassword = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        const authResponse = yield (0, confirmForgotPassword_1.confirmForgotPassword)(userPoolId, userPoolClientId, region, code, resolvedUsername, password);
-        return (0, quidproquo_core_1.actionResult)(authResponse);
+        try {
+            const authResponse = yield (0, confirmForgotPassword_1.confirmForgotPassword)(userPoolId, userPoolClientId, region, code, resolvedUsername, password);
+            return (0, quidproquo_core_1.actionResult)(authResponse);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                CodeMismatchException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmForgotPasswordErrorTypeEnum.InvalidCode, 'Confirmation code is incorrect'),
+                ExpiredCodeException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmForgotPasswordErrorTypeEnum.ExpiredCode, 'Confirmation code has expired'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmForgotPasswordErrorTypeEnum.InvalidNewPassword, 'New password does not meet the password policy'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryConfirmForgotPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryConfirmForgotPasswordActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryCreateUserActionProcessor.js

@@ -23,10 +23,19 @@ const getProcessCreateUser = (qpqConfig) => {
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(payload.userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, payload.createUserRequest.email);
         if (resolvedUsername !== payload.createUserRequest.email) {
-            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Conflict, 'An account with this email already exists');
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryCreateUserErrorTypeEnum.Conflict, 'An account with this email already exists');
+        }
+        try {
+            const authResponse = yield (0, createUser_1.createUser)(userPoolId, region, userPoolClientId, payload.createUserRequest);
+            return (0, quidproquo_core_1.actionResult)(authResponse);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UsernameExistsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryCreateUserErrorTypeEnum.Conflict, 'An account with this email already exists'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryCreateUserErrorTypeEnum.InvalidPassword, 'Password does not meet the password policy'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryCreateUserErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
         }
-        const authResponse = yield (0, createUser_1.createUser)(userPoolId, region, userPoolClientId, payload.createUserRequest);
-        return (0, quidproquo_core_1.actionResult)(authResponse);
     });
 };
 const getUserDirectoryCreateUserActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryDecodeAccessTokenActionProcessor.js

@@ -21,7 +21,7 @@ const getProcessDecodeAccessToken = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const authInfo = yield (0, decodeValidJwt_1.decodeValidJwt)(userPoolId, region, ignoreExpiration, accessToken);
         if (!authInfo || !(authInfo === null || authInfo === void 0 ? void 0 : authInfo.username)) {
-            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid access token');
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryDecodeAccessTokenErrorTypeEnum.Unauthorized, 'Invalid access token');
         }
         return (0, quidproquo_core_1.actionResult)(Object.assign(Object.assign({}, authInfo), { userDirectory: userDirectoryName }));
     });

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryForgotPasswordActionProcessor.js

@@ -22,8 +22,16 @@ const getProcessForgotPassword = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        const authResponse = yield (0, forgotPassword_1.forgotPassword)(userPoolId, userPoolClientId, region, resolvedUsername);
-        return (0, quidproquo_core_1.actionResult)(authResponse);
+        try {
+            const authResponse = yield (0, forgotPassword_1.forgotPassword)(userPoolId, userPoolClientId, region, resolvedUsername);
+            return (0, quidproquo_core_1.actionResult)(authResponse);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UserNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryForgotPasswordErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryForgotPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryForgotPasswordActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryGetUserAttributesByUserIdActionProcessor.js

@@ -19,8 +19,15 @@ const getProcessGetUserAttributesByUserId = (qpqConfig) => {
     return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ userDirectoryName, userId }, session) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const userAttributes = yield (0, getUserAttributesBySub_1.getUserAttributesBySub)(userPoolId, region, userId);
-        return (0, quidproquo_core_1.actionResult)(userAttributes);
+        try {
+            const userAttributes = yield (0, getUserAttributesBySub_1.getUserAttributesBySub)(userPoolId, region, userId);
+            return (0, quidproquo_core_1.actionResult)(userAttributes);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                USER_NOT_FOUND: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryGetUserAttributesByUserIdErrorTypeEnum.UserNotFound, 'No user found for this userId'),
+            });
+        }
     });
 };
 const getUserDirectoryGetUserAttributesByUserIdActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryGetUsersActionProcessor.js

@@ -19,8 +19,16 @@ const getProcessGetUsers = (qpqConfig) => {
     return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ userDirectoryName, nextPageKey }, session) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const userAttributes = yield (0, listPagedUsers_1.listPagedUsers)(userPoolId, region, nextPageKey);
-        return (0, quidproquo_core_1.actionResult)(userAttributes);
+        try {
+            const userAttributes = yield (0, listPagedUsers_1.listPagedUsers)(userPoolId, region, nextPageKey);
+            return (0, quidproquo_core_1.actionResult)(userAttributes);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                InvalidParameterException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryGetUsersErrorTypeEnum.InvalidPageKey, 'The supplied page key is invalid'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryGetUsersErrorTypeEnum.LimitExceeded, 'Too many requests, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryGetUsersActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryGetUsersByAttributeActionProcessor.js

@@ -19,8 +19,16 @@ const getProcessGetUsersByAttribute = (qpqConfig) => {
     return (_a, _session_1) => __awaiter(void 0, [_a, _session_1], void 0, function* ({ userDirectoryName, attribueName, attribueValue, limit, nextPageKey }, _session) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const userAttributes = yield (0, listPagedUsersByAttribute_1.listPagedUsersByAttribute)(userPoolId, region, attribueName, attribueValue, limit, nextPageKey);
-        return (0, quidproquo_core_1.actionResult)(userAttributes);
+        try {
+            const userAttributes = yield (0, listPagedUsersByAttribute_1.listPagedUsersByAttribute)(userPoolId, region, attribueName, attribueValue, limit, nextPageKey);
+            return (0, quidproquo_core_1.actionResult)(userAttributes);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                InvalidParameterException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryGetUsersByAttributeErrorTypeEnum.InvalidSearchParameters, 'The search attribute, value, limit, or page key is invalid'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryGetUsersByAttributeErrorTypeEnum.LimitExceeded, 'Too many requests, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryGetUsersByAttributeActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRefreshTokenActionProcessor.js

@@ -21,10 +21,24 @@ const getProcessRefreshToken = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
         if (!session.decodedAccessToken || !session.decodedAccessToken.username) {
-            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+        }
+        // NOTE: we intentionally do NOT gate on decodedAccessToken.wasValid here.
+        // Refresh must accept a signature-valid-but-expired access token (that's the
+        // point of refreshing), and wasValid folds in the expiry check. The trust
+        // anchor for this operation is the refreshToken itself: Cognito's
+        // REFRESH_TOKEN_AUTH validates it and the SECRET_HASH binds it to `username`,
+        // so a forged/unverified username cannot mint tokens for another user.
+        try {
+            const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
+            return (0, quidproquo_core_1.actionResult)(authResponse);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or has expired'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
         }
-        const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
-        return (0, quidproquo_core_1.actionResult)(authResponse);
     });
 };
 const getUserDirectoryRefreshTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRequestEmailVerificationActionProcessor.js

@@ -16,8 +16,17 @@ const requestEmailVerificationCode_1 = require("../../../logic/cognito/requestEm
 const getProcessRequestEmailVerification = (qpqConfig) => {
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ userDirectoryName, accessToken }) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        yield (0, requestEmailVerificationCode_1.requestEmailVerificationCode)(region, accessToken);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, requestEmailVerificationCode_1.requestEmailVerificationCode)(region, accessToken);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                CodeDeliveryFailureException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.CodeDeliveryFailed, 'Could not deliver the verification code'),
+            });
+        }
     });
 };
 const getUserDirectoryRequestEmailVerificationActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRespondToAuthChallengeActionProcessor.js

@@ -16,6 +16,7 @@ const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-iden
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
 const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
 const respondToAuthChallengeChallenge_1 = require("../../../logic/cognito/respondToAuthChallengeChallenge");
+const verifySoftwareToken_1 = require("../../../logic/cognito/verifySoftwareToken");
 const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
     switch (authChallenge.challenge) {
         case quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED:
@@ -26,6 +27,14 @@ const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
             return {
                 ANSWER: JSON.stringify(authChallenge.challengeAnswer),
             };
+        case quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return {
+                SOFTWARE_TOKEN_MFA_CODE: authChallenge.mfaCode,
+            };
+        // MFA_SETUP completes with just USERNAME/SESSION — the TOTP code is consumed
+        // by the preceding VerifySoftwareToken call, not by RespondToAuthChallenge.
+        case quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP:
+            return {};
         default:
             return {};
     }
@@ -36,6 +45,10 @@ const anyAuthChallengeToCognitoChallengeName = (authChallenge) => {
             return client_cognito_identity_provider_1.ChallengeNameType.NEW_PASSWORD_REQUIRED;
         case quidproquo_core_1.AuthenticateUserChallenge.CUSTOM_CHALLENGE:
             return client_cognito_identity_provider_1.ChallengeNameType.CUSTOM_CHALLENGE;
+        case quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return client_cognito_identity_provider_1.ChallengeNameType.SOFTWARE_TOKEN_MFA;
+        case quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP:
+            return client_cognito_identity_provider_1.ChallengeNameType.MFA_SETUP;
         default:
             throw new Error(`Unknown challenge`);
     }
@@ -45,8 +58,27 @@ const getProcessRespondToAuthChallenge = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const response = yield (0, respondToAuthChallengeChallenge_1.respondToAuthChallengeChallenge)(userPoolId, userPoolClientId, region, authChallenge.username, authChallenge.session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
-        return (0, quidproquo_core_1.actionResult)(response);
+        // MFA_SETUP must verify the TOTP code first; Cognito returns a fresh session
+        // that is then used to complete the challenge and issue tokens.
+        let session = authChallenge.session;
+        try {
+            if (authChallenge.challenge === quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP) {
+                session = yield (0, verifySoftwareToken_1.verifySoftwareToken)(region, session, authChallenge.mfaCode);
+            }
+            const response = yield (0, respondToAuthChallengeChallenge_1.respondToAuthChallengeChallenge)(userPoolId, userPoolClientId, region, authChallenge.username, session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
+            return (0, quidproquo_core_1.actionResult)(response);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                CodeMismatchException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                EnableSoftwareTokenMFAException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                ExpiredCodeException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.ExpiredCode, 'The supplied code has expired'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidNewPassword, 'New password does not meet the password policy'),
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.Unauthorized, 'The challenge session is invalid or has expired'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryRespondToAuthChallengeActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySetPasswordActionProcessor.js

@@ -21,8 +21,18 @@ const getProcessSetPassword = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, resolvedUsername, newPassword);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, resolvedUsername, newPassword);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UserNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.InvalidNewPassword, 'Password does not meet the password policy'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectorySetPasswordActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySetUserAttributesActionProcessor.js

@@ -21,8 +21,19 @@ const getProcessSetUserAttributes = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        yield (0, setUserAttributes_1.setUserAttributes)(userPoolId, region, resolvedUsername, userAttributes);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, setUserAttributes_1.setUserAttributes)(userPoolId, region, resolvedUsername, userAttributes);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UserNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidParameterException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.InvalidAttributes, 'One or more attributes are invalid'),
+                AliasExistsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.AliasExists, 'That email or phone number is already in use'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectorySetUserAttributesActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/index.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserDirectoryActionProcessor = void 0;
+const getUserDirectoryAssociateSoftwareTokenActionProcessor_1 = require("./getUserDirectoryAssociateSoftwareTokenActionProcessor");
 const getUserDirectoryAuthenticateUserActionProcessor_1 = require("./getUserDirectoryAuthenticateUserActionProcessor");
 const getUserDirectoryChangePasswordActionProcessor_1 = require("./getUserDirectoryChangePasswordActionProcessor");
 const getUserDirectoryConfirmEmailVerificationActionProcessor_1 = require("./getUserDirectoryConfirmEmailVerificationActionProcessor");
@@ -29,6 +30,6 @@ const getUserDirectorySetAccessTokenActionProcessor_1 = require("./getUserDirect
 const getUserDirectorySetPasswordActionProcessor_1 = require("./getUserDirectorySetPasswordActionProcessor");
 const getUserDirectorySetUserAttributesActionProcessor_1 = require("./getUserDirectorySetUserAttributesActionProcessor");
 const getUserDirectoryActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAssociateSoftwareTokenActionProcessor_1.getUserDirectoryAssociateSoftwareTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getUserDirectoryActionProcessor = getUserDirectoryActionProcessor;

package/lib/commonjs/getActionProcessor/webserver/serviceFunction/getServiceFunctionExecuteActionProcessor.js

@@ -16,7 +16,7 @@ const quidproquo_webserver_1 = require("quidproquo-webserver");
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
 const executeLambdaByName_1 = require("../../../logic/lambda/executeLambdaByName");
 const getProcessExecute = (qpqConfig) => {
-    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ functionName, service, payload, context, isAsync }, session) {
+    return (_a, session_1) => __awaiter(void 0, [_a, session_1], void 0, function* ({ functionName, service, payload, isAsync }, session) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const appName = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
         const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
@@ -25,7 +25,7 @@ const getProcessExecute = (qpqConfig) => {
         const serviceFunctionEvent = {
             functionName: functionName,
             payload: payload,
-            storySession: Object.assign(Object.assign({}, session), { context }),
+            storySession: (0, quidproquo_core_1.toCrossServiceSession)(session),
         };
         const result = yield (0, executeLambdaByName_1.executeLambdaByName)(awsFunctionName, region, serviceFunctionEvent, isAsync);
         if (!result) {

package/lib/commonjs/index.d.ts

@@ -8,3 +8,4 @@ export * from './logic';
 export * from './logic/cache/memoFunc';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
+export * from './lambdaExtensions/getLogExtensionLayerPath';

package/lib/commonjs/index.js

@@ -48,3 +48,6 @@ __exportStar(require("./logic"), exports);
 __exportStar(require("./logic/cache/memoFunc"), exports);
 __exportStar(require("./logic/parametersManager/getParameter"), exports);
 __exportStar(require("./logic/parametersManager/getParameters"), exports);
+// Log extension layer path + handler port. NOTE: never export the extension
+// entry (./lambdaExtensions/qpqLogExtension) -- it self-executes on import.
+__exportStar(require("./lambdaExtensions/getLogExtensionLayerPath"), exports);

package/lib/commonjs/lambdaExtensions/getLogExtensionLayerPath.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+export declare const getLogExtensionLayerPath: () => string;