quidproquo-actionprocessor-awslambda 0.0.262 → 0.1.0

package/lib/commonjs/lambdaExtensions/getLogExtensionLayerPath.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLogExtensionLayerPath = void 0;
+const path_1 = __importDefault(require("path"));
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+const getLogExtensionLayerPath = () => {
+    return path_1.default.resolve(__dirname, '..', '..', 'extension-layer');
+};
+exports.getLogExtensionLayerPath = getLogExtensionLayerPath;

package/lib/commonjs/lambdaExtensions/logExtensionPort.d.ts

@@ -0,0 +1 @@
+export declare const LOG_EXTENSION_PORT = 9009;

package/lib/commonjs/lambdaExtensions/logExtensionPort.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOG_EXTENSION_PORT = void 0;
+// Fixed localhost port the function handler uses to reach the qpq-log-extension.
+// Hardcoded on both ends — the handler and the extension always ship together, so
+// there's no need to pass it through an env var.
+exports.LOG_EXTENSION_PORT = 9009;

package/lib/commonjs/lambdaHandlers/getApiGatewayEventHandler.js

@@ -4,12 +4,8 @@ exports.getApiGatewayEventHandler = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const getActionProcessor_1 = require("../getActionProcessor");
 const getQpqLambdaRuntimeForEvent_1 = require("./helpers/getQpqLambdaRuntimeForEvent");
-const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => (0, getQpqLambdaRuntimeForEvent_1.getQpqLambdaRuntimeForEvent)(quidproquo_core_1.QpqRuntimeType.API, (event) => {
-    console.log('event', JSON.stringify(event, null, 2));
-    console.log(event);
-    return {
-        depth: 0,
-        context: {},
-    };
-}, getActionProcessor_1.getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);
+const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => (0, getQpqLambdaRuntimeForEvent_1.getQpqLambdaRuntimeForEvent)(quidproquo_core_1.QpqRuntimeType.API, () => ({
+    depth: 0,
+    context: {},
+}), getActionProcessor_1.getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);
 exports.getApiGatewayEventHandler = getApiGatewayEventHandler;

package/lib/commonjs/lambdaHandlers/getApiGatewayEventHandler_redirect.js

@@ -11,8 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getApiGatewayEventHandler_redirect = void 0;
 const apiGatewayEventHandler_redirect = (event, context) => __awaiter(void 0, void 0, void 0, function* () {
-    console.log('event: ', JSON.stringify(event, null, 2));
-    console.log('process.env: ', JSON.stringify(process.env, null, 2));
     const redirectConfig = JSON.parse(process.env.redirectConfig);
     // For direct urls ~ Go straight to the url
     let redirectUrl = redirectConfig.redirectUrl;

package/lib/commonjs/lambdaHandlers/helpers/getQpqLambdaRuntimeForEvent.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getQpqLambdaRuntimeForEvent = void 0;
-const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const quidproquo_actionprocessor_js_1 = require("quidproquo-actionprocessor-js");
 const quidproquo_core_1 = require("quidproquo-core");
 const getActionProcessor_1 = require("../../getActionProcessor");
 const dynamicModuleLoaderWarmer_1 = require("./dynamicModuleLoaderWarmer");
@@ -28,7 +28,7 @@ const getQpqLambdaRuntimeForEvent = (runtimeType, getStorySession, getActionProc
         console.log('tick: ', JSON.stringify(event, null, 2));
         const logger = (0, logger_1.getLogger)(qpqConfig);
         const resolveStory = (0, quidproquo_core_1.createRuntime)(qpqConfig, getStorySession(event), () => __awaiter(void 0, void 0, void 0, function* () {
-            return (Object.assign(Object.assign(Object.assign({}, (yield (0, getActionProcessor_1.getAwsActionProcessors)(qpqConfig, dynamicModuleLoader))), (yield getActionProcessorList(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_actionprocessor_node_1.getCustomActionActionProcessor)(qpqConfig, dynamicModuleLoader))));
+            return (Object.assign(Object.assign(Object.assign({}, (yield (0, getActionProcessor_1.getAwsActionProcessors)(qpqConfig, dynamicModuleLoader))), (yield getActionProcessorList(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_actionprocessor_js_1.getCustomActionActionProcessor)(qpqConfig, dynamicModuleLoader))));
         }), () => new Date().toISOString(), logger, (0, getRuntimeCorrelation_1.getRuntimeCorrelation)(qpqConfig), runtimeType, dynamicModuleLoader);
         const processEvent = () => __awaiter(void 0, void 0, void 0, function* () {
             const result = yield resolveStory(quidproquo_core_1.askProcessEvent, [event, context]);

package/lib/commonjs/lambdaHandlers/helpers/logger.d.ts

@@ -1,5 +1,8 @@
 import { QPQConfig, QpqLogger, StoryResult } from 'quidproquo-core';
-export declare const storyLogger: (result: StoryResult<any>, bucketName: string, region: string) => Promise<void>;
+import { S3Client } from '@aws-sdk/client-s3';
+export declare const storyLogger: (result: StoryResult<any>, bucketName: string, s3Client: S3Client) => Promise<void>;
 export declare const storyLoggerFs: (result: StoryResult<any>) => Promise<void>;
 export declare const moveLogsToPerminateStorage: (bucketName: string, region: string) => Promise<void>;
+export declare const getS3Logger: (qpqConfig: QPQConfig) => QpqLogger;
+export declare const getS3LoggerViaExtension: (qpqConfig: QPQConfig) => QpqLogger;
 export declare const getLogger: (qpqConfig: QPQConfig) => QpqLogger;

package/lib/commonjs/lambdaHandlers/helpers/logger.js

@@ -12,18 +12,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLogger = exports.moveLogsToPerminateStorage = exports.storyLoggerFs = exports.storyLogger = void 0;
+exports.getLogger = exports.getS3LoggerViaExtension = exports.getS3Logger = exports.moveLogsToPerminateStorage = exports.storyLoggerFs = exports.storyLogger = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const client_s3_1 = require("@aws-sdk/client-s3");
 const awsNamingUtils_1 = require("../../awsNamingUtils");
+const logExtensionPort_1 = require("../../lambdaExtensions/logExtensionPort");
 const tempDirectory = '/tmp/qpqlogs';
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_2 = require("quidproquo-core");
-const storyLogger = (result, bucketName, region) => __awaiter(void 0, void 0, void 0, function* () {
+const storyLogger = (result, bucketName, s3Client) => __awaiter(void 0, void 0, void 0, function* () {
     try {
-        const s3Client = new client_s3_1.S3Client({ region });
         const commandParams = {
             Key: `${result.correlation}.json`,
             Bucket: bucketName,
@@ -54,11 +54,12 @@ const moveLogsToPerminateStorage = (bucketName, region) => __awaiter(void 0, voi
     try {
         yield fs_1.default.promises.mkdir(tempDirectory, { recursive: true });
         const files = yield fs_1.default.promises.readdir(tempDirectory);
+        const s3Client = new client_s3_1.S3Client({ region });
         for (const file of files) {
             const filePath = path_1.default.join(tempDirectory, file);
             const data = yield fs_1.default.promises.readFile(filePath, 'utf-8');
             const result = JSON.parse(data);
-            yield (0, exports.storyLogger)(result, bucketName, region);
+            yield (0, exports.storyLogger)(result, bucketName, s3Client);
             yield fs_1.default.promises.unlink(filePath);
             console.log(`Moved log file [${file}] to S3 and deleted from temporary directory`);
         }
@@ -69,50 +70,52 @@ const moveLogsToPerminateStorage = (bucketName, region) => __awaiter(void 0, voi
     }
 });
 exports.moveLogsToPerminateStorage = moveLogsToPerminateStorage;
-const getLogger = (qpqConfig) => {
-    const awsSettings = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
-    // If we have no log service, just return nothing.
-    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === 'qpq-logs') {
-        return {
-            enableLogs: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            log: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            moveToPermanentStorage: () => __awaiter(void 0, void 0, void 0, function* () { }),
-        };
-    }
-    const service = awsSettings.logServiceName;
+const noopLogger = {
+    enableLogs: () => __awaiter(void 0, void 0, void 0, function* () { }),
+    log: () => { },
+    waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () { }),
+    moveToPermanentStorage: () => __awaiter(void 0, void 0, void 0, function* () { }),
+};
+// Resolves which S3 bucket (and its region) story logs go to for this config.
+const resolveLogTarget = (qpqConfig) => {
+    const service = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig).logServiceName;
     const application = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
     const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
     const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
-    // Workout the bucket name.
-    const bucketName = (0, awsNamingUtils_1.getConfigRuntimeResourceName)('qpq-logs', application, service, environment, feature);
-    // Where is this bucket?
+    const bucketName = (0, awsNamingUtils_1.getConfigRuntimeResourceName)(quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME, application, service, environment, feature);
     const regionForBucket = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoByDeploymentInfo)(qpqConfig, service, environment, feature, application).awsRegion;
+    return { bucketName, regionForBucket };
+};
+// Shared plumbing for both loggers: defers each log to a microtask, applies the
+// disabled-correlation history filter, and tracks the promises so
+// waitToFinishWriting can await them. Only `ship` (how a log reaches S3) differs.
+const createBufferedLogger = (bucketName, regionForBucket, ship) => {
     const logs = [];
     let disabledLogCorrelations = [];
     return {
         enableLogs: (enable, reason, correlation) => __awaiter(void 0, void 0, void 0, function* () {
-            if (!enable) {
-                disabledLogCorrelations = [...disabledLogCorrelations, correlation];
-            }
-            else {
-                disabledLogCorrelations = disabledLogCorrelations.filter((dlc) => dlc !== correlation);
-            }
+            disabledLogCorrelations = enable
+                ? disabledLogCorrelations.filter((dlc) => dlc !== correlation)
+                : [...disabledLogCorrelations, correlation];
         }),
-        log: (result) => __awaiter(void 0, void 0, void 0, function* () {
-            let modifyableResult = !disabledLogCorrelations.includes(result.correlation)
-                ? result
-                : Object.assign(Object.assign({}, result), { history: (0, quidproquo_core_2.filterLogHistoryByActionTypes)(result.history, [
-                        quidproquo_core_1.LogActionType.Create,
-                        quidproquo_core_1.LogActionType.TemplateLiteral,
-                        quidproquo_core_1.LogActionType.DisableEventHistory,
-                    ]) });
-            // TODO: Filter and flatten histories log histories
-            const promise = (0, exports.storyLogger)(modifyableResult, bucketName, regionForBucket).catch((e) => {
+        log: (result) => {
+            // Defer all work (including JSON.stringify) to a microtask so the caller is not blocked.
+            const promise = Promise.resolve()
+                .then(() => {
+                const modifyableResult = !disabledLogCorrelations.includes(result.correlation)
+                    ? result
+                    : Object.assign(Object.assign({}, result), { history: (0, quidproquo_core_2.filterLogHistoryByActionTypes)(result.history, [
+                            quidproquo_core_1.LogActionType.Create,
+                            quidproquo_core_1.LogActionType.TemplateLiteral,
+                            quidproquo_core_1.LogActionType.DisableEventHistory,
+                        ]) });
+                return ship(modifyableResult);
+            })
+                .catch((e) => {
                 console.log('Failed to log story result to S3', JSON.stringify(e, null, 2));
             });
             logs.push(promise);
-        }),
+        },
         waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () {
             yield Promise.all(logs);
         }),
@@ -121,4 +124,59 @@ const getLogger = (qpqConfig) => {
         }),
     };
 };
+// Logs straight to S3: the handler awaits the PutObject itself. Simple and fully
+// durable, but the invoke waits on S3. No extension required.
+const getS3Logger = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new client_s3_1.S3Client({ region: regionForBucket });
+    return createBufferedLogger(bucketName, regionForBucket, (result) => (0, exports.storyLogger)(result, bucketName, s3Client));
+};
+exports.getS3Logger = getS3Logger;
+// Logs via the qpq-log-extension: a fast local HTTP POST hands the log off so the
+// response is not blocked on S3. Falls back to a direct S3 write if the extension
+// is unreachable, so a log is never silently dropped.
+const getS3LoggerViaExtension = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new client_s3_1.S3Client({ region: regionForBucket });
+    const sendToExtension = (result) => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield fetch(`http://127.0.0.1:${logExtensionPort_1.LOG_EXTENSION_PORT}/log`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                bucketName,
+                region: regionForBucket,
+                key: `${result.correlation}.json`,
+                body: JSON.stringify(result),
+                storageClass: 'INTELLIGENT_TIERING',
+            }),
+        });
+        if (!res.ok) {
+            throw new Error(`extension responded ${res.status}`);
+        }
+    });
+    return createBufferedLogger(bucketName, regionForBucket, (result) => __awaiter(void 0, void 0, void 0, function* () {
+        try {
+            yield sendToExtension(result);
+        }
+        catch (error) {
+            console.log(`qpq-log-extension unreachable, writing [${result.correlation}] to S3 directly:`, error);
+            yield (0, exports.storyLogger)(result, bucketName, s3Client);
+        }
+    }));
+};
+exports.getS3LoggerViaExtension = getS3LoggerViaExtension;
+const getLogger = (qpqConfig) => {
+    const awsSettings = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
+    // If we have no log service, just return nothing.
+    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME) {
+        return noopLogger;
+    }
+    // instantLogs forces the synchronous direct-to-S3 path, bypassing the extension.
+    if (awsSettings.instantLogs) {
+        return (0, exports.getS3Logger)(qpqConfig);
+    }
+    // Use the off-response-path extension when running inside a real Lambda (where it
+    // is always attached); otherwise log directly to S3.
+    return process.env.AWS_LAMBDA_RUNTIME_API ? (0, exports.getS3LoggerViaExtension)(qpqConfig) : (0, exports.getS3Logger)(qpqConfig);
+};
 exports.getLogger = getLogger;

package/lib/commonjs/logic/cognito/associateSoftwareToken.d.ts

@@ -0,0 +1,2 @@
+import { AssociateSoftwareTokenResult } from 'quidproquo-core';
+export declare const associateSoftwareToken: (region: string, session: string) => Promise<AssociateSoftwareTokenResult>;

package/lib/commonjs/logic/cognito/associateSoftwareToken.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.associateSoftwareToken = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const createAwsClient_1 = require("../createAwsClient");
+// Begins TOTP enrollment for the MFA_SETUP challenge. Cognito returns the
+// shared secret to seed the authenticator app and a refreshed session that must
+// be used for the subsequent VerifySoftwareToken / RespondToAuthChallenge calls.
+const associateSoftwareToken = (region, session) => __awaiter(void 0, void 0, void 0, function* () {
+    const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
+        region,
+    });
+    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AssociateSoftwareTokenCommand({ Session: session }));
+    return {
+        secretCode: response.SecretCode || '',
+        session: response.Session || '',
+    };
+});
+exports.associateSoftwareToken = associateSoftwareToken;

package/lib/commonjs/logic/cognito/decodeValidJwt.js

@@ -42,7 +42,8 @@ const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __
         return decodedAccessToken;
     }
     catch (e) {
-        console.log('Failed to decode jwt token', e);
+        const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';
+        console.log('Failed to decode jwt token:', summary);
         return null;
     }
 });

package/lib/commonjs/logic/cognito/getUserAttributesBySub.d.ts

@@ -1,2 +1,6 @@
 import { UserAttributes } from 'quidproquo-core';
+export declare class UserNotFoundError extends Error {
+    readonly code = "USER_NOT_FOUND";
+    constructor();
+}
 export declare const getUserAttributesBySub: (userPoolId: string, region: string, sub: string) => Promise<UserAttributes>;

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js

@@ -9,10 +9,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserAttributesBySub = void 0;
+exports.getUserAttributesBySub = exports.UserNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+// ListUsers returns an empty list rather than throwing for no match, so we throw
+// our own error with a discriminable `code` for the processor's catch to map.
+class UserNotFoundError extends Error {
+    constructor() {
+        super('User not found');
+        this.code = 'USER_NOT_FOUND';
+        this.name = 'UserNotFoundError';
+    }
+}
+exports.UserNotFoundError = UserNotFoundError;
 const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
@@ -23,7 +33,7 @@ const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, vo
     }));
     const [user] = (response === null || response === void 0 ? void 0 : response.Users) || [];
     if (!user) {
-        throw new Error('User not found');
+        throw new UserNotFoundError();
     }
     const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
     return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);

package/lib/commonjs/logic/cognito/utils/transformCognitoResponse.js

@@ -25,6 +25,8 @@ const cognitoChallengeNameTypeToQpqAuthenticateUserChallenge = (cognitoChallenge
     const map = {
         [client_cognito_identity_provider_1.ChallengeNameType.NEW_PASSWORD_REQUIRED]: quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED,
         [client_cognito_identity_provider_1.ChallengeNameType.CUSTOM_CHALLENGE]: quidproquo_core_1.AuthenticateUserChallenge.CUSTOM_CHALLENGE,
+        [client_cognito_identity_provider_1.ChallengeNameType.SOFTWARE_TOKEN_MFA]: quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA,
+        [client_cognito_identity_provider_1.ChallengeNameType.MFA_SETUP]: quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP,
     };
     // TODO: handle the NOT-IMP cases
     const challenge = map[cognitoChallengeName] || `QPQ-NOT-IMP-${cognitoChallengeName}`;

package/lib/commonjs/logic/cognito/verifySoftwareToken.d.ts

@@ -0,0 +1 @@
+export declare const verifySoftwareToken: (region: string, session: string, userCode: string) => Promise<string>;

package/lib/commonjs/logic/cognito/verifySoftwareToken.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySoftwareToken = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const createAwsClient_1 = require("../createAwsClient");
+// Verifies the first TOTP code during MFA_SETUP. On success Cognito returns a
+// fresh session that must be passed to RespondToAuthChallenge to complete login.
+// A bad code throws (e.g. CodeMismatchException / EnableSoftwareTokenMFAException).
+const verifySoftwareToken = (region, session, userCode) => __awaiter(void 0, void 0, void 0, function* () {
+    const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
+        region,
+    });
+    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.VerifySoftwareTokenCommand({
+        Session: session,
+        UserCode: userCode,
+    }));
+    return response.Session || '';
+});
+exports.verifySoftwareToken = verifySoftwareToken;

package/lib/commonjs/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getDynamoTableIndexByConfigAndQuery = void 0;
 const buildDynamoQuery_1 = require("./buildDynamoQuery");
 const getDynamoTableIndexByConfigAndQuery = (setting, query) => {
+    var _a;
     // Function to extract keys from a query
     const extractKeysFromQuery = (query) => {
         if ((0, buildDynamoQuery_1.isKvsQueryCondition)(query)) {
@@ -14,13 +15,18 @@ const getDynamoTableIndexByConfigAndQuery = (setting, query) => {
         return [];
     };
     const queriedKeys = extractKeysFromQuery(query);
-    // Find a matching index
+    // If the query includes the primary sort key, the primary table is a direct match —
+    // prefer it over any GSI so we never land on a GSI with a non-SK condition.
+    const primarySortKey = (_a = setting.sortKeys[0]) === null || _a === void 0 ? void 0 : _a.key;
+    if (primarySortKey && queriedKeys.includes(primarySortKey)) {
+        return undefined;
+    }
+    // Find a GSI whose partition key is in the query.
     for (const index of setting.indexes) {
         if (queriedKeys.includes(index.partitionKey.key)) {
             return index.partitionKey.key;
         }
     }
-    // No matching index found
     return undefined;
 };
 exports.getDynamoTableIndexByConfigAndQuery = getDynamoTableIndexByConfigAndQuery;

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.js

@@ -44,7 +44,14 @@ const createAwsClient_1 = require("../createAwsClient");
 //   };
 // };
 const generatePresignedUploadUrl = (bucketName, objectKey, region, expirationMs, correlationId, contentType) => __awaiter(void 0, void 0, void 0, function* () {
-    const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
+    // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the
+    // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed
+    // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and
+    // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).
+    const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, {
+        region,
+        requestChecksumCalculation: 'WHEN_REQUIRED',
+    });
     const putObjectCommand = new client_s3_1.PutObjectCommand({
         Bucket: bucketName,
         Key: objectKey,

package/lib/commonjs/logic/s3/objectExists.js

@@ -14,16 +14,22 @@ const client_s3_1 = require("@aws-sdk/client-s3");
 const client_s3_2 = require("@aws-sdk/client-s3");
 const createAwsClient_1 = require("../createAwsClient");
 const objectExists = (bucketName, key, region) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
     try {
-        const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
         yield s3Client.send(new client_s3_2.HeadObjectCommand({
             Key: key,
             Bucket: bucketName,
         }));
         return true;
     }
-    catch (_a) {
-        return false;
+    catch (error) {
+        // A 404 is a definitive "does not exist"; anything else (access denied,
+        // throttling, ...) must surface rather than masquerade as a missing file.
+        if ((error === null || error === void 0 ? void 0 : error.name) === 'NotFound' || ((_a = error === null || error === void 0 ? void 0 : error.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode) === 404) {
+            return false;
+        }
+        throw error;
     }
 });
 exports.objectExists = objectExists;

package/lib/esm/awsNamingUtils.d.ts

@@ -23,3 +23,4 @@ export declare const getInfStackName: (qpqConfig: QPQConfig) => string;
 export declare const getWebStackName: (qpqConfig: QPQConfig) => string;
 export declare const getApiStackName: (qpqConfig: QPQConfig) => string;
 export declare const getBootstrapStackName: (qpqConfig: QPQConfig) => string;
+export declare const getDomainStackName: (qpqConfig: QPQConfig) => string;

package/lib/esm/awsNamingUtils.js

@@ -168,3 +168,13 @@ export const getBootstrapStackName = (qpqConfig) => {
     }
     return `${baseName}-bs`;
 };
+export const getDomainStackName = (qpqConfig) => {
+    const appName = qpqCoreUtils.getApplicationName(qpqConfig);
+    const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    const baseName = `${appName}-${environment}`;
+    if (feature) {
+        return `${baseName}-${feature}-domain`;
+    }
+    return `${baseName}-domain`;
+};

package/lib/esm/getActionProcessor/core/ai/aiModelMap.d.ts

@@ -0,0 +1,2 @@
+import { AiModel } from 'quidproquo-core';
+export declare const bedrockModelMap: Record<AiModel, string>;

package/lib/esm/getActionProcessor/core/ai/aiModelMap.js

@@ -0,0 +1,12 @@
+import { AiModel } from 'quidproquo-core';
+export const bedrockModelMap = {
+    [AiModel.ClaudeHaiku35]: 'au.anthropic.claude-3-5-haiku-20241022-v1:0',
+    [AiModel.ClaudeSonnet35]: 'au.anthropic.claude-3-5-sonnet-20241022-v2:0',
+    [AiModel.ClaudeSonnet4]: 'au.anthropic.claude-sonnet-4-20250514-v1:0',
+    [AiModel.ClaudeOpus4]: 'au.anthropic.claude-opus-4-20250514-v1:0',
+    [AiModel.ClaudeHaiku45]: 'au.anthropic.claude-haiku-4-5-20251001-v1:0',
+    [AiModel.ClaudeSonnet45]: 'au.anthropic.claude-sonnet-4-5-20250929-v1:0',
+    [AiModel.ClaudeOpus45]: 'au.anthropic.claude-opus-4-5-20251101-v1:0',
+    [AiModel.ClaudeSonnet46]: 'au.anthropic.claude-sonnet-4-6',
+    [AiModel.ClaudeOpus46]: 'au.anthropic.claude-opus-4-6-v1',
+};

package/lib/esm/getActionProcessor/core/ai/getAiPromptActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getAiPromptActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/ai/getAiPromptActionProcessor.js

@@ -0,0 +1,33 @@
+import { actionResult, actionResultError, AiActionType, ErrorTypeEnum, } from 'quidproquo-core';
+import { generateText, stepCountIs } from 'ai';
+import { prepareAiPromptCall, toSdkMessages } from './logic';
+const getProcessAiPrompt = (qpqConfig) => {
+    return async (payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
+        const prepared = prepareAiPromptCall(qpqConfig, payload, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry);
+        if ('error' in prepared) {
+            return actionResultError(prepared.error.type, prepared.error.message);
+        }
+        const promptOrMessages = payload.messages
+            ? { messages: toSdkMessages(payload.messages) }
+            : { prompt: payload.prompt };
+        try {
+            const result = await generateText({
+                model: prepared.model,
+                system: payload.system,
+                ...promptOrMessages,
+                tools: prepared.tools,
+                stopWhen: stepCountIs(10),
+            });
+            return actionResult({ text: result.text });
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                return actionResultError(ErrorTypeEnum.GenericError, error.message);
+            }
+            return actionResultError(ErrorTypeEnum.GenericError, 'An error occurred during AI prompt execution.');
+        }
+    };
+};
+export const getAiPromptActionProcessor = async (qpqConfig) => ({
+    [AiActionType.Prompt]: getProcessAiPrompt(qpqConfig),
+});

package/lib/esm/getActionProcessor/core/ai/getAiPromptStreamActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getAiPromptStreamActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/ai/getAiPromptStreamActionProcessor.js

@@ -0,0 +1,46 @@
+import { actionResult, actionResultError, AiActionType, ErrorTypeEnum, } from 'quidproquo-core';
+import { stepCountIs, streamText } from 'ai';
+import { randomGuid } from '../../../awsLambdaUtils';
+import { mapAiStreamPart, prepareAiPromptCall, toSdkMessages } from './logic';
+const getProcessAiPromptStream = (qpqConfig) => {
+    return async (payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
+        const prepared = prepareAiPromptCall(qpqConfig, payload, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry);
+        if ('error' in prepared) {
+            return actionResultError(prepared.error.type, prepared.error.message);
+        }
+        const promptOrMessages = payload.messages
+            ? { messages: toSdkMessages(payload.messages) }
+            : { prompt: payload.prompt };
+        try {
+            const { fullStream } = streamText({
+                model: prepared.model,
+                system: payload.system,
+                ...promptOrMessages,
+                tools: prepared.tools,
+                stopWhen: stepCountIs(10),
+                // streamText swallows errors by default to keep the server alive — surface them to CloudWatch.
+                onError: ({ error }) => {
+                    // todo yeild this out
+                    console.error('AI prompt stream error:', error);
+                },
+            });
+            const streamId = `ai-prompt-${Date.now()}-${randomGuid()}`;
+            async function* aiStreamIterator() {
+                for await (const part of fullStream) {
+                    yield JSON.stringify(mapAiStreamPart(part));
+                }
+            }
+            streamRegistry.register(streamId, aiStreamIterator());
+            return actionResult({ id: streamId, encoding: 'json' });
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                return actionResultError(ErrorTypeEnum.GenericError, error.message);
+            }
+            return actionResultError(ErrorTypeEnum.GenericError, 'An error occurred during AI prompt stream.');
+        }
+    };
+};
+export const getAiPromptStreamActionProcessor = async (qpqConfig) => ({
+    [AiActionType.PromptStream]: getProcessAiPromptStream(qpqConfig),
+});

package/lib/esm/getActionProcessor/core/ai/index.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getAiActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/ai/index.js

@@ -0,0 +1,6 @@
+import { getAiPromptActionProcessor } from './getAiPromptActionProcessor';
+import { getAiPromptStreamActionProcessor } from './getAiPromptStreamActionProcessor';
+export const getAiActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
+    ...(await getAiPromptActionProcessor(qpqConfig, dynamicModuleLoader)),
+    ...(await getAiPromptStreamActionProcessor(qpqConfig, dynamicModuleLoader)),
+});

package/lib/esm/getActionProcessor/core/ai/logic/aiStreamPartMappers.d.ts

@@ -0,0 +1,6 @@
+import { AiStreamPart } from 'quidproquo-core';
+import { AiSdkStreamPart, AiSdkStreamPartOfType } from '../types';
+export type AiStreamPartMappers = {
+    [K in AiSdkStreamPart['type']]: (part: AiSdkStreamPartOfType<K>) => AiStreamPart;
+};
+export declare const aiStreamPartMappers: AiStreamPartMappers;