quidproquo-actionprocessor-awslambda 0.0.262 → 0.1.0

package/lib/esm/getActionProcessor/core/ai/logic/toSdkMessages.js

@@ -0,0 +1,78 @@
+const mapUserPart = (part) => {
+    if (part.type === 'text') {
+        return { type: 'text', text: part.text };
+    }
+    return {
+        type: 'file',
+        data: new URL(part.url),
+        mediaType: part.mediaType,
+        filename: part.filename,
+    };
+};
+const mapAssistantPart = (part) => {
+    switch (part.type) {
+        case 'text':
+            return { type: 'text', text: part.text };
+        case 'file':
+            return {
+                type: 'file',
+                data: new URL(part.url),
+                mediaType: part.mediaType,
+                filename: part.filename,
+            };
+        case 'tool-call':
+            return {
+                type: 'tool-call',
+                toolCallId: part.toolCallId,
+                toolName: part.toolName,
+                input: part.input,
+            };
+        case 'reasoning':
+            return {
+                type: 'reasoning',
+                text: part.text,
+                providerOptions: part.providerOptions,
+            };
+    }
+};
+const mapToolResult = (part) => {
+    const output = part.isError
+        ? typeof part.output === 'string'
+            ? { type: 'error-text', value: part.output }
+            : { type: 'error-json', value: part.output }
+        : typeof part.output === 'string'
+            ? { type: 'text', value: part.output }
+            : { type: 'json', value: part.output };
+    return {
+        type: 'tool-result',
+        toolCallId: part.toolCallId,
+        toolName: part.toolName,
+        output,
+    };
+};
+const mapUserMessage = (message) => {
+    if (typeof message.content === 'string') {
+        return { role: 'user', content: message.content };
+    }
+    return { role: 'user', content: message.content.map(mapUserPart) };
+};
+const mapAssistantMessage = (message) => {
+    if (typeof message.content === 'string') {
+        return { role: 'assistant', content: message.content };
+    }
+    return { role: 'assistant', content: message.content.map(mapAssistantPart) };
+};
+const mapToolMessage = (message) => ({
+    role: 'tool',
+    content: message.content.map(mapToolResult),
+});
+export const toSdkMessages = (messages) => messages.map((message) => {
+    switch (message.role) {
+        case 'user':
+            return mapUserMessage(message);
+        case 'assistant':
+            return mapAssistantMessage(message);
+        case 'tool':
+            return mapToolMessage(message);
+    }
+});

package/lib/esm/getActionProcessor/core/ai/types/aiSdkStreamPart.d.ts

@@ -0,0 +1,5 @@
+import { TextStreamPart, ToolSet } from 'ai';
+export type AiSdkStreamPart = TextStreamPart<ToolSet>;
+export type AiSdkStreamPartOfType<K extends AiSdkStreamPart['type']> = Extract<AiSdkStreamPart, {
+    type: K;
+}>;

package/lib/esm/getActionProcessor/core/ai/types/aiSdkStreamPart.js

@@ -0,0 +1 @@
+export {};

package/lib/esm/getActionProcessor/core/ai/types/index.d.ts

@@ -0,0 +1 @@
+export * from './aiSdkStreamPart';

package/lib/esm/getActionProcessor/core/ai/types/index.js

@@ -0,0 +1 @@
+export * from './aiSdkStreamPart';

package/lib/esm/getActionProcessor/core/apiKeyValidation/getApiKeyValidationValidateActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getApiKeyValidationValidateActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/apiKeyValidation/getApiKeyValidationValidateActionProcessor.js

@@ -0,0 +1,35 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { actionResult, qpqCoreUtils, } from 'quidproquo-core';
+import { ApiKeyValidationActionType } from 'quidproquo-webserver';
+import { timingSafeEqual } from 'crypto';
+import { getConfigRuntimeResourceName } from '../../../awsNamingUtils';
+import { getApiKeys } from '../../../logic/apiGateway/getApiKeys';
+// Constant-time string equality. `timingSafeEqual` throws on length mismatch,
+// so guard the length check — the length itself isn't secret for API keys.
+const safeEqual = (a, b) => {
+    if (!a || !b || a.length != b.length) {
+        return false;
+    }
+    const aBuf = Buffer.from(a, 'utf8');
+    const bBuf = Buffer.from(b, 'utf8');
+    return timingSafeEqual(aBuf, bBuf);
+};
+const getProcessApiKeyValidationValidate = (qpqConfig) => {
+    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+    const application = qpqCoreUtils.getApplicationName(qpqConfig);
+    const service = qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    return async ({ apiKeyValue, apiKeyReferences }) => {
+        const realApiKeys = await getApiKeys(region, ...apiKeyReferences.map((apiKey) => {
+            const apiKeyApplication = apiKey.applicationName || application;
+            const apiKeyService = apiKey.serviceName || service;
+            return getConfigRuntimeResourceName(apiKey.name, apiKeyApplication, apiKeyService, environment, feature);
+        }));
+        const matched = realApiKeys.some((apiKey) => safeEqual(apiKey.value, apiKeyValue));
+        return actionResult(matched);
+    };
+};
+export const getApiKeyValidationValidateActionProcessor = async (qpqConfig) => ({
+    [ApiKeyValidationActionType.Validate]: getProcessApiKeyValidationValidate(qpqConfig),
+});

package/lib/esm/getActionProcessor/core/apiKeyValidation/index.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getApiKeyValidationActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/apiKeyValidation/index.js

@@ -0,0 +1,4 @@
+import { getApiKeyValidationValidateActionProcessor } from './getApiKeyValidationValidateActionProcessor';
+export const getApiKeyValidationActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
+    ...(await getApiKeyValidationValidateActionProcessor(qpqConfig, dynamicModuleLoader)),
+});

package/lib/esm/getActionProcessor/core/config/getConfigGetSecretActionProcessor.js

@@ -1,12 +1,20 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, ConfigActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, ConfigActionType, ConfigGetSecretErrorTypeEnum, } from 'quidproquo-core';
 import { getSecret } from '../../../logic/secretsManager/getSecret';
 import { resolveSecretResourceName } from './utils';
 const getProcessConfigGetSecret = (qpqConfig) => {
     return async ({ secretName }) => {
         const awsSecretKey = resolveSecretResourceName(secretName, qpqConfig);
-        const secretValue = await getSecret(awsSecretKey, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig));
-        return actionResult(secretValue);
+        try {
+            const secretValue = await getSecret(awsSecretKey, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig));
+            return actionResult(secretValue);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                ResourceNotFoundException: () => actionResultError(ConfigGetSecretErrorTypeEnum.ResourceNotFound, `Secret not found: [${secretName}]`),
+                ThrottlingException: () => actionResultError(ConfigGetSecretErrorTypeEnum.Throttling, 'Throttling: Rate exceeded'),
+            });
+        }
     };
 };
 export const getConfigGetSecretActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/config/getConfigSetParameterActionProcessor.js

@@ -1,12 +1,20 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, ConfigActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, ConfigActionType, ConfigSetParameterErrorTypeEnum, } from 'quidproquo-core';
 import { setParameter } from '../../../logic/parametersManager/setParameter';
 import { resolveParameterKey } from '../../../runtimeConfig/qpqAwsLambdaRuntimeConfigUtils';
 const getProcessConfigSetParameter = (qpqConfig) => {
     return async ({ parameterName, parameterValue }) => {
         const awsParameterKey = resolveParameterKey(parameterName, qpqConfig);
-        await setParameter(awsParameterKey, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), parameterValue);
-        return actionResult(void 0);
+        try {
+            await setParameter(awsParameterKey, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), parameterValue);
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                ThrottlingException: () => actionResultError(ConfigSetParameterErrorTypeEnum.Throttling, 'Throttling: Rate exceeded'),
+                ParameterLimitExceeded: () => actionResultError(ConfigSetParameterErrorTypeEnum.QuotaExceeded, 'Parameter store limit exceeded'),
+            });
+        }
     };
 };
 export const getConfigSetParameterActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/config/index.js

@@ -1,11 +1,9 @@
-import { getConfigGetGlobalActionProcessor } from './getConfigGetGlobalActionProcessor';
 import { getConfigGetParameterActionProcessor } from './getConfigGetParameterActionProcessor';
 import { getConfigGetParametersActionProcessor } from './getConfigGetParametersActionProcessor';
 import { getConfigGetSecretActionProcessor } from './getConfigGetSecretActionProcessor';
 import { getConfigListParametersActionProcessor } from './getConfigListParametersActionProcessor';
 import { getConfigSetParameterActionProcessor } from './getConfigSetParameterActionProcessor';
 export const getConfigActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
-    ...(await getConfigGetGlobalActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getConfigGetParameterActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getConfigGetParametersActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getConfigGetSecretActionProcessor(qpqConfig, dynamicModuleLoader)),

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventAutoRespondActionProcessor.js

@@ -1,33 +1,4 @@
-import { actionResult, EventActionType, } from 'quidproquo-core';
-import { qpqWebServerUtils } from 'quidproquo-webserver';
-import { isAuthValid } from '../../utils/isAuthValid';
-const getProcessAutoRespond = (qpqConfig) => {
-    return async ({ qpqEventRecord, matchResult }) => {
-        // Just auto respond for options requests
-        if (qpqEventRecord.method === 'OPTIONS') {
-            return actionResult({
-                status: 200,
-                isBase64Encoded: false,
-                body: '',
-                headers: qpqWebServerUtils.getCorsHeaders(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
-            });
-        }
-        // TODO: We can pull out the jwt from the session if thats a better way?
-        // Think about that when you dont have covid.
-        const authValid = await isAuthValid(qpqConfig, qpqWebServerUtils.getHeaderValue('Authorization', qpqEventRecord.headers), qpqWebServerUtils.getHeaderValue('x-api-key', qpqEventRecord.headers), matchResult.config?.routeAuthSettings);
-        if (!authValid) {
-            return actionResult({
-                status: 401,
-                isBase64Encoded: false,
-                body: JSON.stringify({
-                    message: 'You are unauthorized to access this resource',
-                }),
-                headers: qpqWebServerUtils.getCorsHeaders(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
-            });
-        }
-        return actionResult(null);
-    };
-};
-export const getEventAutoRespondActionProcessor = async (qpqConfig) => ({
-    [EventActionType.AutoRespond]: getProcessAutoRespond(qpqConfig),
+import { getHttpApiEventAutoRespondActionProcessor } from 'quidproquo-webserver';
+export const getEventAutoRespondActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
+    ...(await getHttpApiEventAutoRespondActionProcessor(qpqConfig, dynamicModuleLoader)),
 });

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetStorySessionActionProcessor.js

@@ -1,36 +1,4 @@
-import { actionResult, EventActionType, } from 'quidproquo-core';
-import { qpqWebServerUtils } from 'quidproquo-webserver';
-import { decodeAccessToken } from '../../../../../logic/cognito';
-const getProcessGetStorySession = (qpqConfig) => {
-    return async ({ matchStoryResult, qpqEventRecord }, session) => {
-        const accessToken = qpqWebServerUtils.getAccessTokenFromHeaders(qpqEventRecord.headers);
-        if (!accessToken) {
-            return actionResult(void 0);
-        }
-        // if this endpoint has no auth settings, BUT we do have an access token
-        // then we want to just attempt to extract info for logs, but we will say that its
-        // wasValid = false
-        if (!matchStoryResult.config?.routeAuthSettings?.userDirectoryName) {
-            // If this endpoint is unauthenticated, then we will just decode it, and say it wasnt valid, for logs
-            const info = qpqWebServerUtils.decodeJWT(accessToken);
-            return actionResult({
-                ...session,
-                decodedAccessToken: {
-                    exp: info?.exp || 0,
-                    userDirectory: '',
-                    userId: info?.sub || info?.id || info?.userId || info?.username || '',
-                    username: info?.username || info?.userId || info?.sub || info?.id || '',
-                    wasValid: false,
-                },
-            });
-        }
-        const decodedAccessToken = await decodeAccessToken(matchStoryResult.config.routeAuthSettings.userDirectoryName, qpqConfig, accessToken, true);
-        return actionResult({
-            ...session,
-            decodedAccessToken,
-        });
-    };
-};
-export const getEventGetStorySessionActionProcessor = async (qpqConfig) => ({
-    [EventActionType.GetStorySession]: getProcessGetStorySession(qpqConfig),
+import { getHttpApiEventGetStorySessionActionProcessor } from 'quidproquo-webserver';
+export const getEventGetStorySessionActionProcessor = async (qpqConfig, dynamicModuleLoader) => ({
+    ...(await getHttpApiEventGetStorySessionActionProcessor(qpqConfig, dynamicModuleLoader)),
 });

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/websocket/getEventTransformResponseResultActionProcessor.js

@@ -11,10 +11,10 @@ export function* askTransformResponseStory({ eventParams, qpqEventRecordResponse
 const getProcessTransformResponseResult = (qpqConfig) => {
     // Create a custom runtime for errored responses so we can log them out
     const errorCustomImplementation = getProcessCustomImplementation(qpqConfig, askTransformResponseStory, 'Transform Errored Websocket Response', null, () => new Date().toISOString(), randomGuid);
-    return async (payload, session, actionProcessors, logger, updateSession, dynamicModuleLoader) => {
+    return async (payload, session, actionProcessors, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
         if (payload.qpqEventRecordResponses.some((r) => !r.success)) {
             // We only wan't to run this for errors, because a custom imp is slower then a regular imp
-            return await errorCustomImplementation(payload, session, actionProcessors, logger, updateSession, dynamicModuleLoader);
+            return await errorCustomImplementation(payload, session, actionProcessors, logger, updateSession, dynamicModuleLoader, streamRegistry);
         }
         return actionResult({
             statusCode: 200,

package/lib/esm/getActionProcessor/core/eventBus/getEventBusSendMessagesActionProcessor.js

@@ -1,26 +1,33 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, ErrorTypeEnum, EventBusActionType, qpqCoreUtils, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, ErrorTypeEnum, EventBusActionType, EventBusSendMessagesErrorTypeEnum, qpqCoreUtils, toCrossServiceSession, } from 'quidproquo-core';
 import { getEventBusSnsTopicArn } from '../../../awsNamingUtils';
 import { publishMessage } from '../../../logic/sns/publishMessage';
 const getProcessEventBusSendMessage = (qpqConfig) => {
-    return async ({ eventBusName, eventBusMessages, context, }, session) => {
+    return async ({ eventBusName, eventBusMessages, }, session) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const eventBusConfig = qpqCoreUtils.getEventBusConfigByName(eventBusName, qpqConfig);
         if (!eventBusConfig) {
             return actionResultError(ErrorTypeEnum.NotFound, `Event bus ${eventBusName} not found`);
         }
         const topicArn = getEventBusSnsTopicArn(eventBusConfig.owner?.resourceNameOverride || eventBusName, qpqConfig, eventBusConfig.owner?.module || qpqCoreUtils.getApplicationModuleName(qpqConfig), eventBusConfig.owner?.environment || qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig), eventBusConfig.owner?.application || qpqCoreUtils.getApplicationName(qpqConfig), eventBusConfig.owner?.feature || qpqCoreUtils.getApplicationModuleFeature(qpqConfig));
-        await publishMessage(topicArn, region, eventBusMessages.map((message) => {
-            const eventBusMessageWithSession = {
-                ...message,
-                storySession: {
-                    ...session,
-                    context,
-                },
-            };
-            return JSON.stringify(eventBusMessageWithSession);
-        }));
-        return actionResult(void 0);
+        try {
+            await publishMessage(topicArn, region, eventBusMessages.map((message) => {
+                const eventBusMessageWithSession = {
+                    ...message,
+                    storySession: toCrossServiceSession(session),
+                };
+                return JSON.stringify(eventBusMessageWithSession);
+            }));
+            return actionResult(void 0);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                AuthorizationErrorException: () => actionResultError(EventBusSendMessagesErrorTypeEnum.AccessDenied, 'Access denied publishing to event bus'),
+                NotFoundException: () => actionResultError(EventBusSendMessagesErrorTypeEnum.TopicNotFound, `Event bus topic not found: ${eventBusName}`),
+                InternalErrorException: () => actionResultError(EventBusSendMessagesErrorTypeEnum.ServiceUnavailable, 'Event bus service unavailable'),
+                ThrottledException: () => actionResultError(EventBusSendMessagesErrorTypeEnum.ServiceUnavailable, 'Event bus throttled'),
+            });
+        }
     };
 };
 export const getEventBusSendMessagesActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileDeleteActionProcessor.js

@@ -1,19 +1,27 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, FileActionType } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileDeleteErrorTypeEnum } from 'quidproquo-core';
 import { deleteFiles } from '../../../logic/s3/s3Utils';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileDelete = (qpqConfig) => {
     return async ({ drive, filepaths }) => {
         const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-        const errored = await deleteFiles(s3BucketName, filepaths, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig));
-        // errored deletes are a graceful success ~ Retry
-        // if (errored.length > 0) {
-        //   return actionResultError(
-        //     ErrorTypeEnum.GenericError,
-        //     `Could not delete files ${errored.length}`,
-        //   );
-        // }
-        return actionResult(errored);
+        try {
+            const errored = await deleteFiles(s3BucketName, filepaths, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig));
+            // errored deletes are a graceful success ~ Retry
+            // if (errored.length > 0) {
+            //   return actionResultError(
+            //     ErrorTypeEnum.GenericError,
+            //     `Could not delete files ${errored.length}`,
+            //   );
+            // }
+            return actionResult(errored);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                AccessDenied: () => actionResultError(FileDeleteErrorTypeEnum.AccessDenied, 'Access denied deleting files'),
+                NoSuchBucket: () => actionResultError(FileDeleteErrorTypeEnum.DriveNotFound, `Storage drive not found: ${drive}`),
+            });
+        }
     };
 };
 export const getFileDeleteActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileExistsActionProcessor.js

@@ -1,11 +1,19 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, FileActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileExistsErrorTypeEnum, } from 'quidproquo-core';
 import { objectExists } from '../../../logic/s3/s3Utils';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileExists = (qpqConfig) => {
     return async ({ drive, filepath }) => {
         const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-        return actionResult(await objectExists(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig)));
+        try {
+            return actionResult(await objectExists(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig)));
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                AccessDenied: () => actionResultError(FileExistsErrorTypeEnum.AccessDenied, 'Access denied checking file existence'),
+                Forbidden: () => actionResultError(FileExistsErrorTypeEnum.AccessDenied, 'Access denied checking file existence'),
+            });
+        }
     };
 };
 export const getFileExistsActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporarySecureUrlActionProcessor.js

@@ -1,10 +1,15 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { actionResultError, ErrorTypeEnum } from 'quidproquo-core';
-import { actionResult, FileActionType } from 'quidproquo-core';
+import { actionResult, FileActionType, FileGenerateTemporarySecureUrlErrorTypeEnum } from 'quidproquo-core';
 import { generatePresignedUrl } from '../../../logic/s3/generatePresignedUrl';
 import { resolveStorageDriveBucketName } from './utils';
+// SigV4 presigned URLs cannot expire more than 7 days in the future
+const maxExpirationMs = 7 * 24 * 60 * 60 * 1000;
 const getProcessFileGenerateTemporarySecureUrl = (qpqConfig) => {
     return async ({ drive, filepath, expirationMs }) => {
+        if (expirationMs > maxExpirationMs) {
+            return actionResultError(FileGenerateTemporarySecureUrlErrorTypeEnum.ExpirationTooLong, 'Expiration exceeds the 7 day maximum for presigned URLs');
+        }
         try {
             const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
             const url = await generatePresignedUrl(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs);

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js

@@ -1,10 +1,15 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { actionResultError, ErrorTypeEnum } from 'quidproquo-core';
-import { actionResult, FileActionType } from 'quidproquo-core';
+import { actionResult, FileActionType, FileGenerateTemporaryUploadSecureUrlErrorTypeEnum } from 'quidproquo-core';
 import { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';
 import { resolveStorageDriveBucketName } from './utils';
+// SigV4 presigned URLs cannot expire more than 7 days in the future
+const maxExpirationMs = 7 * 24 * 60 * 60 * 1000;
 const getProcessFileGenerateTemporaryUploadSecureUrl = (qpqConfig) => {
     return async ({ drive, filepath, expirationMs, contentType }, session) => {
+        if (expirationMs > maxExpirationMs) {
+            return actionResultError(FileGenerateTemporaryUploadSecureUrlErrorTypeEnum.ExpirationTooLong, 'Expiration exceeds the 7 day maximum for presigned URLs');
+        }
         try {
             const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
             const url = await generatePresignedUploadUrl(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), expirationMs, session.correlation, contentType);

package/lib/esm/getActionProcessor/core/file/getFileIsColdStorageActionProcessor.js

@@ -1,12 +1,23 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, FileActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileIsColdStorageErrorTypeEnum, } from 'quidproquo-core';
 import { getObjectStorageClass } from '../../../logic/s3/getObjectStorageClass';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileIsColdStorage = (qpqConfig) => {
     return async ({ drive, filepath }) => {
         const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-        const isColdStorage = (await getObjectStorageClass(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig))) === 'cold_storage';
-        return actionResult(isColdStorage);
+        try {
+            const isColdStorage = (await getObjectStorageClass(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig))) === 'cold_storage';
+            return actionResult(isColdStorage);
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                AccessDenied: () => actionResultError(FileIsColdStorageErrorTypeEnum.AccessDenied, 'Access denied reading file storage class'),
+                Forbidden: () => actionResultError(FileIsColdStorageErrorTypeEnum.AccessDenied, 'Access denied reading file storage class'),
+                NotFound: () => actionResultError(FileIsColdStorageErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+                NoSuchKey: () => actionResultError(FileIsColdStorageErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+                NoSuchBucket: () => actionResultError(FileIsColdStorageErrorTypeEnum.DriveNotFound, `Storage drive not found: ${drive}`),
+            });
+        }
     };
 };
 export const getFileIsColdStorageActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileListDirectoryActionProcessor.js

@@ -1,20 +1,29 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, FileActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileListDirectoryErrorTypeEnum, } from 'quidproquo-core';
 import { listFiles } from '../../../logic/s3/s3Utils';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileListDirectory = (qpqConfig) => {
     return async ({ drive, folderPath, maxFiles, pageToken }) => {
         const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-        const s3FileList = await listFiles(s3BucketName, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), folderPath, maxFiles, pageToken);
-        // Add the drive onto the list
-        const fileInfos = s3FileList.fileInfos.map((s3fi) => ({
-            ...s3fi,
-            drive,
-        }));
-        return actionResult({
-            fileInfos,
-            pageToken: s3FileList.pageToken,
-        });
+        try {
+            const s3FileList = await listFiles(s3BucketName, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), folderPath, maxFiles, pageToken);
+            // Add the drive onto the list
+            const fileInfos = s3FileList.fileInfos.map((s3fi) => ({
+                ...s3fi,
+                drive,
+            }));
+            return actionResult({
+                fileInfos,
+                pageToken: s3FileList.pageToken,
+            });
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                AccessDenied: () => actionResultError(FileListDirectoryErrorTypeEnum.AccessDenied, 'Access denied listing directory'),
+                Forbidden: () => actionResultError(FileListDirectoryErrorTypeEnum.AccessDenied, 'Access denied listing directory'),
+                NoSuchBucket: () => actionResultError(FileListDirectoryErrorTypeEnum.DriveNotFound, `Storage drive not found: ${drive}`),
+            });
+        }
     };
 };
 export const getFileListDirectoryActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileReadBinaryContentsActionProcessor.js

@@ -1,11 +1,20 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, FileActionType, } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileReadBinaryContentsErrorTypeEnum, } from 'quidproquo-core';
 import { readBinaryFile } from '../../../logic/s3/s3Utils';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileReadBinaryContents = (qpqConfig) => {
     return async ({ drive, filepath }) => {
-        const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
-        return actionResult(await readBinaryFile(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig)));
+        try {
+            const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
+            return actionResult(await readBinaryFile(s3BucketName, filepath, qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig)));
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                InvalidObjectState: () => actionResultError(FileReadBinaryContentsErrorTypeEnum.InvalidStorageClass, 'File is in the wrong storage class'),
+                NoSuchKey: () => actionResultError(FileReadBinaryContentsErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+                NotFound: () => actionResultError(FileReadBinaryContentsErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+            });
+        }
     };
 };
 export const getFileReadBinaryContentsActionProcessor = async (qpqConfig) => ({

package/lib/esm/getActionProcessor/core/file/getFileStreamOpenActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getFileStreamOpenActionProcessor: ActionProcessorListResolver;

package/lib/esm/getActionProcessor/core/file/getFileStreamOpenActionProcessor.js

@@ -0,0 +1,55 @@
+import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, ErrorTypeEnum, FileActionType, FileStreamOpenErrorTypeEnum, } from 'quidproquo-core';
+import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { randomGuid } from '../../../awsLambdaUtils';
+import { createAwsClient } from '../../../logic/createAwsClient';
+import { resolveStorageDriveBucketName } from './utils';
+async function* chunkedReadableIterator(stream, chunkSize, transform) {
+    let buffer = Buffer.alloc(0);
+    for await (const chunk of stream) {
+        const incoming = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
+        buffer = Buffer.concat([buffer, incoming]);
+        while (buffer.length >= chunkSize) {
+            yield transform(buffer.subarray(0, chunkSize));
+            buffer = buffer.subarray(chunkSize);
+        }
+    }
+    if (buffer.length > 0) {
+        yield transform(buffer);
+    }
+}
+const getProcessFileStreamOpen = (qpqConfig) => {
+    return async ({ drive, filepath, encoding, chunkSize }, session, actionProcessors, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
+        try {
+            const s3BucketName = resolveStorageDriveBucketName(drive, qpqConfig);
+            const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+            const s3Client = createAwsClient(S3Client, { region });
+            const response = await s3Client.send(new GetObjectCommand({
+                Key: filepath,
+                Bucket: s3BucketName,
+            }));
+            if (!response.Body) {
+                return actionResultError(ErrorTypeEnum.GenericError, `Empty response body for: ${filepath}`);
+            }
+            const streamId = `s3-${randomGuid()}`;
+            const isText = encoding === 'text';
+            const size = chunkSize ?? 65536;
+            const transform = isText
+                ? (buf) => buf.toString('utf8')
+                : (buf) => buf.toString('base64');
+            const iterator = chunkedReadableIterator(response.Body, size, transform);
+            streamRegistry.register(streamId, iterator);
+            return actionResult({ id: streamId, encoding });
+        }
+        catch (error) {
+            return actionResultErrorFromCaughtError(error, {
+                InvalidObjectState: () => actionResultError(FileStreamOpenErrorTypeEnum.InvalidStorageClass, 'File is in the wrong storage class'),
+                NoSuchKey: () => actionResultError(FileStreamOpenErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+                NotFound: () => actionResultError(FileStreamOpenErrorTypeEnum.FileNotFound, `File not found: ${filepath}`),
+            });
+        }
+    };
+};
+export const getFileStreamOpenActionProcessor = async (qpqConfig) => ({
+    [FileActionType.StreamOpen]: getProcessFileStreamOpen(qpqConfig),
+});