quidproquo-actionprocessor-awslambda 0.0.263 → 0.1.1

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRefreshTokenActionProcessor.js

@@ -21,10 +21,24 @@ const getProcessRefreshToken = (qpqConfig) => {
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
         if (!session.decodedAccessToken || !session.decodedAccessToken.username) {
-            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.ErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Invalid accessToken');
+        }
+        // NOTE: we intentionally do NOT gate on decodedAccessToken.wasValid here.
+        // Refresh must accept a signature-valid-but-expired access token (that's the
+        // point of refreshing), and wasValid folds in the expiry check. The trust
+        // anchor for this operation is the refreshToken itself: Cognito's
+        // REFRESH_TOKEN_AUTH validates it and the SECRET_HASH binds it to `username`,
+        // so a forged/unverified username cannot mint tokens for another user.
+        try {
+            const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
+            return (0, quidproquo_core_1.actionResult)(authResponse);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.Unauthorized, 'Refresh token is invalid or has expired'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRefreshTokenErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
         }
-        const authResponse = yield (0, refreshToken_1.refreshToken)(userPoolId, userPoolClientId, quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig), session.decodedAccessToken.username, refreshToken);
-        return (0, quidproquo_core_1.actionResult)(authResponse);
     });
 };
 const getUserDirectoryRefreshTokenActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRequestEmailVerificationActionProcessor.js

@@ -16,8 +16,17 @@ const requestEmailVerificationCode_1 = require("../../../logic/cognito/requestEm
 const getProcessRequestEmailVerification = (qpqConfig) => {
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ userDirectoryName, accessToken }) {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-        yield (0, requestEmailVerificationCode_1.requestEmailVerificationCode)(region, accessToken);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, requestEmailVerificationCode_1.requestEmailVerificationCode)(region, accessToken);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.Unauthorized, 'Access token is invalid or has expired'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                CodeDeliveryFailureException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRequestEmailVerificationErrorTypeEnum.CodeDeliveryFailed, 'Could not deliver the verification code'),
+            });
+        }
     });
 };
 const getUserDirectoryRequestEmailVerificationActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectoryRespondToAuthChallengeActionProcessor.js

@@ -16,6 +16,7 @@ const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-iden
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
 const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
 const respondToAuthChallengeChallenge_1 = require("../../../logic/cognito/respondToAuthChallengeChallenge");
+const verifySoftwareToken_1 = require("../../../logic/cognito/verifySoftwareToken");
 const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
     switch (authChallenge.challenge) {
         case quidproquo_core_1.AuthenticateUserChallenge.NEW_PASSWORD_REQUIRED:
@@ -26,6 +27,14 @@ const anyAuthChallengeToCognitoAttributes = (authChallenge) => {
             return {
                 ANSWER: JSON.stringify(authChallenge.challengeAnswer),
             };
+        case quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return {
+                SOFTWARE_TOKEN_MFA_CODE: authChallenge.mfaCode,
+            };
+        // MFA_SETUP completes with just USERNAME/SESSION — the TOTP code is consumed
+        // by the preceding VerifySoftwareToken call, not by RespondToAuthChallenge.
+        case quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP:
+            return {};
         default:
             return {};
     }
@@ -36,6 +45,10 @@ const anyAuthChallengeToCognitoChallengeName = (authChallenge) => {
             return client_cognito_identity_provider_1.ChallengeNameType.NEW_PASSWORD_REQUIRED;
         case quidproquo_core_1.AuthenticateUserChallenge.CUSTOM_CHALLENGE:
             return client_cognito_identity_provider_1.ChallengeNameType.CUSTOM_CHALLENGE;
+        case quidproquo_core_1.AuthenticateUserChallenge.SOFTWARE_TOKEN_MFA:
+            return client_cognito_identity_provider_1.ChallengeNameType.SOFTWARE_TOKEN_MFA;
+        case quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP:
+            return client_cognito_identity_provider_1.ChallengeNameType.MFA_SETUP;
         default:
             throw new Error(`Unknown challenge`);
     }
@@ -45,8 +58,27 @@ const getProcessRespondToAuthChallenge = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const userPoolClientId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolClientIdFromConfig)(userDirectoryName, qpqConfig), region);
-        const response = yield (0, respondToAuthChallengeChallenge_1.respondToAuthChallengeChallenge)(userPoolId, userPoolClientId, region, authChallenge.username, authChallenge.session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
-        return (0, quidproquo_core_1.actionResult)(response);
+        // MFA_SETUP must verify the TOTP code first; Cognito returns a fresh session
+        // that is then used to complete the challenge and issue tokens.
+        let session = authChallenge.session;
+        try {
+            if (authChallenge.challenge === quidproquo_core_1.AuthenticateUserChallenge.MFA_SETUP) {
+                session = yield (0, verifySoftwareToken_1.verifySoftwareToken)(region, session, authChallenge.mfaCode);
+            }
+            const response = yield (0, respondToAuthChallengeChallenge_1.respondToAuthChallengeChallenge)(userPoolId, userPoolClientId, region, authChallenge.username, session, anyAuthChallengeToCognitoChallengeName(authChallenge), anyAuthChallengeToCognitoAttributes(authChallenge));
+            return (0, quidproquo_core_1.actionResult)(response);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                CodeMismatchException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                EnableSoftwareTokenMFAException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidCode, 'The supplied code is incorrect'),
+                ExpiredCodeException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.ExpiredCode, 'The supplied code has expired'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.InvalidNewPassword, 'New password does not meet the password policy'),
+                NotAuthorizedException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.Unauthorized, 'The challenge session is invalid or has expired'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectoryRespondToAuthChallengeErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectoryRespondToAuthChallengeActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySetPasswordActionProcessor.js

@@ -21,8 +21,18 @@ const getProcessSetPassword = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, resolvedUsername, newPassword);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, setUserPassword_1.setUserPassword)(region, userPoolId, resolvedUsername, newPassword);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UserNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidPasswordException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.InvalidNewPassword, 'Password does not meet the password policy'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetPasswordErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectorySetPasswordActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/getUserDirectorySetUserAttributesActionProcessor.js

@@ -21,8 +21,19 @@ const getProcessSetUserAttributes = (qpqConfig) => {
         const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const userPoolId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameUserPoolIdFromConfig)(userDirectoryName, qpqConfig), region);
         const resolvedUsername = yield (0, resolveUsernameByPreferredUsername_1.resolveUsernameByPreferredUsername)(userPoolId, region, username);
-        yield (0, setUserAttributes_1.setUserAttributes)(userPoolId, region, resolvedUsername, userAttributes);
-        return (0, quidproquo_core_1.actionResult)(void 0);
+        try {
+            yield (0, setUserAttributes_1.setUserAttributes)(userPoolId, region, resolvedUsername, userAttributes);
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                UserNotFoundException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.UserNotFound, 'No account found for this user'),
+                InvalidParameterException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.InvalidAttributes, 'One or more attributes are invalid'),
+                AliasExistsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.AliasExists, 'That email or phone number is already in use'),
+                LimitExceededException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+                TooManyRequestsException: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.UserDirectorySetUserAttributesErrorTypeEnum.LimitExceeded, 'Too many attempts, please try again later'),
+            });
+        }
     });
 };
 const getUserDirectorySetUserAttributesActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {

package/lib/commonjs/getActionProcessor/core/userDirectory/index.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUserDirectoryActionProcessor = void 0;
+const getUserDirectoryAssociateSoftwareTokenActionProcessor_1 = require("./getUserDirectoryAssociateSoftwareTokenActionProcessor");
 const getUserDirectoryAuthenticateUserActionProcessor_1 = require("./getUserDirectoryAuthenticateUserActionProcessor");
 const getUserDirectoryChangePasswordActionProcessor_1 = require("./getUserDirectoryChangePasswordActionProcessor");
 const getUserDirectoryConfirmEmailVerificationActionProcessor_1 = require("./getUserDirectoryConfirmEmailVerificationActionProcessor");
@@ -29,6 +30,6 @@ const getUserDirectorySetAccessTokenActionProcessor_1 = require("./getUserDirect
 const getUserDirectorySetPasswordActionProcessor_1 = require("./getUserDirectorySetPasswordActionProcessor");
 const getUserDirectorySetUserAttributesActionProcessor_1 = require("./getUserDirectorySetUserAttributesActionProcessor");
 const getUserDirectoryActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getUserDirectoryAssociateSoftwareTokenActionProcessor_1.getUserDirectoryAssociateSoftwareTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryAuthenticateUserActionProcessor_1.getUserDirectoryAuthenticateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryChangePasswordActionProcessor_1.getUserDirectoryChangePasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmEmailVerificationActionProcessor_1.getUserDirectoryConfirmEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryConfirmForgotPasswordActionProcessor_1.getUserDirectoryConfirmForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryCreateUserActionProcessor_1.getUserDirectoryCreateUserActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryDecodeAccessTokenActionProcessor_1.getUserDirectoryDecodeAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryForgotPasswordActionProcessor_1.getUserDirectoryForgotPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesActionProcessor_1.getUserDirectoryGetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUserAttributesByUserIdActionProcessor_1.getUserDirectoryGetUserAttributesByUserIdActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersActionProcessor_1.getUserDirectoryGetUsersActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryGetUsersByAttributeActionProcessor_1.getUserDirectoryGetUsersByAttributeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryReadAccessTokenActionProcessor_1.getUserDirectoryReadAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRefreshTokenActionProcessor_1.getUserDirectoryRefreshTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRequestEmailVerificationActionProcessor_1.getUserDirectoryRequestEmailVerificationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectoryRespondToAuthChallengeActionProcessor_1.getUserDirectoryRespondToAuthChallengeActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetAccessTokenActionProcessor_1.getUserDirectorySetAccessTokenActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetPasswordActionProcessor_1.getUserDirectorySetPasswordActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getUserDirectorySetUserAttributesActionProcessor_1.getUserDirectorySetUserAttributesActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getUserDirectoryActionProcessor = getUserDirectoryActionProcessor;

package/lib/commonjs/getActionProcessor/webserver/index.d.ts

@@ -1,4 +1,3 @@
-export * from './extract';
 export * from './serviceFunction';
 export * from './webEntry';
 export * from './websocket';

package/lib/commonjs/getActionProcessor/webserver/index.js

@@ -24,15 +24,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getWebserverActionProcessor = void 0;
-const extract_1 = require("./extract");
 const serviceFunction_1 = require("./serviceFunction");
 const webEntry_1 = require("./webEntry");
 const websocket_1 = require("./websocket");
-__exportStar(require("./extract"), exports);
 __exportStar(require("./serviceFunction"), exports);
 __exportStar(require("./webEntry"), exports);
 __exportStar(require("./websocket"), exports);
 const getWebserverActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, extract_1.getExtractActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, webEntry_1.getWebEntryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, serviceFunction_1.getServiceFunctionActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, websocket_1.getWebsocketActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign({}, (yield (0, webEntry_1.getWebEntryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, serviceFunction_1.getServiceFunctionActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, websocket_1.getWebsocketActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getWebserverActionProcessor = getWebserverActionProcessor;

package/lib/commonjs/getActionProcessor/webserver/serviceFunction/getServiceFunctionExecuteActionProcessor.js

@@ -25,7 +25,7 @@ const getProcessExecute = (qpqConfig) => {
         const serviceFunctionEvent = {
             functionName: functionName,
             payload: payload,
-            storySession: session,
+            storySession: (0, quidproquo_core_1.toCrossServiceSession)(session),
         };
         const result = yield (0, executeLambdaByName_1.executeLambdaByName)(awsFunctionName, region, serviceFunctionEvent, isAsync);
         if (!result) {

package/lib/commonjs/index.d.ts

@@ -8,3 +8,4 @@ export * from './logic';
 export * from './logic/cache/memoFunc';
 export * from './logic/parametersManager/getParameter';
 export * from './logic/parametersManager/getParameters';
+export * from './lambdaExtensions/getLogExtensionLayerPath';

package/lib/commonjs/index.js

@@ -48,3 +48,6 @@ __exportStar(require("./logic"), exports);
 __exportStar(require("./logic/cache/memoFunc"), exports);
 __exportStar(require("./logic/parametersManager/getParameter"), exports);
 __exportStar(require("./logic/parametersManager/getParameters"), exports);
+// Log extension layer path + handler port. NOTE: never export the extension
+// entry (./lambdaExtensions/qpqLogExtension) -- it self-executes on import.
+__exportStar(require("./lambdaExtensions/getLogExtensionLayerPath"), exports);

package/lib/commonjs/lambdaExtensions/getLogExtensionLayerPath.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+export declare const getLogExtensionLayerPath: () => string;

package/lib/commonjs/lambdaExtensions/getLogExtensionLayerPath.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLogExtensionLayerPath = void 0;
+const path_1 = __importDefault(require("path"));
+/**
+ * Absolute path to the built qpq-log-extension layer directory (contains the
+ * `extensions/` folder). Produced by scripts/buildLogExtensionLayer.mjs and
+ * shipped under lib/extension-layer. Used by the CDK layer construct as the
+ * LayerVersion asset source.
+ *
+ * Resolved relative to this compiled file: lib/<format>/lambdaExtensions/<this>
+ * -> ../../extension-layer.
+ */
+const getLogExtensionLayerPath = () => {
+    return path_1.default.resolve(__dirname, '..', '..', 'extension-layer');
+};
+exports.getLogExtensionLayerPath = getLogExtensionLayerPath;

package/lib/commonjs/lambdaExtensions/logExtensionPort.d.ts

@@ -0,0 +1 @@
+export declare const LOG_EXTENSION_PORT = 9009;

package/lib/commonjs/lambdaExtensions/logExtensionPort.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOG_EXTENSION_PORT = void 0;
+// Fixed localhost port the function handler uses to reach the qpq-log-extension.
+// Hardcoded on both ends — the handler and the extension always ship together, so
+// there's no need to pass it through an env var.
+exports.LOG_EXTENSION_PORT = 9009;

package/lib/commonjs/lambdaHandlers/getApiGatewayEventHandler.js

@@ -4,12 +4,8 @@ exports.getApiGatewayEventHandler = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const getActionProcessor_1 = require("../getActionProcessor");
 const getQpqLambdaRuntimeForEvent_1 = require("./helpers/getQpqLambdaRuntimeForEvent");
-const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => (0, getQpqLambdaRuntimeForEvent_1.getQpqLambdaRuntimeForEvent)(quidproquo_core_1.QpqRuntimeType.API, (event) => {
-    console.log('event', JSON.stringify(event, null, 2));
-    console.log(event);
-    return {
-        depth: 0,
-        context: {},
-    };
-}, getActionProcessor_1.getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);
+const getApiGatewayEventHandler = (dynamicModuleLoader, qpqConfig) => (0, getQpqLambdaRuntimeForEvent_1.getQpqLambdaRuntimeForEvent)(quidproquo_core_1.QpqRuntimeType.API, () => ({
+    depth: 0,
+    context: {},
+}), getActionProcessor_1.getApiGatewayApiEventEventProcessor, dynamicModuleLoader, qpqConfig);
 exports.getApiGatewayEventHandler = getApiGatewayEventHandler;

package/lib/commonjs/lambdaHandlers/getApiGatewayEventHandler_redirect.js

@@ -11,8 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getApiGatewayEventHandler_redirect = void 0;
 const apiGatewayEventHandler_redirect = (event, context) => __awaiter(void 0, void 0, void 0, function* () {
-    console.log('event: ', JSON.stringify(event, null, 2));
-    console.log('process.env: ', JSON.stringify(process.env, null, 2));
     const redirectConfig = JSON.parse(process.env.redirectConfig);
     // For direct urls ~ Go straight to the url
     let redirectUrl = redirectConfig.redirectUrl;

package/lib/commonjs/lambdaHandlers/helpers/getQpqLambdaRuntimeForEvent.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getQpqLambdaRuntimeForEvent = void 0;
-const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const quidproquo_actionprocessor_js_1 = require("quidproquo-actionprocessor-js");
 const quidproquo_core_1 = require("quidproquo-core");
 const getActionProcessor_1 = require("../../getActionProcessor");
 const dynamicModuleLoaderWarmer_1 = require("./dynamicModuleLoaderWarmer");
@@ -28,7 +28,7 @@ const getQpqLambdaRuntimeForEvent = (runtimeType, getStorySession, getActionProc
         console.log('tick: ', JSON.stringify(event, null, 2));
         const logger = (0, logger_1.getLogger)(qpqConfig);
         const resolveStory = (0, quidproquo_core_1.createRuntime)(qpqConfig, getStorySession(event), () => __awaiter(void 0, void 0, void 0, function* () {
-            return (Object.assign(Object.assign(Object.assign({}, (yield (0, getActionProcessor_1.getAwsActionProcessors)(qpqConfig, dynamicModuleLoader))), (yield getActionProcessorList(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_actionprocessor_node_1.getCustomActionActionProcessor)(qpqConfig, dynamicModuleLoader))));
+            return (Object.assign(Object.assign(Object.assign({}, (yield (0, getActionProcessor_1.getAwsActionProcessors)(qpqConfig, dynamicModuleLoader))), (yield getActionProcessorList(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_actionprocessor_js_1.getCustomActionActionProcessor)(qpqConfig, dynamicModuleLoader))));
         }), () => new Date().toISOString(), logger, (0, getRuntimeCorrelation_1.getRuntimeCorrelation)(qpqConfig), runtimeType, dynamicModuleLoader);
         const processEvent = () => __awaiter(void 0, void 0, void 0, function* () {
             const result = yield resolveStory(quidproquo_core_1.askProcessEvent, [event, context]);

package/lib/commonjs/lambdaHandlers/helpers/logger.d.ts

@@ -1,5 +1,8 @@
 import { QPQConfig, QpqLogger, StoryResult } from 'quidproquo-core';
-export declare const storyLogger: (result: StoryResult<any>, bucketName: string, region: string) => Promise<void>;
+import { S3Client } from '@aws-sdk/client-s3';
+export declare const storyLogger: (result: StoryResult<any>, bucketName: string, s3Client: S3Client) => Promise<void>;
 export declare const storyLoggerFs: (result: StoryResult<any>) => Promise<void>;
 export declare const moveLogsToPerminateStorage: (bucketName: string, region: string) => Promise<void>;
+export declare const getS3Logger: (qpqConfig: QPQConfig) => QpqLogger;
+export declare const getS3LoggerViaExtension: (qpqConfig: QPQConfig) => QpqLogger;
 export declare const getLogger: (qpqConfig: QPQConfig) => QpqLogger;

package/lib/commonjs/lambdaHandlers/helpers/logger.js

@@ -12,18 +12,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLogger = exports.moveLogsToPerminateStorage = exports.storyLoggerFs = exports.storyLogger = void 0;
+exports.getLogger = exports.getS3LoggerViaExtension = exports.getS3Logger = exports.moveLogsToPerminateStorage = exports.storyLoggerFs = exports.storyLogger = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const client_s3_1 = require("@aws-sdk/client-s3");
 const awsNamingUtils_1 = require("../../awsNamingUtils");
+const logExtensionPort_1 = require("../../lambdaExtensions/logExtensionPort");
 const tempDirectory = '/tmp/qpqlogs';
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_2 = require("quidproquo-core");
-const storyLogger = (result, bucketName, region) => __awaiter(void 0, void 0, void 0, function* () {
+const storyLogger = (result, bucketName, s3Client) => __awaiter(void 0, void 0, void 0, function* () {
     try {
-        const s3Client = new client_s3_1.S3Client({ region });
         const commandParams = {
             Key: `${result.correlation}.json`,
             Bucket: bucketName,
@@ -54,11 +54,12 @@ const moveLogsToPerminateStorage = (bucketName, region) => __awaiter(void 0, voi
     try {
         yield fs_1.default.promises.mkdir(tempDirectory, { recursive: true });
         const files = yield fs_1.default.promises.readdir(tempDirectory);
+        const s3Client = new client_s3_1.S3Client({ region });
         for (const file of files) {
             const filePath = path_1.default.join(tempDirectory, file);
             const data = yield fs_1.default.promises.readFile(filePath, 'utf-8');
             const result = JSON.parse(data);
-            yield (0, exports.storyLogger)(result, bucketName, region);
+            yield (0, exports.storyLogger)(result, bucketName, s3Client);
             yield fs_1.default.promises.unlink(filePath);
             console.log(`Moved log file [${file}] to S3 and deleted from temporary directory`);
         }
@@ -69,50 +70,52 @@ const moveLogsToPerminateStorage = (bucketName, region) => __awaiter(void 0, voi
     }
 });
 exports.moveLogsToPerminateStorage = moveLogsToPerminateStorage;
-const getLogger = (qpqConfig) => {
-    const awsSettings = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
-    // If we have no log service, just return nothing.
-    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === 'qpq-logs') {
-        return {
-            enableLogs: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            log: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () { }),
-            moveToPermanentStorage: () => __awaiter(void 0, void 0, void 0, function* () { }),
-        };
-    }
-    const service = awsSettings.logServiceName;
+const noopLogger = {
+    enableLogs: () => __awaiter(void 0, void 0, void 0, function* () { }),
+    log: () => { },
+    waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () { }),
+    moveToPermanentStorage: () => __awaiter(void 0, void 0, void 0, function* () { }),
+};
+// Resolves which S3 bucket (and its region) story logs go to for this config.
+const resolveLogTarget = (qpqConfig) => {
+    const service = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig).logServiceName;
     const application = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
     const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
     const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
-    // Workout the bucket name.
-    const bucketName = (0, awsNamingUtils_1.getConfigRuntimeResourceName)('qpq-logs', application, service, environment, feature);
-    // Where is this bucket?
+    const bucketName = (0, awsNamingUtils_1.getConfigRuntimeResourceName)(quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME, application, service, environment, feature);
     const regionForBucket = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoByDeploymentInfo)(qpqConfig, service, environment, feature, application).awsRegion;
+    return { bucketName, regionForBucket };
+};
+// Shared plumbing for both loggers: defers each log to a microtask, applies the
+// disabled-correlation history filter, and tracks the promises so
+// waitToFinishWriting can await them. Only `ship` (how a log reaches S3) differs.
+const createBufferedLogger = (bucketName, regionForBucket, ship) => {
     const logs = [];
     let disabledLogCorrelations = [];
     return {
         enableLogs: (enable, reason, correlation) => __awaiter(void 0, void 0, void 0, function* () {
-            if (!enable) {
-                disabledLogCorrelations = [...disabledLogCorrelations, correlation];
-            }
-            else {
-                disabledLogCorrelations = disabledLogCorrelations.filter((dlc) => dlc !== correlation);
-            }
+            disabledLogCorrelations = enable
+                ? disabledLogCorrelations.filter((dlc) => dlc !== correlation)
+                : [...disabledLogCorrelations, correlation];
         }),
-        log: (result) => __awaiter(void 0, void 0, void 0, function* () {
-            let modifyableResult = !disabledLogCorrelations.includes(result.correlation)
-                ? result
-                : Object.assign(Object.assign({}, result), { history: (0, quidproquo_core_2.filterLogHistoryByActionTypes)(result.history, [
-                        quidproquo_core_1.LogActionType.Create,
-                        quidproquo_core_1.LogActionType.TemplateLiteral,
-                        quidproquo_core_1.LogActionType.DisableEventHistory,
-                    ]) });
-            // TODO: Filter and flatten histories log histories
-            const promise = (0, exports.storyLogger)(modifyableResult, bucketName, regionForBucket).catch((e) => {
+        log: (result) => {
+            // Defer all work (including JSON.stringify) to a microtask so the caller is not blocked.
+            const promise = Promise.resolve()
+                .then(() => {
+                const modifyableResult = !disabledLogCorrelations.includes(result.correlation)
+                    ? result
+                    : Object.assign(Object.assign({}, result), { history: (0, quidproquo_core_2.filterLogHistoryByActionTypes)(result.history, [
+                            quidproquo_core_1.LogActionType.Create,
+                            quidproquo_core_1.LogActionType.TemplateLiteral,
+                            quidproquo_core_1.LogActionType.DisableEventHistory,
+                        ]) });
+                return ship(modifyableResult);
+            })
+                .catch((e) => {
                 console.log('Failed to log story result to S3', JSON.stringify(e, null, 2));
             });
             logs.push(promise);
-        }),
+        },
         waitToFinishWriting: () => __awaiter(void 0, void 0, void 0, function* () {
             yield Promise.all(logs);
         }),
@@ -121,4 +124,59 @@ const getLogger = (qpqConfig) => {
         }),
     };
 };
+// Logs straight to S3: the handler awaits the PutObject itself. Simple and fully
+// durable, but the invoke waits on S3. No extension required.
+const getS3Logger = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new client_s3_1.S3Client({ region: regionForBucket });
+    return createBufferedLogger(bucketName, regionForBucket, (result) => (0, exports.storyLogger)(result, bucketName, s3Client));
+};
+exports.getS3Logger = getS3Logger;
+// Logs via the qpq-log-extension: a fast local HTTP POST hands the log off so the
+// response is not blocked on S3. Falls back to a direct S3 write if the extension
+// is unreachable, so a log is never silently dropped.
+const getS3LoggerViaExtension = (qpqConfig) => {
+    const { bucketName, regionForBucket } = resolveLogTarget(qpqConfig);
+    const s3Client = new client_s3_1.S3Client({ region: regionForBucket });
+    const sendToExtension = (result) => __awaiter(void 0, void 0, void 0, function* () {
+        const res = yield fetch(`http://127.0.0.1:${logExtensionPort_1.LOG_EXTENSION_PORT}/log`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                bucketName,
+                region: regionForBucket,
+                key: `${result.correlation}.json`,
+                body: JSON.stringify(result),
+                storageClass: 'INTELLIGENT_TIERING',
+            }),
+        });
+        if (!res.ok) {
+            throw new Error(`extension responded ${res.status}`);
+        }
+    });
+    return createBufferedLogger(bucketName, regionForBucket, (result) => __awaiter(void 0, void 0, void 0, function* () {
+        try {
+            yield sendToExtension(result);
+        }
+        catch (error) {
+            console.log(`qpq-log-extension unreachable, writing [${result.correlation}] to S3 directly:`, error);
+            yield (0, exports.storyLogger)(result, bucketName, s3Client);
+        }
+    }));
+};
+exports.getS3LoggerViaExtension = getS3LoggerViaExtension;
+const getLogger = (qpqConfig) => {
+    const awsSettings = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoConfig)(qpqConfig);
+    // If we have no log service, just return nothing.
+    if (!awsSettings.logServiceName || awsSettings.disableLogs || process.env.storageDriveName === quidproquo_core_1.QPQ_LOGS_STORAGE_DRIVE_NAME) {
+        return noopLogger;
+    }
+    // instantLogs forces the synchronous direct-to-S3 path, bypassing the extension.
+    if (awsSettings.instantLogs) {
+        return (0, exports.getS3Logger)(qpqConfig);
+    }
+    // Use the off-response-path extension when running inside a real Lambda (where it
+    // is always attached); otherwise log directly to S3.
+    return process.env.AWS_LAMBDA_RUNTIME_API ? (0, exports.getS3LoggerViaExtension)(qpqConfig) : (0, exports.getS3Logger)(qpqConfig);
+};
 exports.getLogger = getLogger;

package/lib/commonjs/logic/cognito/associateSoftwareToken.d.ts

@@ -0,0 +1,2 @@
+import { AssociateSoftwareTokenResult } from 'quidproquo-core';
+export declare const associateSoftwareToken: (region: string, session: string) => Promise<AssociateSoftwareTokenResult>;

package/lib/commonjs/logic/cognito/associateSoftwareToken.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.associateSoftwareToken = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const createAwsClient_1 = require("../createAwsClient");
+// Begins TOTP enrollment for the MFA_SETUP challenge. Cognito returns the
+// shared secret to seed the authenticator app and a refreshed session that must
+// be used for the subsequent VerifySoftwareToken / RespondToAuthChallenge calls.
+const associateSoftwareToken = (region, session) => __awaiter(void 0, void 0, void 0, function* () {
+    const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
+        region,
+    });
+    const response = yield cognitoClient.send(new client_cognito_identity_provider_1.AssociateSoftwareTokenCommand({ Session: session }));
+    return {
+        secretCode: response.SecretCode || '',
+        session: response.Session || '',
+    };
+});
+exports.associateSoftwareToken = associateSoftwareToken;

package/lib/commonjs/logic/cognito/decodeValidJwt.js

@@ -42,7 +42,8 @@ const decodeValidJwt = (userPoolId, region, ignoreExpiration, accessToken) => __
         return decodedAccessToken;
     }
     catch (e) {
-        console.log('Failed to decode jwt token', e);
+        const summary = e instanceof Error ? `${e.name}: ${e.message}` : 'unknown error';
+        console.log('Failed to decode jwt token:', summary);
         return null;
     }
 });

package/lib/commonjs/logic/cognito/getUserAttributesBySub.d.ts

@@ -1,2 +1,6 @@
 import { UserAttributes } from 'quidproquo-core';
+export declare class UserNotFoundError extends Error {
+    readonly code = "USER_NOT_FOUND";
+    constructor();
+}
 export declare const getUserAttributesBySub: (userPoolId: string, region: string, sub: string) => Promise<UserAttributes>;

package/lib/commonjs/logic/cognito/getUserAttributesBySub.js

@@ -9,10 +9,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserAttributesBySub = void 0;
+exports.getUserAttributesBySub = exports.UserNotFoundError = void 0;
 const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
 const createAwsClient_1 = require("../createAwsClient");
 const cognitoAttributeMap_1 = require("./cognitoAttributeMap");
+// ListUsers returns an empty list rather than throwing for no match, so we throw
+// our own error with a discriminable `code` for the processor's catch to map.
+class UserNotFoundError extends Error {
+    constructor() {
+        super('User not found');
+        this.code = 'USER_NOT_FOUND';
+        this.name = 'UserNotFoundError';
+    }
+}
+exports.UserNotFoundError = UserNotFoundError;
 const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, void 0, void 0, function* () {
     const cognitoClient = (0, createAwsClient_1.createAwsClient)(client_cognito_identity_provider_1.CognitoIdentityProviderClient, {
         region,
@@ -23,7 +33,7 @@ const getUserAttributesBySub = (userPoolId, region, sub) => __awaiter(void 0, vo
     }));
     const [user] = (response === null || response === void 0 ? void 0 : response.Users) || [];
     if (!user) {
-        throw new Error('User not found');
+        throw new UserNotFoundError();
     }
     const validAttributes = (user.Attributes || []).filter((attr) => attr.Name && attr.Value);
     return (0, cognitoAttributeMap_1.getQpqAttributesFromCognitoUserAttributes)(validAttributes);