quidproquo-actionprocessor-awslambda 0.1.1 → 0.1.3

package/lib/esm/awsNamingUtils.js

@@ -131,6 +131,19 @@ export const getCFExportNameWebsocketApiIdFromConfig = (websocketApiName, qpqCon
     const resourceName = websocketApiConfig.owner?.resourceNameOverride || websocketApiName;
     return getQpqRuntimeResourceName(resourceName, application, service, environment, feature, 'websocket-api-id-export');
 };
+// SSM parameter holding a websocket api's AWS-generated id, written by the owning service's
+// inf stack. Referencing services resolve it at deploy time to build exact execute-api
+// grants (deploy the owning inf stack first - same owner-publishes/others-read pattern as
+// the domain certificate arn parameter).
+export const getWebsocketApiIdSsmParameterName = (websocketApiName, qpqConfig) => {
+    const websocketApiConfig = qpqWebServerUtils.getWebsocketEntryByApiName(websocketApiName, qpqConfig);
+    const application = websocketApiConfig.owner?.application || qpqCoreUtils.getApplicationName(qpqConfig);
+    const service = websocketApiConfig.owner?.module || qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const environment = websocketApiConfig.owner?.environment || qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = websocketApiConfig.owner?.feature || qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    const resourceName = websocketApiConfig.owner?.resourceNameOverride || websocketApiName;
+    return `/qpq/websocket/api-id/${getConfigRuntimeResourceName(resourceName, application, service, environment, feature)}`;
+};
 export const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environment, application, feature) => {
     const topicName = getConfigRuntimeResourceName(eventBusName, application, module, environment, feature);
     const accountInfo = getAwsServiceAccountInfoByDeploymentInfo(qpqConfig, module, environment, feature, application);
@@ -138,6 +151,13 @@ export const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environm
     const region = accountInfo.awsRegion;
     return `arn:aws:sns:${region}:${awsAccountId}:${topicName}`;
 };
+// The account stack owns account-level resources (cloud trail, budgets, security services)
+// so they never share an app's lifecycle. The name is deliberately static: stack names are
+// already namespaced per account+region, and the resources it holds meter/audit the whole
+// account - an app/environment segment would only fake a separation that doesn't exist.
+// Everything in one account converges on this one stack, so exactly ONE repo/config must
+// own it, and actor (feature) deploys must not deploy it.
+export const getAccountStackName = () => 'qpq-account';
 export const getBaseStackName = (qpqConfig) => {
     const appName = qpqCoreUtils.getApplicationName(qpqConfig);
     const moduleName = qpqCoreUtils.getApplicationModuleName(qpqConfig);

package/lib/esm/getActionProcessor/core/ai/getAiPromptActionProcessor.js

@@ -1,21 +1,28 @@
 import { actionResult, actionResultError, AiActionType, ErrorTypeEnum, } from 'quidproquo-core';
 import { generateText, stepCountIs } from 'ai';
-import { prepareAiPromptCall, toSdkMessages } from './logic';
+import { createDriveFileResolver, prepareAiPromptCall, toSdkMessages } from './logic';
 const getProcessAiPrompt = (qpqConfig) => {
     return async (payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
         const prepared = prepareAiPromptCall(qpqConfig, payload, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry);
         if ('error' in prepared) {
             return actionResultError(prepared.error.type, prepared.error.message);
         }
-        const promptOrMessages = payload.messages
-            ? { messages: toSdkMessages(payload.messages) }
-            : { prompt: payload.prompt };
         try {
+            const promptOrMessages = payload.messages
+                ? {
+                    messages: await toSdkMessages(payload.messages, createDriveFileResolver(qpqConfig, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry)),
+                }
+                : { prompt: payload.prompt };
+            // Extended thinking — the model reasons before answering, within the token budget.
+            const providerOptions = payload.reasoning
+                ? { bedrock: { reasoningConfig: { type: 'enabled', budgetTokens: payload.reasoning.budgetTokens ?? 4096 } } }
+                : undefined;
             const result = await generateText({
                 model: prepared.model,
                 system: payload.system,
                 ...promptOrMessages,
                 tools: prepared.tools,
+                providerOptions,
                 stopWhen: stepCountIs(10),
             });
             return actionResult({ text: result.text });

package/lib/esm/getActionProcessor/core/ai/getAiPromptStreamActionProcessor.js

@@ -1,22 +1,29 @@
 import { actionResult, actionResultError, AiActionType, ErrorTypeEnum, } from 'quidproquo-core';
 import { stepCountIs, streamText } from 'ai';
 import { randomGuid } from '../../../awsLambdaUtils';
-import { mapAiStreamPart, prepareAiPromptCall, toSdkMessages } from './logic';
+import { createDriveFileResolver, mapAiStreamPart, prepareAiPromptCall, toSdkMessages } from './logic';
 const getProcessAiPromptStream = (qpqConfig) => {
     return async (payload, session, actionProcessorList, logger, updateSession, dynamicModuleLoader, streamRegistry) => {
         const prepared = prepareAiPromptCall(qpqConfig, payload, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry);
         if ('error' in prepared) {
             return actionResultError(prepared.error.type, prepared.error.message);
         }
-        const promptOrMessages = payload.messages
-            ? { messages: toSdkMessages(payload.messages) }
-            : { prompt: payload.prompt };
         try {
+            const promptOrMessages = payload.messages
+                ? {
+                    messages: await toSdkMessages(payload.messages, createDriveFileResolver(qpqConfig, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry)),
+                }
+                : { prompt: payload.prompt };
+            // Extended thinking — thinking progress streams out as Reasoning* parts.
+            const providerOptions = payload.reasoning
+                ? { bedrock: { reasoningConfig: { type: 'enabled', budgetTokens: payload.reasoning.budgetTokens ?? 4096 } } }
+                : undefined;
             const { fullStream } = streamText({
                 model: prepared.model,
                 system: payload.system,
                 ...promptOrMessages,
                 tools: prepared.tools,
+                providerOptions,
                 stopWhen: stepCountIs(10),
                 // streamText swallows errors by default to keep the server alive — surface them to CloudWatch.
                 onError: ({ error }) => {

package/lib/esm/getActionProcessor/core/ai/logic/aiStreamPartMappers.js

@@ -25,17 +25,17 @@ import { mapAiStreamToolInputStart } from './mapAiStreamToolInputStart';
 import { mapAiStreamToolOutputDenied } from './mapAiStreamToolOutputDenied';
 import { mapAiStreamToolResult } from './mapAiStreamToolResult';
 export const aiStreamPartMappers = {
-    'start': mapAiStreamStart,
-    'finish': mapAiStreamFinish,
+    start: mapAiStreamStart,
+    finish: mapAiStreamFinish,
     'start-step': mapAiStreamStartStep,
     'finish-step': mapAiStreamFinishStep,
-    'abort': mapAiStreamAbort,
-    'error': mapAiStreamError,
-    'raw': mapAiStreamRaw,
-    'source': mapAiStreamSourcePart,
-    'file': mapAiStreamFilePart,
+    abort: mapAiStreamAbort,
+    error: mapAiStreamError,
+    raw: mapAiStreamRaw,
+    source: mapAiStreamSourcePart,
+    file: mapAiStreamFilePart,
     'reasoning-file': mapAiStreamReasoningFilePart,
-    'custom': mapAiStreamCustom,
+    custom: mapAiStreamCustom,
     'text-start': mapAiStreamTextStart,
     'text-end': mapAiStreamTextEnd,
     'text-delta': mapAiStreamTextDelta,

package/lib/esm/getActionProcessor/core/ai/logic/createDriveFileResolver.d.ts

@@ -0,0 +1,3 @@
+import { ActionProcessorList, DynamicModuleLoader, QPQConfig, QpqLogger, StorySession, StreamRegistry } from 'quidproquo-core';
+import { AiDriveFileResolver } from './toSdkMessages';
+export declare const createDriveFileResolver: (qpqConfig: QPQConfig, session: StorySession, actionProcessorList: ActionProcessorList, logger: QpqLogger, dynamicModuleLoader: DynamicModuleLoader, streamRegistry?: StreamRegistry) => AiDriveFileResolver;

package/lib/esm/getActionProcessor/core/ai/logic/createDriveFileResolver.js

@@ -0,0 +1,14 @@
+import { askFileReadBinaryContents, createImplementationRuntime, } from 'quidproquo-core';
+import { randomGuid } from '../../../../awsLambdaUtils';
+// Reads drive-referenced files through the active file action processor, so the
+// same message works against S3 in production and local disk under the dev server.
+export const createDriveFileResolver = (qpqConfig, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry) => {
+    return async (drive, filepath) => {
+        const resolveStory = createImplementationRuntime(qpqConfig, [`AI File: ${drive}/${filepath}`], () => new Date().toISOString(), randomGuid, session, actionProcessorList, logger, dynamicModuleLoader, streamRegistry);
+        const storyResult = await resolveStory(askFileReadBinaryContents, [drive, filepath]);
+        if (storyResult.error) {
+            throw new Error(storyResult.error.errorText);
+        }
+        return storyResult.result;
+    };
+};

package/lib/esm/getActionProcessor/core/ai/logic/index.d.ts

@@ -1,4 +1,5 @@
 export * from './aiStreamPartMappers';
+export * from './createDriveFileResolver';
 export * from './mapAiStreamAbort';
 export * from './mapAiStreamCustom';
 export * from './mapAiStreamError';

package/lib/esm/getActionProcessor/core/ai/logic/index.js

@@ -1,4 +1,5 @@
 export * from './aiStreamPartMappers';
+export * from './createDriveFileResolver';
 export * from './mapAiStreamAbort';
 export * from './mapAiStreamCustom';
 export * from './mapAiStreamError';

package/lib/esm/getActionProcessor/core/ai/logic/toSdkMessages.d.ts

@@ -1,3 +1,4 @@
-import { AiMessage } from 'quidproquo-core';
+import { AiMessage, QPQBinaryData } from 'quidproquo-core';
 import type { ModelMessage } from 'ai';
-export declare const toSdkMessages: (messages: AiMessage[]) => ModelMessage[];
+export type AiDriveFileResolver = (drive: string, filepath: string) => Promise<QPQBinaryData>;
+export declare const toSdkMessages: (messages: AiMessage[], resolveDriveFile: AiDriveFileResolver) => Promise<ModelMessage[]>;

package/lib/esm/getActionProcessor/core/ai/logic/toSdkMessages.js

@@ -1,25 +1,32 @@
-const mapUserPart = (part) => {
-    if (part.type === 'text') {
-        return { type: 'text', text: part.text };
+const mapFilePart = async (part, resolveDriveFile) => {
+    if ('url' in part) {
+        return {
+            type: 'file',
+            data: new URL(part.url),
+            mediaType: part.mediaType,
+            filename: part.filename,
+        };
     }
+    const binary = await resolveDriveFile(part.drive, part.filepath);
     return {
         type: 'file',
-        data: new URL(part.url),
+        data: binary.base64Data,
         mediaType: part.mediaType,
-        filename: part.filename,
+        filename: part.filename ?? binary.filename,
     };
 };
-const mapAssistantPart = (part) => {
+const mapUserPart = async (part, resolveDriveFile) => {
+    if (part.type === 'text') {
+        return { type: 'text', text: part.text };
+    }
+    return mapFilePart(part, resolveDriveFile);
+};
+const mapAssistantPart = async (part, resolveDriveFile) => {
     switch (part.type) {
         case 'text':
             return { type: 'text', text: part.text };
         case 'file':
-            return {
-                type: 'file',
-                data: new URL(part.url),
-                mediaType: part.mediaType,
-                filename: part.filename,
-            };
+            return mapFilePart(part, resolveDriveFile);
         case 'tool-call':
             return {
                 type: 'tool-call',
@@ -50,29 +57,29 @@ const mapToolResult = (part) => {
         output,
     };
 };
-const mapUserMessage = (message) => {
+const mapUserMessage = async (message, resolveDriveFile) => {
     if (typeof message.content === 'string') {
         return { role: 'user', content: message.content };
     }
-    return { role: 'user', content: message.content.map(mapUserPart) };
+    return { role: 'user', content: await Promise.all(message.content.map((part) => mapUserPart(part, resolveDriveFile))) };
 };
-const mapAssistantMessage = (message) => {
+const mapAssistantMessage = async (message, resolveDriveFile) => {
     if (typeof message.content === 'string') {
         return { role: 'assistant', content: message.content };
     }
-    return { role: 'assistant', content: message.content.map(mapAssistantPart) };
+    return { role: 'assistant', content: await Promise.all(message.content.map((part) => mapAssistantPart(part, resolveDriveFile))) };
 };
 const mapToolMessage = (message) => ({
     role: 'tool',
     content: message.content.map(mapToolResult),
 });
-export const toSdkMessages = (messages) => messages.map((message) => {
+export const toSdkMessages = (messages, resolveDriveFile) => Promise.all(messages.map((message) => {
     switch (message.role) {
         case 'user':
-            return mapUserMessage(message);
+            return mapUserMessage(message, resolveDriveFile);
         case 'assistant':
-            return mapAssistantMessage(message);
+            return mapAssistantMessage(message, resolveDriveFile);
         case 'tool':
             return mapToolMessage(message);
     }
-});
+}));

package/lib/esm/getActionProcessor/core/apiKeyValidation/getApiKeyValidationValidateActionProcessor.js

@@ -1,9 +1,10 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, qpqCoreUtils, } from 'quidproquo-core';
+import { actionResult } from 'quidproquo-core';
 import { ApiKeyValidationActionType } from 'quidproquo-webserver';
 import { timingSafeEqual } from 'crypto';
-import { getConfigRuntimeResourceName } from '../../../awsNamingUtils';
-import { getApiKeys } from '../../../logic/apiGateway/getApiKeys';
+import { getCFExportNameApiKeyIdFromConfig } from '../../../awsNamingUtils';
+import { getApiKeyValue } from '../../../logic/apiGateway/getApiKeyValue';
+import { getExportedValue } from '../../../logic/cloudformation/getExportedValue';
 // Constant-time string equality. `timingSafeEqual` throws on length mismatch,
 // so guard the length check — the length itself isn't secret for API keys.
 const safeEqual = (a, b) => {
@@ -16,17 +17,20 @@ const safeEqual = (a, b) => {
 };
 const getProcessApiKeyValidationValidate = (qpqConfig) => {
     const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-    const application = qpqCoreUtils.getApplicationName(qpqConfig);
-    const service = qpqCoreUtils.getApplicationModuleName(qpqConfig);
-    const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
-    const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
     return async ({ apiKeyValue, apiKeyReferences }) => {
-        const realApiKeys = await getApiKeys(region, ...apiKeyReferences.map((apiKey) => {
-            const apiKeyApplication = apiKey.applicationName || application;
-            const apiKeyService = apiKey.serviceName || service;
-            return getConfigRuntimeResourceName(apiKey.name, apiKeyApplication, apiKeyService, environment, feature);
+        // Fetch each referenced key individually (id via CFN export, then GetApiKey) rather than
+        // listing every key in the account - keeps the IAM grant per-key instead of /apikeys-wide.
+        const realApiKeyValues = await Promise.all(apiKeyReferences.map(async (apiKeyReference) => {
+            try {
+                const apiKeyId = await getExportedValue(getCFExportNameApiKeyIdFromConfig(apiKeyReference.name, qpqConfig, apiKeyReference.serviceName, apiKeyReference.applicationName), region);
+                return await getApiKeyValue(region, apiKeyId);
+            }
+            catch {
+                // An unresolvable reference behaves like the old list-and-filter miss - no match
+                return undefined;
+            }
         }));
-        const matched = realApiKeys.some((apiKey) => safeEqual(apiKey.value, apiKeyValue));
+        const matched = realApiKeyValues.some((realApiKeyValue) => safeEqual(realApiKeyValue, apiKeyValue));
         return actionResult(matched);
     };
 };

package/lib/esm/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetRecordsActionProcessor.js

@@ -1,8 +1,9 @@
 import { actionResult, EventActionType, qpqCoreUtils, } from 'quidproquo-core';
-import { qpqWebServerUtils } from 'quidproquo-webserver';
-import { parseMultipartFormData } from '../../utils/parseMultipartFormData';
+import { FileUploadErrorTypeEnum, qpqWebServerUtils } from 'quidproquo-webserver';
+import { FileUploadValidationError, parseMultipartFormData } from '../../utils/parseMultipartFormData';
 const getProcessGetRecords = (qpqConfig) => {
     const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const fileUploadSettings = qpqWebServerUtils.getFileUploadSettings(qpqConfig);
     return async ({ eventParams: [apiGatewayEvent, context] }) => {
         // Initialize `path` by removing the service name prefix from `apiGatewayEvent.path`.
         // This adjustment is necessary because the API gateway routes requests to services based on
@@ -26,7 +27,17 @@ const getProcessGetRecords = (qpqConfig) => {
         };
         // Transform the body if its a multipart/form-data
         if ((qpqWebServerUtils.getHeaderValue('Content-Type', apiGatewayEvent.headers) || '').startsWith('multipart/form-data') && apiGatewayEvent.body) {
-            internalEventRecord.files = await parseMultipartFormData(apiGatewayEvent);
+            try {
+                internalEventRecord.files = await parseMultipartFormData(apiGatewayEvent, fileUploadSettings);
+            }
+            catch (error) {
+                // Stamp the failure on the record so the auto-respond step returns the matching
+                // 4xx before the route story runs - throwing here would fail the whole event as a 5xx
+                internalEventRecord.fileUploadError =
+                    error instanceof FileUploadValidationError
+                        ? { errorType: error.errorType, message: error.message }
+                        : { errorType: FileUploadErrorTypeEnum.malformed, message: 'Unable to parse multipart/form-data body' };
+            }
         }
         return actionResult([internalEventRecord]);
     };

package/lib/esm/getActionProcessor/core/event/utils/parseMultipartFormData.d.ts

@@ -1,3 +1,9 @@
 import { QPQBinaryData } from 'quidproquo-core';
+import { FileUploadErrorTypeEnum, FileUploadSettings } from 'quidproquo-webserver';
 import { APIGatewayEvent } from 'aws-lambda';
-export declare const parseMultipartFormData: (event: APIGatewayEvent) => Promise<QPQBinaryData[]>;
+export declare class FileUploadValidationError extends Error {
+    readonly errorType: FileUploadErrorTypeEnum;
+    constructor(errorType: FileUploadErrorTypeEnum, message: string);
+}
+export declare const sanitizeFilename: (filename?: string) => string;
+export declare const parseMultipartFormData: (event: APIGatewayEvent, fileUploadSettings: FileUploadSettings) => Promise<QPQBinaryData[]>;

package/lib/esm/getActionProcessor/core/event/utils/parseMultipartFormData.js

@@ -1,38 +1,106 @@
+import { FileUploadErrorTypeEnum } from 'quidproquo-webserver';
 import Busboy from 'busboy';
-export const parseMultipartFormData = (event) => new Promise((resolve, reject) => {
+export class FileUploadValidationError extends Error {
+    errorType;
+    constructor(errorType, message) {
+        super(message);
+        this.errorType = errorType;
+        this.name = 'FileUploadValidationError';
+    }
+}
+// Reduce a client-supplied filename to a bare, path-traversal-safe name.
+export const sanitizeFilename = (filename) => {
+    const baseName = (filename || '')
+        .split(/[/\\]/)
+        .filter((segment) => segment.length > 0)
+        .pop();
+    // eslint-disable-next-line no-control-regex
+    const cleaned = (baseName || '').replace(/[\x00-\x1f]/g, '');
+    if (!cleaned || cleaned === '.' || cleaned === '..') {
+        return 'unnamed';
+    }
+    return cleaned;
+};
+const isMimeTypeAllowed = (mimeType, allowedMimeTypes) => {
+    if (!allowedMimeTypes) {
+        return true;
+    }
+    const normalizedMimeType = (mimeType || '').toLowerCase();
+    return allowedMimeTypes.some((allowed) => {
+        const normalizedAllowed = allowed.toLowerCase();
+        return normalizedAllowed.endsWith('/*')
+            ? normalizedMimeType.startsWith(normalizedAllowed.slice(0, -1))
+            : normalizedMimeType === normalizedAllowed;
+    });
+};
+export const parseMultipartFormData = (event, fileUploadSettings) => new Promise((resolve, reject) => {
     const busboy = Busboy({
         headers: {
             'content-type': event.headers['content-type'] || event.headers['Content-Type'],
         },
+        limits: {
+            fileSize: fileUploadSettings.maxFileSizeBytes,
+            files: fileUploadSettings.maxFileCount,
+            fields: fileUploadSettings.maxFieldCount,
+            fieldSize: fileUploadSettings.maxFieldSizeBytes,
+        },
     });
     const result = {
         files: [],
         fields: {},
     };
+    let settled = false;
+    const rejectOnce = (error) => {
+        if (!settled) {
+            settled = true;
+            reject(error);
+        }
+    };
     busboy.on('file', (name, file, info) => {
-        let fileBuffer = Buffer.alloc(0);
+        const filename = sanitizeFilename(info.filename);
+        if (!isMimeTypeAllowed(info.mimeType, fileUploadSettings.allowedMimeTypes)) {
+            rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.disallowedMimeType, `File "${filename}" has disallowed content type "${info.mimeType}"`));
+            file.resume();
+            return;
+        }
+        const chunks = [];
         file.on('data', (data) => {
-            fileBuffer = Buffer.concat([fileBuffer, data]); // Concatenate the new data to the existing buffer
+            chunks.push(data);
+        });
+        // Emitted when the stream is truncated at limits.fileSize - a silently truncated upload must fail, not succeed
+        file.on('limit', () => {
+            rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.fileTooLarge, `File "${filename}" exceeds the maximum file size of ${fileUploadSettings.maxFileSizeBytes} bytes`));
         });
         file.on('end', () => {
-            if (fileBuffer.length > 0) {
+            const content = Buffer.concat(chunks);
+            if (!settled && content.length > 0) {
                 result.files.push({
-                    filename: info.filename,
+                    filename,
                     contentType: info.mimeType,
                     encoding: info.encoding,
                     name: name,
-                    content: fileBuffer,
+                    content,
                 });
             }
         });
     });
+    busboy.on('filesLimit', () => {
+        rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.tooManyFiles, `Upload exceeds the maximum of ${fileUploadSettings.maxFileCount} files`));
+    });
+    busboy.on('fieldsLimit', () => {
+        rejectOnce(new FileUploadValidationError(FileUploadErrorTypeEnum.tooManyFields, `Upload exceeds the maximum of ${fileUploadSettings.maxFieldCount} fields`));
+    });
     busboy.on('field', (name, value) => {
         result.fields[name] = value;
     });
     busboy.on('error', (error) => {
-        reject(error);
+        rejectOnce(error);
     });
     busboy.on('finish', () => {
+        if (settled) {
+            return;
+        }
+        settled = true;
         const qpqBinaryFiles = result.files.map((f) => ({
             filename: f.filename,
             mimetype: f.contentType,

package/lib/esm/getActionProcessor/core/eventBus/getEventBusSendMessagesActionProcessor.js

@@ -3,7 +3,7 @@ import { actionResult, actionResultError, actionResultErrorFromCaughtError, Erro
 import { getEventBusSnsTopicArn } from '../../../awsNamingUtils';
 import { publishMessage } from '../../../logic/sns/publishMessage';
 const getProcessEventBusSendMessage = (qpqConfig) => {
-    return async ({ eventBusName, eventBusMessages, }, session) => {
+    return async ({ eventBusName, eventBusMessages }, session) => {
         const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
         const eventBusConfig = qpqCoreUtils.getEventBusConfigByName(eventBusName, qpqConfig);
         if (!eventBusConfig) {

package/lib/esm/getActionProcessor/core/file/getFileDeleteActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileDeleteErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, FileActionType, FileDeleteErrorTypeEnum, } from 'quidproquo-core';
 import { deleteFiles } from '../../../logic/s3/s3Utils';
 import { resolveStorageDriveBucketName } from './utils';
 const getProcessFileDelete = (qpqConfig) => {

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporarySecureUrlActionProcessor.js

@@ -1,6 +1,6 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { actionResultError, ErrorTypeEnum } from 'quidproquo-core';
-import { actionResult, FileActionType, FileGenerateTemporarySecureUrlErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, FileActionType, FileGenerateTemporarySecureUrlErrorTypeEnum, } from 'quidproquo-core';
 import { generatePresignedUrl } from '../../../logic/s3/generatePresignedUrl';
 import { resolveStorageDriveBucketName } from './utils';
 // SigV4 presigned URLs cannot expire more than 7 days in the future

package/lib/esm/getActionProcessor/core/file/getFileGenerateTemporaryUploadSecureUrlActionProcessor.js

@@ -1,6 +1,6 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { actionResultError, ErrorTypeEnum } from 'quidproquo-core';
-import { actionResult, FileActionType, FileGenerateTemporaryUploadSecureUrlErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, FileActionType, FileGenerateTemporaryUploadSecureUrlErrorTypeEnum, } from 'quidproquo-core';
 import { generatePresignedUploadUrl } from '../../../logic/s3/generatePresignedUploadUrl';
 import { resolveStorageDriveBucketName } from './utils';
 // SigV4 presigned URLs cannot expire more than 7 days in the future

package/lib/esm/getActionProcessor/core/file/getFileStreamOpenActionProcessor.js

@@ -34,9 +34,7 @@ const getProcessFileStreamOpen = (qpqConfig) => {
             const streamId = `s3-${randomGuid()}`;
             const isText = encoding === 'text';
             const size = chunkSize ?? 65536;
-            const transform = isText
-                ? (buf) => buf.toString('utf8')
-                : (buf) => buf.toString('base64');
+            const transform = isText ? (buf) => buf.toString('utf8') : (buf) => buf.toString('base64');
             const iterator = chunkedReadableIterator(response.Body, size, transform);
             streamRegistry.register(streamId, iterator);
             return actionResult({ id: streamId, encoding });

package/lib/esm/getActionProcessor/core/index.d.ts

@@ -6,6 +6,7 @@ export * from './eventBus';
 export * from './file';
 export * from './graphDatabase';
 export * from './keyValueStore';
+export * from './metric';
 export * from './queue';
 export * from './system';
 export * from './userDirectory';

package/lib/esm/getActionProcessor/core/index.js

@@ -6,6 +6,7 @@ export * from './eventBus';
 export * from './file';
 export * from './graphDatabase';
 export * from './keyValueStore';
+export * from './metric';
 export * from './queue';
 export * from './system';
 export * from './userDirectory';
@@ -18,6 +19,7 @@ import { getEventBusActionProcessor } from './eventBus';
 import { getFileActionProcessor } from './file';
 import { getGraphDatabaseActionProcessor } from './graphDatabase';
 import { getKeyValueStoreActionProcessor } from './keyValueStore';
+import { getMetricActionProcessor } from './metric';
 import { getQueueActionProcessor } from './queue';
 import { getSystemActionProcessor } from './system';
 import { getUserDirectoryActionProcessor } from './userDirectory';
@@ -26,6 +28,7 @@ export const getCoreActionProcessor = async (qpqConfig, dynamicModuleLoader) =>
     ...(await getApiKeyValidationActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getFileActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getKeyValueStoreActionProcessor(qpqConfig, dynamicModuleLoader)),
+    ...(await getMetricActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getQueueActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getUserDirectoryActionProcessor(qpqConfig, dynamicModuleLoader)),
     ...(await getEventBusActionProcessor(qpqConfig, dynamicModuleLoader)),

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreDeleteActionProcessor.js

@@ -1,6 +1,6 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { qpqCoreUtils } from 'quidproquo-core';
-import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreDeleteErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreDeleteErrorTypeEnum, } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { deleteItem } from '../../../logic/dynamo';
 const getProcessKeyValueStoreDelete = (qpqConfig) => {

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreGetActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreGetErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreGetErrorTypeEnum, } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { getItem } from '../../../logic/dynamo';
 const getProcessKeyValueStoreGet = (qpqConfig) => {

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreGetAllActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreGetAllErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreGetAllErrorTypeEnum, } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { getAllItems } from '../../../logic/dynamo';
 const getProcessKeyValueStoreGetAll = (qpqConfig) => {

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreQueryActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResultError, actionResultErrorFromCaughtError, ErrorTypeEnum, qpqCoreUtils } from 'quidproquo-core';
+import { actionResultError, actionResultErrorFromCaughtError, ErrorTypeEnum, qpqCoreUtils, } from 'quidproquo-core';
 import { actionResult, KeyValueStoreActionType, KeyValueStoreQueryErrorTypeEnum } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { query } from '../../../logic/dynamo';

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreScanActionProcessor.js

@@ -1,5 +1,5 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
-import { actionResultError, actionResultErrorFromCaughtError } from 'quidproquo-core';
+import { actionResultError, actionResultErrorFromCaughtError, } from 'quidproquo-core';
 import { actionResult, KeyValueStoreActionType, KeyValueStoreScanErrorTypeEnum } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { scan } from '../../../logic/dynamo/scan';

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreUpdateActionProcessor.js

@@ -1,6 +1,6 @@
 import { qpqConfigAwsUtils } from 'quidproquo-config-aws';
 import { qpqCoreUtils } from 'quidproquo-core';
-import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreUpdateErrorTypeEnum } from 'quidproquo-core';
+import { actionResult, actionResultError, actionResultErrorFromCaughtError, KeyValueStoreActionType, KeyValueStoreUpdateErrorTypeEnum, } from 'quidproquo-core';
 import { getKvsDynamoTableNameFromConfig } from '../../../awsNamingUtils';
 import { updateItem } from '../../../logic/dynamo';
 const getProcessKeyValueStoreUpdate = (qpqConfig) => {

package/lib/esm/getActionProcessor/core/keyValueStore/getKeyValueStoreUpsertActionProcessor.js

@@ -20,6 +20,7 @@ const getProcessKeyValueStoreUpsert = (qpqConfig) => {
         try {
             await putItem(dynamoTableName, item, keys, {
                 expires: options?.ttlInSeconds,
+                ifNotExistsAttribute: options?.ifNotExists ? storeConfig.partitionKey.key : undefined,
             }, region);
             return actionResult(void 0);
         }
@@ -27,6 +28,7 @@ const getProcessKeyValueStoreUpsert = (qpqConfig) => {
             return actionResultErrorFromCaughtError(error, {
                 InternalServerError: () => actionResultError(KeyValueStoreUpsertErrorTypeEnum.ServiceUnavailable, 'KVS Service Unavailable'),
                 ResourceNotFoundException: () => actionResultError(KeyValueStoreUpsertErrorTypeEnum.ResourceNotFound, 'KVS Resource Not Found'),
+                ConditionalCheckFailedException: () => actionResultError(KeyValueStoreUpsertErrorTypeEnum.Conflict, 'KVS item already exists'),
             });
         }
     };

package/lib/esm/getActionProcessor/core/metric/getMetricPutActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getMetricPutActionProcessor: ActionProcessorListResolver;