quidproquo-actionprocessor-awslambda 0.1.10 → 0.1.12

package/lib/commonjs/logic/dynamo/updateItem.d.ts

@@ -1,2 +1,3 @@
 import { KvsCoreDataType, KvsUpdate } from 'quidproquo-core';
-export declare function updateItem<Item>(tableName: string, region: string, update: KvsUpdate, keyName: string, key: KvsCoreDataType, sortkeyName?: string, sortKey?: KvsCoreDataType): Promise<Item>;
+/** Apply a kvs update to one item and return the full item as stored after the update. */
+export declare function updateItem<Item>(tableName: string, region: string, update: KvsUpdate, keyName: string, key: KvsCoreDataType, sortKeyName?: string, sortKey?: KvsCoreDataType): Promise<Item>;

package/lib/commonjs/logic/dynamo/updateItem.js

@@ -12,26 +12,22 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateItem = updateItem;
 const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
 const createAwsClient_1 = require("../createAwsClient");
-const convertObjectToDynamoMap_1 = require("./convertObjectToDynamoMap");
+const buildDynamoKey_1 = require("./utils/buildDynamoKey");
+const convertDynamoMapToObject_1 = require("./convertDynamoMapToObject");
 const qpqDynamoOrm_1 = require("./qpqDynamoOrm");
-function updateItem(tableName, region, update, keyName, key, sortkeyName, sortKey) {
+/** Apply a kvs update to one item and return the full item as stored after the update. */
+function updateItem(tableName, region, update, keyName, key, sortKeyName, sortKey) {
     return __awaiter(this, void 0, void 0, function* () {
         const dynamoDBClient = (0, createAwsClient_1.createAwsClient)(client_dynamodb_1.DynamoDBClient, { region });
-        const params = {
+        const result = yield dynamoDBClient.send(new client_dynamodb_1.UpdateItemCommand({
             TableName: tableName,
-            Key: {
-                [keyName]: (0, qpqDynamoOrm_1.buildAttributeValue)(key),
-            },
+            Key: (0, buildDynamoKey_1.buildDynamoKey)(keyName, key, sortKeyName, sortKey),
             UpdateExpression: (0, qpqDynamoOrm_1.buildDynamoUpdateExpression)(update),
             ExpressionAttributeValues: (0, qpqDynamoOrm_1.buildUpdateExpressionAttributeValues)(update),
             ExpressionAttributeNames: (0, qpqDynamoOrm_1.buildUpdateExpressionAttributeNames)(update),
             ReturnValues: client_dynamodb_1.ReturnValue.ALL_NEW,
-        };
-        if (sortkeyName && sortKey !== undefined) {
-            params.Key[sortkeyName] = (0, qpqDynamoOrm_1.buildAttributeValue)(sortKey);
-        }
-        const result = yield dynamoDBClient.send(new client_dynamodb_1.UpdateItemCommand(params));
-        return (0, convertObjectToDynamoMap_1.convertDynamoMapToObject)(result.Attributes);
+        }));
+        return (0, convertDynamoMapToObject_1.convertDynamoMapToObject)(result.Attributes);
     });
 }
 //# sourceMappingURL=updateItem.js.map

package/lib/commonjs/logic/dynamo/updateItem.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateItem.js","sourceRoot":"","sources":["../../../../src/logic/dynamo/updateItem.ts"],"names":[],"mappings":";;;;;;;;;;;AAaA,gCA6BC;AAxCD,8DAAkH;AAElH,wDAAqD;AACrD,yEAAsE;AACtE,iDAKwB;AAExB,SAAsB,UAAU,CAC9B,SAAiB,EACjB,MAAc,EACd,MAAiB,EACjB,OAAe,EACf,GAAoB,EACpB,WAAoB,EACpB,OAAyB;;QAEzB,MAAM,cAAc,GAAG,IAAA,iCAAe,EAAC,gCAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,MAAM,GAA2B;YACrC,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE;gBACH,CAAC,OAAO,CAAC,EAAE,IAAA,kCAAmB,EAAC,GAAG,CAAC;aACpC;YACD,gBAAgB,EAAE,IAAA,0CAA2B,EAAC,MAAM,CAAC;YACrD,yBAAyB,EAAE,IAAA,mDAAoC,EAAC,MAAM,CAAC;YACvE,wBAAwB,EAAE,IAAA,kDAAmC,EAAC,MAAM,CAAC;YACrE,YAAY,EAAE,6BAAW,CAAC,OAAO;SAClC,CAAC;QAEF,IAAI,WAAW,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,GAAI,CAAC,WAAW,CAAC,GAAG,IAAA,kCAAmB,EAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,mCAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAExE,OAAO,IAAA,mDAAwB,EAAC,MAAM,CAAC,UAAU,CAAS,CAAC;IAC7D,CAAC;CAAA","sourcesContent":["import { KvsCoreDataType, KvsUpdate } from 'quidproquo-core';\n\nimport { DynamoDBClient, ReturnValue, UpdateItemCommand, UpdateItemCommandInput } from '@aws-sdk/client-dynamodb';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { convertDynamoMapToObject } from './convertObjectToDynamoMap';\nimport {\n  buildAttributeValue,\n  buildDynamoUpdateExpression,\n  buildUpdateExpressionAttributeNames,\n  buildUpdateExpressionAttributeValues,\n} from './qpqDynamoOrm';\n\nexport async function updateItem<Item>(\n  tableName: string,\n  region: string,\n  update: KvsUpdate,\n  keyName: string,\n  key: KvsCoreDataType,\n  sortkeyName?: string,\n  sortKey?: KvsCoreDataType,\n): Promise<Item> {\n  const dynamoDBClient = createAwsClient(DynamoDBClient, { region });\n\n  const params: UpdateItemCommandInput = {\n    TableName: tableName,\n    Key: {\n      [keyName]: buildAttributeValue(key),\n    },\n    UpdateExpression: buildDynamoUpdateExpression(update),\n    ExpressionAttributeValues: buildUpdateExpressionAttributeValues(update),\n    ExpressionAttributeNames: buildUpdateExpressionAttributeNames(update),\n    ReturnValues: ReturnValue.ALL_NEW,\n  };\n\n  if (sortkeyName && sortKey !== undefined) {\n    params.Key![sortkeyName] = buildAttributeValue(sortKey);\n  }\n\n  const result = await dynamoDBClient.send(new UpdateItemCommand(params));\n\n  return convertDynamoMapToObject(result.Attributes) as Item;\n}\n"]}
+{"version":3,"file":"updateItem.js","sourceRoot":"","sources":["../../../../src/logic/dynamo/updateItem.ts"],"names":[],"mappings":";;;;;;;;;;;AAUA,gCAuBC;AA/BD,8DAA0F;AAE1F,wDAAqD;AACrD,2DAAwD;AACxD,yEAAsE;AACtE,iDAAwI;AAExI,0FAA0F;AAC1F,SAAsB,UAAU,CAC9B,SAAiB,EACjB,MAAc,EACd,MAAiB,EACjB,OAAe,EACf,GAAoB,EACpB,WAAoB,EACpB,OAAyB;;QAEzB,MAAM,cAAc,GAAG,IAAA,iCAAe,EAAC,gCAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CACtC,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,IAAA,+BAAc,EAAC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC;YACvD,gBAAgB,EAAE,IAAA,0CAA2B,EAAC,MAAM,CAAC;YACrD,yBAAyB,EAAE,IAAA,mDAAoC,EAAC,MAAM,CAAC;YACvE,wBAAwB,EAAE,IAAA,kDAAmC,EAAC,MAAM,CAAC;YACrE,YAAY,EAAE,6BAAW,CAAC,OAAO;SAClC,CAAC,CACH,CAAC;QAEF,OAAO,IAAA,mDAAwB,EAAC,MAAM,CAAC,UAAU,CAAS,CAAC;IAC7D,CAAC;CAAA","sourcesContent":["import { KvsCoreDataType, KvsUpdate } from 'quidproquo-core';\n\nimport { DynamoDBClient, ReturnValue, UpdateItemCommand } from '@aws-sdk/client-dynamodb';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { buildDynamoKey } from './utils/buildDynamoKey';\nimport { convertDynamoMapToObject } from './convertDynamoMapToObject';\nimport { buildDynamoUpdateExpression, buildUpdateExpressionAttributeNames, buildUpdateExpressionAttributeValues } from './qpqDynamoOrm';\n\n/** Apply a kvs update to one item and return the full item as stored after the update. */\nexport async function updateItem<Item>(\n  tableName: string,\n  region: string,\n  update: KvsUpdate,\n  keyName: string,\n  key: KvsCoreDataType,\n  sortKeyName?: string,\n  sortKey?: KvsCoreDataType,\n): Promise<Item> {\n  const dynamoDBClient = createAwsClient(DynamoDBClient, { region });\n\n  const result = await dynamoDBClient.send(\n    new UpdateItemCommand({\n      TableName: tableName,\n      Key: buildDynamoKey(keyName, key, sortKeyName, sortKey),\n      UpdateExpression: buildDynamoUpdateExpression(update),\n      ExpressionAttributeValues: buildUpdateExpressionAttributeValues(update),\n      ExpressionAttributeNames: buildUpdateExpressionAttributeNames(update),\n      ReturnValues: ReturnValue.ALL_NEW,\n    }),\n  );\n\n  return convertDynamoMapToObject(result.Attributes) as Item;\n}\n"]}

package/lib/commonjs/logic/dynamo/utils/buildDynamoKey.d.ts

@@ -0,0 +1,8 @@
+import { KvsCoreDataType } from 'quidproquo-core';
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+/**
+ * Build the Key map for a Get/Delete/Update item command. The sort key is
+ * included whenever its name is given and the value is defined (falsy values
+ * like 0 and '' are valid sort keys).
+ */
+export declare const buildDynamoKey: (keyName: string, key: KvsCoreDataType, sortKeyName?: string, sortKey?: KvsCoreDataType) => Record<string, AttributeValue>;

package/lib/commonjs/logic/dynamo/utils/buildDynamoKey.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDynamoKey = void 0;
+const buildAttributeValue_1 = require("../qpqDynamoOrm/buildAttributeValue");
+/**
+ * Build the Key map for a Get/Delete/Update item command. The sort key is
+ * included whenever its name is given and the value is defined (falsy values
+ * like 0 and '' are valid sort keys).
+ */
+const buildDynamoKey = (keyName, key, sortKeyName, sortKey) => {
+    const dynamoKey = {
+        [keyName]: (0, buildAttributeValue_1.buildAttributeValue)(key),
+    };
+    if (sortKeyName && sortKey !== undefined) {
+        dynamoKey[sortKeyName] = (0, buildAttributeValue_1.buildAttributeValue)(sortKey);
+    }
+    return dynamoKey;
+};
+exports.buildDynamoKey = buildDynamoKey;
+//# sourceMappingURL=buildDynamoKey.js.map

package/lib/commonjs/logic/dynamo/utils/buildDynamoKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildDynamoKey.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/buildDynamoKey.ts"],"names":[],"mappings":";;;AAIA,6EAA0E;AAE1E;;;;GAIG;AACI,MAAM,cAAc,GAAG,CAC5B,OAAe,EACf,GAAoB,EACpB,WAAoB,EACpB,OAAyB,EACO,EAAE;IAClC,MAAM,SAAS,GAAmC;QAChD,CAAC,OAAO,CAAC,EAAE,IAAA,yCAAmB,EAAC,GAAG,CAAC;KACpC,CAAC;IAEF,IAAI,WAAW,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC,WAAW,CAAC,GAAG,IAAA,yCAAmB,EAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAfW,QAAA,cAAc,kBAezB","sourcesContent":["import { KvsCoreDataType } from 'quidproquo-core';\n\nimport { AttributeValue } from '@aws-sdk/client-dynamodb';\n\nimport { buildAttributeValue } from '../qpqDynamoOrm/buildAttributeValue';\n\n/**\n * Build the Key map for a Get/Delete/Update item command. The sort key is\n * included whenever its name is given and the value is defined (falsy values\n * like 0 and '' are valid sort keys).\n */\nexport const buildDynamoKey = (\n  keyName: string,\n  key: KvsCoreDataType,\n  sortKeyName?: string,\n  sortKey?: KvsCoreDataType,\n): Record<string, AttributeValue> => {\n  const dynamoKey: Record<string, AttributeValue> = {\n    [keyName]: buildAttributeValue(key),\n  };\n\n  if (sortKeyName && sortKey !== undefined) {\n    dynamoKey[sortKeyName] = buildAttributeValue(sortKey);\n  }\n\n  return dynamoKey;\n};\n"]}

package/lib/commonjs/logic/dynamo/{logs/utils → utils}/index.d.ts

@@ -1,2 +1,4 @@
+export * from './buildDynamoKey';
+export * from './itemsToQpqPagedData';
 export * from './lastEvaluatedKeyToString';
 export * from './stringToLastEvaluatedKey';

package/lib/commonjs/logic/dynamo/{logs/utils → utils}/index.js

@@ -14,6 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./buildDynamoKey"), exports);
+__exportStar(require("./itemsToQpqPagedData"), exports);
 __exportStar(require("./lastEvaluatedKeyToString"), exports);
 __exportStar(require("./stringToLastEvaluatedKey"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/logic/dynamo/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,wDAAsC;AACtC,6DAA2C;AAC3C,6DAA2C","sourcesContent":["export * from './buildDynamoKey';\nexport * from './itemsToQpqPagedData';\nexport * from './lastEvaluatedKeyToString';\nexport * from './stringToLastEvaluatedKey';\n"]}

package/lib/commonjs/logic/dynamo/utils/itemsToQpqPagedData.d.ts

@@ -1,2 +1,4 @@
 import { QpqPagedData } from 'quidproquo-core';
-export declare const itemsToQpqPagedData: <T>(items: T[], lastEvaluatedKey?: any) => QpqPagedData<T>;
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+/** Wrap a page of items as QpqPagedData, encoding LastEvaluatedKey as the opaque nextPageKey. */
+export declare const itemsToQpqPagedData: <T>(items: T[], lastEvaluatedKey?: Record<string, AttributeValue>) => QpqPagedData<T>;

package/lib/commonjs/logic/dynamo/utils/itemsToQpqPagedData.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.itemsToQpqPagedData = void 0;
-const logs_1 = require("../logs");
+const lastEvaluatedKeyToString_1 = require("./lastEvaluatedKeyToString");
+/** Wrap a page of items as QpqPagedData, encoding LastEvaluatedKey as the opaque nextPageKey. */
 const itemsToQpqPagedData = (items, lastEvaluatedKey) => ({
     items,
-    nextPageKey: lastEvaluatedKey ? (0, logs_1.lastEvaluatedKeyToString)(lastEvaluatedKey) : undefined,
+    nextPageKey: lastEvaluatedKey ? (0, lastEvaluatedKeyToString_1.lastEvaluatedKeyToString)(lastEvaluatedKey) : undefined,
 });
 exports.itemsToQpqPagedData = itemsToQpqPagedData;
 //# sourceMappingURL=itemsToQpqPagedData.js.map

package/lib/commonjs/logic/dynamo/utils/itemsToQpqPagedData.js.map

@@ -1 +1 @@
-{"version":3,"file":"itemsToQpqPagedData.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/itemsToQpqPagedData.ts"],"names":[],"mappings":";;;AAEA,kCAAmD;AAE5C,MAAM,mBAAmB,GAAG,CAAI,KAAU,EAAE,gBAAsB,EAAmB,EAAE,CAAC,CAAC;IAC9F,KAAK;IACL,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAA,+BAAwB,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;CACvF,CAAC,CAAC;AAHU,QAAA,mBAAmB,uBAG7B","sourcesContent":["import { QpqPagedData } from 'quidproquo-core';\n\nimport { lastEvaluatedKeyToString } from '../logs';\n\nexport const itemsToQpqPagedData = <T>(items: T[], lastEvaluatedKey?: any): QpqPagedData<T> => ({\n  items,\n  nextPageKey: lastEvaluatedKey ? lastEvaluatedKeyToString(lastEvaluatedKey) : undefined,\n});\n"]}
+{"version":3,"file":"itemsToQpqPagedData.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/itemsToQpqPagedData.ts"],"names":[],"mappings":";;;AAIA,yEAAsE;AAEtE,iGAAiG;AAC1F,MAAM,mBAAmB,GAAG,CAAI,KAAU,EAAE,gBAAiD,EAAmB,EAAE,CAAC,CAAC;IACzH,KAAK;IACL,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAA,mDAAwB,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;CACvF,CAAC,CAAC;AAHU,QAAA,mBAAmB,uBAG7B","sourcesContent":["import { QpqPagedData } from 'quidproquo-core';\n\nimport { AttributeValue } from '@aws-sdk/client-dynamodb';\n\nimport { lastEvaluatedKeyToString } from './lastEvaluatedKeyToString';\n\n/** Wrap a page of items as QpqPagedData, encoding LastEvaluatedKey as the opaque nextPageKey. */\nexport const itemsToQpqPagedData = <T>(items: T[], lastEvaluatedKey?: Record<string, AttributeValue>): QpqPagedData<T> => ({\n  items,\n  nextPageKey: lastEvaluatedKey ? lastEvaluatedKeyToString(lastEvaluatedKey) : undefined,\n});\n"]}

package/lib/commonjs/logic/dynamo/utils/lastEvaluatedKeyToString.d.ts

@@ -0,0 +1,3 @@
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+/** Encode a DynamoDB LastEvaluatedKey as an opaque page-key string for clients. */
+export declare function lastEvaluatedKeyToString(lastEvaluatedKey: Record<string, AttributeValue>): string;

package/lib/commonjs/logic/dynamo/{logs/utils → utils}/lastEvaluatedKeyToString.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lastEvaluatedKeyToString = lastEvaluatedKeyToString;
+/** Encode a DynamoDB LastEvaluatedKey as an opaque page-key string for clients. */
 function lastEvaluatedKeyToString(lastEvaluatedKey) {
     return Buffer.from(JSON.stringify(lastEvaluatedKey)).toString('base64');
 }

package/lib/commonjs/logic/dynamo/utils/lastEvaluatedKeyToString.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lastEvaluatedKeyToString.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/lastEvaluatedKeyToString.ts"],"names":[],"mappings":";;AAGA,4DAEC;AAHD,mFAAmF;AACnF,SAAgB,wBAAwB,CAAC,gBAAgD;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import { AttributeValue } from '@aws-sdk/client-dynamodb';\n\n/** Encode a DynamoDB LastEvaluatedKey as an opaque page-key string for clients. */\nexport function lastEvaluatedKeyToString(lastEvaluatedKey: Record<string, AttributeValue>): string {\n  return Buffer.from(JSON.stringify(lastEvaluatedKey)).toString('base64');\n}\n"]}

package/lib/commonjs/logic/dynamo/utils/stringToLastEvaluatedKey.d.ts

@@ -0,0 +1,8 @@
+import { AttributeValue } from '@aws-sdk/client-dynamodb';
+/**
+ * Decode a client-supplied page key back into a DynamoDB ExclusiveStartKey.
+ * The token is client-controlled and unauthenticated: nothing validates that
+ * the decoded shape is a real key (DynamoDB rejects keys that do not match
+ * the table's key schema), and a malformed token throws a SyntaxError.
+ */
+export declare function stringToLastEvaluatedKey(encodedKey: string): Record<string, AttributeValue>;

package/lib/commonjs/logic/dynamo/utils/stringToLastEvaluatedKey.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stringToLastEvaluatedKey = stringToLastEvaluatedKey;
+/**
+ * Decode a client-supplied page key back into a DynamoDB ExclusiveStartKey.
+ * The token is client-controlled and unauthenticated: nothing validates that
+ * the decoded shape is a real key (DynamoDB rejects keys that do not match
+ * the table's key schema), and a malformed token throws a SyntaxError.
+ */
+function stringToLastEvaluatedKey(encodedKey) {
+    return JSON.parse(Buffer.from(encodedKey, 'base64').toString());
+}
+//# sourceMappingURL=stringToLastEvaluatedKey.js.map

package/lib/commonjs/logic/dynamo/utils/stringToLastEvaluatedKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stringToLastEvaluatedKey.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/utils/stringToLastEvaluatedKey.ts"],"names":[],"mappings":";;AAQA,4DAEC;AARD;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,UAAkB;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import { AttributeValue } from '@aws-sdk/client-dynamodb';\n\n/**\n * Decode a client-supplied page key back into a DynamoDB ExclusiveStartKey.\n * The token is client-controlled and unauthenticated: nothing validates that\n * the decoded shape is a real key (DynamoDB rejects keys that do not match\n * the table's key schema), and a malformed token throws a SyntaxError.\n */\nexport function stringToLastEvaluatedKey(encodedKey: string): Record<string, AttributeValue> {\n  return JSON.parse(Buffer.from(encodedKey, 'base64').toString());\n}\n"]}

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleStoreManifest.d.ts

@@ -1,8 +1,8 @@
-export interface FederatedModuleStoreManifest {
+export type FederatedModuleStoreManifest = {
     containerName: string;
     service: string;
     hash: string;
     entry: string;
     files: string[];
     exposes: Record<string, string>;
-}
+};

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleStoreManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedModuleStoreManifest.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/FederatedModuleStoreManifest.ts"],"names":[],"mappings":"","sourcesContent":["// ─────────────────────────────────────────────────────────────────────────────\n// The JSON contract that ties the two halves of federation together:\n//   WRITTEN BY   quidproquo-deploy-webpack/src/federation/publishFederatedRemote.ts\n//   READ BY      quidproquo-actionprocessor-awslambda .../loadFederatedStory.ts\n//\n// Store layout (under s3://<bucket>/<service>/ once uploaded):\n//   manifest.json          <- THIS document, uploaded LAST (the atomic \"current\" pointer)\n//   <hash>/<...files>      <- the immutable module-federation container build for a version\n//\n// The loader reads manifest.json first, so publishing = upload the <hash>/ dir, then\n// overwrite manifest.json. A new `hash` is what tells a warm lambda a new version exists.\n// ─────────────────────────────────────────────────────────────────────────────\nexport interface FederatedModuleStoreManifest {\n  // MF container name (qpq_<service>). The build bakes it in as the container's library\n  // name; the loader stores the loaded container on globalThis under this key.\n  containerName: string;\n\n  // qpq service/module this remote was built from (informational / debugging).\n  service: string;\n\n  // Content hash of the published files == the <hash> version directory name. Changing\n  // it is the signal the loader uses to detect and hot-swap to a new version.\n  hash: string;\n\n  // Container entry file within the version directory (always 'remoteEntry.js').\n  entry: string;\n\n  // Every file in the version directory. The loader syncs exactly these (so it needs\n  // GetObject only, no ListBucket) to /tmp.\n  files: string[];\n\n  // The lookup table the loader uses: machine-independent runtime key\n  // (getFederatedKeyFromQpqFunctionRuntime) -> the container's expose path (no './'\n  // prefix). Built on the publish side by getFederatedRemoteInfoForQpqConfig.\n  exposes: Record<string, string>;\n}\n"]}
+{"version":3,"file":"FederatedModuleStoreManifest.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/FederatedModuleStoreManifest.ts"],"names":[],"mappings":"","sourcesContent":["// ─────────────────────────────────────────────────────────────────────────────\n// The JSON contract that ties the two halves of federation together:\n//   WRITTEN BY   quidproquo-deploy-webpack/src/federation/publishFederatedRemote.ts\n//   READ BY      quidproquo-actionprocessor-awslambda .../loadFederatedStory.ts\n//\n// Store layout (under s3://<bucket>/<service>/ once uploaded):\n//   manifest.json          <- THIS document, uploaded LAST (the atomic \"current\" pointer)\n//   <hash>/<...files>      <- the immutable module-federation container build for a version\n//\n// The loader reads manifest.json first, so publishing = upload the <hash>/ dir, then\n// overwrite manifest.json. A new `hash` is what tells a warm lambda a new version exists.\n// ─────────────────────────────────────────────────────────────────────────────\nexport type FederatedModuleStoreManifest = {\n  // MF container name (qpq_<service>). The build bakes it in as the container's library\n  // name; the loader stores the loaded container on globalThis under this key.\n  containerName: string;\n\n  // qpq service/module this remote was built from (informational / debugging).\n  service: string;\n\n  // Content hash of the published files == the <hash> version directory name. Changing\n  // it is the signal the loader uses to detect and hot-swap to a new version.\n  hash: string;\n\n  // Container entry file within the version directory (always 'remoteEntry.js').\n  entry: string;\n\n  // Every file in the version directory. The loader syncs exactly these (so it needs\n  // GetObject only, no ListBucket) to /tmp.\n  files: string[];\n\n  // The lookup table the loader uses: machine-independent runtime key\n  // (getFederatedKeyFromQpqFunctionRuntime) -> the container's expose path (no './'\n  // prefix). Built on the publish side by getFederatedRemoteInfoForQpqConfig.\n  exposes: Record<string, string>;\n};\n"]}

package/lib/commonjs/logic/federatedModuleStore/loadFederatedStory.d.ts

@@ -1,3 +1,3 @@
 import { QPQConfig, QpqFunctionRuntime } from 'quidproquo-core';
 export declare const resetFederatedModuleStoreCache: () => void;
-export declare const loadFederatedStory: <T = any>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime) => Promise<T | undefined>;
+export declare const loadFederatedStory: <T = unknown>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime) => Promise<T | undefined>;

package/lib/commonjs/logic/federatedModuleStore/loadFederatedStory.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadFederatedStory.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/loadFederatedStory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAA0D;AAC1D,gEAAkD;AAClD,qDAAqH;AACrH,0EAA4D;AAE5D,uCAAyB;AACzB,mCAAuC;AACvC,2CAA6B;AAC7B,6BAAoC;AACpC,kDAAgE;AAChE,iEAAwF;AAExF,wDAAqD;AACrD,yEAAoG;AAEpG,qDAAkE;AAkClE,kFAAkF;AAClF,uFAAuF;AACvF,uFAAuF;AACvF,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9E,CAAC,CAAC;AAEF,IAAI,aAAqC,CAAC;AAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAgD,CAAC;AACrD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,qEAAqE;AAC9D,MAAM,8BAA8B,GAAG,GAAS,EAAE;IACvD,aAAa,GAAG,SAAS,CAAC;IAC1B,YAAY,GAAG,CAAC,CAAC;IACjB,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEF,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,SAAoB,EAA+C,EAAE;IAC7G,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC7E,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO,CAAO,YAAoB,EAAmB,EAAE;;YACrD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,4BAAgB,CAAC;gBACnB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY;gBAC9D,mBAAmB,EAAE,mBAAmB;aACzC,CAAC,CACH,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,oBAAoB,EAAE,CAAA,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,2BAA2B,YAAY,GAAG,CAAC,CAAC;YACnI,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAA,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAExF,OAAO,CAAO,YAAoB,EAAmB,EAAE,kDAAC,OAAA,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA,GAAA,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,yCAAyC,QAAQ,GAAG,CAAC,CAAC;AAC7I,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IAEtD,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,QAAQ,CAAC;AACvF,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,WAAW,GAA4B;IAC3C,iBAAiB,EAAE,cAAc;IACjC,sBAAsB,EAAE,mBAAmB;CAC5C,CAAC;AAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,MAAM,CAAC,WAAW,CAChB,+CAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,IAAI;IACJ;QACE,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAc,EAAE;KAClE;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAA,cAAI,EAAC;QACH,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,oBAAoB,EAAE;KAC/B,CAAC,CAAC;IACH,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAO,OAAuC,EAAE,QAAsC,EAAmB,EAAE;;IAClI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,yBAAyB,CAAC;IACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACpD,+EAA+E;QAC/E,gFAAgF;QAChF,+DAA+D;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,kFAAkF;QAClF,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAA,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAA,sBAAa,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAA,MAAA,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAI,eAAe,CAAC,OAAO,mCAAI,eAAe,CAAC;IAExG,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,KAAK,UAAU,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,IAAI,CAAA,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,mBAAmB,EAChD,IAAI,QAAQ,CAAC,KAAK,0DAA0D,QAAQ,CAAC,aAAa,GAAG,CACtG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,2EAA2E;IAC1E,UAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IACxD,qBAAqB,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClE,IAAA,yBAAe,EAAC;QACd;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,QAAQ,CAAC,aAAa;SACxC;KACF,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,gFAAgF;AAChF,uFAAuF;AACvF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAO,SAAoB,EAAE,QAAgB,EAAE,OAA+B,EAAuB,EAAE;IACxH,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpD,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IACE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAA;QACxB,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA;QACf,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAA;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAC;QAC/B,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ;QACrC,QAAQ,CAAC,OAAO,KAAK,IAAI,EACzB,CAAC;QACD,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,eAAe,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;IAC7I,CAAC;IAED,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC,CAAA,CAAC;AAEF,wFAAwF;AACxF,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAgB,EAAuB,EAAE;IACnF,IAAI,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC;aAC7D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,aAAa,GAAG,KAAK,CAAC;YACtB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,4EAA4E;YAC5E,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,KAAK,CAAC,CAAC;YACnF,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,aAAa,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,mFAAmF;IACnF,eAAe;IACf,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1E,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,qFAAqF;AACrF,yEAAyE;AAClE,MAAM,kBAAkB,GAAG,CAAgB,SAAoB,EAAE,kBAAsC,EAA0B,EAAE;IACxI,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,uDAAqC,EAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,2CAA2C,YAAY,8BAA8B,CAAC,CAAC;YACpG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,oBAAU,EAAoB,GAAG,UAAU,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,8BAAY,CAAC,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,gBAAgB,EAC7C,UAAU,SAAS,4CAA4C,UAAU,GAAG,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAA,CAAC;AApCW,QAAA,kBAAkB,sBAoC7B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport * as quidproquoCore from 'quidproquo-core';\nimport { getFederatedKeyFromQpqFunctionRuntime, QPQConfig, qpqCoreUtils, QpqFunctionRuntime } from 'quidproquo-core';\nimport * as quidproquoWebserver from 'quidproquo-webserver';\n\nimport * as fs from 'fs';\nimport { createRequire } from 'module';\nimport * as path from 'path';\nimport { fileURLToPath } from 'url';\nimport { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { init, loadRemote, registerRemotes } from '@module-federation/enhanced/runtime';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { FederatedModuleLoadError, FederatedModuleLoadErrorCode } from './FederatedModuleLoadError';\nimport { FederatedModuleStoreManifest } from './FederatedModuleStoreManifest';\nimport { FEDERATED_SHARED_PACKAGE_NAMES } from './sharedPackages';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// loadFederatedStory — the RUNTIME half of module federation on lambda. Given a\n// QpqFunctionRuntime, it returns the published story function from the service's\n// code store, or undefined so dynamicModuleLoader falls back to the bundled copy.\n//\n// WHERE THE STORE COMES FROM\n//   process.env.federatedCodeStoreUrl = \"s3://<bucket>/<service>\" is set on every\n//   lambda by the CDK Function construct when the service declared\n//   defineFederatedModuleStore(...). The build/publish half (quidproquo-deploy-webpack)\n//   put the artifacts there. The two halves agree via FederatedModuleStoreManifest and\n//   the machine-independent key getFederatedKeyFromQpqFunctionRuntime (in core).\n//\n// FLOW (per lambda container)\n//   loadFederatedStory(runtime)\n//     └─ resolveStore()                 cache the store decision; re-probe on a TTL\n//         └─ probeStore()               read manifest.json; new hash? -> loadStoreVersion()\n//             └─ loadStoreVersion()     sync files to /tmp, require container, register w/ MF\n//     └─ manifest.exposes[key]          machine-independent runtime key -> expose path\n//     └─ loadRemote(container/expose)   MF hands back the module; return module[storyName]\n//\n// CACHING (state below): a resolved 'available' store is served instantly from memory;\n// the manifest is re-checked in the BACKGROUND every recheck interval so a warm\n// container picks up a newly published version without a redeploy. Every miss or error\n// returns undefined -> the caller uses the statically bundled module instead.\n// ─────────────────────────────────────────────────────────────────────────────\n\n// ── Module-level cache (per lambda execution environment / warm container) ───────\n// This state persists across invocations in the same container. resetFederatedModule-\n// StoreCache() clears it (tests only). 'available' carries the loaded manifest + the\n// MF remote name to loadRemote from; 'unavailable' means \"run the bundled fallback\".\ntype StoreState = { available: true; manifest: FederatedModuleStoreManifest; runtimeName: string } | { available: false };\n\n// How long a resolved state is served before the manifest is re-checked for a new\n// version. Overridable per service (defineFederatedModuleStore recheckMs -> this env).\n// Lower = faster pickup of new publishes at the cost of one small S3 GET per container\n// per interval. The re-check runs in the BACKGROUND so it never blocks a request.\nconst DEFAULT_RECHECK_MS = 60_000;\n\nconst getRecheckMs = (): number => {\n  const raw = process.env.federatedCodeStoreRecheckMs;\n  const parsed = raw ? parseInt(raw, 10) : NaN;\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RECHECK_MS;\n};\n\nlet resolvedState: StoreState | undefined;\nlet recheckAfter = 0;\nlet inflightResolve: Promise<StoreState> | undefined;\nlet hostInitialised = false;\n\n// Test seam - forces the next call to re-resolve the store from env.\nexport const resetFederatedModuleStoreCache = (): void => {\n  resolvedState = undefined;\n  recheckAfter = 0;\n  inflightResolve = undefined;\n};\n\n// ── Transport ────────────────────────────────────────────────────────────────\n// Returns a function that reads a path RELATIVE to the store (e.g. 'manifest.json'\n// or '<hash>/remoteEntry.js'). Two backends: s3:// for real deploys, file:// for\n// local/dev and tests. The store URL already includes the per-service prefix, so\n// callers pass only the in-service relative path.\nconst getFileFetcher = (storeUrl: string, qpqConfig: QPQConfig): ((relativePath: string) => Promise<Buffer>) => {\n  if (storeUrl.startsWith('s3://')) {\n    const url = new URL(storeUrl);\n    const bucketName = url.host;\n    const keyPrefix = url.pathname.replace(/^\\/|\\/$/g, '');\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n    // Pin the owner so a same-name bucket in another account can't be squatted to\n    // serve code we'd then require() with the service role's credentials.\n    const expectedBucketOwner = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(qpqConfig);\n    const s3Client = createAwsClient(S3Client, { region });\n\n    return async (relativePath: string): Promise<Buffer> => {\n      const response = await s3Client.send(\n        new GetObjectCommand({\n          Bucket: bucketName,\n          Key: keyPrefix ? `${keyPrefix}/${relativePath}` : relativePath,\n          ExpectedBucketOwner: expectedBucketOwner,\n        }),\n      );\n\n      const bytes = await response.Body?.transformToByteArray();\n      if (!bytes) {\n        throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.containerLoadFailed, `empty response reading [${relativePath}]`);\n      }\n\n      return Buffer.from(bytes);\n    };\n  }\n\n  if (storeUrl.startsWith('file://')) {\n    const baseDirectory = fileURLToPath(storeUrl.endsWith('/') ? storeUrl : `${storeUrl}/`);\n\n    return async (relativePath: string): Promise<Buffer> => fs.promises.readFile(path.join(baseDirectory, relativePath));\n  }\n\n  throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.unsupportedStoreUrl, `unsupported federated code store url [${storeUrl}]`);\n};\n\n// \"Nothing published yet\" is a legitimate not-found: the manifest key is absent\n// (NoSuchKey/NotFound) or the store bucket isn't created yet, which happens normally\n// when a lambda cold-starts between deploy phases (NoSuchBucket). We do NOT include\n// AccessDenied: a permission failure is a real misconfiguration and must surface (as a\n// warning, and be retried) rather than masquerade as 'not published'.\nconst isManifestNotFoundError = (error: unknown): boolean => {\n  const name = (error as { name?: string })?.name || '';\n  const code = (error as { code?: string })?.code || '';\n\n  return ['NoSuchKey', 'NotFound', 'NoSuchBucket'].includes(name) || code === 'ENOENT';\n};\n\n// ── Module-federation shared scope ───────────────────────────────────────────\n// The host provides the framework packages to the container's share scope so remote\n// story code resolves the SAME module instances as the bundled runtime. The package\n// list is shared with the remote build so the two can't drift (see sharedPackages).\nconst SHARED_LIBS: Record<string, unknown> = {\n  'quidproquo-core': quidproquoCore,\n  'quidproquo-webserver': quidproquoWebserver,\n};\n\nconst getHostSharedModules = () =>\n  Object.fromEntries(\n    FEDERATED_SHARED_PACKAGE_NAMES.map((name) => [\n      name,\n      {\n        version: '0.0.0',\n        lib: () => SHARED_LIBS[name],\n        shareConfig: { singleton: true, requiredVersion: false as const },\n      },\n    ]),\n  );\n\nconst ensureHostInitialised = (): void => {\n  if (hostInitialised) {\n    return;\n  }\n  init({\n    name: 'qpq_federated_host',\n    remotes: [],\n    shared: getHostSharedModules(),\n  });\n  hostInitialised = true;\n};\n\n// ── Version loading ──────────────────────────────────────────────────────────\n// Downloads a manifest's files (atomically) and registers the container with the MF\n// runtime under a HASH-UNIQUE remote name, so loadRemote can't serve a previous\n// version's module from its cache when the hash changes. Returns the runtime name.\n// This is the step that actually puts a new version's code into effect.\nconst loadStoreVersion = async (getFile: (p: string) => Promise<Buffer>, manifest: FederatedModuleStoreManifest): Promise<string> => {\n  const cacheRoot = process.env.federatedCodeStoreCacheDir || '/tmp/qpq-federated-code';\n  const versionDirectory = path.join(cacheRoot, manifest.containerName, manifest.hash);\n  await fs.promises.mkdir(versionDirectory, { recursive: true });\n\n  await Promise.all(\n    manifest.files.map(async (file) => {\n      const localPath = path.join(versionDirectory, file);\n      // Files are immutable under their hash dir AND only ever appear via the atomic\n      // rename below, so an existing file is always complete and valid - this is what\n      // lets a re-check of an unchanged version skip re-downloading.\n      if (fs.existsSync(localPath)) {\n        return;\n      }\n\n      const data = await getFile(`${manifest.hash}/${file}`);\n      await fs.promises.mkdir(path.dirname(localPath), { recursive: true });\n\n      // Write to a temp name then rename: rename is atomic on the same filesystem, so a\n      // crash/timeout mid-write never leaves a truncated file that a later invocation\n      // would trust via the existsSync check above. The random suffix keeps concurrent\n      // writers in the SAME process (overlapping probes) off each other's temp file.\n      const tempPath = `${localPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;\n      await fs.promises.writeFile(tempPath, data);\n      await fs.promises.rename(tempPath, localPath);\n    }),\n  );\n\n  const entryPath = path.join(versionDirectory, manifest.entry);\n  const containerRequire = createRequire(entryPath);\n  const containerModule = containerRequire(entryPath);\n  const container = containerModule[manifest.containerName] ?? containerModule.default ?? containerModule;\n\n  if (typeof container?.get !== 'function' || typeof container?.init !== 'function') {\n    throw new FederatedModuleLoadError(\n      FederatedModuleLoadErrorCode.containerLoadFailed,\n      `[${manifest.entry}] does not export a module federation container named [${manifest.containerName}]`,\n    );\n  }\n\n  // entryGlobalName is the container's real (build-time) library name; the registered\n  // remote name is hash-unique so each version is a distinct loadRemote key.\n  (globalThis as any)[manifest.containerName] = container;\n  ensureHostInitialised();\n\n  const runtimeName = `${manifest.containerName}__${manifest.hash}`;\n  registerRemotes([\n    {\n      name: runtimeName,\n      entry: entryPath,\n      type: 'global',\n      entryGlobalName: manifest.containerName,\n    },\n  ]);\n\n  return runtimeName;\n};\n\n// ── Probe & resolve (the caching state machine) ──────────────────────────────\n// Reads the manifest and decides the current state. If the hash is unchanged from what\n// we already loaded, keeps the existing container (no re-sync). Not-found -> unavailable.\nconst probeStore = async (qpqConfig: QPQConfig, storeUrl: string, current: StoreState | undefined): Promise<StoreState> => {\n  const getFile = getFileFetcher(storeUrl, qpqConfig);\n\n  let manifest: FederatedModuleStoreManifest;\n  try {\n    manifest = JSON.parse((await getFile('manifest.json')).toString('utf8'));\n  } catch (error) {\n    if (isManifestNotFoundError(error)) {\n      console.log(`federated code store [${storeUrl}] has no manifest - using bundled modules`);\n      return { available: false };\n    }\n    throw error;\n  }\n\n  if (\n    !manifest?.containerName ||\n    !manifest?.hash ||\n    !manifest?.entry ||\n    !Array.isArray(manifest?.files) ||\n    typeof manifest?.exposes !== 'object' ||\n    manifest.exposes === null\n  ) {\n    throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.manifestInvalid, `invalid manifest in federated code store [${storeUrl}]`);\n  }\n\n  if (current?.available && current.manifest.hash === manifest.hash) {\n    return current;\n  }\n\n  const runtimeName = await loadStoreVersion(getFile, manifest);\n  return { available: true, manifest, runtimeName };\n};\n\n// Resolves the store, re-checking the manifest after the recheck interval. The re-check\n// runs in the background: a stale-but-usable state is served immediately so a request\n// never blocks on S3; only the very first resolve (no state yet) awaits.\nconst resolveStore = (qpqConfig: QPQConfig, storeUrl: string): Promise<StoreState> => {\n  if (resolvedState && Date.now() < recheckAfter) {\n    return Promise.resolve(resolvedState);\n  }\n\n  if (!inflightResolve) {\n    inflightResolve = probeStore(qpqConfig, storeUrl, resolvedState)\n      .then((state) => {\n        resolvedState = state;\n        recheckAfter = Date.now() + getRecheckMs();\n        return state;\n      })\n      .catch((error) => {\n        // Back off and keep serving whatever we had (or unavailable). Surfaced as a\n        // warning so real errors (e.g. AccessDenied) are visible, not silent.\n        console.warn('federated code store check failed - keeping current modules', error);\n        recheckAfter = Date.now() + getRecheckMs();\n        resolvedState = resolvedState ?? { available: false };\n        return resolvedState;\n      })\n      .finally(() => {\n        inflightResolve = undefined;\n      });\n  }\n\n  // Serve the stale state instantly while the refresh happens; only block if we have\n  // nothing yet.\n  return resolvedState ? Promise.resolve(resolvedState) : inflightResolve;\n};\n\n// ── Public entry ─────────────────────────────────────────────────────────────\n// Called by dynamicModuleLoader for every story load. Returns the story function, or\n// undefined to signal \"use the bundled module\" (no store, nothing published, runtime\n// not exposed, or any error - availability always wins over federation).\nexport const loadFederatedStory = async <T = any>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime): Promise<T | undefined> => {\n  const storeUrl = process.env.federatedCodeStoreUrl;\n  if (!storeUrl) {\n    return undefined;\n  }\n\n  try {\n    const storeState = await resolveStore(qpqConfig, storeUrl);\n    if (!storeState.available) {\n      return undefined;\n    }\n\n    const federatedKey = getFederatedKeyFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const exposePath = storeState.manifest.exposes[federatedKey];\n    if (!exposePath) {\n      console.warn(`federated code store has no module for [${federatedKey}] - using the bundled module`);\n      return undefined;\n    }\n\n    const remoteModule = await loadRemote<Record<string, T>>(`${storeState.runtimeName}/${exposePath}`);\n\n    const storyName = qpqCoreUtils.getStoryNameFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const story = remoteModule?.[storyName];\n    if (!story) {\n      throw new FederatedModuleLoadError(\n        FederatedModuleLoadErrorCode.storyNotExported,\n        `story [${storyName}] is not exported from federated module [${exposePath}]`,\n      );\n    }\n\n    return story;\n  } catch (error) {\n    // Availability first: a broken store must never take the service down\n    console.warn('federated module load failed - using the bundled module', error);\n    return undefined;\n  }\n};\n"]}
+{"version":3,"file":"loadFederatedStory.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/loadFederatedStory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAA0D;AAC1D,gEAAkD;AAClD,qDAAqH;AACrH,0EAA4D;AAE5D,uCAAyB;AACzB,mCAAuC;AACvC,2CAA6B;AAC7B,6BAAoC;AACpC,kDAAgE;AAChE,iEAAwF;AAExF,wDAAqD;AACrD,yEAAoG;AAEpG,qDAAkE;AAkClE,kFAAkF;AAClF,uFAAuF;AACvF,uFAAuF;AACvF,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9E,CAAC,CAAC;AAEF,IAAI,aAAqC,CAAC;AAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAgD,CAAC;AACrD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,qEAAqE;AAC9D,MAAM,8BAA8B,GAAG,GAAS,EAAE;IACvD,aAAa,GAAG,SAAS,CAAC;IAC1B,YAAY,GAAG,CAAC,CAAC;IACjB,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEF,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,SAAoB,EAA+C,EAAE;IAC7G,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC7E,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO,CAAO,YAAoB,EAAmB,EAAE;;YACrD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,4BAAgB,CAAC;gBACnB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY;gBAC9D,mBAAmB,EAAE,mBAAmB;aACzC,CAAC,CACH,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,oBAAoB,EAAE,CAAA,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,2BAA2B,YAAY,GAAG,CAAC,CAAC;YACnI,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAA,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAExF,OAAO,CAAO,YAAoB,EAAmB,EAAE,kDAAC,OAAA,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA,GAAA,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,yCAAyC,QAAQ,GAAG,CAAC,CAAC;AAC7I,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IAEtD,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,QAAQ,CAAC;AACvF,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,WAAW,GAA4B;IAC3C,iBAAiB,EAAE,cAAc;IACjC,sBAAsB,EAAE,mBAAmB;CAC5C,CAAC;AAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,MAAM,CAAC,WAAW,CAChB,+CAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,IAAI;IACJ;QACE,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAc,EAAE;KAClE;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAA,cAAI,EAAC;QACH,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,oBAAoB,EAAE;KAC/B,CAAC,CAAC;IACH,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAO,OAAuC,EAAE,QAAsC,EAAmB,EAAE;;IAClI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,yBAAyB,CAAC;IACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACpD,+EAA+E;QAC/E,gFAAgF;QAChF,+DAA+D;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,kFAAkF;QAClF,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAA,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAA,sBAAa,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAA,MAAA,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAI,eAAe,CAAC,OAAO,mCAAI,eAAe,CAAC;IAExG,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,KAAK,UAAU,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,IAAI,CAAA,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,mBAAmB,EAChD,IAAI,QAAQ,CAAC,KAAK,0DAA0D,QAAQ,CAAC,aAAa,GAAG,CACtG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,2EAA2E;IAC1E,UAAsC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IAC5E,qBAAqB,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClE,IAAA,yBAAe,EAAC;QACd;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,QAAQ,CAAC,aAAa;SACxC;KACF,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,gFAAgF;AAChF,uFAAuF;AACvF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAO,SAAoB,EAAE,QAAgB,EAAE,OAA+B,EAAuB,EAAE;IACxH,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpD,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IACE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAA;QACxB,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA;QACf,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAA;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAC;QAC/B,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ;QACrC,QAAQ,CAAC,OAAO,KAAK,IAAI,EACzB,CAAC;QACD,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,eAAe,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;IAC7I,CAAC;IAED,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC,CAAA,CAAC;AAEF,wFAAwF;AACxF,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAgB,EAAuB,EAAE;IACnF,IAAI,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC;aAC7D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,aAAa,GAAG,KAAK,CAAC;YACtB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,4EAA4E;YAC5E,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,KAAK,CAAC,CAAC;YACnF,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,aAAa,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,mFAAmF;IACnF,eAAe;IACf,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1E,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,qFAAqF;AACrF,yEAAyE;AAClE,MAAM,kBAAkB,GAAG,CAAoB,SAAoB,EAAE,kBAAsC,EAA0B,EAAE;IAC5I,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,uDAAqC,EAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,2CAA2C,YAAY,8BAA8B,CAAC,CAAC;YACpG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,oBAAU,EAAoB,GAAG,UAAU,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,8BAAY,CAAC,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,gBAAgB,EAC7C,UAAU,SAAS,4CAA4C,UAAU,GAAG,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAA,CAAC;AApCW,QAAA,kBAAkB,sBAoC7B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport * as quidproquoCore from 'quidproquo-core';\nimport { getFederatedKeyFromQpqFunctionRuntime, QPQConfig, qpqCoreUtils, QpqFunctionRuntime } from 'quidproquo-core';\nimport * as quidproquoWebserver from 'quidproquo-webserver';\n\nimport * as fs from 'fs';\nimport { createRequire } from 'module';\nimport * as path from 'path';\nimport { fileURLToPath } from 'url';\nimport { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { init, loadRemote, registerRemotes } from '@module-federation/enhanced/runtime';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { FederatedModuleLoadError, FederatedModuleLoadErrorCode } from './FederatedModuleLoadError';\nimport { FederatedModuleStoreManifest } from './FederatedModuleStoreManifest';\nimport { FEDERATED_SHARED_PACKAGE_NAMES } from './sharedPackages';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// loadFederatedStory: the RUNTIME half of module federation on lambda. Given a\n// QpqFunctionRuntime, it returns the published story function from the service's\n// code store, or undefined so dynamicModuleLoader falls back to the bundled copy.\n//\n// WHERE THE STORE COMES FROM\n//   process.env.federatedCodeStoreUrl = \"s3://<bucket>/<service>\" is set on every\n//   lambda by the CDK Function construct when the service declared\n//   defineFederatedModuleStore(...). The build/publish half (quidproquo-deploy-webpack)\n//   put the artifacts there. The two halves agree via FederatedModuleStoreManifest and\n//   the machine-independent key getFederatedKeyFromQpqFunctionRuntime (in core).\n//\n// FLOW (per lambda container)\n//   loadFederatedStory(runtime)\n//     └─ resolveStore()                 cache the store decision; re-probe on a TTL\n//         └─ probeStore()               read manifest.json; new hash? -> loadStoreVersion()\n//             └─ loadStoreVersion()     sync files to /tmp, require container, register w/ MF\n//     └─ manifest.exposes[key]          machine-independent runtime key -> expose path\n//     └─ loadRemote(container/expose)   MF hands back the module; return module[storyName]\n//\n// CACHING (state below): a resolved 'available' store is served instantly from memory;\n// the manifest is re-checked in the BACKGROUND every recheck interval so a warm\n// container picks up a newly published version without a redeploy. Every miss or error\n// returns undefined -> the caller uses the statically bundled module instead.\n// ─────────────────────────────────────────────────────────────────────────────\n\n// ── Module-level cache (per lambda execution environment / warm container) ───────\n// This state persists across invocations in the same container. resetFederatedModule-\n// StoreCache() clears it (tests only). 'available' carries the loaded manifest + the\n// MF remote name to loadRemote from; 'unavailable' means \"run the bundled fallback\".\ntype StoreState = { available: true; manifest: FederatedModuleStoreManifest; runtimeName: string } | { available: false };\n\n// How long a resolved state is served before the manifest is re-checked for a new\n// version. Overridable per service (defineFederatedModuleStore recheckMs -> this env).\n// Lower = faster pickup of new publishes at the cost of one small S3 GET per container\n// per interval. The re-check runs in the BACKGROUND so it never blocks a request.\nconst DEFAULT_RECHECK_MS = 60_000;\n\nconst getRecheckMs = (): number => {\n  const raw = process.env.federatedCodeStoreRecheckMs;\n  const parsed = raw ? parseInt(raw, 10) : NaN;\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RECHECK_MS;\n};\n\nlet resolvedState: StoreState | undefined;\nlet recheckAfter = 0;\nlet inflightResolve: Promise<StoreState> | undefined;\nlet hostInitialised = false;\n\n// Test seam - forces the next call to re-resolve the store from env.\nexport const resetFederatedModuleStoreCache = (): void => {\n  resolvedState = undefined;\n  recheckAfter = 0;\n  inflightResolve = undefined;\n};\n\n// ── Transport ────────────────────────────────────────────────────────────────\n// Returns a function that reads a path RELATIVE to the store (e.g. 'manifest.json'\n// or '<hash>/remoteEntry.js'). Two backends: s3:// for real deploys, file:// for\n// local/dev and tests. The store URL already includes the per-service prefix, so\n// callers pass only the in-service relative path.\nconst getFileFetcher = (storeUrl: string, qpqConfig: QPQConfig): ((relativePath: string) => Promise<Buffer>) => {\n  if (storeUrl.startsWith('s3://')) {\n    const url = new URL(storeUrl);\n    const bucketName = url.host;\n    const keyPrefix = url.pathname.replace(/^\\/|\\/$/g, '');\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n    // Pin the owner so a same-name bucket in another account can't be squatted to\n    // serve code we'd then require() with the service role's credentials.\n    const expectedBucketOwner = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(qpqConfig);\n    const s3Client = createAwsClient(S3Client, { region });\n\n    return async (relativePath: string): Promise<Buffer> => {\n      const response = await s3Client.send(\n        new GetObjectCommand({\n          Bucket: bucketName,\n          Key: keyPrefix ? `${keyPrefix}/${relativePath}` : relativePath,\n          ExpectedBucketOwner: expectedBucketOwner,\n        }),\n      );\n\n      const bytes = await response.Body?.transformToByteArray();\n      if (!bytes) {\n        throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.containerLoadFailed, `empty response reading [${relativePath}]`);\n      }\n\n      return Buffer.from(bytes);\n    };\n  }\n\n  if (storeUrl.startsWith('file://')) {\n    const baseDirectory = fileURLToPath(storeUrl.endsWith('/') ? storeUrl : `${storeUrl}/`);\n\n    return async (relativePath: string): Promise<Buffer> => fs.promises.readFile(path.join(baseDirectory, relativePath));\n  }\n\n  throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.unsupportedStoreUrl, `unsupported federated code store url [${storeUrl}]`);\n};\n\n// \"Nothing published yet\" is a legitimate not-found: the manifest key is absent\n// (NoSuchKey/NotFound) or the store bucket isn't created yet, which happens normally\n// when a lambda cold-starts between deploy phases (NoSuchBucket). We do NOT include\n// AccessDenied: a permission failure is a real misconfiguration and must surface (as a\n// warning, and be retried) rather than masquerade as 'not published'.\nconst isManifestNotFoundError = (error: unknown): boolean => {\n  const name = (error as { name?: string })?.name || '';\n  const code = (error as { code?: string })?.code || '';\n\n  return ['NoSuchKey', 'NotFound', 'NoSuchBucket'].includes(name) || code === 'ENOENT';\n};\n\n// ── Module-federation shared scope ───────────────────────────────────────────\n// The host provides the framework packages to the container's share scope so remote\n// story code resolves the SAME module instances as the bundled runtime. The package\n// list is shared with the remote build so the two can't drift (see sharedPackages).\nconst SHARED_LIBS: Record<string, unknown> = {\n  'quidproquo-core': quidproquoCore,\n  'quidproquo-webserver': quidproquoWebserver,\n};\n\nconst getHostSharedModules = () =>\n  Object.fromEntries(\n    FEDERATED_SHARED_PACKAGE_NAMES.map((name) => [\n      name,\n      {\n        version: '0.0.0',\n        lib: () => SHARED_LIBS[name],\n        shareConfig: { singleton: true, requiredVersion: false as const },\n      },\n    ]),\n  );\n\nconst ensureHostInitialised = (): void => {\n  if (hostInitialised) {\n    return;\n  }\n  init({\n    name: 'qpq_federated_host',\n    remotes: [],\n    shared: getHostSharedModules(),\n  });\n  hostInitialised = true;\n};\n\n// ── Version loading ──────────────────────────────────────────────────────────\n// Downloads a manifest's files (atomically) and registers the container with the MF\n// runtime under a HASH-UNIQUE remote name, so loadRemote can't serve a previous\n// version's module from its cache when the hash changes. Returns the runtime name.\n// This is the step that actually puts a new version's code into effect.\nconst loadStoreVersion = async (getFile: (p: string) => Promise<Buffer>, manifest: FederatedModuleStoreManifest): Promise<string> => {\n  const cacheRoot = process.env.federatedCodeStoreCacheDir || '/tmp/qpq-federated-code';\n  const versionDirectory = path.join(cacheRoot, manifest.containerName, manifest.hash);\n  await fs.promises.mkdir(versionDirectory, { recursive: true });\n\n  await Promise.all(\n    manifest.files.map(async (file) => {\n      const localPath = path.join(versionDirectory, file);\n      // Files are immutable under their hash dir AND only ever appear via the atomic\n      // rename below, so an existing file is always complete and valid - this is what\n      // lets a re-check of an unchanged version skip re-downloading.\n      if (fs.existsSync(localPath)) {\n        return;\n      }\n\n      const data = await getFile(`${manifest.hash}/${file}`);\n      await fs.promises.mkdir(path.dirname(localPath), { recursive: true });\n\n      // Write to a temp name then rename: rename is atomic on the same filesystem, so a\n      // crash/timeout mid-write never leaves a truncated file that a later invocation\n      // would trust via the existsSync check above. The random suffix keeps concurrent\n      // writers in the SAME process (overlapping probes) off each other's temp file.\n      const tempPath = `${localPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;\n      await fs.promises.writeFile(tempPath, data);\n      await fs.promises.rename(tempPath, localPath);\n    }),\n  );\n\n  const entryPath = path.join(versionDirectory, manifest.entry);\n  const containerRequire = createRequire(entryPath);\n  const containerModule = containerRequire(entryPath);\n  const container = containerModule[manifest.containerName] ?? containerModule.default ?? containerModule;\n\n  if (typeof container?.get !== 'function' || typeof container?.init !== 'function') {\n    throw new FederatedModuleLoadError(\n      FederatedModuleLoadErrorCode.containerLoadFailed,\n      `[${manifest.entry}] does not export a module federation container named [${manifest.containerName}]`,\n    );\n  }\n\n  // entryGlobalName is the container's real (build-time) library name; the registered\n  // remote name is hash-unique so each version is a distinct loadRemote key.\n  (globalThis as Record<string, unknown>)[manifest.containerName] = container;\n  ensureHostInitialised();\n\n  const runtimeName = `${manifest.containerName}__${manifest.hash}`;\n  registerRemotes([\n    {\n      name: runtimeName,\n      entry: entryPath,\n      type: 'global',\n      entryGlobalName: manifest.containerName,\n    },\n  ]);\n\n  return runtimeName;\n};\n\n// ── Probe & resolve (the caching state machine) ──────────────────────────────\n// Reads the manifest and decides the current state. If the hash is unchanged from what\n// we already loaded, keeps the existing container (no re-sync). Not-found -> unavailable.\nconst probeStore = async (qpqConfig: QPQConfig, storeUrl: string, current: StoreState | undefined): Promise<StoreState> => {\n  const getFile = getFileFetcher(storeUrl, qpqConfig);\n\n  let manifest: FederatedModuleStoreManifest;\n  try {\n    manifest = JSON.parse((await getFile('manifest.json')).toString('utf8'));\n  } catch (error) {\n    if (isManifestNotFoundError(error)) {\n      console.log(`federated code store [${storeUrl}] has no manifest - using bundled modules`);\n      return { available: false };\n    }\n    throw error;\n  }\n\n  if (\n    !manifest?.containerName ||\n    !manifest?.hash ||\n    !manifest?.entry ||\n    !Array.isArray(manifest?.files) ||\n    typeof manifest?.exposes !== 'object' ||\n    manifest.exposes === null\n  ) {\n    throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.manifestInvalid, `invalid manifest in federated code store [${storeUrl}]`);\n  }\n\n  if (current?.available && current.manifest.hash === manifest.hash) {\n    return current;\n  }\n\n  const runtimeName = await loadStoreVersion(getFile, manifest);\n  return { available: true, manifest, runtimeName };\n};\n\n// Resolves the store, re-checking the manifest after the recheck interval. The re-check\n// runs in the background: a stale-but-usable state is served immediately so a request\n// never blocks on S3; only the very first resolve (no state yet) awaits.\nconst resolveStore = (qpqConfig: QPQConfig, storeUrl: string): Promise<StoreState> => {\n  if (resolvedState && Date.now() < recheckAfter) {\n    return Promise.resolve(resolvedState);\n  }\n\n  if (!inflightResolve) {\n    inflightResolve = probeStore(qpqConfig, storeUrl, resolvedState)\n      .then((state) => {\n        resolvedState = state;\n        recheckAfter = Date.now() + getRecheckMs();\n        return state;\n      })\n      .catch((error) => {\n        // Back off and keep serving whatever we had (or unavailable). Surfaced as a\n        // warning so real errors (e.g. AccessDenied) are visible, not silent.\n        console.warn('federated code store check failed - keeping current modules', error);\n        recheckAfter = Date.now() + getRecheckMs();\n        resolvedState = resolvedState ?? { available: false };\n        return resolvedState;\n      })\n      .finally(() => {\n        inflightResolve = undefined;\n      });\n  }\n\n  // Serve the stale state instantly while the refresh happens; only block if we have\n  // nothing yet.\n  return resolvedState ? Promise.resolve(resolvedState) : inflightResolve;\n};\n\n// ── Public entry ─────────────────────────────────────────────────────────────\n// Called by dynamicModuleLoader for every story load. Returns the story function, or\n// undefined to signal \"use the bundled module\" (no store, nothing published, runtime\n// not exposed, or any error - availability always wins over federation).\nexport const loadFederatedStory = async <T = unknown>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime): Promise<T | undefined> => {\n  const storeUrl = process.env.federatedCodeStoreUrl;\n  if (!storeUrl) {\n    return undefined;\n  }\n\n  try {\n    const storeState = await resolveStore(qpqConfig, storeUrl);\n    if (!storeState.available) {\n      return undefined;\n    }\n\n    const federatedKey = getFederatedKeyFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const exposePath = storeState.manifest.exposes[federatedKey];\n    if (!exposePath) {\n      console.warn(`federated code store has no module for [${federatedKey}] - using the bundled module`);\n      return undefined;\n    }\n\n    const remoteModule = await loadRemote<Record<string, T>>(`${storeState.runtimeName}/${exposePath}`);\n\n    const storyName = qpqCoreUtils.getStoryNameFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const story = remoteModule?.[storyName];\n    if (!story) {\n      throw new FederatedModuleLoadError(\n        FederatedModuleLoadErrorCode.storyNotExported,\n        `story [${storyName}] is not exported from federated module [${exposePath}]`,\n      );\n    }\n\n    return story;\n  } catch (error) {\n    // Availability first: a broken store must never take the service down\n    console.warn('federated module load failed - using the bundled module', error);\n    return undefined;\n  }\n};\n"]}

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.js

@@ -6,7 +6,7 @@ exports.FEDERATED_SHARED_PACKAGE_NAMES = void 0;
 // (instanceof checks and module-level state stay coherent). Single source of truth
 // for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the
 // remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and
-// quidproquo-deploy-rspack getRspackConfigForQpqRemote) — the lists must never
+// quidproquo-deploy-rspack getRspackConfigForQpqRemote). The lists must never
 // drift, or the remote would silently bundle its own copy.
 exports.FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'];
 //# sourceMappingURL=sharedPackages.js.map

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharedPackages.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/sharedPackages.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,2DAA2D;AAC9C,QAAA,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC","sourcesContent":["// The framework packages the lambda host provides to the module-federation share\n// scope, so a federated remote resolves the SAME module instances as the host\n// (instanceof checks and module-level state stay coherent). Single source of truth\n// for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the\n// remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and\n// quidproquo-deploy-rspack getRspackConfigForQpqRemote) — the lists must never\n// drift, or the remote would silently bundle its own copy.\nexport const FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'] as const;\n"]}
+{"version":3,"file":"sharedPackages.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/sharedPackages.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC9C,QAAA,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC","sourcesContent":["// The framework packages the lambda host provides to the module-federation share\n// scope, so a federated remote resolves the SAME module instances as the host\n// (instanceof checks and module-level state stay coherent). Single source of truth\n// for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the\n// remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and\n// quidproquo-deploy-rspack getRspackConfigForQpqRemote). The lists must never\n// drift, or the remote would silently bundle its own copy.\nexport const FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'] as const;\n"]}

package/lib/commonjs/logic/kms/decryptDataKey.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const decryptDataKey: (wrappedKey: Buffer, context: CryptoContext, region: string) => Promise<Buffer>;

package/lib/commonjs/logic/kms/decryptDataKey.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptDataKey = void 0;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+const toKmsEncryptionContext_1 = require("./toKmsEncryptionContext");
+// The wrapped key embeds the CMK id, so no KeyId is needed; the
+// EncryptionContext must match the one used at GenerateDataKey time (this is
+// also what puts the per-context decrypt entry in CloudTrail).
+const decryptDataKey = (wrappedKey, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.DecryptCommand({
+        CiphertextBlob: wrappedKey,
+        EncryptionContext: (0, toKmsEncryptionContext_1.toKmsEncryptionContext)(context),
+    }));
+    if (!response.Plaintext) {
+        throw new Error('KMS returned no plaintext for the wrapped data key');
+    }
+    return Buffer.from(response.Plaintext);
+});
+exports.decryptDataKey = decryptDataKey;
+//# sourceMappingURL=decryptDataKey.js.map

package/lib/commonjs/logic/kms/decryptDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/decryptDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oDAAgE;AAEhE,wDAAqD;AACrD,qEAAkE;AAElE,gEAAgE;AAChE,6EAA6E;AAC7E,+DAA+D;AACxD,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,OAAsB,EAAE,MAAc,EAAmB,EAAE;IAClH,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,2BAAc,CAAC;QACjB,cAAc,EAAE,UAAU;QAC1B,iBAAiB,EAAE,IAAA,+CAAsB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAA,CAAC;AAjBW,QAAA,cAAc,kBAiBzB","sourcesContent":["import { CryptoContext } from 'quidproquo-core';\n\nimport { DecryptCommand, KMSClient } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { toKmsEncryptionContext } from './toKmsEncryptionContext';\n\n// The wrapped key embeds the CMK id, so no KeyId is needed; the\n// EncryptionContext must match the one used at GenerateDataKey time (this is\n// also what puts the per-context decrypt entry in CloudTrail).\nexport const decryptDataKey = async (wrappedKey: Buffer, context: CryptoContext, region: string): Promise<Buffer> => {\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new DecryptCommand({\n      CiphertextBlob: wrappedKey,\n      EncryptionContext: toKmsEncryptionContext(context),\n    }),\n  );\n\n  if (!response.Plaintext) {\n    throw new Error('KMS returned no plaintext for the wrapped data key');\n  }\n\n  return Buffer.from(response.Plaintext);\n};\n"]}

package/lib/commonjs/logic/kms/generateDataKey.d.ts

@@ -0,0 +1,3 @@
+import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';
+import { CryptoContext } from 'quidproquo-core';
+export declare const generateDataKey: (keyAlias: string, context: CryptoContext, region: string) => Promise<GeneratedDataKey>;

package/lib/commonjs/logic/kms/generateDataKey.js

@@ -0,0 +1,34 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateDataKey = void 0;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+const toKmsEncryptionContext_1 = require("./toKmsEncryptionContext");
+const generateDataKey = (keyAlias, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.GenerateDataKeyCommand({
+        KeyId: keyAlias,
+        KeySpec: 'AES_256',
+        EncryptionContext: (0, toKmsEncryptionContext_1.toKmsEncryptionContext)(context),
+    }));
+    if (!response.Plaintext || !response.CiphertextBlob) {
+        throw new Error(`KMS returned an incomplete data key for [${keyAlias}]`);
+    }
+    return {
+        plaintextKey: Buffer.from(response.Plaintext),
+        wrappedKey: Buffer.from(response.CiphertextBlob),
+    };
+});
+exports.generateDataKey = generateDataKey;
+//# sourceMappingURL=generateDataKey.js.map

package/lib/commonjs/logic/kms/generateDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/generateDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oDAAwE;AAExE,wDAAqD;AACrD,qEAAkE;AAE3D,MAAM,eAAe,GAAG,CAAO,QAAgB,EAAE,OAAsB,EAAE,MAAc,EAA6B,EAAE;IAC3H,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,mCAAsB,CAAC;QACzB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,SAAS;QAClB,iBAAiB,EAAE,IAAA,+CAAsB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;KACjD,CAAC;AACJ,CAAC,CAAA,CAAC;AArBW,QAAA,eAAe,mBAqB1B","sourcesContent":["import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { GenerateDataKeyCommand, KMSClient } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { toKmsEncryptionContext } from './toKmsEncryptionContext';\n\nexport const generateDataKey = async (keyAlias: string, context: CryptoContext, region: string): Promise<GeneratedDataKey> => {\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new GenerateDataKeyCommand({\n      KeyId: keyAlias,\n      KeySpec: 'AES_256',\n      EncryptionContext: toKmsEncryptionContext(context),\n    }),\n  );\n\n  if (!response.Plaintext || !response.CiphertextBlob) {\n    throw new Error(`KMS returned an incomplete data key for [${keyAlias}]`);\n  }\n\n  return {\n    plaintextKey: Buffer.from(response.Plaintext),\n    wrappedKey: Buffer.from(response.CiphertextBlob),\n  };\n};\n"]}

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.d.ts

@@ -0,0 +1,3 @@
+import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';
+import { CryptoContext } from 'quidproquo-core';
+export declare const getCachedGeneratedDataKey: (keyAlias: string, context: CryptoContext, region: string) => Promise<GeneratedDataKey>;

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedGeneratedDataKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const generateDataKey_1 = require("./generateDataKey");
+// A data key is reused across encrypts for the same key + context so most
+// askCryptoEncrypt calls never touch KMS. Bounded by age and use count; each
+// encrypt still gets a fresh random IV, so reuse within these limits is safe.
+const DATA_KEY_MAX_AGE_MS = 5 * 60 * 1000;
+const DATA_KEY_MAX_USES = 500;
+const cache = new Map();
+const getCachedGeneratedDataKey = (keyAlias, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cacheKey = `${region}|${keyAlias}|${(0, quidproquo_actionprocessor_node_1.canonicalizeCryptoContext)(context)}`;
+    const cached = cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now() && cached.remainingUses > 0) {
+        cached.remainingUses -= 1;
+        return cached.dataKey;
+    }
+    const dataKey = yield (0, generateDataKey_1.generateDataKey)(keyAlias, context, region);
+    cache.set(cacheKey, {
+        dataKey,
+        expiresAt: Date.now() + DATA_KEY_MAX_AGE_MS,
+        remainingUses: DATA_KEY_MAX_USES - 1,
+    });
+    return dataKey;
+});
+exports.getCachedGeneratedDataKey = getCachedGeneratedDataKey;
+//# sourceMappingURL=getCachedGeneratedDataKey.js.map

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCachedGeneratedDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/getCachedGeneratedDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA8F;AAG9F,uDAAoD;AAEpD,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAQ9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEjD,MAAM,yBAAyB,GAAG,CAAO,QAAgB,EAAE,OAAsB,EAAE,MAAc,EAA6B,EAAE;IACrI,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAA,2DAAyB,EAAC,OAAO,CAAC,EAAE,CAAC;IAE/E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAe,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;QAClB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;QAC3C,aAAa,EAAE,iBAAiB,GAAG,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAA,CAAC;AAlBW,QAAA,yBAAyB,6BAkBpC","sourcesContent":["import { canonicalizeCryptoContext, GeneratedDataKey } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { generateDataKey } from './generateDataKey';\n\n// A data key is reused across encrypts for the same key + context so most\n// askCryptoEncrypt calls never touch KMS. Bounded by age and use count; each\n// encrypt still gets a fresh random IV, so reuse within these limits is safe.\nconst DATA_KEY_MAX_AGE_MS = 5 * 60 * 1000;\nconst DATA_KEY_MAX_USES = 500;\n\ntype CachedGeneratedDataKey = {\n  dataKey: GeneratedDataKey;\n  expiresAt: number;\n  remainingUses: number;\n};\n\nconst cache = new Map<string, CachedGeneratedDataKey>();\n\nexport const getCachedGeneratedDataKey = async (keyAlias: string, context: CryptoContext, region: string): Promise<GeneratedDataKey> => {\n  const cacheKey = `${region}|${keyAlias}|${canonicalizeCryptoContext(context)}`;\n\n  const cached = cache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now() && cached.remainingUses > 0) {\n    cached.remainingUses -= 1;\n    return cached.dataKey;\n  }\n\n  const dataKey = await generateDataKey(keyAlias, context, region);\n\n  cache.set(cacheKey, {\n    dataKey,\n    expiresAt: Date.now() + DATA_KEY_MAX_AGE_MS,\n    remainingUses: DATA_KEY_MAX_USES - 1,\n  });\n\n  return dataKey;\n};\n"]}

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const getCachedUnwrappedDataKey: (wrappedKey: Buffer, context: CryptoContext, region: string) => Promise<Buffer>;

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedUnwrappedDataKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const decryptDataKey_1 = require("./decryptDataKey");
+const UNWRAPPED_KEY_MAX_AGE_MS = 5 * 60 * 1000;
+const UNWRAPPED_KEY_MAX_ENTRIES = 1000;
+const cache = new Map();
+const getCachedUnwrappedDataKey = (wrappedKey, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cacheKey = `${region}|${(0, quidproquo_actionprocessor_node_1.canonicalizeCryptoContext)(context)}|${wrappedKey.toString('base64')}`;
+    const cached = cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.plaintextKey;
+    }
+    const plaintextKey = yield (0, decryptDataKey_1.decryptDataKey)(wrappedKey, context, region);
+    // Crude eviction so a long-lived runtime decrypting many distinct blobs
+    // can't grow the cache without bound
+    if (cache.size >= UNWRAPPED_KEY_MAX_ENTRIES) {
+        cache.clear();
+    }
+    cache.set(cacheKey, {
+        plaintextKey,
+        expiresAt: Date.now() + UNWRAPPED_KEY_MAX_AGE_MS,
+    });
+    return plaintextKey;
+});
+exports.getCachedUnwrappedDataKey = getCachedUnwrappedDataKey;
+//# sourceMappingURL=getCachedUnwrappedDataKey.js.map

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCachedUnwrappedDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/getCachedUnwrappedDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA4E;AAG5E,qDAAkD;AAElD,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAOvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEjD,MAAM,yBAAyB,GAAG,CAAO,UAAkB,EAAE,OAAsB,EAAE,MAAc,EAAmB,EAAE;IAC7H,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAA,2DAAyB,EAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEpG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,KAAK,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAC5C,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;QAClB,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB;KACjD,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAtBW,QAAA,yBAAyB,6BAsBpC","sourcesContent":["import { canonicalizeCryptoContext } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { decryptDataKey } from './decryptDataKey';\n\nconst UNWRAPPED_KEY_MAX_AGE_MS = 5 * 60 * 1000;\nconst UNWRAPPED_KEY_MAX_ENTRIES = 1000;\n\ntype CachedUnwrappedDataKey = {\n  plaintextKey: Buffer;\n  expiresAt: number;\n};\n\nconst cache = new Map<string, CachedUnwrappedDataKey>();\n\nexport const getCachedUnwrappedDataKey = async (wrappedKey: Buffer, context: CryptoContext, region: string): Promise<Buffer> => {\n  const cacheKey = `${region}|${canonicalizeCryptoContext(context)}|${wrappedKey.toString('base64')}`;\n\n  const cached = cache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.plaintextKey;\n  }\n\n  const plaintextKey = await decryptDataKey(wrappedKey, context, region);\n\n  // Crude eviction so a long-lived runtime decrypting many distinct blobs\n  // can't grow the cache without bound\n  if (cache.size >= UNWRAPPED_KEY_MAX_ENTRIES) {\n    cache.clear();\n  }\n\n  cache.set(cacheKey, {\n    plaintextKey,\n    expiresAt: Date.now() + UNWRAPPED_KEY_MAX_AGE_MS,\n  });\n\n  return plaintextKey;\n};\n"]}

package/lib/commonjs/logic/kms/toKmsEncryptionContext.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const toKmsEncryptionContext: (context: CryptoContext) => Record<string, string> | undefined;

package/lib/commonjs/logic/kms/toKmsEncryptionContext.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toKmsEncryptionContext = void 0;
+// KMS treats a missing EncryptionContext and an empty one as equivalent, but
+// we normalise to undefined so requests are byte-identical either way.
+const toKmsEncryptionContext = (context) => {
+    return Object.keys(context).length > 0 ? context : undefined;
+};
+exports.toKmsEncryptionContext = toKmsEncryptionContext;
+//# sourceMappingURL=toKmsEncryptionContext.js.map

package/lib/commonjs/logic/kms/toKmsEncryptionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toKmsEncryptionContext.js","sourceRoot":"","sources":["../../../../src/logic/kms/toKmsEncryptionContext.ts"],"names":[],"mappings":";;;AAEA,6EAA6E;AAC7E,uEAAuE;AAChE,MAAM,sBAAsB,GAAG,CAAC,OAAsB,EAAsC,EAAE;IACnG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC,CAAC;AAFW,QAAA,sBAAsB,0BAEjC","sourcesContent":["import { CryptoContext } from 'quidproquo-core';\n\n// KMS treats a missing EncryptionContext and an empty one as equivalent, but\n// we normalise to undefined so requests are byte-identical either way.\nexport const toKmsEncryptionContext = (context: CryptoContext): Record<string, string> | undefined => {\n  return Object.keys(context).length > 0 ? context : undefined;\n};\n"]}