quidproquo-actionprocessor-awslambda 0.1.11 → 0.1.12

package/lib/commonjs/logic/federatedModuleStore/loadFederatedStory.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadFederatedStory.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/loadFederatedStory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAA0D;AAC1D,gEAAkD;AAClD,qDAAqH;AACrH,0EAA4D;AAE5D,uCAAyB;AACzB,mCAAuC;AACvC,2CAA6B;AAC7B,6BAAoC;AACpC,kDAAgE;AAChE,iEAAwF;AAExF,wDAAqD;AACrD,yEAAoG;AAEpG,qDAAkE;AAkClE,kFAAkF;AAClF,uFAAuF;AACvF,uFAAuF;AACvF,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9E,CAAC,CAAC;AAEF,IAAI,aAAqC,CAAC;AAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAgD,CAAC;AACrD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,qEAAqE;AAC9D,MAAM,8BAA8B,GAAG,GAAS,EAAE;IACvD,aAAa,GAAG,SAAS,CAAC;IAC1B,YAAY,GAAG,CAAC,CAAC;IACjB,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEF,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,SAAoB,EAA+C,EAAE;IAC7G,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC7E,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO,CAAO,YAAoB,EAAmB,EAAE;;YACrD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,4BAAgB,CAAC;gBACnB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY;gBAC9D,mBAAmB,EAAE,mBAAmB;aACzC,CAAC,CACH,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,oBAAoB,EAAE,CAAA,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,2BAA2B,YAAY,GAAG,CAAC,CAAC;YACnI,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAA,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAExF,OAAO,CAAO,YAAoB,EAAmB,EAAE,kDAAC,OAAA,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA,GAAA,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,yCAAyC,QAAQ,GAAG,CAAC,CAAC;AAC7I,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IAEtD,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,QAAQ,CAAC;AACvF,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,WAAW,GAA4B;IAC3C,iBAAiB,EAAE,cAAc;IACjC,sBAAsB,EAAE,mBAAmB;CAC5C,CAAC;AAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,MAAM,CAAC,WAAW,CAChB,+CAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,IAAI;IACJ;QACE,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAc,EAAE;KAClE;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAA,cAAI,EAAC;QACH,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,oBAAoB,EAAE;KAC/B,CAAC,CAAC;IACH,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAO,OAAuC,EAAE,QAAsC,EAAmB,EAAE;;IAClI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,yBAAyB,CAAC;IACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACpD,+EAA+E;QAC/E,gFAAgF;QAChF,+DAA+D;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,kFAAkF;QAClF,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAA,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAA,sBAAa,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAA,MAAA,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAI,eAAe,CAAC,OAAO,mCAAI,eAAe,CAAC;IAExG,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,KAAK,UAAU,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,IAAI,CAAA,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,mBAAmB,EAChD,IAAI,QAAQ,CAAC,KAAK,0DAA0D,QAAQ,CAAC,aAAa,GAAG,CACtG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,2EAA2E;IAC1E,UAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IACxD,qBAAqB,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClE,IAAA,yBAAe,EAAC;QACd;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,QAAQ,CAAC,aAAa;SACxC;KACF,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,gFAAgF;AAChF,uFAAuF;AACvF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAO,SAAoB,EAAE,QAAgB,EAAE,OAA+B,EAAuB,EAAE;IACxH,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpD,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IACE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAA;QACxB,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA;QACf,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAA;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAC;QAC/B,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ;QACrC,QAAQ,CAAC,OAAO,KAAK,IAAI,EACzB,CAAC;QACD,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,eAAe,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;IAC7I,CAAC;IAED,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC,CAAA,CAAC;AAEF,wFAAwF;AACxF,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAgB,EAAuB,EAAE;IACnF,IAAI,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC;aAC7D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,aAAa,GAAG,KAAK,CAAC;YACtB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,4EAA4E;YAC5E,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,KAAK,CAAC,CAAC;YACnF,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,aAAa,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,mFAAmF;IACnF,eAAe;IACf,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1E,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,qFAAqF;AACrF,yEAAyE;AAClE,MAAM,kBAAkB,GAAG,CAAgB,SAAoB,EAAE,kBAAsC,EAA0B,EAAE;IACxI,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,uDAAqC,EAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,2CAA2C,YAAY,8BAA8B,CAAC,CAAC;YACpG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,oBAAU,EAAoB,GAAG,UAAU,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,8BAAY,CAAC,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,gBAAgB,EAC7C,UAAU,SAAS,4CAA4C,UAAU,GAAG,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAA,CAAC;AApCW,QAAA,kBAAkB,sBAoC7B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport * as quidproquoCore from 'quidproquo-core';\nimport { getFederatedKeyFromQpqFunctionRuntime, QPQConfig, qpqCoreUtils, QpqFunctionRuntime } from 'quidproquo-core';\nimport * as quidproquoWebserver from 'quidproquo-webserver';\n\nimport * as fs from 'fs';\nimport { createRequire } from 'module';\nimport * as path from 'path';\nimport { fileURLToPath } from 'url';\nimport { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { init, loadRemote, registerRemotes } from '@module-federation/enhanced/runtime';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { FederatedModuleLoadError, FederatedModuleLoadErrorCode } from './FederatedModuleLoadError';\nimport { FederatedModuleStoreManifest } from './FederatedModuleStoreManifest';\nimport { FEDERATED_SHARED_PACKAGE_NAMES } from './sharedPackages';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// loadFederatedStory — the RUNTIME half of module federation on lambda. Given a\n// QpqFunctionRuntime, it returns the published story function from the service's\n// code store, or undefined so dynamicModuleLoader falls back to the bundled copy.\n//\n// WHERE THE STORE COMES FROM\n//   process.env.federatedCodeStoreUrl = \"s3://<bucket>/<service>\" is set on every\n//   lambda by the CDK Function construct when the service declared\n//   defineFederatedModuleStore(...). The build/publish half (quidproquo-deploy-webpack)\n//   put the artifacts there. The two halves agree via FederatedModuleStoreManifest and\n//   the machine-independent key getFederatedKeyFromQpqFunctionRuntime (in core).\n//\n// FLOW (per lambda container)\n//   loadFederatedStory(runtime)\n//     └─ resolveStore()                 cache the store decision; re-probe on a TTL\n//         └─ probeStore()               read manifest.json; new hash? -> loadStoreVersion()\n//             └─ loadStoreVersion()     sync files to /tmp, require container, register w/ MF\n//     └─ manifest.exposes[key]          machine-independent runtime key -> expose path\n//     └─ loadRemote(container/expose)   MF hands back the module; return module[storyName]\n//\n// CACHING (state below): a resolved 'available' store is served instantly from memory;\n// the manifest is re-checked in the BACKGROUND every recheck interval so a warm\n// container picks up a newly published version without a redeploy. Every miss or error\n// returns undefined -> the caller uses the statically bundled module instead.\n// ─────────────────────────────────────────────────────────────────────────────\n\n// ── Module-level cache (per lambda execution environment / warm container) ───────\n// This state persists across invocations in the same container. resetFederatedModule-\n// StoreCache() clears it (tests only). 'available' carries the loaded manifest + the\n// MF remote name to loadRemote from; 'unavailable' means \"run the bundled fallback\".\ntype StoreState = { available: true; manifest: FederatedModuleStoreManifest; runtimeName: string } | { available: false };\n\n// How long a resolved state is served before the manifest is re-checked for a new\n// version. Overridable per service (defineFederatedModuleStore recheckMs -> this env).\n// Lower = faster pickup of new publishes at the cost of one small S3 GET per container\n// per interval. The re-check runs in the BACKGROUND so it never blocks a request.\nconst DEFAULT_RECHECK_MS = 60_000;\n\nconst getRecheckMs = (): number => {\n  const raw = process.env.federatedCodeStoreRecheckMs;\n  const parsed = raw ? parseInt(raw, 10) : NaN;\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RECHECK_MS;\n};\n\nlet resolvedState: StoreState | undefined;\nlet recheckAfter = 0;\nlet inflightResolve: Promise<StoreState> | undefined;\nlet hostInitialised = false;\n\n// Test seam - forces the next call to re-resolve the store from env.\nexport const resetFederatedModuleStoreCache = (): void => {\n  resolvedState = undefined;\n  recheckAfter = 0;\n  inflightResolve = undefined;\n};\n\n// ── Transport ────────────────────────────────────────────────────────────────\n// Returns a function that reads a path RELATIVE to the store (e.g. 'manifest.json'\n// or '<hash>/remoteEntry.js'). Two backends: s3:// for real deploys, file:// for\n// local/dev and tests. The store URL already includes the per-service prefix, so\n// callers pass only the in-service relative path.\nconst getFileFetcher = (storeUrl: string, qpqConfig: QPQConfig): ((relativePath: string) => Promise<Buffer>) => {\n  if (storeUrl.startsWith('s3://')) {\n    const url = new URL(storeUrl);\n    const bucketName = url.host;\n    const keyPrefix = url.pathname.replace(/^\\/|\\/$/g, '');\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n    // Pin the owner so a same-name bucket in another account can't be squatted to\n    // serve code we'd then require() with the service role's credentials.\n    const expectedBucketOwner = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(qpqConfig);\n    const s3Client = createAwsClient(S3Client, { region });\n\n    return async (relativePath: string): Promise<Buffer> => {\n      const response = await s3Client.send(\n        new GetObjectCommand({\n          Bucket: bucketName,\n          Key: keyPrefix ? `${keyPrefix}/${relativePath}` : relativePath,\n          ExpectedBucketOwner: expectedBucketOwner,\n        }),\n      );\n\n      const bytes = await response.Body?.transformToByteArray();\n      if (!bytes) {\n        throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.containerLoadFailed, `empty response reading [${relativePath}]`);\n      }\n\n      return Buffer.from(bytes);\n    };\n  }\n\n  if (storeUrl.startsWith('file://')) {\n    const baseDirectory = fileURLToPath(storeUrl.endsWith('/') ? storeUrl : `${storeUrl}/`);\n\n    return async (relativePath: string): Promise<Buffer> => fs.promises.readFile(path.join(baseDirectory, relativePath));\n  }\n\n  throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.unsupportedStoreUrl, `unsupported federated code store url [${storeUrl}]`);\n};\n\n// \"Nothing published yet\" is a legitimate not-found: the manifest key is absent\n// (NoSuchKey/NotFound) or the store bucket isn't created yet, which happens normally\n// when a lambda cold-starts between deploy phases (NoSuchBucket). We do NOT include\n// AccessDenied: a permission failure is a real misconfiguration and must surface (as a\n// warning, and be retried) rather than masquerade as 'not published'.\nconst isManifestNotFoundError = (error: unknown): boolean => {\n  const name = (error as { name?: string })?.name || '';\n  const code = (error as { code?: string })?.code || '';\n\n  return ['NoSuchKey', 'NotFound', 'NoSuchBucket'].includes(name) || code === 'ENOENT';\n};\n\n// ── Module-federation shared scope ───────────────────────────────────────────\n// The host provides the framework packages to the container's share scope so remote\n// story code resolves the SAME module instances as the bundled runtime. The package\n// list is shared with the remote build so the two can't drift (see sharedPackages).\nconst SHARED_LIBS: Record<string, unknown> = {\n  'quidproquo-core': quidproquoCore,\n  'quidproquo-webserver': quidproquoWebserver,\n};\n\nconst getHostSharedModules = () =>\n  Object.fromEntries(\n    FEDERATED_SHARED_PACKAGE_NAMES.map((name) => [\n      name,\n      {\n        version: '0.0.0',\n        lib: () => SHARED_LIBS[name],\n        shareConfig: { singleton: true, requiredVersion: false as const },\n      },\n    ]),\n  );\n\nconst ensureHostInitialised = (): void => {\n  if (hostInitialised) {\n    return;\n  }\n  init({\n    name: 'qpq_federated_host',\n    remotes: [],\n    shared: getHostSharedModules(),\n  });\n  hostInitialised = true;\n};\n\n// ── Version loading ──────────────────────────────────────────────────────────\n// Downloads a manifest's files (atomically) and registers the container with the MF\n// runtime under a HASH-UNIQUE remote name, so loadRemote can't serve a previous\n// version's module from its cache when the hash changes. Returns the runtime name.\n// This is the step that actually puts a new version's code into effect.\nconst loadStoreVersion = async (getFile: (p: string) => Promise<Buffer>, manifest: FederatedModuleStoreManifest): Promise<string> => {\n  const cacheRoot = process.env.federatedCodeStoreCacheDir || '/tmp/qpq-federated-code';\n  const versionDirectory = path.join(cacheRoot, manifest.containerName, manifest.hash);\n  await fs.promises.mkdir(versionDirectory, { recursive: true });\n\n  await Promise.all(\n    manifest.files.map(async (file) => {\n      const localPath = path.join(versionDirectory, file);\n      // Files are immutable under their hash dir AND only ever appear via the atomic\n      // rename below, so an existing file is always complete and valid - this is what\n      // lets a re-check of an unchanged version skip re-downloading.\n      if (fs.existsSync(localPath)) {\n        return;\n      }\n\n      const data = await getFile(`${manifest.hash}/${file}`);\n      await fs.promises.mkdir(path.dirname(localPath), { recursive: true });\n\n      // Write to a temp name then rename: rename is atomic on the same filesystem, so a\n      // crash/timeout mid-write never leaves a truncated file that a later invocation\n      // would trust via the existsSync check above. The random suffix keeps concurrent\n      // writers in the SAME process (overlapping probes) off each other's temp file.\n      const tempPath = `${localPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;\n      await fs.promises.writeFile(tempPath, data);\n      await fs.promises.rename(tempPath, localPath);\n    }),\n  );\n\n  const entryPath = path.join(versionDirectory, manifest.entry);\n  const containerRequire = createRequire(entryPath);\n  const containerModule = containerRequire(entryPath);\n  const container = containerModule[manifest.containerName] ?? containerModule.default ?? containerModule;\n\n  if (typeof container?.get !== 'function' || typeof container?.init !== 'function') {\n    throw new FederatedModuleLoadError(\n      FederatedModuleLoadErrorCode.containerLoadFailed,\n      `[${manifest.entry}] does not export a module federation container named [${manifest.containerName}]`,\n    );\n  }\n\n  // entryGlobalName is the container's real (build-time) library name; the registered\n  // remote name is hash-unique so each version is a distinct loadRemote key.\n  (globalThis as any)[manifest.containerName] = container;\n  ensureHostInitialised();\n\n  const runtimeName = `${manifest.containerName}__${manifest.hash}`;\n  registerRemotes([\n    {\n      name: runtimeName,\n      entry: entryPath,\n      type: 'global',\n      entryGlobalName: manifest.containerName,\n    },\n  ]);\n\n  return runtimeName;\n};\n\n// ── Probe & resolve (the caching state machine) ──────────────────────────────\n// Reads the manifest and decides the current state. If the hash is unchanged from what\n// we already loaded, keeps the existing container (no re-sync). Not-found -> unavailable.\nconst probeStore = async (qpqConfig: QPQConfig, storeUrl: string, current: StoreState | undefined): Promise<StoreState> => {\n  const getFile = getFileFetcher(storeUrl, qpqConfig);\n\n  let manifest: FederatedModuleStoreManifest;\n  try {\n    manifest = JSON.parse((await getFile('manifest.json')).toString('utf8'));\n  } catch (error) {\n    if (isManifestNotFoundError(error)) {\n      console.log(`federated code store [${storeUrl}] has no manifest - using bundled modules`);\n      return { available: false };\n    }\n    throw error;\n  }\n\n  if (\n    !manifest?.containerName ||\n    !manifest?.hash ||\n    !manifest?.entry ||\n    !Array.isArray(manifest?.files) ||\n    typeof manifest?.exposes !== 'object' ||\n    manifest.exposes === null\n  ) {\n    throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.manifestInvalid, `invalid manifest in federated code store [${storeUrl}]`);\n  }\n\n  if (current?.available && current.manifest.hash === manifest.hash) {\n    return current;\n  }\n\n  const runtimeName = await loadStoreVersion(getFile, manifest);\n  return { available: true, manifest, runtimeName };\n};\n\n// Resolves the store, re-checking the manifest after the recheck interval. The re-check\n// runs in the background: a stale-but-usable state is served immediately so a request\n// never blocks on S3; only the very first resolve (no state yet) awaits.\nconst resolveStore = (qpqConfig: QPQConfig, storeUrl: string): Promise<StoreState> => {\n  if (resolvedState && Date.now() < recheckAfter) {\n    return Promise.resolve(resolvedState);\n  }\n\n  if (!inflightResolve) {\n    inflightResolve = probeStore(qpqConfig, storeUrl, resolvedState)\n      .then((state) => {\n        resolvedState = state;\n        recheckAfter = Date.now() + getRecheckMs();\n        return state;\n      })\n      .catch((error) => {\n        // Back off and keep serving whatever we had (or unavailable). Surfaced as a\n        // warning so real errors (e.g. AccessDenied) are visible, not silent.\n        console.warn('federated code store check failed - keeping current modules', error);\n        recheckAfter = Date.now() + getRecheckMs();\n        resolvedState = resolvedState ?? { available: false };\n        return resolvedState;\n      })\n      .finally(() => {\n        inflightResolve = undefined;\n      });\n  }\n\n  // Serve the stale state instantly while the refresh happens; only block if we have\n  // nothing yet.\n  return resolvedState ? Promise.resolve(resolvedState) : inflightResolve;\n};\n\n// ── Public entry ─────────────────────────────────────────────────────────────\n// Called by dynamicModuleLoader for every story load. Returns the story function, or\n// undefined to signal \"use the bundled module\" (no store, nothing published, runtime\n// not exposed, or any error - availability always wins over federation).\nexport const loadFederatedStory = async <T = any>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime): Promise<T | undefined> => {\n  const storeUrl = process.env.federatedCodeStoreUrl;\n  if (!storeUrl) {\n    return undefined;\n  }\n\n  try {\n    const storeState = await resolveStore(qpqConfig, storeUrl);\n    if (!storeState.available) {\n      return undefined;\n    }\n\n    const federatedKey = getFederatedKeyFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const exposePath = storeState.manifest.exposes[federatedKey];\n    if (!exposePath) {\n      console.warn(`federated code store has no module for [${federatedKey}] - using the bundled module`);\n      return undefined;\n    }\n\n    const remoteModule = await loadRemote<Record<string, T>>(`${storeState.runtimeName}/${exposePath}`);\n\n    const storyName = qpqCoreUtils.getStoryNameFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const story = remoteModule?.[storyName];\n    if (!story) {\n      throw new FederatedModuleLoadError(\n        FederatedModuleLoadErrorCode.storyNotExported,\n        `story [${storyName}] is not exported from federated module [${exposePath}]`,\n      );\n    }\n\n    return story;\n  } catch (error) {\n    // Availability first: a broken store must never take the service down\n    console.warn('federated module load failed - using the bundled module', error);\n    return undefined;\n  }\n};\n"]}
+{"version":3,"file":"loadFederatedStory.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/loadFederatedStory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iEAA0D;AAC1D,gEAAkD;AAClD,qDAAqH;AACrH,0EAA4D;AAE5D,uCAAyB;AACzB,mCAAuC;AACvC,2CAA6B;AAC7B,6BAAoC;AACpC,kDAAgE;AAChE,iEAAwF;AAExF,wDAAqD;AACrD,yEAAoG;AAEpG,qDAAkE;AAkClE,kFAAkF;AAClF,uFAAuF;AACvF,uFAAuF;AACvF,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9E,CAAC,CAAC;AAEF,IAAI,aAAqC,CAAC;AAC1C,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAgD,CAAC;AACrD,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,qEAAqE;AAC9D,MAAM,8BAA8B,GAAG,GAAS,EAAE;IACvD,aAAa,GAAG,SAAS,CAAC;IAC1B,YAAY,GAAG,CAAC,CAAC;IACjB,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEF,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,iFAAiF;AACjF,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,SAAoB,EAA+C,EAAE;IAC7G,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAC7E,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,mBAAmB,GAAG,yCAAiB,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvD,OAAO,CAAO,YAAoB,EAAmB,EAAE;;YACrD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,4BAAgB,CAAC;gBACnB,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY;gBAC9D,mBAAmB,EAAE,mBAAmB;aACzC,CAAC,CACH,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,CAAA,MAAA,QAAQ,CAAC,IAAI,0CAAE,oBAAoB,EAAE,CAAA,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,2BAA2B,YAAY,GAAG,CAAC,CAAC;YACnI,CAAC;YAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAA,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QAExF,OAAO,CAAO,YAAoB,EAAmB,EAAE,kDAAC,OAAA,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAA,GAAA,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,mBAAmB,EAAE,yCAAyC,QAAQ,GAAG,CAAC,CAAC;AAC7I,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,KAAI,EAAE,CAAC;IAEtD,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,QAAQ,CAAC;AACvF,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,WAAW,GAA4B;IAC3C,iBAAiB,EAAE,cAAc;IACjC,sBAAsB,EAAE,mBAAmB;CAC5C,CAAC;AAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE,CAChC,MAAM,CAAC,WAAW,CAChB,+CAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,IAAI;IACJ;QACE,OAAO,EAAE,OAAO;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;QAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,KAAc,EAAE;KAClE;CACF,CAAC,CACH,CAAC;AAEJ,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAA,cAAI,EAAC;QACH,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,oBAAoB,EAAE;KAC/B,CAAC,CAAC;IACH,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC,CAAC;AAEF,gFAAgF;AAChF,oFAAoF;AACpF,gFAAgF;AAChF,mFAAmF;AACnF,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAO,OAAuC,EAAE,QAAsC,EAAmB,EAAE;;IAClI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,yBAAyB,CAAC;IACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACpD,+EAA+E;QAC/E,gFAAgF;QAChF,+DAA+D;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,kFAAkF;QAClF,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1F,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAA,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,IAAA,sBAAa,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAA,MAAA,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAI,eAAe,CAAC,OAAO,mCAAI,eAAe,CAAC;IAExG,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,GAAG,CAAA,KAAK,UAAU,IAAI,OAAO,CAAA,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,IAAI,CAAA,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,mBAAmB,EAChD,IAAI,QAAQ,CAAC,KAAK,0DAA0D,QAAQ,CAAC,aAAa,GAAG,CACtG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,2EAA2E;IAC1E,UAAsC,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IAC5E,qBAAqB,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClE,IAAA,yBAAe,EAAC;QACd;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,QAAQ,CAAC,aAAa;SACxC;KACF,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACrB,CAAC,CAAA,CAAC;AAEF,gFAAgF;AAChF,uFAAuF;AACvF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAO,SAAoB,EAAE,QAAgB,EAAE,OAA+B,EAAuB,EAAE;IACxH,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpD,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IACE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAA;QACxB,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAA;QACf,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAA;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAC;QAC/B,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ;QACrC,QAAQ,CAAC,OAAO,KAAK,IAAI,EACzB,CAAC;QACD,MAAM,IAAI,mDAAwB,CAAC,uDAA4B,CAAC,eAAe,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;IAC7I,CAAC;IAED,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACpD,CAAC,CAAA,CAAC;AAEF,wFAAwF;AACxF,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAgB,EAAuB,EAAE;IACnF,IAAI,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC;aAC7D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,aAAa,GAAG,KAAK,CAAC;YACtB,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,4EAA4E;YAC5E,sEAAsE;YACtE,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,KAAK,CAAC,CAAC;YACnF,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YAC3C,aAAa,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,mFAAmF;IACnF,eAAe;IACf,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC1E,CAAC,CAAC;AAEF,gFAAgF;AAChF,qFAAqF;AACrF,qFAAqF;AACrF,yEAAyE;AAClE,MAAM,kBAAkB,GAAG,CAAoB,SAAoB,EAAE,kBAAsC,EAA0B,EAAE;IAC5I,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,uDAAqC,EAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,2CAA2C,YAAY,8BAA8B,CAAC,CAAC;YACpG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,oBAAU,EAAoB,GAAG,UAAU,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC,CAAC;QAEpG,MAAM,SAAS,GAAG,8BAAY,CAAC,kCAAkC,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAG,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mDAAwB,CAChC,uDAA4B,CAAC,gBAAgB,EAC7C,UAAU,SAAS,4CAA4C,UAAU,GAAG,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAA,CAAC;AApCW,QAAA,kBAAkB,sBAoC7B","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport * as quidproquoCore from 'quidproquo-core';\nimport { getFederatedKeyFromQpqFunctionRuntime, QPQConfig, qpqCoreUtils, QpqFunctionRuntime } from 'quidproquo-core';\nimport * as quidproquoWebserver from 'quidproquo-webserver';\n\nimport * as fs from 'fs';\nimport { createRequire } from 'module';\nimport * as path from 'path';\nimport { fileURLToPath } from 'url';\nimport { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';\nimport { init, loadRemote, registerRemotes } from '@module-federation/enhanced/runtime';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { FederatedModuleLoadError, FederatedModuleLoadErrorCode } from './FederatedModuleLoadError';\nimport { FederatedModuleStoreManifest } from './FederatedModuleStoreManifest';\nimport { FEDERATED_SHARED_PACKAGE_NAMES } from './sharedPackages';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// loadFederatedStory: the RUNTIME half of module federation on lambda. Given a\n// QpqFunctionRuntime, it returns the published story function from the service's\n// code store, or undefined so dynamicModuleLoader falls back to the bundled copy.\n//\n// WHERE THE STORE COMES FROM\n//   process.env.federatedCodeStoreUrl = \"s3://<bucket>/<service>\" is set on every\n//   lambda by the CDK Function construct when the service declared\n//   defineFederatedModuleStore(...). The build/publish half (quidproquo-deploy-webpack)\n//   put the artifacts there. The two halves agree via FederatedModuleStoreManifest and\n//   the machine-independent key getFederatedKeyFromQpqFunctionRuntime (in core).\n//\n// FLOW (per lambda container)\n//   loadFederatedStory(runtime)\n//     └─ resolveStore()                 cache the store decision; re-probe on a TTL\n//         └─ probeStore()               read manifest.json; new hash? -> loadStoreVersion()\n//             └─ loadStoreVersion()     sync files to /tmp, require container, register w/ MF\n//     └─ manifest.exposes[key]          machine-independent runtime key -> expose path\n//     └─ loadRemote(container/expose)   MF hands back the module; return module[storyName]\n//\n// CACHING (state below): a resolved 'available' store is served instantly from memory;\n// the manifest is re-checked in the BACKGROUND every recheck interval so a warm\n// container picks up a newly published version without a redeploy. Every miss or error\n// returns undefined -> the caller uses the statically bundled module instead.\n// ─────────────────────────────────────────────────────────────────────────────\n\n// ── Module-level cache (per lambda execution environment / warm container) ───────\n// This state persists across invocations in the same container. resetFederatedModule-\n// StoreCache() clears it (tests only). 'available' carries the loaded manifest + the\n// MF remote name to loadRemote from; 'unavailable' means \"run the bundled fallback\".\ntype StoreState = { available: true; manifest: FederatedModuleStoreManifest; runtimeName: string } | { available: false };\n\n// How long a resolved state is served before the manifest is re-checked for a new\n// version. Overridable per service (defineFederatedModuleStore recheckMs -> this env).\n// Lower = faster pickup of new publishes at the cost of one small S3 GET per container\n// per interval. The re-check runs in the BACKGROUND so it never blocks a request.\nconst DEFAULT_RECHECK_MS = 60_000;\n\nconst getRecheckMs = (): number => {\n  const raw = process.env.federatedCodeStoreRecheckMs;\n  const parsed = raw ? parseInt(raw, 10) : NaN;\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_RECHECK_MS;\n};\n\nlet resolvedState: StoreState | undefined;\nlet recheckAfter = 0;\nlet inflightResolve: Promise<StoreState> | undefined;\nlet hostInitialised = false;\n\n// Test seam - forces the next call to re-resolve the store from env.\nexport const resetFederatedModuleStoreCache = (): void => {\n  resolvedState = undefined;\n  recheckAfter = 0;\n  inflightResolve = undefined;\n};\n\n// ── Transport ────────────────────────────────────────────────────────────────\n// Returns a function that reads a path RELATIVE to the store (e.g. 'manifest.json'\n// or '<hash>/remoteEntry.js'). Two backends: s3:// for real deploys, file:// for\n// local/dev and tests. The store URL already includes the per-service prefix, so\n// callers pass only the in-service relative path.\nconst getFileFetcher = (storeUrl: string, qpqConfig: QPQConfig): ((relativePath: string) => Promise<Buffer>) => {\n  if (storeUrl.startsWith('s3://')) {\n    const url = new URL(storeUrl);\n    const bucketName = url.host;\n    const keyPrefix = url.pathname.replace(/^\\/|\\/$/g, '');\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n    // Pin the owner so a same-name bucket in another account can't be squatted to\n    // serve code we'd then require() with the service role's credentials.\n    const expectedBucketOwner = qpqConfigAwsUtils.getApplicationModuleDeployAccountId(qpqConfig);\n    const s3Client = createAwsClient(S3Client, { region });\n\n    return async (relativePath: string): Promise<Buffer> => {\n      const response = await s3Client.send(\n        new GetObjectCommand({\n          Bucket: bucketName,\n          Key: keyPrefix ? `${keyPrefix}/${relativePath}` : relativePath,\n          ExpectedBucketOwner: expectedBucketOwner,\n        }),\n      );\n\n      const bytes = await response.Body?.transformToByteArray();\n      if (!bytes) {\n        throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.containerLoadFailed, `empty response reading [${relativePath}]`);\n      }\n\n      return Buffer.from(bytes);\n    };\n  }\n\n  if (storeUrl.startsWith('file://')) {\n    const baseDirectory = fileURLToPath(storeUrl.endsWith('/') ? storeUrl : `${storeUrl}/`);\n\n    return async (relativePath: string): Promise<Buffer> => fs.promises.readFile(path.join(baseDirectory, relativePath));\n  }\n\n  throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.unsupportedStoreUrl, `unsupported federated code store url [${storeUrl}]`);\n};\n\n// \"Nothing published yet\" is a legitimate not-found: the manifest key is absent\n// (NoSuchKey/NotFound) or the store bucket isn't created yet, which happens normally\n// when a lambda cold-starts between deploy phases (NoSuchBucket). We do NOT include\n// AccessDenied: a permission failure is a real misconfiguration and must surface (as a\n// warning, and be retried) rather than masquerade as 'not published'.\nconst isManifestNotFoundError = (error: unknown): boolean => {\n  const name = (error as { name?: string })?.name || '';\n  const code = (error as { code?: string })?.code || '';\n\n  return ['NoSuchKey', 'NotFound', 'NoSuchBucket'].includes(name) || code === 'ENOENT';\n};\n\n// ── Module-federation shared scope ───────────────────────────────────────────\n// The host provides the framework packages to the container's share scope so remote\n// story code resolves the SAME module instances as the bundled runtime. The package\n// list is shared with the remote build so the two can't drift (see sharedPackages).\nconst SHARED_LIBS: Record<string, unknown> = {\n  'quidproquo-core': quidproquoCore,\n  'quidproquo-webserver': quidproquoWebserver,\n};\n\nconst getHostSharedModules = () =>\n  Object.fromEntries(\n    FEDERATED_SHARED_PACKAGE_NAMES.map((name) => [\n      name,\n      {\n        version: '0.0.0',\n        lib: () => SHARED_LIBS[name],\n        shareConfig: { singleton: true, requiredVersion: false as const },\n      },\n    ]),\n  );\n\nconst ensureHostInitialised = (): void => {\n  if (hostInitialised) {\n    return;\n  }\n  init({\n    name: 'qpq_federated_host',\n    remotes: [],\n    shared: getHostSharedModules(),\n  });\n  hostInitialised = true;\n};\n\n// ── Version loading ──────────────────────────────────────────────────────────\n// Downloads a manifest's files (atomically) and registers the container with the MF\n// runtime under a HASH-UNIQUE remote name, so loadRemote can't serve a previous\n// version's module from its cache when the hash changes. Returns the runtime name.\n// This is the step that actually puts a new version's code into effect.\nconst loadStoreVersion = async (getFile: (p: string) => Promise<Buffer>, manifest: FederatedModuleStoreManifest): Promise<string> => {\n  const cacheRoot = process.env.federatedCodeStoreCacheDir || '/tmp/qpq-federated-code';\n  const versionDirectory = path.join(cacheRoot, manifest.containerName, manifest.hash);\n  await fs.promises.mkdir(versionDirectory, { recursive: true });\n\n  await Promise.all(\n    manifest.files.map(async (file) => {\n      const localPath = path.join(versionDirectory, file);\n      // Files are immutable under their hash dir AND only ever appear via the atomic\n      // rename below, so an existing file is always complete and valid - this is what\n      // lets a re-check of an unchanged version skip re-downloading.\n      if (fs.existsSync(localPath)) {\n        return;\n      }\n\n      const data = await getFile(`${manifest.hash}/${file}`);\n      await fs.promises.mkdir(path.dirname(localPath), { recursive: true });\n\n      // Write to a temp name then rename: rename is atomic on the same filesystem, so a\n      // crash/timeout mid-write never leaves a truncated file that a later invocation\n      // would trust via the existsSync check above. The random suffix keeps concurrent\n      // writers in the SAME process (overlapping probes) off each other's temp file.\n      const tempPath = `${localPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;\n      await fs.promises.writeFile(tempPath, data);\n      await fs.promises.rename(tempPath, localPath);\n    }),\n  );\n\n  const entryPath = path.join(versionDirectory, manifest.entry);\n  const containerRequire = createRequire(entryPath);\n  const containerModule = containerRequire(entryPath);\n  const container = containerModule[manifest.containerName] ?? containerModule.default ?? containerModule;\n\n  if (typeof container?.get !== 'function' || typeof container?.init !== 'function') {\n    throw new FederatedModuleLoadError(\n      FederatedModuleLoadErrorCode.containerLoadFailed,\n      `[${manifest.entry}] does not export a module federation container named [${manifest.containerName}]`,\n    );\n  }\n\n  // entryGlobalName is the container's real (build-time) library name; the registered\n  // remote name is hash-unique so each version is a distinct loadRemote key.\n  (globalThis as Record<string, unknown>)[manifest.containerName] = container;\n  ensureHostInitialised();\n\n  const runtimeName = `${manifest.containerName}__${manifest.hash}`;\n  registerRemotes([\n    {\n      name: runtimeName,\n      entry: entryPath,\n      type: 'global',\n      entryGlobalName: manifest.containerName,\n    },\n  ]);\n\n  return runtimeName;\n};\n\n// ── Probe & resolve (the caching state machine) ──────────────────────────────\n// Reads the manifest and decides the current state. If the hash is unchanged from what\n// we already loaded, keeps the existing container (no re-sync). Not-found -> unavailable.\nconst probeStore = async (qpqConfig: QPQConfig, storeUrl: string, current: StoreState | undefined): Promise<StoreState> => {\n  const getFile = getFileFetcher(storeUrl, qpqConfig);\n\n  let manifest: FederatedModuleStoreManifest;\n  try {\n    manifest = JSON.parse((await getFile('manifest.json')).toString('utf8'));\n  } catch (error) {\n    if (isManifestNotFoundError(error)) {\n      console.log(`federated code store [${storeUrl}] has no manifest - using bundled modules`);\n      return { available: false };\n    }\n    throw error;\n  }\n\n  if (\n    !manifest?.containerName ||\n    !manifest?.hash ||\n    !manifest?.entry ||\n    !Array.isArray(manifest?.files) ||\n    typeof manifest?.exposes !== 'object' ||\n    manifest.exposes === null\n  ) {\n    throw new FederatedModuleLoadError(FederatedModuleLoadErrorCode.manifestInvalid, `invalid manifest in federated code store [${storeUrl}]`);\n  }\n\n  if (current?.available && current.manifest.hash === manifest.hash) {\n    return current;\n  }\n\n  const runtimeName = await loadStoreVersion(getFile, manifest);\n  return { available: true, manifest, runtimeName };\n};\n\n// Resolves the store, re-checking the manifest after the recheck interval. The re-check\n// runs in the background: a stale-but-usable state is served immediately so a request\n// never blocks on S3; only the very first resolve (no state yet) awaits.\nconst resolveStore = (qpqConfig: QPQConfig, storeUrl: string): Promise<StoreState> => {\n  if (resolvedState && Date.now() < recheckAfter) {\n    return Promise.resolve(resolvedState);\n  }\n\n  if (!inflightResolve) {\n    inflightResolve = probeStore(qpqConfig, storeUrl, resolvedState)\n      .then((state) => {\n        resolvedState = state;\n        recheckAfter = Date.now() + getRecheckMs();\n        return state;\n      })\n      .catch((error) => {\n        // Back off and keep serving whatever we had (or unavailable). Surfaced as a\n        // warning so real errors (e.g. AccessDenied) are visible, not silent.\n        console.warn('federated code store check failed - keeping current modules', error);\n        recheckAfter = Date.now() + getRecheckMs();\n        resolvedState = resolvedState ?? { available: false };\n        return resolvedState;\n      })\n      .finally(() => {\n        inflightResolve = undefined;\n      });\n  }\n\n  // Serve the stale state instantly while the refresh happens; only block if we have\n  // nothing yet.\n  return resolvedState ? Promise.resolve(resolvedState) : inflightResolve;\n};\n\n// ── Public entry ─────────────────────────────────────────────────────────────\n// Called by dynamicModuleLoader for every story load. Returns the story function, or\n// undefined to signal \"use the bundled module\" (no store, nothing published, runtime\n// not exposed, or any error - availability always wins over federation).\nexport const loadFederatedStory = async <T = unknown>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime): Promise<T | undefined> => {\n  const storeUrl = process.env.federatedCodeStoreUrl;\n  if (!storeUrl) {\n    return undefined;\n  }\n\n  try {\n    const storeState = await resolveStore(qpqConfig, storeUrl);\n    if (!storeState.available) {\n      return undefined;\n    }\n\n    const federatedKey = getFederatedKeyFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const exposePath = storeState.manifest.exposes[federatedKey];\n    if (!exposePath) {\n      console.warn(`federated code store has no module for [${federatedKey}] - using the bundled module`);\n      return undefined;\n    }\n\n    const remoteModule = await loadRemote<Record<string, T>>(`${storeState.runtimeName}/${exposePath}`);\n\n    const storyName = qpqCoreUtils.getStoryNameFromQpqFunctionRuntime(qpqFunctionRuntime);\n    const story = remoteModule?.[storyName];\n    if (!story) {\n      throw new FederatedModuleLoadError(\n        FederatedModuleLoadErrorCode.storyNotExported,\n        `story [${storyName}] is not exported from federated module [${exposePath}]`,\n      );\n    }\n\n    return story;\n  } catch (error) {\n    // Availability first: a broken store must never take the service down\n    console.warn('federated module load failed - using the bundled module', error);\n    return undefined;\n  }\n};\n"]}

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.js

@@ -6,7 +6,7 @@ exports.FEDERATED_SHARED_PACKAGE_NAMES = void 0;
 // (instanceof checks and module-level state stay coherent). Single source of truth
 // for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the
 // remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and
-// quidproquo-deploy-rspack getRspackConfigForQpqRemote) — the lists must never
+// quidproquo-deploy-rspack getRspackConfigForQpqRemote). The lists must never
 // drift, or the remote would silently bundle its own copy.
 exports.FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'];
 //# sourceMappingURL=sharedPackages.js.map

package/lib/commonjs/logic/federatedModuleStore/sharedPackages.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharedPackages.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/sharedPackages.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,2DAA2D;AAC9C,QAAA,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC","sourcesContent":["// The framework packages the lambda host provides to the module-federation share\n// scope, so a federated remote resolves the SAME module instances as the host\n// (instanceof checks and module-level state stay coherent). Single source of truth\n// for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the\n// remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and\n// quidproquo-deploy-rspack getRspackConfigForQpqRemote) — the lists must never\n// drift, or the remote would silently bundle its own copy.\nexport const FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'] as const;\n"]}
+{"version":3,"file":"sharedPackages.js","sourceRoot":"","sources":["../../../../src/logic/federatedModuleStore/sharedPackages.ts"],"names":[],"mappings":";;;AAAA,iFAAiF;AACjF,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC9C,QAAA,8BAA8B,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAU,CAAC","sourcesContent":["// The framework packages the lambda host provides to the module-federation share\n// scope, so a federated remote resolves the SAME module instances as the host\n// (instanceof checks and module-level state stay coherent). Single source of truth\n// for BOTH the host runtime (loadFederatedStory getHostSharedModules) and the\n// remote builds (quidproquo-deploy-webpack getWebpackConfigForQpqRemote and\n// quidproquo-deploy-rspack getRspackConfigForQpqRemote). The lists must never\n// drift, or the remote would silently bundle its own copy.\nexport const FEDERATED_SHARED_PACKAGE_NAMES = ['quidproquo-core', 'quidproquo-webserver'] as const;\n"]}

package/lib/commonjs/logic/kms/decryptDataKey.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const decryptDataKey: (wrappedKey: Buffer, context: CryptoContext, region: string) => Promise<Buffer>;

package/lib/commonjs/logic/kms/decryptDataKey.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptDataKey = void 0;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+const toKmsEncryptionContext_1 = require("./toKmsEncryptionContext");
+// The wrapped key embeds the CMK id, so no KeyId is needed; the
+// EncryptionContext must match the one used at GenerateDataKey time (this is
+// also what puts the per-context decrypt entry in CloudTrail).
+const decryptDataKey = (wrappedKey, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.DecryptCommand({
+        CiphertextBlob: wrappedKey,
+        EncryptionContext: (0, toKmsEncryptionContext_1.toKmsEncryptionContext)(context),
+    }));
+    if (!response.Plaintext) {
+        throw new Error('KMS returned no plaintext for the wrapped data key');
+    }
+    return Buffer.from(response.Plaintext);
+});
+exports.decryptDataKey = decryptDataKey;
+//# sourceMappingURL=decryptDataKey.js.map

package/lib/commonjs/logic/kms/decryptDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/decryptDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,oDAAgE;AAEhE,wDAAqD;AACrD,qEAAkE;AAElE,gEAAgE;AAChE,6EAA6E;AAC7E,+DAA+D;AACxD,MAAM,cAAc,GAAG,CAAO,UAAkB,EAAE,OAAsB,EAAE,MAAc,EAAmB,EAAE;IAClH,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,2BAAc,CAAC;QACjB,cAAc,EAAE,UAAU;QAC1B,iBAAiB,EAAE,IAAA,+CAAsB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAA,CAAC;AAjBW,QAAA,cAAc,kBAiBzB","sourcesContent":["import { CryptoContext } from 'quidproquo-core';\n\nimport { DecryptCommand, KMSClient } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { toKmsEncryptionContext } from './toKmsEncryptionContext';\n\n// The wrapped key embeds the CMK id, so no KeyId is needed; the\n// EncryptionContext must match the one used at GenerateDataKey time (this is\n// also what puts the per-context decrypt entry in CloudTrail).\nexport const decryptDataKey = async (wrappedKey: Buffer, context: CryptoContext, region: string): Promise<Buffer> => {\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new DecryptCommand({\n      CiphertextBlob: wrappedKey,\n      EncryptionContext: toKmsEncryptionContext(context),\n    }),\n  );\n\n  if (!response.Plaintext) {\n    throw new Error('KMS returned no plaintext for the wrapped data key');\n  }\n\n  return Buffer.from(response.Plaintext);\n};\n"]}

package/lib/commonjs/logic/kms/generateDataKey.d.ts

@@ -0,0 +1,3 @@
+import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';
+import { CryptoContext } from 'quidproquo-core';
+export declare const generateDataKey: (keyAlias: string, context: CryptoContext, region: string) => Promise<GeneratedDataKey>;

package/lib/commonjs/logic/kms/generateDataKey.js

@@ -0,0 +1,34 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateDataKey = void 0;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+const toKmsEncryptionContext_1 = require("./toKmsEncryptionContext");
+const generateDataKey = (keyAlias, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.GenerateDataKeyCommand({
+        KeyId: keyAlias,
+        KeySpec: 'AES_256',
+        EncryptionContext: (0, toKmsEncryptionContext_1.toKmsEncryptionContext)(context),
+    }));
+    if (!response.Plaintext || !response.CiphertextBlob) {
+        throw new Error(`KMS returned an incomplete data key for [${keyAlias}]`);
+    }
+    return {
+        plaintextKey: Buffer.from(response.Plaintext),
+        wrappedKey: Buffer.from(response.CiphertextBlob),
+    };
+});
+exports.generateDataKey = generateDataKey;
+//# sourceMappingURL=generateDataKey.js.map

package/lib/commonjs/logic/kms/generateDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/generateDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,oDAAwE;AAExE,wDAAqD;AACrD,qEAAkE;AAE3D,MAAM,eAAe,GAAG,CAAO,QAAgB,EAAE,OAAsB,EAAE,MAAc,EAA6B,EAAE;IAC3H,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,mCAAsB,CAAC;QACzB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,SAAS;QAClB,iBAAiB,EAAE,IAAA,+CAAsB,EAAC,OAAO,CAAC;KACnD,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;KACjD,CAAC;AACJ,CAAC,CAAA,CAAC;AArBW,QAAA,eAAe,mBAqB1B","sourcesContent":["import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { GenerateDataKeyCommand, KMSClient } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\nimport { toKmsEncryptionContext } from './toKmsEncryptionContext';\n\nexport const generateDataKey = async (keyAlias: string, context: CryptoContext, region: string): Promise<GeneratedDataKey> => {\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new GenerateDataKeyCommand({\n      KeyId: keyAlias,\n      KeySpec: 'AES_256',\n      EncryptionContext: toKmsEncryptionContext(context),\n    }),\n  );\n\n  if (!response.Plaintext || !response.CiphertextBlob) {\n    throw new Error(`KMS returned an incomplete data key for [${keyAlias}]`);\n  }\n\n  return {\n    plaintextKey: Buffer.from(response.Plaintext),\n    wrappedKey: Buffer.from(response.CiphertextBlob),\n  };\n};\n"]}

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.d.ts

@@ -0,0 +1,3 @@
+import { GeneratedDataKey } from 'quidproquo-actionprocessor-node';
+import { CryptoContext } from 'quidproquo-core';
+export declare const getCachedGeneratedDataKey: (keyAlias: string, context: CryptoContext, region: string) => Promise<GeneratedDataKey>;

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedGeneratedDataKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const generateDataKey_1 = require("./generateDataKey");
+// A data key is reused across encrypts for the same key + context so most
+// askCryptoEncrypt calls never touch KMS. Bounded by age and use count; each
+// encrypt still gets a fresh random IV, so reuse within these limits is safe.
+const DATA_KEY_MAX_AGE_MS = 5 * 60 * 1000;
+const DATA_KEY_MAX_USES = 500;
+const cache = new Map();
+const getCachedGeneratedDataKey = (keyAlias, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cacheKey = `${region}|${keyAlias}|${(0, quidproquo_actionprocessor_node_1.canonicalizeCryptoContext)(context)}`;
+    const cached = cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now() && cached.remainingUses > 0) {
+        cached.remainingUses -= 1;
+        return cached.dataKey;
+    }
+    const dataKey = yield (0, generateDataKey_1.generateDataKey)(keyAlias, context, region);
+    cache.set(cacheKey, {
+        dataKey,
+        expiresAt: Date.now() + DATA_KEY_MAX_AGE_MS,
+        remainingUses: DATA_KEY_MAX_USES - 1,
+    });
+    return dataKey;
+});
+exports.getCachedGeneratedDataKey = getCachedGeneratedDataKey;
+//# sourceMappingURL=getCachedGeneratedDataKey.js.map

package/lib/commonjs/logic/kms/getCachedGeneratedDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCachedGeneratedDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/getCachedGeneratedDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA8F;AAG9F,uDAAoD;AAEpD,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAQ9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEjD,MAAM,yBAAyB,GAAG,CAAO,QAAgB,EAAE,OAAsB,EAAE,MAAc,EAA6B,EAAE;IACrI,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAA,2DAAyB,EAAC,OAAO,CAAC,EAAE,CAAC;IAE/E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAe,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;QAClB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;QAC3C,aAAa,EAAE,iBAAiB,GAAG,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAA,CAAC;AAlBW,QAAA,yBAAyB,6BAkBpC","sourcesContent":["import { canonicalizeCryptoContext, GeneratedDataKey } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { generateDataKey } from './generateDataKey';\n\n// A data key is reused across encrypts for the same key + context so most\n// askCryptoEncrypt calls never touch KMS. Bounded by age and use count; each\n// encrypt still gets a fresh random IV, so reuse within these limits is safe.\nconst DATA_KEY_MAX_AGE_MS = 5 * 60 * 1000;\nconst DATA_KEY_MAX_USES = 500;\n\ntype CachedGeneratedDataKey = {\n  dataKey: GeneratedDataKey;\n  expiresAt: number;\n  remainingUses: number;\n};\n\nconst cache = new Map<string, CachedGeneratedDataKey>();\n\nexport const getCachedGeneratedDataKey = async (keyAlias: string, context: CryptoContext, region: string): Promise<GeneratedDataKey> => {\n  const cacheKey = `${region}|${keyAlias}|${canonicalizeCryptoContext(context)}`;\n\n  const cached = cache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now() && cached.remainingUses > 0) {\n    cached.remainingUses -= 1;\n    return cached.dataKey;\n  }\n\n  const dataKey = await generateDataKey(keyAlias, context, region);\n\n  cache.set(cacheKey, {\n    dataKey,\n    expiresAt: Date.now() + DATA_KEY_MAX_AGE_MS,\n    remainingUses: DATA_KEY_MAX_USES - 1,\n  });\n\n  return dataKey;\n};\n"]}

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const getCachedUnwrappedDataKey: (wrappedKey: Buffer, context: CryptoContext, region: string) => Promise<Buffer>;

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedUnwrappedDataKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const decryptDataKey_1 = require("./decryptDataKey");
+const UNWRAPPED_KEY_MAX_AGE_MS = 5 * 60 * 1000;
+const UNWRAPPED_KEY_MAX_ENTRIES = 1000;
+const cache = new Map();
+const getCachedUnwrappedDataKey = (wrappedKey, context, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cacheKey = `${region}|${(0, quidproquo_actionprocessor_node_1.canonicalizeCryptoContext)(context)}|${wrappedKey.toString('base64')}`;
+    const cached = cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.plaintextKey;
+    }
+    const plaintextKey = yield (0, decryptDataKey_1.decryptDataKey)(wrappedKey, context, region);
+    // Crude eviction so a long-lived runtime decrypting many distinct blobs
+    // can't grow the cache without bound
+    if (cache.size >= UNWRAPPED_KEY_MAX_ENTRIES) {
+        cache.clear();
+    }
+    cache.set(cacheKey, {
+        plaintextKey,
+        expiresAt: Date.now() + UNWRAPPED_KEY_MAX_AGE_MS,
+    });
+    return plaintextKey;
+});
+exports.getCachedUnwrappedDataKey = getCachedUnwrappedDataKey;
+//# sourceMappingURL=getCachedUnwrappedDataKey.js.map

package/lib/commonjs/logic/kms/getCachedUnwrappedDataKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCachedUnwrappedDataKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/getCachedUnwrappedDataKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA4E;AAG5E,qDAAkD;AAElD,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAOvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEjD,MAAM,yBAAyB,GAAG,CAAO,UAAkB,EAAE,OAAsB,EAAE,MAAc,EAAmB,EAAE;IAC7H,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAA,2DAAyB,EAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEpG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAA,+BAAc,EAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvE,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,KAAK,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAC5C,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;QAClB,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB;KACjD,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAtBW,QAAA,yBAAyB,6BAsBpC","sourcesContent":["import { canonicalizeCryptoContext } from 'quidproquo-actionprocessor-node';\nimport { CryptoContext } from 'quidproquo-core';\n\nimport { decryptDataKey } from './decryptDataKey';\n\nconst UNWRAPPED_KEY_MAX_AGE_MS = 5 * 60 * 1000;\nconst UNWRAPPED_KEY_MAX_ENTRIES = 1000;\n\ntype CachedUnwrappedDataKey = {\n  plaintextKey: Buffer;\n  expiresAt: number;\n};\n\nconst cache = new Map<string, CachedUnwrappedDataKey>();\n\nexport const getCachedUnwrappedDataKey = async (wrappedKey: Buffer, context: CryptoContext, region: string): Promise<Buffer> => {\n  const cacheKey = `${region}|${canonicalizeCryptoContext(context)}|${wrappedKey.toString('base64')}`;\n\n  const cached = cache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.plaintextKey;\n  }\n\n  const plaintextKey = await decryptDataKey(wrappedKey, context, region);\n\n  // Crude eviction so a long-lived runtime decrypting many distinct blobs\n  // can't grow the cache without bound\n  if (cache.size >= UNWRAPPED_KEY_MAX_ENTRIES) {\n    cache.clear();\n  }\n\n  cache.set(cacheKey, {\n    plaintextKey,\n    expiresAt: Date.now() + UNWRAPPED_KEY_MAX_AGE_MS,\n  });\n\n  return plaintextKey;\n};\n"]}

package/lib/commonjs/logic/kms/toKmsEncryptionContext.d.ts

@@ -0,0 +1,2 @@
+import { CryptoContext } from 'quidproquo-core';
+export declare const toKmsEncryptionContext: (context: CryptoContext) => Record<string, string> | undefined;

package/lib/commonjs/logic/kms/toKmsEncryptionContext.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toKmsEncryptionContext = void 0;
+// KMS treats a missing EncryptionContext and an empty one as equivalent, but
+// we normalise to undefined so requests are byte-identical either way.
+const toKmsEncryptionContext = (context) => {
+    return Object.keys(context).length > 0 ? context : undefined;
+};
+exports.toKmsEncryptionContext = toKmsEncryptionContext;
+//# sourceMappingURL=toKmsEncryptionContext.js.map

package/lib/commonjs/logic/kms/toKmsEncryptionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toKmsEncryptionContext.js","sourceRoot":"","sources":["../../../../src/logic/kms/toKmsEncryptionContext.ts"],"names":[],"mappings":";;;AAEA,6EAA6E;AAC7E,uEAAuE;AAChE,MAAM,sBAAsB,GAAG,CAAC,OAAsB,EAAsC,EAAE;IACnG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC,CAAC;AAFW,QAAA,sBAAsB,0BAEjC","sourcesContent":["import { CryptoContext } from 'quidproquo-core';\n\n// KMS treats a missing EncryptionContext and an empty one as equivalent, but\n// we normalise to undefined so requests are byte-identical either way.\nexport const toKmsEncryptionContext = (context: CryptoContext): Record<string, string> | undefined => {\n  return Object.keys(context).length > 0 ? context : undefined;\n};\n"]}

package/lib/commonjs/logic/lambda/executeLambdaByName.d.ts

@@ -1 +1,5 @@
-export declare const executeLambdaByName: <R>(functionName: string, region: string, payload: any, isAsync: boolean) => Promise<R | undefined>;
+/**
+ * Invokes a lambda with a JSON payload. isAsync = fire-and-forget (Event invocation,
+ * always resolves undefined); otherwise waits and returns the parsed response payload.
+ */
+export declare const executeLambdaByName: <R>(functionName: string, region: string, payload: unknown, isAsync: boolean) => Promise<R | undefined>;

package/lib/commonjs/logic/lambda/executeLambdaByName.js

@@ -12,6 +12,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeLambdaByName = void 0;
 const client_lambda_1 = require("@aws-sdk/client-lambda");
 const createAwsClient_1 = require("../createAwsClient");
+/**
+ * Invokes a lambda with a JSON payload. isAsync = fire-and-forget (Event invocation,
+ * always resolves undefined); otherwise waits and returns the parsed response payload.
+ */
 const executeLambdaByName = (functionName, region, payload, isAsync) => __awaiter(void 0, void 0, void 0, function* () {
     const lambdaClient = (0, createAwsClient_1.createAwsClient)(client_lambda_1.LambdaClient, { region });
     const encoder = new TextEncoder();
@@ -22,15 +26,14 @@ const executeLambdaByName = (functionName, region, payload, isAsync) => __awaite
         InvocationType: isAsync ? 'Event' : 'RequestResponse',
     }));
     if (response.FunctionError) {
-        // Get more details about the error if available
+        // On function errors the payload carries the thrown error details
         const errorDetails = response.Payload ? new TextDecoder().decode(response.Payload) : '';
         throw new Error(`Lambda Error: ${response.FunctionError}. Details: ${errorDetails}`);
     }
     if (!isAsync && response.Payload) {
         const jsonString = new TextDecoder().decode(response.Payload);
         if (jsonString) {
-            const object = JSON.parse(jsonString);
-            return object;
+            return JSON.parse(jsonString);
         }
     }
     return undefined;

package/lib/commonjs/logic/lambda/executeLambdaByName.js.map

@@ -1 +1 @@
-{"version":3,"file":"executeLambdaByName.js","sourceRoot":"","sources":["../../../../src/logic/lambda/executeLambdaByName.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAqE;AAErE,wDAAqD;AAE9C,MAAM,mBAAmB,GAAG,CAAU,YAAoB,EAAE,MAAc,EAAE,OAAY,EAAE,OAAgB,EAA0B,EAAE;IAC3I,MAAM,YAAY,GAAG,IAAA,iCAAe,EAAC,4BAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CACtC,IAAI,6BAAa,CAAC;QAChB,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,cAAc;QACvB,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;KACtD,CAAC,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,gDAAgD;QAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,iBAAiB,QAAQ,CAAC,aAAa,cAAc,YAAY,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAA,CAAC;AA7BW,QAAA,mBAAmB,uBA6B9B","sourcesContent":["import { InvokeCommand, LambdaClient } from '@aws-sdk/client-lambda';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const executeLambdaByName = async <R>(functionName: string, region: string, payload: any, isAsync: boolean): Promise<R | undefined> => {\n  const lambdaClient = createAwsClient(LambdaClient, { region });\n\n  const encoder = new TextEncoder();\n  const encodedPayload = encoder.encode(JSON.stringify(payload));\n\n  const response = await lambdaClient.send(\n    new InvokeCommand({\n      FunctionName: functionName,\n      Payload: encodedPayload,\n      InvocationType: isAsync ? 'Event' : 'RequestResponse',\n    }),\n  );\n\n  if (response.FunctionError) {\n    // Get more details about the error if available\n    const errorDetails = response.Payload ? new TextDecoder().decode(response.Payload) : '';\n    throw new Error(`Lambda Error: ${response.FunctionError}. Details: ${errorDetails}`);\n  }\n\n  if (!isAsync && response.Payload) {\n    const jsonString = new TextDecoder().decode(response.Payload);\n    if (jsonString) {\n      const object = JSON.parse(jsonString);\n      return object;\n    }\n  }\n\n  return undefined;\n};\n"]}
+{"version":3,"file":"executeLambdaByName.js","sourceRoot":"","sources":["../../../../src/logic/lambda/executeLambdaByName.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAqE;AAErE,wDAAqD;AAErD;;;GAGG;AACI,MAAM,mBAAmB,GAAG,CAAU,YAAoB,EAAE,MAAc,EAAE,OAAgB,EAAE,OAAgB,EAA0B,EAAE;IAC/I,MAAM,YAAY,GAAG,IAAA,iCAAe,EAAC,4BAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CACtC,IAAI,6BAAa,CAAC;QAChB,YAAY,EAAE,YAAY;QAC1B,OAAO,EAAE,cAAc;QACvB,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;KACtD,CAAC,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,kEAAkE;QAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,iBAAiB,QAAQ,CAAC,aAAa,cAAc,YAAY,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAA,CAAC;AA5BW,QAAA,mBAAmB,uBA4B9B","sourcesContent":["import { InvokeCommand, LambdaClient } from '@aws-sdk/client-lambda';\n\nimport { createAwsClient } from '../createAwsClient';\n\n/**\n * Invokes a lambda with a JSON payload. isAsync = fire-and-forget (Event invocation,\n * always resolves undefined); otherwise waits and returns the parsed response payload.\n */\nexport const executeLambdaByName = async <R>(functionName: string, region: string, payload: unknown, isAsync: boolean): Promise<R | undefined> => {\n  const lambdaClient = createAwsClient(LambdaClient, { region });\n\n  const encoder = new TextEncoder();\n  const encodedPayload = encoder.encode(JSON.stringify(payload));\n\n  const response = await lambdaClient.send(\n    new InvokeCommand({\n      FunctionName: functionName,\n      Payload: encodedPayload,\n      InvocationType: isAsync ? 'Event' : 'RequestResponse',\n    }),\n  );\n\n  if (response.FunctionError) {\n    // On function errors the payload carries the thrown error details\n    const errorDetails = response.Payload ? new TextDecoder().decode(response.Payload) : '';\n    throw new Error(`Lambda Error: ${response.FunctionError}. Details: ${errorDetails}`);\n  }\n\n  if (!isAsync && response.Payload) {\n    const jsonString = new TextDecoder().decode(response.Payload);\n    if (jsonString) {\n      return JSON.parse(jsonString);\n    }\n  }\n\n  return undefined;\n};\n"]}

package/lib/commonjs/logic/neptune/getNeptuneEndpoints.js

@@ -13,19 +13,21 @@ exports.getNeptuneEndpoints = void 0;
 const client_neptune_1 = require("@aws-sdk/client-neptune");
 const createAwsClient_1 = require("../createAwsClient");
 const getNeptuneEndpoints = (clusterIdentifier, region) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     const neptuneClient = (0, createAwsClient_1.createAwsClient)(client_neptune_1.NeptuneClient, { region });
     const command = new client_neptune_1.DescribeDBClustersCommand({
         DBClusterIdentifier: clusterIdentifier,
     });
     try {
         const response = yield neptuneClient.send(command);
-        if (response.DBClusters && response.DBClusters.length > 0) {
-            const cluster = response.DBClusters[0];
-            const writeEndpoint = cluster.Endpoint && cluster.Port ? `https://${cluster.Endpoint}:${cluster.Port}` : undefined;
-            const readEndpoint = cluster.ReaderEndpoint && cluster.Port ? `https://${cluster.ReaderEndpoint}:${cluster.Port}` : undefined;
-            return { writeEndpoint, readEndpoint };
+        const cluster = (_a = response.DBClusters) === null || _a === void 0 ? void 0 : _a[0];
+        if (!cluster) {
+            return {};
         }
-        return {};
+        return {
+            writeEndpoint: cluster.Endpoint && cluster.Port ? `https://${cluster.Endpoint}:${cluster.Port}` : undefined,
+            readEndpoint: cluster.ReaderEndpoint && cluster.Port ? `https://${cluster.ReaderEndpoint}:${cluster.Port}` : undefined,
+        };
     }
     catch (error) {
         console.error('Error fetching Neptune cluster endpoints:', error);

package/lib/commonjs/logic/neptune/getNeptuneEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"getNeptuneEndpoints.js","sourceRoot":"","sources":["../../../../src/logic/neptune/getNeptuneEndpoints.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAAmF;AAGnF,wDAAqD;AAE9C,MAAM,mBAAmB,GAAG,CAAO,iBAAyB,EAAE,MAAc,EAAmC,EAAE;IACtH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,8BAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,0CAAyB,CAAC;QAC5C,mBAAmB,EAAE,iBAAiB;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAEvC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACnH,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAE9H,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAA,CAAC;AAxBW,QAAA,mBAAmB,uBAwB9B","sourcesContent":["import { DescribeDBClustersCommand, NeptuneClient } from '@aws-sdk/client-neptune';\n\nimport { GraphDatabaseEndpoints } from '../../getActionProcessor/core/graphDatabase/customActions/actions';\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getNeptuneEndpoints = async (clusterIdentifier: string, region: string): Promise<GraphDatabaseEndpoints> => {\n  const neptuneClient = createAwsClient(NeptuneClient, { region });\n\n  const command = new DescribeDBClustersCommand({\n    DBClusterIdentifier: clusterIdentifier,\n  });\n\n  try {\n    const response = await neptuneClient.send(command);\n\n    if (response.DBClusters && response.DBClusters.length > 0) {\n      const cluster = response.DBClusters[0];\n\n      const writeEndpoint = cluster.Endpoint && cluster.Port ? `https://${cluster.Endpoint}:${cluster.Port}` : undefined;\n      const readEndpoint = cluster.ReaderEndpoint && cluster.Port ? `https://${cluster.ReaderEndpoint}:${cluster.Port}` : undefined;\n\n      return { writeEndpoint, readEndpoint };\n    }\n\n    return {};\n  } catch (error) {\n    console.error('Error fetching Neptune cluster endpoints:', error);\n    throw new Error(`Failed to retrieve Neptune endpoints: ${error}`);\n  }\n};\n"]}
+{"version":3,"file":"getNeptuneEndpoints.js","sourceRoot":"","sources":["../../../../src/logic/neptune/getNeptuneEndpoints.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,4DAAmF;AAGnF,wDAAqD;AAE9C,MAAM,mBAAmB,GAAG,CAAO,iBAAyB,EAAE,MAAc,EAAmC,EAAE;;IACtH,MAAM,aAAa,GAAG,IAAA,iCAAe,EAAC,8BAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,0CAAyB,CAAC;QAC5C,mBAAmB,EAAE,iBAAiB;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAA,QAAQ,CAAC,UAAU,0CAAG,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,aAAa,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC3G,YAAY,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SACvH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAA,CAAC;AAvBW,QAAA,mBAAmB,uBAuB9B","sourcesContent":["import { DescribeDBClustersCommand, NeptuneClient } from '@aws-sdk/client-neptune';\n\nimport { GraphDatabaseEndpoints } from '../../getActionProcessor/core/graphDatabase/customActions/actions';\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getNeptuneEndpoints = async (clusterIdentifier: string, region: string): Promise<GraphDatabaseEndpoints> => {\n  const neptuneClient = createAwsClient(NeptuneClient, { region });\n\n  const command = new DescribeDBClustersCommand({\n    DBClusterIdentifier: clusterIdentifier,\n  });\n\n  try {\n    const response = await neptuneClient.send(command);\n\n    const cluster = response.DBClusters?.[0];\n    if (!cluster) {\n      return {};\n    }\n\n    return {\n      writeEndpoint: cluster.Endpoint && cluster.Port ? `https://${cluster.Endpoint}:${cluster.Port}` : undefined,\n      readEndpoint: cluster.ReaderEndpoint && cluster.Port ? `https://${cluster.ReaderEndpoint}:${cluster.Port}` : undefined,\n    };\n  } catch (error) {\n    console.error('Error fetching Neptune cluster endpoints:', error);\n    throw new Error(`Failed to retrieve Neptune endpoints: ${error}`);\n  }\n};\n"]}

package/lib/commonjs/logic/parametersManager/getParameters.js

@@ -19,6 +19,7 @@ exports.getParameters = (0, memoFuncAsync_1.memoFuncAsync)((parameterNames, regi
         Names: parameterNames,
     }));
     const resolvedParams = response.Parameters || [];
-    return parameterNames.map((pn) => { var _a; return ((_a = resolvedParams.find((rp) => rp.Name == pn)) === null || _a === void 0 ? void 0 : _a.Value) || ''; });
+    // Preserve the requested order; a missing parameter resolves to an empty string
+    return parameterNames.map((parameterName) => { var _a; return ((_a = resolvedParams.find((resolvedParam) => resolvedParam.Name === parameterName)) === null || _a === void 0 ? void 0 : _a.Value) || ''; });
 }), 60);
 //# sourceMappingURL=getParameters.js.map

package/lib/commonjs/logic/parametersManager/getParameters.js.map

@@ -1 +1 @@
-{"version":3,"file":"getParameters.js","sourceRoot":"","sources":["../../../../src/logic/parametersManager/getParameters.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAsE;AAEtE,0DAAuD;AACvD,wDAAqD;AAExC,QAAA,aAAa,GAAG,IAAA,6BAAa,EAAC,CAAO,cAAwB,EAAE,MAAc,EAAqB,EAAE;IAC/G,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,iCAAoB,CAAC;QACvB,KAAK,EAAE,cAAc;KACtB,CAAC,CACH,CAAC;IAEF,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IAEjD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,0CAAE,KAAK,KAAI,EAAE,CAAA,EAAA,CAAC,CAAC;AAC7F,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC","sourcesContent":["import { GetParametersCommand, SSMClient } from '@aws-sdk/client-ssm';\n\nimport { memoFuncAsync } from '../cache/memoFuncAsync';\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getParameters = memoFuncAsync(async (parameterNames: string[], region: string): Promise<string[]> => {\n  const ssmClient = createAwsClient(SSMClient, { region });\n\n  const response = await ssmClient.send(\n    new GetParametersCommand({\n      Names: parameterNames,\n    }),\n  );\n\n  const resolvedParams = response.Parameters || [];\n\n  return parameterNames.map((pn) => resolvedParams.find((rp) => rp.Name == pn)?.Value || '');\n}, 60);\n"]}
+{"version":3,"file":"getParameters.js","sourceRoot":"","sources":["../../../../src/logic/parametersManager/getParameters.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAsE;AAEtE,0DAAuD;AACvD,wDAAqD;AAExC,QAAA,aAAa,GAAG,IAAA,6BAAa,EAAC,CAAO,cAAwB,EAAE,MAAc,EAAqB,EAAE;IAC/G,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,iCAAoB,CAAC;QACvB,KAAK,EAAE,cAAc;KACtB,CAAC,CACH,CAAC;IAEF,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;IAEjD,gFAAgF;IAChF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,KAAK,aAAa,CAAC,0CAAE,KAAK,KAAI,EAAE,CAAA,EAAA,CAAC,CAAC;AAC1I,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC","sourcesContent":["import { GetParametersCommand, SSMClient } from '@aws-sdk/client-ssm';\n\nimport { memoFuncAsync } from '../cache/memoFuncAsync';\nimport { createAwsClient } from '../createAwsClient';\n\nexport const getParameters = memoFuncAsync(async (parameterNames: string[], region: string): Promise<string[]> => {\n  const ssmClient = createAwsClient(SSMClient, { region });\n\n  const response = await ssmClient.send(\n    new GetParametersCommand({\n      Names: parameterNames,\n    }),\n  );\n\n  const resolvedParams = response.Parameters || [];\n\n  // Preserve the requested order; a missing parameter resolves to an empty string\n  return parameterNames.map((parameterName) => resolvedParams.find((resolvedParam) => resolvedParam.Name === parameterName)?.Value || '');\n}, 60);\n"]}

package/lib/commonjs/logic/s3/deleteFiles.d.ts

@@ -1 +1,2 @@
+/** Batch-deletes the given keys; returns the keys that FAILED to delete (empty array = all deleted). */
 export declare const deleteFiles: (drive: string, filepaths: string[], region: string) => Promise<string[]>;

package/lib/commonjs/logic/s3/deleteFiles.js

@@ -12,17 +12,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deleteFiles = void 0;
 const client_s3_1 = require("@aws-sdk/client-s3");
 const createAwsClient_1 = require("../createAwsClient");
+// DeleteObjects rejects requests with more than 1000 keys, so larger deletes are split.
+const MAX_KEYS_PER_DELETE_REQUEST = 1000;
+/** Batch-deletes the given keys; returns the keys that FAILED to delete (empty array = all deleted). */
 const deleteFiles = (drive, filepaths, region) => __awaiter(void 0, void 0, void 0, function* () {
     const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
-    const bucketParams = {
-        Bucket: drive,
-        Delete: {
-            Quiet: true,
-            Objects: filepaths.map((fp) => ({ Key: fp })),
-        },
-    };
-    const response = yield s3Client.send(new client_s3_1.DeleteObjectsCommand(bucketParams));
-    return (response.Errors || []).map((e) => e.Key || '');
+    const failedKeys = [];
+    for (let offset = 0; offset < filepaths.length; offset += MAX_KEYS_PER_DELETE_REQUEST) {
+        const batch = filepaths.slice(offset, offset + MAX_KEYS_PER_DELETE_REQUEST);
+        const response = yield s3Client.send(new client_s3_1.DeleteObjectsCommand({
+            Bucket: drive,
+            Delete: {
+                Quiet: true,
+                Objects: batch.map((filepath) => ({ Key: filepath })),
+            },
+        }));
+        failedKeys.push(...(response.Errors || []).map((deleteError) => deleteError.Key || ''));
+    }
+    return failedKeys;
 });
 exports.deleteFiles = deleteFiles;
 //# sourceMappingURL=deleteFiles.js.map

package/lib/commonjs/logic/s3/deleteFiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"deleteFiles.js","sourceRoot":"","sources":["../../../../src/logic/s3/deleteFiles.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAA+F;AAE/F,wDAAqD;AAE9C,MAAM,WAAW,GAAG,CAAO,KAAa,EAAE,SAAmB,EAAE,MAAc,EAAqB,EAAE;IACzG,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,MAAM,YAAY,GAA8B;QAC9C,MAAM,EAAE,KAAK;QACb,MAAM,EAAE;YACN,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;SAC9C;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,gCAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC,CAAA,CAAC;AAdW,QAAA,WAAW,eActB","sourcesContent":["import { DeleteObjectsCommand, DeleteObjectsCommandInput, S3Client } from '@aws-sdk/client-s3';\n\nimport { createAwsClient } from '../createAwsClient';\n\nexport const deleteFiles = async (drive: string, filepaths: string[], region: string): Promise<string[]> => {\n  const s3Client = createAwsClient(S3Client, { region });\n\n  const bucketParams: DeleteObjectsCommandInput = {\n    Bucket: drive,\n    Delete: {\n      Quiet: true,\n      Objects: filepaths.map((fp) => ({ Key: fp })),\n    },\n  };\n\n  const response = await s3Client.send(new DeleteObjectsCommand(bucketParams));\n\n  return (response.Errors || []).map((e) => e.Key || '');\n};\n"]}
+{"version":3,"file":"deleteFiles.js","sourceRoot":"","sources":["../../../../src/logic/s3/deleteFiles.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAoE;AAEpE,wDAAqD;AAErD,wFAAwF;AACxF,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEzC,wGAAwG;AACjG,MAAM,WAAW,GAAG,CAAO,KAAa,EAAE,SAAmB,EAAE,MAAc,EAAqB,EAAE;IACzG,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,IAAI,2BAA2B,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,gCAAoB,CAAC;YACvB,MAAM,EAAE,KAAK;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;aACtD;SACF,CAAC,CACH,CAAC;QAEF,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC,CAAA,CAAC;AAtBW,QAAA,WAAW,eAsBtB","sourcesContent":["import { DeleteObjectsCommand, S3Client } from '@aws-sdk/client-s3';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// DeleteObjects rejects requests with more than 1000 keys, so larger deletes are split.\nconst MAX_KEYS_PER_DELETE_REQUEST = 1000;\n\n/** Batch-deletes the given keys; returns the keys that FAILED to delete (empty array = all deleted). */\nexport const deleteFiles = async (drive: string, filepaths: string[], region: string): Promise<string[]> => {\n  const s3Client = createAwsClient(S3Client, { region });\n\n  const failedKeys: string[] = [];\n\n  for (let offset = 0; offset < filepaths.length; offset += MAX_KEYS_PER_DELETE_REQUEST) {\n    const batch = filepaths.slice(offset, offset + MAX_KEYS_PER_DELETE_REQUEST);\n\n    const response = await s3Client.send(\n      new DeleteObjectsCommand({\n        Bucket: drive,\n        Delete: {\n          Quiet: true,\n          Objects: batch.map((filepath) => ({ Key: filepath })),\n        },\n      }),\n    );\n\n    failedKeys.push(...(response.Errors || []).map((deleteError) => deleteError.Key || ''));\n  }\n\n  return failedKeys;\n};\n"]}

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.d.ts

@@ -1 +1,2 @@
+/** Presigns a PUT of the object, valid for expirationMs from now. */
 export declare const generatePresignedUploadUrl: (bucketName: string, objectKey: string, region: string, expirationMs: number, correlationId?: string, contentType?: string, contentDisposition?: string) => Promise<string>;

package/lib/commonjs/logic/s3/generatePresignedUploadUrl.js

@@ -12,41 +12,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generatePresignedUploadUrl = void 0;
 const client_s3_1 = require("@aws-sdk/client-s3");
 const s3_request_presigner_1 = require("@aws-sdk/s3-request-presigner");
-// import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
 const createAwsClient_1 = require("../createAwsClient");
-// export const generatePresignedUploadFormUrl = async (
-//   bucketName: string,
-//   objectKey: string,
-//   region: string,
-//   expirationMs: number,
-//   contentType: string | undefined,
-//   maxSizeBytes?: number | undefined
-// ): Promise<{ url: string; fields: Record<string, string> }> => {
-//   const s3Client = createAwsClient(S3Client, { region });
-//   const conditions: any[] = [];
-//   // Add content type condition if provided
-//   if (contentType) {
-//     conditions.push(['eq', '$Content-Type', contentType]);
-//   }
-//   // Add file size limit condition if provided
-//   if (maxSizeBytes) {
-//     conditions.push(['content-length-range', 0, maxSizeBytes]);
-//   }
-//   const presignedPost = await createPresignedPost(s3Client, {
-//     Bucket: bucketName,
-//     Key: objectKey,
-//     Conditions: conditions,
-//     Expires: Math.floor(expirationMs / 1000),
-//   });
-//   return {
-//     url: presignedPost.url,
-//     fields: presignedPost.fields
-//   };
-// };
+/** Presigns a PUT of the object, valid for expirationMs from now. */
 const generatePresignedUploadUrl = (bucketName, objectKey, region, expirationMs, correlationId, contentType, contentDisposition) => __awaiter(void 0, void 0, void 0, function* () {
     // WHEN_REQUIRED disables the SDK v3 default request checksum (CRC32). Otherwise the
     // presigner bakes an empty-body checksum (x-amz-checksum-crc32=AAAAAA==) into the signed
-    // URL, which never matches the real body the browser PUTs — S3 then rejects the upload and
+    // URL, which never matches the real body the browser PUTs. S3 then rejects the upload and
     // the failure surfaces in the browser as a CORS error (the error response has no ACAO header).
     const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, {
         region,