quidproquo-actionprocessor-awslambda 0.1.2 → 0.1.3

package/lib/commonjs/awsNamingUtils.d.ts

@@ -17,7 +17,9 @@ export declare const getCFExportNameApiKeyIdFromConfig: (apiKeyName: string, qpq
 export declare const getCFExportNameSnsTopicArnFromConfig: (eventBusName: string, qpqConfig: QPQConfig, applicationOverride?: string) => string;
 export declare const getCFExportNameDistributionIdArnFromConfig: (webEntryName: string, qpqConfig: QPQConfig, serviceOverride?: string, applicationOverride?: string) => string;
 export declare const getCFExportNameWebsocketApiIdFromConfig: (websocketApiName: string, qpqConfig: QPQConfig) => string;
+export declare const getWebsocketApiIdSsmParameterName: (websocketApiName: string, qpqConfig: QPQConfig) => string;
 export declare const getEventBusSnsTopicArn: (eventBusName: string, qpqConfig: QPQConfig, module: string, environment: string, application: string, feature?: string) => string;
+export declare const getAccountStackName: () => string;
 export declare const getBaseStackName: (qpqConfig: QPQConfig) => string;
 export declare const getInfStackName: (qpqConfig: QPQConfig) => string;
 export declare const getWebStackName: (qpqConfig: QPQConfig) => string;

package/lib/commonjs/awsNamingUtils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getDomainStackName = exports.getBootstrapStackName = exports.getApiStackName = exports.getWebStackName = exports.getInfStackName = exports.getBaseStackName = exports.getEventBusSnsTopicArn = exports.getCFExportNameWebsocketApiIdFromConfig = exports.getCFExportNameDistributionIdArnFromConfig = exports.getCFExportNameSnsTopicArnFromConfig = exports.getCFExportNameApiKeyIdFromConfig = exports.getCFExportNameUserPoolClientIdFromConfig = exports.getCFExportNameCachePolicyIdFromConfig = exports.getCFExportNameUserPoolIdFromConfig = exports.getKvsDynamoTableNameFromConfig = exports.getQpqRuntimeResourceNameFromConfig = exports.getQpqRuntimeResourceName = exports.getConfigRuntimeResourceNameFromConfigWithServiceOverride = exports.getConfigRuntimeBootstrapResourceNameFromConfig = exports.resolveConfigRuntimeResourceNameFromConfig = exports.getConfigRuntimeResourceNameFromConfig = exports.getConfigRuntimeBootstrapResourceName = exports.getConfigRuntimeResourceName = exports.getGlobalQpqRuntimeResourceName = exports.getGlobalConfigRuntimeResourceName = void 0;
+exports.getDomainStackName = exports.getBootstrapStackName = exports.getApiStackName = exports.getWebStackName = exports.getInfStackName = exports.getBaseStackName = exports.getAccountStackName = exports.getEventBusSnsTopicArn = exports.getWebsocketApiIdSsmParameterName = exports.getCFExportNameWebsocketApiIdFromConfig = exports.getCFExportNameDistributionIdArnFromConfig = exports.getCFExportNameSnsTopicArnFromConfig = exports.getCFExportNameApiKeyIdFromConfig = exports.getCFExportNameUserPoolClientIdFromConfig = exports.getCFExportNameCachePolicyIdFromConfig = exports.getCFExportNameUserPoolIdFromConfig = exports.getKvsDynamoTableNameFromConfig = exports.getQpqRuntimeResourceNameFromConfig = exports.getQpqRuntimeResourceName = exports.getConfigRuntimeResourceNameFromConfigWithServiceOverride = exports.getConfigRuntimeBootstrapResourceNameFromConfig = exports.resolveConfigRuntimeResourceNameFromConfig = exports.getConfigRuntimeResourceNameFromConfig = exports.getConfigRuntimeBootstrapResourceName = exports.getConfigRuntimeResourceName = exports.getGlobalQpqRuntimeResourceName = exports.getGlobalConfigRuntimeResourceName = void 0;
 const quidproquo_config_aws_1 = require("quidproquo-config-aws");
 const quidproquo_core_1 = require("quidproquo-core");
 const quidproquo_webserver_1 = require("quidproquo-webserver");
@@ -156,6 +156,21 @@ const getCFExportNameWebsocketApiIdFromConfig = (websocketApiName, qpqConfig) =>
     return (0, exports.getQpqRuntimeResourceName)(resourceName, application, service, environment, feature, 'websocket-api-id-export');
 };
 exports.getCFExportNameWebsocketApiIdFromConfig = getCFExportNameWebsocketApiIdFromConfig;
+// SSM parameter holding a websocket api's AWS-generated id, written by the owning service's
+// inf stack. Referencing services resolve it at deploy time to build exact execute-api
+// grants (deploy the owning inf stack first - same owner-publishes/others-read pattern as
+// the domain certificate arn parameter).
+const getWebsocketApiIdSsmParameterName = (websocketApiName, qpqConfig) => {
+    var _a, _b, _c, _d, _e;
+    const websocketApiConfig = quidproquo_webserver_1.qpqWebServerUtils.getWebsocketEntryByApiName(websocketApiName, qpqConfig);
+    const application = ((_a = websocketApiConfig.owner) === null || _a === void 0 ? void 0 : _a.application) || quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
+    const service = ((_b = websocketApiConfig.owner) === null || _b === void 0 ? void 0 : _b.module) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const environment = ((_c = websocketApiConfig.owner) === null || _c === void 0 ? void 0 : _c.environment) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = ((_d = websocketApiConfig.owner) === null || _d === void 0 ? void 0 : _d.feature) || quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    const resourceName = ((_e = websocketApiConfig.owner) === null || _e === void 0 ? void 0 : _e.resourceNameOverride) || websocketApiName;
+    return `/qpq/websocket/api-id/${(0, exports.getConfigRuntimeResourceName)(resourceName, application, service, environment, feature)}`;
+};
+exports.getWebsocketApiIdSsmParameterName = getWebsocketApiIdSsmParameterName;
 const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environment, application, feature) => {
     const topicName = (0, exports.getConfigRuntimeResourceName)(eventBusName, application, module, environment, feature);
     const accountInfo = (0, quidproquo_config_aws_1.getAwsServiceAccountInfoByDeploymentInfo)(qpqConfig, module, environment, feature, application);
@@ -164,6 +179,14 @@ const getEventBusSnsTopicArn = (eventBusName, qpqConfig, module, environment, ap
     return `arn:aws:sns:${region}:${awsAccountId}:${topicName}`;
 };
 exports.getEventBusSnsTopicArn = getEventBusSnsTopicArn;
+// The account stack owns account-level resources (cloud trail, budgets, security services)
+// so they never share an app's lifecycle. The name is deliberately static: stack names are
+// already namespaced per account+region, and the resources it holds meter/audit the whole
+// account - an app/environment segment would only fake a separation that doesn't exist.
+// Everything in one account converges on this one stack, so exactly ONE repo/config must
+// own it, and actor (feature) deploys must not deploy it.
+const getAccountStackName = () => 'qpq-account';
+exports.getAccountStackName = getAccountStackName;
 const getBaseStackName = (qpqConfig) => {
     const appName = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
     const moduleName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);

package/lib/commonjs/getActionProcessor/core/apiKeyValidation/getApiKeyValidationValidateActionProcessor.js

@@ -15,7 +15,8 @@ const quidproquo_core_1 = require("quidproquo-core");
 const quidproquo_webserver_1 = require("quidproquo-webserver");
 const crypto_1 = require("crypto");
 const awsNamingUtils_1 = require("../../../awsNamingUtils");
-const getApiKeys_1 = require("../../../logic/apiGateway/getApiKeys");
+const getApiKeyValue_1 = require("../../../logic/apiGateway/getApiKeyValue");
+const getExportedValue_1 = require("../../../logic/cloudformation/getExportedValue");
 // Constant-time string equality. `timingSafeEqual` throws on length mismatch,
 // so guard the length check — the length itself isn't secret for API keys.
 const safeEqual = (a, b) => {
@@ -28,17 +29,20 @@ const safeEqual = (a, b) => {
 };
 const getProcessApiKeyValidationValidate = (qpqConfig) => {
     const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
-    const application = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
-    const service = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
-    const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
-    const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ apiKeyValue, apiKeyReferences }) {
-        const realApiKeys = yield (0, getApiKeys_1.getApiKeys)(region, ...apiKeyReferences.map((apiKey) => {
-            const apiKeyApplication = apiKey.applicationName || application;
-            const apiKeyService = apiKey.serviceName || service;
-            return (0, awsNamingUtils_1.getConfigRuntimeResourceName)(apiKey.name, apiKeyApplication, apiKeyService, environment, feature);
-        }));
-        const matched = realApiKeys.some((apiKey) => safeEqual(apiKey.value, apiKeyValue));
+        // Fetch each referenced key individually (id via CFN export, then GetApiKey) rather than
+        // listing every key in the account - keeps the IAM grant per-key instead of /apikeys-wide.
+        const realApiKeyValues = yield Promise.all(apiKeyReferences.map((apiKeyReference) => __awaiter(void 0, void 0, void 0, function* () {
+            try {
+                const apiKeyId = yield (0, getExportedValue_1.getExportedValue)((0, awsNamingUtils_1.getCFExportNameApiKeyIdFromConfig)(apiKeyReference.name, qpqConfig, apiKeyReference.serviceName, apiKeyReference.applicationName), region);
+                return yield (0, getApiKeyValue_1.getApiKeyValue)(region, apiKeyId);
+            }
+            catch (_a) {
+                // An unresolvable reference behaves like the old list-and-filter miss - no match
+                return undefined;
+            }
+        })));
+        const matched = realApiKeyValues.some((realApiKeyValue) => safeEqual(realApiKeyValue, apiKeyValue));
         return (0, quidproquo_core_1.actionResult)(matched);
     });
 };

package/lib/commonjs/getActionProcessor/core/event/apiGatwayEvent/api/getEventGetRecordsActionProcessor.js

@@ -15,6 +15,7 @@ const quidproquo_webserver_1 = require("quidproquo-webserver");
 const parseMultipartFormData_1 = require("../../utils/parseMultipartFormData");
 const getProcessGetRecords = (qpqConfig) => {
     const serviceName = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    const fileUploadSettings = quidproquo_webserver_1.qpqWebServerUtils.getFileUploadSettings(qpqConfig);
     return (_a) => __awaiter(void 0, [_a], void 0, function* ({ eventParams: [apiGatewayEvent, context] }) {
         // Initialize `path` by removing the service name prefix from `apiGatewayEvent.path`.
         // This adjustment is necessary because the API gateway routes requests to services based on
@@ -35,7 +36,17 @@ const getProcessGetRecords = (qpqConfig) => {
         };
         // Transform the body if its a multipart/form-data
         if ((quidproquo_webserver_1.qpqWebServerUtils.getHeaderValue('Content-Type', apiGatewayEvent.headers) || '').startsWith('multipart/form-data') && apiGatewayEvent.body) {
-            internalEventRecord.files = yield (0, parseMultipartFormData_1.parseMultipartFormData)(apiGatewayEvent);
+            try {
+                internalEventRecord.files = yield (0, parseMultipartFormData_1.parseMultipartFormData)(apiGatewayEvent, fileUploadSettings);
+            }
+            catch (error) {
+                // Stamp the failure on the record so the auto-respond step returns the matching
+                // 4xx before the route story runs - throwing here would fail the whole event as a 5xx
+                internalEventRecord.fileUploadError =
+                    error instanceof parseMultipartFormData_1.FileUploadValidationError
+                        ? { errorType: error.errorType, message: error.message }
+                        : { errorType: quidproquo_webserver_1.FileUploadErrorTypeEnum.malformed, message: 'Unable to parse multipart/form-data body' };
+            }
         }
         return (0, quidproquo_core_1.actionResult)([internalEventRecord]);
     });

package/lib/commonjs/getActionProcessor/core/event/utils/parseMultipartFormData.d.ts

@@ -1,3 +1,9 @@
 import { QPQBinaryData } from 'quidproquo-core';
+import { FileUploadErrorTypeEnum, FileUploadSettings } from 'quidproquo-webserver';
 import { APIGatewayEvent } from 'aws-lambda';
-export declare const parseMultipartFormData: (event: APIGatewayEvent) => Promise<QPQBinaryData[]>;
+export declare class FileUploadValidationError extends Error {
+    readonly errorType: FileUploadErrorTypeEnum;
+    constructor(errorType: FileUploadErrorTypeEnum, message: string);
+}
+export declare const sanitizeFilename: (filename?: string) => string;
+export declare const parseMultipartFormData: (event: APIGatewayEvent, fileUploadSettings: FileUploadSettings) => Promise<QPQBinaryData[]>;

package/lib/commonjs/getActionProcessor/core/event/utils/parseMultipartFormData.js

@@ -3,42 +3,111 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseMultipartFormData = void 0;
+exports.parseMultipartFormData = exports.sanitizeFilename = exports.FileUploadValidationError = void 0;
+const quidproquo_webserver_1 = require("quidproquo-webserver");
 const busboy_1 = __importDefault(require("busboy"));
-const parseMultipartFormData = (event) => new Promise((resolve, reject) => {
+class FileUploadValidationError extends Error {
+    constructor(errorType, message) {
+        super(message);
+        this.errorType = errorType;
+        this.name = 'FileUploadValidationError';
+    }
+}
+exports.FileUploadValidationError = FileUploadValidationError;
+// Reduce a client-supplied filename to a bare, path-traversal-safe name.
+const sanitizeFilename = (filename) => {
+    const baseName = (filename || '')
+        .split(/[/\\]/)
+        .filter((segment) => segment.length > 0)
+        .pop();
+    // eslint-disable-next-line no-control-regex
+    const cleaned = (baseName || '').replace(/[\x00-\x1f]/g, '');
+    if (!cleaned || cleaned === '.' || cleaned === '..') {
+        return 'unnamed';
+    }
+    return cleaned;
+};
+exports.sanitizeFilename = sanitizeFilename;
+const isMimeTypeAllowed = (mimeType, allowedMimeTypes) => {
+    if (!allowedMimeTypes) {
+        return true;
+    }
+    const normalizedMimeType = (mimeType || '').toLowerCase();
+    return allowedMimeTypes.some((allowed) => {
+        const normalizedAllowed = allowed.toLowerCase();
+        return normalizedAllowed.endsWith('/*')
+            ? normalizedMimeType.startsWith(normalizedAllowed.slice(0, -1))
+            : normalizedMimeType === normalizedAllowed;
+    });
+};
+const parseMultipartFormData = (event, fileUploadSettings) => new Promise((resolve, reject) => {
     const busboy = (0, busboy_1.default)({
         headers: {
             'content-type': event.headers['content-type'] || event.headers['Content-Type'],
         },
+        limits: {
+            fileSize: fileUploadSettings.maxFileSizeBytes,
+            files: fileUploadSettings.maxFileCount,
+            fields: fileUploadSettings.maxFieldCount,
+            fieldSize: fileUploadSettings.maxFieldSizeBytes,
+        },
     });
     const result = {
         files: [],
         fields: {},
     };
+    let settled = false;
+    const rejectOnce = (error) => {
+        if (!settled) {
+            settled = true;
+            reject(error);
+        }
+    };
     busboy.on('file', (name, file, info) => {
-        let fileBuffer = Buffer.alloc(0);
+        const filename = (0, exports.sanitizeFilename)(info.filename);
+        if (!isMimeTypeAllowed(info.mimeType, fileUploadSettings.allowedMimeTypes)) {
+            rejectOnce(new FileUploadValidationError(quidproquo_webserver_1.FileUploadErrorTypeEnum.disallowedMimeType, `File "${filename}" has disallowed content type "${info.mimeType}"`));
+            file.resume();
+            return;
+        }
+        const chunks = [];
         file.on('data', (data) => {
-            fileBuffer = Buffer.concat([fileBuffer, data]); // Concatenate the new data to the existing buffer
+            chunks.push(data);
+        });
+        // Emitted when the stream is truncated at limits.fileSize - a silently truncated upload must fail, not succeed
+        file.on('limit', () => {
+            rejectOnce(new FileUploadValidationError(quidproquo_webserver_1.FileUploadErrorTypeEnum.fileTooLarge, `File "${filename}" exceeds the maximum file size of ${fileUploadSettings.maxFileSizeBytes} bytes`));
         });
         file.on('end', () => {
-            if (fileBuffer.length > 0) {
+            const content = Buffer.concat(chunks);
+            if (!settled && content.length > 0) {
                 result.files.push({
-                    filename: info.filename,
+                    filename,
                     contentType: info.mimeType,
                     encoding: info.encoding,
                     name: name,
-                    content: fileBuffer,
+                    content,
                 });
             }
         });
     });
+    busboy.on('filesLimit', () => {
+        rejectOnce(new FileUploadValidationError(quidproquo_webserver_1.FileUploadErrorTypeEnum.tooManyFiles, `Upload exceeds the maximum of ${fileUploadSettings.maxFileCount} files`));
+    });
+    busboy.on('fieldsLimit', () => {
+        rejectOnce(new FileUploadValidationError(quidproquo_webserver_1.FileUploadErrorTypeEnum.tooManyFields, `Upload exceeds the maximum of ${fileUploadSettings.maxFieldCount} fields`));
+    });
     busboy.on('field', (name, value) => {
         result.fields[name] = value;
     });
     busboy.on('error', (error) => {
-        reject(error);
+        rejectOnce(error);
     });
     busboy.on('finish', () => {
+        if (settled) {
+            return;
+        }
+        settled = true;
         const qpqBinaryFiles = result.files.map((f) => ({
             filename: f.filename,
             mimetype: f.contentType,

package/lib/commonjs/getActionProcessor/core/index.d.ts

@@ -6,6 +6,7 @@ export * from './eventBus';
 export * from './file';
 export * from './graphDatabase';
 export * from './keyValueStore';
+export * from './metric';
 export * from './queue';
 export * from './system';
 export * from './userDirectory';

package/lib/commonjs/getActionProcessor/core/index.js

@@ -32,6 +32,7 @@ __exportStar(require("./eventBus"), exports);
 __exportStar(require("./file"), exports);
 __exportStar(require("./graphDatabase"), exports);
 __exportStar(require("./keyValueStore"), exports);
+__exportStar(require("./metric"), exports);
 __exportStar(require("./queue"), exports);
 __exportStar(require("./system"), exports);
 __exportStar(require("./userDirectory"), exports);
@@ -44,10 +45,11 @@ const eventBus_1 = require("./eventBus");
 const file_1 = require("./file");
 const graphDatabase_1 = require("./graphDatabase");
 const keyValueStore_1 = require("./keyValueStore");
+const metric_1 = require("./metric");
 const queue_1 = require("./queue");
 const system_1 = require("./system");
 const userDirectory_1 = require("./userDirectory");
 const getCoreActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, ai_1.getAiActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, apiKeyValidation_1.getApiKeyValidationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, file_1.getFileActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, keyValueStore_1.getKeyValueStoreActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, queue_1.getQueueActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, userDirectory_1.getUserDirectoryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, eventBus_1.getEventBusActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, system_1.getSystemActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, config_1.getConfigActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, event_1.getApiGatewayApiEventEventProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, graphDatabase_1.getGraphDatabaseActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_webserver_1.getRouteAuthValidationActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, ai_1.getAiActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, apiKeyValidation_1.getApiKeyValidationActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, file_1.getFileActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, keyValueStore_1.getKeyValueStoreActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, metric_1.getMetricActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, queue_1.getQueueActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, userDirectory_1.getUserDirectoryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, eventBus_1.getEventBusActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, system_1.getSystemActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, config_1.getConfigActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, event_1.getApiGatewayApiEventEventProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, graphDatabase_1.getGraphDatabaseActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, quidproquo_webserver_1.getRouteAuthValidationActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getCoreActionProcessor = getCoreActionProcessor;

package/lib/commonjs/getActionProcessor/core/metric/getMetricPutActionProcessor.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getMetricPutActionProcessor: ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/metric/getMetricPutActionProcessor.js

@@ -0,0 +1,51 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMetricPutActionProcessor = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+// Emits the metric as a CloudWatch Embedded Metric Format (EMF) log line: CloudWatch
+// extracts metrics from the function's log stream - no api calls, no extra IAM, no
+// latency on the story. Cost: each unique metricName x dimension-combination is one
+// custom metric (~$0.30/mo) - the standard dimensions are service/environment(/feature),
+// so keep payload dimensions low-cardinality (never per-user / per-request ids).
+const getProcessMetricPut = (qpqConfig) => {
+    // The namespace is the deployed app instance - app/environment(/feature) - mirroring how
+    // every qpq resource name embeds the deployment identity. Apps sharing an account can't
+    // merge same-named metrics, per-developer feature sandboxes (e.g. qpq/docgen/development/jane)
+    // never pollute mainline, and dimensions are reserved for slices WITHIN the deployment
+    // (service + caller-supplied).
+    const application = quidproquo_core_1.qpqCoreUtils.getApplicationName(qpqConfig);
+    const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);
+    const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
+    const namespace = `qpq/${application}/${environment}${feature ? `/${feature}` : ''}`;
+    const service = quidproquo_core_1.qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ metricName, value, unit, dimensions }) {
+        const allDimensions = Object.assign({ service }, dimensions);
+        const emf = Object.assign(Object.assign({ _aws: {
+                Timestamp: Date.now(),
+                CloudWatchMetrics: [
+                    {
+                        Namespace: namespace,
+                        Dimensions: [Object.keys(allDimensions)],
+                        Metrics: [{ Name: metricName, Unit: unit !== null && unit !== void 0 ? unit : quidproquo_core_1.MetricUnit.count }],
+                    },
+                ],
+            } }, allDimensions), { [metricName]: value });
+        console.log(JSON.stringify(emf));
+        return (0, quidproquo_core_1.actionResult)(void 0);
+    });
+};
+const getMetricPutActionProcessor = (qpqConfig) => __awaiter(void 0, void 0, void 0, function* () {
+    return ({
+        [quidproquo_core_1.MetricActionType.Put]: getProcessMetricPut(qpqConfig),
+    });
+});
+exports.getMetricPutActionProcessor = getMetricPutActionProcessor;

package/lib/commonjs/getActionProcessor/core/metric/index.d.ts

@@ -0,0 +1,2 @@
+import { ActionProcessorListResolver } from 'quidproquo-core';
+export declare const getMetricActionProcessor: ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/metric/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMetricActionProcessor = void 0;
+const getMetricPutActionProcessor_1 = require("./getMetricPutActionProcessor");
+const getMetricActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
+    return (Object.assign({}, (yield (0, getMetricPutActionProcessor_1.getMetricPutActionProcessor)(qpqConfig, dynamicModuleLoader))));
+});
+exports.getMetricActionProcessor = getMetricActionProcessor;

package/lib/commonjs/lambdas/dynamicModuleLoader/dynamicModuleLoader.js

@@ -10,9 +10,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dynamicModuleLoader = void 0;
-// @ts-expect-error - Special webpack file injected
+// @ts-expect-error - injected at build time by QpqPlugin (webpack virtual module)
 const quidproquo_dynamic_loader_1 = require("quidproquo-dynamic-loader");
+const federatedModuleStore_1 = require("../../logic/federatedModuleStore");
 const dynamicModuleLoader = (qpqFunctionRuntime) => __awaiter(void 0, void 0, void 0, function* () {
+    // Tier 1: federated. undefined means "nothing published for this runtime" -> fall through.
+    const federatedStory = yield (0, federatedModuleStore_1.loadFederatedStory)(quidproquo_dynamic_loader_1.qpqConfig, qpqFunctionRuntime);
+    if (federatedStory !== undefined) {
+        return federatedStory;
+    }
+    // Tier 2: the statically bundled story (or a fail-fast throw for a thin shell).
     return (0, quidproquo_dynamic_loader_1.qpqDynamicModuleLoader)(qpqFunctionRuntime);
 });
 exports.dynamicModuleLoader = dynamicModuleLoader;

package/lib/commonjs/logic/apiGateway/getApiKeyValue.d.ts

@@ -0,0 +1 @@
+export declare const getApiKeyValue: (region: string, apiKeyId: string) => Promise<string | undefined>;

package/lib/commonjs/logic/apiGateway/{getApiKeys.js → getApiKeyValue.js}

@@ -9,21 +9,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getApiKeys = void 0;
+exports.getApiKeyValue = void 0;
 const client_api_gateway_1 = require("@aws-sdk/client-api-gateway");
 const createAwsClient_1 = require("../createAwsClient");
-const getApiKeys = (region, ...keyNames) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a;
+// Fetch a single api key's value by id - keys are read individually (not listed) so the
+// IAM grant can be scoped per-key with tag conditions rather than the /apikeys collection.
+const getApiKeyValue = (region, apiKeyId) => __awaiter(void 0, void 0, void 0, function* () {
     const apiGatewayClient = (0, createAwsClient_1.createAwsClient)(client_api_gateway_1.APIGatewayClient, { region });
-    const input = {
-        includeValues: true,
-        limit: 500,
-    };
-    const res = yield apiGatewayClient.send(new client_api_gateway_1.GetApiKeysCommand(input));
-    return (((_a = res.items) === null || _a === void 0 ? void 0 : _a.filter((i) => keyNames.indexOf(i.name) >= 0).map((i) => ({
-        name: i.name,
-        value: i.value,
-        description: i.description,
-    }))) || []);
+    const res = yield apiGatewayClient.send(new client_api_gateway_1.GetApiKeyCommand({
+        apiKey: apiKeyId,
+        includeValue: true,
+    }));
+    return res.value;
 });
-exports.getApiKeys = getApiKeys;
+exports.getApiKeyValue = getApiKeyValue;

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleLoadError.d.ts

@@ -0,0 +1,10 @@
+export declare enum FederatedModuleLoadErrorCode {
+    unsupportedStoreUrl = "unsupportedStoreUrl",
+    manifestInvalid = "manifestInvalid",
+    containerLoadFailed = "containerLoadFailed",
+    storyNotExported = "storyNotExported"
+}
+export declare class FederatedModuleLoadError extends Error {
+    readonly code: FederatedModuleLoadErrorCode;
+    constructor(code: FederatedModuleLoadErrorCode, message: string);
+}

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleLoadError.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedModuleLoadError = exports.FederatedModuleLoadErrorCode = void 0;
+// Discriminable failures raised inside loadFederatedStory. All of them are ultimately
+// caught there and turned into a fall-back-to-bundled (with a warning) - they exist so
+// logs/backoff can tell WHY a store didn't load, not to crash the request.
+var FederatedModuleLoadErrorCode;
+(function (FederatedModuleLoadErrorCode) {
+    // Store URL wasn't s3:// or file:// (a config/env mistake).
+    FederatedModuleLoadErrorCode["unsupportedStoreUrl"] = "unsupportedStoreUrl";
+    // manifest.json parsed but is missing required fields (bad/partial publish).
+    FederatedModuleLoadErrorCode["manifestInvalid"] = "manifestInvalid";
+    // A version's files downloaded but the entry didn't expose a valid MF container.
+    FederatedModuleLoadErrorCode["containerLoadFailed"] = "containerLoadFailed";
+    // The manifest exposed the module, but it didn't export the requested story name
+    // (e.g. a story was renamed in the remote but the manifest still lists it).
+    FederatedModuleLoadErrorCode["storyNotExported"] = "storyNotExported";
+})(FederatedModuleLoadErrorCode || (exports.FederatedModuleLoadErrorCode = FederatedModuleLoadErrorCode = {}));
+class FederatedModuleLoadError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'FederatedModuleLoadError';
+    }
+}
+exports.FederatedModuleLoadError = FederatedModuleLoadError;

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleStoreManifest.d.ts

@@ -0,0 +1,8 @@
+export interface FederatedModuleStoreManifest {
+    containerName: string;
+    service: string;
+    hash: string;
+    entry: string;
+    files: string[];
+    exposes: Record<string, string>;
+}

package/lib/commonjs/logic/federatedModuleStore/FederatedModuleStoreManifest.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/commonjs/logic/federatedModuleStore/index.d.ts

@@ -0,0 +1,4 @@
+export * from './FederatedModuleLoadError';
+export * from './FederatedModuleStoreManifest';
+export * from './loadFederatedStory';
+export * from './sharedPackages';

package/lib/commonjs/logic/federatedModuleStore/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./FederatedModuleLoadError"), exports);
+__exportStar(require("./FederatedModuleStoreManifest"), exports);
+__exportStar(require("./loadFederatedStory"), exports);
+__exportStar(require("./sharedPackages"), exports);

package/lib/commonjs/logic/federatedModuleStore/loadFederatedStory.d.ts

@@ -0,0 +1,3 @@
+import { QPQConfig, QpqFunctionRuntime } from 'quidproquo-core';
+export declare const resetFederatedModuleStoreCache: () => void;
+export declare const loadFederatedStory: <T = any>(qpqConfig: QPQConfig, qpqFunctionRuntime: QpqFunctionRuntime) => Promise<T | undefined>;