quidproquo-actionprocessor-awslambda 0.1.22 → 0.1.24

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoGetPublicKeyActionProcessor.d.ts

@@ -0,0 +1 @@
+export declare const getCryptoGetPublicKeyActionProcessor: import("quidproquo-core").ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoGetPublicKeyActionProcessor.js

@@ -0,0 +1,34 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCryptoGetPublicKeyActionProcessor = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const getCachedPublicKey_1 = require("../../../logic/kms/getCachedPublicKey");
+const kmsSigningErrorMap_1 = require("./kmsSigningErrorMap");
+const utils_1 = require("./utils");
+const getProcessCryptoGetPublicKey = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ keyName }) {
+        const keyAlias = (0, utils_1.resolveSigningKeyAlias)(keyName, qpqConfig);
+        if (!keyAlias) {
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askCryptoGetPublicKey.errorType.KeyNotConfigured, (0, kmsSigningErrorMap_1.signingKeyNotConfiguredMessage)(keyName));
+        }
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        try {
+            return (0, quidproquo_core_1.actionResult)(yield (0, getCachedPublicKey_1.getCachedPublicKey)(keyAlias, region));
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, (0, kmsSigningErrorMap_1.kmsSigningErrorMap)(quidproquo_core_1.askCryptoGetPublicKey.errorType, keyName));
+        }
+    });
+};
+exports.getCryptoGetPublicKeyActionProcessor = (0, quidproquo_core_1.createActionProcessor)(quidproquo_core_1.askCryptoGetPublicKey, getProcessCryptoGetPublicKey);
+//# sourceMappingURL=getCryptoGetPublicKeyActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoGetPublicKeyActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCryptoGetPublicKeyActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/getCryptoGetPublicKeyActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAQyB;AAEzB,8EAA2E;AAC3E,6DAA0F;AAC1F,mCAAiD;AAEjD,MAAM,4BAA4B,GAAG,CAAC,SAAoB,EAA8C,EAAE;IACxG,OAAO,KAAoB,EAAE,4CAAf,EAAE,OAAO,EAAE;QACvB,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAA,mCAAiB,EAAC,uCAAqB,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAA,mDAA8B,EAAC,OAAO,CAAC,CAAC,CAAC;QACtH,CAAC;QAED,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,OAAO,IAAA,8BAAY,EAAC,MAAM,IAAA,uCAAkB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE,IAAA,uCAAkB,EAAC,uCAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEW,QAAA,oCAAoC,GAAG,IAAA,uCAAqB,EAAC,uCAAqB,EAAE,4BAA4B,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  askCryptoGetPublicKey,\n  createActionProcessor,\n  ProcessorFor,\n  QPQConfig,\n} from 'quidproquo-core';\n\nimport { getCachedPublicKey } from '../../../logic/kms/getCachedPublicKey';\nimport { kmsSigningErrorMap, signingKeyNotConfiguredMessage } from './kmsSigningErrorMap';\nimport { resolveSigningKeyAlias } from './utils';\n\nconst getProcessCryptoGetPublicKey = (qpqConfig: QPQConfig): ProcessorFor<typeof askCryptoGetPublicKey> => {\n  return async ({ keyName }) => {\n    const keyAlias = resolveSigningKeyAlias(keyName, qpqConfig);\n    if (!keyAlias) {\n      return actionResultError(askCryptoGetPublicKey.errorType.KeyNotConfigured, signingKeyNotConfiguredMessage(keyName));\n    }\n\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    try {\n      return actionResult(await getCachedPublicKey(keyAlias, region));\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, kmsSigningErrorMap(askCryptoGetPublicKey.errorType, keyName));\n    }\n  };\n};\n\nexport const getCryptoGetPublicKeyActionProcessor = createActionProcessor(askCryptoGetPublicKey, getProcessCryptoGetPublicKey);\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoSignActionProcessor.d.ts

@@ -0,0 +1 @@
+export declare const getCryptoSignActionProcessor: import("quidproquo-core").ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoSignActionProcessor.js

@@ -0,0 +1,36 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCryptoSignActionProcessor = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const signWithKey_1 = require("../../../logic/kms/signWithKey");
+const kmsSigningErrorMap_1 = require("./kmsSigningErrorMap");
+const utils_1 = require("./utils");
+const getProcessCryptoSign = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ keyName, message }) {
+        const keyAlias = (0, utils_1.resolveSigningKeyAlias)(keyName, qpqConfig);
+        if (!keyAlias) {
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askCryptoSign.errorType.KeyNotConfigured, (0, kmsSigningErrorMap_1.signingKeyNotConfiguredMessage)(keyName));
+        }
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        try {
+            const signature = yield (0, signWithKey_1.signWithKey)(keyAlias, message, region);
+            return (0, quidproquo_core_1.actionResult)((0, quidproquo_actionprocessor_node_1.base64UrlEncode)(signature));
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, (0, kmsSigningErrorMap_1.kmsSigningErrorMap)(quidproquo_core_1.askCryptoSign.errorType, keyName));
+        }
+    });
+};
+exports.getCryptoSignActionProcessor = (0, quidproquo_core_1.createActionProcessor)(quidproquo_core_1.askCryptoSign, getProcessCryptoSign);
+//# sourceMappingURL=getCryptoSignActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoSignActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCryptoSignActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/getCryptoSignActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAAkE;AAClE,iEAA0D;AAC1D,qDAQyB;AAEzB,gEAA6D;AAC7D,6DAA0F;AAC1F,mCAAiD;AAEjD,MAAM,oBAAoB,GAAG,CAAC,SAAoB,EAAsC,EAAE;IACxF,OAAO,KAA6B,EAAE,4CAAxB,EAAE,OAAO,EAAE,OAAO,EAAE;QAChC,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAA,mCAAiB,EAAC,+BAAa,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAA,mDAA8B,EAAC,OAAO,CAAC,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/D,OAAO,IAAA,8BAAY,EAAC,IAAA,iDAAe,EAAC,SAAS,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE,IAAA,uCAAkB,EAAC,+BAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEW,QAAA,4BAA4B,GAAG,IAAA,uCAAqB,EAAC,+BAAa,EAAE,oBAAoB,CAAC,CAAC","sourcesContent":["import { base64UrlEncode } from 'quidproquo-actionprocessor-node';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  askCryptoSign,\n  createActionProcessor,\n  ProcessorFor,\n  QPQConfig,\n} from 'quidproquo-core';\n\nimport { signWithKey } from '../../../logic/kms/signWithKey';\nimport { kmsSigningErrorMap, signingKeyNotConfiguredMessage } from './kmsSigningErrorMap';\nimport { resolveSigningKeyAlias } from './utils';\n\nconst getProcessCryptoSign = (qpqConfig: QPQConfig): ProcessorFor<typeof askCryptoSign> => {\n  return async ({ keyName, message }) => {\n    const keyAlias = resolveSigningKeyAlias(keyName, qpqConfig);\n    if (!keyAlias) {\n      return actionResultError(askCryptoSign.errorType.KeyNotConfigured, signingKeyNotConfiguredMessage(keyName));\n    }\n\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    try {\n      const signature = await signWithKey(keyAlias, message, region);\n      return actionResult(base64UrlEncode(signature));\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, kmsSigningErrorMap(askCryptoSign.errorType, keyName));\n    }\n  };\n};\n\nexport const getCryptoSignActionProcessor = createActionProcessor(askCryptoSign, getProcessCryptoSign);\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoVerifyActionProcessor.d.ts

@@ -0,0 +1 @@
+export declare const getCryptoVerifyActionProcessor: import("quidproquo-core").ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoVerifyActionProcessor.js

@@ -0,0 +1,38 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCryptoVerifyActionProcessor = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const getCachedPublicKey_1 = require("../../../logic/kms/getCachedPublicKey");
+const kmsSigningErrorMap_1 = require("./kmsSigningErrorMap");
+const utils_1 = require("./utils");
+// Verifies locally against the cached public key rather than calling kms:Verify,
+// so the hot path (every authenticated request) costs no KMS round trip.
+const getProcessCryptoVerify = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ keyName, message, signature }) {
+        const keyAlias = (0, utils_1.resolveSigningKeyAlias)(keyName, qpqConfig);
+        if (!keyAlias) {
+            return (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askCryptoVerify.errorType.KeyNotConfigured, (0, kmsSigningErrorMap_1.signingKeyNotConfiguredMessage)(keyName));
+        }
+        const region = quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);
+        try {
+            const publicKeyPem = yield (0, getCachedPublicKey_1.getCachedPublicKey)(keyAlias, region);
+            return (0, quidproquo_core_1.actionResult)((0, quidproquo_actionprocessor_node_1.rs256Verify)(publicKeyPem, message, signature));
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, Object.assign({ QpqSigningMalformedSignature: (e) => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askCryptoVerify.errorType.MalformedSignature, e.message) }, (0, kmsSigningErrorMap_1.kmsSigningErrorMap)(quidproquo_core_1.askCryptoVerify.errorType, keyName)));
+        }
+    });
+};
+exports.getCryptoVerifyActionProcessor = (0, quidproquo_core_1.createActionProcessor)(quidproquo_core_1.askCryptoVerify, getProcessCryptoVerify);
+//# sourceMappingURL=getCryptoVerifyActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/crypto/getCryptoVerifyActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCryptoVerifyActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/getCryptoVerifyActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA8D;AAC9D,iEAA0D;AAC1D,qDAQyB;AAEzB,8EAA2E;AAC3E,6DAA0F;AAC1F,mCAAiD;AAEjD,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,CAAC,SAAoB,EAAwC,EAAE;IAC5F,OAAO,KAAwC,EAAE,4CAAnC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;QAC3C,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAA,mCAAiB,EAAC,iCAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAA,mDAA8B,EAAC,OAAO,CAAC,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,MAAM,GAAG,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAA,uCAAkB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO,IAAA,8BAAY,EAAC,IAAA,6CAAW,EAAC,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,kBAC3C,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mCAAiB,EAAC,iCAAe,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAC5G,IAAA,uCAAkB,EAAC,iCAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EACzD,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEW,QAAA,8BAA8B,GAAG,IAAA,uCAAqB,EAAC,iCAAe,EAAE,sBAAsB,CAAC,CAAC","sourcesContent":["import { rs256Verify } from 'quidproquo-actionprocessor-node';\nimport { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  askCryptoVerify,\n  createActionProcessor,\n  ProcessorFor,\n  QPQConfig,\n} from 'quidproquo-core';\n\nimport { getCachedPublicKey } from '../../../logic/kms/getCachedPublicKey';\nimport { kmsSigningErrorMap, signingKeyNotConfiguredMessage } from './kmsSigningErrorMap';\nimport { resolveSigningKeyAlias } from './utils';\n\n// Verifies locally against the cached public key rather than calling kms:Verify,\n// so the hot path (every authenticated request) costs no KMS round trip.\nconst getProcessCryptoVerify = (qpqConfig: QPQConfig): ProcessorFor<typeof askCryptoVerify> => {\n  return async ({ keyName, message, signature }) => {\n    const keyAlias = resolveSigningKeyAlias(keyName, qpqConfig);\n    if (!keyAlias) {\n      return actionResultError(askCryptoVerify.errorType.KeyNotConfigured, signingKeyNotConfiguredMessage(keyName));\n    }\n\n    const region = qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig);\n\n    try {\n      const publicKeyPem = await getCachedPublicKey(keyAlias, region);\n      return actionResult(rs256Verify(publicKeyPem, message, signature));\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        QpqSigningMalformedSignature: (e) => actionResultError(askCryptoVerify.errorType.MalformedSignature, e.message),\n        ...kmsSigningErrorMap(askCryptoVerify.errorType, keyName),\n      });\n    }\n  };\n};\n\nexport const getCryptoVerifyActionProcessor = createActionProcessor(askCryptoVerify, getProcessCryptoVerify);\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/index.js

@@ -12,8 +12,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCryptoActionProcessor = void 0;
 const getCryptoDecryptActionProcessor_1 = require("./getCryptoDecryptActionProcessor");
 const getCryptoEncryptActionProcessor_1 = require("./getCryptoEncryptActionProcessor");
+const getCryptoGetPublicKeyActionProcessor_1 = require("./getCryptoGetPublicKeyActionProcessor");
+const getCryptoSignActionProcessor_1 = require("./getCryptoSignActionProcessor");
+const getCryptoVerifyActionProcessor_1 = require("./getCryptoVerifyActionProcessor");
 const getCryptoActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign({}, (yield (0, getCryptoEncryptActionProcessor_1.getCryptoEncryptActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getCryptoDecryptActionProcessor_1.getCryptoDecryptActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getCryptoEncryptActionProcessor_1.getCryptoEncryptActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getCryptoDecryptActionProcessor_1.getCryptoDecryptActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getCryptoSignActionProcessor_1.getCryptoSignActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getCryptoVerifyActionProcessor_1.getCryptoVerifyActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getCryptoGetPublicKeyActionProcessor_1.getCryptoGetPublicKeyActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getCryptoActionProcessor = getCryptoActionProcessor;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/getActionProcessor/core/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,uFAAoF;AACpF,uFAAoF;AAE7E,MAAM,wBAAwB,GAAgC,CACnE,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,iCAC9B,CAAC,MAAM,IAAA,iEAA+B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACvE,CAAC,MAAM,IAAA,iEAA+B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC1E,CAAA;EAAA,CAAC;AANU,QAAA,wBAAwB,4BAMlC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getCryptoDecryptActionProcessor } from './getCryptoDecryptActionProcessor';\nimport { getCryptoEncryptActionProcessor } from './getCryptoEncryptActionProcessor';\n\nexport const getCryptoActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getCryptoEncryptActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getCryptoDecryptActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,uFAAoF;AACpF,uFAAoF;AACpF,iGAA8F;AAC9F,iFAA8E;AAC9E,qFAAkF;AAE3E,MAAM,wBAAwB,GAAgC,CACnE,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,2EAC9B,CAAC,MAAM,IAAA,iEAA+B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACvE,CAAC,MAAM,IAAA,iEAA+B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACvE,CAAC,MAAM,IAAA,2DAA4B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACpE,CAAC,MAAM,IAAA,+DAA8B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACtE,CAAC,MAAM,IAAA,2EAAoC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC/E,CAAA;EAAA,CAAC;AATU,QAAA,wBAAwB,4BASlC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getCryptoDecryptActionProcessor } from './getCryptoDecryptActionProcessor';\nimport { getCryptoEncryptActionProcessor } from './getCryptoEncryptActionProcessor';\nimport { getCryptoGetPublicKeyActionProcessor } from './getCryptoGetPublicKeyActionProcessor';\nimport { getCryptoSignActionProcessor } from './getCryptoSignActionProcessor';\nimport { getCryptoVerifyActionProcessor } from './getCryptoVerifyActionProcessor';\n\nexport const getCryptoActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getCryptoEncryptActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getCryptoDecryptActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getCryptoSignActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getCryptoVerifyActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getCryptoGetPublicKeyActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/kmsSigningErrorMap.d.ts

@@ -0,0 +1,13 @@
+type SigningErrorTypes = {
+    KeyUnavailable: string;
+    Throttling: string;
+};
+export declare const kmsSigningErrorMap: (errorType: SigningErrorTypes, keyName: string) => {
+    NotFoundException: () => import("quidproquo-core").ActionProcessorResult<any>;
+    DisabledException: () => import("quidproquo-core").ActionProcessorResult<any>;
+    KMSInvalidStateException: () => import("quidproquo-core").ActionProcessorResult<any>;
+    AccessDeniedException: () => import("quidproquo-core").ActionProcessorResult<any>;
+    ThrottlingException: () => import("quidproquo-core").ActionProcessorResult<any>;
+};
+export declare const signingKeyNotConfiguredMessage: (keyName: string) => string;
+export {};

package/lib/commonjs/getActionProcessor/core/crypto/kmsSigningErrorMap.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signingKeyNotConfiguredMessage = exports.kmsSigningErrorMap = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+// The KMS exceptions every signing-key processor maps the same way, keyed by
+// error.name as actionResultErrorFromCaughtError expects.
+const kmsSigningErrorMap = (errorType, keyName) => ({
+    NotFoundException: () => (0, quidproquo_core_1.actionResultError)(errorType.KeyUnavailable, `Signing key not found: [${keyName}]`),
+    DisabledException: () => (0, quidproquo_core_1.actionResultError)(errorType.KeyUnavailable, `Signing key is disabled: [${keyName}]`),
+    KMSInvalidStateException: () => (0, quidproquo_core_1.actionResultError)(errorType.KeyUnavailable, `Signing key is in an unusable state: [${keyName}]`),
+    AccessDeniedException: () => (0, quidproquo_core_1.actionResultError)(errorType.KeyUnavailable, `Access denied to signing key: [${keyName}]`),
+    ThrottlingException: () => (0, quidproquo_core_1.actionResultError)(errorType.Throttling, 'Throttling: Rate exceeded'),
+});
+exports.kmsSigningErrorMap = kmsSigningErrorMap;
+const signingKeyNotConfiguredMessage = (keyName) => `Signing key not configured: [${keyName}] - declare it with defineSigningKey`;
+exports.signingKeyNotConfiguredMessage = signingKeyNotConfiguredMessage;
+//# sourceMappingURL=kmsSigningErrorMap.js.map

package/lib/commonjs/getActionProcessor/core/crypto/kmsSigningErrorMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsSigningErrorMap.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/crypto/kmsSigningErrorMap.ts"],"names":[],"mappings":";;;AAAA,qDAAoD;AAOpD,6EAA6E;AAC7E,0DAA0D;AACnD,MAAM,kBAAkB,GAAG,CAAC,SAA4B,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC;IACpF,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,OAAO,GAAG,CAAC;IAC3G,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,SAAS,CAAC,cAAc,EAAE,6BAA6B,OAAO,GAAG,CAAC;IAC7G,wBAAwB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,SAAS,CAAC,cAAc,EAAE,yCAAyC,OAAO,GAAG,CAAC;IAChI,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,SAAS,CAAC,cAAc,EAAE,kCAAkC,OAAO,GAAG,CAAC;IACtH,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC;CAChG,CAAC,CAAC;AANU,QAAA,kBAAkB,sBAM5B;AAEI,MAAM,8BAA8B,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,gCAAgC,OAAO,sCAAsC,CAAC;AAApI,QAAA,8BAA8B,kCAAsG","sourcesContent":["import { actionResultError } from 'quidproquo-core';\n\ntype SigningErrorTypes = {\n  KeyUnavailable: string;\n  Throttling: string;\n};\n\n// The KMS exceptions every signing-key processor maps the same way, keyed by\n// error.name as actionResultErrorFromCaughtError expects.\nexport const kmsSigningErrorMap = (errorType: SigningErrorTypes, keyName: string) => ({\n  NotFoundException: () => actionResultError(errorType.KeyUnavailable, `Signing key not found: [${keyName}]`),\n  DisabledException: () => actionResultError(errorType.KeyUnavailable, `Signing key is disabled: [${keyName}]`),\n  KMSInvalidStateException: () => actionResultError(errorType.KeyUnavailable, `Signing key is in an unusable state: [${keyName}]`),\n  AccessDeniedException: () => actionResultError(errorType.KeyUnavailable, `Access denied to signing key: [${keyName}]`),\n  ThrottlingException: () => actionResultError(errorType.Throttling, 'Throttling: Rate exceeded'),\n});\n\nexport const signingKeyNotConfiguredMessage = (keyName: string) => `Signing key not configured: [${keyName}] - declare it with defineSigningKey`;\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/utils/index.d.ts

@@ -1,2 +1,3 @@
 export * from './createKmsDataKeyProvider';
 export * from './resolveCryptoKeyAlias';
+export * from './resolveSigningKeyAlias';

package/lib/commonjs/getActionProcessor/core/crypto/utils/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./createKmsDataKeyProvider"), exports);
 __exportStar(require("./resolveCryptoKeyAlias"), exports);
+__exportStar(require("./resolveSigningKeyAlias"), exports);
 //# sourceMappingURL=index.js.map

package/lib/commonjs/getActionProcessor/core/crypto/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/getActionProcessor/core/crypto/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,0DAAwC","sourcesContent":["export * from './createKmsDataKeyProvider';\nexport * from './resolveCryptoKeyAlias';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/getActionProcessor/core/crypto/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,0DAAwC;AACxC,2DAAyC","sourcesContent":["export * from './createKmsDataKeyProvider';\nexport * from './resolveCryptoKeyAlias';\nexport * from './resolveSigningKeyAlias';\n"]}

package/lib/commonjs/getActionProcessor/core/crypto/utils/resolveSigningKeyAlias.d.ts

@@ -0,0 +1,2 @@
+import { Nullable, QPQConfig } from 'quidproquo-core';
+export declare const resolveSigningKeyAlias: (signingKeyName: string, qpqConfig: QPQConfig) => Nullable<string>;

package/lib/commonjs/getActionProcessor/core/crypto/utils/resolveSigningKeyAlias.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSigningKeyAlias = void 0;
+const quidproquo_core_1 = require("quidproquo-core");
+const awsNamingUtils_1 = require("../../../../awsNamingUtils");
+// The signing-key twin of resolveCryptoKeyAlias: the deterministic KMS alias the
+// CDK construct derives for a defineSigningKey, or null when none matches so
+// processors can fail with KeyNotConfigured instead of a generic error.
+const resolveSigningKeyAlias = (signingKeyName, qpqConfig) => {
+    var _a, _b;
+    const signingKeyConfig = quidproquo_core_1.qpqCoreUtils.getAllSigningKeyConfigs(qpqConfig).find((k) => k.keyName === signingKeyName);
+    if (!signingKeyConfig) {
+        return null;
+    }
+    const resolvedName = (0, awsNamingUtils_1.getConfigRuntimeResourceNameFromConfigWithServiceOverride)(((_a = signingKeyConfig.owner) === null || _a === void 0 ? void 0 : _a.resourceNameOverride) || signingKeyName, qpqConfig, (_b = signingKeyConfig.owner) === null || _b === void 0 ? void 0 : _b.module);
+    return `alias/${resolvedName}`;
+};
+exports.resolveSigningKeyAlias = resolveSigningKeyAlias;
+//# sourceMappingURL=resolveSigningKeyAlias.js.map

package/lib/commonjs/getActionProcessor/core/crypto/utils/resolveSigningKeyAlias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSigningKeyAlias.js","sourceRoot":"","sources":["../../../../../../src/getActionProcessor/core/crypto/utils/resolveSigningKeyAlias.ts"],"names":[],"mappings":";;;AAAA,qDAAoE;AAEpE,+DAAuG;AAEvG,iFAAiF;AACjF,6EAA6E;AAC7E,wEAAwE;AACjE,MAAM,sBAAsB,GAAG,CAAC,cAAsB,EAAE,SAAoB,EAAoB,EAAE;;IACvG,MAAM,gBAAgB,GAAG,8BAAY,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC;IAEnH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,0EAAyD,EAC5E,CAAA,MAAA,gBAAgB,CAAC,KAAK,0CAAE,oBAAoB,KAAI,cAAc,EAC9D,SAAS,EACT,MAAA,gBAAgB,CAAC,KAAK,0CAAE,MAAM,CAC/B,CAAC;IAEF,OAAO,SAAS,YAAY,EAAE,CAAC;AACjC,CAAC,CAAC;AAdW,QAAA,sBAAsB,0BAcjC","sourcesContent":["import { Nullable, QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { getConfigRuntimeResourceNameFromConfigWithServiceOverride } from '../../../../awsNamingUtils';\n\n// The signing-key twin of resolveCryptoKeyAlias: the deterministic KMS alias the\n// CDK construct derives for a defineSigningKey, or null when none matches so\n// processors can fail with KeyNotConfigured instead of a generic error.\nexport const resolveSigningKeyAlias = (signingKeyName: string, qpqConfig: QPQConfig): Nullable<string> => {\n  const signingKeyConfig = qpqCoreUtils.getAllSigningKeyConfigs(qpqConfig).find((k) => k.keyName === signingKeyName);\n\n  if (!signingKeyConfig) {\n    return null;\n  }\n\n  const resolvedName = getConfigRuntimeResourceNameFromConfigWithServiceOverride(\n    signingKeyConfig.owner?.resourceNameOverride || signingKeyName,\n    qpqConfig,\n    signingKeyConfig.owner?.module,\n  );\n\n  return `alias/${resolvedName}`;\n};\n"]}

package/lib/commonjs/getActionProcessor/core/file/getFileCopyActionProcessor.d.ts

@@ -0,0 +1 @@
+export declare const getFileCopyActionProcessor: import("quidproquo-core").ActionProcessorListResolver;

package/lib/commonjs/getActionProcessor/core/file/getFileCopyActionProcessor.js

@@ -0,0 +1,37 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFileCopyActionProcessor = void 0;
+const quidproquo_config_aws_1 = require("quidproquo-config-aws");
+const quidproquo_core_1 = require("quidproquo-core");
+const s3Utils_1 = require("../../../logic/s3/s3Utils");
+const utils_1 = require("./utils");
+const getProcessFileCopy = (qpqConfig) => {
+    return (_a) => __awaiter(void 0, [_a], void 0, function* ({ sourceDrive, sourceFilepath, targetDrive, targetFilepath, scope }) {
+        try {
+            const sourceBucketName = (0, utils_1.resolveStorageDriveBucketName)(sourceDrive, qpqConfig);
+            const targetBucketName = (0, utils_1.resolveStorageDriveBucketName)(targetDrive, qpqConfig);
+            yield (0, s3Utils_1.copyFile)(sourceBucketName, (0, quidproquo_core_1.composeScopedFilePath)(scope, sourceFilepath), targetBucketName, (0, quidproquo_core_1.composeScopedFilePath)(scope, targetFilepath), quidproquo_config_aws_1.qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig));
+            return (0, quidproquo_core_1.actionResult)(void 0);
+        }
+        catch (error) {
+            return (0, quidproquo_core_1.actionResultErrorFromCaughtError)(error, {
+                AccessDenied: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askFileCopy.errorType.AccessDenied, 'Access denied copying file'),
+                NoSuchBucket: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askFileCopy.errorType.DriveNotFound, `Storage drive not found: ${sourceDrive} or ${targetDrive}`),
+                NoSuchKey: () => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askFileCopy.errorType.FileNotFound, `File not found: ${sourceFilepath}`),
+                StorageDriveNotFoundError: (error) => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askFileCopy.errorType.DriveNotFound, error.message),
+                InvalidScopeError: (error) => (0, quidproquo_core_1.actionResultError)(quidproquo_core_1.askFileCopy.errorType.InvalidScope, error.message),
+            });
+        }
+    });
+};
+exports.getFileCopyActionProcessor = (0, quidproquo_core_1.createActionProcessor)(quidproquo_core_1.askFileCopy, getProcessFileCopy);
+//# sourceMappingURL=getFileCopyActionProcessor.js.map

package/lib/commonjs/getActionProcessor/core/file/getFileCopyActionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFileCopyActionProcessor.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/getFileCopyActionProcessor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,iEAA0D;AAC1D,qDAUyB;AAEzB,uDAAqD;AACrD,mCAAwD;AAExD,MAAM,kBAAkB,GAAG,CAAC,SAAoB,EAAoC,EAAE;IACpF,OAAO,KAA4E,EAAE,4CAAvE,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAA,qCAA6B,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/E,MAAM,gBAAgB,GAAG,IAAA,qCAA6B,EAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAE/E,MAAM,IAAA,kBAAQ,EACZ,gBAAgB,EAChB,IAAA,uCAAqB,EAAC,KAAK,EAAE,cAAc,CAAC,EAC5C,gBAAgB,EAChB,IAAA,uCAAqB,EAAC,KAAK,EAAE,cAAc,CAAC,EAC5C,yCAAiB,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAC9D,CAAC;YAEF,OAAO,IAAA,8BAAY,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAA,kDAAgC,EAAC,KAAK,EAAE;gBAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,6BAAW,CAAC,SAAS,CAAC,YAAY,EAAE,4BAA4B,CAAC;gBACvG,YAAY,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,6BAAW,CAAC,SAAS,CAAC,aAAa,EAAE,4BAA4B,WAAW,OAAO,WAAW,EAAE,CAAC;gBACvI,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAiB,EAAC,6BAAW,CAAC,SAAS,CAAC,YAAY,EAAE,mBAAmB,cAAc,EAAE,CAAC;gBAC3G,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAiB,EAAC,6BAAW,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC;gBAC3G,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAiB,EAAC,6BAAW,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;aACnG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAA,CAAC;AACJ,CAAC,CAAC;AAEW,QAAA,0BAA0B,GAAG,IAAA,uCAAqB,EAAC,6BAAW,EAAE,kBAAkB,CAAC,CAAC","sourcesContent":["import { qpqConfigAwsUtils } from 'quidproquo-config-aws';\nimport {\n  actionResult,\n  actionResultError,\n  actionResultErrorFromCaughtError,\n  askFileCopy,\n  composeScopedFilePath,\n  createActionProcessor,\n  FileActionType,\n  ProcessorFor,\n  QPQConfig,\n} from 'quidproquo-core';\n\nimport { copyFile } from '../../../logic/s3/s3Utils';\nimport { resolveStorageDriveBucketName } from './utils';\n\nconst getProcessFileCopy = (qpqConfig: QPQConfig): ProcessorFor<typeof askFileCopy> => {\n  return async ({ sourceDrive, sourceFilepath, targetDrive, targetFilepath, scope }) => {\n    try {\n      const sourceBucketName = resolveStorageDriveBucketName(sourceDrive, qpqConfig);\n      const targetBucketName = resolveStorageDriveBucketName(targetDrive, qpqConfig);\n\n      await copyFile(\n        sourceBucketName,\n        composeScopedFilePath(scope, sourceFilepath),\n        targetBucketName,\n        composeScopedFilePath(scope, targetFilepath),\n        qpqConfigAwsUtils.getApplicationModuleDeployRegion(qpqConfig),\n      );\n\n      return actionResult(void 0);\n    } catch (error: unknown) {\n      return actionResultErrorFromCaughtError(error, {\n        AccessDenied: () => actionResultError(askFileCopy.errorType.AccessDenied, 'Access denied copying file'),\n        NoSuchBucket: () => actionResultError(askFileCopy.errorType.DriveNotFound, `Storage drive not found: ${sourceDrive} or ${targetDrive}`),\n        NoSuchKey: () => actionResultError(askFileCopy.errorType.FileNotFound, `File not found: ${sourceFilepath}`),\n        StorageDriveNotFoundError: (error) => actionResultError(askFileCopy.errorType.DriveNotFound, error.message),\n        InvalidScopeError: (error) => actionResultError(askFileCopy.errorType.InvalidScope, error.message),\n      });\n    }\n  };\n};\n\nexport const getFileCopyActionProcessor = createActionProcessor(askFileCopy, getProcessFileCopy);\n"]}

package/lib/commonjs/getActionProcessor/core/file/index.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getFileActionProcessor = void 0;
+const getFileCopyActionProcessor_1 = require("./getFileCopyActionProcessor");
 const getFileDeleteActionProcessor_1 = require("./getFileDeleteActionProcessor");
 const getFileExistsActionProcessor_1 = require("./getFileExistsActionProcessor");
 const getFileGenerateTemporarySecureUrlActionProcessor_1 = require("./getFileGenerateTemporarySecureUrlActionProcessor");
@@ -24,7 +25,7 @@ const getFileWriteBinaryContentsActionProcessor_1 = require("./getFileWriteBinar
 const getFileWriteObjectJsonActionProcessor_1 = require("./getFileWriteObjectJsonActionProcessor");
 const getFileWriteTextContentsActionProcessor_1 = require("./getFileWriteTextContentsActionProcessor");
 const getFileActionProcessor = (qpqConfig, dynamicModuleLoader) => __awaiter(void 0, void 0, void 0, function* () {
-    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getFileDeleteActionProcessor_1.getFileDeleteActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileExistsActionProcessor_1.getFileExistsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileGenerateTemporarySecureUrlActionProcessor_1.getFileGenerateTemporarySecureUrlActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileGenerateTemporaryUploadSecureUrlActionProcessor_1.getFileGenerateTemporaryUploadSecureUrlActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileIsColdStorageActionProcessor_1.getFileIsColdStorageActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileListDirectoryActionProcessor_1.getFileListDirectoryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadTextContentsActionProcessor_1.getFileReadTextContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadObjectJsonActionProcessor_1.getFileReadObjectJsonActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteTextContentsActionProcessor_1.getFileWriteTextContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadBinaryContentsActionProcessor_1.getFileReadBinaryContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteObjectJsonActionProcessor_1.getFileWriteObjectJsonActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteBinaryContentsActionProcessor_1.getFileWriteBinaryContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileStreamOpenActionProcessor_1.getFileStreamOpenActionProcessor)(qpqConfig, dynamicModuleLoader))));
+    return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (yield (0, getFileCopyActionProcessor_1.getFileCopyActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileDeleteActionProcessor_1.getFileDeleteActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileExistsActionProcessor_1.getFileExistsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileGenerateTemporarySecureUrlActionProcessor_1.getFileGenerateTemporarySecureUrlActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileGenerateTemporaryUploadSecureUrlActionProcessor_1.getFileGenerateTemporaryUploadSecureUrlActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileIsColdStorageActionProcessor_1.getFileIsColdStorageActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileListDirectoryActionProcessor_1.getFileListDirectoryActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadTextContentsActionProcessor_1.getFileReadTextContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadObjectJsonActionProcessor_1.getFileReadObjectJsonActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteTextContentsActionProcessor_1.getFileWriteTextContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileReadBinaryContentsActionProcessor_1.getFileReadBinaryContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteObjectJsonActionProcessor_1.getFileWriteObjectJsonActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileWriteBinaryContentsActionProcessor_1.getFileWriteBinaryContentsActionProcessor)(qpqConfig, dynamicModuleLoader))), (yield (0, getFileStreamOpenActionProcessor_1.getFileStreamOpenActionProcessor)(qpqConfig, dynamicModuleLoader))));
 });
 exports.getFileActionProcessor = getFileActionProcessor;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/getActionProcessor/core/file/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,iFAA8E;AAC9E,iFAA8E;AAC9E,yHAAsH;AACtH,qIAAkI;AAClI,+FAA4F;AAC5F,+FAA4F;AAC5F,yGAAsG;AACtG,iGAA8F;AAC9F,qGAAkG;AAClG,yFAAsF;AACtF,2GAAwG;AACxG,mGAAgG;AAChG,uGAAoG;AAE7F,MAAM,sBAAsB,GAAgC,CACjE,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,2LAC9B,CAAC,MAAM,IAAA,2DAA4B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACpE,CAAC,MAAM,IAAA,2DAA4B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACpE,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,+GAAsD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC9F,CAAC,MAAM,IAAA,yEAAmC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC3E,CAAC,MAAM,IAAA,yEAAmC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC3E,CAAC,MAAM,IAAA,+EAAsC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC9E,CAAC,MAAM,IAAA,2EAAoC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC5E,CAAC,MAAM,IAAA,iFAAuC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/E,CAAC,MAAM,IAAA,mFAAwC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAChF,CAAC,MAAM,IAAA,6EAAqC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7E,CAAC,MAAM,IAAA,qFAAyC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACjF,CAAC,MAAM,IAAA,mEAAgC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC3E,CAAA;EAAA,CAAC;AAjBU,QAAA,sBAAsB,0BAiBhC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getFileDeleteActionProcessor } from './getFileDeleteActionProcessor';\nimport { getFileExistsActionProcessor } from './getFileExistsActionProcessor';\nimport { getFileGenerateTemporarySecureUrlActionProcessor } from './getFileGenerateTemporarySecureUrlActionProcessor';\nimport { getFileGenerateTemporaryUploadSecureUrlActionProcessor } from './getFileGenerateTemporaryUploadSecureUrlActionProcessor';\nimport { getFileIsColdStorageActionProcessor } from './getFileIsColdStorageActionProcessor';\nimport { getFileListDirectoryActionProcessor } from './getFileListDirectoryActionProcessor';\nimport { getFileReadBinaryContentsActionProcessor } from './getFileReadBinaryContentsActionProcessor';\nimport { getFileReadObjectJsonActionProcessor } from './getFileReadObjectJsonActionProcessor';\nimport { getFileReadTextContentsActionProcessor } from './getFileReadTextContentsActionProcessor';\nimport { getFileStreamOpenActionProcessor } from './getFileStreamOpenActionProcessor';\nimport { getFileWriteBinaryContentsActionProcessor } from './getFileWriteBinaryContentsActionProcessor';\nimport { getFileWriteObjectJsonActionProcessor } from './getFileWriteObjectJsonActionProcessor';\nimport { getFileWriteTextContentsActionProcessor } from './getFileWriteTextContentsActionProcessor';\n\nexport const getFileActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getFileDeleteActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileExistsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileGenerateTemporarySecureUrlActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileGenerateTemporaryUploadSecureUrlActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileIsColdStorageActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileListDirectoryActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadTextContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadObjectJsonActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteTextContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadBinaryContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteObjectJsonActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteBinaryContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileStreamOpenActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/getActionProcessor/core/file/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,6EAA0E;AAC1E,iFAA8E;AAC9E,iFAA8E;AAC9E,yHAAsH;AACtH,qIAAkI;AAClI,+FAA4F;AAC5F,+FAA4F;AAC5F,yGAAsG;AACtG,iGAA8F;AAC9F,qGAAkG;AAClG,yFAAsF;AACtF,2GAAwG;AACxG,mGAAgG;AAChG,uGAAoG;AAE7F,MAAM,sBAAsB,GAAgC,CACjE,SAAoB,EACpB,mBAAwC,EACV,EAAE;IAAC,OAAA,yMAC9B,CAAC,MAAM,IAAA,uDAA0B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAClE,CAAC,MAAM,IAAA,2DAA4B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACpE,CAAC,MAAM,IAAA,2DAA4B,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACpE,CAAC,MAAM,IAAA,mGAAgD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACxF,CAAC,MAAM,IAAA,+GAAsD,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC9F,CAAC,MAAM,IAAA,yEAAmC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC3E,CAAC,MAAM,IAAA,yEAAmC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC3E,CAAC,MAAM,IAAA,+EAAsC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC9E,CAAC,MAAM,IAAA,2EAAoC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC5E,CAAC,MAAM,IAAA,iFAAuC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC/E,CAAC,MAAM,IAAA,mFAAwC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAChF,CAAC,MAAM,IAAA,6EAAqC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GAC7E,CAAC,MAAM,IAAA,qFAAyC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,GACjF,CAAC,MAAM,IAAA,mEAAgC,EAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC3E,CAAA;EAAA,CAAC;AAlBU,QAAA,sBAAsB,0BAkBhC","sourcesContent":["import { ActionProcessorList, ActionProcessorListResolver, DynamicModuleLoader, QPQConfig } from 'quidproquo-core';\n\nimport { getFileCopyActionProcessor } from './getFileCopyActionProcessor';\nimport { getFileDeleteActionProcessor } from './getFileDeleteActionProcessor';\nimport { getFileExistsActionProcessor } from './getFileExistsActionProcessor';\nimport { getFileGenerateTemporarySecureUrlActionProcessor } from './getFileGenerateTemporarySecureUrlActionProcessor';\nimport { getFileGenerateTemporaryUploadSecureUrlActionProcessor } from './getFileGenerateTemporaryUploadSecureUrlActionProcessor';\nimport { getFileIsColdStorageActionProcessor } from './getFileIsColdStorageActionProcessor';\nimport { getFileListDirectoryActionProcessor } from './getFileListDirectoryActionProcessor';\nimport { getFileReadBinaryContentsActionProcessor } from './getFileReadBinaryContentsActionProcessor';\nimport { getFileReadObjectJsonActionProcessor } from './getFileReadObjectJsonActionProcessor';\nimport { getFileReadTextContentsActionProcessor } from './getFileReadTextContentsActionProcessor';\nimport { getFileStreamOpenActionProcessor } from './getFileStreamOpenActionProcessor';\nimport { getFileWriteBinaryContentsActionProcessor } from './getFileWriteBinaryContentsActionProcessor';\nimport { getFileWriteObjectJsonActionProcessor } from './getFileWriteObjectJsonActionProcessor';\nimport { getFileWriteTextContentsActionProcessor } from './getFileWriteTextContentsActionProcessor';\n\nexport const getFileActionProcessor: ActionProcessorListResolver = async (\n  qpqConfig: QPQConfig,\n  dynamicModuleLoader: DynamicModuleLoader,\n): Promise<ActionProcessorList> => ({\n  ...(await getFileCopyActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileDeleteActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileExistsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileGenerateTemporarySecureUrlActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileGenerateTemporaryUploadSecureUrlActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileIsColdStorageActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileListDirectoryActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadTextContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadObjectJsonActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteTextContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileReadBinaryContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteObjectJsonActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileWriteBinaryContentsActionProcessor(qpqConfig, dynamicModuleLoader)),\n  ...(await getFileStreamOpenActionProcessor(qpqConfig, dynamicModuleLoader)),\n});\n"]}

package/lib/commonjs/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.d.ts

@@ -3,5 +3,13 @@ import { KeyValueStoreQPQConfigSetting, KvsQueryOperation, Nullable } from 'quid
  * Pick the GSI that can serve the query, or null to query the primary table.
  * Returns the GSI's partition key name, which is also its index name (the CDK
  * construct names each GSI after its partition key).
+ *
+ * A Query MUST constrain the partition key of whatever it runs against. So: if
+ * the query names the primary partition key, the primary table can serve it
+ * (strongly consistent, and its sort key is available) - prefer it over any GSI.
+ * Otherwise route to the GSI whose partition key the query names. Deciding on
+ * the primary SORT key instead is wrong: a GSI commonly has the primary sort key
+ * as its partition key (pk userId / sk tenantId with a GSI on tenantId), and a
+ * query on that key alone can only be served by the GSI.
  */
 export declare const getDynamoTableIndexByConfigAndQuery: (setting: KeyValueStoreQPQConfigSetting, query: KvsQueryOperation) => Nullable<string>;

package/lib/commonjs/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.js

@@ -6,15 +6,20 @@ const flattenKvsQueryConditions_1 = require("./flattenKvsQueryConditions");
  * Pick the GSI that can serve the query, or null to query the primary table.
  * Returns the GSI's partition key name, which is also its index name (the CDK
  * construct names each GSI after its partition key).
+ *
+ * A Query MUST constrain the partition key of whatever it runs against. So: if
+ * the query names the primary partition key, the primary table can serve it
+ * (strongly consistent, and its sort key is available) - prefer it over any GSI.
+ * Otherwise route to the GSI whose partition key the query names. Deciding on
+ * the primary SORT key instead is wrong: a GSI commonly has the primary sort key
+ * as its partition key (pk userId / sk tenantId with a GSI on tenantId), and a
+ * query on that key alone can only be served by the GSI.
  */
 const getDynamoTableIndexByConfigAndQuery = (setting, query) => {
     var _a;
     const queriedKeys = (0, flattenKvsQueryConditions_1.flattenKvsQueryConditions)(query).map((condition) => condition.key);
-    // If the query includes the primary sort key, the primary table is a direct
-    // match: prefer it over any GSI so we never land on a GSI with a non-SK
-    // condition.
-    const primarySortKey = (_a = setting.sortKeys[0]) === null || _a === void 0 ? void 0 : _a.key;
-    if (primarySortKey && queriedKeys.includes(primarySortKey)) {
+    const primaryPartitionKey = (_a = setting.partitionKey) === null || _a === void 0 ? void 0 : _a.key;
+    if (primaryPartitionKey && queriedKeys.includes(primaryPartitionKey)) {
         return null;
     }
     const matchingIndex = setting.indexes.find((index) => queriedKeys.includes(index.partitionKey.key));

package/lib/commonjs/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"getDynamoTableIndexByConfigAndQuery.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.ts"],"names":[],"mappings":";;;AAEA,2EAAwE;AAExE;;;;GAIG;AACI,MAAM,mCAAmC,GAAG,CAAC,OAAsC,EAAE,KAAwB,EAAoB,EAAE;;IACxI,MAAM,WAAW,GAAG,IAAA,qDAAyB,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAEvF,4EAA4E;IAC5E,wEAAwE;IACxE,aAAa;IACb,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,0CAAE,GAAG,CAAC;IAChD,IAAI,cAAc,IAAI,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpG,OAAO,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC,CAAC;AAdW,QAAA,mCAAmC,uCAc9C","sourcesContent":["import { KeyValueStoreQPQConfigSetting, KvsQueryOperation, Nullable } from 'quidproquo-core';\n\nimport { flattenKvsQueryConditions } from './flattenKvsQueryConditions';\n\n/**\n * Pick the GSI that can serve the query, or null to query the primary table.\n * Returns the GSI's partition key name, which is also its index name (the CDK\n * construct names each GSI after its partition key).\n */\nexport const getDynamoTableIndexByConfigAndQuery = (setting: KeyValueStoreQPQConfigSetting, query: KvsQueryOperation): Nullable<string> => {\n  const queriedKeys = flattenKvsQueryConditions(query).map((condition) => condition.key);\n\n  // If the query includes the primary sort key, the primary table is a direct\n  // match: prefer it over any GSI so we never land on a GSI with a non-SK\n  // condition.\n  const primarySortKey = setting.sortKeys[0]?.key;\n  if (primarySortKey && queriedKeys.includes(primarySortKey)) {\n    return null;\n  }\n\n  const matchingIndex = setting.indexes.find((index) => queriedKeys.includes(index.partitionKey.key));\n\n  return matchingIndex ? matchingIndex.partitionKey.key : null;\n};\n"]}
+{"version":3,"file":"getDynamoTableIndexByConfigAndQuery.js","sourceRoot":"","sources":["../../../../../src/logic/dynamo/qpqDynamoOrm/getDynamoTableIndexByConfigAndQuery.ts"],"names":[],"mappings":";;;AAEA,2EAAwE;AAExE;;;;;;;;;;;;GAYG;AACI,MAAM,mCAAmC,GAAG,CAAC,OAAsC,EAAE,KAAwB,EAAoB,EAAE;;IACxI,MAAM,WAAW,GAAG,IAAA,qDAAyB,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAEvF,MAAM,mBAAmB,GAAG,MAAA,OAAO,CAAC,YAAY,0CAAE,GAAG,CAAC;IACtD,IAAI,mBAAmB,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpG,OAAO,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC,CAAC;AAXW,QAAA,mCAAmC,uCAW9C","sourcesContent":["import { KeyValueStoreQPQConfigSetting, KvsQueryOperation, Nullable } from 'quidproquo-core';\n\nimport { flattenKvsQueryConditions } from './flattenKvsQueryConditions';\n\n/**\n * Pick the GSI that can serve the query, or null to query the primary table.\n * Returns the GSI's partition key name, which is also its index name (the CDK\n * construct names each GSI after its partition key).\n *\n * A Query MUST constrain the partition key of whatever it runs against. So: if\n * the query names the primary partition key, the primary table can serve it\n * (strongly consistent, and its sort key is available) - prefer it over any GSI.\n * Otherwise route to the GSI whose partition key the query names. Deciding on\n * the primary SORT key instead is wrong: a GSI commonly has the primary sort key\n * as its partition key (pk userId / sk tenantId with a GSI on tenantId), and a\n * query on that key alone can only be served by the GSI.\n */\nexport const getDynamoTableIndexByConfigAndQuery = (setting: KeyValueStoreQPQConfigSetting, query: KvsQueryOperation): Nullable<string> => {\n  const queriedKeys = flattenKvsQueryConditions(query).map((condition) => condition.key);\n\n  const primaryPartitionKey = setting.partitionKey?.key;\n  if (primaryPartitionKey && queriedKeys.includes(primaryPartitionKey)) {\n    return null;\n  }\n\n  const matchingIndex = setting.indexes.find((index) => queriedKeys.includes(index.partitionKey.key));\n\n  return matchingIndex ? matchingIndex.partitionKey.key : null;\n};\n"]}

package/lib/commonjs/logic/kms/getCachedPublicKey.d.ts

@@ -0,0 +1 @@
+export declare const getCachedPublicKey: (keyAlias: string, region: string) => Promise<string>;

package/lib/commonjs/logic/kms/getCachedPublicKey.js

@@ -0,0 +1,45 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedPublicKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+// The public half of a signing key is immutable for the life of the key, so it is
+// fetched once per alias per runtime and verification runs locally from then on:
+// askCryptoVerify costs no KMS call after warm-up, and needs no kms:Verify grant.
+// Bounded by age only so a key replaced under the same alias is picked up.
+const PUBLIC_KEY_MAX_AGE_MS = 60 * 60 * 1000;
+const cache = new Map();
+const getCachedPublicKey = (keyAlias, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const cacheKey = `${region}|${keyAlias}`;
+    const cached = cache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.publicKeyPem;
+    }
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.GetPublicKeyCommand({
+        KeyId: keyAlias,
+    }));
+    if (!response.PublicKey) {
+        throw new Error(`KMS returned no public key for [${keyAlias}]`);
+    }
+    const publicKeyPem = (0, quidproquo_actionprocessor_node_1.spkiDerToPem)(Buffer.from(response.PublicKey));
+    cache.set(cacheKey, {
+        publicKeyPem,
+        expiresAt: Date.now() + PUBLIC_KEY_MAX_AGE_MS,
+    });
+    return publicKeyPem;
+});
+exports.getCachedPublicKey = getCachedPublicKey;
+//# sourceMappingURL=getCachedPublicKey.js.map

package/lib/commonjs/logic/kms/getCachedPublicKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getCachedPublicKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/getCachedPublicKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA+D;AAE/D,oDAAqE;AAErE,wDAAqD;AAErD,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAO7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE1C,MAAM,kBAAkB,GAAG,CAAO,QAAgB,EAAE,MAAc,EAAmB,EAAE;IAC5F,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,gCAAmB,CAAC;QACtB,KAAK,EAAE,QAAQ;KAChB,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,8CAAY,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEnE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;QAClB,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB;KAC9C,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AA9BW,QAAA,kBAAkB,sBA8B7B","sourcesContent":["import { spkiDerToPem } from 'quidproquo-actionprocessor-node';\n\nimport { GetPublicKeyCommand, KMSClient } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// The public half of a signing key is immutable for the life of the key, so it is\n// fetched once per alias per runtime and verification runs locally from then on:\n// askCryptoVerify costs no KMS call after warm-up, and needs no kms:Verify grant.\n// Bounded by age only so a key replaced under the same alias is picked up.\nconst PUBLIC_KEY_MAX_AGE_MS = 60 * 60 * 1000;\n\ntype CachedPublicKey = {\n  publicKeyPem: string;\n  expiresAt: number;\n};\n\nconst cache = new Map<string, CachedPublicKey>();\n\nexport const getCachedPublicKey = async (keyAlias: string, region: string): Promise<string> => {\n  const cacheKey = `${region}|${keyAlias}`;\n\n  const cached = cache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.publicKeyPem;\n  }\n\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new GetPublicKeyCommand({\n      KeyId: keyAlias,\n    }),\n  );\n\n  if (!response.PublicKey) {\n    throw new Error(`KMS returned no public key for [${keyAlias}]`);\n  }\n\n  const publicKeyPem = spkiDerToPem(Buffer.from(response.PublicKey));\n\n  cache.set(cacheKey, {\n    publicKeyPem,\n    expiresAt: Date.now() + PUBLIC_KEY_MAX_AGE_MS,\n  });\n\n  return publicKeyPem;\n};\n"]}

package/lib/commonjs/logic/kms/signWithKey.d.ts

@@ -0,0 +1 @@
+export declare const signWithKey: (keyAlias: string, message: string, region: string) => Promise<Buffer>;

package/lib/commonjs/logic/kms/signWithKey.js

@@ -0,0 +1,34 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signWithKey = void 0;
+const quidproquo_actionprocessor_node_1 = require("quidproquo-actionprocessor-node");
+const client_kms_1 = require("@aws-sdk/client-kms");
+const createAwsClient_1 = require("../createAwsClient");
+// One kms:Sign per call: the private key never leaves KMS, so there is nothing
+// to cache here. Returns the raw signature bytes.
+const signWithKey = (keyAlias, message, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const kmsClient = (0, createAwsClient_1.createAwsClient)(client_kms_1.KMSClient, {
+        region,
+    });
+    const response = yield kmsClient.send(new client_kms_1.SignCommand({
+        KeyId: keyAlias,
+        Message: Buffer.from(message, 'utf8'),
+        MessageType: 'RAW',
+        SigningAlgorithm: quidproquo_actionprocessor_node_1.RS256_KMS_SIGNING_ALGORITHM,
+    }));
+    if (!response.Signature) {
+        throw new Error(`KMS returned no signature for [${keyAlias}]`);
+    }
+    return Buffer.from(response.Signature);
+});
+exports.signWithKey = signWithKey;
+//# sourceMappingURL=signWithKey.js.map

package/lib/commonjs/logic/kms/signWithKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signWithKey.js","sourceRoot":"","sources":["../../../../src/logic/kms/signWithKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qFAA8E;AAE9E,oDAA6D;AAE7D,wDAAqD;AAErD,+EAA+E;AAC/E,kDAAkD;AAC3C,MAAM,WAAW,GAAG,CAAO,QAAgB,EAAE,OAAe,EAAE,MAAc,EAAmB,EAAE;IACtG,MAAM,SAAS,GAAG,IAAA,iCAAe,EAAC,sBAAS,EAAE;QAC3C,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,wBAAW,CAAC;QACd,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,6DAA2B;KAC9C,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC,CAAA,CAAC;AAnBW,QAAA,WAAW,eAmBtB","sourcesContent":["import { RS256_KMS_SIGNING_ALGORITHM } from 'quidproquo-actionprocessor-node';\n\nimport { KMSClient, SignCommand } from '@aws-sdk/client-kms';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// One kms:Sign per call: the private key never leaves KMS, so there is nothing\n// to cache here. Returns the raw signature bytes.\nexport const signWithKey = async (keyAlias: string, message: string, region: string): Promise<Buffer> => {\n  const kmsClient = createAwsClient(KMSClient, {\n    region,\n  });\n\n  const response = await kmsClient.send(\n    new SignCommand({\n      KeyId: keyAlias,\n      Message: Buffer.from(message, 'utf8'),\n      MessageType: 'RAW',\n      SigningAlgorithm: RS256_KMS_SIGNING_ALGORITHM,\n    }),\n  );\n\n  if (!response.Signature) {\n    throw new Error(`KMS returned no signature for [${keyAlias}]`);\n  }\n\n  return Buffer.from(response.Signature);\n};\n"]}

package/lib/commonjs/logic/s3/copyFile.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Server-side copies one object to another key (same or another bucket). The default COPY metadata
+ * directive carries the stored Content-Type / Content-Disposition across unchanged.
+ */
+export declare const copyFile: (sourceBucketName: string, sourceKey: string, targetBucketName: string, targetKey: string, region: string) => Promise<void>;

package/lib/commonjs/logic/s3/copyFile.js

@@ -0,0 +1,31 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copyFile = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const createAwsClient_1 = require("../createAwsClient");
+// CopySource is a URL path, so each key segment is percent-encoded (a key can hold spaces, '+', '#'...);
+// the '/' between segments stays a separator.
+const encodeCopySource = (bucketName, key) => `${bucketName}/${key.split('/').map(encodeURIComponent).join('/')}`;
+/**
+ * Server-side copies one object to another key (same or another bucket). The default COPY metadata
+ * directive carries the stored Content-Type / Content-Disposition across unchanged.
+ */
+const copyFile = (sourceBucketName, sourceKey, targetBucketName, targetKey, region) => __awaiter(void 0, void 0, void 0, function* () {
+    const s3Client = (0, createAwsClient_1.createAwsClient)(client_s3_1.S3Client, { region });
+    yield s3Client.send(new client_s3_1.CopyObjectCommand({
+        CopySource: encodeCopySource(sourceBucketName, sourceKey),
+        Bucket: targetBucketName,
+        Key: targetKey,
+    }));
+});
+exports.copyFile = copyFile;
+//# sourceMappingURL=copyFile.js.map

package/lib/commonjs/logic/s3/copyFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copyFile.js","sourceRoot":"","sources":["../../../../src/logic/s3/copyFile.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,kDAAiE;AAEjE,wDAAqD;AAErD,yGAAyG;AACzG,8CAA8C;AAC9C,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAE,GAAW,EAAU,EAAE,CAAC,GAAG,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1I;;;GAGG;AACI,MAAM,QAAQ,GAAG,CACtB,gBAAwB,EACxB,SAAiB,EACjB,gBAAwB,EACxB,SAAiB,EACjB,MAAc,EACC,EAAE;IACjB,MAAM,QAAQ,GAAG,IAAA,iCAAe,EAAC,oBAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,CAAC,IAAI,CACjB,IAAI,6BAAiB,CAAC;QACpB,UAAU,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,SAAS,CAAC;QACzD,MAAM,EAAE,gBAAgB;QACxB,GAAG,EAAE,SAAS;KACf,CAAC,CACH,CAAC;AACJ,CAAC,CAAA,CAAC;AAhBW,QAAA,QAAQ,YAgBnB","sourcesContent":["import { CopyObjectCommand, S3Client } from '@aws-sdk/client-s3';\n\nimport { createAwsClient } from '../createAwsClient';\n\n// CopySource is a URL path, so each key segment is percent-encoded (a key can hold spaces, '+', '#'...);\n// the '/' between segments stays a separator.\nconst encodeCopySource = (bucketName: string, key: string): string => `${bucketName}/${key.split('/').map(encodeURIComponent).join('/')}`;\n\n/**\n * Server-side copies one object to another key (same or another bucket). The default COPY metadata\n * directive carries the stored Content-Type / Content-Disposition across unchanged.\n */\nexport const copyFile = async (\n  sourceBucketName: string,\n  sourceKey: string,\n  targetBucketName: string,\n  targetKey: string,\n  region: string,\n): Promise<void> => {\n  const s3Client = createAwsClient(S3Client, { region });\n\n  await s3Client.send(\n    new CopyObjectCommand({\n      CopySource: encodeCopySource(sourceBucketName, sourceKey),\n      Bucket: targetBucketName,\n      Key: targetKey,\n    }),\n  );\n};\n"]}

package/lib/commonjs/logic/s3/s3Utils.d.ts

@@ -1,3 +1,4 @@
+export * from './copyFile';
 export * from './deleteFiles';
 export * from './generatePresignedUploadUrl';
 export * from './generatePresignedUrl';

package/lib/commonjs/logic/s3/s3Utils.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 // The s3 folder's barrel (kept under its historical name: many processors and their
 // vi.mock calls point at 'logic/s3/s3Utils').
+__exportStar(require("./copyFile"), exports);
 __exportStar(require("./deleteFiles"), exports);
 __exportStar(require("./generatePresignedUploadUrl"), exports);
 __exportStar(require("./generatePresignedUrl"), exports);