quidproquo-webserver 0.1.1 → 0.1.3

package/lib/commonjs/actionProcessor/api/getHttpApiEventAutoRespondActionProcessor.js

@@ -12,7 +12,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getHttpApiEventAutoRespondActionProcessor = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const askValidateRouteAuth_1 = require("../../stories/askValidateRouteAuth");
+const HTTPEvent_1 = require("../../types/HTTPEvent");
 const headerUtils_1 = require("../../utils/headerUtils");
+const fileUploadErrorHttpStatusMap = {
+    [HTTPEvent_1.FileUploadErrorTypeEnum.fileTooLarge]: 413,
+    [HTTPEvent_1.FileUploadErrorTypeEnum.tooManyFiles]: 413,
+    [HTTPEvent_1.FileUploadErrorTypeEnum.tooManyFields]: 400,
+    [HTTPEvent_1.FileUploadErrorTypeEnum.disallowedMimeType]: 415,
+    [HTTPEvent_1.FileUploadErrorTypeEnum.malformed]: 400,
+};
 const getProcessAutoRespond = (qpqConfig) => {
     const validateAuth = (0, quidproquo_core_1.getProcessCustomImplementation)(qpqConfig, askValidateRouteAuth_1.askValidateRouteAuth, 'API Auth Validation', null, () => new Date().toISOString(), quidproquo_core_1.generateUuid);
     return (_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1) => __awaiter(void 0, [_a, session_1, actionProcessorList_1, logger_1, updateSession_1, dynamicModuleLoader_1], void 0, function* ({ qpqEventRecord, matchResult }, session, actionProcessorList, logger, updateSession, dynamicModuleLoader) {
@@ -41,6 +49,18 @@ const getProcessAutoRespond = (qpqConfig) => {
                 headers: (0, headerUtils_1.getCorsHeaders)(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
             });
         }
+        // Reject invalid multipart uploads before the route story runs (after auth, so a 401 wins)
+        if (qpqEventRecord.fileUploadError) {
+            return (0, quidproquo_core_1.actionResult)({
+                status: fileUploadErrorHttpStatusMap[qpqEventRecord.fileUploadError.errorType] || 400,
+                isBase64Encoded: false,
+                body: JSON.stringify({
+                    errorType: qpqEventRecord.fileUploadError.errorType,
+                    errorText: qpqEventRecord.fileUploadError.message,
+                }),
+                headers: (0, headerUtils_1.getCorsHeaders)(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
+            });
+        }
         return (0, quidproquo_core_1.actionResult)(null);
     });
 };

package/lib/commonjs/config/QPQConfig.d.ts

@@ -13,7 +13,8 @@ export declare enum QPQWebServerConfigSettingType {
     Cache = "@quidproquo-webserver/config/Cache",
     Certificate = "@quidproquo-webserver/config/Certificate",
     DomainProxy = "@quidproquo-webserver/config/DomainProxy",
-    StorageDriveCorsSettings = "@quidproquo-webserver/config/StorageDriveCorsSettings"
+    StorageDriveCorsSettings = "@quidproquo-webserver/config/StorageDriveCorsSettings",
+    FileUploadSettings = "@quidproquo-webserver/config/FileUploadSettings"
 }
 export interface CacheSettings {
     minTTLInSeconds: number;

package/lib/commonjs/config/QPQConfig.js

@@ -18,4 +18,5 @@ var QPQWebServerConfigSettingType;
     QPQWebServerConfigSettingType["Certificate"] = "@quidproquo-webserver/config/Certificate";
     QPQWebServerConfigSettingType["DomainProxy"] = "@quidproquo-webserver/config/DomainProxy";
     QPQWebServerConfigSettingType["StorageDriveCorsSettings"] = "@quidproquo-webserver/config/StorageDriveCorsSettings";
+    QPQWebServerConfigSettingType["FileUploadSettings"] = "@quidproquo-webserver/config/FileUploadSettings";
 })(QPQWebServerConfigSettingType || (exports.QPQWebServerConfigSettingType = QPQWebServerConfigSettingType = {}));

package/lib/commonjs/config/settings/api.d.ts

@@ -3,6 +3,7 @@ export interface QPQConfigAdvancedApiSettings extends QPQConfigAdvancedSettings
     subDomain?: string;
     cloudflareApiKeySecretName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export interface ApiQPQWebServerConfigSetting extends QPQConfigSetting {
     apiSubdomain: string;
@@ -11,5 +12,6 @@ export interface ApiQPQWebServerConfigSetting extends QPQConfigSetting {
     deprecated: boolean;
     cloudflareApiKeySecretName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineApi: (apiName: string, rootDomain: string, options?: QPQConfigAdvancedApiSettings) => ApiQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/api.js

@@ -12,6 +12,7 @@ const defineApi = (apiName, rootDomain, options) => {
         deprecated: (options === null || options === void 0 ? void 0 : options.deprecated) || false,
         cloudflareApiKeySecretName: options === null || options === void 0 ? void 0 : options.cloudflareApiKeySecretName,
         virtualNetworkName: options === null || options === void 0 ? void 0 : options.virtualNetworkName,
+        maxConcurrentExecutions: options === null || options === void 0 ? void 0 : options.maxConcurrentExecutions,
     };
 };
 exports.defineApi = defineApi;

package/lib/commonjs/config/settings/fileUploadSettings.d.ts

@@ -0,0 +1,24 @@
+import { QPQConfigSetting } from 'quidproquo-core';
+export interface FileUploadSettings {
+    /** Maximum size of any single uploaded file. Uploads with a larger file are rejected with a 413. */
+    maxFileSizeBytes: number;
+    /** Maximum number of files in a single multipart request. */
+    maxFileCount: number;
+    /** Maximum number of non-file fields in a single multipart request. */
+    maxFieldCount: number;
+    /** Maximum size of any single non-file field value. Larger values are truncated by the parser. */
+    maxFieldSizeBytes: number;
+    /**
+     * Content types accepted for uploaded files, e.g. `['image/*', 'application/pdf']`
+     * (`type/*` wildcards supported). Omit to accept any content type.
+     */
+    allowedMimeTypes?: string[];
+}
+export interface FileUploadSettingsQPQWebServerConfigSetting extends QPQConfigSetting {
+    fileUploadSettings: Partial<FileUploadSettings>;
+}
+/**
+ * Service-wide limits for multipart/form-data file uploads. Sensible defaults
+ * apply even when this setting is not declared — declare it only to override them.
+ */
+export declare const defineFileUploadSettings: (fileUploadSettings: Partial<FileUploadSettings>) => FileUploadSettingsQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/fileUploadSettings.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineFileUploadSettings = void 0;
+const QPQConfig_1 = require("../QPQConfig");
+/**
+ * Service-wide limits for multipart/form-data file uploads. Sensible defaults
+ * apply even when this setting is not declared — declare it only to override them.
+ */
+const defineFileUploadSettings = (fileUploadSettings) => ({
+    configSettingType: QPQConfig_1.QPQWebServerConfigSettingType.FileUploadSettings,
+    uniqueKey: 'fileUploadSettings',
+    fileUploadSettings,
+});
+exports.defineFileUploadSettings = defineFileUploadSettings;

package/lib/commonjs/config/settings/index.d.ts

@@ -8,6 +8,7 @@ export * from './defineAdminSettings';
 export * from './defineAuthSystem';
 export * from './dns';
 export * from './domainProxy';
+export * from './fileUploadSettings';
 export * from './migration';
 export * from './openApi';
 export * from './route';

package/lib/commonjs/config/settings/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./defineAdminSettings"), exports);
 __exportStar(require("./defineAuthSystem"), exports);
 __exportStar(require("./dns"), exports);
 __exportStar(require("./domainProxy"), exports);
+__exportStar(require("./fileUploadSettings"), exports);
 __exportStar(require("./migration"), exports);
 __exportStar(require("./openApi"), exports);
 __exportStar(require("./route"), exports);

package/lib/commonjs/config/settings/serviceFunction.d.ts

@@ -2,11 +2,13 @@ import { CrossModuleOwner, QPQConfigAdvancedSettings, QPQConfigSetting, QpqFunct
 export interface QPQConfigAdvancedServiceFunctionSettings extends QPQConfigAdvancedSettings {
     functionName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
     owner?: CrossModuleOwner<'functionName'>;
 }
 export interface ServiceFunctionQPQWebServerConfigSetting extends QPQConfigSetting {
     runtime: QpqFunctionRuntime;
     functionName: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineServiceFunction: (runtime: QpqFunctionRuntime, options?: QPQConfigAdvancedServiceFunctionSettings) => ServiceFunctionQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/serviceFunction.js

@@ -11,6 +11,7 @@ const defineServiceFunction = (runtime, options) => {
         runtime,
         functionName: functionName,
         virtualNetworkName: options === null || options === void 0 ? void 0 : options.virtualNetworkName,
+        maxConcurrentExecutions: options === null || options === void 0 ? void 0 : options.maxConcurrentExecutions,
         owner: quidproquo_core_1.qpqCoreUtils.convertCrossModuleOwnerToGenericResourceNameOverride(options === null || options === void 0 ? void 0 : options.owner),
     };
 };

package/lib/commonjs/config/settings/websocket.d.ts

@@ -8,6 +8,7 @@ export interface QPQConfigAdvancedWebSocketSettings extends QPQConfigAdvancedSet
     onRootDomain?: boolean;
     apiName?: string;
     cloudflareApiKeySecretName?: string;
+    maxConcurrentExecutions?: number;
     owner?: CrossModuleOwner<'websocketApiName'>;
 }
 export interface WebSocketQPQWebServerConfigSetting extends QPQConfigSetting {
@@ -18,5 +19,6 @@ export interface WebSocketQPQWebServerConfigSetting extends QPQConfigSetting {
     eventProcessors: QpqWebSocketEventProcessors;
     deprecated: boolean;
     cloudflareApiKeySecretName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineWebsocket: (apiSubdomain: string, rootDomain: string, eventProcessors: QpqWebSocketEventProcessors, options?: QPQConfigAdvancedWebSocketSettings) => WebSocketQPQWebServerConfigSetting;

package/lib/commonjs/config/settings/websocket.js

@@ -15,6 +15,7 @@ const defineWebsocket = (apiSubdomain, rootDomain, eventProcessors, options) =>
         apiName: (options === null || options === void 0 ? void 0 : options.apiName) || 'api',
         deprecated: (options === null || options === void 0 ? void 0 : options.deprecated) || false,
         cloudflareApiKeySecretName: options === null || options === void 0 ? void 0 : options.cloudflareApiKeySecretName,
+        maxConcurrentExecutions: options === null || options === void 0 ? void 0 : options.maxConcurrentExecutions,
         owner: quidproquo_core_1.qpqCoreUtils.convertCrossModuleOwnerToGenericResourceNameOverride(options === null || options === void 0 ? void 0 : options.owner),
     };
 };

package/lib/commonjs/services/webSocketQueue/logic/webSocket/messageProcessors/askProcessOnAuthenticate.js

@@ -14,28 +14,35 @@ function isWebSocketAuthenticateMessage(event) {
 }
 function* askProcessOnAuthenticate(connectionId, accessToken) {
     const connection = yield* data_1.webSocketConnectionData.askGetById(connectionId);
-    if (connection) {
-        const apiName = yield* (0, context_1.askWebsocketReadApiNameOrThrow)();
-        const userDirectoryName = yield* (0, quidproquo_core_1.askConfigGetGlobal)((0, config_1.getWebSocketQueueGlobalConfigKeyForUserDirectoryName)(apiName));
-        if (userDirectoryName) {
-            const result = yield* (0, quidproquo_core_1.askCatch)((0, quidproquo_core_1.askUserDirectorySetAccessToken)(userDirectoryName, accessToken));
-            if (!result.success) {
-                yield* (0, askSendMessage_1.askSendMessage)(connectionId, {
-                    type: types_1.WebSocketQueueServerMessageEventType.Unauthenticated,
-                });
-                return;
-            }
-            const decodedAccessToken = result.result;
-            yield* data_1.webSocketConnectionData.askUpsert(Object.assign(Object.assign({}, connection), { userId: decodedAccessToken.userId, accessToken }));
+    // No connection record (e.g. the connect event hasn't been processed yet) —
+    // tell the client rather than dropping the request silently, so it can
+    // distinguish "not authenticated" from "no reply".
+    if (!connection) {
+        yield* (0, askSendMessage_1.askSendMessage)(connectionId, {
+            type: types_1.WebSocketQueueServerMessageEventType.Unauthenticated,
+        });
+        return;
+    }
+    const apiName = yield* (0, context_1.askWebsocketReadApiNameOrThrow)();
+    const userDirectoryName = yield* (0, quidproquo_core_1.askConfigGetGlobal)((0, config_1.getWebSocketQueueGlobalConfigKeyForUserDirectoryName)(apiName));
+    if (userDirectoryName) {
+        const result = yield* (0, quidproquo_core_1.askCatch)((0, quidproquo_core_1.askUserDirectorySetAccessToken)(userDirectoryName, accessToken));
+        if (!result.success) {
             yield* (0, askSendMessage_1.askSendMessage)(connectionId, {
-                type: types_1.WebSocketQueueServerMessageEventType.Authenticated,
+                type: types_1.WebSocketQueueServerMessageEventType.Unauthenticated,
             });
-            // Send a websocket message to the event buss WITHOUT an access token
-            const webSocketQueueClientEventMessageAuthenticate = {
-                type: types_1.WebSocketQueueClientMessageEventType.Authenticate,
-                payload: {},
-            };
-            yield* (0, askBroadcastUnknownMessage_1.askBroadcastUnknownMessage)(webSocketQueueClientEventMessageAuthenticate);
+            return;
         }
+        const decodedAccessToken = result.result;
+        yield* data_1.webSocketConnectionData.askUpsert(Object.assign(Object.assign({}, connection), { userId: decodedAccessToken.userId, accessToken }));
+        yield* (0, askSendMessage_1.askSendMessage)(connectionId, {
+            type: types_1.WebSocketQueueServerMessageEventType.Authenticated,
+        });
+        // Send a websocket message to the event buss WITHOUT an access token
+        const webSocketQueueClientEventMessageAuthenticate = {
+            type: types_1.WebSocketQueueClientMessageEventType.Authenticate,
+            payload: {},
+        };
+        yield* (0, askBroadcastUnknownMessage_1.askBroadcastUnknownMessage)(webSocketQueueClientEventMessageAuthenticate);
     }
 }

package/lib/commonjs/types/HTTPEvent.d.ts

@@ -5,6 +5,17 @@ export interface HttpEventHeaders {
 export interface HttpEventRouteParams {
     [key: string]: string;
 }
+export declare enum FileUploadErrorTypeEnum {
+    fileTooLarge = "fileTooLarge",
+    tooManyFiles = "tooManyFiles",
+    tooManyFields = "tooManyFields",
+    disallowedMimeType = "disallowedMimeType",
+    malformed = "malformed"
+}
+export interface HTTPEventFileUploadError {
+    errorType: FileUploadErrorTypeEnum;
+    message: string;
+}
 export interface HTTPEvent {
     path: string;
     query: {
@@ -17,6 +28,7 @@ export interface HTTPEvent {
     sourceIp: string;
     isBase64Encoded: boolean;
     files?: QPQBinaryData[];
+    fileUploadError?: HTTPEventFileUploadError;
 }
 export interface HTTPEventResponse {
     status: number;

package/lib/commonjs/types/HTTPEvent.js

@@ -1,5 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileUploadErrorTypeEnum = void 0;
+var FileUploadErrorTypeEnum;
+(function (FileUploadErrorTypeEnum) {
+    FileUploadErrorTypeEnum["fileTooLarge"] = "fileTooLarge";
+    FileUploadErrorTypeEnum["tooManyFiles"] = "tooManyFiles";
+    FileUploadErrorTypeEnum["tooManyFields"] = "tooManyFields";
+    FileUploadErrorTypeEnum["disallowedMimeType"] = "disallowedMimeType";
+    FileUploadErrorTypeEnum["malformed"] = "malformed";
+})(FileUploadErrorTypeEnum || (exports.FileUploadErrorTypeEnum = FileUploadErrorTypeEnum = {}));
 // type ParseParamType<S extends string> = S extends `${infer ParamName}:number`
 //   ? { name: ParamName; type: number }
 //   : S extends `${infer ParamName}:int`

package/lib/commonjs/utils/httpEventUtils.d.ts

@@ -4,6 +4,14 @@ import { HTTPEvent, HTTPEventResponse } from '../types/HTTPEvent';
 export declare const rawFromJsonEventRequest: (httpJsonEvent: HTTPEvent) => string | undefined;
 export declare const fromJsonEventRequest: <T>(httpJsonEvent: HTTPEvent) => T;
 export declare function askFromJsonEventRequest<T>(httpJsonEvent: HTTPEvent): AskResponse<T>;
+/**
+ * Like `askFromJsonEventRequest`, but the parsed body is run through an app-supplied
+ * validator before it is returned - so the `T` is actually checked, not just cast.
+ * The validator throws (or returns the typed value); a validation throw becomes an
+ * `Invalid` (422) response. Any schema library fits, e.g. zod: `(data) => schema.parse(data)`.
+ */
+export declare function askFromValidJsonEventRequest<T>(httpJsonEvent: HTTPEvent, validate: (data: unknown) => T): AskResponse<T>;
+export declare const readUriQueryParamFromEvent: (event: HTTPEvent, paramName: string) => string | undefined;
 export declare const toJsonEventResponse: (item: any, status?: number) => HTTPEventResponse;
 export declare const toHtmlResponse: (html: string, status?: number) => HTTPEventResponse;
 export declare const toTextResponse: (text: string, status?: number) => HTTPEventResponse;

package/lib/commonjs/utils/httpEventUtils.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toCdnResponse = exports.toMovedTemporarilyRedirectResponse = exports.toMovedPermanentlyRedirectResponse = exports.toTextResponse = exports.toHtmlResponse = exports.toJsonEventResponse = exports.fromJsonEventRequest = exports.rawFromJsonEventRequest = void 0;
+exports.toCdnResponse = exports.toMovedTemporarilyRedirectResponse = exports.toMovedPermanentlyRedirectResponse = exports.toTextResponse = exports.toHtmlResponse = exports.toJsonEventResponse = exports.readUriQueryParamFromEvent = exports.fromJsonEventRequest = exports.rawFromJsonEventRequest = void 0;
 exports.askFromJsonEventRequest = askFromJsonEventRequest;
+exports.askFromValidJsonEventRequest = askFromValidJsonEventRequest;
 const quidproquo_core_1 = require("quidproquo-core");
 const rawFromJsonEventRequest = (httpJsonEvent) => {
     const json = httpJsonEvent.isBase64Encoded && httpJsonEvent.body ? Buffer.from(httpJsonEvent.body, 'base64').toString() : httpJsonEvent.body;
@@ -39,6 +40,29 @@ function* askFromJsonEventRequest(httpJsonEvent) {
         return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.BadRequest, 'Unable to parse incoming json from HTTPEvent.');
     }
 }
+/**
+ * Like `askFromJsonEventRequest`, but the parsed body is run through an app-supplied
+ * validator before it is returned - so the `T` is actually checked, not just cast.
+ * The validator throws (or returns the typed value); a validation throw becomes an
+ * `Invalid` (422) response. Any schema library fits, e.g. zod: `(data) => schema.parse(data)`.
+ */
+function* askFromValidJsonEventRequest(httpJsonEvent, validate) {
+    const parsedBody = yield* askFromJsonEventRequest(httpJsonEvent);
+    try {
+        return validate(parsedBody);
+    }
+    catch (error) {
+        return yield* (0, quidproquo_core_1.askThrowError)(quidproquo_core_1.ErrorTypeEnum.Invalid, error instanceof Error ? error.message : 'Invalid request body.');
+    }
+}
+const readUriQueryParamFromEvent = (event, paramName) => {
+    const rawValue = event.query[paramName];
+    if (!rawValue) {
+        return undefined;
+    }
+    return Array.isArray(rawValue) ? rawValue[0] : rawValue;
+};
+exports.readUriQueryParamFromEvent = readUriQueryParamFromEvent;
 const toJsonEventResponse = (item, status = 200) => {
     return {
         status,

package/lib/commonjs/utils/networkRequestUtils.js

@@ -22,7 +22,7 @@ const isAbsoluteUrl = (url) => /^([a-z][a-z\d+\-.]*:)?\/\//i.test(url);
 // Join basePath + url like axios' combineURLs (path concatenation), NOT URL
 // resolution. `new URL('/v1/x', 'http://host/api/svc')` drops the base path
 // because a leading-slash url is root-absolute; we want '.../api/svc/v1/x'.
-const combineUrls = (basePath, url) => url ? `${basePath.replace(/\/+$/, '')}/${url.replace(/^\/+/, '')}` : basePath;
+const combineUrls = (basePath, url) => (url ? `${basePath.replace(/\/+$/, '')}/${url.replace(/^\/+/, '')}` : basePath);
 const buildRequestUrl = (payload) => {
     const fullUrl = payload.basePath && !isAbsoluteUrl(payload.url) ? combineUrls(payload.basePath, payload.url) : payload.url;
     const url = new URL(fullUrl);

package/lib/commonjs/utils/qpqConfigAccessorsUtils.d.ts

@@ -1,5 +1,5 @@
 import { QPQConfig, QpqFunctionRuntime } from 'quidproquo-core';
-import { ApiKeyQPQWebServerConfigSetting, CacheQPQWebServerConfigSetting, CertificateQPQWebServerConfigSetting, DefaultRouteOptionsQPQWebServerConfigSetting, DnsQPQWebServerConfigSetting, DomainProxyQPQWebServerConfigSetting, OpenApiQPQWebServerConfigSetting, RouteQPQWebServerConfigSetting, SeoQPQWebServerConfigSetting, ServiceFunctionQPQWebServerConfigSetting, SubdomainRedirectQPQWebServerConfigSetting, WebSocketQPQWebServerConfigSetting } from '../config';
+import { ApiKeyQPQWebServerConfigSetting, CacheQPQWebServerConfigSetting, CertificateQPQWebServerConfigSetting, DefaultRouteOptionsQPQWebServerConfigSetting, DnsQPQWebServerConfigSetting, DomainProxyQPQWebServerConfigSetting, FileUploadSettings, OpenApiQPQWebServerConfigSetting, RouteQPQWebServerConfigSetting, SeoQPQWebServerConfigSetting, ServiceFunctionQPQWebServerConfigSetting, SubdomainRedirectQPQWebServerConfigSetting, WebSocketQPQWebServerConfigSetting } from '../config';
 import { ApiQPQWebServerConfigSetting, WebEntryQPQWebServerConfigSetting } from '../config';
 export declare const getAllRoutes: (qpqConfig: QPQConfig) => RouteQPQWebServerConfigSetting[];
 export declare const getAllRoutesForApi: (apiName: string, qpqConfig: QPQConfig) => RouteQPQWebServerConfigSetting[];
@@ -40,6 +40,15 @@ export declare const resolveServiceScopedCorsAllowedOrigins: (qpqConfig: QPQConf
  * `defineStorageDriveCorsSettings` wins; otherwise the service-scoped default.
  */
 export declare const getStorageDriveCorsAllowedOrigins: (qpqConfig: QPQConfig, storageDriveName: string) => string[];
+/**
+ * Whether any web entry in this service serves its assets from the named storage
+ * drive (`storageDrive.sourceStorageDrive`) — i.e. the drive's bucket is a
+ * CloudFront origin. Drives with no web entry consumer need no CloudFront access
+ * to their bucket at all.
+ */
+export declare const isStorageDriveWebEntryOrigin: (qpqConfig: QPQConfig, storageDriveName: string) => boolean;
+export declare const defaultFileUploadSettings: FileUploadSettings;
+export declare const getFileUploadSettings: (qpqConfig: QPQConfig) => FileUploadSettings;
 export declare const resolveApexDomainNameFromDomainConfig: (qpqConfig: QPQConfig, rootDomain: string, onRootDomain: boolean) => string;
 export declare const constructServiceDomainName: (rootDomain: string, environment: string, service: string, feature?: string) => string;
 export declare const constructEnvironmentDomainName: (environment: string, domain: string) => string;

package/lib/commonjs/utils/qpqConfigAccessorsUtils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getOwnedWebsocketSettings = exports.getWebsocketSettings = exports.resolveDomainRoot = exports.getDomainRoot = exports.getDefaultRouteSettings = exports.constructEnvironmentDomainName = exports.constructServiceDomainName = exports.resolveApexDomainNameFromDomainConfig = exports.getStorageDriveCorsAllowedOrigins = exports.resolveServiceScopedCorsAllowedOrigins = exports.getServiceDomainName = exports.getBaseDomainName = exports.getEnvironmentDomainName = exports.getCacheConfigByName = exports.getAllOwnedCertifcateConfigs = exports.getAllOwnedCacheConfigs = exports.getDomainProxyConfigs = exports.getWebEntryConfigs = exports.getDnsConfigs = exports.getApiConfigs = exports.getSubdomainRedirects = exports.getWebsocketEntryByApiName = exports.getWebEntry = exports.getDomainName = exports.getAllSrcEntries = exports.getAllWebsocketSrcEntries = exports.getAllOpenApiSpecs = exports.getOwnedServiceFunctions = exports.getAllServiceFunctions = exports.getAllSeo = exports.getAllApiKeyConfigs = exports.getAllRoutesForApi = exports.getAllRoutes = void 0;
+exports.getOwnedWebsocketSettings = exports.getWebsocketSettings = exports.resolveDomainRoot = exports.getDomainRoot = exports.getDefaultRouteSettings = exports.constructEnvironmentDomainName = exports.constructServiceDomainName = exports.resolveApexDomainNameFromDomainConfig = exports.getFileUploadSettings = exports.defaultFileUploadSettings = exports.isStorageDriveWebEntryOrigin = exports.getStorageDriveCorsAllowedOrigins = exports.resolveServiceScopedCorsAllowedOrigins = exports.getServiceDomainName = exports.getBaseDomainName = exports.getEnvironmentDomainName = exports.getCacheConfigByName = exports.getAllOwnedCertifcateConfigs = exports.getAllOwnedCacheConfigs = exports.getDomainProxyConfigs = exports.getWebEntryConfigs = exports.getDnsConfigs = exports.getApiConfigs = exports.getSubdomainRedirects = exports.getWebsocketEntryByApiName = exports.getWebEntry = exports.getDomainName = exports.getAllSrcEntries = exports.getAllWebsocketSrcEntries = exports.getAllOpenApiSpecs = exports.getOwnedServiceFunctions = exports.getAllServiceFunctions = exports.getAllSeo = exports.getAllApiKeyConfigs = exports.getAllRoutesForApi = exports.getAllRoutes = void 0;
 const quidproquo_core_1 = require("quidproquo-core");
 const config_1 = require("../config");
 const getAllRoutes = (qpqConfig) => {
@@ -175,6 +175,29 @@ const getStorageDriveCorsAllowedOrigins = (qpqConfig, storageDriveName) => {
     return (0, exports.resolveServiceScopedCorsAllowedOrigins)(qpqConfig, corsSetting === null || corsSetting === void 0 ? void 0 : corsSetting.allowedOrigins);
 };
 exports.getStorageDriveCorsAllowedOrigins = getStorageDriveCorsAllowedOrigins;
+/**
+ * Whether any web entry in this service serves its assets from the named storage
+ * drive (`storageDrive.sourceStorageDrive`) — i.e. the drive's bucket is a
+ * CloudFront origin. Drives with no web entry consumer need no CloudFront access
+ * to their bucket at all.
+ */
+const isStorageDriveWebEntryOrigin = (qpqConfig, storageDriveName) => {
+    return (0, exports.getWebEntryConfigs)(qpqConfig).some((webEntry) => webEntry.storageDrive.sourceStorageDrive === storageDriveName);
+};
+exports.isStorageDriveWebEntryOrigin = isStorageDriveWebEntryOrigin;
+// API Gateway caps request payloads at 10MB, so the default per-file ceiling matches it;
+// the other defaults exist to bound parser memory rather than to be hit in practice.
+exports.defaultFileUploadSettings = {
+    maxFileSizeBytes: 10 * 1024 * 1024,
+    maxFileCount: 10,
+    maxFieldCount: 100,
+    maxFieldSizeBytes: 1024 * 1024,
+};
+const getFileUploadSettings = (qpqConfig) => {
+    const setting = quidproquo_core_1.qpqCoreUtils.getConfigSetting(qpqConfig, config_1.QPQWebServerConfigSettingType.FileUploadSettings);
+    return Object.assign(Object.assign({}, exports.defaultFileUploadSettings), Object.fromEntries(Object.entries((setting === null || setting === void 0 ? void 0 : setting.fileUploadSettings) || {}).filter(([, value]) => (0, quidproquo_core_1.isDefined)(value))));
+};
+exports.getFileUploadSettings = getFileUploadSettings;
 const resolveApexDomainNameFromDomainConfig = (qpqConfig, rootDomain, onRootDomain) => {
     const feature = quidproquo_core_1.qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
     const environment = quidproquo_core_1.qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);

package/lib/esm/actionProcessor/api/getHttpApiEventAutoRespondActionProcessor.js

@@ -1,6 +1,14 @@
 import { actionResult, EventActionType, generateUuid, getProcessCustomImplementation, } from 'quidproquo-core';
 import { askValidateRouteAuth } from '../../stories/askValidateRouteAuth';
+import { FileUploadErrorTypeEnum } from '../../types/HTTPEvent';
 import { getCorsHeaders } from '../../utils/headerUtils';
+const fileUploadErrorHttpStatusMap = {
+    [FileUploadErrorTypeEnum.fileTooLarge]: 413,
+    [FileUploadErrorTypeEnum.tooManyFiles]: 413,
+    [FileUploadErrorTypeEnum.tooManyFields]: 400,
+    [FileUploadErrorTypeEnum.disallowedMimeType]: 415,
+    [FileUploadErrorTypeEnum.malformed]: 400,
+};
 const getProcessAutoRespond = (qpqConfig) => {
     const validateAuth = getProcessCustomImplementation(qpqConfig, askValidateRouteAuth, 'API Auth Validation', null, () => new Date().toISOString(), generateUuid);
     return async ({ qpqEventRecord, matchResult }, session, actionProcessorList, logger, updateSession, dynamicModuleLoader) => {
@@ -28,6 +36,18 @@ const getProcessAutoRespond = (qpqConfig) => {
                 headers: getCorsHeaders(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
             });
         }
+        // Reject invalid multipart uploads before the route story runs (after auth, so a 401 wins)
+        if (qpqEventRecord.fileUploadError) {
+            return actionResult({
+                status: fileUploadErrorHttpStatusMap[qpqEventRecord.fileUploadError.errorType] || 400,
+                isBase64Encoded: false,
+                body: JSON.stringify({
+                    errorType: qpqEventRecord.fileUploadError.errorType,
+                    errorText: qpqEventRecord.fileUploadError.message,
+                }),
+                headers: getCorsHeaders(qpqConfig, matchResult.config || {}, qpqEventRecord.headers),
+            });
+        }
         return actionResult(null);
     };
 };

package/lib/esm/config/QPQConfig.d.ts

@@ -13,7 +13,8 @@ export declare enum QPQWebServerConfigSettingType {
     Cache = "@quidproquo-webserver/config/Cache",
     Certificate = "@quidproquo-webserver/config/Certificate",
     DomainProxy = "@quidproquo-webserver/config/DomainProxy",
-    StorageDriveCorsSettings = "@quidproquo-webserver/config/StorageDriveCorsSettings"
+    StorageDriveCorsSettings = "@quidproquo-webserver/config/StorageDriveCorsSettings",
+    FileUploadSettings = "@quidproquo-webserver/config/FileUploadSettings"
 }
 export interface CacheSettings {
     minTTLInSeconds: number;

package/lib/esm/config/QPQConfig.js

@@ -15,4 +15,5 @@ export var QPQWebServerConfigSettingType;
     QPQWebServerConfigSettingType["Certificate"] = "@quidproquo-webserver/config/Certificate";
     QPQWebServerConfigSettingType["DomainProxy"] = "@quidproquo-webserver/config/DomainProxy";
     QPQWebServerConfigSettingType["StorageDriveCorsSettings"] = "@quidproquo-webserver/config/StorageDriveCorsSettings";
+    QPQWebServerConfigSettingType["FileUploadSettings"] = "@quidproquo-webserver/config/FileUploadSettings";
 })(QPQWebServerConfigSettingType || (QPQWebServerConfigSettingType = {}));

package/lib/esm/config/settings/api.d.ts

@@ -3,6 +3,7 @@ export interface QPQConfigAdvancedApiSettings extends QPQConfigAdvancedSettings
     subDomain?: string;
     cloudflareApiKeySecretName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export interface ApiQPQWebServerConfigSetting extends QPQConfigSetting {
     apiSubdomain: string;
@@ -11,5 +12,6 @@ export interface ApiQPQWebServerConfigSetting extends QPQConfigSetting {
     deprecated: boolean;
     cloudflareApiKeySecretName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineApi: (apiName: string, rootDomain: string, options?: QPQConfigAdvancedApiSettings) => ApiQPQWebServerConfigSetting;

package/lib/esm/config/settings/api.js

@@ -9,5 +9,6 @@ export const defineApi = (apiName, rootDomain, options) => {
         deprecated: options?.deprecated || false,
         cloudflareApiKeySecretName: options?.cloudflareApiKeySecretName,
         virtualNetworkName: options?.virtualNetworkName,
+        maxConcurrentExecutions: options?.maxConcurrentExecutions,
     };
 };

package/lib/esm/config/settings/fileUploadSettings.d.ts

@@ -0,0 +1,24 @@
+import { QPQConfigSetting } from 'quidproquo-core';
+export interface FileUploadSettings {
+    /** Maximum size of any single uploaded file. Uploads with a larger file are rejected with a 413. */
+    maxFileSizeBytes: number;
+    /** Maximum number of files in a single multipart request. */
+    maxFileCount: number;
+    /** Maximum number of non-file fields in a single multipart request. */
+    maxFieldCount: number;
+    /** Maximum size of any single non-file field value. Larger values are truncated by the parser. */
+    maxFieldSizeBytes: number;
+    /**
+     * Content types accepted for uploaded files, e.g. `['image/*', 'application/pdf']`
+     * (`type/*` wildcards supported). Omit to accept any content type.
+     */
+    allowedMimeTypes?: string[];
+}
+export interface FileUploadSettingsQPQWebServerConfigSetting extends QPQConfigSetting {
+    fileUploadSettings: Partial<FileUploadSettings>;
+}
+/**
+ * Service-wide limits for multipart/form-data file uploads. Sensible defaults
+ * apply even when this setting is not declared — declare it only to override them.
+ */
+export declare const defineFileUploadSettings: (fileUploadSettings: Partial<FileUploadSettings>) => FileUploadSettingsQPQWebServerConfigSetting;

package/lib/esm/config/settings/fileUploadSettings.js

@@ -0,0 +1,10 @@
+import { QPQWebServerConfigSettingType } from '../QPQConfig';
+/**
+ * Service-wide limits for multipart/form-data file uploads. Sensible defaults
+ * apply even when this setting is not declared — declare it only to override them.
+ */
+export const defineFileUploadSettings = (fileUploadSettings) => ({
+    configSettingType: QPQWebServerConfigSettingType.FileUploadSettings,
+    uniqueKey: 'fileUploadSettings',
+    fileUploadSettings,
+});

package/lib/esm/config/settings/index.d.ts

@@ -8,6 +8,7 @@ export * from './defineAdminSettings';
 export * from './defineAuthSystem';
 export * from './dns';
 export * from './domainProxy';
+export * from './fileUploadSettings';
 export * from './migration';
 export * from './openApi';
 export * from './route';

package/lib/esm/config/settings/index.js

@@ -8,6 +8,7 @@ export * from './defineAdminSettings';
 export * from './defineAuthSystem';
 export * from './dns';
 export * from './domainProxy';
+export * from './fileUploadSettings';
 export * from './migration';
 export * from './openApi';
 export * from './route';

package/lib/esm/config/settings/serviceFunction.d.ts

@@ -2,11 +2,13 @@ import { CrossModuleOwner, QPQConfigAdvancedSettings, QPQConfigSetting, QpqFunct
 export interface QPQConfigAdvancedServiceFunctionSettings extends QPQConfigAdvancedSettings {
     functionName?: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
     owner?: CrossModuleOwner<'functionName'>;
 }
 export interface ServiceFunctionQPQWebServerConfigSetting extends QPQConfigSetting {
     runtime: QpqFunctionRuntime;
     functionName: string;
     virtualNetworkName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineServiceFunction: (runtime: QpqFunctionRuntime, options?: QPQConfigAdvancedServiceFunctionSettings) => ServiceFunctionQPQWebServerConfigSetting;

package/lib/esm/config/settings/serviceFunction.js

@@ -8,6 +8,7 @@ export const defineServiceFunction = (runtime, options) => {
         runtime,
         functionName: functionName,
         virtualNetworkName: options?.virtualNetworkName,
+        maxConcurrentExecutions: options?.maxConcurrentExecutions,
         owner: qpqCoreUtils.convertCrossModuleOwnerToGenericResourceNameOverride(options?.owner),
     };
 };

package/lib/esm/config/settings/websocket.d.ts

@@ -8,6 +8,7 @@ export interface QPQConfigAdvancedWebSocketSettings extends QPQConfigAdvancedSet
     onRootDomain?: boolean;
     apiName?: string;
     cloudflareApiKeySecretName?: string;
+    maxConcurrentExecutions?: number;
     owner?: CrossModuleOwner<'websocketApiName'>;
 }
 export interface WebSocketQPQWebServerConfigSetting extends QPQConfigSetting {
@@ -18,5 +19,6 @@ export interface WebSocketQPQWebServerConfigSetting extends QPQConfigSetting {
     eventProcessors: QpqWebSocketEventProcessors;
     deprecated: boolean;
     cloudflareApiKeySecretName?: string;
+    maxConcurrentExecutions?: number;
 }
 export declare const defineWebsocket: (apiSubdomain: string, rootDomain: string, eventProcessors: QpqWebSocketEventProcessors, options?: QPQConfigAdvancedWebSocketSettings) => WebSocketQPQWebServerConfigSetting;

package/lib/esm/config/settings/websocket.js

@@ -12,6 +12,7 @@ export const defineWebsocket = (apiSubdomain, rootDomain, eventProcessors, optio
         apiName: options?.apiName || 'api',
         deprecated: options?.deprecated || false,
         cloudflareApiKeySecretName: options?.cloudflareApiKeySecretName,
+        maxConcurrentExecutions: options?.maxConcurrentExecutions,
         owner: qpqCoreUtils.convertCrossModuleOwnerToGenericResourceNameOverride(options?.owner),
     };
 };

package/lib/esm/services/webSocketQueue/logic/webSocket/messageProcessors/askProcessOnAuthenticate.js

@@ -10,32 +10,39 @@ export function isWebSocketAuthenticateMessage(event) {
 }
 export function* askProcessOnAuthenticate(connectionId, accessToken) {
     const connection = yield* webSocketConnectionData.askGetById(connectionId);
-    if (connection) {
-        const apiName = yield* askWebsocketReadApiNameOrThrow();
-        const userDirectoryName = yield* askConfigGetGlobal(getWebSocketQueueGlobalConfigKeyForUserDirectoryName(apiName));
-        if (userDirectoryName) {
-            const result = yield* askCatch(askUserDirectorySetAccessToken(userDirectoryName, accessToken));
-            if (!result.success) {
-                yield* askSendMessage(connectionId, {
-                    type: WebSocketQueueServerMessageEventType.Unauthenticated,
-                });
-                return;
-            }
-            const decodedAccessToken = result.result;
-            yield* webSocketConnectionData.askUpsert({
-                ...connection,
-                userId: decodedAccessToken.userId,
-                accessToken,
-            });
+    // No connection record (e.g. the connect event hasn't been processed yet) —
+    // tell the client rather than dropping the request silently, so it can
+    // distinguish "not authenticated" from "no reply".
+    if (!connection) {
+        yield* askSendMessage(connectionId, {
+            type: WebSocketQueueServerMessageEventType.Unauthenticated,
+        });
+        return;
+    }
+    const apiName = yield* askWebsocketReadApiNameOrThrow();
+    const userDirectoryName = yield* askConfigGetGlobal(getWebSocketQueueGlobalConfigKeyForUserDirectoryName(apiName));
+    if (userDirectoryName) {
+        const result = yield* askCatch(askUserDirectorySetAccessToken(userDirectoryName, accessToken));
+        if (!result.success) {
             yield* askSendMessage(connectionId, {
-                type: WebSocketQueueServerMessageEventType.Authenticated,
+                type: WebSocketQueueServerMessageEventType.Unauthenticated,
             });
-            // Send a websocket message to the event buss WITHOUT an access token
-            const webSocketQueueClientEventMessageAuthenticate = {
-                type: WebSocketQueueClientMessageEventType.Authenticate,
-                payload: {},
-            };
-            yield* askBroadcastUnknownMessage(webSocketQueueClientEventMessageAuthenticate);
+            return;
         }
+        const decodedAccessToken = result.result;
+        yield* webSocketConnectionData.askUpsert({
+            ...connection,
+            userId: decodedAccessToken.userId,
+            accessToken,
+        });
+        yield* askSendMessage(connectionId, {
+            type: WebSocketQueueServerMessageEventType.Authenticated,
+        });
+        // Send a websocket message to the event buss WITHOUT an access token
+        const webSocketQueueClientEventMessageAuthenticate = {
+            type: WebSocketQueueClientMessageEventType.Authenticate,
+            payload: {},
+        };
+        yield* askBroadcastUnknownMessage(webSocketQueueClientEventMessageAuthenticate);
     }
 }

package/lib/esm/types/HTTPEvent.d.ts

@@ -5,6 +5,17 @@ export interface HttpEventHeaders {
 export interface HttpEventRouteParams {
     [key: string]: string;
 }
+export declare enum FileUploadErrorTypeEnum {
+    fileTooLarge = "fileTooLarge",
+    tooManyFiles = "tooManyFiles",
+    tooManyFields = "tooManyFields",
+    disallowedMimeType = "disallowedMimeType",
+    malformed = "malformed"
+}
+export interface HTTPEventFileUploadError {
+    errorType: FileUploadErrorTypeEnum;
+    message: string;
+}
 export interface HTTPEvent {
     path: string;
     query: {
@@ -17,6 +28,7 @@ export interface HTTPEvent {
     sourceIp: string;
     isBase64Encoded: boolean;
     files?: QPQBinaryData[];
+    fileUploadError?: HTTPEventFileUploadError;
 }
 export interface HTTPEventResponse {
     status: number;

package/lib/esm/types/HTTPEvent.js

@@ -1,4 +1,11 @@
-export {};
+export var FileUploadErrorTypeEnum;
+(function (FileUploadErrorTypeEnum) {
+    FileUploadErrorTypeEnum["fileTooLarge"] = "fileTooLarge";
+    FileUploadErrorTypeEnum["tooManyFiles"] = "tooManyFiles";
+    FileUploadErrorTypeEnum["tooManyFields"] = "tooManyFields";
+    FileUploadErrorTypeEnum["disallowedMimeType"] = "disallowedMimeType";
+    FileUploadErrorTypeEnum["malformed"] = "malformed";
+})(FileUploadErrorTypeEnum || (FileUploadErrorTypeEnum = {}));
 // type ParseParamType<S extends string> = S extends `${infer ParamName}:number`
 //   ? { name: ParamName; type: number }
 //   : S extends `${infer ParamName}:int`

package/lib/esm/utils/httpEventUtils.d.ts

@@ -4,6 +4,14 @@ import { HTTPEvent, HTTPEventResponse } from '../types/HTTPEvent';
 export declare const rawFromJsonEventRequest: (httpJsonEvent: HTTPEvent) => string | undefined;
 export declare const fromJsonEventRequest: <T>(httpJsonEvent: HTTPEvent) => T;
 export declare function askFromJsonEventRequest<T>(httpJsonEvent: HTTPEvent): AskResponse<T>;
+/**
+ * Like `askFromJsonEventRequest`, but the parsed body is run through an app-supplied
+ * validator before it is returned - so the `T` is actually checked, not just cast.
+ * The validator throws (or returns the typed value); a validation throw becomes an
+ * `Invalid` (422) response. Any schema library fits, e.g. zod: `(data) => schema.parse(data)`.
+ */
+export declare function askFromValidJsonEventRequest<T>(httpJsonEvent: HTTPEvent, validate: (data: unknown) => T): AskResponse<T>;
+export declare const readUriQueryParamFromEvent: (event: HTTPEvent, paramName: string) => string | undefined;
 export declare const toJsonEventResponse: (item: any, status?: number) => HTTPEventResponse;
 export declare const toHtmlResponse: (html: string, status?: number) => HTTPEventResponse;
 export declare const toTextResponse: (text: string, status?: number) => HTTPEventResponse;

package/lib/esm/utils/httpEventUtils.js

@@ -33,6 +33,28 @@ export function* askFromJsonEventRequest(httpJsonEvent) {
         return yield* askThrowError(ErrorTypeEnum.BadRequest, 'Unable to parse incoming json from HTTPEvent.');
     }
 }
+/**
+ * Like `askFromJsonEventRequest`, but the parsed body is run through an app-supplied
+ * validator before it is returned - so the `T` is actually checked, not just cast.
+ * The validator throws (or returns the typed value); a validation throw becomes an
+ * `Invalid` (422) response. Any schema library fits, e.g. zod: `(data) => schema.parse(data)`.
+ */
+export function* askFromValidJsonEventRequest(httpJsonEvent, validate) {
+    const parsedBody = yield* askFromJsonEventRequest(httpJsonEvent);
+    try {
+        return validate(parsedBody);
+    }
+    catch (error) {
+        return yield* askThrowError(ErrorTypeEnum.Invalid, error instanceof Error ? error.message : 'Invalid request body.');
+    }
+}
+export const readUriQueryParamFromEvent = (event, paramName) => {
+    const rawValue = event.query[paramName];
+    if (!rawValue) {
+        return undefined;
+    }
+    return Array.isArray(rawValue) ? rawValue[0] : rawValue;
+};
 export const toJsonEventResponse = (item, status = 200) => {
     return {
         status,

package/lib/esm/utils/networkRequestUtils.js

@@ -10,7 +10,7 @@ const isAbsoluteUrl = (url) => /^([a-z][a-z\d+\-.]*:)?\/\//i.test(url);
 // Join basePath + url like axios' combineURLs (path concatenation), NOT URL
 // resolution. `new URL('/v1/x', 'http://host/api/svc')` drops the base path
 // because a leading-slash url is root-absolute; we want '.../api/svc/v1/x'.
-const combineUrls = (basePath, url) => url ? `${basePath.replace(/\/+$/, '')}/${url.replace(/^\/+/, '')}` : basePath;
+const combineUrls = (basePath, url) => (url ? `${basePath.replace(/\/+$/, '')}/${url.replace(/^\/+/, '')}` : basePath);
 const buildRequestUrl = (payload) => {
     const fullUrl = payload.basePath && !isAbsoluteUrl(payload.url) ? combineUrls(payload.basePath, payload.url) : payload.url;
     const url = new URL(fullUrl);

package/lib/esm/utils/qpqConfigAccessorsUtils.d.ts

@@ -1,5 +1,5 @@
 import { QPQConfig, QpqFunctionRuntime } from 'quidproquo-core';
-import { ApiKeyQPQWebServerConfigSetting, CacheQPQWebServerConfigSetting, CertificateQPQWebServerConfigSetting, DefaultRouteOptionsQPQWebServerConfigSetting, DnsQPQWebServerConfigSetting, DomainProxyQPQWebServerConfigSetting, OpenApiQPQWebServerConfigSetting, RouteQPQWebServerConfigSetting, SeoQPQWebServerConfigSetting, ServiceFunctionQPQWebServerConfigSetting, SubdomainRedirectQPQWebServerConfigSetting, WebSocketQPQWebServerConfigSetting } from '../config';
+import { ApiKeyQPQWebServerConfigSetting, CacheQPQWebServerConfigSetting, CertificateQPQWebServerConfigSetting, DefaultRouteOptionsQPQWebServerConfigSetting, DnsQPQWebServerConfigSetting, DomainProxyQPQWebServerConfigSetting, FileUploadSettings, OpenApiQPQWebServerConfigSetting, RouteQPQWebServerConfigSetting, SeoQPQWebServerConfigSetting, ServiceFunctionQPQWebServerConfigSetting, SubdomainRedirectQPQWebServerConfigSetting, WebSocketQPQWebServerConfigSetting } from '../config';
 import { ApiQPQWebServerConfigSetting, WebEntryQPQWebServerConfigSetting } from '../config';
 export declare const getAllRoutes: (qpqConfig: QPQConfig) => RouteQPQWebServerConfigSetting[];
 export declare const getAllRoutesForApi: (apiName: string, qpqConfig: QPQConfig) => RouteQPQWebServerConfigSetting[];
@@ -40,6 +40,15 @@ export declare const resolveServiceScopedCorsAllowedOrigins: (qpqConfig: QPQConf
  * `defineStorageDriveCorsSettings` wins; otherwise the service-scoped default.
  */
 export declare const getStorageDriveCorsAllowedOrigins: (qpqConfig: QPQConfig, storageDriveName: string) => string[];
+/**
+ * Whether any web entry in this service serves its assets from the named storage
+ * drive (`storageDrive.sourceStorageDrive`) — i.e. the drive's bucket is a
+ * CloudFront origin. Drives with no web entry consumer need no CloudFront access
+ * to their bucket at all.
+ */
+export declare const isStorageDriveWebEntryOrigin: (qpqConfig: QPQConfig, storageDriveName: string) => boolean;
+export declare const defaultFileUploadSettings: FileUploadSettings;
+export declare const getFileUploadSettings: (qpqConfig: QPQConfig) => FileUploadSettings;
 export declare const resolveApexDomainNameFromDomainConfig: (qpqConfig: QPQConfig, rootDomain: string, onRootDomain: boolean) => string;
 export declare const constructServiceDomainName: (rootDomain: string, environment: string, service: string, feature?: string) => string;
 export declare const constructEnvironmentDomainName: (environment: string, domain: string) => string;

package/lib/esm/utils/qpqConfigAccessorsUtils.js

@@ -147,6 +147,30 @@ export const getStorageDriveCorsAllowedOrigins = (qpqConfig, storageDriveName) =
         .find((setting) => setting.storageDriveName === storageDriveName);
     return resolveServiceScopedCorsAllowedOrigins(qpqConfig, corsSetting?.allowedOrigins);
 };
+/**
+ * Whether any web entry in this service serves its assets from the named storage
+ * drive (`storageDrive.sourceStorageDrive`) — i.e. the drive's bucket is a
+ * CloudFront origin. Drives with no web entry consumer need no CloudFront access
+ * to their bucket at all.
+ */
+export const isStorageDriveWebEntryOrigin = (qpqConfig, storageDriveName) => {
+    return getWebEntryConfigs(qpqConfig).some((webEntry) => webEntry.storageDrive.sourceStorageDrive === storageDriveName);
+};
+// API Gateway caps request payloads at 10MB, so the default per-file ceiling matches it;
+// the other defaults exist to bound parser memory rather than to be hit in practice.
+export const defaultFileUploadSettings = {
+    maxFileSizeBytes: 10 * 1024 * 1024,
+    maxFileCount: 10,
+    maxFieldCount: 100,
+    maxFieldSizeBytes: 1024 * 1024,
+};
+export const getFileUploadSettings = (qpqConfig) => {
+    const setting = qpqCoreUtils.getConfigSetting(qpqConfig, QPQWebServerConfigSettingType.FileUploadSettings);
+    return {
+        ...defaultFileUploadSettings,
+        ...Object.fromEntries(Object.entries(setting?.fileUploadSettings || {}).filter(([, value]) => isDefined(value))),
+    };
+};
 export const resolveApexDomainNameFromDomainConfig = (qpqConfig, rootDomain, onRootDomain) => {
     const feature = qpqCoreUtils.getApplicationModuleFeature(qpqConfig);
     const environment = qpqCoreUtils.getApplicationModuleEnvironment(qpqConfig);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-webserver",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "",
   "main": "./lib/commonjs/index.js",
   "module": "./lib/esm/index.js",
@@ -33,10 +33,10 @@
   "homepage": "https://github.com/joe-coady/quidproquo#readme",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.19.1",
-    "quidproquo-core": "0.1.1"
+    "quidproquo-core": "0.1.3"
   },
   "devDependencies": {
-    "quidproquo-tsconfig": "0.1.1",
+    "quidproquo-tsconfig": "0.1.3",
     "typescript": "^5.8.2"
   }
 }