@ampless/backend 0.2.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ampless contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,121 @@
+# @ampless/backend
+
+Amplify Gen 2 backend factories for [ampless](https://github.com/heavymoons/ampless). Bundles the IAM / SQS / DynamoDB-stream wiring, the auth / data / storage definitions, and every event-processing Lambda behind one `defineAmplessBackend(...)` factory.
+
+> **Pre-release / alpha.** Breaking changes possible in any minor version until v1.0.
+
+Splitting this out of the template lets you `npm update @ampless/backend` without re-running the scaffolder. Backend bug fixes and infrastructure improvements arrive through the package; the user-side `amplify/` tree becomes a handful of 1–5 line shells that compose the factories.
+
+## Install
+
+```bash
+npm install @ampless/backend@alpha ampless@alpha
+```
+
+Peer dependencies: `@aws-amplify/backend` (^1), `aws-cdk-lib` (^2). The CLI scaffolder pins compatible versions in the template's `package.json`.
+
+## Usage
+
+### `amplify/backend.ts`
+
+```ts
+import { defineAmplessBackend } from '@ampless/backend'
+import { auth } from './auth/resource'
+import { data } from './data/resource'
+import { storage } from './storage/resource'
+import { postConfirmation } from './auth/post-confirmation/resource'
+import { eventDispatcher } from './events/dispatcher/resource'
+import { processorTrusted } from './events/processor-trusted/resource'
+import { processorUntrusted } from './events/processor-untrusted/resource'
+import { apiKeyRenewer } from './functions/api-key-renewer/resource'
+
+export default defineAmplessBackend({
+  auth, data, storage, postConfirmation,
+  eventDispatcher, processorTrusted, processorUntrusted, apiKeyRenewer,
+})
+```
+
+### `amplify/auth/resource.ts`
+
+```ts
+import { defineAmplessAuth } from '@ampless/backend'
+import { postConfirmation } from './post-confirmation/resource'
+
+export const auth = defineAmplessAuth({ postConfirmation })
+```
+
+### `amplify/data/resource.ts`
+
+```ts
+import { a, defineData, type ClientSchema } from '@aws-amplify/backend'
+import { amplessSchemaModels, defaultAuthorizationModes } from '@ampless/backend'
+
+const schema = a.schema({
+  ...amplessSchemaModels(a),
+  // Add custom models here — they live alongside the built-ins:
+  // MyCustomModel: a.model({ ... }).authorization((allow) => [...]),
+})
+
+export type Schema = ClientSchema<typeof schema>
+export const data = defineData({ schema, authorizationModes: defaultAuthorizationModes })
+```
+
+The three AppSync JS resolver files (`list-published-posts.js`, `get-published-post.js`, `list-posts-by-tag.js`) stay in the template — AppSync resolves resolver `entry` paths at CDK synth time relative to the file that calls `defineData`, and pnpm-symlinked `node_modules` paths don't survive that resolution. If you move them out of `amplify/data/`, pass new paths through `amplessSchemaModels(a, { resolverPaths })`.
+
+### `amplify/storage/resource.ts`
+
+```ts
+import { defineAmplessStorage } from '@ampless/backend'
+export const storage = defineAmplessStorage()
+```
+
+### Lambda thin shells
+
+Every handler file in `amplify/auth/`, `amplify/events/`, and `amplify/functions/` becomes a 1–3 line re-export. Amplify's esbuild follows the import into this package and bundles the real handler code into the Lambda artifact.
+
+```ts
+// amplify/auth/post-confirmation/handler.ts
+export { handler } from '@ampless/backend/auth/post-confirmation'
+
+// amplify/events/dispatcher/handler.ts
+export { handler } from '@ampless/backend/events/dispatcher'
+
+// amplify/events/processor-trusted/handler.ts
+import config from '../../../cms.config'
+import { createProcessorTrustedHandler } from '@ampless/backend/events/processor-trusted'
+export const handler = createProcessorTrustedHandler({
+  plugins: config.plugins,
+  site: config.site,
+})
+
+// amplify/events/processor-untrusted/handler.ts
+import config from '../../../cms.config'
+import { createProcessorUntrustedHandler } from '@ampless/backend/events/processor-untrusted'
+export const handler = createProcessorUntrustedHandler({
+  plugins: config.plugins,
+  site: config.site,
+})
+
+// amplify/functions/api-key-renewer/handler.ts
+export { handler } from '@ampless/backend/functions/api-key-renewer'
+```
+
+## Sub-paths
+
+- `@ampless/backend` — `defineAmplessBackend`, `defineAmplessAuth`, `defineAmplessStorage`, `amplessSchemaModels`, `extendAmplessSchema`, `defaultAuthorizationModes`
+- `@ampless/backend/auth/post-confirmation` — Lambda handler
+- `@ampless/backend/events/dispatcher` — Lambda handler
+- `@ampless/backend/events/processor-trusted` — `createProcessorTrustedHandler({ plugins, site })`
+- `@ampless/backend/events/processor-untrusted` — `createProcessorUntrustedHandler({ plugins, site })`
+- `@ampless/backend/functions/api-key-renewer` — Lambda handler
+
+## What's still in the template
+
+- `amplify/data/*.js` — AppSync JS resolvers (file-path constraint).
+- Every `resource.ts` and `handler.ts` — they're thin shells, but they hold the `entry: './handler.ts'` paths that Amplify's CDK synth resolves on the user side.
+- `cms.config.ts` and `themes-registry.ts` — user-owned customisation surface.
+- Theme components under `templates/<theme>/` — user-owned.
+
+## License
+
+MIT

package/dist/auth/post-confirmation.d.ts

@@ -0,0 +1,14 @@
+import { PostConfirmationTriggerHandler } from 'aws-lambda';
+
+/**
+ * Post-confirmation Cognito trigger: promote the first confirmed user
+ * to `ampless-admin`. Subsequent signups stay in the default group
+ * (i.e. no group) and the admin must promote them manually.
+ *
+ * Re-exported from the template's thin shell
+ * `amplify/auth/post-confirmation/handler.ts`; Amplify's esbuild
+ * bundles this module into the Lambda artifact.
+ */
+declare const handler: PostConfirmationTriggerHandler;
+
+export { handler };

package/dist/auth/post-confirmation.js

@@ -0,0 +1,30 @@
+// src/auth/post-confirmation.ts
+import {
+  CognitoIdentityProviderClient,
+  AdminAddUserToGroupCommand,
+  ListUsersInGroupCommand
+} from "@aws-sdk/client-cognito-identity-provider";
+var cognito = new CognitoIdentityProviderClient({});
+var handler = async (event) => {
+  const { userPoolId, userName } = event;
+  const existing = await cognito.send(
+    new ListUsersInGroupCommand({
+      UserPoolId: userPoolId,
+      GroupName: "ampless-admin",
+      Limit: 1
+    })
+  );
+  if (!existing.Users || existing.Users.length === 0) {
+    await cognito.send(
+      new AdminAddUserToGroupCommand({
+        UserPoolId: userPoolId,
+        Username: userName,
+        GroupName: "ampless-admin"
+      })
+    );
+  }
+  return event;
+};
+export {
+  handler
+};

package/dist/events/dispatcher.d.ts

@@ -0,0 +1,15 @@
+import { DynamoDBStreamHandler } from 'aws-lambda';
+
+/**
+ * DynamoDB-stream → SQS-fanout dispatcher. Wired to both the Post and
+ * KvStore tables; routes content events to the trusted+untrusted
+ * queues and site-settings updates likewise. trust_level isolation
+ * is enforced by the downstream Lambdas' IAM roles, not by message
+ * routing here.
+ *
+ * Re-exported by the template's thin shell
+ * `amplify/events/dispatcher/handler.ts`.
+ */
+declare const handler: DynamoDBStreamHandler;
+
+export { handler };

package/dist/events/dispatcher.js

@@ -0,0 +1,86 @@
+// src/events/dispatcher.ts
+import { unmarshall } from "@aws-sdk/util-dynamodb";
+import {
+  SQSClient,
+  SendMessageBatchCommand
+} from "@aws-sdk/client-sqs";
+import { detectContentEvents } from "ampless";
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`event-dispatcher: missing required env var ${name}`);
+  return v;
+}
+var sqs = new SQSClient({});
+var TRUSTED_QUEUE_URL = requireEnv("TRUSTED_QUEUE_URL");
+var UNTRUSTED_QUEUE_URL = requireEnv("UNTRUSTED_QUEUE_URL");
+function tableNameFromArn(arn) {
+  if (!arn) return null;
+  const match = arn.match(/:table\/([^/]+)/);
+  return match ? match[1] : null;
+}
+function emitContentEvents(record, timestamp) {
+  const oldItem = record.dynamodb?.OldImage ? unmarshall(record.dynamodb.OldImage) : null;
+  const newItem = record.dynamodb?.NewImage ? unmarshall(record.dynamodb.NewImage) : null;
+  const types = detectContentEvents({
+    eventName: record.eventName,
+    oldStatus: oldItem?.status,
+    newStatus: newItem?.status
+  });
+  if (types.length === 0) return [];
+  const item = newItem ?? oldItem ?? {};
+  const payload = {
+    siteId: item.siteId,
+    postId: item.postId,
+    slug: item.slug,
+    title: item.title,
+    status: item.status,
+    publishedAt: item.publishedAt,
+    tags: item.tags
+  };
+  return types.map((type) => ({ type, payload, timestamp }));
+}
+function emitKvEvents(record, timestamp) {
+  const item = record.dynamodb?.NewImage ?? record.dynamodb?.OldImage ? unmarshall(record.dynamodb.NewImage ?? record.dynamodb.OldImage) : {};
+  const pk = item.pk;
+  if (!pk) return [];
+  if (!pk.startsWith("siteconfig:")) return [];
+  const siteId = pk.slice("siteconfig:".length);
+  if (!siteId) return [];
+  return [
+    {
+      type: "site.settings.updated",
+      payload: { siteId },
+      timestamp
+    }
+  ];
+}
+async function sendBatch(queueUrl, entries) {
+  for (let i = 0; i < entries.length; i += 10) {
+    const chunk = entries.slice(i, i + 10);
+    await sqs.send(new SendMessageBatchCommand({ QueueUrl: queueUrl, Entries: chunk }));
+  }
+}
+var handler = async (event) => {
+  const messages = [];
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  for (const record of event.Records) {
+    const tableName = tableNameFromArn(record.eventSourceARN);
+    if (tableName && tableName.startsWith("Post-")) {
+      messages.push(...emitContentEvents(record, timestamp));
+    } else if (tableName && tableName.startsWith("KvStore-")) {
+      messages.push(...emitKvEvents(record, timestamp));
+    }
+  }
+  if (messages.length === 0) return;
+  const entries = messages.map((m, i) => ({
+    Id: `msg-${i}`,
+    MessageBody: JSON.stringify(m)
+  }));
+  await Promise.all([
+    sendBatch(TRUSTED_QUEUE_URL, entries),
+    sendBatch(UNTRUSTED_QUEUE_URL, entries)
+  ]);
+};
+export {
+  handler
+};

package/dist/events/processor-trusted.d.ts

@@ -0,0 +1,36 @@
+import { SQSHandler } from 'aws-lambda';
+import { AmplessPlugin, Config } from 'ampless';
+
+interface CreateProcessorTrustedHandlerOpts {
+    /**
+     * The full `cms.config.plugins` array. The handler filters down to
+     * trusted plugins itself so callers don't need to remember the
+     * filter, and so adding `privileged` later only touches the handler
+     * code in this package.
+     */
+    plugins?: AmplessPlugin[];
+    /**
+     * The `cms.config.site` block, surfaced to plugin hooks via
+     * `ctx.site`. Pass through from the thin shell — handlers must
+     * not import `cms.config` directly because the package can't know
+     * the user's project layout.
+     */
+    site: Config['site'];
+}
+/**
+ * SQS-driven trusted plugin executor. Trusted plugins get a runtime
+ * context with `listPublishedPosts` (one Query per site partition)
+ * and `writePublicAsset` (S3 PutObject under
+ * `public/plugins/{name}/{siteId}/{key}`).
+ *
+ * Built-in: rebuilds the site-settings JSON cache at
+ * `public/site-settings/{siteId}.json` whenever a
+ * `site.settings.updated` event arrives.
+ *
+ * Re-exported by the template's thin shell
+ * `amplify/events/processor-trusted/handler.ts` which supplies the
+ * site-wide plugin list and site config from `cms.config`.
+ */
+declare function createProcessorTrustedHandler(opts: CreateProcessorTrustedHandlerOpts): SQSHandler;
+
+export { type CreateProcessorTrustedHandlerOpts, createProcessorTrustedHandler };

package/dist/events/processor-trusted.js

@@ -0,0 +1,159 @@
+// src/events/processor-trusted.ts
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, QueryCommand } from "@aws-sdk/lib-dynamodb";
+import {
+  formatPublicAssetUrl
+} from "ampless";
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`processor-trusted: missing required env var ${name}`);
+  return v;
+}
+var POST_BY_SITE_STATUS_INDEX = "bySiteIdStatus";
+function safeParse(s) {
+  try {
+    return JSON.parse(s);
+  } catch (err) {
+    console.warn("[trusted-processor] post.body is not valid JSON; passing through as string", err);
+    return s;
+  }
+}
+function createProcessorTrustedHandler(opts) {
+  const trustedPlugins = (opts.plugins ?? []).filter(
+    (p) => typeof p === "object" && p.trust_level === "trusted"
+  );
+  const s3 = new S3Client({});
+  const ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+  const BUCKET = requireEnv("AMPLESS_BUCKET_NAME");
+  const POST_TABLE = requireEnv("AMPLESS_POST_TABLE");
+  const KV_TABLE = requireEnv("AMPLESS_KV_TABLE");
+  const REGION = requireEnv("AWS_REGION");
+  async function listPublished(siteId) {
+    const items = [];
+    let exclusiveStartKey;
+    const partition = `${siteId}#published`;
+    do {
+      const res = await ddb.send(
+        new QueryCommand({
+          TableName: POST_TABLE,
+          IndexName: POST_BY_SITE_STATUS_INDEX,
+          KeyConditionExpression: "#siteIdStatus = :siteIdStatus",
+          ExpressionAttributeNames: { "#siteIdStatus": "siteIdStatus" },
+          ExpressionAttributeValues: { ":siteIdStatus": partition },
+          ScanIndexForward: false,
+          ExclusiveStartKey: exclusiveStartKey
+        })
+      );
+      for (const row of res.Items ?? []) {
+        items.push({
+          postId: row.postId,
+          siteId: row.siteId,
+          slug: row.slug,
+          title: row.title,
+          excerpt: row.excerpt ?? void 0,
+          format: row.format ?? "markdown",
+          body: typeof row.body === "string" ? safeParse(row.body) : row.body,
+          status: row.status ?? "published",
+          publishedAt: row.publishedAt ?? void 0,
+          tags: Array.isArray(row.tags) ? row.tags : []
+        });
+      }
+      exclusiveStartKey = res.LastEvaluatedKey;
+    } while (exclusiveStartKey);
+    return items;
+  }
+  function makeContext(plugin, siteId) {
+    return {
+      siteId,
+      site: opts.site,
+      listPublishedPosts: () => listPublished(siteId),
+      async writePublicAsset(key, body, contentType) {
+        const objectKey = `public/plugins/${plugin.name}/${siteId}/${key}`;
+        await s3.send(
+          new PutObjectCommand({
+            Bucket: BUCKET,
+            Key: objectKey,
+            Body: body,
+            ContentType: contentType,
+            CacheControl: "public, max-age=300"
+          })
+        );
+        return formatPublicAssetUrl(BUCKET, REGION, objectKey);
+      }
+    };
+  }
+  async function rebuildSiteSettingsCache(siteId) {
+    const settings = {};
+    let exclusiveStartKey;
+    do {
+      const res = await ddb.send(
+        new QueryCommand({
+          TableName: KV_TABLE,
+          KeyConditionExpression: "#pk = :pk",
+          ExpressionAttributeNames: { "#pk": "pk" },
+          ExpressionAttributeValues: { ":pk": `siteconfig:${siteId}` },
+          ExclusiveStartKey: exclusiveStartKey
+        })
+      );
+      for (const row of res.Items ?? []) {
+        const sk = row.sk;
+        if (!sk) continue;
+        const raw = row.value;
+        settings[sk] = typeof raw === "string" ? safeParse(raw) : raw;
+      }
+      exclusiveStartKey = res.LastEvaluatedKey;
+    } while (exclusiveStartKey);
+    const objectKey = `public/site-settings/${siteId}.json`;
+    await s3.send(
+      new PutObjectCommand({
+        Bucket: BUCKET,
+        Key: objectKey,
+        Body: JSON.stringify(settings),
+        ContentType: "application/json; charset=utf-8",
+        // Public site fetches with Next.js fetch cache (60s) — keep this
+        // short so admin edits propagate quickly without thrashing.
+        CacheControl: "public, max-age=60"
+      })
+    );
+    console.log(
+      `[site-settings-cache] wrote ${objectKey} (${Object.keys(settings).length} keys)`
+    );
+  }
+  return async (event) => {
+    for (const record of event.Records) {
+      let parsed;
+      try {
+        parsed = JSON.parse(record.body);
+      } catch (err) {
+        console.error("[trusted-processor] bad message", record.body, err);
+        continue;
+      }
+      const siteId = parsed.payload.siteId ?? "default";
+      if (parsed.type === "site.settings.updated") {
+        try {
+          await rebuildSiteSettingsCache(siteId);
+        } catch (err) {
+          console.error(
+            `[trusted-processor] site-settings-cache rebuild failed for ${siteId}`,
+            err
+          );
+          throw err;
+        }
+      }
+      for (const plugin of trustedPlugins) {
+        const hook = plugin.hooks?.[parsed.type];
+        if (!hook) continue;
+        try {
+          await hook(parsed, makeContext(plugin, siteId));
+        } catch (err) {
+          console.error(`[trusted-processor] ${plugin.name}.${parsed.type} failed`, err);
+          throw err;
+        }
+      }
+    }
+  };
+}
+export {
+  createProcessorTrustedHandler
+};

package/dist/events/processor-untrusted.d.ts

@@ -0,0 +1,28 @@
+import { SQSHandler } from 'aws-lambda';
+import { AmplessPlugin, Config } from 'ampless';
+
+interface CreateProcessorUntrustedHandlerOpts {
+    /**
+     * The full `cms.config.plugins` array. The handler filters down to
+     * untrusted plugins itself.
+     */
+    plugins?: AmplessPlugin[];
+    /**
+     * The `cms.config.site` block, surfaced to plugin hooks via
+     * `ctx.site` (read-only — untrusted plugins have no AWS-touching
+     * capabilities).
+     */
+    site: Config['site'];
+}
+/**
+ * SQS-driven untrusted plugin executor. Untrusted plugins get a runtime
+ * context with NO AWS-touching capabilities — they can only read the
+ * event payload, run pure JS, and return. Any attempt to call
+ * `listPublishedPosts` or `writePublicAsset` throws.
+ *
+ * Re-exported by the template's thin shell
+ * `amplify/events/processor-untrusted/handler.ts`.
+ */
+declare function createProcessorUntrustedHandler(opts: CreateProcessorUntrustedHandlerOpts): SQSHandler;
+
+export { type CreateProcessorUntrustedHandlerOpts, createProcessorUntrustedHandler };

package/dist/events/processor-untrusted.js

@@ -0,0 +1,44 @@
+// src/events/processor-untrusted.ts
+function createProcessorUntrustedHandler(opts) {
+  const untrustedPlugins = (opts.plugins ?? []).filter(
+    (p) => typeof p === "object" && p.trust_level === "untrusted"
+  );
+  function makeContext(siteId) {
+    return {
+      siteId,
+      site: opts.site,
+      async listPublishedPosts() {
+        throw new Error("untrusted plugins cannot list posts");
+      },
+      async writePublicAsset() {
+        throw new Error("untrusted plugins cannot write assets");
+      }
+    };
+  }
+  return async (event) => {
+    if (untrustedPlugins.length === 0) return;
+    for (const record of event.Records) {
+      let parsed;
+      try {
+        parsed = JSON.parse(record.body);
+      } catch (err) {
+        console.error("[untrusted-processor] bad message", record.body, err);
+        continue;
+      }
+      const siteId = parsed.payload.siteId ?? "default";
+      for (const plugin of untrustedPlugins) {
+        const hook = plugin.hooks?.[parsed.type];
+        if (!hook) continue;
+        try {
+          await hook(parsed, makeContext(siteId));
+        } catch (err) {
+          console.error(`[untrusted-processor] ${plugin.name}.${parsed.type} failed`, err);
+          throw err;
+        }
+      }
+    }
+  };
+}
+export {
+  createProcessorUntrustedHandler
+};

package/dist/functions/api-key-renewer.d.ts

@@ -0,0 +1,8 @@
+/**
+ * EventBridge-triggered Lambda that rolls every AppSync API key on
+ * this API forward to `now + 364 days`. Re-exported by the template's
+ * thin shell `amplify/functions/api-key-renewer/handler.ts`.
+ */
+declare const handler: () => Promise<void>;
+
+export { handler };

package/dist/functions/api-key-renewer.js

@@ -0,0 +1,40 @@
+// src/functions/api-key-renewer.ts
+import {
+  AppSyncClient,
+  ListApiKeysCommand,
+  UpdateApiKeyCommand
+} from "@aws-sdk/client-appsync";
+var client = new AppSyncClient({});
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) throw new Error(`api-key-renewer: missing required env var ${name}`);
+  return v;
+}
+var APPSYNC_API_ID = requireEnv("APPSYNC_API_ID");
+var TTL_DAYS = 364;
+var handler = async () => {
+  const { apiKeys } = await client.send(
+    new ListApiKeysCommand({ apiId: APPSYNC_API_ID })
+  );
+  if (!apiKeys || apiKeys.length === 0) {
+    console.warn("[api-key-renewer] no api keys to renew");
+    return;
+  }
+  const expires = Math.floor(Date.now() / 1e3) + TTL_DAYS * 86400;
+  const targetIso = new Date(expires * 1e3).toISOString();
+  for (const k of apiKeys) {
+    if (!k.id) continue;
+    const beforeIso = k.expires ? new Date(k.expires * 1e3).toISOString() : "(none)";
+    await client.send(
+      new UpdateApiKeyCommand({
+        apiId: APPSYNC_API_ID,
+        id: k.id,
+        expires
+      })
+    );
+    console.log(`[api-key-renewer] ${k.id}: ${beforeIso} -> ${targetIso}`);
+  }
+};
+export {
+  handler
+};

package/dist/index.d.ts

@@ -0,0 +1,158 @@
+import { defineData } from '@aws-amplify/backend';
+
+type AuthResource = any;
+type DataResource = any;
+type StorageResource = any;
+type FunctionResource = any;
+interface DefineAmplessBackendOpts {
+    auth: AuthResource;
+    data: DataResource;
+    storage: StorageResource;
+    postConfirmation: FunctionResource;
+    eventDispatcher: FunctionResource;
+    processorTrusted: FunctionResource;
+    processorUntrusted: FunctionResource;
+    apiKeyRenewer: FunctionResource;
+}
+type AmplessBackend = any;
+/**
+ * The end-to-end ampless backend wiring: identical to the 251-line
+ * `backend.ts` that used to live in `templates/_shared/amplify/`,
+ * but parameterised on the resource objects so users only have to
+ * compose the imports.
+ *
+ * What it does, in order:
+ *   1. Calls `defineBackend` with every Ampless resource.
+ *   2. Opens up the S3 bucket to anonymous reads under `public/*`
+ *      plus a permissive CORS rule for cross-origin asset fetches.
+ *   3. Relaxes the Cognito password policy to length-only.
+ *   4. Grants the post-confirmation Lambda permission to add
+ *      newly-confirmed users to Cognito groups.
+ *   5. Enables DynamoDB Streams on Post + KvStore, provisions
+ *      Trusted/Untrusted SQS queues with a shared DLQ, wires the
+ *      dispatcher Lambda to both streams and both queues, and
+ *      grants the trusted processor scoped data / S3 access.
+ *   6. Schedules the AppSync API key renewer to run monthly.
+ *
+ * The user-side `amplify/backend.ts` becomes:
+ *
+ *     import { defineAmplessBackend } from '@ampless/backend'
+ *     import { auth } from './auth/resource'
+ *     import { data } from './data/resource'
+ *     // ...
+ *     export default defineAmplessBackend({ auth, data, ... })
+ */
+declare function defineAmplessBackend(opts: DefineAmplessBackendOpts): AmplessBackend;
+
+interface DefineAmplessAuthOpts {
+    /**
+     * The `post-confirmation` Cognito Lambda trigger that promotes the
+     * first signup to `ampless-admin`. Wire your own `defineFunction`
+     * pointing at the thin-shell handler that re-exports from
+     * `@ampless/backend/auth/post-confirmation`.
+     *
+     * Typed as `unknown` because Amplify's `defineFunction` return type
+     * carries internal pnpm paths that don't survive declaration emit —
+     * caller-side `defineFunction({ entry: './handler.ts' })` flows
+     * through without losing functionality.
+     */
+    postConfirmation?: unknown;
+}
+/**
+ * Provision the ampless Cognito User Pool / Identity Pool with the
+ * three role groups and the optional post-confirmation trigger.
+ *
+ * Public reads use AppSync's API key (not the guest Identity Pool
+ * role) because `a.handler.custom` doesn't accept `allow.guest()`
+ * in Amplify Gen 2 — see `data/resource.ts` and the RUNBOOK.
+ */
+declare function defineAmplessAuth(opts?: DefineAmplessAuthOpts): any;
+
+/**
+ * Provision the ampless S3 bucket with the standard access map:
+ *   - `public/media/*`   — guest read, admin/editor full
+ *   - `public/plugins/*` — guest read, admin full
+ *
+ * Bucket-level overrides (PublicAccessBlock, CORS, IAM policies for
+ * `public/site-settings/*`) are applied by `defineAmplessBackend`
+ * after `defineBackend` runs.
+ *
+ * Return type is `unknown` because Amplify's storage construct type
+ * carries internal pnpm paths that don't survive declaration emit —
+ * the resulting `storage` resource flows into `defineAmplessBackend`
+ * unchanged.
+ */
+declare function defineAmplessStorage(): any;
+
+interface AmplessResolverPaths {
+    listPublishedPosts: string;
+    getPublishedPost: string;
+    listPostsByTag: string;
+}
+/**
+ * Default AppSync JS resolver paths. AppSync resolves these strings at
+ * CDK synth time relative to the file that calls `defineData` — i.e.
+ * the user's `amplify/data/resource.ts`. Templates ship the three
+ * resolver files at exactly these paths.
+ *
+ * Users with a non-default layout (e.g. moving the resolvers under a
+ * `resolvers/` subdir) pass overrides through `amplessSchemaModels(a, {
+ * resolverPaths: { ... } })`.
+ */
+declare const DEFAULT_RESOLVER_PATHS: AmplessResolverPaths;
+interface AmplessSchemaModelsOpts {
+    /**
+     * Override the relative paths used for AppSync JS resolver entries.
+     * Paths are interpreted by Amplify at synth time relative to the
+     * file that calls `defineData`, NOT relative to this package — so
+     * they must point to actual `.js` files inside the user's project.
+     */
+    resolverPaths?: Partial<AmplessResolverPaths>;
+}
+/**
+ * The Ampless model + custom query definitions, returned as a plain
+ * object suitable for spreading into `a.schema({ ... })`.
+ *
+ *   const schema = a.schema({
+ *     ...amplessSchemaModels(a),
+ *     MyCustomModel: a.model({ ... }).authorization(...),
+ *   })
+ *
+ * Returning a builder-shape rather than a fully-instantiated `schema`
+ * lets the user weave custom models alongside ampless's defaults
+ * inside one `a.schema(...)` call, which is the only way Amplify Gen
+ * 2's `ClientSchema<typeof schema>` inference picks up the user's
+ * extra models.
+ */
+declare function amplessSchemaModels(a: any, opts?: AmplessSchemaModelsOpts): {
+    Post: any;
+    Page: any;
+    Media: any;
+    Taxonomy: any;
+    PostTag: any;
+    KvStore: any;
+    PublicPost: any;
+    PublicPostConnection: any;
+    listPublishedPosts: any;
+    getPublishedPost: any;
+    listPostsByTag: any;
+};
+/**
+ * Convenience helper: build a fully-instantiated `a.schema(...)`
+ * containing ampless's models plus any caller-supplied custom models.
+ * Pick whichever pattern fits — direct spread is more transparent
+ * when reading `amplify/data/resource.ts`, this helper is shorter
+ * when there are no custom models.
+ */
+declare function extendAmplessSchema(a: any, custom?: Record<string, any>, opts?: AmplessSchemaModelsOpts): any;
+/**
+ * Standard authorization modes for ampless. `userPool` is the default
+ * (admin/editor access); the API key serves the public read endpoints
+ * because `a.handler.custom` doesn't support `allow.guest()` in
+ * Amplify Gen 2 (verified 2026-04). The key has a 365-day TTL; the
+ * `@ampless/backend/functions/api-key-renewer` Lambda rotates it
+ * monthly so the public site never silently 401s.
+ */
+declare const defaultAuthorizationModes: Parameters<typeof defineData>[0]['authorizationModes'];
+
+export { type AmplessBackend, type AmplessResolverPaths, type AmplessSchemaModelsOpts, DEFAULT_RESOLVER_PATHS, type DefineAmplessAuthOpts, type DefineAmplessBackendOpts, amplessSchemaModels, defaultAuthorizationModes, defineAmplessAuth, defineAmplessBackend, defineAmplessStorage, extendAmplessSchema };

package/dist/index.js

@@ -0,0 +1,393 @@
+// src/backend.ts
+import { defineBackend } from "@aws-amplify/backend";
+import { Effect, PolicyStatement, AnyPrincipal } from "aws-cdk-lib/aws-iam";
+import { Duration, Stack } from "aws-cdk-lib";
+import { Queue } from "aws-cdk-lib/aws-sqs";
+import { StartingPosition } from "aws-cdk-lib/aws-lambda";
+import { DynamoEventSource, SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
+import { Rule, Schedule } from "aws-cdk-lib/aws-events";
+import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
+function defineAmplessBackend(opts) {
+  const backend = defineBackend({
+    auth: opts.auth,
+    data: opts.data,
+    storage: opts.storage,
+    postConfirmation: opts.postConfirmation,
+    eventDispatcher: opts.eventDispatcher,
+    processorTrusted: opts.processorTrusted,
+    processorUntrusted: opts.processorUntrusted,
+    apiKeyRenewer: opts.apiKeyRenewer
+  });
+  const cfnBucket = backend.storage.resources.cfnResources.cfnBucket;
+  cfnBucket.publicAccessBlockConfiguration = {
+    blockPublicAcls: true,
+    blockPublicPolicy: false,
+    ignorePublicAcls: true,
+    restrictPublicBuckets: false
+  };
+  cfnBucket.corsConfiguration = {
+    corsRules: [
+      {
+        allowedMethods: ["GET", "HEAD"],
+        allowedOrigins: ["*"],
+        allowedHeaders: ["*"],
+        maxAge: 3e3
+      }
+    ]
+  };
+  backend.storage.resources.bucket.addToResourcePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      principals: [new AnyPrincipal()],
+      actions: ["s3:GetObject"],
+      resources: [`${backend.storage.resources.bucket.bucketArn}/public/*`]
+    })
+  );
+  const cfnUserPool = backend.auth.resources.cfnResources.cfnUserPool;
+  cfnUserPool.policies = {
+    passwordPolicy: {
+      minimumLength: 8,
+      requireLowercase: false,
+      requireUppercase: false,
+      requireNumbers: false,
+      requireSymbols: false,
+      temporaryPasswordValidityDays: 7
+    }
+  };
+  backend.postConfirmation.resources.lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["cognito-idp:AdminAddUserToGroup", "cognito-idp:ListUsersInGroup"],
+      resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
+    })
+  );
+  const postTable = backend.data.resources.tables["Post"];
+  const cfnPostTable = backend.data.resources.cfnResources.amplifyDynamoDbTables["Post"];
+  cfnPostTable.streamSpecification = { streamViewType: "NEW_AND_OLD_IMAGES" };
+  const kvTable = backend.data.resources.tables["KvStore"];
+  const cfnKvTable = backend.data.resources.cfnResources.amplifyDynamoDbTables["KvStore"];
+  cfnKvTable.streamSpecification = { streamViewType: "NEW_AND_OLD_IMAGES" };
+  cfnKvTable.timeToLiveSpecification = { attributeName: "ttl", enabled: true };
+  const eventsStack = backend.createStack("amplessEvents");
+  const eventsDlq = new Queue(eventsStack, "EventsDlq", {
+    retentionPeriod: Duration.days(14)
+  });
+  const trustedQueue = new Queue(eventsStack, "TrustedEventsQueue", {
+    visibilityTimeout: Duration.seconds(120),
+    deadLetterQueue: { maxReceiveCount: 3, queue: eventsDlq }
+  });
+  const untrustedQueue = new Queue(eventsStack, "UntrustedEventsQueue", {
+    visibilityTimeout: Duration.seconds(60),
+    deadLetterQueue: { maxReceiveCount: 3, queue: eventsDlq }
+  });
+  const dispatcherFn = backend.eventDispatcher.resources.lambda;
+  dispatcherFn.addEventSource(
+    new DynamoEventSource(postTable, {
+      startingPosition: StartingPosition.LATEST,
+      batchSize: 10,
+      retryAttempts: 3,
+      bisectBatchOnError: true
+    })
+  );
+  dispatcherFn.addEventSource(
+    new DynamoEventSource(kvTable, {
+      startingPosition: StartingPosition.LATEST,
+      batchSize: 10,
+      retryAttempts: 3,
+      bisectBatchOnError: true
+    })
+  );
+  trustedQueue.grantSendMessages(dispatcherFn);
+  untrustedQueue.grantSendMessages(dispatcherFn);
+  dispatcherFn.addEnvironment("TRUSTED_QUEUE_URL", trustedQueue.queueUrl);
+  dispatcherFn.addEnvironment("UNTRUSTED_QUEUE_URL", untrustedQueue.queueUrl);
+  const trustedFn = backend.processorTrusted.resources.lambda;
+  trustedFn.addEventSource(new SqsEventSource(trustedQueue, { batchSize: 5 }));
+  postTable.grantReadData(trustedFn);
+  trustedFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["dynamodb:Query", "dynamodb:Scan"],
+      resources: [`${postTable.tableArn}/index/*`]
+    })
+  );
+  kvTable.grantReadData(trustedFn);
+  trustedFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:PutObject", "s3:DeleteObject"],
+      resources: [
+        `${backend.storage.resources.bucket.bucketArn}/public/plugins/*`,
+        // Built-in cache: rebuildSiteSettingsCache writes the per-site
+        // JSON the public site reads. Without this entry the
+        // `site.settings.updated` handler S3 PutObject call fails
+        // silently (CloudWatch shows AccessDenied; the public site never
+        // sees theme.active overrides because the cache file never
+        // appears).
+        `${backend.storage.resources.bucket.bucketArn}/public/site-settings/*`
+      ]
+    })
+  );
+  trustedFn.addEnvironment("AMPLESS_BUCKET_NAME", backend.storage.resources.bucket.bucketName);
+  trustedFn.addEnvironment("AMPLESS_POST_TABLE", postTable.tableName);
+  trustedFn.addEnvironment("AMPLESS_KV_TABLE", kvTable.tableName);
+  const untrustedFn = backend.processorUntrusted.resources.lambda;
+  untrustedFn.addEventSource(new SqsEventSource(untrustedQueue, { batchSize: 5 }));
+  const graphqlApi = backend.data.resources.cfnResources.cfnGraphqlApi;
+  const apiKeyRenewerFn = backend.apiKeyRenewer.resources.lambda;
+  apiKeyRenewerFn.addEnvironment("APPSYNC_API_ID", graphqlApi.attrApiId);
+  apiKeyRenewerFn.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["appsync:ListApiKeys", "appsync:UpdateApiKey"],
+      // attrArn is `arn:aws:appsync:{region}:{account}:apis/{apiId}`; the API
+      // key resources live underneath, so a wildcard suffix covers them.
+      resources: [graphqlApi.attrArn, `${graphqlApi.attrArn}/*`]
+    })
+  );
+  new Rule(Stack.of(apiKeyRenewerFn), "ApiKeyRenewerSchedule", {
+    schedule: Schedule.cron({ minute: "0", hour: "3", day: "1", month: "*", year: "*" }),
+    targets: [new LambdaFunction(apiKeyRenewerFn)]
+  });
+  return backend;
+}
+
+// src/auth/index.ts
+import { defineAuth } from "@aws-amplify/backend";
+function defineAmplessAuth(opts = {}) {
+  return defineAuth({
+    loginWith: {
+      email: true
+    },
+    groups: ["ampless-admin", "ampless-editor", "ampless-reader"],
+    triggers: opts.postConfirmation ? (
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      { postConfirmation: opts.postConfirmation }
+    ) : void 0
+  });
+}
+
+// src/storage/index.ts
+import { defineStorage } from "@aws-amplify/backend";
+function defineAmplessStorage() {
+  return defineStorage({
+    name: "amplessMedia",
+    access: (allow) => ({
+      "public/media/*": [
+        allow.guest.to(["read"]),
+        allow.groups(["ampless-admin", "ampless-editor"]).to(["read", "write", "delete"])
+      ],
+      "public/plugins/*": [
+        allow.guest.to(["read"]),
+        allow.groups(["ampless-admin"]).to(["read", "write", "delete"])
+      ]
+    })
+  });
+}
+
+// src/data/index.ts
+var DEFAULT_RESOLVER_PATHS = {
+  listPublishedPosts: "./list-published-posts.js",
+  getPublishedPost: "./get-published-post.js",
+  listPostsByTag: "./list-posts-by-tag.js"
+};
+function amplessSchemaModels(a, opts = {}) {
+  const resolverPaths = {
+    ...DEFAULT_RESOLVER_PATHS,
+    ...opts.resolverPaths
+  };
+  return {
+    Post: a.model({
+      siteId: a.string().required(),
+      postId: a.id().required(),
+      slug: a.string().required(),
+      title: a.string().required(),
+      excerpt: a.string(),
+      format: a.enum(["tiptap", "markdown", "html"]),
+      body: a.json(),
+      status: a.enum(["draft", "published"]),
+      publishedAt: a.datetime(),
+      tags: a.string().array(),
+      // Denormalized GSI keys — set by every write path (admin client,
+      // MCP tools). Same pattern as siteIdStatus: composing the
+      // partition key as a single string lets each public-read query
+      // hit DynamoDB with a pure PK Query, no filter pass.
+      //   siteIdStatus = `${siteId}#${status}`
+      //     → bySiteIdStatus partitions per site×status, sorted by publishedAt
+      //   siteIdSlug = `${siteId}#${slug}`
+      //     → bySiteIdSlug locates a single post by slug in O(1)
+      siteIdStatus: a.string(),
+      siteIdSlug: a.string()
+    }).identifier(["siteId", "postId"]).secondaryIndexes((index) => [
+      index("siteIdStatus").sortKeys(["publishedAt"]).name("bySiteIdStatus"),
+      index("siteIdSlug").name("bySiteIdSlug")
+    ]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    Page: a.model({
+      siteId: a.string().required(),
+      pageId: a.id().required(),
+      slug: a.string().required(),
+      title: a.string().required(),
+      format: a.enum(["tiptap", "markdown", "html"]),
+      body: a.json(),
+      status: a.enum(["draft", "published"]),
+      publishedAt: a.datetime()
+    }).identifier(["siteId", "pageId"]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    Media: a.model({
+      siteId: a.string().required(),
+      mediaId: a.id().required(),
+      src: a.string().required(),
+      mimeType: a.string().required(),
+      size: a.integer(),
+      delivery: a.string()
+    }).identifier(["siteId", "mediaId"]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    Taxonomy: a.model({
+      siteId: a.string().required(),
+      termId: a.id().required(),
+      type: a.enum(["category", "tag"]),
+      name: a.string().required(),
+      slug: a.string().required()
+    }).identifier(["siteId", "termId"]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    // Denormalized index for "posts by tag" queries. Each Post tag becomes
+    // one PostTag row, so listing/filtering by tag is a single Query —
+    // including date-range archive views, since publishedAt is part of the
+    // sort key. Maintained by the admin client whenever a post is created,
+    // updated, or deleted; never edited by end users.
+    //
+    //   PK: siteIdTag         e.g. "default#tech"
+    //   SK: publishedAtPostId e.g. "2026-04-27T13:57:05.679Z#post-001"
+    PostTag: a.model({
+      siteIdTag: a.string().required(),
+      publishedAtPostId: a.string().required(),
+      siteId: a.string().required(),
+      tag: a.string().required(),
+      postId: a.id().required(),
+      publishedAt: a.datetime().required(),
+      slug: a.string().required(),
+      title: a.string().required(),
+      excerpt: a.string(),
+      // Full tag list of the post (for chip rendering on tag pages).
+      tags: a.string().array()
+    }).identifier(["siteIdTag", "publishedAtPostId"]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    // Generic key/value store. Two roles in one table:
+    //   - Site settings: PK = `siteconfig:{siteId}`, SK = dotted key
+    //     (`site.name`, `media.imageDisplay`, ...). No TTL → persistent.
+    //   - Caches / plugin state: PK = whatever namespace the caller picks
+    //     (`cache:{ns}`, `pluginstate:{name}:...`). TTL set → DynamoDB
+    //     auto-deletes within ~48h of expiry.
+    //
+    // Auth is admin/editor write only. Guests never read this table
+    // directly — site settings are mirrored to S3 by the site-settings-
+    // cache built-in plugin and the public site fetches from there.
+    KvStore: a.model({
+      pk: a.string().required(),
+      sk: a.string().required(),
+      value: a.json(),
+      // Unix epoch seconds. When set, DynamoDB removes the row
+      // automatically (TimeToLive enabled in backend.ts).
+      ttl: a.integer()
+    }).identifier(["pk", "sk"]).authorization((allow) => [
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    // Custom return type for public post reads. Decoupling from `Post` lets
+    // AppSync skip the model-level (admin-only) auth check on fields.
+    PublicPost: a.customType({
+      siteId: a.string().required(),
+      postId: a.id().required(),
+      slug: a.string().required(),
+      title: a.string().required(),
+      excerpt: a.string(),
+      format: a.string(),
+      body: a.json(),
+      status: a.string(),
+      publishedAt: a.datetime(),
+      tags: a.string().array()
+    }),
+    // Paginated wrapper for list responses.
+    PublicPostConnection: a.customType({
+      items: a.ref("PublicPost").array(),
+      nextToken: a.string()
+    }),
+    // Public read endpoints — guard against draft leakage via custom resolvers.
+    // Custom handlers (`a.handler.custom`) only support apiKey / userPool /
+    // lambda / group / owner auth. `allow.guest()` (Cognito Identity Pool
+    // unauthenticated role) is NOT supported with custom handlers as of
+    // Amplify Gen 2 (2026-04). So anonymous visitors get a public API key,
+    // which has a 365-day TTL — see RUNBOOK.md for the rotation procedure.
+    // The resolvers themselves strip drafts at the data-source level, so the
+    // only thing guests can see is `status === 'published'` rows projected
+    // onto `PublicPost`.
+    listPublishedPosts: a.query().arguments({
+      siteId: a.string(),
+      // Both ISO 8601 strings; query SK condition is pushed into DynamoDB
+      // so only the matching publishedAt range is read.
+      from: a.datetime(),
+      to: a.datetime(),
+      limit: a.integer(),
+      // Opaque DynamoDB pagination cursor. Pass back the previous response's
+      // `nextToken` to fetch the next page.
+      nextToken: a.string()
+    }).returns(a.ref("PublicPostConnection")).handler(
+      a.handler.custom({
+        dataSource: a.ref("Post"),
+        entry: resolverPaths.listPublishedPosts
+      })
+    ).authorization((allow) => [
+      allow.publicApiKey(),
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    getPublishedPost: a.query().arguments({ siteId: a.string(), slug: a.string().required() }).returns(a.ref("PublicPost")).handler(
+      a.handler.custom({
+        dataSource: a.ref("Post"),
+        entry: resolverPaths.getPublishedPost
+      })
+    ).authorization((allow) => [
+      allow.publicApiKey(),
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
+    // Tag pages: newest-first only. Archive (date range) within a tag is not
+    // a common UX pattern; if it's ever needed, add `from`/`to` args here.
+    listPostsByTag: a.query().arguments({
+      siteId: a.string(),
+      tag: a.string().required(),
+      limit: a.integer(),
+      nextToken: a.string()
+    }).returns(a.ref("PublicPostConnection")).handler(
+      a.handler.custom({
+        dataSource: a.ref("PostTag"),
+        entry: resolverPaths.listPostsByTag
+      })
+    ).authorization((allow) => [
+      allow.publicApiKey(),
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ])
+  };
+}
+function extendAmplessSchema(a, custom, opts) {
+  return a.schema({
+    ...amplessSchemaModels(a, opts),
+    ...custom ?? {}
+  });
+}
+var defaultAuthorizationModes = {
+  defaultAuthorizationMode: "userPool",
+  apiKeyAuthorizationMode: { expiresInDays: 365 }
+};
+export {
+  DEFAULT_RESOLVER_PATHS,
+  amplessSchemaModels,
+  defaultAuthorizationModes,
+  defineAmplessAuth,
+  defineAmplessBackend,
+  defineAmplessStorage,
+  extendAmplessSchema
+};

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@ampless/backend",
+  "version": "0.2.0-alpha.0",
+  "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./auth/post-confirmation": {
+      "import": "./dist/auth/post-confirmation.js",
+      "types": "./dist/auth/post-confirmation.d.ts"
+    },
+    "./events/dispatcher": {
+      "import": "./dist/events/dispatcher.js",
+      "types": "./dist/events/dispatcher.d.ts"
+    },
+    "./events/processor-trusted": {
+      "import": "./dist/events/processor-trusted.js",
+      "types": "./dist/events/processor-trusted.d.ts"
+    },
+    "./events/processor-untrusted": {
+      "import": "./dist/events/processor-untrusted.js",
+      "types": "./dist/events/processor-untrusted.d.ts"
+    },
+    "./functions/api-key-renewer": {
+      "import": "./dist/functions/api-key-renewer.js",
+      "types": "./dist/functions/api-key-renewer.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/heavymoons/ampless.git",
+    "directory": "packages/backend"
+  },
+  "homepage": "https://github.com/heavymoons/ampless/tree/main/packages/backend#readme",
+  "bugs": "https://github.com/heavymoons/ampless/issues",
+  "dependencies": {
+    "@aws-sdk/client-appsync": "^3.717.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.717.0",
+    "@aws-sdk/client-dynamodb": "^3.717.0",
+    "@aws-sdk/client-s3": "^3.717.0",
+    "@aws-sdk/client-sqs": "^3.717.0",
+    "@aws-sdk/lib-dynamodb": "^3.717.0",
+    "@aws-sdk/util-dynamodb": "^3.717.0",
+    "ampless": "0.2.0-alpha.0"
+  },
+  "peerDependencies": {
+    "@aws-amplify/backend": "^1",
+    "aws-cdk-lib": "^2"
+  },
+  "devDependencies": {
+    "@aws-amplify/backend": "^1.13.0",
+    "@types/aws-lambda": "^8.10.147",
+    "aws-cdk-lib": "^2.174.0"
+  },
+  "keywords": [
+    "ampless",
+    "backend",
+    "amplify",
+    "cms"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}