@empire-builder-kit/runtime 0.0.1-alpha.1 → 0.0.1-alpha.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Empire Builder Kit Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -17,6 +17,7 @@ Publishable runtime primitives for Empire Builder Kit workspaces and apps.
 - `@empire-builder-kit/runtime/frontend`
 - `@empire-builder-kit/runtime/request-context`
 - `@empire-builder-kit/runtime/logging`
+- `@empire-builder-kit/runtime/lambda`
 - `@empire-builder-kit/runtime/observability`
 - `@empire-builder-kit/runtime/response`
 

package/dist/auth-backend.d.ts

@@ -0,0 +1,18 @@
+import { BetterAuthConfig, AuthenticatedSession } from './auth';
+import { type JWTVerifyGetKey } from 'jose';
+/**
+ * Verifies a Cognito JWT token and returns a typed session.
+ * Uses the Cognito JWKS endpoint for validation.
+ */
+export interface CognitoJwtVerifier {
+    verify(token: string): Promise<AuthenticatedSession>;
+}
+export interface CognitoJwtVerifierOptions {
+    jwks?: JWTVerifyGetKey;
+}
+export declare function createCognitoJwtVerifier(config: BetterAuthConfig, options?: CognitoJwtVerifierOptions): CognitoJwtVerifier;
+/**
+ * Extracts a Bearer token from an Authorization header.
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+//# sourceMappingURL=auth-backend.d.ts.map

package/dist/auth-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-backend.d.ts","sourceRoot":"","sources":["../src/auth-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,MAAM,CAAC;AAEd;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AA+BD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CAmCpB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAKf"}

package/dist/auth-backend.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCognitoJwtVerifier = createCognitoJwtVerifier;
+exports.extractBearerToken = extractBearerToken;
+const auth_1 = require("./auth");
+const jose_1 = require("jose");
+function hasExpectedAudience(payload, clientId) {
+    return (payload.aud === clientId ||
+        (Array.isArray(payload.aud) && payload.aud.includes(clientId)) ||
+        payload.client_id === clientId);
+}
+function normalizeGroups(groups) {
+    if (!Array.isArray(groups)) {
+        return undefined;
+    }
+    const normalized = groups.filter((group) => typeof group === 'string');
+    return normalized.length > 0 ? normalized : undefined;
+}
+function createCognitoJwtVerifier(config, options = {}) {
+    const jwks = options.jwks ??
+        (0, jose_1.createRemoteJWKSet)(new URL(`${config.issuerUrl}/.well-known/jwks.json`));
+    return {
+        async verify(token) {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                throw new Error('Invalid JWT format');
+            }
+            const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
+                algorithms: ['RS256'],
+                issuer: config.issuerUrl,
+            });
+            if (!hasExpectedAudience(payload, config.clientId)) {
+                throw new Error('Invalid audience');
+            }
+            if (!payload.sub) {
+                throw new Error('Invalid subject');
+            }
+            return (0, auth_1.sessionFromCognitoToken)({
+                sub: payload.sub,
+                email: payload.email,
+                'cognito:username': payload['cognito:username'],
+                'cognito:groups': normalizeGroups(payload['cognito:groups']),
+                exp: payload.exp,
+                iat: payload.iat,
+            });
+        },
+    };
+}
+/**
+ * Extracts a Bearer token from an Authorization header.
+ */
+function extractBearerToken(authHeader) {
+    if (!authHeader?.startsWith('Bearer ')) {
+        return null;
+    }
+    return authHeader.slice(7).trim() || null;
+}

package/dist/auth-web.d.ts

@@ -0,0 +1,18 @@
+import { BetterAuthConfig } from './auth';
+/**
+ * Creates Next.js middleware configuration for auth.
+ * Validates JWT from cookies or Authorization header.
+ */
+export declare function createAuthMiddlewareConfig(config: BetterAuthConfig): {
+    verifier: import("./auth-backend").CognitoJwtVerifier;
+    /**
+     * Extract and verify session from a Next.js request.
+     * Checks Authorization header first, then auth cookie.
+     */
+    getSession(request: {
+        headers: {
+            get(name: string): string | null;
+        };
+    }): Promise<import("./auth").AuthenticatedSession | null>;
+};
+//# sourceMappingURL=auth-web.d.ts.map

package/dist/auth-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-web.d.ts","sourceRoot":"","sources":["../src/auth-web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAG1C;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB;;IAK/D;;;OAGG;wBACuB;QACxB,OAAO,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/C;EAiBJ"}

package/dist/auth-web.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddlewareConfig = createAuthMiddlewareConfig;
+const auth_backend_1 = require("./auth-backend");
+/**
+ * Creates Next.js middleware configuration for auth.
+ * Validates JWT from cookies or Authorization header.
+ */
+function createAuthMiddlewareConfig(config) {
+    const verifier = (0, auth_backend_1.createCognitoJwtVerifier)(config);
+    return {
+        verifier,
+        /**
+         * Extract and verify session from a Next.js request.
+         * Checks Authorization header first, then auth cookie.
+         */
+        async getSession(request) {
+            const authHeader = request.headers.get('authorization');
+            const token = (0, auth_backend_1.extractBearerToken)(authHeader ?? undefined) ??
+                request.headers.get('x-auth-token');
+            if (!token) {
+                return null;
+            }
+            try {
+                return await verifier.verify(token);
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/dist/auth.d.ts

@@ -39,4 +39,30 @@ export declare function createAuthenticatedSession(input: AuthenticatedSessionIn
 export declare function isAuthenticatedSession(session: AuthSession): session is AuthenticatedSession;
 export declare function toRequestActor(session: AuthSession): RequestActor | undefined;
 export declare function toSessionLogMetadata(session: AuthSession): RequestMetadata;
+/**
+ * BetterAuth configuration contract.
+ *
+ * App groups consume auth from the core SDK. The core app group owns
+ * the Cognito user pool and exposes these connection details so
+ * BetterAuth can be configured against the shared pool.
+ */
+export interface BetterAuthConfig {
+    provider: 'cognito';
+    userPoolId: string;
+    clientId: string;
+    issuerUrl: string;
+}
+export declare function createBetterAuthConfig(options: {
+    userPoolId: string;
+    clientId: string;
+    region?: string;
+}): BetterAuthConfig;
+export declare function sessionFromCognitoToken(decoded: {
+    sub: string;
+    email?: string;
+    'cognito:username'?: string;
+    'cognito:groups'?: string[];
+    exp?: number;
+    iat?: number;
+}): AuthenticatedSession;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAmCX,wBAAgB,sBAAsB,CACpC,KAAK,GAAE,qBAA0B,GAChC,WAAW,CAQb;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAMtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,oBAAoB,CAEjC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAe1E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAmCX,wBAAgB,sBAAsB,CACpC,KAAK,GAAE,qBAA0B,GAChC,WAAW,CAQb;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAMtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,oBAAoB,CAEjC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAe1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,gBAAgB,CAQnB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,oBAAoB,CAgBvB"}

package/dist/auth.js

@@ -6,6 +6,8 @@ exports.createAuthenticatedSession = createAuthenticatedSession;
 exports.isAuthenticatedSession = isAuthenticatedSession;
 exports.toRequestActor = toRequestActor;
 exports.toSessionLogMetadata = toSessionLogMetadata;
+exports.createBetterAuthConfig = createBetterAuthConfig;
+exports.sessionFromCognitoToken = sessionFromCognitoToken;
 exports.authContract = {
     exportPath: '@empire-builder-kit/runtime/auth',
     packageName: '@empire-builder-kit/runtime',
@@ -77,3 +79,29 @@ function toSessionLogMetadata(session) {
         ...session.metadata,
     });
 }
+function createBetterAuthConfig(options) {
+    const region = options.region ?? 'us-east-1';
+    return {
+        provider: 'cognito',
+        userPoolId: options.userPoolId,
+        clientId: options.clientId,
+        issuerUrl: `https://cognito-idp.${region}.amazonaws.com/${options.userPoolId}`,
+    };
+}
+function sessionFromCognitoToken(decoded) {
+    return createAuthenticatedSession({
+        subject: {
+            id: decoded.sub,
+            email: decoded.email,
+            displayName: decoded['cognito:username'],
+            roles: decoded['cognito:groups'],
+            type: 'user',
+        },
+        expiresAt: decoded.exp
+            ? new Date(decoded.exp * 1000).toISOString()
+            : undefined,
+        issuedAt: decoded.iat
+            ? new Date(decoded.iat * 1000).toISOString()
+            : undefined,
+    });
+}

package/dist/index.d.ts

@@ -2,11 +2,12 @@ export * from './auth';
 export * from './config';
 export * from './frontend';
 export * from './logging';
+export * from './lambda';
 export * from './observability';
 export * from './request-context';
 export * from './response';
 export declare const runtimePackage: {
-    readonly exports: readonly ["@empire-builder-kit/runtime/auth", "@empire-builder-kit/runtime/config", "@empire-builder-kit/runtime/frontend", "@empire-builder-kit/runtime/request-context", "@empire-builder-kit/runtime/logging", "@empire-builder-kit/runtime/observability", "@empire-builder-kit/runtime/response"];
+    readonly exports: readonly ["@empire-builder-kit/runtime/auth", "@empire-builder-kit/runtime/config", "@empire-builder-kit/runtime/frontend", "@empire-builder-kit/runtime/request-context", "@empire-builder-kit/runtime/logging", "@empire-builder-kit/runtime/lambda", "@empire-builder-kit/runtime/observability", "@empire-builder-kit/runtime/response"];
     readonly name: "@empire-builder-kit/runtime";
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAE3B,eAAO,MAAM,cAAc;;;CAWjB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAE3B,eAAO,MAAM,cAAc;;;CAYjB,CAAC"}

package/dist/index.js

@@ -6,6 +6,7 @@ tslib_1.__exportStar(require("./auth"), exports);
 tslib_1.__exportStar(require("./config"), exports);
 tslib_1.__exportStar(require("./frontend"), exports);
 tslib_1.__exportStar(require("./logging"), exports);
+tslib_1.__exportStar(require("./lambda"), exports);
 tslib_1.__exportStar(require("./observability"), exports);
 tslib_1.__exportStar(require("./request-context"), exports);
 tslib_1.__exportStar(require("./response"), exports);
@@ -16,6 +17,7 @@ exports.runtimePackage = {
         '@empire-builder-kit/runtime/frontend',
         '@empire-builder-kit/runtime/request-context',
         '@empire-builder-kit/runtime/logging',
+        '@empire-builder-kit/runtime/lambda',
         '@empire-builder-kit/runtime/observability',
         '@empire-builder-kit/runtime/response',
     ],

package/dist/lambda.d.ts

@@ -0,0 +1,46 @@
+import { type Logger } from './logging';
+import { type RequestContext } from './request-context';
+import { type AppResponse } from './response';
+export interface RuntimeHttpEvent {
+    body?: string | null;
+    headers?: Record<string, string | undefined> | null;
+    rawPath?: string;
+    requestContext?: {
+        http?: {
+            method?: string;
+            path?: string;
+            sourceIp?: string;
+            userAgent?: string;
+        };
+        requestId?: string;
+    };
+}
+export interface RuntimeHttpJsonResponse {
+    body: string;
+    headers: Record<string, string>;
+    statusCode: number;
+}
+export interface RuntimeHttpHandlerInput<E extends RuntimeHttpEvent = RuntimeHttpEvent> {
+    context: RequestContext;
+    event: E;
+    logger: Logger;
+}
+export interface CreateHttpJsonHandlerOptions<T, E extends RuntimeHttpEvent = RuntimeHttpEvent> {
+    app: string;
+    handle(input: RuntimeHttpHandlerInput<E>): Promise<T> | T;
+    includeErrorDetails?: boolean;
+    logger?: Logger;
+    operation: string;
+    service?: string;
+    stage?: string;
+    successStatus?: number;
+}
+export type RuntimeHttpJsonHandler<E extends RuntimeHttpEvent = RuntimeHttpEvent> = (event: E) => Promise<RuntimeHttpJsonResponse>;
+export declare const lambdaContract: {
+    readonly defaultResponseFormat: "json";
+    readonly exportPath: "@empire-builder-kit/runtime/lambda";
+    readonly packageName: "@empire-builder-kit/runtime";
+};
+export declare function toHttpJsonResponse<T>(response: AppResponse<T>): RuntimeHttpJsonResponse;
+export declare function createHttpJsonHandler<T, E extends RuntimeHttpEvent = RuntimeHttpEvent>(options: CreateHttpJsonHandlerOptions<T, E>): RuntimeHttpJsonHandler<E>;
+//# sourceMappingURL=lambda.d.ts.map

package/dist/lambda.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lambda.d.ts","sourceRoot":"","sources":["../src/lambda.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE;QACf,IAAI,CAAC,EAAE;YACL,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB,CACtC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IAE7C,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B,CAC3C,CAAC,EACD,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IAE7C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,sBAAsB,CAChC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,IAC3C,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEnD,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AA8BX,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,GACvB,uBAAuB,CAczB;AAED,wBAAgB,qBAAqB,CACnC,CAAC,EACD,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,EAC7C,OAAO,EAAE,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAgGxE"}

package/dist/lambda.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lambdaContract = void 0;
+exports.toHttpJsonResponse = toHttpJsonResponse;
+exports.createHttpJsonHandler = createHttpJsonHandler;
+const logging_1 = require("./logging");
+const request_context_1 = require("./request-context");
+const response_1 = require("./response");
+exports.lambdaContract = {
+    defaultResponseFormat: 'json',
+    exportPath: '@empire-builder-kit/runtime/lambda',
+    packageName: '@empire-builder-kit/runtime',
+};
+function getHeader(headers, name) {
+    if (!headers) {
+        return undefined;
+    }
+    const lowerName = name.toLowerCase();
+    const entry = Object.entries(headers).find(([key]) => key.toLowerCase() === lowerName);
+    return entry?.[1];
+}
+function resolveStage(stage) {
+    return stage ?? process.env.SST_STAGE ?? process.env.STAGE ?? 'development';
+}
+function createResponseMeta(context) {
+    return {
+        correlationId: context.correlationId,
+        requestId: context.requestId,
+        stage: context.stage,
+    };
+}
+function toHttpJsonResponse(response) {
+    return {
+        body: JSON.stringify(response),
+        headers: {
+            'content-type': 'application/json',
+            ...(response.meta?.correlationId
+                ? { 'x-correlation-id': String(response.meta.correlationId) }
+                : {}),
+            ...(response.meta?.requestId
+                ? { 'x-request-id': String(response.meta.requestId) }
+                : {}),
+        },
+        statusCode: response.status,
+    };
+}
+function createHttpJsonHandler(options) {
+    const stage = resolveStage(options.stage);
+    const baseLogger = options.logger ??
+        (0, logging_1.createLogger)({
+            app: options.app,
+            service: options.service ?? options.operation,
+            stage,
+        });
+    return async (event) => {
+        const requestId = getHeader(event.headers, 'x-request-id') ??
+            event.requestContext?.requestId;
+        const context = (0, request_context_1.createRequestContext)({
+            app: options.app,
+            correlationId: getHeader(event.headers, 'x-correlation-id') ?? requestId,
+            metadata: {
+                method: event.requestContext?.http?.method,
+                path: event.rawPath ?? event.requestContext?.http?.path,
+                sourceIp: event.requestContext?.http?.sourceIp,
+                userAgent: event.requestContext?.http?.userAgent,
+            },
+            operation: options.operation,
+            requestId,
+            stage,
+        });
+        const requestLogger = baseLogger.child({
+            context,
+            service: options.service ?? options.operation,
+            stage,
+        });
+        requestLogger.info(`${options.app}.${options.operation} request received`, {
+            metadata: {
+                method: event.requestContext?.http?.method,
+                path: event.rawPath ?? event.requestContext?.http?.path,
+            },
+        });
+        try {
+            const data = await options.handle({
+                context,
+                event,
+                logger: requestLogger,
+            });
+            const response = (0, response_1.createSuccessResponse)(data, {
+                meta: createResponseMeta(context),
+                status: options.successStatus,
+            });
+            requestLogger.info(`${options.app}.${options.operation} request completed`, {
+                metadata: {
+                    status: response.status,
+                },
+            });
+            const httpResponse = toHttpJsonResponse(response);
+            return {
+                ...httpResponse,
+                headers: {
+                    ...httpResponse.headers,
+                    ...(0, request_context_1.toRequestHeaders)(context),
+                },
+            };
+        }
+        catch (error) {
+            const response = (0, response_1.createErrorResponse)(error, {
+                includeDetails: options.includeErrorDetails,
+                meta: createResponseMeta(context),
+            });
+            requestLogger.error(`${options.app}.${options.operation} request failed`, {
+                error,
+                metadata: {
+                    status: response.status,
+                },
+            });
+            const httpResponse = toHttpJsonResponse(response);
+            return {
+                ...httpResponse,
+                headers: {
+                    ...httpResponse.headers,
+                    ...(0, request_context_1.toRequestHeaders)(context),
+                },
+            };
+        }
+    };
+}

package/dist/observability.d.ts

@@ -53,6 +53,22 @@ export interface QueueAlarmRegistration extends QueueAlarmInput {
     thresholds: QueueAlertThresholds;
 }
 export type MonitoringOwner = 'platform' | 'product';
+export type AppGroupAlarmKind = 'app-runtime-errors' | 'web-5xx-errors' | 'function-errors' | 'runtime-smoke-failures';
+export interface AppGroupObservabilityInput {
+    app: string;
+    functions?: readonly string[];
+    owner?: MonitoringOwner;
+    stage: string;
+    summary?: string;
+    webApps?: readonly string[];
+}
+export interface AppGroupObservabilityRegistration extends AppGroupObservabilityInput {
+    alarms: AlarmDefinition[];
+    dashboards: MonitoringDashboardRegistration[];
+    owner: MonitoringOwner;
+    queues: QueueAlarmRegistration[];
+    summary: string;
+}
 export interface AppGroupMonitoringRegistration {
     app: string;
     dashboards: MonitoringDashboardRegistration[];
@@ -67,5 +83,7 @@ export declare function createQueueAlarmDefinitions(input: QueueAlarmInput): Ala
 export declare function createDashboardPath(input: DashboardPathInput): string;
 export declare function createDashboardRegistration(input: DashboardRegistrationInput): MonitoringDashboardRegistration;
 export declare function createQueueAlarmRegistration(input: QueueAlarmRegistrationInput): QueueAlarmRegistration;
+export declare function createDefaultAppGroupAlarmDefinitions(input: AppGroupObservabilityInput): AlarmDefinition[];
+export declare function createAppGroupObservabilityRegistration(input: AppGroupObservabilityInput): AppGroupObservabilityRegistration;
 export declare function defineAppGroupMonitoringRegistration<T extends AppGroupMonitoringRegistration>(registration: T): T;
 //# sourceMappingURL=observability.d.ts.map

package/dist/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,+BAA+B,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,+BACf,SAAQ,kBAAkB,EACxB,IAAI,CAAC,0BAA0B,EAAE,aAAa,GAAG,OAAO,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ7D;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAC5C,oBAAoB,CAOtB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,eAAe,GACrB,eAAe,EAAE,CAmEnB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,+BAA+B,CAKjC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,2BAA2B,GACjC,sBAAsB,CAkBxB;AAED,wBAAgB,oCAAoC,CAClD,CAAC,SAAS,8BAA8B,EACxC,YAAY,EAAE,CAAC,GAAG,CAAC,CAEpB"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,+BAA+B,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,+BACf,SACE,kBAAkB,EAClB,IAAI,CAAC,0BAA0B,EAAE,aAAa,GAAG,OAAO,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,iCAAkC,SAAQ,0BAA0B;IACnF,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ7D;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAC5C,oBAAoB,CAOtB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,eAAe,GACrB,eAAe,EAAE,CAmEnB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,+BAA+B,CAKjC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,2BAA2B,GACjC,sBAAsB,CAkBxB;AAaD,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,0BAA0B,GAChC,eAAe,EAAE,CAyFnB;AAED,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,0BAA0B,GAChC,iCAAiC,CAsBnC;AAED,wBAAgB,oCAAoC,CAClD,CAAC,SAAS,8BAA8B,EACxC,YAAY,EAAE,CAAC,GAAG,CAAC,CAEpB"}

package/dist/observability.js

@@ -7,6 +7,8 @@ exports.createQueueAlarmDefinitions = createQueueAlarmDefinitions;
 exports.createDashboardPath = createDashboardPath;
 exports.createDashboardRegistration = createDashboardRegistration;
 exports.createQueueAlarmRegistration = createQueueAlarmRegistration;
+exports.createDefaultAppGroupAlarmDefinitions = createDefaultAppGroupAlarmDefinitions;
+exports.createAppGroupObservabilityRegistration = createAppGroupObservabilityRegistration;
 exports.defineAppGroupMonitoringRegistration = defineAppGroupMonitoringRegistration;
 function normalizeSegment(value) {
     return value
@@ -129,6 +131,120 @@ function createQueueAlarmRegistration(input) {
         thresholds,
     };
 }
+function createAppGroupMetricDimensions(input, extra = {}) {
+    return {
+        App: input.app,
+        Stage: input.stage,
+        ...extra,
+    };
+}
+function createDefaultAppGroupAlarmDefinitions(input) {
+    const namespace = createMetricNamespace(input.app);
+    const alarms = [
+        {
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `Runtime errors for ${input.app} exceed the app-group baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input),
+            evaluationPeriods: 1,
+            metricName: 'RuntimeErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: 'app',
+                metric: 'runtime-errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        },
+    ];
+    for (const webApp of input.webApps ?? []) {
+        alarms.push({
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `5xx responses for ${input.app}/${webApp} exceed the web baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input, {
+                WebApp: webApp,
+            }),
+            evaluationPeriods: 1,
+            metricName: 'Web5xxErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: `web-${webApp}`,
+                metric: '5xx-errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        });
+    }
+    for (const functionName of input.functions ?? []) {
+        alarms.push({
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `Lambda errors for ${input.app}/${functionName} exceed the function baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input, {
+                Function: functionName,
+            }),
+            evaluationPeriods: 1,
+            metricName: 'FunctionErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: `function-${functionName}`,
+                metric: 'errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        });
+    }
+    alarms.push({
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        description: `Runtime smoke failures for ${input.app} exceed the release-readiness threshold.`,
+        dimensions: createAppGroupMetricDimensions(input),
+        evaluationPeriods: 1,
+        metricName: 'RuntimeSmokeFailures',
+        name: createAlarmName({
+            app: input.app,
+            component: 'runtime-smoke',
+            metric: 'failures',
+            severity: 'critical',
+            stage: input.stage,
+        }),
+        namespace,
+        periodSeconds: 300,
+        severity: 'critical',
+        threshold: 1,
+    });
+    return alarms;
+}
+function createAppGroupObservabilityRegistration(input) {
+    const owner = input.owner ?? 'product';
+    const summary = input.summary ??
+        `${input.app} app-group CloudWatch baseline for runtime health, web health, function errors, and smoke validation.`;
+    return {
+        ...input,
+        alarms: createDefaultAppGroupAlarmDefinitions(input),
+        dashboards: [
+            createDashboardRegistration({
+                app: input.app,
+                dashboard: 'operations',
+                description: summary,
+                stage: input.stage,
+                title: `${input.app} Operations`,
+            }),
+        ],
+        owner,
+        queues: [],
+        summary,
+    };
+}
 function defineAppGroupMonitoringRegistration(registration) {
     return registration;
 }

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@empire-builder-kit/runtime",
-  "version": "0.0.1-alpha.1",
+  "version": "0.0.1-alpha.10",
+  "license": "MIT",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": false
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,6 +23,18 @@
       "import": "./dist/auth.js",
       "default": "./dist/auth.js"
     },
+    "./auth-backend": {
+      "@org/source": "./src/auth-backend.ts",
+      "types": "./dist/auth-backend.d.ts",
+      "import": "./dist/auth-backend.js",
+      "default": "./dist/auth-backend.js"
+    },
+    "./auth-web": {
+      "@org/source": "./src/auth-web.ts",
+      "types": "./dist/auth-web.d.ts",
+      "import": "./dist/auth-web.js",
+      "default": "./dist/auth-web.js"
+    },
     "./config": {
       "@org/source": "./src/config.ts",
       "types": "./dist/config.d.ts",
@@ -45,6 +59,12 @@
       "import": "./dist/logging.js",
       "default": "./dist/logging.js"
     },
+    "./lambda": {
+      "@org/source": "./src/lambda.ts",
+      "types": "./dist/lambda.d.ts",
+      "import": "./dist/lambda.js",
+      "default": "./dist/lambda.js"
+    },
     "./observability": {
       "@org/source": "./src/observability.ts",
       "types": "./dist/observability.d.ts",
@@ -104,6 +124,16 @@
     }
   },
   "dependencies": {
+    "jose": "^6.2.2",
     "tslib": "^2.3.0"
-  }
-}
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LukasGuptaLeary/empire-builder-kit.git",
+    "directory": "packages/runtime"
+  },
+  "bugs": {
+    "url": "https://github.com/LukasGuptaLeary/empire-builder-kit/issues"
+  },
+  "homepage": "https://github.com/LukasGuptaLeary/empire-builder-kit#readme"
+}