@empire-builder-kit/runtime 0.0.1-alpha.1 → 0.0.1-alpha.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Empire Builder Kit Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth-backend.d.ts

@@ -0,0 +1,18 @@
+import { BetterAuthConfig, AuthenticatedSession } from './auth';
+import { type JWTVerifyGetKey } from 'jose';
+/**
+ * Verifies a Cognito JWT token and returns a typed session.
+ * Uses the Cognito JWKS endpoint for validation.
+ */
+export interface CognitoJwtVerifier {
+    verify(token: string): Promise<AuthenticatedSession>;
+}
+export interface CognitoJwtVerifierOptions {
+    jwks?: JWTVerifyGetKey;
+}
+export declare function createCognitoJwtVerifier(config: BetterAuthConfig, options?: CognitoJwtVerifierOptions): CognitoJwtVerifier;
+/**
+ * Extracts a Bearer token from an Authorization header.
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+//# sourceMappingURL=auth-backend.d.ts.map

package/dist/auth-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-backend.d.ts","sourceRoot":"","sources":["../src/auth-backend.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,MAAM,CAAC;AAEd;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AA+BD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CAmCpB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAKf"}

package/dist/auth-backend.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCognitoJwtVerifier = createCognitoJwtVerifier;
+exports.extractBearerToken = extractBearerToken;
+const auth_1 = require("./auth");
+const jose_1 = require("jose");
+function hasExpectedAudience(payload, clientId) {
+    return (payload.aud === clientId ||
+        (Array.isArray(payload.aud) && payload.aud.includes(clientId)) ||
+        payload.client_id === clientId);
+}
+function normalizeGroups(groups) {
+    if (!Array.isArray(groups)) {
+        return undefined;
+    }
+    const normalized = groups.filter((group) => typeof group === 'string');
+    return normalized.length > 0 ? normalized : undefined;
+}
+function createCognitoJwtVerifier(config, options = {}) {
+    const jwks = options.jwks ??
+        (0, jose_1.createRemoteJWKSet)(new URL(`${config.issuerUrl}/.well-known/jwks.json`));
+    return {
+        async verify(token) {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                throw new Error('Invalid JWT format');
+            }
+            const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
+                algorithms: ['RS256'],
+                issuer: config.issuerUrl,
+            });
+            if (!hasExpectedAudience(payload, config.clientId)) {
+                throw new Error('Invalid audience');
+            }
+            if (!payload.sub) {
+                throw new Error('Invalid subject');
+            }
+            return (0, auth_1.sessionFromCognitoToken)({
+                sub: payload.sub,
+                email: payload.email,
+                'cognito:username': payload['cognito:username'],
+                'cognito:groups': normalizeGroups(payload['cognito:groups']),
+                exp: payload.exp,
+                iat: payload.iat,
+            });
+        },
+    };
+}
+/**
+ * Extracts a Bearer token from an Authorization header.
+ */
+function extractBearerToken(authHeader) {
+    if (!authHeader?.startsWith('Bearer ')) {
+        return null;
+    }
+    return authHeader.slice(7).trim() || null;
+}

package/dist/auth-web.d.ts

@@ -0,0 +1,18 @@
+import { BetterAuthConfig } from './auth';
+/**
+ * Creates Next.js middleware configuration for auth.
+ * Validates JWT from cookies or Authorization header.
+ */
+export declare function createAuthMiddlewareConfig(config: BetterAuthConfig): {
+    verifier: import("./auth-backend").CognitoJwtVerifier;
+    /**
+     * Extract and verify session from a Next.js request.
+     * Checks Authorization header first, then auth cookie.
+     */
+    getSession(request: {
+        headers: {
+            get(name: string): string | null;
+        };
+    }): Promise<import("./auth").AuthenticatedSession | null>;
+};
+//# sourceMappingURL=auth-web.d.ts.map

package/dist/auth-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-web.d.ts","sourceRoot":"","sources":["../src/auth-web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAG1C;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB;;IAK/D;;;OAGG;wBACuB;QACxB,OAAO,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/C;EAiBJ"}

package/dist/auth-web.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddlewareConfig = createAuthMiddlewareConfig;
+const auth_backend_1 = require("./auth-backend");
+/**
+ * Creates Next.js middleware configuration for auth.
+ * Validates JWT from cookies or Authorization header.
+ */
+function createAuthMiddlewareConfig(config) {
+    const verifier = (0, auth_backend_1.createCognitoJwtVerifier)(config);
+    return {
+        verifier,
+        /**
+         * Extract and verify session from a Next.js request.
+         * Checks Authorization header first, then auth cookie.
+         */
+        async getSession(request) {
+            const authHeader = request.headers.get('authorization');
+            const token = (0, auth_backend_1.extractBearerToken)(authHeader ?? undefined) ??
+                request.headers.get('x-auth-token');
+            if (!token) {
+                return null;
+            }
+            try {
+                return await verifier.verify(token);
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/dist/auth.d.ts

@@ -39,4 +39,30 @@ export declare function createAuthenticatedSession(input: AuthenticatedSessionIn
 export declare function isAuthenticatedSession(session: AuthSession): session is AuthenticatedSession;
 export declare function toRequestActor(session: AuthSession): RequestActor | undefined;
 export declare function toSessionLogMetadata(session: AuthSession): RequestMetadata;
+/**
+ * BetterAuth configuration contract.
+ *
+ * App groups consume auth from the core SDK. The core app group owns
+ * the Cognito user pool and exposes these connection details so
+ * BetterAuth can be configured against the shared pool.
+ */
+export interface BetterAuthConfig {
+    provider: 'cognito';
+    userPoolId: string;
+    clientId: string;
+    issuerUrl: string;
+}
+export declare function createBetterAuthConfig(options: {
+    userPoolId: string;
+    clientId: string;
+    region?: string;
+}): BetterAuthConfig;
+export declare function sessionFromCognitoToken(decoded: {
+    sub: string;
+    email?: string;
+    'cognito:username'?: string;
+    'cognito:groups'?: string[];
+    exp?: number;
+    iat?: number;
+}): AuthenticatedSession;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAmCX,wBAAgB,sBAAsB,CACpC,KAAK,GAAE,qBAA0B,GAChC,WAAW,CAQb;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAMtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,oBAAoB,CAEjC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAe1E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,eAAe,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAmCX,wBAAgB,sBAAsB,CACpC,KAAK,GAAE,qBAA0B,GAChC,WAAW,CAQb;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAMtB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,oBAAoB,CAEjC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,eAAe,CAe1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,gBAAgB,CAQnB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,oBAAoB,CAgBvB"}

package/dist/auth.js

@@ -6,6 +6,8 @@ exports.createAuthenticatedSession = createAuthenticatedSession;
 exports.isAuthenticatedSession = isAuthenticatedSession;
 exports.toRequestActor = toRequestActor;
 exports.toSessionLogMetadata = toSessionLogMetadata;
+exports.createBetterAuthConfig = createBetterAuthConfig;
+exports.sessionFromCognitoToken = sessionFromCognitoToken;
 exports.authContract = {
     exportPath: '@empire-builder-kit/runtime/auth',
     packageName: '@empire-builder-kit/runtime',
@@ -77,3 +79,29 @@ function toSessionLogMetadata(session) {
         ...session.metadata,
     });
 }
+function createBetterAuthConfig(options) {
+    const region = options.region ?? 'us-east-1';
+    return {
+        provider: 'cognito',
+        userPoolId: options.userPoolId,
+        clientId: options.clientId,
+        issuerUrl: `https://cognito-idp.${region}.amazonaws.com/${options.userPoolId}`,
+    };
+}
+function sessionFromCognitoToken(decoded) {
+    return createAuthenticatedSession({
+        subject: {
+            id: decoded.sub,
+            email: decoded.email,
+            displayName: decoded['cognito:username'],
+            roles: decoded['cognito:groups'],
+            type: 'user',
+        },
+        expiresAt: decoded.exp
+            ? new Date(decoded.exp * 1000).toISOString()
+            : undefined,
+        issuedAt: decoded.iat
+            ? new Date(decoded.iat * 1000).toISOString()
+            : undefined,
+    });
+}

package/dist/observability.d.ts

@@ -53,6 +53,22 @@ export interface QueueAlarmRegistration extends QueueAlarmInput {
     thresholds: QueueAlertThresholds;
 }
 export type MonitoringOwner = 'platform' | 'product';
+export type AppGroupAlarmKind = 'app-runtime-errors' | 'web-5xx-errors' | 'function-errors' | 'runtime-smoke-failures';
+export interface AppGroupObservabilityInput {
+    app: string;
+    functions?: readonly string[];
+    owner?: MonitoringOwner;
+    stage: string;
+    summary?: string;
+    webApps?: readonly string[];
+}
+export interface AppGroupObservabilityRegistration extends AppGroupObservabilityInput {
+    alarms: AlarmDefinition[];
+    dashboards: MonitoringDashboardRegistration[];
+    owner: MonitoringOwner;
+    queues: QueueAlarmRegistration[];
+    summary: string;
+}
 export interface AppGroupMonitoringRegistration {
     app: string;
     dashboards: MonitoringDashboardRegistration[];
@@ -67,5 +83,7 @@ export declare function createQueueAlarmDefinitions(input: QueueAlarmInput): Ala
 export declare function createDashboardPath(input: DashboardPathInput): string;
 export declare function createDashboardRegistration(input: DashboardRegistrationInput): MonitoringDashboardRegistration;
 export declare function createQueueAlarmRegistration(input: QueueAlarmRegistrationInput): QueueAlarmRegistration;
+export declare function createDefaultAppGroupAlarmDefinitions(input: AppGroupObservabilityInput): AlarmDefinition[];
+export declare function createAppGroupObservabilityRegistration(input: AppGroupObservabilityInput): AppGroupObservabilityRegistration;
 export declare function defineAppGroupMonitoringRegistration<T extends AppGroupMonitoringRegistration>(registration: T): T;
 //# sourceMappingURL=observability.d.ts.map

package/dist/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,+BAA+B,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,+BACf,SAAQ,kBAAkB,EACxB,IAAI,CAAC,0BAA0B,EAAE,aAAa,GAAG,OAAO,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ7D;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAC5C,oBAAoB,CAOtB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,eAAe,GACrB,eAAe,EAAE,CAmEnB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,+BAA+B,CAKjC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,2BAA2B,GACjC,sBAAsB,CAkBxB;AAED,wBAAgB,oCAAoC,CAClD,CAAC,SAAS,8BAA8B,EACxC,YAAY,EAAE,CAAC,GAAG,CAAC,CAEpB"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,+BAA+B,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,+BACf,SACE,kBAAkB,EAClB,IAAI,CAAC,0BAA0B,EAAE,aAAa,GAAG,OAAO,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,iCAAkC,SAAQ,0BAA0B;IACnF,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,+BAA+B,EAAE,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAUD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ7D;AAED,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAC5C,oBAAoB,CAOtB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,eAAe,GACrB,eAAe,EAAE,CAmEnB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,+BAA+B,CAKjC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,2BAA2B,GACjC,sBAAsB,CAkBxB;AAaD,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,0BAA0B,GAChC,eAAe,EAAE,CAyFnB;AAED,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,0BAA0B,GAChC,iCAAiC,CAsBnC;AAED,wBAAgB,oCAAoC,CAClD,CAAC,SAAS,8BAA8B,EACxC,YAAY,EAAE,CAAC,GAAG,CAAC,CAEpB"}

package/dist/observability.js

@@ -7,6 +7,8 @@ exports.createQueueAlarmDefinitions = createQueueAlarmDefinitions;
 exports.createDashboardPath = createDashboardPath;
 exports.createDashboardRegistration = createDashboardRegistration;
 exports.createQueueAlarmRegistration = createQueueAlarmRegistration;
+exports.createDefaultAppGroupAlarmDefinitions = createDefaultAppGroupAlarmDefinitions;
+exports.createAppGroupObservabilityRegistration = createAppGroupObservabilityRegistration;
 exports.defineAppGroupMonitoringRegistration = defineAppGroupMonitoringRegistration;
 function normalizeSegment(value) {
     return value
@@ -129,6 +131,120 @@ function createQueueAlarmRegistration(input) {
         thresholds,
     };
 }
+function createAppGroupMetricDimensions(input, extra = {}) {
+    return {
+        App: input.app,
+        Stage: input.stage,
+        ...extra,
+    };
+}
+function createDefaultAppGroupAlarmDefinitions(input) {
+    const namespace = createMetricNamespace(input.app);
+    const alarms = [
+        {
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `Runtime errors for ${input.app} exceed the app-group baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input),
+            evaluationPeriods: 1,
+            metricName: 'RuntimeErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: 'app',
+                metric: 'runtime-errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        },
+    ];
+    for (const webApp of input.webApps ?? []) {
+        alarms.push({
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `5xx responses for ${input.app}/${webApp} exceed the web baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input, {
+                WebApp: webApp,
+            }),
+            evaluationPeriods: 1,
+            metricName: 'Web5xxErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: `web-${webApp}`,
+                metric: '5xx-errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        });
+    }
+    for (const functionName of input.functions ?? []) {
+        alarms.push({
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            description: `Lambda errors for ${input.app}/${functionName} exceed the function baseline threshold.`,
+            dimensions: createAppGroupMetricDimensions(input, {
+                Function: functionName,
+            }),
+            evaluationPeriods: 1,
+            metricName: 'FunctionErrors',
+            name: createAlarmName({
+                app: input.app,
+                component: `function-${functionName}`,
+                metric: 'errors',
+                severity: 'high',
+                stage: input.stage,
+            }),
+            namespace,
+            periodSeconds: 60,
+            severity: 'high',
+            threshold: 1,
+        });
+    }
+    alarms.push({
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        description: `Runtime smoke failures for ${input.app} exceed the release-readiness threshold.`,
+        dimensions: createAppGroupMetricDimensions(input),
+        evaluationPeriods: 1,
+        metricName: 'RuntimeSmokeFailures',
+        name: createAlarmName({
+            app: input.app,
+            component: 'runtime-smoke',
+            metric: 'failures',
+            severity: 'critical',
+            stage: input.stage,
+        }),
+        namespace,
+        periodSeconds: 300,
+        severity: 'critical',
+        threshold: 1,
+    });
+    return alarms;
+}
+function createAppGroupObservabilityRegistration(input) {
+    const owner = input.owner ?? 'product';
+    const summary = input.summary ??
+        `${input.app} app-group CloudWatch baseline for runtime health, web health, function errors, and smoke validation.`;
+    return {
+        ...input,
+        alarms: createDefaultAppGroupAlarmDefinitions(input),
+        dashboards: [
+            createDashboardRegistration({
+                app: input.app,
+                dashboard: 'operations',
+                description: summary,
+                stage: input.stage,
+                title: `${input.app} Operations`,
+            }),
+        ],
+        owner,
+        queues: [],
+        summary,
+    };
+}
 function defineAppGroupMonitoringRegistration(registration) {
     return registration;
 }

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@empire-builder-kit/runtime",
-  "version": "0.0.1-alpha.1",
+  "version": "0.0.1-alpha.5",
+  "license": "MIT",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": false
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,6 +23,18 @@
       "import": "./dist/auth.js",
       "default": "./dist/auth.js"
     },
+    "./auth-backend": {
+      "@org/source": "./src/auth-backend.ts",
+      "types": "./dist/auth-backend.d.ts",
+      "import": "./dist/auth-backend.js",
+      "default": "./dist/auth-backend.js"
+    },
+    "./auth-web": {
+      "@org/source": "./src/auth-web.ts",
+      "types": "./dist/auth-web.d.ts",
+      "import": "./dist/auth-web.js",
+      "default": "./dist/auth-web.js"
+    },
     "./config": {
       "@org/source": "./src/config.ts",
       "types": "./dist/config.d.ts",
@@ -104,6 +118,16 @@
     }
   },
   "dependencies": {
+    "jose": "^6.2.2",
     "tslib": "^2.3.0"
-  }
-}
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LukasGuptaLeary/empire-builder-kit.git",
+    "directory": "packages/runtime"
+  },
+  "bugs": {
+    "url": "https://github.com/LukasGuptaLeary/empire-builder-kit/issues"
+  },
+  "homepage": "https://github.com/LukasGuptaLeary/empire-builder-kit#readme"
+}