@empire-builder-kit/runtime 0.0.1-alpha.9 → 1.0.0-beta.11

package/src/database.d.ts

@@ -0,0 +1,32 @@
+export interface DatabaseCredential {
+    database: string;
+    host: string;
+    password: string;
+    port: number;
+    username: string;
+}
+export interface LocalDatabaseResource extends DatabaseCredential {
+    provider: 'local';
+}
+export interface SecretsManagerDatabaseResource {
+    database: string;
+    host: string;
+    port: number;
+    provider: 'aws-secrets-manager';
+    secretArn: string;
+    username: string;
+}
+export type LinkedDatabaseResource = LocalDatabaseResource | SecretsManagerDatabaseResource;
+export interface DatabaseTlsOptions {
+    ca: string;
+    rejectUnauthorized: true;
+}
+export interface ResolveDatabaseCredentialOptions {
+    cacheTtlMs?: number;
+    loadSecret?: (secretArn: string) => Promise<string>;
+    now?: () => number;
+}
+export declare function databaseTlsOptions(resource: LinkedDatabaseResource): false | DatabaseTlsOptions;
+export declare function resolveDatabaseCredential(resource: LinkedDatabaseResource, options?: ResolveDatabaseCredentialOptions): Promise<DatabaseCredential>;
+export declare function invalidateDatabaseCredential(resource: SecretsManagerDatabaseResource | string): void;
+export { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';

package/src/database.js

@@ -0,0 +1,119 @@
+import { __awaiter } from "tslib";
+import { GetSecretValueCommand, SecretsManagerClient, } from '@aws-sdk/client-secrets-manager';
+import { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';
+export function databaseTlsOptions(resource) {
+    if (resource.provider === 'local')
+        return false;
+    if (resource.provider === 'aws-secrets-manager') {
+        return {
+            ca: RDS_GLOBAL_CA_BUNDLE,
+            rejectUnauthorized: true,
+        };
+    }
+    throw new Error('Unsupported linked database credential provider.');
+}
+const credentialCache = new Map();
+let secretsManagerClient;
+function requireString(value, field) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new Error(`Database credential ${field} must be a non-empty string.`);
+    }
+    return value;
+}
+function requirePort(value) {
+    if (typeof value !== 'number' ||
+        !Number.isSafeInteger(value) ||
+        value < 1 ||
+        value > 65535) {
+        throw new Error('Database credential port must be from 1 through 65535.');
+    }
+    return value;
+}
+function requireSecretArn(value) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new Error('Linked database credential secretArn must be a non-empty string.');
+    }
+    return value;
+}
+function parseCredential(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (_a) {
+        throw new Error('Database credential secret must contain valid JSON.');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Database credential secret must contain a JSON object.');
+    }
+    const fields = parsed;
+    return {
+        database: requireString(fields['database'], 'database'),
+        host: requireString(fields['host'], 'host'),
+        password: requireString(fields['password'], 'password'),
+        port: requirePort(fields['port']),
+        username: requireString(fields['username'], 'username'),
+    };
+}
+function loadSecretFromAws(secretArn) {
+    return __awaiter(this, void 0, void 0, function* () {
+        secretsManagerClient !== null && secretsManagerClient !== void 0 ? secretsManagerClient : (secretsManagerClient = new SecretsManagerClient({}));
+        const result = yield secretsManagerClient.send(new GetSecretValueCommand({ SecretId: secretArn }));
+        if (!result.SecretString) {
+            throw new Error('Database credential secret must use a JSON SecretString value.');
+        }
+        return result.SecretString;
+    });
+}
+function assertReferenceMatches(resource, credential) {
+    for (const field of ['database', 'host', 'port', 'username']) {
+        if (credential[field] !== resource[field]) {
+            throw new Error(`Database credential ${field} does not match its linked reference.`);
+        }
+    }
+}
+export function resolveDatabaseCredential(resource_1) {
+    return __awaiter(this, arguments, void 0, function* (resource, options = {}) {
+        var _a, _b, _c, _d;
+        if (resource.provider === 'local') {
+            return {
+                database: requireString(resource.database, 'database'),
+                host: requireString(resource.host, 'host'),
+                password: requireString(resource.password, 'password'),
+                port: requirePort(resource.port),
+                username: requireString(resource.username, 'username'),
+            };
+        }
+        if (resource.provider !== 'aws-secrets-manager') {
+            throw new Error('Unsupported linked database credential provider.');
+        }
+        const secretArn = requireSecretArn(resource.secretArn);
+        const now = (_b = (_a = options.now) === null || _a === void 0 ? void 0 : _a.call(options)) !== null && _b !== void 0 ? _b : Date.now();
+        const cacheTtlMs = (_c = options.cacheTtlMs) !== null && _c !== void 0 ? _c : 60000;
+        if (!Number.isSafeInteger(cacheTtlMs) ||
+            cacheTtlMs < 0 ||
+            cacheTtlMs > 15 * 60000) {
+            throw new Error('Database credential cacheTtlMs must be from 0 through 900000.');
+        }
+        const cached = credentialCache.get(secretArn);
+        if (cached && cached.expiresAt > now) {
+            assertReferenceMatches(resource, cached.value);
+            return cached.value;
+        }
+        const secret = yield ((_d = options.loadSecret) !== null && _d !== void 0 ? _d : loadSecretFromAws)(secretArn);
+        const credential = parseCredential(secret);
+        assertReferenceMatches(resource, credential);
+        if (cacheTtlMs > 0) {
+            credentialCache.set(secretArn, {
+                expiresAt: now + cacheTtlMs,
+                value: credential,
+            });
+        }
+        return credential;
+    });
+}
+export function invalidateDatabaseCredential(resource) {
+    credentialCache.delete(typeof resource === 'string' ? resource : resource.secretArn);
+}
+export { RDS_GLOBAL_CA_BUNDLE } from './rds-global-ca-bundle.js';
+//# sourceMappingURL=database.js.map

package/src/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../../packages/runtime/src/database.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AA0CjE,MAAM,UAAU,kBAAkB,CAChC,QAAgC;IAEhC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,oBAAoB;YACxB,kBAAkB,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC5D,IAAI,oBAAsD,CAAC;AAE3D,SAAS,aAAa,CACpB,KAAc,EACd,KAA+B;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,8BAA8B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,KAAK,EACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,OAAO;QACL,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;QACvD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC3C,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;QACvD,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,SAAe,iBAAiB,CAAC,SAAiB;;QAChD,oBAAoB,aAApB,oBAAoB,cAApB,oBAAoB,IAApB,oBAAoB,GAAK,IAAI,oBAAoB,CAAC,EAAE,CAAC,EAAC;QACtD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAC5C,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACnD,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;CAAA;AAED,SAAS,sBAAsB,CAC7B,QAAwC,EACxC,UAA8B;IAE9B,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAU,EAAE,CAAC;QACtE,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,uCAAuC,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAgB,yBAAyB;yDAC7C,QAAgC,EAChC,UAA4C,EAAE;;QAE9C,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO;gBACL,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACtD,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAC1C,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACtD,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAA,MAAA,OAAO,CAAC,GAAG,uDAAI,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,KAAM,CAAC;QAChD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,UAAU,GAAG,CAAC;YACd,UAAU,GAAG,EAAE,GAAG,KAAM,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC7B,SAAS,EAAE,GAAG,GAAG,UAAU;gBAC3B,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CAAA;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAiD;IAEjD,eAAe,CAAC,MAAM,CACpB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAC7D,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC"}

package/src/events.d.ts

@@ -0,0 +1,74 @@
+import type { RequestActor, RequestContext } from './request-context.js';
+export interface EventContractRef {
+    readonly source: string;
+    readonly detailType: string;
+    readonly schemaVersion: number;
+}
+export interface EventEnvelopeMeta {
+    eventId: string;
+    schemaVersion: number;
+    occurredAt: string;
+    app: string;
+    stage: string;
+    correlationId: string;
+    causationId?: string;
+    actor?: RequestActor;
+    tenantId?: string;
+    traceParent?: string;
+    traceState?: string;
+}
+export interface EventEnvelope<TData = unknown> {
+    meta: EventEnvelopeMeta;
+    data: TData;
+}
+export interface PublishableEventEntry {
+    eventBusName: string;
+    source: string;
+    detailType: string;
+    detail: string;
+}
+export interface BuildEventEntryOptions {
+    busName: string;
+    stage: string;
+    context?: Pick<RequestContext, 'actor' | 'correlationId' | 'requestId' | 'tenantId' | 'traceParent' | 'traceState'>;
+    actor?: RequestActor;
+    eventId?: string;
+    occurredAt?: string;
+}
+export interface BuiltEventEntry<TData = unknown> {
+    entry: PublishableEventEntry;
+    envelope: EventEnvelope<TData>;
+}
+export declare function buildEventEntry<TData>(contract: EventContractRef, data: TData, options: BuildEventEntryOptions): BuiltEventEntry<TData>;
+export interface EventPublisherOptions {
+    busName: string;
+    stage: string;
+    send: (entry: PublishableEventEntry) => Promise<unknown>;
+}
+export interface PublishEventOptions {
+    context?: Pick<RequestContext, 'actor' | 'correlationId' | 'requestId' | 'tenantId' | 'traceParent' | 'traceState'>;
+    actor?: RequestActor;
+}
+export type EventPublisher = <TData>(contract: EventContractRef, data: TData, options?: PublishEventOptions) => Promise<EventEnvelope<TData>>;
+export declare function createEventPublisher(options: EventPublisherOptions): EventPublisher;
+export declare function parseEventEnvelope<TData = unknown>(detail: unknown): EventEnvelope<TData>;
+export interface SqsRecordLike {
+    messageId?: string;
+    body: string;
+}
+export interface ParsedEventRecord<TData = unknown> {
+    messageId?: string;
+    source: string;
+    detailType: string;
+    envelope: EventEnvelope<TData>;
+}
+export interface FailedEventRecord {
+    messageId?: string;
+    error: string;
+}
+export interface ParsedEventBatch<TData = unknown> {
+    events: ParsedEventRecord<TData>[];
+    failures: FailedEventRecord[];
+}
+export declare function parseSqsEventBridgeRecords<TData = unknown>(records: readonly SqsRecordLike[]): ParsedEventBatch<TData>;
+export declare function toEventLogMetadata(meta: EventEnvelopeMeta): Record<string, string | number>;

package/src/events.js

@@ -0,0 +1,149 @@
+import { __awaiter } from "tslib";
+import { randomUUID } from 'node:crypto';
+// EventBridge caps a PutEvents entry at 256 KB. We guard below the hard limit
+// so envelope overhead never turns a passing payload into a runtime failure.
+const MAX_EVENT_ENTRY_BYTES = 256 * 1024;
+function assertContract(contract) {
+    var _a, _b;
+    if (!((_a = contract.source) === null || _a === void 0 ? void 0 : _a.trim())) {
+        throw new Error('[runtime/events] Event contract is missing a non-empty `source` (the publishing app group).');
+    }
+    if (!((_b = contract.detailType) === null || _b === void 0 ? void 0 : _b.trim())) {
+        throw new Error('[runtime/events] Event contract is missing a non-empty `detailType`.');
+    }
+    if (!Number.isInteger(contract.schemaVersion) || contract.schemaVersion < 1) {
+        throw new Error('[runtime/events] Event contract `schemaVersion` must be a positive integer.');
+    }
+}
+// Builds a validated envelope + PutEvents entry for the shared core bus.
+// Pure — no AWS calls — so publishers and tests share the exact same path.
+export function buildEventEntry(contract, data, options) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+    assertContract(contract);
+    if (!((_a = options.stage) === null || _a === void 0 ? void 0 : _a.trim())) {
+        throw new Error('[runtime/events] `stage` is required — consumers filter on meta.stage to isolate shared-bus traffic.');
+    }
+    const eventId = (_b = options.eventId) !== null && _b !== void 0 ? _b : randomUUID();
+    const envelope = {
+        meta: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ eventId, schemaVersion: contract.schemaVersion, occurredAt: (_c = options.occurredAt) !== null && _c !== void 0 ? _c : new Date().toISOString(), app: contract.source, stage: options.stage, correlationId: (_e = (_d = options.context) === null || _d === void 0 ? void 0 : _d.correlationId) !== null && _e !== void 0 ? _e : eventId }, (((_f = options.context) === null || _f === void 0 ? void 0 : _f.requestId)
+            ? { causationId: options.context.requestId }
+            : {})), { actor: (_g = options.actor) !== null && _g !== void 0 ? _g : (_h = options.context) === null || _h === void 0 ? void 0 : _h.actor }), (((_j = options.context) === null || _j === void 0 ? void 0 : _j.tenantId)
+            ? { tenantId: options.context.tenantId }
+            : {})), (((_k = options.context) === null || _k === void 0 ? void 0 : _k.traceParent)
+            ? { traceParent: options.context.traceParent }
+            : {})), (((_l = options.context) === null || _l === void 0 ? void 0 : _l.traceState)
+            ? { traceState: options.context.traceState }
+            : {})),
+        data,
+    };
+    const detail = JSON.stringify(envelope);
+    const bytes = Buffer.byteLength(detail, 'utf8');
+    if (bytes > MAX_EVENT_ENTRY_BYTES) {
+        throw new Error(`[runtime/events] Event ${contract.source}/${contract.detailType} detail is ${bytes} bytes, ` +
+            `over the ${MAX_EVENT_ENTRY_BYTES}-byte EventBridge entry limit. ` +
+            'Store the payload (e.g. S3) and publish a claim-check reference instead.');
+    }
+    return {
+        entry: {
+            eventBusName: options.busName,
+            source: contract.source,
+            detailType: contract.detailType,
+            detail,
+        },
+        envelope,
+    };
+}
+export function createEventPublisher(options) {
+    var _a, _b;
+    if (!((_a = options.busName) === null || _a === void 0 ? void 0 : _a.trim())) {
+        throw new Error('[runtime/events] `busName` is required.');
+    }
+    if (!((_b = options.stage) === null || _b === void 0 ? void 0 : _b.trim())) {
+        throw new Error('[runtime/events] `stage` is required.');
+    }
+    return (contract_1, data_1, ...args_1) => __awaiter(this, [contract_1, data_1, ...args_1], void 0, function* (contract, data, publishOptions = {}) {
+        const { entry, envelope } = buildEventEntry(contract, data, {
+            busName: options.busName,
+            stage: options.stage,
+            context: publishOptions.context,
+            actor: publishOptions.actor,
+        });
+        yield options.send(entry);
+        return envelope;
+    });
+}
+// --- Consumer-side parsing -------------------------------------------------
+export function parseEventEnvelope(detail) {
+    var _a;
+    if (!detail || typeof detail !== 'object') {
+        throw new Error('[runtime/events] Event detail is not an object envelope.');
+    }
+    const candidate = detail;
+    if (!candidate.meta || typeof candidate.meta !== 'object') {
+        throw new Error('[runtime/events] Event detail is missing the `meta` envelope block.');
+    }
+    const meta = candidate.meta;
+    for (const field of [
+        'eventId',
+        'occurredAt',
+        'app',
+        'stage',
+        'correlationId',
+    ]) {
+        if (typeof meta[field] !== 'string' || !meta[field]) {
+            throw new Error(`[runtime/events] Event envelope meta.${field} is missing or not a string.`);
+        }
+    }
+    if (!Number.isInteger(meta.schemaVersion) || ((_a = meta.schemaVersion) !== null && _a !== void 0 ? _a : 0) < 1) {
+        throw new Error('[runtime/events] Event envelope meta.schemaVersion is missing or not a positive integer.');
+    }
+    for (const field of [
+        'causationId',
+        'tenantId',
+        'traceParent',
+        'traceState',
+    ]) {
+        if (meta[field] !== undefined && typeof meta[field] !== 'string') {
+            throw new Error(`[runtime/events] Event envelope meta.${field} must be a string when present.`);
+        }
+    }
+    return {
+        meta: meta,
+        data: candidate.data,
+    };
+}
+// Consumers receive EventBridge events wrapped in SQS bodies (the buffer
+// queue between the bus rule and the handler). Each body is the EventBridge
+// event JSON: { id, source, "detail-type", detail, ... }.
+export function parseSqsEventBridgeRecords(records) {
+    const events = [];
+    const failures = [];
+    for (const record of records) {
+        try {
+            const raw = JSON.parse(record.body);
+            if (typeof raw.source !== 'string' || !raw.source) {
+                throw new Error('EventBridge record is missing `source`.');
+            }
+            if (typeof raw['detail-type'] !== 'string' || !raw['detail-type']) {
+                throw new Error('EventBridge record is missing `detail-type`.');
+            }
+            events.push({
+                messageId: record.messageId,
+                source: raw.source,
+                detailType: raw['detail-type'],
+                envelope: parseEventEnvelope(raw.detail),
+            });
+        }
+        catch (err) {
+            failures.push({
+                messageId: record.messageId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return { events, failures };
+}
+export function toEventLogMetadata(meta) {
+    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ app: meta.app }, (meta.causationId ? { causationId: meta.causationId } : {})), { correlationId: meta.correlationId, eventId: meta.eventId, occurredAt: meta.occurredAt, schemaVersion: meta.schemaVersion, stage: meta.stage }), (meta.tenantId ? { tenantId: meta.tenantId } : {})), (meta.traceParent ? { traceParent: meta.traceParent } : {})), (meta.traceState ? { traceState: meta.traceState } : {}));
+}
+//# sourceMappingURL=events.js.map

package/src/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../packages/runtime/src/events.ts"],"names":[],"mappings":";AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AA8EzC,SAAS,cAAc,CAAC,QAA0B;;IAChD,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,MAAM,0CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,UAAU,0CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAC7B,QAA0B,EAC1B,IAAW,EACX,OAA+B;;IAE/B,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,IAAI,CAAC,CAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,UAAU,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAyB;QACrC,IAAI,0EACF,OAAO,EACP,aAAa,EAAE,QAAQ,CAAC,aAAa,EACrC,UAAU,EAAE,MAAA,OAAO,CAAC,UAAU,mCAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAC1D,GAAG,EAAE,QAAQ,CAAC,MAAM,EACpB,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,aAAa,EAAE,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,aAAa,mCAAI,OAAO,IACrD,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,SAAS;YAC5B,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC,KACP,KAAK,EAAE,MAAA,OAAO,CAAC,KAAK,mCAAI,MAAA,OAAO,CAAC,OAAO,0CAAE,KAAK,KAC3C,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ;YAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,WAAW;YAC9B,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,UAAU;YAC7B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC,CACR;QACD,IAAI;KACL,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,cAAc,KAAK,UAAU;YAC3F,YAAY,qBAAqB,iCAAiC;YAClE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,YAAY,EAAE,OAAO,CAAC,OAAO;YAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM;SACP;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AA2CD,MAAM,UAAU,oBAAoB,CAClC,OAA8B;;IAE9B,IAAI,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,IAAI,EAAE,CAAA,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,gCAA4C,EAAE,qEAAvC,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,EAAE;QAC/C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,KAAK,EAAE,cAAc,CAAC,KAAK;SAC5B,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAA,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB,CAChC,MAAe;;IAEf,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,MAA4C,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAkC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI;QAClB,SAAS;QACT,YAAY;QACZ,KAAK;QACL,OAAO;QACP,eAAe;KACP,EAAE,CAAC;QACX,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,8BAA8B,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAA,IAAI,CAAC,aAAa,mCAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI;QAClB,aAAa;QACb,UAAU;QACV,aAAa;QACb,YAAY;KACJ,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,iCAAiC,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAyB;QAC/B,IAAI,EAAE,SAAS,CAAC,IAAa;KAC9B,CAAC;AACJ,CAAC;AA2BD,yEAAyE;AACzE,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAIjC,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC;gBAC9B,QAAQ,EAAE,kBAAkB,CAAQ,GAAG,CAAC,MAAM,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAuB;IAEvB,+EACE,GAAG,EAAE,IAAI,CAAC,GAAG,IACV,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9D,aAAa,EAAE,IAAI,CAAC,aAAa,EACjC,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,IAAI,CAAC,UAAU,EAC3B,aAAa,EAAE,IAAI,CAAC,aAAa,EACjC,KAAK,EAAE,IAAI,CAAC,KAAK,KACd,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3D,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3D;AACJ,CAAC"}

package/{dist → src}/frontend.d.ts

@@ -1,4 +1,4 @@
-import type { AuthSessionStatus } from './auth';
+import type { AuthSessionStatus } from './auth.js';
 export type FrontendRuntime = 'web' | 'mobile';
 export type FrontendDeploymentMode = 'opennext' | 'container' | 'static-export' | 'expo';
 export type FrontendSessionTransport = 'cookie' | 'bearer' | 'none';
@@ -39,4 +39,3 @@ export declare const frontendContract: {
     readonly packageName: "@empire-builder-kit/runtime";
 };
 export declare function createFrontendClientContract(input: FrontendClientContractInput): FrontendClientContract;
-//# sourceMappingURL=frontend.d.ts.map

package/src/frontend.js

@@ -0,0 +1,62 @@
+export const frontendContract = {
+    exportPath: '@empire-builder-kit/runtime/frontend',
+    packageName: '@empire-builder-kit/runtime',
+};
+function trimOrFallback(value, fallback) {
+    const normalized = value === null || value === void 0 ? void 0 : value.trim();
+    return normalized && normalized.length > 0 ? normalized : fallback;
+}
+function defaultsForRuntime(runtime) {
+    if (runtime === 'mobile') {
+        return {
+            auth: {
+                initialStatus: 'anonymous',
+                storage: 'secure-store',
+                transport: 'bearer',
+            },
+            deployment: {
+                mode: 'expo',
+                publicBaseUrlEnvVar: 'EXPO_PUBLIC_API_BASE_URL',
+                stageEnvVar: 'EXPO_PUBLIC_STAGE',
+            },
+        };
+    }
+    return {
+        auth: {
+            initialStatus: 'anonymous',
+            storage: 'server',
+            transport: 'cookie',
+        },
+        deployment: {
+            mode: 'opennext',
+            publicBaseUrlEnvVar: 'NEXT_PUBLIC_APP_URL',
+            stageEnvVar: 'NEXT_PUBLIC_STAGE',
+        },
+    };
+}
+export function createFrontendClientContract(input) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+    const runtimeDefaults = defaultsForRuntime(input.runtime);
+    const app = trimOrFallback(input.app, 'app');
+    return {
+        api: {
+            sameScopeImportPrefix: trimOrFallback((_a = input.api) === null || _a === void 0 ? void 0 : _a.sameScopeImportPrefix, `@${app}/`),
+            sdkPackage: trimOrFallback((_b = input.api) === null || _b === void 0 ? void 0 : _b.sdkPackage, `@${app}/sdk/client`),
+        },
+        app,
+        auth: {
+            exportPath: '@empire-builder-kit/runtime/auth',
+            initialStatus: (_d = (_c = input.auth) === null || _c === void 0 ? void 0 : _c.initialStatus) !== null && _d !== void 0 ? _d : runtimeDefaults.auth.initialStatus,
+            storage: (_f = (_e = input.auth) === null || _e === void 0 ? void 0 : _e.storage) !== null && _f !== void 0 ? _f : runtimeDefaults.auth.storage,
+            transport: (_h = (_g = input.auth) === null || _g === void 0 ? void 0 : _g.transport) !== null && _h !== void 0 ? _h : runtimeDefaults.auth.transport,
+        },
+        client: trimOrFallback(input.client, `${app}-${input.runtime}`),
+        deployment: {
+            mode: (_k = (_j = input.deployment) === null || _j === void 0 ? void 0 : _j.mode) !== null && _k !== void 0 ? _k : runtimeDefaults.deployment.mode,
+            publicBaseUrlEnvVar: trimOrFallback((_l = input.deployment) === null || _l === void 0 ? void 0 : _l.publicBaseUrlEnvVar, runtimeDefaults.deployment.publicBaseUrlEnvVar),
+            stageEnvVar: trimOrFallback((_m = input.deployment) === null || _m === void 0 ? void 0 : _m.stageEnvVar, runtimeDefaults.deployment.stageEnvVar),
+        },
+        runtime: input.runtime,
+    };
+}
+//# sourceMappingURL=frontend.js.map

package/src/frontend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend.js","sourceRoot":"","sources":["../../../../packages/runtime/src/frontend.ts"],"names":[],"mappings":"AA+CA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,UAAU,EAAE,sCAAsC;IAClD,WAAW,EAAE,6BAA6B;CAClC,CAAC;AAEX,SAAS,cAAc,CAAC,KAAyB,EAAE,QAAgB;IACjE,MAAM,UAAU,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,EAAE,CAAC;IAEjC,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAwB;IAClD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE;gBACJ,aAAa,EAAE,WAAoB;gBACnC,OAAO,EAAE,cAAuB;gBAChC,SAAS,EAAE,QAAiB;aAC7B;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,MAAe;gBACrB,mBAAmB,EAAE,0BAA0B;gBAC/C,WAAW,EAAE,mBAAmB;aACjC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,aAAa,EAAE,WAAoB;YACnC,OAAO,EAAE,QAAiB;YAC1B,SAAS,EAAE,QAAiB;SAC7B;QACD,UAAU,EAAE;YACV,IAAI,EAAE,UAAmB;YACzB,mBAAmB,EAAE,qBAAqB;YAC1C,WAAW,EAAE,mBAAmB;SACjC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAkC;;IAElC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,OAAO;QACL,GAAG,EAAE;YACH,qBAAqB,EAAE,cAAc,CACnC,MAAA,KAAK,CAAC,GAAG,0CAAE,qBAAqB,EAChC,IAAI,GAAG,GAAG,CACX;YACD,UAAU,EAAE,cAAc,CAAC,MAAA,KAAK,CAAC,GAAG,0CAAE,UAAU,EAAE,IAAI,GAAG,aAAa,CAAC;SACxE;QACD,GAAG;QACH,IAAI,EAAE;YACJ,UAAU,EAAE,kCAAkC;YAC9C,aAAa,EACX,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,aAAa,mCAAI,eAAe,CAAC,IAAI,CAAC,aAAa;YACjE,OAAO,EAAE,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,OAAO,mCAAI,eAAe,CAAC,IAAI,CAAC,OAAO;YAC5D,SAAS,EAAE,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,SAAS,mCAAI,eAAe,CAAC,IAAI,CAAC,SAAS;SACnE;QACD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/D,UAAU,EAAE;YACV,IAAI,EAAE,MAAA,MAAA,KAAK,CAAC,UAAU,0CAAE,IAAI,mCAAI,eAAe,CAAC,UAAU,CAAC,IAAI;YAC/D,mBAAmB,EAAE,cAAc,CACjC,MAAA,KAAK,CAAC,UAAU,0CAAE,mBAAmB,EACrC,eAAe,CAAC,UAAU,CAAC,mBAAmB,CAC/C;YACD,WAAW,EAAE,cAAc,CACzB,MAAA,KAAK,CAAC,UAAU,0CAAE,WAAW,EAC7B,eAAe,CAAC,UAAU,CAAC,WAAW,CACvC;SACF;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/src/hosts.d.ts

@@ -0,0 +1,9 @@
+export interface CreateStageHostnameOptions {
+    readonly app: string;
+    readonly defaultStage?: string;
+    readonly rootDomain: string;
+    readonly stage: string;
+}
+export declare function normalizeDnsLabel(value: string, fieldName: string): string;
+export declare function normalizeRootDomain(rootDomain: string): string;
+export declare function createStageHostname({ app, defaultStage, rootDomain, stage, }: CreateStageHostnameOptions): string;

package/src/hosts.js

@@ -0,0 +1,38 @@
+export function normalizeDnsLabel(value, fieldName) {
+    const label = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '');
+    if (!label) {
+        throw new Error(`${fieldName} must contain at least one DNS-safe character`);
+    }
+    if (label.length > 63) {
+        throw new Error(`${fieldName} DNS label must be 63 characters or fewer`);
+    }
+    return label;
+}
+export function normalizeRootDomain(rootDomain) {
+    const normalized = rootDomain.trim().toLowerCase().replace(/\.$/, '');
+    if (!normalized) {
+        throw new Error('rootDomain is required');
+    }
+    if (normalized
+        .split('.')
+        .some((label) => normalizeDnsLabel(label, 'rootDomain label') !== label)) {
+        throw new Error(`rootDomain must be a valid DNS name: ${rootDomain}`);
+    }
+    return normalized;
+}
+export function createStageHostname({ app, defaultStage, rootDomain, stage, }) {
+    const appLabel = normalizeDnsLabel(app, 'app');
+    const stageLabel = normalizeDnsLabel(stage, 'stage');
+    const defaultStageLabel = normalizeDnsLabel(defaultStage !== null && defaultStage !== void 0 ? defaultStage : 'production', 'defaultStage');
+    const publicLabel = stageLabel === defaultStageLabel ? appLabel : `${appLabel}-${stageLabel}`;
+    if (publicLabel.length > 63) {
+        throw new Error('combined app and stage DNS label must be 63 characters or fewer');
+    }
+    return `${publicLabel}.${normalizeRootDomain(rootDomain)}`;
+}
+//# sourceMappingURL=hosts.js.map

package/src/hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts.js","sourceRoot":"","sources":["../../../../packages/runtime/src/hosts.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,KAAK,GAAG,KAAK;SAChB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,+CAA+C,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,IACE,UAAU;SACP,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,KAAK,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,YAAY,EACZ,UAAU,EACV,KAAK,GACsB;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,iBAAiB,CACzC,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,YAAY,EAC5B,cAAc,CACf,CAAC;IACF,MAAM,WAAW,GACf,UAAU,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5E,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,WAAW,IAAI,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC7D,CAAC"}

package/src/index.d.ts

@@ -0,0 +1,15 @@
+export * from './auth.js';
+export * from './auth-session.js';
+export * from './config.js';
+export * from './events.js';
+export * from './frontend.js';
+export * from './hosts.js';
+export * from './logging.js';
+export * from './lambda.js';
+export * from './observability.js';
+export * from './request-context.js';
+export * from './response.js';
+export declare const runtimePackage: {
+    readonly exports: readonly ["@empire-builder-kit/runtime/auth", "@empire-builder-kit/runtime/auth-backend", "@empire-builder-kit/runtime/auth-web", "@empire-builder-kit/runtime/auth-session", "@empire-builder-kit/runtime/config", "@empire-builder-kit/runtime/database", "@empire-builder-kit/runtime/events", "@empire-builder-kit/runtime/frontend", "@empire-builder-kit/runtime/hosts", "@empire-builder-kit/runtime/request-context", "@empire-builder-kit/runtime/logging", "@empire-builder-kit/runtime/lambda", "@empire-builder-kit/runtime/observability", "@empire-builder-kit/runtime/response"];
+    readonly name: "@empire-builder-kit/runtime";
+};

package/src/index.js

@@ -0,0 +1,31 @@
+export * from './auth.js';
+export * from './auth-session.js';
+export * from './config.js';
+export * from './events.js';
+export * from './frontend.js';
+export * from './hosts.js';
+export * from './logging.js';
+export * from './lambda.js';
+export * from './observability.js';
+export * from './request-context.js';
+export * from './response.js';
+export const runtimePackage = {
+    exports: [
+        '@empire-builder-kit/runtime/auth',
+        '@empire-builder-kit/runtime/auth-backend',
+        '@empire-builder-kit/runtime/auth-web',
+        '@empire-builder-kit/runtime/auth-session',
+        '@empire-builder-kit/runtime/config',
+        '@empire-builder-kit/runtime/database',
+        '@empire-builder-kit/runtime/events',
+        '@empire-builder-kit/runtime/frontend',
+        '@empire-builder-kit/runtime/hosts',
+        '@empire-builder-kit/runtime/request-context',
+        '@empire-builder-kit/runtime/logging',
+        '@empire-builder-kit/runtime/lambda',
+        '@empire-builder-kit/runtime/observability',
+        '@empire-builder-kit/runtime/response',
+    ],
+    name: '@empire-builder-kit/runtime',
+};
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/runtime/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE;QACP,kCAAkC;QAClC,0CAA0C;QAC1C,sCAAsC;QACtC,0CAA0C;QAC1C,oCAAoC;QACpC,sCAAsC;QACtC,oCAAoC;QACpC,sCAAsC;QACtC,mCAAmC;QACnC,6CAA6C;QAC7C,qCAAqC;QACrC,oCAAoC;QACpC,2CAA2C;QAC3C,sCAAsC;KACvC;IACD,IAAI,EAAE,6BAA6B;CAC3B,CAAC"}

package/src/lambda.d.ts

@@ -0,0 +1,45 @@
+import { type Logger } from './logging.js';
+import { type RequestContext } from './request-context.js';
+import { type AppResponse } from './response.js';
+export interface RuntimeHttpEvent {
+    body?: string | null;
+    headers?: Record<string, string | undefined> | null;
+    rawPath?: string;
+    requestContext?: {
+        http?: {
+            method?: string;
+            path?: string;
+            sourceIp?: string;
+            userAgent?: string;
+        };
+        requestId?: string;
+    };
+}
+export interface RuntimeHttpJsonResponse {
+    body: string;
+    headers: Record<string, string>;
+    statusCode: number;
+}
+export interface RuntimeHttpHandlerInput<E extends RuntimeHttpEvent = RuntimeHttpEvent> {
+    context: RequestContext;
+    event: E;
+    logger: Logger;
+}
+export interface CreateHttpJsonHandlerOptions<T, E extends RuntimeHttpEvent = RuntimeHttpEvent> {
+    app: string;
+    handle(input: RuntimeHttpHandlerInput<E>): Promise<T> | T;
+    includeErrorDetails?: boolean;
+    logger?: Logger;
+    operation: string;
+    service?: string;
+    stage?: string;
+    successStatus?: number;
+}
+export type RuntimeHttpJsonHandler<E extends RuntimeHttpEvent = RuntimeHttpEvent> = (event: E) => Promise<RuntimeHttpJsonResponse>;
+export declare const lambdaContract: {
+    readonly defaultResponseFormat: "json";
+    readonly exportPath: "@empire-builder-kit/runtime/lambda";
+    readonly packageName: "@empire-builder-kit/runtime";
+};
+export declare function toHttpJsonResponse<T>(response: AppResponse<T>): RuntimeHttpJsonResponse;
+export declare function createHttpJsonHandler<T, E extends RuntimeHttpEvent = RuntimeHttpEvent>(options: CreateHttpJsonHandlerOptions<T, E>): RuntimeHttpJsonHandler<E>;