@ericminassian/platform 0.0.0-stage → 0.1.0

package/dist/worker.js

@@ -0,0 +1,179 @@
+/**
+ * Worker (Lambda Event Function) entry. Apps write:
+ *
+ *   export default defineWorker({
+ *     queues: { emails: async (msg) => { ... } },
+ *     events: { 'order.created': async (evt) => { ... } },
+ *     crons: { nightly: async () => { ... } },
+ *   });
+ *
+ * `plat build` generates `export const handler = createWorkerHandler(def)`.
+ * One function per stage handles every queue, event subscription, cron and
+ * direct invocation; the handler dispatches on the event shape. Each job is
+ * auto-instrumented (`job`/`err` telemetry, trace propagation from the
+ * producer). SQS batches report partial failures.
+ *
+ * CONTRACT: used by the CLI build and the control plane. Keep stable.
+ */
+import { gunzipSync } from 'node:zlib';
+import { getBindings, tryBindings } from './bindings.js';
+import { client } from './clients.js';
+import { currentTrace, newContext, runWithContext } from './context.js';
+import { emit, emitError, installConsoleCapture, installFetchInstrumentation, log } from './telemetry.js';
+export function defineWorker(def) {
+    return def;
+}
+async function runJob(kind, name, trace, attempt, lambdaCtx, fn) {
+    const ctx = newContext(trace);
+    ctx.job = `${kind}:${name}`;
+    return runWithContext(ctx, async () => {
+        const t0 = performance.now();
+        const jobCtx = {
+            trace: ctx.trace,
+            attempt,
+            remainingMs: () => lambdaCtx?.getRemainingTimeInMillis?.() ?? Number.POSITIVE_INFINITY,
+        };
+        try {
+            const value = await fn(jobCtx);
+            emit('job', { kind, name, status: 'ok', dur: ms(t0), attempt, span: ctx.span });
+            return { ok: true, value };
+        }
+        catch (error) {
+            emitError(error, 'job', { job: `${kind}:${name}` });
+            emit('job', { kind, name, status: 'error', dur: ms(t0), attempt, span: ctx.span });
+            return { ok: false, error };
+        }
+    });
+}
+function ms(t0) {
+    return Math.round((performance.now() - t0) * 10) / 10;
+}
+function parseBody(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+function isSqsEvent(e) {
+    const records = e?.Records;
+    return Array.isArray(records) && records.length > 0 && records[0]?.eventSource === 'aws:sqs';
+}
+function isEventBridge(e) {
+    return (typeof e === 'object' && e !== null && typeof e['detail-type'] === 'string');
+}
+function isDirect(e) {
+    const p = e?.__platform;
+    return p === 'cron' || p === 'invoke';
+}
+function isLogs(e) {
+    return typeof e?.awslogs?.data === 'string';
+}
+/** Lambda handler for a worker definition. */
+export function createWorkerHandler(def) {
+    installConsoleCapture();
+    installFetchInstrumentation();
+    emit('env', { event: 'start', runtime: 'worker', initMs: Math.round(performance.now()) });
+    return async (event, context) => {
+        const lambdaCtx = context;
+        if (isSqsEvent(event))
+            return handleSqs(def, event.Records, lambdaCtx);
+        if (isLogs(event)) {
+            const decoded = JSON.parse(gunzipSync(Buffer.from(event.awslogs.data, 'base64')).toString('utf8'));
+            if (decoded.messageType === 'CONTROL_MESSAGE')
+                return;
+            if (!def.logs) {
+                log.warn('worker received a CloudWatch Logs batch but defines no `logs` handler');
+                return;
+            }
+            const ctx = newContext();
+            return runWithContext(ctx, () => def.logs({ logGroup: decoded.logGroup, logStream: decoded.logStream, logEvents: decoded.logEvents ?? [] }, {
+                trace: ctx.trace,
+                attempt: 1,
+                remainingMs: () => lambdaCtx?.getRemainingTimeInMillis?.() ?? Number.POSITIVE_INFINITY,
+            }));
+        }
+        if (isEventBridge(event)) {
+            const type = event['detail-type'];
+            const handler = def.events?.[type];
+            if (!handler) {
+                log.warn(`no handler for event "${type}"`, { source: event.source });
+                return;
+            }
+            const env = event.detail;
+            const isEnvelope = env !== null && typeof env === 'object' && 'data' in env;
+            const r = await runJob('event', type, isEnvelope ? env.trace : undefined, 1, lambdaCtx, (ctx) => handler({ id: event.id, type, detail: isEnvelope ? env.data : event.detail, time: new Date(event.time) }, ctx));
+            // Rethrow so Lambda's async retries and the on-failure destination apply.
+            if (!r.ok)
+                throw r.error;
+            return;
+        }
+        if (isDirect(event)) {
+            if (event.__platform === 'cron') {
+                const handler = def.crons?.[event.name];
+                if (!handler)
+                    throw new Error(`no cron handler "${event.name}"`);
+                const r = await runJob('cron', event.name, event.trace, 1, lambdaCtx, (ctx) => handler(ctx));
+                if (!r.ok)
+                    throw r.error;
+                return;
+            }
+            const handler = def.invoke?.[event.name];
+            if (!handler)
+                throw new Error(`no invoke handler "${event.name}"`);
+            const r = await runJob('invoke', event.name, event.trace, 1, lambdaCtx, (ctx) => handler(event.payload, ctx));
+            if (!r.ok)
+                throw r.error;
+            return r.value;
+        }
+        throw new Error('Unrecognized worker event');
+    };
+}
+async function handleSqs(def, records, lambdaCtx) {
+    const queues = tryBindings()?.queues ?? {};
+    const byArn = new Map(Object.entries(queues).map(([name, q]) => [q.arn, name]));
+    const failures = [];
+    for (const record of records) {
+        const name = byArn.get(record.eventSourceARN);
+        const handler = name ? def.queues?.[name] : undefined;
+        if (!name || !handler) {
+            emitError(new Error(`no queue handler for ${record.eventSourceARN}`), 'job');
+            failures.push({ itemIdentifier: record.messageId });
+            continue;
+        }
+        const attempt = Number(record.attributes?.ApproximateReceiveCount ?? '1');
+        const trace = record.messageAttributes?.trace?.stringValue;
+        const sentAt = new Date(Number(record.attributes?.SentTimestamp ?? Date.now()));
+        const r = await runJob('queue', name, trace, attempt, lambdaCtx, (ctx) => handler({ id: record.messageId, body: parseBody(record.body), attempt, sentAt }, ctx));
+        if (!r.ok)
+            failures.push({ itemIdentifier: record.messageId });
+    }
+    return { batchItemFailures: failures };
+}
+/** Invoke another named job on this stage's worker asynchronously. */
+export async function invokeJob(name, payload) {
+    const worker = getBindings().worker;
+    if (!worker)
+        throw new Error('This app has no worker. Add a "worker" (or queues/events/crons) to platform.json.');
+    const body = { __platform: 'invoke', name, payload, trace: currentTrace() };
+    // `plat dev` / `plat test` run the worker as a local Node process (the
+    // emulator's Lambda sandbox has no networking modules) and set this URL.
+    const local = process.env.PLATFORM_LOCAL_WORKER_URL;
+    if (local) {
+        // Fire-and-forget like an async Lambda invoke; failures surface in the worker's logs.
+        void fetch(local, { method: 'POST', body: JSON.stringify(body) })
+            .then((r) => r.body?.cancel())
+            .catch((err) => console.warn(`invokeJob(${name}) could not reach the local worker`, err));
+        return;
+    }
+    const { InvokeCommand } = await import('@aws-sdk/client-lambda');
+    const out = await (await client('lambda')).send(new InvokeCommand({
+        FunctionName: worker,
+        InvocationType: 'Event',
+        Payload: new TextEncoder().encode(JSON.stringify(body)),
+    }));
+    if (out.FunctionError)
+        throw new Error(`invokeJob(${name}) failed: ${out.FunctionError}`);
+}
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAsE1G,MAAM,UAAU,YAAY,CAA6B,GAAM;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAID,KAAK,UAAU,MAAM,CACnB,IAAU,EACV,IAAY,EACZ,KAAyB,EACzB,OAAe,EACf,SAAwC,EACxC,EAAuC;IAEvC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5B,OAAO,cAAc,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAe;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;YACP,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,wBAAwB,EAAE,EAAE,IAAI,MAAM,CAAC,iBAAiB;SACvF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,EAAE,CAAC,EAAU;IACpB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,MAAM,OAAO,GAAI,CAA2B,EAAE,OAAO,CAAC;IACtD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAK,OAAO,CAAC,CAAC,CAAe,EAAE,WAAW,KAAK,SAAS,CAAC;AAC9G,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAQ,CAA6B,CAAC,aAAa,CAAC,KAAK,QAAQ,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,MAAM,CAAC,GAAI,CAA8B,EAAE,UAAU,CAAC;IACtD,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAQ,CAAsC,EAAE,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC;AACpF,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,mBAAmB,CACjC,GAAqB;IAErB,qBAAqB,EAAE,CAAC;IACxB,2BAA2B,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAE1F,OAAO,KAAK,EAAE,KAAc,EAAE,OAAgB,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,OAAwC,CAAC;QAE3D,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGvE,CAAC;YACF,IAAI,OAAO,CAAC,WAAW,KAAK,iBAAiB;gBAAE,OAAO;YACtD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAC9B,GAAG,CAAC,IAAK,CACP,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,EAChG;gBACE,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,wBAAwB,EAAE,EAAE,IAAI,MAAM,CAAC,iBAAiB;aACvF,CACF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAA4C,CAAC;YAC/D,MAAM,UAAU,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC;YAC5E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAC9F,OAAO,CACL,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAChG,GAAG,CACJ,CACF,CAAC;YACF,0EAA0E;YAC1E,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;gBACjE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7F,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,CAAC,CAAC,KAAK,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACnE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAC9E,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,CAAC,CAAC,KAAK,CAAC;YACzB,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,OAAoB,EACpB,SAAwC;IAExC,MAAM,MAAM,GAAG,WAAW,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAsC,EAAE,CAAC;IACvD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,uBAAuB,IAAI,GAAG,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,WAAW,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACvE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CACtF,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,OAAgB;IAC5D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,MAAM,IAAI,GAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;IAC3F,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACpD,IAAI,KAAK,EAAE,CAAC;QACV,sFAAsF;QACtF,KAAK,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;aAC7B,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,oCAAoC,EAAE,GAAG,CAAC,CAAC,CAAC;QACrG,OAAO;IACT,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAC7C,IAAI,aAAa,CAAC;QAChB,YAAY,EAAE,MAAM;QACpB,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC,CACH,CAAC;IACF,IAAI,GAAG,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@ericminassian/platform",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Runtime SDK for apps on the platform: db, queues, events, storage, secrets, auth, metrics.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eric-minassian/platform.git",
+    "directory": "packages/sdk"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
+    },
+    "./worker": {
+      "types": "./dist/worker.d.ts",
+      "default": "./dist/worker.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "@aws-sdk/client-cognito-identity-provider": "^3.1169.0",
+    "@aws-sdk/client-dynamodb": "^3.1169.0",
+    "@aws-sdk/client-eventbridge": "^3.1169.0",
+    "@aws-sdk/client-lambda": "^3.1169.0",
+    "@aws-sdk/client-s3": "^3.1169.0",
+    "@aws-sdk/client-sqs": "^3.1169.0",
+    "@aws-sdk/client-ssm": "^3.1169.0",
+    "@aws-sdk/lib-dynamodb": "^3.1169.0",
+    "@aws-sdk/s3-request-presigner": "^3.1169.0",
+    "@ericminassian/platform-core": "0.1.0",
+    "jose": "^6.2.17"
+  },
+  "devDependencies": {
+    "@ericminassian/platform-engine": "0.1.0",
+    "@types/aws-lambda": "^8.10.164",
+    "hono": "^4.13.18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:integration": "vitest run --config vitest.integration.config.ts"
+  }
 }

package/src/app.ts

@@ -0,0 +1,32 @@
+import { getBindings } from './bindings.ts';
+
+export interface AppInfo {
+  name: string;
+  stage: string;
+  host: string;
+  url: string;
+  revision: string;
+  isLocal: boolean;
+}
+
+/** Facts about the running app stage (lazy: read from bindings on access). */
+export const app: AppInfo = {
+  get name() {
+    return getBindings().app;
+  },
+  get stage() {
+    return getBindings().stage;
+  },
+  get host() {
+    return getBindings().host;
+  },
+  get url() {
+    return getBindings().url;
+  },
+  get revision() {
+    return getBindings().revision;
+  },
+  get isLocal() {
+    return process.env.PLATFORM_LOCAL === '1';
+  },
+};

package/src/auth/cookies.ts

@@ -0,0 +1,39 @@
+export function parseCookies(header: string | null | undefined): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (!header) return out;
+  for (const part of header.split(';')) {
+    const i = part.indexOf('=');
+    if (i <= 0) continue;
+    const name = part.slice(0, i).trim();
+    const raw = part.slice(i + 1).trim();
+    if (!name || name in out) continue;
+    try {
+      out[name] = decodeURIComponent(raw);
+    } catch {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+
+export interface CookieOptions {
+  maxAge?: number;
+  path?: string;
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: 'Lax' | 'Strict' | 'None';
+}
+
+export function serializeCookie(name: string, value: string, opts: CookieOptions = {}): string {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${opts.path ?? '/'}`);
+  if (opts.maxAge !== undefined) parts.push(`Max-Age=${Math.floor(opts.maxAge)}`);
+  if (opts.httpOnly ?? true) parts.push('HttpOnly');
+  if (opts.secure) parts.push('Secure');
+  parts.push(`SameSite=${opts.sameSite ?? 'Lax'}`);
+  return parts.join('; ');
+}
+
+export function clearCookie(name: string, opts: Omit<CookieOptions, 'maxAge'> = {}): string {
+  return serializeCookie(name, '', { ...opts, maxAge: 0 });
+}

package/src/auth/index.ts

@@ -0,0 +1,246 @@
+import {
+  AUTH_COOKIES,
+  AUTH_ROUTES,
+  AUTH_SCOPES,
+  type AuthBindings,
+  type Bindings,
+  type PlatformUser,
+} from '@ericminassian/platform-core';
+import { getBindings } from '../bindings.ts';
+import { currentContext } from '../context.ts';
+import { log } from '../telemetry.ts';
+import { clearCookie, parseCookies, serializeCookie } from './cookies.ts';
+import { challengeFor, createVerifier, decodeFlow, encodeFlow, randomState, safeRedirect } from './pkce.ts';
+import {
+  exchangeCode,
+  isExpiredError,
+  localSignIn,
+  refreshTokens,
+  type Tokens,
+  verifyToken,
+} from './tokens.ts';
+
+export interface Auth {
+  /** The signed-in user for this request, or null. */
+  getUser(request: Request): Promise<PlatformUser | null>;
+  /** Like getUser but throws a 401 Response when signed out. */
+  requireUser(request: Request): Promise<PlatformUser>;
+  /** Path to start sign-in, returning to `redirect` afterwards. */
+  loginUrl(redirect?: string): string;
+  logoutUrl(redirect?: string): string;
+}
+
+const SESSION_MAX_AGE = 30 * 24 * 3600;
+const FLOW_MAX_AGE = 600;
+
+function authBindings(): AuthBindings {
+  const a = getBindings().auth;
+  if (!a) throw new Error('Auth is not enabled for this app. Add `"auth": true` to platform.json.');
+  return a;
+}
+
+function secure(b: Bindings): boolean {
+  return b.url.startsWith('https:');
+}
+
+export function sessionCookies(b: Bindings, tokens: Tokens): string[] {
+  const opts = { maxAge: SESSION_MAX_AGE, secure: secure(b) };
+  const out = [serializeCookie(AUTH_COOKIES.id, tokens.idToken, opts)];
+  if (tokens.refreshToken) out.push(serializeCookie(AUTH_COOKIES.refresh, tokens.refreshToken, opts));
+  return out;
+}
+
+export function clearSessionCookies(b: Bindings): string[] {
+  return [
+    clearCookie(AUTH_COOKIES.id, { secure: secure(b) }),
+    clearCookie(AUTH_COOKIES.refresh, { secure: secure(b) }),
+  ];
+}
+
+function bearer(request: Request): string | undefined {
+  const h = request.headers.get('authorization');
+  const m = h ? /^Bearer\s+(.+)$/i.exec(h) : null;
+  return m?.[1];
+}
+
+async function resolveUser(request: Request): Promise<PlatformUser | null> {
+  const ctx = currentContext();
+  if (ctx && ctx.user !== undefined) return ctx.user;
+  const b = getBindings();
+  const a = authBindings();
+  const cookies = parseCookies(request.headers.get('cookie'));
+  const idToken = cookies[AUTH_COOKIES.id] ?? bearer(request);
+  const refresh = cookies[AUTH_COOKIES.refresh];
+  let user: PlatformUser | null = null;
+  let expired = !idToken;
+  if (idToken) {
+    try {
+      user = await verifyToken(a, idToken);
+    } catch (e) {
+      expired = isExpiredError(e);
+      if (!expired) log.debug('auth: rejected session token', { reason: (e as Error).message });
+    }
+  }
+  if (!user && expired && refresh) {
+    try {
+      const tokens = await refreshTokens(a, refresh);
+      user = await verifyToken(a, tokens.idToken);
+      ctx?.cookies.push(...sessionCookies(b, tokens));
+    } catch (e) {
+      log.debug('auth: refresh failed', { reason: (e as Error).message });
+      ctx?.cookies.push(...clearSessionCookies(b));
+    }
+  }
+  if (ctx) ctx.user = user;
+  return user;
+}
+
+export function unauthorized(): Response {
+  return Response.json(
+    { error: { code: 'unauthorized', message: 'Sign in required', loginUrl: AUTH_ROUTES.login } },
+    { status: 401, headers: { 'cache-control': 'no-store' } },
+  );
+}
+
+export const auth: Auth = {
+  getUser: (request) => resolveUser(request),
+  async requireUser(request) {
+    const user = await resolveUser(request);
+    if (!user) throw unauthorized();
+    return user;
+  },
+  loginUrl: (redirect = '/') => `${AUTH_ROUTES.login}?redirect=${encodeURIComponent(safeRedirect(redirect))}`,
+  logoutUrl: (redirect = '/') =>
+    `${AUTH_ROUTES.logout}?redirect=${encodeURIComponent(safeRedirect(redirect))}`,
+};
+
+/**
+ * `auth.required`: redirect signed-out browsers to sign-in and 401 everything
+ * else. Returns a Response to short-circuit, or null to continue.
+ */
+export async function authGate(request: Request): Promise<Response | null> {
+  const a = getBindings().auth;
+  if (!a?.required) return null;
+  if (await resolveUser(request)) return null;
+  const url = new URL(request.url);
+  const wantsHtml = request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html');
+  if (wantsHtml) return redirect(auth.loginUrl(url.pathname + url.search));
+  return unauthorized();
+}
+
+function redirect(location: string, cookies: string[] = [], status = 302): Response {
+  const headers = new Headers({ location, 'cache-control': 'no-store' });
+  for (const c of cookies) headers.append('set-cookie', c);
+  return new Response(null, { status, headers });
+}
+
+// ---------------------------------------------------------------- /__platform/auth/*
+
+/** Handles the auth routes; returns null for other paths. */
+export async function handleAuthRoute(request: Request): Promise<Response | null> {
+  const url = new URL(request.url);
+  const route = Object.values(AUTH_ROUTES).find((p) => p === url.pathname);
+  if (!route) return null;
+  const b = getBindings();
+  const a = b.auth;
+  if (!a)
+    return Response.json({ error: { code: 'not_found', message: 'Auth is not enabled' } }, { status: 404 });
+
+  if (route === AUTH_ROUTES.me) {
+    const user = await resolveUser(request);
+    return user ? Response.json(user, { headers: { 'cache-control': 'no-store' } }) : unauthorized();
+  }
+  if (route === AUTH_ROUTES.logout) {
+    const back = safeRedirect(url.searchParams.get('redirect'));
+    if (a.mode === 'local') return redirect(back, clearSessionCookies(b));
+    const target = new URL(`${a.loginUrl.replace(/\/$/, '')}/logout`);
+    target.searchParams.set('client_id', a.clientId);
+    target.searchParams.set('logout_uri', `${b.url}/`);
+    return redirect(target.toString(), clearSessionCookies(b));
+  }
+  if (a.mode === 'local') return localRoute(request, b, a, route);
+
+  const callbackUrl = `${b.url}${AUTH_ROUTES.callback}`;
+  if (route === AUTH_ROUTES.login) {
+    const verifier = createVerifier();
+    const state = randomState();
+    const flow = encodeFlow({ v: verifier, s: state, r: safeRedirect(url.searchParams.get('redirect')) });
+    const target = new URL(`${a.loginUrl.replace(/\/$/, '')}/oauth2/authorize`);
+    target.search = new URLSearchParams({
+      client_id: a.clientId,
+      response_type: 'code',
+      scope: AUTH_SCOPES.join(' '),
+      redirect_uri: callbackUrl,
+      state,
+      code_challenge: challengeFor(verifier),
+      code_challenge_method: 'S256',
+    }).toString();
+    return redirect(target.toString(), [
+      serializeCookie(AUTH_COOKIES.flow, flow, {
+        maxAge: FLOW_MAX_AGE,
+        secure: secure(b),
+        path: '/__platform/auth',
+      }),
+    ]);
+  }
+  // callback
+  const flow = decodeFlow(parseCookies(request.headers.get('cookie'))[AUTH_COOKIES.flow]);
+  const code = url.searchParams.get('code');
+  const clearFlow = clearCookie(AUTH_COOKIES.flow, { secure: secure(b), path: '/__platform/auth' });
+  if (url.searchParams.get('error')) {
+    return redirect(flow?.r ?? '/', [clearFlow]);
+  }
+  if (!flow || !code || url.searchParams.get('state') !== flow.s) {
+    return new Response('Sign-in expired or was tampered with. Please try again.', {
+      status: 400,
+      headers: { 'set-cookie': clearFlow, 'cache-control': 'no-store' },
+    });
+  }
+  const tokens = await exchangeCode(a, code, flow.v, callbackUrl);
+  return redirect(flow.r, [...sessionCookies(b, tokens), clearFlow]);
+}
+
+async function localRoute(request: Request, b: Bindings, a: AuthBindings, route: string): Promise<Response> {
+  const url = new URL(request.url);
+  if (route === AUTH_ROUTES.login && request.method === 'POST') {
+    const form = await request.formData();
+    const email = String(form.get('email') ?? '')
+      .trim()
+      .toLowerCase();
+    const name = String(form.get('name') ?? '').trim();
+    const back = safeRedirect(String(form.get('redirect') ?? '/'));
+    if (!/^[^\s@]+@[^\s@]+$/.test(email)) return html(loginPage(b, back, 'Enter an email address.'), 400);
+    const tokens = await localSignIn(a, email, name || undefined);
+    return redirect(back, sessionCookies(b, tokens), 303);
+  }
+  if (route === AUTH_ROUTES.login) return html(loginPage(b, safeRedirect(url.searchParams.get('redirect'))));
+  // No hosted UI locally; callback is never used.
+  return redirect('/');
+}
+
+function html(body: string, status = 200): Response {
+  return new Response(body, {
+    status,
+    headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
+  });
+}
+
+function escapeHtml(s: string): string {
+  return s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+
+function loginPage(b: Bindings, back: string, error?: string): string {
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in · ${escapeHtml(b.app)} (local)</title>
+<style>body{font:16px system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;background:#f6f7f9;color:#111}
+form{background:#fff;padding:2rem;border-radius:12px;box-shadow:0 1px 3px #0002;display:grid;gap:.75rem;min-width:18rem}
+input,button{font:inherit;padding:.6rem .75rem;border-radius:8px;border:1px solid #ccd}button{background:#111;color:#fff;border:0;cursor:pointer}
+small{color:#667}.err{color:#b00}</style></head><body>
+<form method="post" action="${AUTH_ROUTES.login}">
+<strong>Sign in to ${escapeHtml(b.app)}</strong><small>Local development: any email works. Users live in the AWS Emulator.</small>
+${error ? `<span class="err">${escapeHtml(error)}</span>` : ''}
+<input name="email" type="email" placeholder="you@example.com" required autofocus>
+<input name="name" placeholder="Name (optional)">
+<input type="hidden" name="redirect" value="${escapeHtml(back)}">
+<button type="submit">Sign in</button></form></body></html>`;
+}

package/src/auth/pkce.ts

@@ -0,0 +1,43 @@
+import { createHash, randomBytes } from 'node:crypto';
+
+/** RFC 7636 code verifier (43-128 chars of unreserved characters). */
+export function createVerifier(): string {
+  return randomBytes(32).toString('base64url');
+}
+
+export function challengeFor(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url');
+}
+
+export function randomState(): string {
+  return randomBytes(16).toString('base64url');
+}
+
+export interface FlowState {
+  /** PKCE verifier. */
+  v: string;
+  /** OAuth state. */
+  s: string;
+  /** Path to return to after sign-in. */
+  r: string;
+}
+
+export function encodeFlow(f: FlowState): string {
+  return Buffer.from(JSON.stringify(f)).toString('base64url');
+}
+
+export function decodeFlow(raw: string | undefined): FlowState | null {
+  if (!raw) return null;
+  try {
+    const f = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8')) as FlowState;
+    return typeof f.v === 'string' && typeof f.s === 'string' && typeof f.r === 'string' ? f : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Only same-origin absolute paths are allowed as post-login destinations. */
+export function safeRedirect(target: string | null | undefined): string {
+  if (!target?.startsWith('/') || target.startsWith('//') || target.includes('\\')) return '/';
+  return target;
+}