@venturekit/runtime 0.0.0-dev.20260312012510 → 0.0.0-dev.20260329102450

package/dist/ws/ws.js

@@ -0,0 +1,294 @@
+/**
+ * WebSocket Connection Store
+ *
+ * DynamoDB-backed connection management for API Gateway WebSocket APIs.
+ *
+ * Authentication:
+ *   Two-phase auth — the client connects without credentials, then sends
+ *   an { action: "auth", token: "<jwt>" } message over the encrypted channel.
+ *   The connection is stored as unauthenticated on $connect and upgraded
+ *   to authenticated via connectionStore.authenticate().
+ *   This avoids leaking JWTs in query strings, server logs, and access logs.
+ *
+ * Multi-tenancy:
+ *   If enabled, each connection stores a tenantId alongside userId.
+ *   Use sendToTenant() to broadcast within a tenant boundary.
+ *
+ * API:
+ *   connectionStore.save(connectionId)                        — $connect (unauthenticated)
+ *   connectionStore.authenticate(connectionId, metadata)      — after JWT verification
+ *   connectionStore.remove(connectionId)                      — $disconnect
+ *   connectionStore.get(connectionId)                         — single connection
+ *   connectionStore.getAll()                                  — all connections
+ *   connectionStore.getByUser(userId)                         — by user (GSI)
+ *   connectionStore.getByTenant(tenantId)                     — by tenant (GSI)
+ *   connectionStore.postToConnection(domain, stage, id, data) — send to one
+ *   connectionStore.sendToUser(domain, stage, userId, data)   — send to all user sessions
+ *   connectionStore.sendToTenant(domain, stage, tenantId, data) — broadcast within tenant
+ *   connectionStore.broadcast(domain, stage, data)            — broadcast to all
+ *
+ * Environment variables:
+ *   CONNECTIONS_TABLE — DynamoDB table name (required)
+ *
+ * DynamoDB table schema:
+ *   Partition key: connectionId (String)
+ *   TTL attribute: ttl
+ *   GSI: userId-index  (partition key: userId)
+ *   GSI: tenantId-index (partition key: tenantId) — only if multi-tenancy enabled
+ */
+const DEFAULT_TTL_SECONDS = 7200; // 2 hours
+const AUTH_GRACE_PERIOD_SECONDS = 30; // unauthenticated connections expire quickly
+function getTableName() {
+    const table = process.env.CONNECTIONS_TABLE;
+    if (!table) {
+        throw new Error('CONNECTIONS_TABLE environment variable is not set');
+    }
+    return table;
+}
+let _ddb = null;
+async function ddb() {
+    if (!_ddb) {
+        const { DynamoDBClient } = await import('@aws-sdk/client-dynamodb');
+        const { DynamoDBDocumentClient } = await import('@aws-sdk/lib-dynamodb');
+        _ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+    }
+    return _ddb;
+}
+async function getDocCommands() {
+    return await import('@aws-sdk/lib-dynamodb');
+}
+async function getApigwClient() {
+    return await import('@aws-sdk/client-apigatewaymanagementapi');
+}
+function encode(data) {
+    return new TextEncoder().encode(JSON.stringify(data));
+}
+/**
+ * Deliver data to a list of connections in parallel.
+ * Removes stale connections automatically.
+ * Returns count of successful deliveries.
+ */
+async function deliverToMany(store, domainName, stage, connections, data) {
+    let delivered = 0;
+    const results = await Promise.allSettled(connections
+        .filter((c) => c.authenticated)
+        .map((c) => store.postToConnection(domainName, stage, c.connectionId, data)));
+    for (const result of results) {
+        if (result.status === 'fulfilled' && result.value)
+            delivered++;
+    }
+    return delivered;
+}
+/**
+ * WebSocket connection store backed by DynamoDB.
+ *
+ * Two-phase authentication flow:
+ *
+ * 1. $connect handler:
+ * ```typescript
+ * await connectionStore.save(connectionId);
+ * // Connection is unauthenticated, TTL = 30s
+ * ```
+ *
+ * 2. Client sends auth message over the encrypted WebSocket:
+ * ```json
+ * { "action": "auth", "token": "<jwt>" }
+ * ```
+ *
+ * 3. $default handler verifies JWT, then:
+ * ```typescript
+ * await connectionStore.authenticate(connectionId, { userId, tenantId, email });
+ * // Connection is now authenticated, TTL extended to 2h
+ * ```
+ */
+export const connectionStore = {
+    /**
+     * Save a new connection on $connect.
+     * The connection is unauthenticated with a short TTL.
+     * The client must send an auth message to upgrade.
+     */
+    async save(connectionId) {
+        const now = Date.now();
+        const client = await ddb();
+        const { PutCommand } = await getDocCommands();
+        await client.send(new PutCommand({
+            TableName: getTableName(),
+            Item: {
+                connectionId,
+                authenticated: false,
+                connectedAt: now,
+                ttl: Math.floor(now / 1000) + AUTH_GRACE_PERIOD_SECONDS,
+            },
+        }));
+    },
+    /**
+     * Authenticate a connection after JWT verification.
+     * Updates the record with user metadata and extends the TTL.
+     *
+     * @param connectionId — the connection to authenticate
+     * @param metadata — must include userId, optionally tenantId, email, etc.
+     */
+    async authenticate(connectionId, metadata) {
+        const now = Date.now();
+        const { userId, tenantId, email, ...extra } = metadata;
+        const updateParts = [
+            'authenticated = :auth',
+            'userId = :uid',
+            'authenticatedAt = :authAt',
+            'ttl = :ttl',
+        ];
+        const values = {
+            ':auth': true,
+            ':uid': userId,
+            ':authAt': now,
+            ':ttl': Math.floor(now / 1000) + DEFAULT_TTL_SECONDS,
+        };
+        if (tenantId) {
+            updateParts.push('tenantId = :tid');
+            values[':tid'] = tenantId;
+        }
+        if (email) {
+            updateParts.push('email = :email');
+            values[':email'] = email;
+        }
+        // Store any extra metadata fields
+        let extraIdx = 0;
+        for (const [key, val] of Object.entries(extra)) {
+            const placeholder = `:extra${extraIdx}`;
+            updateParts.push(`#extra${extraIdx} = ${placeholder}`);
+            values[placeholder] = val;
+            extraIdx++;
+        }
+        const names = {};
+        for (let i = 0; i < extraIdx; i++) {
+            names[`#extra${i}`] = Object.keys(extra)[i];
+        }
+        const client = await ddb();
+        const { UpdateCommand } = await getDocCommands();
+        await client.send(new UpdateCommand({
+            TableName: getTableName(),
+            Key: { connectionId },
+            UpdateExpression: `SET ${updateParts.join(', ')}`,
+            ExpressionAttributeValues: values,
+            ...(extraIdx > 0 ? { ExpressionAttributeNames: names } : {}),
+        }));
+    },
+    /**
+     * Remove a connection on $disconnect.
+     */
+    async remove(connectionId) {
+        const client = await ddb();
+        const { DeleteCommand } = await getDocCommands();
+        await client.send(new DeleteCommand({
+            TableName: getTableName(),
+            Key: { connectionId },
+        }));
+    },
+    /**
+     * Get a single connection record.
+     */
+    async get(connectionId) {
+        const client = await ddb();
+        const { GetCommand } = await getDocCommands();
+        const result = await client.send(new GetCommand({
+            TableName: getTableName(),
+            Key: { connectionId },
+        }));
+        return result.Item ?? null;
+    },
+    /**
+     * Get all authenticated connections.
+     * For large-scale apps, prefer getByUser() or getByTenant().
+     */
+    async getAll() {
+        const client = await ddb();
+        const { ScanCommand } = await getDocCommands();
+        const result = await client.send(new ScanCommand({
+            TableName: getTableName(),
+            FilterExpression: 'authenticated = :auth',
+            ExpressionAttributeValues: { ':auth': true },
+        }));
+        return (result.Items ?? []);
+    },
+    /**
+     * Get all connections for a specific user.
+     * A user can have multiple active connections (e.g. multiple tabs/devices).
+     * Requires GSI: userId-index (partition key: userId).
+     */
+    async getByUser(userId) {
+        const client = await ddb();
+        const { QueryCommand } = await getDocCommands();
+        const result = await client.send(new QueryCommand({
+            TableName: getTableName(),
+            IndexName: 'userId-index',
+            KeyConditionExpression: 'userId = :uid',
+            ExpressionAttributeValues: { ':uid': userId },
+        }));
+        return (result.Items ?? []);
+    },
+    /**
+     * Get all connections for a specific tenant.
+     * Requires GSI: tenantId-index (partition key: tenantId).
+     */
+    async getByTenant(tenantId) {
+        const client = await ddb();
+        const { QueryCommand } = await getDocCommands();
+        const result = await client.send(new QueryCommand({
+            TableName: getTableName(),
+            IndexName: 'tenantId-index',
+            KeyConditionExpression: 'tenantId = :tid',
+            ExpressionAttributeValues: { ':tid': tenantId },
+        }));
+        return (result.Items ?? []);
+    },
+    /**
+     * Send data to a specific connection via API Gateway Management API.
+     * Automatically cleans up stale connections (GoneException).
+     * Returns true if sent, false if the connection was stale and removed.
+     */
+    async postToConnection(domainName, stage, connectionId, data) {
+        const { ApiGatewayManagementApiClient, PostToConnectionCommand, GoneException } = await getApigwClient();
+        const apigw = new ApiGatewayManagementApiClient({
+            endpoint: `https://${domainName}/${stage}`,
+        });
+        try {
+            await apigw.send(new PostToConnectionCommand({
+                ConnectionId: connectionId,
+                Data: encode(data),
+            }));
+            return true;
+        }
+        catch (err) {
+            if (err instanceof GoneException) {
+                await this.remove(connectionId);
+                return false;
+            }
+            throw err;
+        }
+    },
+    /**
+     * Send data to all connections belonging to a specific user.
+     * Returns the number of connections that received the message.
+     */
+    async sendToUser(domainName, stage, userId, data) {
+        const connections = await this.getByUser(userId);
+        return deliverToMany(this, domainName, stage, connections, data);
+    },
+    /**
+     * Send data to all connections within a specific tenant.
+     * Returns the number of connections that received the message.
+     */
+    async sendToTenant(domainName, stage, tenantId, data) {
+        const connections = await this.getByTenant(tenantId);
+        return deliverToMany(this, domainName, stage, connections, data);
+    },
+    /**
+     * Broadcast data to all authenticated connections.
+     * Returns the number of clients that received the message.
+     */
+    async broadcast(domainName, stage, data) {
+        const connections = await this.getAll();
+        return deliverToMany(this, domainName, stage, connections, data);
+    },
+};
+//# sourceMappingURL=ws.js.map

package/dist/ws/ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../../src/ws/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAwBH,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAC,UAAU;AAC5C,MAAM,yBAAyB,GAAG,EAAE,CAAC,CAAC,6CAA6C;AAEnF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,IAAI,IAAI,GAAQ,IAAI,CAAC;AAErB,KAAK,UAAU,GAAG;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,OAAO,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,OAAO,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC3B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,KAA6B,EAC7B,UAAkB,EAClB,KAAa,EACb,WAA+B,EAC/B,IAAa;IAEb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,WAAW;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAC/E,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK;YAAE,SAAS,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,YAAoB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC9C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;YAC/B,SAAS,EAAE,YAAY,EAAE;YACzB,IAAI,EAAE;gBACJ,YAAY;gBACZ,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,GAAG;gBAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,yBAAyB;aACxD;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,YAAoB,EAAE,QAA4B;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC;QAEvD,MAAM,WAAW,GAAG;YAClB,uBAAuB;YACvB,eAAe;YACf,2BAA2B;YAC3B,YAAY;SACb,CAAC;QACF,MAAM,MAAM,GAA4B;YACtC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,mBAAmB;SACrD,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;QAED,kCAAkC;QAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,SAAS,QAAQ,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC,SAAS,QAAQ,MAAM,WAAW,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;YAC1B,QAAQ,EAAE,CAAC;QACb,CAAC;QAED,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QACjD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;YAClC,SAAS,EAAE,YAAY,EAAE;YACzB,GAAG,EAAE,EAAE,YAAY,EAAE;YACrB,gBAAgB,EAAE,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjD,yBAAyB,EAAE,MAAM;YACjC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QACjD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;YAClC,SAAS,EAAE,YAAY,EAAE;YACzB,GAAG,EAAE,EAAE,YAAY,EAAE;SACtB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,YAAoB;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;YAC9C,SAAS,EAAE,YAAY,EAAE;YACzB,GAAG,EAAE,EAAE,YAAY,EAAE;SACtB,CAAC,CAAC,CAAC;QACJ,OAAQ,MAAM,CAAC,IAAyB,IAAI,IAAI,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;YAC/C,SAAS,EAAE,YAAY,EAAE;YACzB,gBAAgB,EAAE,uBAAuB;YACzC,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAuB,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;YAChD,SAAS,EAAE,YAAY,EAAE;YACzB,SAAS,EAAE,cAAc;YACzB,sBAAsB,EAAE,eAAe;YACvC,yBAAyB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC9C,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAuB,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;YAChD,SAAS,EAAE,YAAY,EAAE;YACzB,SAAS,EAAE,gBAAgB;YAC3B,sBAAsB,EAAE,iBAAiB;YACzC,yBAAyB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAChD,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAuB,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,UAAkB,EAClB,KAAa,EACb,YAAoB,EACpB,IAAa;QAEb,MAAM,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QACzG,MAAM,KAAK,GAAG,IAAI,6BAA6B,CAAC;YAC9C,QAAQ,EAAE,WAAW,UAAU,IAAI,KAAK,EAAE;SAC3C,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC;gBAC3C,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;aACnB,CAAC,CAAC,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,UAAkB,EAClB,KAAa,EACb,QAAgB,EAChB,IAAa;QAEb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,KAAa,EAAE,IAAa;QAC9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;CACF,CAAC"}

package/dist/ws.d.ts

@@ -1,139 +1,11 @@
 /**
- * WebSocket Connection Store
+ * @venturekit/runtime/ws
  *
- * DynamoDB-backed connection management for API Gateway WebSocket APIs.
- *
- * Authentication:
- *   Two-phase auth — the client connects without credentials, then sends
- *   an { action: "auth", token: "<jwt>" } message over the encrypted channel.
- *   The connection is stored as unauthenticated on $connect and upgraded
- *   to authenticated via connectionStore.authenticate().
- *   This avoids leaking JWTs in query strings, server logs, and access logs.
- *
- * Multi-tenancy:
- *   If enabled, each connection stores a tenantId alongside userId.
- *   Use sendToTenant() to broadcast within a tenant boundary.
- *
- * API:
- *   connectionStore.save(connectionId)                        — $connect (unauthenticated)
- *   connectionStore.authenticate(connectionId, metadata)      — after JWT verification
- *   connectionStore.remove(connectionId)                      — $disconnect
- *   connectionStore.get(connectionId)                         — single connection
- *   connectionStore.getAll()                                  — all connections
- *   connectionStore.getByUser(userId)                         — by user (GSI)
- *   connectionStore.getByTenant(tenantId)                     — by tenant (GSI)
- *   connectionStore.postToConnection(domain, stage, id, data) — send to one
- *   connectionStore.sendToUser(domain, stage, userId, data)   — send to all user sessions
- *   connectionStore.sendToTenant(domain, stage, tenantId, data) — broadcast within tenant
- *   connectionStore.broadcast(domain, stage, data)            — broadcast to all
- *
- * Environment variables:
- *   CONNECTIONS_TABLE — DynamoDB table name (required)
- *
- * DynamoDB table schema:
- *   Partition key: connectionId (String)
- *   TTL attribute: ttl
- *   GSI: userId-index  (partition key: userId)
- *   GSI: tenantId-index (partition key: tenantId) — only if multi-tenancy enabled
- */
-export interface ConnectionRecord {
-    connectionId: string;
-    authenticated: boolean;
-    userId?: string;
-    tenantId?: string;
-    email?: string;
-    connectedAt: number;
-    authenticatedAt?: number;
-    ttl: number;
-    [key: string]: unknown;
-}
-export interface ConnectionMetadata {
-    userId: string;
-    tenantId?: string;
-    email?: string;
-    [key: string]: unknown;
-}
-/**
  * WebSocket connection store backed by DynamoDB.
+ * Requires @aws-sdk/client-dynamodb, @aws-sdk/lib-dynamodb, @aws-sdk/client-apigatewaymanagementapi.
  *
- * Two-phase authentication flow:
- *
- * 1. $connect handler:
- * ```typescript
- * await connectionStore.save(connectionId);
- * // Connection is unauthenticated, TTL = 30s
- * ```
- *
- * 2. Client sends auth message over the encrypted WebSocket:
- * ```json
- * { "action": "auth", "token": "<jwt>" }
- * ```
- *
- * 3. $default handler verifies JWT, then:
- * ```typescript
- * await connectionStore.authenticate(connectionId, { userId, tenantId, email });
- * // Connection is now authenticated, TTL extended to 2h
- * ```
+ * Import via: `import { connectionStore } from '@venturekit/runtime/ws'`
  */
-export declare const connectionStore: {
-    /**
-     * Save a new connection on $connect.
-     * The connection is unauthenticated with a short TTL.
-     * The client must send an auth message to upgrade.
-     */
-    save(connectionId: string): Promise<void>;
-    /**
-     * Authenticate a connection after JWT verification.
-     * Updates the record with user metadata and extends the TTL.
-     *
-     * @param connectionId — the connection to authenticate
-     * @param metadata — must include userId, optionally tenantId, email, etc.
-     */
-    authenticate(connectionId: string, metadata: ConnectionMetadata): Promise<void>;
-    /**
-     * Remove a connection on $disconnect.
-     */
-    remove(connectionId: string): Promise<void>;
-    /**
-     * Get a single connection record.
-     */
-    get(connectionId: string): Promise<ConnectionRecord | null>;
-    /**
-     * Get all authenticated connections.
-     * For large-scale apps, prefer getByUser() or getByTenant().
-     */
-    getAll(): Promise<ConnectionRecord[]>;
-    /**
-     * Get all connections for a specific user.
-     * A user can have multiple active connections (e.g. multiple tabs/devices).
-     * Requires GSI: userId-index (partition key: userId).
-     */
-    getByUser(userId: string): Promise<ConnectionRecord[]>;
-    /**
-     * Get all connections for a specific tenant.
-     * Requires GSI: tenantId-index (partition key: tenantId).
-     */
-    getByTenant(tenantId: string): Promise<ConnectionRecord[]>;
-    /**
-     * Send data to a specific connection via API Gateway Management API.
-     * Automatically cleans up stale connections (GoneException).
-     * Returns true if sent, false if the connection was stale and removed.
-     */
-    postToConnection(domainName: string, stage: string, connectionId: string, data: unknown): Promise<boolean>;
-    /**
-     * Send data to all connections belonging to a specific user.
-     * Returns the number of connections that received the message.
-     */
-    sendToUser(domainName: string, stage: string, userId: string, data: unknown): Promise<number>;
-    /**
-     * Send data to all connections within a specific tenant.
-     * Returns the number of connections that received the message.
-     */
-    sendToTenant(domainName: string, stage: string, tenantId: string, data: unknown): Promise<number>;
-    /**
-     * Broadcast data to all authenticated connections.
-     * Returns the number of clients that received the message.
-     */
-    broadcast(domainName: string, stage: string, data: unknown): Promise<number>;
-};
+export { connectionStore } from './ws/ws.js';
+export type { ConnectionRecord, ConnectionMetadata } from './ws/ws.js';
 //# sourceMappingURL=ws.d.ts.map

package/dist/ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA4DD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe;IAC1B;;;;OAIG;uBACsB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/C;;;;;;OAMG;+BAC8B,MAAM,YAAY,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDrF;;OAEG;yBACwB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD;;OAEG;sBACqB,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAUjE;;;OAGG;cACa,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAW3C;;;;OAIG;sBACqB,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY5D;;;OAGG;0BACyB,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAYhE;;;;OAIG;iCAEW,MAAM,SACX,MAAM,gBACC,MAAM,QACd,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC;IAqBnB;;;OAGG;2BAEW,MAAM,SACX,MAAM,UACL,MAAM,QACR,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC;IAKlB;;;OAGG;6BAEW,MAAM,SACX,MAAM,YACH,MAAM,QACV,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC;IAKlB;;;OAGG;0BACyB,MAAM,SAAS,MAAM,QAAQ,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAInF,CAAC"}
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}