@webiny/api-core 6.4.11 → 6.6.0-alpha.1

package/features/dateFormatter/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/dateFormatter/abstractions.js","sources":["../../../src/features/dateFormatter/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\nexport type FormattableDate = Date | string | number;\n\nexport interface IDateFormatter {\n    /**\n     * Formats an absolute date/time as a string using Webiny's default format. Change the format\n     * everywhere at once by decorating this abstraction.\n     */\n    format(date: FormattableDate): string;\n}\n\nexport const DateFormatter = createAbstraction<IDateFormatter>(\"DateFormatter\");\n\nexport namespace DateFormatter {\n    export type Interface = IDateFormatter;\n    export type Value = FormattableDate;\n}\n"],"names":["DateFormatter","createAbstraction"],"mappings":";AAYO,MAAMA,gBAAgBC,kBAAkC"}

package/features/dateFormatter/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const DateFormatterFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/dateFormatter/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { DefaultDateFormatter } from "./DefaultDateFormatter.js";
+const DateFormatterFeature = createFeature({
+    name: "DateFormatterFeature",
+    register (container) {
+        container.register(DefaultDateFormatter);
+    }
+});
+export { DateFormatterFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/dateFormatter/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/dateFormatter/feature.js","sources":["../../../src/features/dateFormatter/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { DefaultDateFormatter } from \"./DefaultDateFormatter.js\";\n\nexport const DateFormatterFeature = createFeature({\n    name: \"DateFormatterFeature\",\n    register(container) {\n        container.register(DefaultDateFormatter);\n    }\n});\n"],"names":["DateFormatterFeature","createFeature","container","DefaultDateFormatter"],"mappings":";;AAGO,MAAMA,uBAAuBC,cAAc;IAC9C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/features/dateFormatter/index.d.ts

@@ -0,0 +1,3 @@
+export { DateFormatter } from "./abstractions.js";
+export type { IDateFormatter, FormattableDate } from "./abstractions.js";
+export { DateFormatterFeature } from "./feature.js";

package/features/dateFormatter/index.js

@@ -0,0 +1,2 @@
+export { DateFormatter } from "./abstractions.js";
+export { DateFormatterFeature } from "./feature.js";

package/features/featureFlags/decorators/FeatureFlagsWithLicenseDecorator.d.ts

@@ -0,0 +1,13 @@
+import { FeatureFlags } from "../abstractions.js";
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+import { WcpLicenseProvider } from "../../../features/wcp/WcpLicenseProvider.js";
+declare class FeatureFlagsWithLicenseDecoratorImpl implements FeatureFlags.Interface {
+    private licenseProvider;
+    private decoratee;
+    constructor(licenseProvider: WcpLicenseProvider.Interface, decoratee: FeatureFlags.Interface);
+    get(): FeatureFlagsClass;
+}
+export declare const FeatureFlagsWithLicenseDecorator: typeof FeatureFlagsWithLicenseDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("../abstractions.js").IFeatureFlagsAbstraction>;
+};
+export {};

package/features/featureFlags/decorators/FeatureFlagsWithLicenseDecorator.js

@@ -0,0 +1,49 @@
+import { FeatureFlags } from "../abstractions.js";
+import { FeatureFlags as feature_flags_FeatureFlags } from "@webiny/feature-flags";
+import { WcpLicenseProvider } from "../../wcp/WcpLicenseProvider.js";
+const LICENSE_CHECKS = {
+    multiTenancy: (l)=>l.canUseFeature("multiTenancy"),
+    advancedPublishingWorkflow: (l)=>l.canUseWorkflows(),
+    advancedAccessControlLayer: (l)=>l.canUseAacl(),
+    "advancedAccessControlLayer.teams": (l)=>l.canUseTeams(),
+    "advancedAccessControlLayer.privateFiles": (l)=>l.canUsePrivateFiles(),
+    "advancedAccessControlLayer.folderLevelPermissions": (l)=>l.canUseFolderLevelPermissions(),
+    "advancedAccessControlLayer.hcmsFieldPermissions": (l)=>l.canUseHcmsFieldPermissions(),
+    auditLogs: (l)=>l.canUseAuditLogs(),
+    recordLocking: (l)=>l.canUseRecordLocking(),
+    "fileManager.threatDetection": (l)=>l.canUseFileManagerThreatDetection(),
+    "aiPowerups.fileManager.imageEnrichment": (l)=>l.canUseAiImageEnrichment(),
+    abTesting: (l)=>l.canUseAbTesting()
+};
+class LicenseDecoratedFeatureFlags extends feature_flags_FeatureFlags {
+    constructor(base, license){
+        super(base.toDto()), this.base = base, this.license = license;
+    }
+    isEnabled(name) {
+        const check = LICENSE_CHECKS[name];
+        if (check) {
+            if (!check(this.license)) return false;
+            return !this.base.isExplicitlyDisabled(name);
+        }
+        return this.base.isEnabled(name);
+    }
+}
+class FeatureFlagsWithLicenseDecoratorImpl {
+    constructor(licenseProvider, decoratee){
+        this.licenseProvider = licenseProvider;
+        this.decoratee = decoratee;
+    }
+    get() {
+        const base = this.decoratee.get();
+        return new LicenseDecoratedFeatureFlags(base, this.licenseProvider.get());
+    }
+}
+const FeatureFlagsWithLicenseDecorator = FeatureFlags.createDecorator({
+    decorator: FeatureFlagsWithLicenseDecoratorImpl,
+    dependencies: [
+        WcpLicenseProvider
+    ]
+});
+export { FeatureFlagsWithLicenseDecorator };
+
+//# sourceMappingURL=FeatureFlagsWithLicenseDecorator.js.map

package/features/featureFlags/decorators/FeatureFlagsWithLicenseDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/featureFlags/decorators/FeatureFlagsWithLicenseDecorator.js","sources":["../../../../src/features/featureFlags/decorators/FeatureFlagsWithLicenseDecorator.ts"],"sourcesContent":["import { FeatureFlags } from \"../abstractions.js\";\nimport { FeatureFlags as FeatureFlagsClass } from \"@webiny/feature-flags\";\nimport type { FeatureFlagName } from \"@webiny/feature-flags\";\nimport type { ILicense } from \"@webiny/wcp/types.js\";\nimport { WcpLicenseProvider } from \"~/features/wcp/WcpLicenseProvider.js\";\n\n/*\n * Feature flag resolution (license decorator).\n *\n * Two kinds of flag, and only one of them is Webiny's to sell:\n *\n * LICENSE-GOVERNED (listed in LICENSE_CHECKS) — the license is the authority:\n * 1. No license, or license blocks the flag → false, config ignored\n * 2. License allows + config unset          → true (the license grants it)\n * 3. License allows + config=false          → false (config may disable, never re-enable)\n *\n * EVERYTHING ELSE — the project's own flags. The config decides, and nothing is assumed:\n * 4. config=true           → true\n * 5. config=false or unset → false\n *\n * There is deliberately no third kind. A set of flags used to be enabled by default here, which was\n * a workaround for capabilities the license could not express: rather than gate them properly they\n * were left on for anyone holding any license at all. It also meant EVERY unrecognised name resolved\n * to true, so an undeclared flag and a typo both read as enabled. A feature that should be sold\n * belongs in LICENSE_CHECKS and on the license; anything else is the project's own to switch on.\n */\n\nconst LICENSE_CHECKS: Record<string, (license: ILicense) => boolean> = {\n    multiTenancy: l => l.canUseFeature(\"multiTenancy\"),\n    advancedPublishingWorkflow: l => l.canUseWorkflows(),\n    advancedAccessControlLayer: l => l.canUseAacl(),\n    \"advancedAccessControlLayer.teams\": l => l.canUseTeams(),\n    \"advancedAccessControlLayer.privateFiles\": l => l.canUsePrivateFiles(),\n    \"advancedAccessControlLayer.folderLevelPermissions\": l => l.canUseFolderLevelPermissions(),\n    \"advancedAccessControlLayer.hcmsFieldPermissions\": l => l.canUseHcmsFieldPermissions(),\n    auditLogs: l => l.canUseAuditLogs(),\n    recordLocking: l => l.canUseRecordLocking(),\n    \"fileManager.threatDetection\": l => l.canUseFileManagerThreatDetection(),\n    \"aiPowerups.fileManager.imageEnrichment\": l => l.canUseAiImageEnrichment(),\n    abTesting: l => l.canUseAbTesting()\n};\n\nclass LicenseDecoratedFeatureFlags extends FeatureFlagsClass {\n    constructor(\n        private base: FeatureFlagsClass,\n        private license: ILicense\n    ) {\n        super(base.toDto());\n    }\n\n    override isEnabled(name: FeatureFlagName): boolean {\n        const check = LICENSE_CHECKS[name];\n        if (check) {\n            if (!check(this.license)) {\n                return false;\n            }\n            // License allows — config can only disable, not re-enable blocked features.\n            return !this.base.isExplicitlyDisabled(name);\n        }\n        /*\n         * Everything else is the project's own, and the config is the only thing that decides. No\n         * default: `isEnabled` on the base is true only for an explicitly configured `true`.\n         *\n         * This branch used to return `!isExplicitlyDisabled(name)` whenever a license existed, which\n         * made EVERY unrecognised name true — an undeclared flag, or a typo like `aiPowerupz`. It also\n         * returned false outright without a license, so an unlicensed install could not turn on a flag\n         * it had declared itself. Neither is the license's business.\n         */\n        return this.base.isEnabled(name);\n    }\n}\n\nclass FeatureFlagsWithLicenseDecoratorImpl implements FeatureFlags.Interface {\n    constructor(\n        private licenseProvider: WcpLicenseProvider.Interface,\n        private decoratee: FeatureFlags.Interface\n    ) {}\n\n    get(): FeatureFlagsClass {\n        const base = this.decoratee.get();\n        return new LicenseDecoratedFeatureFlags(base, this.licenseProvider.get());\n    }\n}\n\nexport const FeatureFlagsWithLicenseDecorator = FeatureFlags.createDecorator({\n    decorator: FeatureFlagsWithLicenseDecoratorImpl,\n    dependencies: [WcpLicenseProvider]\n});\n"],"names":["LICENSE_CHECKS","l","LicenseDecoratedFeatureFlags","FeatureFlagsClass","base","license","name","check","FeatureFlagsWithLicenseDecoratorImpl","licenseProvider","decoratee","FeatureFlagsWithLicenseDecorator","FeatureFlags","WcpLicenseProvider"],"mappings":";;;AA2BA,MAAMA,iBAAiE;IACnE,cAAcC,CAAAA,IAAKA,EAAE,aAAa,CAAC;IACnC,4BAA4BA,CAAAA,IAAKA,EAAE,eAAe;IAClD,4BAA4BA,CAAAA,IAAKA,EAAE,UAAU;IAC7C,oCAAoCA,CAAAA,IAAKA,EAAE,WAAW;IACtD,2CAA2CA,CAAAA,IAAKA,EAAE,kBAAkB;IACpE,qDAAqDA,CAAAA,IAAKA,EAAE,4BAA4B;IACxF,mDAAmDA,CAAAA,IAAKA,EAAE,0BAA0B;IACpF,WAAWA,CAAAA,IAAKA,EAAE,eAAe;IACjC,eAAeA,CAAAA,IAAKA,EAAE,mBAAmB;IACzC,+BAA+BA,CAAAA,IAAKA,EAAE,gCAAgC;IACtE,0CAA0CA,CAAAA,IAAKA,EAAE,uBAAuB;IACxE,WAAWA,CAAAA,IAAKA,EAAE,eAAe;AACrC;AAEA,MAAMC,qCAAqCC;IACvC,YACYC,IAAuB,EACvBC,OAAiB,CAC3B;QACE,KAAK,CAACD,KAAK,KAAK,UAHRA,IAAI,GAAJA,MAAAA,IAAAA,CACAC,OAAO,GAAPA;IAGZ;IAES,UAAUC,IAAqB,EAAW;QAC/C,MAAMC,QAAQP,cAAc,CAACM,KAAK;QAClC,IAAIC,OAAO;YACP,IAAI,CAACA,MAAM,IAAI,CAAC,OAAO,GACnB,OAAO;YAGX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAACD;QAC3C;QAUA,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAACA;IAC/B;AACJ;AAEA,MAAME;IACF,YACYC,eAA6C,EAC7CC,SAAiC,CAC3C;aAFUD,eAAe,GAAfA;aACAC,SAAS,GAATA;IACT;IAEH,MAAyB;QACrB,MAAMN,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG;QAC/B,OAAO,IAAIF,6BAA6BE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG;IAC1E;AACJ;AAEO,MAAMO,mCAAmCC,aAAa,eAAe,CAAC;IACzE,WAAWJ;IACX,cAAc;QAACK;KAAmB;AACtC"}

package/features/hashing/ScryptHasher.d.ts

@@ -0,0 +1,11 @@
+import type { IHasher } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+export declare class ScryptHasher implements IHasher {
+    private readonly cost;
+    private readonly pepper;
+    constructor(buildParams: BuildParams.Interface);
+    hash(value: string): Promise<string>;
+    verify(value: string, storedHash: string): Promise<boolean>;
+    private withPepper;
+}
+export declare const Hasher: import("@webiny/di").Implementation<typeof ScryptHasher>;

package/features/hashing/ScryptHasher.js

@@ -0,0 +1,74 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { createImplementation } from "@webiny/feature/api";
+import { Hasher } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+const ScryptHasher_scrypt = (value, salt, keylen, options)=>new Promise((resolve, reject)=>{
+        scrypt(value, salt, keylen, options, (err, derivedKey)=>{
+            if (err) reject(err);
+            else resolve(derivedKey);
+        });
+    });
+const PREFIX = "scrypt";
+const KEYLEN = 64;
+const SALT_BYTES = 16;
+const DEFAULT_COST = {
+    N: 16384,
+    r: 8,
+    p: 1
+};
+class ScryptHasher {
+    constructor(buildParams){
+        this.pepper = buildParams.get("HashingPepper") ?? "";
+        const costN = buildParams.get("HashingCost");
+        this.cost = costN ? {
+            ...DEFAULT_COST,
+            N: Number(costN)
+        } : DEFAULT_COST;
+    }
+    async hash(value) {
+        const { N, r, p } = this.cost;
+        const salt = randomBytes(SALT_BYTES);
+        const derived = await ScryptHasher_scrypt(this.withPepper(value), salt, KEYLEN, {
+            N,
+            r,
+            p
+        });
+        return [
+            PREFIX,
+            N,
+            r,
+            p,
+            salt.toString("base64"),
+            derived.toString("base64")
+        ].join("$");
+    }
+    async verify(value, storedHash) {
+        const parts = storedHash.split("$");
+        if (6 !== parts.length || parts[0] !== PREFIX) return false;
+        const [, nRaw, rRaw, pRaw, saltB64, hashB64] = parts;
+        const N = Number(nRaw);
+        const r = Number(rRaw);
+        const p = Number(pRaw);
+        const salt = Buffer.from(saltB64, "base64");
+        const expected = Buffer.from(hashB64, "base64");
+        const derived = await ScryptHasher_scrypt(this.withPepper(value), salt, expected.length, {
+            N,
+            r,
+            p
+        });
+        return timingSafeEqual(derived, expected);
+    }
+    withPepper(value) {
+        return this.pepper ? `${value}${this.pepper}` : value;
+    }
+}
+const ScryptHasher_Hasher = createImplementation({
+    abstraction: Hasher,
+    implementation: ScryptHasher,
+    dependencies: [
+        BuildParams
+    ]
+});
+export { ScryptHasher, ScryptHasher_Hasher as Hasher };
+
+//# sourceMappingURL=ScryptHasher.js.map

package/features/hashing/ScryptHasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hashing/ScryptHasher.js","sources":["../../../src/features/hashing/ScryptHasher.ts"],"sourcesContent":["import { randomBytes, scrypt as scryptCb, timingSafeEqual } from \"node:crypto\";\nimport type { ScryptOptions } from \"node:crypto\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Hasher as HasherAbstraction } from \"./abstractions.js\";\nimport type { IHasher } from \"./abstractions.js\";\nimport { BuildParams } from \"../buildParams/abstractions.js\";\n\n// `promisify(scryptCb)` resolves to the no-options overload, so we wrap by hand\n// to keep the cost parameters (N, r, p).\nconst scrypt = (\n    value: string,\n    salt: Buffer,\n    keylen: number,\n    options: ScryptOptions\n): Promise<Buffer> =>\n    new Promise((resolve, reject) => {\n        scryptCb(value, salt, keylen, options, (err, derivedKey) => {\n            if (err) {\n                reject(err);\n            } else {\n                resolve(derivedKey);\n            }\n        });\n    });\n\n/**\n * Default hasher, built on Node's `crypto.scrypt` — no native dependency, so it runs anywhere Node\n * runs.\n *\n * Configuration (from `webiny.config.tsx` via `<Infra.Hashing>` → BuildParams):\n *  - `HashingPepper` — an optional server-side secret folded into every hash. Unlike the per-value\n *    salt (stored alongside the hash), the pepper is NOT stored, so a stolen database alone cannot\n *    be brute-forced without also holding the pepper. Changing it invalidates existing hashes (same\n *    trade-off as rotating the encryption passphrase). Omitted → no pepper, salt only.\n *  - `HashingCost` — optional override of the scrypt cost parameter N. Defaults to 16384.\n *\n * The stored value is self-describing (`scrypt$N$r$p$salt$hash`), so switching to Argon2id later is\n * a matter of registering a different `Hasher` — old scrypt hashes keep verifying.\n */\nconst PREFIX = \"scrypt\";\nconst KEYLEN = 64;\nconst SALT_BYTES = 16;\n\ninterface ScryptCost {\n    N: number;\n    r: number;\n    p: number;\n}\n\nconst DEFAULT_COST: ScryptCost = { N: 16384, r: 8, p: 1 };\n\nexport class ScryptHasher implements IHasher {\n    private readonly cost: ScryptCost;\n    private readonly pepper: string;\n\n    constructor(buildParams: BuildParams.Interface) {\n        this.pepper = buildParams.get<string>(\"HashingPepper\") ?? \"\";\n        const costN = buildParams.get<number | string>(\"HashingCost\");\n        this.cost = costN ? { ...DEFAULT_COST, N: Number(costN) } : DEFAULT_COST;\n    }\n\n    async hash(value: string): Promise<string> {\n        const { N, r, p } = this.cost;\n        const salt = randomBytes(SALT_BYTES);\n        const derived = (await scrypt(this.withPepper(value), salt, KEYLEN, { N, r, p })) as Buffer;\n\n        return [PREFIX, N, r, p, salt.toString(\"base64\"), derived.toString(\"base64\")].join(\"$\");\n    }\n\n    async verify(value: string, storedHash: string): Promise<boolean> {\n        const parts = storedHash.split(\"$\");\n        if (parts.length !== 6 || parts[0] !== PREFIX) {\n            return false;\n        }\n\n        const [, nRaw, rRaw, pRaw, saltB64, hashB64] = parts;\n        const N = Number(nRaw);\n        const r = Number(rRaw);\n        const p = Number(pRaw);\n        const salt = Buffer.from(saltB64, \"base64\");\n        const expected = Buffer.from(hashB64, \"base64\");\n\n        const derived = (await scrypt(this.withPepper(value), salt, expected.length, {\n            N,\n            r,\n            p\n        })) as Buffer;\n\n        // Lengths always match here, so timingSafeEqual is safe to call directly.\n        return timingSafeEqual(derived, expected);\n    }\n\n    private withPepper(value: string): string {\n        return this.pepper ? `${value}${this.pepper}` : value;\n    }\n}\n\nexport const Hasher = createImplementation({\n    abstraction: HasherAbstraction,\n    implementation: ScryptHasher,\n    dependencies: [BuildParams]\n});\n"],"names":["scrypt","value","salt","keylen","options","Promise","resolve","reject","scryptCb","err","derivedKey","PREFIX","KEYLEN","SALT_BYTES","DEFAULT_COST","ScryptHasher","buildParams","costN","Number","N","r","p","randomBytes","derived","storedHash","parts","nRaw","rRaw","pRaw","saltB64","hashB64","Buffer","expected","timingSafeEqual","Hasher","createImplementation","HasherAbstraction","BuildParams"],"mappings":";;;;AASA,MAAMA,sBAAS,CACXC,OACAC,MACAC,QACAC,UAEA,IAAIC,QAAQ,CAACC,SAASC;QAClBC,OAASP,OAAOC,MAAMC,QAAQC,SAAS,CAACK,KAAKC;YACzC,IAAID,KACAF,OAAOE;iBAEPH,QAAQI;QAEhB;IACJ;AAgBJ,MAAMC,SAAS;AACf,MAAMC,SAAS;AACf,MAAMC,aAAa;AAQnB,MAAMC,eAA2B;IAAE,GAAG;IAAO,GAAG;IAAG,GAAG;AAAE;AAEjD,MAAMC;IAIT,YAAYC,WAAkC,CAAE;QAC5C,IAAI,CAAC,MAAM,GAAGA,YAAY,GAAG,CAAS,oBAAoB;QAC1D,MAAMC,QAAQD,YAAY,GAAG,CAAkB;QAC/C,IAAI,CAAC,IAAI,GAAGC,QAAQ;YAAE,GAAGH,YAAY;YAAE,GAAGI,OAAOD;QAAO,IAAIH;IAChE;IAEA,MAAM,KAAKb,KAAa,EAAmB;QACvC,MAAM,EAAEkB,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI;QAC7B,MAAMnB,OAAOoB,YAAYT;QACzB,MAAMU,UAAW,MAAMvB,oBAAO,IAAI,CAAC,UAAU,CAACC,QAAQC,MAAMU,QAAQ;YAAEO;YAAGC;YAAGC;QAAE;QAE9E,OAAO;YAACV;YAAQQ;YAAGC;YAAGC;YAAGnB,KAAK,QAAQ,CAAC;YAAWqB,QAAQ,QAAQ,CAAC;SAAU,CAAC,IAAI,CAAC;IACvF;IAEA,MAAM,OAAOtB,KAAa,EAAEuB,UAAkB,EAAoB;QAC9D,MAAMC,QAAQD,WAAW,KAAK,CAAC;QAC/B,IAAIC,AAAiB,MAAjBA,MAAM,MAAM,IAAUA,KAAK,CAAC,EAAE,KAAKd,QACnC,OAAO;QAGX,MAAM,GAAGe,MAAMC,MAAMC,MAAMC,SAASC,QAAQ,GAAGL;QAC/C,MAAMN,IAAID,OAAOQ;QACjB,MAAMN,IAAIF,OAAOS;QACjB,MAAMN,IAAIH,OAAOU;QACjB,MAAM1B,OAAO6B,OAAO,IAAI,CAACF,SAAS;QAClC,MAAMG,WAAWD,OAAO,IAAI,CAACD,SAAS;QAEtC,MAAMP,UAAW,MAAMvB,oBAAO,IAAI,CAAC,UAAU,CAACC,QAAQC,MAAM8B,SAAS,MAAM,EAAE;YACzEb;YACAC;YACAC;QACJ;QAGA,OAAOY,gBAAgBV,SAASS;IACpC;IAEQ,WAAW/B,KAAa,EAAU;QACtC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAGA,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAGA;IACpD;AACJ;AAEO,MAAMiC,sBAASC,qBAAqB;IACvC,aAAaC;IACb,gBAAgBrB;IAChB,cAAc;QAACsB;KAAY;AAC/B"}

package/features/hashing/abstractions.d.ts

@@ -0,0 +1,18 @@
+export interface IHasher {
+    hash(value: string): Promise<string>;
+    /** Constant-time compare of `value` against a previously produced hash string. */
+    verify(value: string, storedHash: string): Promise<boolean>;
+}
+/**
+ * Hashes and verifies secret values (passwords, API-key secrets, tokens, …) with a slow, salted
+ * KDF — built for the "store a hash, later verify a presented value" pattern.
+ *
+ * NOT a general-purpose digest: output is salted and non-deterministic, so this is the wrong tool
+ * for checksums / cache keys / dedup (use a fast deterministic digest util for those). Swap the
+ * implementation to change algorithms (e.g. Argon2id); stored hashes are self-describing, so old
+ * hashes keep verifying after a swap.
+ */
+export declare const Hasher: import("@webiny/di").Abstraction<IHasher>;
+export declare namespace Hasher {
+    type Interface = IHasher;
+}

package/features/hashing/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const Hasher = createAbstraction("Hasher");
+export { Hasher };
+
+//# sourceMappingURL=abstractions.js.map

package/features/hashing/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hashing/abstractions.js","sources":["../../../src/features/hashing/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\nexport interface IHasher {\n    hash(value: string): Promise<string>;\n    /** Constant-time compare of `value` against a previously produced hash string. */\n    verify(value: string, storedHash: string): Promise<boolean>;\n}\n\n/**\n * Hashes and verifies secret values (passwords, API-key secrets, tokens, …) with a slow, salted\n * KDF — built for the \"store a hash, later verify a presented value\" pattern.\n *\n * NOT a general-purpose digest: output is salted and non-deterministic, so this is the wrong tool\n * for checksums / cache keys / dedup (use a fast deterministic digest util for those). Swap the\n * implementation to change algorithms (e.g. Argon2id); stored hashes are self-describing, so old\n * hashes keep verifying after a swap.\n */\nexport const Hasher = createAbstraction<IHasher>(\"Hasher\");\n\nexport namespace Hasher {\n    export type Interface = IHasher;\n}\n"],"names":["Hasher","createAbstraction"],"mappings":";AAiBO,MAAMA,SAASC,kBAA2B"}

package/features/hashing/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const HasherFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/hashing/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { Hasher } from "./ScryptHasher.js";
+const HasherFeature = createFeature({
+    name: "HasherFeature",
+    register (container) {
+        container.register(Hasher);
+    }
+});
+export { HasherFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/hashing/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hashing/feature.js","sources":["../../../src/features/hashing/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { Hasher } from \"./ScryptHasher.js\";\n\nexport const HasherFeature = createFeature({\n    name: \"HasherFeature\",\n    register(container) {\n        container.register(Hasher);\n    }\n});\n"],"names":["HasherFeature","createFeature","container","Hasher"],"mappings":";;AAGO,MAAMA,gBAAgBC,cAAc;IACvC,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/features/hashing/index.d.ts

@@ -0,0 +1,2 @@
+export { Hasher } from "./abstractions.js";
+export type { IHasher } from "./abstractions.js";

package/features/hashing/index.js

@@ -0,0 +1 @@
+export { Hasher } from "./abstractions.js";

package/features/requestContext/RawAuthToken.d.ts

@@ -0,0 +1,14 @@
+import type { IRawAuthToken } from "./abstractions.js";
+/**
+ * Per-request holder for the transport-extracted raw auth token. Registered per request, so a fresh
+ * instance holds the value for the current request only.
+ */
+declare class RawAuthTokenImpl implements IRawAuthToken {
+    private value;
+    get(): string | null;
+    set(token: string | null): void;
+}
+export declare const RawAuthToken: typeof RawAuthTokenImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IRawAuthToken>;
+};
+export {};

package/features/requestContext/RawAuthToken.js

@@ -0,0 +1,19 @@
+import { RawAuthToken } from "./abstractions.js";
+class RawAuthTokenImpl {
+    get() {
+        return this.value;
+    }
+    set(token) {
+        this.value = token;
+    }
+    constructor(){
+        this.value = null;
+    }
+}
+const RawAuthToken_RawAuthToken = RawAuthToken.createImplementation({
+    implementation: RawAuthTokenImpl,
+    dependencies: []
+});
+export { RawAuthToken_RawAuthToken as RawAuthToken };
+
+//# sourceMappingURL=RawAuthToken.js.map

package/features/requestContext/RawAuthToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/RawAuthToken.js","sources":["../../../src/features/requestContext/RawAuthToken.ts"],"sourcesContent":["import { RawAuthToken as Abstraction } from \"./abstractions.js\";\nimport type { IRawAuthToken } from \"./abstractions.js\";\n\n/**\n * Per-request holder for the transport-extracted raw auth token. Registered per request, so a fresh\n * instance holds the value for the current request only.\n */\nclass RawAuthTokenImpl implements IRawAuthToken {\n    private value: string | null = null;\n\n    get(): string | null {\n        return this.value;\n    }\n\n    set(token: string | null): void {\n        this.value = token;\n    }\n}\n\nexport const RawAuthToken = Abstraction.createImplementation({\n    implementation: RawAuthTokenImpl,\n    dependencies: []\n});\n"],"names":["RawAuthTokenImpl","token","RawAuthToken","Abstraction"],"mappings":";AAOA,MAAMA;IAGF,MAAqB;QACjB,OAAO,IAAI,CAAC,KAAK;IACrB;IAEA,IAAIC,KAAoB,EAAQ;QAC5B,IAAI,CAAC,KAAK,GAAGA;IACjB;;aARQ,KAAK,GAAkB;;AASnC;AAEO,MAAMC,4BAAeC,aAAAA,oBAAgC,CAAC;IACzD,gBAAgBH;IAChB,cAAc,EAAE;AACpB"}

package/features/requestContext/RawTenantId.d.ts

@@ -0,0 +1,14 @@
+import type { IRawTenantId } from "./abstractions.js";
+/**
+ * Per-request holder for the transport-extracted raw tenant id. Registered per request, so a fresh
+ * instance holds the value for the current request only.
+ */
+declare class RawTenantIdImpl implements IRawTenantId {
+    private value;
+    get(): string | null;
+    set(id: string | null): void;
+}
+export declare const RawTenantId: typeof RawTenantIdImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IRawTenantId>;
+};
+export {};

package/features/requestContext/RawTenantId.js

@@ -0,0 +1,19 @@
+import { RawTenantId } from "./abstractions.js";
+class RawTenantIdImpl {
+    get() {
+        return this.value;
+    }
+    set(id) {
+        this.value = id;
+    }
+    constructor(){
+        this.value = null;
+    }
+}
+const RawTenantId_RawTenantId = RawTenantId.createImplementation({
+    implementation: RawTenantIdImpl,
+    dependencies: []
+});
+export { RawTenantId_RawTenantId as RawTenantId };
+
+//# sourceMappingURL=RawTenantId.js.map

package/features/requestContext/RawTenantId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/RawTenantId.js","sources":["../../../src/features/requestContext/RawTenantId.ts"],"sourcesContent":["import { RawTenantId as Abstraction } from \"./abstractions.js\";\nimport type { IRawTenantId } from \"./abstractions.js\";\n\n/**\n * Per-request holder for the transport-extracted raw tenant id. Registered per request, so a fresh\n * instance holds the value for the current request only.\n */\nclass RawTenantIdImpl implements IRawTenantId {\n    private value: string | null = null;\n\n    get(): string | null {\n        return this.value;\n    }\n\n    set(id: string | null): void {\n        this.value = id;\n    }\n}\n\nexport const RawTenantId = Abstraction.createImplementation({\n    implementation: RawTenantIdImpl,\n    dependencies: []\n});\n"],"names":["RawTenantIdImpl","id","RawTenantId","Abstraction"],"mappings":";AAOA,MAAMA;IAGF,MAAqB;QACjB,OAAO,IAAI,CAAC,KAAK;IACrB;IAEA,IAAIC,EAAiB,EAAQ;QACzB,IAAI,CAAC,KAAK,GAAGA;IACjB;;aARQ,KAAK,GAAkB;;AASnC;AAEO,MAAMC,0BAAcC,YAAAA,oBAAgC,CAAC;IACxD,gBAAgBH;IAChB,cAAc,EAAE;AACpB"}

package/features/requestContext/RequestIdentityLoader.d.ts

@@ -0,0 +1,19 @@
+import { RequestIdentityLoader as Abstraction } from "./abstractions.js";
+import type { IRawAuthToken } from "./abstractions.js";
+import type { IAuthenticationContext } from "../../features/security/authentication/AuthenticationContext/index.js";
+import type { IIdentityContext } from "../../features/security/IdentityContext/abstractions.js";
+/**
+ * LOAD step: authenticates the token set by the transport's EXTRACT step into RawAuthToken and sets
+ * IdentityContext. A null/absent token authenticates as anonymous (preserves the previous
+ * always-authenticate-the-header behavior). Transport-agnostic.
+ */
+export declare class RequestIdentityLoaderImpl implements Abstraction.Interface {
+    private authentication;
+    private identityContext;
+    private rawAuthToken;
+    constructor(authentication: IAuthenticationContext, identityContext: IIdentityContext, rawAuthToken: IRawAuthToken);
+    establish(): Promise<void>;
+}
+export declare const RequestIdentityLoader: typeof RequestIdentityLoaderImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IRequestIdentityLoader>;
+};

package/features/requestContext/RequestIdentityLoader.js

@@ -0,0 +1,26 @@
+import { RawAuthToken, RequestIdentityLoader } from "./abstractions.js";
+import { AuthenticationContext } from "../security/authentication/AuthenticationContext/index.js";
+import { IdentityContext } from "../security/IdentityContext/index.js";
+class RequestIdentityLoaderImpl {
+    constructor(authentication, identityContext, rawAuthToken){
+        this.authentication = authentication;
+        this.identityContext = identityContext;
+        this.rawAuthToken = rawAuthToken;
+    }
+    async establish() {
+        const token = this.rawAuthToken.get() ?? "";
+        const identity = await this.authentication.authenticate(token);
+        this.identityContext.setIdentity(identity);
+    }
+}
+const RequestIdentityLoader_RequestIdentityLoader = RequestIdentityLoader.createImplementation({
+    implementation: RequestIdentityLoaderImpl,
+    dependencies: [
+        AuthenticationContext,
+        IdentityContext,
+        RawAuthToken
+    ]
+});
+export { RequestIdentityLoaderImpl, RequestIdentityLoader_RequestIdentityLoader as RequestIdentityLoader };
+
+//# sourceMappingURL=RequestIdentityLoader.js.map

package/features/requestContext/RequestIdentityLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/RequestIdentityLoader.js","sources":["../../../src/features/requestContext/RequestIdentityLoader.ts"],"sourcesContent":["import { RequestIdentityLoader as Abstraction, RawAuthToken } from \"./abstractions.js\";\nimport type { IRawAuthToken } from \"./abstractions.js\";\nimport { AuthenticationContext } from \"~/features/security/authentication/AuthenticationContext/index.js\";\nimport type { IAuthenticationContext } from \"~/features/security/authentication/AuthenticationContext/index.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\n\n/**\n * LOAD step: authenticates the token set by the transport's EXTRACT step into RawAuthToken and sets\n * IdentityContext. A null/absent token authenticates as anonymous (preserves the previous\n * always-authenticate-the-header behavior). Transport-agnostic.\n */\nexport class RequestIdentityLoaderImpl implements Abstraction.Interface {\n    constructor(\n        private authentication: IAuthenticationContext,\n        private identityContext: IIdentityContext,\n        private rawAuthToken: IRawAuthToken\n    ) {}\n\n    async establish(): Promise<void> {\n        const token = this.rawAuthToken.get() ?? \"\";\n        const identity = await this.authentication.authenticate(token);\n        this.identityContext.setIdentity(identity);\n    }\n}\n\nexport const RequestIdentityLoader = Abstraction.createImplementation({\n    implementation: RequestIdentityLoaderImpl,\n    dependencies: [AuthenticationContext, IdentityContext, RawAuthToken]\n});\n"],"names":["RequestIdentityLoaderImpl","authentication","identityContext","rawAuthToken","token","identity","RequestIdentityLoader","Abstraction","AuthenticationContext","IdentityContext","RawAuthToken"],"mappings":";;;AAYO,MAAMA;IACT,YACYC,cAAsC,EACtCC,eAAiC,EACjCC,YAA2B,CACrC;aAHUF,cAAc,GAAdA;aACAC,eAAe,GAAfA;aACAC,YAAY,GAAZA;IACT;IAEH,MAAM,YAA2B;QAC7B,MAAMC,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,MAAM;QACzC,MAAMC,WAAW,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAACD;QACxD,IAAI,CAAC,eAAe,CAAC,WAAW,CAACC;IACrC;AACJ;AAEO,MAAMC,8CAAwBC,sBAAAA,oBAAgC,CAAC;IAClE,gBAAgBP;IAChB,cAAc;QAACQ;QAAuBC;QAAiBC;KAAa;AACxE"}

package/features/requestContext/RequestTenantLoader.d.ts

@@ -0,0 +1,18 @@
+import { RequestTenantLoader as Abstraction } from "./abstractions.js";
+import type { IRawTenantId } from "./abstractions.js";
+import type { ITenantContext } from "../../features/tenancy/TenantContext/abstractions.js";
+import type { IGetTenantByIdUseCase } from "../../features/tenancy/GetTenantById/abstractions.js";
+/**
+ * LOAD step: reads the raw tenant id (set by the transport's EXTRACT step into RawTenantId),
+ * resolves the Tenant, and sets TenantContext. Transport-agnostic.
+ */
+export declare class RequestTenantLoaderImpl implements Abstraction.Interface {
+    private tenantContext;
+    private getTenantById;
+    private rawTenantId;
+    constructor(tenantContext: ITenantContext, getTenantById: IGetTenantByIdUseCase, rawTenantId: IRawTenantId);
+    establish(): Promise<void>;
+}
+export declare const RequestTenantLoader: typeof RequestTenantLoaderImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IRequestTenantLoader>;
+};

package/features/requestContext/RequestTenantLoader.js

@@ -0,0 +1,52 @@
+import { RawTenantId, RequestTenantLoader } from "./abstractions.js";
+import { TenantContext } from "../tenancy/TenantContext/index.js";
+import { GetTenantByIdUseCase } from "../tenancy/GetTenantById/index.js";
+const DEFAULT_TENANT_ID = "root";
+const createBootstrapRootTenant = ()=>{
+    const now = new Date().toISOString();
+    return {
+        id: DEFAULT_TENANT_ID,
+        name: "Root",
+        description: "",
+        status: "enabled",
+        isInstalled: false,
+        settings: {
+            name: {
+                full: "Root",
+                slug: "root"
+            },
+            social: {},
+            favicon: {},
+            logo: {}
+        },
+        tags: [],
+        parent: null,
+        createdOn: now,
+        savedOn: now
+    };
+};
+class RequestTenantLoaderImpl {
+    constructor(tenantContext, getTenantById, rawTenantId){
+        this.tenantContext = tenantContext;
+        this.getTenantById = getTenantById;
+        this.rawTenantId = rawTenantId;
+    }
+    async establish() {
+        const resolvedId = this.rawTenantId.get() || DEFAULT_TENANT_ID;
+        const result = await this.getTenantById.execute(resolvedId);
+        if (result.isOk()) return void this.tenantContext.setTenant(result.value);
+        if (resolvedId === DEFAULT_TENANT_ID) return void this.tenantContext.setTenant(createBootstrapRootTenant());
+        console.warn(`[RequestTenantLoader] Tenant "${resolvedId}" not found.`);
+    }
+}
+const RequestTenantLoader_RequestTenantLoader = RequestTenantLoader.createImplementation({
+    implementation: RequestTenantLoaderImpl,
+    dependencies: [
+        TenantContext,
+        GetTenantByIdUseCase,
+        RawTenantId
+    ]
+});
+export { RequestTenantLoaderImpl, RequestTenantLoader_RequestTenantLoader as RequestTenantLoader };
+
+//# sourceMappingURL=RequestTenantLoader.js.map

package/features/requestContext/RequestTenantLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/RequestTenantLoader.js","sources":["../../../src/features/requestContext/RequestTenantLoader.ts"],"sourcesContent":["import { RequestTenantLoader as Abstraction, RawTenantId } from \"./abstractions.js\";\nimport type { IRawTenantId } from \"./abstractions.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport type { ITenantContext } from \"~/features/tenancy/TenantContext/abstractions.js\";\nimport { GetTenantByIdUseCase } from \"~/features/tenancy/GetTenantById/index.js\";\nimport type { IGetTenantByIdUseCase } from \"~/features/tenancy/GetTenantById/abstractions.js\";\nimport type { Tenant } from \"~/types/tenancy.js\";\n\nconst DEFAULT_TENANT_ID = \"root\";\n\n/**\n * A minimal in-memory root tenant used only before the system is installed, when the real root\n * tenant record doesn't exist yet. It keeps the request pipeline + GraphQL schema build functional\n * (nothing dereferences a null tenant) so the install mutation can run and create the real root.\n * Once installed, getTenantById returns the persisted record and this is never used.\n */\nconst createBootstrapRootTenant = (): Tenant => {\n    const now = new Date().toISOString();\n    return {\n        id: DEFAULT_TENANT_ID,\n        name: \"Root\",\n        description: \"\",\n        status: \"enabled\",\n        isInstalled: false,\n        settings: {\n            name: { full: \"Root\", slug: \"root\" },\n            social: {},\n            favicon: {},\n            logo: {}\n        } as any,\n        tags: [],\n        parent: null,\n        createdOn: now,\n        savedOn: now\n    };\n};\n\n/**\n * LOAD step: reads the raw tenant id (set by the transport's EXTRACT step into RawTenantId),\n * resolves the Tenant, and sets TenantContext. Transport-agnostic.\n */\nexport class RequestTenantLoaderImpl implements Abstraction.Interface {\n    constructor(\n        private tenantContext: ITenantContext,\n        private getTenantById: IGetTenantByIdUseCase,\n        private rawTenantId: IRawTenantId\n    ) {}\n\n    async establish(): Promise<void> {\n        const resolvedId = this.rawTenantId.get() || DEFAULT_TENANT_ID;\n        const result = await this.getTenantById.execute(resolvedId);\n        if (result.isOk()) {\n            this.tenantContext.setTenant(result.value);\n            return;\n        }\n\n        // Fresh, not-yet-installed environment: the root tenant record doesn't exist yet. Establish a\n        // bootstrap root so the request pipeline + GraphQL schema build work and the install mutation\n        // can create the real root tenant. Only ever taken for the root tenant pre-install.\n        if (resolvedId === DEFAULT_TENANT_ID) {\n            this.tenantContext.setTenant(createBootstrapRootTenant());\n            return;\n        }\n\n        console.warn(`[RequestTenantLoader] Tenant \"${resolvedId}\" not found.`);\n    }\n}\n\nexport const RequestTenantLoader = Abstraction.createImplementation({\n    implementation: RequestTenantLoaderImpl,\n    dependencies: [TenantContext, GetTenantByIdUseCase, RawTenantId]\n});\n"],"names":["DEFAULT_TENANT_ID","createBootstrapRootTenant","now","Date","RequestTenantLoaderImpl","tenantContext","getTenantById","rawTenantId","resolvedId","result","console","RequestTenantLoader","Abstraction","TenantContext","GetTenantByIdUseCase","RawTenantId"],"mappings":";;;AAQA,MAAMA,oBAAoB;AAQ1B,MAAMC,4BAA4B;IAC9B,MAAMC,MAAM,IAAIC,OAAO,WAAW;IAClC,OAAO;QACH,IAAIH;QACJ,MAAM;QACN,aAAa;QACb,QAAQ;QACR,aAAa;QACb,UAAU;YACN,MAAM;gBAAE,MAAM;gBAAQ,MAAM;YAAO;YACnC,QAAQ,CAAC;YACT,SAAS,CAAC;YACV,MAAM,CAAC;QACX;QACA,MAAM,EAAE;QACR,QAAQ;QACR,WAAWE;QACX,SAASA;IACb;AACJ;AAMO,MAAME;IACT,YACYC,aAA6B,EAC7BC,aAAoC,EACpCC,WAAyB,CACnC;aAHUF,aAAa,GAAbA;aACAC,aAAa,GAAbA;aACAC,WAAW,GAAXA;IACT;IAEH,MAAM,YAA2B;QAC7B,MAAMC,aAAa,IAAI,CAAC,WAAW,CAAC,GAAG,MAAMR;QAC7C,MAAMS,SAAS,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAACD;QAChD,IAAIC,OAAO,IAAI,IAAI,YACf,IAAI,CAAC,aAAa,CAAC,SAAS,CAACA,OAAO,KAAK;QAO7C,IAAID,eAAeR,mBAAmB,YAClC,IAAI,CAAC,aAAa,CAAC,SAAS,CAACC;QAIjCS,QAAQ,IAAI,CAAC,CAAC,8BAA8B,EAAEF,WAAW,YAAY,CAAC;IAC1E;AACJ;AAEO,MAAMG,0CAAsBC,oBAAAA,oBAAgC,CAAC;IAChE,gBAAgBR;IAChB,cAAc;QAACS;QAAeC;QAAsBC;KAAY;AACpE"}

package/features/requestContext/abstractions.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Per-request holder for the raw tenant id EXTRACTED by the transport (e.g. the `x-tenant` header
+ * of an API Gateway event, the bucket name of an S3 event, or `payload.tenant` of a background
+ * task). The transport-specific EXTRACT step sets this; the transport-agnostic LOAD step
+ * (RequestTenantLoader) reads it, resolves the Tenant, and sets TenantContext.
+ */
+export interface IRawTenantId {
+    get(): string | null;
+    set(id: string | null): void;
+}
+export declare const RawTenantId: import("@webiny/di").Abstraction<IRawTenantId>;
+export declare namespace RawTenantId {
+    type Interface = IRawTenantId;
+}
+/**
+ * Per-request holder for the raw auth token EXTRACTED by the transport (e.g. the `Authorization`
+ * bearer header or an auth cookie of an API Gateway event). Only token-based transports set this;
+ * the transport-agnostic LOAD step (RequestIdentityLoader) reads it, authenticates it, and
+ * sets IdentityContext. A null/absent value authenticates as anonymous.
+ *
+ * Note: non-token transports (S3, background tasks) never set this — S3 has no user identity, and
+ * background-task identity is derived from `task.createdBy` after the task is fetched.
+ */
+export interface IRawAuthToken {
+    get(): string | null;
+    set(token: string | null): void;
+}
+export declare const RawAuthToken: import("@webiny/di").Abstraction<IRawAuthToken>;
+export declare namespace RawAuthToken {
+    type Interface = IRawAuthToken;
+}
+/**
+ * LOAD step: authenticates the token held by RawAuthToken and sets IdentityContext. Fully
+ * transport-agnostic — transports only EXTRACT the token into RawAuthToken.
+ */
+export interface IRequestIdentityLoader {
+    establish(): Promise<void>;
+}
+export declare const RequestIdentityLoader: import("@webiny/di").Abstraction<IRequestIdentityLoader>;
+export declare namespace RequestIdentityLoader {
+    type Interface = IRequestIdentityLoader;
+}
+/**
+ * LOAD step: resolves the Tenant for the id held by RawTenantId and sets TenantContext. Fully
+ * transport-agnostic — transports only EXTRACT the id into RawTenantId.
+ */
+export interface IRequestTenantLoader {
+    establish(): Promise<void>;
+}
+export declare const RequestTenantLoader: import("@webiny/di").Abstraction<IRequestTenantLoader>;
+export declare namespace RequestTenantLoader {
+    type Interface = IRequestTenantLoader;
+}

package/features/requestContext/abstractions.js

@@ -0,0 +1,8 @@
+import { createAbstraction } from "@webiny/feature/api";
+const RawTenantId = createAbstraction("RequestContext/RawTenantId");
+const RawAuthToken = createAbstraction("RequestContext/RawAuthToken");
+const RequestIdentityLoader = createAbstraction("RequestContext/RequestIdentityLoader");
+const RequestTenantLoader = createAbstraction("RequestContext/RequestTenantLoader");
+export { RawAuthToken, RawTenantId, RequestIdentityLoader, RequestTenantLoader };
+
+//# sourceMappingURL=abstractions.js.map

package/features/requestContext/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/abstractions.js","sources":["../../../src/features/requestContext/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\n/**\n * Per-request holder for the raw tenant id EXTRACTED by the transport (e.g. the `x-tenant` header\n * of an API Gateway event, the bucket name of an S3 event, or `payload.tenant` of a background\n * task). The transport-specific EXTRACT step sets this; the transport-agnostic LOAD step\n * (RequestTenantLoader) reads it, resolves the Tenant, and sets TenantContext.\n */\nexport interface IRawTenantId {\n    get(): string | null;\n    set(id: string | null): void;\n}\n\nexport const RawTenantId = createAbstraction<IRawTenantId>(\"RequestContext/RawTenantId\");\n\nexport namespace RawTenantId {\n    export type Interface = IRawTenantId;\n}\n\n/**\n * Per-request holder for the raw auth token EXTRACTED by the transport (e.g. the `Authorization`\n * bearer header or an auth cookie of an API Gateway event). Only token-based transports set this;\n * the transport-agnostic LOAD step (RequestIdentityLoader) reads it, authenticates it, and\n * sets IdentityContext. A null/absent value authenticates as anonymous.\n *\n * Note: non-token transports (S3, background tasks) never set this — S3 has no user identity, and\n * background-task identity is derived from `task.createdBy` after the task is fetched.\n */\nexport interface IRawAuthToken {\n    get(): string | null;\n    set(token: string | null): void;\n}\n\nexport const RawAuthToken = createAbstraction<IRawAuthToken>(\"RequestContext/RawAuthToken\");\n\nexport namespace RawAuthToken {\n    export type Interface = IRawAuthToken;\n}\n\n/**\n * LOAD step: authenticates the token held by RawAuthToken and sets IdentityContext. Fully\n * transport-agnostic — transports only EXTRACT the token into RawAuthToken.\n */\nexport interface IRequestIdentityLoader {\n    establish(): Promise<void>;\n}\n\nexport const RequestIdentityLoader = createAbstraction<IRequestIdentityLoader>(\n    \"RequestContext/RequestIdentityLoader\"\n);\n\nexport namespace RequestIdentityLoader {\n    export type Interface = IRequestIdentityLoader;\n}\n\n/**\n * LOAD step: resolves the Tenant for the id held by RawTenantId and sets TenantContext. Fully\n * transport-agnostic — transports only EXTRACT the id into RawTenantId.\n */\nexport interface IRequestTenantLoader {\n    establish(): Promise<void>;\n}\n\nexport const RequestTenantLoader = createAbstraction<IRequestTenantLoader>(\n    \"RequestContext/RequestTenantLoader\"\n);\n\nexport namespace RequestTenantLoader {\n    export type Interface = IRequestTenantLoader;\n}\n"],"names":["RawTenantId","createAbstraction","RawAuthToken","RequestIdentityLoader","RequestTenantLoader"],"mappings":";AAaO,MAAMA,cAAcC,kBAAgC;AAoBpD,MAAMC,eAAeD,kBAAiC;AActD,MAAME,wBAAwBF,kBACjC;AAeG,MAAMG,sBAAsBH,kBAC/B"}

package/features/requestContext/feature.d.ts

@@ -0,0 +1,11 @@
+import type { Container } from "@webiny/di";
+/**
+ * Registers the request-context pieces:
+ * - RawTenantId / RawAuthToken: per-request holders that the transport's EXTRACT step writes to.
+ * - RequestIdentityLoader / RequestTenantLoader: transport-agnostic LOAD steps that read
+ *   the holders and set IdentityContext / TenantContext.
+ */
+export declare const RequestContextFeature: {
+    name: string;
+    register(container: Container): void;
+};

package/features/requestContext/feature.js

@@ -0,0 +1,17 @@
+import { createFeature } from "@webiny/feature/api";
+import { RawTenantId } from "./RawTenantId.js";
+import { RawAuthToken } from "./RawAuthToken.js";
+import { RequestIdentityLoader } from "./RequestIdentityLoader.js";
+import { RequestTenantLoader } from "./RequestTenantLoader.js";
+const RequestContextFeature = createFeature({
+    name: "RequestContext",
+    register (container) {
+        container.register(RawTenantId).inSingletonScope();
+        container.register(RawAuthToken).inSingletonScope();
+        container.register(RequestIdentityLoader);
+        container.register(RequestTenantLoader);
+    }
+});
+export { RequestContextFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/requestContext/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/requestContext/feature.js","sources":["../../../src/features/requestContext/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport type { Container } from \"@webiny/di\";\nimport { RawTenantId } from \"./RawTenantId.js\";\nimport { RawAuthToken } from \"./RawAuthToken.js\";\nimport { RequestIdentityLoader } from \"./RequestIdentityLoader.js\";\nimport { RequestTenantLoader } from \"./RequestTenantLoader.js\";\n\n/**\n * Registers the request-context pieces:\n * - RawTenantId / RawAuthToken: per-request holders that the transport's EXTRACT step writes to.\n * - RequestIdentityLoader / RequestTenantLoader: transport-agnostic LOAD steps that read\n *   the holders and set IdentityContext / TenantContext.\n */\nexport const RequestContextFeature = createFeature({\n    name: \"RequestContext\",\n    register(container: Container) {\n        // Singleton so the value the transport's EXTRACT step sets is the same instance the LOAD\n        // establisher reads. Registered per request (RequestContextFeature runs per-request), so it's\n        // singleton *within the request container* — a fresh holder per request.\n        container.register(RawTenantId).inSingletonScope();\n        container.register(RawAuthToken).inSingletonScope();\n        container.register(RequestIdentityLoader);\n        container.register(RequestTenantLoader);\n    }\n});\n"],"names":["RequestContextFeature","createFeature","container","RawTenantId","RawAuthToken","RequestIdentityLoader","RequestTenantLoader"],"mappings":";;;;;AAaO,MAAMA,wBAAwBC,cAAc;IAC/C,MAAM;IACN,UAASC,SAAoB;QAIzBA,UAAU,QAAQ,CAACC,aAAa,gBAAgB;QAChDD,UAAU,QAAQ,CAACE,cAAc,gBAAgB;QACjDF,UAAU,QAAQ,CAACG;QACnBH,UAAU,QAAQ,CAACI;IACvB;AACJ"}

package/features/requestContext/index.d.ts

@@ -0,0 +1,2 @@
+export { RawTenantId, RawAuthToken, RequestIdentityLoader, RequestTenantLoader } from "./abstractions.js";
+export { RequestContextFeature } from "./feature.js";

package/features/requestContext/index.js

@@ -0,0 +1,2 @@
+export { RawAuthToken, RawTenantId, RequestIdentityLoader, RequestTenantLoader } from "./abstractions.js";
+export { RequestContextFeature } from "./feature.js";