@webiny/api-event-handler-aws 0.0.0-unstable.0156a4c312

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Webiny
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @webiny/api-event-handler-aws
+
+> [!NOTE]
+> This package is part of the [Webiny](https://www.webiny.com) monorepo.
+> It’s **included in every Webiny project by default** and is not meant to be used as a standalone package.
+
+📘 **Documentation:** [https://www.webiny.com/docs](https://www.webiny.com/docs)
+
+---
+
+_This README file is automatically generated during the publish process._

package/composition/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./registerInboundEventTypes.js";
+export * from "./registerWebinyApiRoot.js";
+export * from "./registerWebinyApiChild.js";

package/composition/index.js

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./registerInboundEventTypes.js";
+export * from "./registerWebinyApiRoot.js";
+export * from "./registerWebinyApiChild.js";

package/composition/registerInboundEventTypes.d.ts

@@ -0,0 +1,16 @@
+import type { Container } from "@webiny/di";
+/**
+ * Registers every NON-HTTP way this Lambda can be invoked: the event type that recognises the
+ * payload shape, plus the handler the dispatcher resolves once it matches. (The HTTP transport is
+ * registered by `ApiGatewayFeature`, which also brings the router.)
+ *
+ * Both halves are required. An event type with no handler resolves to an empty handler chain and
+ * the invocation silently does nothing; a handler with no event type fails the dispatch outright
+ * with "No event type matched the incoming event".
+ *
+ * This lives in one function so the set is testable, and so an inbound transport cannot be
+ * half-wired. Two bugs of exactly that shape have already shipped: WebSockets ($connect never
+ * dispatched, so server→client push was dead) and EventBridge Scheduler (schedules were created
+ * and fired, but the invocation was rejected, so scheduled publishing silently never happened).
+ */
+export declare function registerInboundEventTypes(container: Container): void;

package/composition/registerInboundEventTypes.js

@@ -0,0 +1,17 @@
+import { BackgroundTaskEventType, ScheduledActionEventType } from "@webiny/event-handler-core";
+import { EventBridgeEventType, WebSocketEventType } from "@webiny/event-handler-aws";
+import { BackgroundTasksAwsFeature } from "@webiny/background-tasks-aws";
+import { BulkActionsEventBridgeLambdaHandlerFeature } from "@webiny/api-headless-cms-bulk-actions-aws";
+import { ScheduledActionLambdaHandler } from "@webiny/api-scheduler";
+function registerInboundEventTypes(container) {
+    container.register(BackgroundTaskEventType);
+    BackgroundTasksAwsFeature.register(container);
+    container.register(EventBridgeEventType);
+    BulkActionsEventBridgeLambdaHandlerFeature.register(container);
+    container.register(ScheduledActionEventType);
+    container.register(ScheduledActionLambdaHandler);
+    container.register(WebSocketEventType);
+}
+export { registerInboundEventTypes };
+
+//# sourceMappingURL=registerInboundEventTypes.js.map

package/composition/registerInboundEventTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition/registerInboundEventTypes.js","sources":["../../src/composition/registerInboundEventTypes.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport { BackgroundTaskEventType } from \"@webiny/event-handler-core\";\nimport { ScheduledActionEventType } from \"@webiny/event-handler-core\";\nimport { EventBridgeEventType } from \"@webiny/event-handler-aws\";\nimport { WebSocketEventType } from \"@webiny/event-handler-aws\";\nimport { BackgroundTasksAwsFeature } from \"@webiny/background-tasks-aws\";\nimport { BulkActionsEventBridgeLambdaHandlerFeature } from \"@webiny/api-headless-cms-bulk-actions-aws\";\nimport { ScheduledActionLambdaHandler } from \"@webiny/api-scheduler\";\n\n/**\n * Registers every NON-HTTP way this Lambda can be invoked: the event type that recognises the\n * payload shape, plus the handler the dispatcher resolves once it matches. (The HTTP transport is\n * registered by `ApiGatewayFeature`, which also brings the router.)\n *\n * Both halves are required. An event type with no handler resolves to an empty handler chain and\n * the invocation silently does nothing; a handler with no event type fails the dispatch outright\n * with \"No event type matched the incoming event\".\n *\n * This lives in one function so the set is testable, and so an inbound transport cannot be\n * half-wired. Two bugs of exactly that shape have already shipped: WebSockets ($connect never\n * dispatched, so server→client push was dead) and EventBridge Scheduler (schedules were created\n * and fired, but the invocation was rejected, so scheduled publishing silently never happened).\n */\nexport function registerInboundEventTypes(container: Container): void {\n    // Background task invocations (Step Functions → Lambda directly). BackgroundTasksAwsFeature\n    // registers the Lambda handler + StepFunctionService (the AWS dispatch transport).\n    container.register(BackgroundTaskEventType);\n    BackgroundTasksAwsFeature.register(container);\n\n    // EventBridge invocations (e.g. scheduled empty-trash-bin).\n    container.register(EventBridgeEventType);\n    BulkActionsEventBridgeLambdaHandlerFeature.register(container);\n\n    // EventBridge Scheduler invocations (a scheduled publish/unpublish firing). SchedulerAwsFeature\n    // wires only the OUTBOUND side (creating the schedule), so the inbound half belongs here.\n    container.register(ScheduledActionEventType);\n    container.register(ScheduledActionLambdaHandler);\n\n    // API Gateway WebSocket invocations ($connect/$disconnect/$default). The connection handlers\n    // come from WebsocketsFeature in the per-request stack.\n    container.register(WebSocketEventType);\n}\n"],"names":["registerInboundEventTypes","container","BackgroundTaskEventType","BackgroundTasksAwsFeature","EventBridgeEventType","BulkActionsEventBridgeLambdaHandlerFeature","ScheduledActionEventType","ScheduledActionLambdaHandler","WebSocketEventType"],"mappings":";;;;;AAuBO,SAASA,0BAA0BC,SAAoB;IAG1DA,UAAU,QAAQ,CAACC;IACnBC,0BAA0B,QAAQ,CAACF;IAGnCA,UAAU,QAAQ,CAACG;IACnBC,2CAA2C,QAAQ,CAACJ;IAIpDA,UAAU,QAAQ,CAACK;IACnBL,UAAU,QAAQ,CAACM;IAInBN,UAAU,QAAQ,CAACO;AACvB"}

package/composition/registerWebinyApiChild.d.ts

@@ -0,0 +1,10 @@
+import type { Container } from "@webiny/di";
+import type { WebinyApiCompositionConfig } from "./types.js";
+/**
+ * Sets up the per-request CHILD container: the transport-agnostic feature stack (shared with the
+ * server transport), with the AWS-specific interleave points supplied as the `transports` adapters.
+ *
+ * Named for the `child` lifecycle step of `HandlerConfig`, not "request", so it matches the contract
+ * it implements.
+ */
+export declare function registerWebinyApiChild(container: Container, config: WebinyApiCompositionConfig): Promise<void>;

package/composition/registerWebinyApiChild.js

@@ -0,0 +1,27 @@
+import { registerApiRequestStack } from "@webiny/api-event-handler-core";
+import { WebsocketsAwsFeature } from "@webiny/api-websockets-aws";
+import { SchedulerAwsFeature } from "@webiny/api-scheduler-aws";
+import { FileManagerS3Feature } from "@webiny/api-file-manager-s3";
+import { ManifestPublicUrlsFeature } from "../publicUrls/feature.js";
+async function registerWebinyApiChild(container, config) {
+    await registerApiRequestStack(container, {
+        extensions: config.extensions,
+        transports: {
+            hostingConfig: (c)=>{
+                ManifestPublicUrlsFeature.register(c);
+            },
+            realtime: (c)=>{
+                WebsocketsAwsFeature.register(c);
+            },
+            scheduler: (c)=>{
+                SchedulerAwsFeature.register(c);
+            },
+            fileManager: (c)=>{
+                FileManagerS3Feature.register(c, {});
+            }
+        }
+    });
+}
+export { registerWebinyApiChild };
+
+//# sourceMappingURL=registerWebinyApiChild.js.map

package/composition/registerWebinyApiChild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition/registerWebinyApiChild.js","sources":["../../src/composition/registerWebinyApiChild.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport { registerApiRequestStack } from \"@webiny/api-event-handler-core\";\nimport { WebsocketsAwsFeature } from \"@webiny/api-websockets-aws\";\nimport { SchedulerAwsFeature } from \"@webiny/api-scheduler-aws\";\nimport { FileManagerS3Feature } from \"@webiny/api-file-manager-s3\";\nimport { ManifestPublicUrlsFeature } from \"~/publicUrls/feature.js\";\nimport type { WebinyApiCompositionConfig } from \"./types.js\";\n\n/**\n * Sets up the per-request CHILD container: the transport-agnostic feature stack (shared with the\n * server transport), with the AWS-specific interleave points supplied as the `transports` adapters.\n *\n * Named for the `child` lifecycle step of `HandlerConfig`, not \"request\", so it matches the contract\n * it implements.\n */\nexport async function registerWebinyApiChild(\n    container: Container,\n    config: WebinyApiCompositionConfig\n): Promise<void> {\n    await registerApiRequestStack(container, {\n        extensions: config.extensions,\n        transports: {\n            // Public URLs: written to the service manifest by the `api` and `admin` Pulumi apps.\n            // Encryption and hashing keep api-core's build-param defaults.\n            hostingConfig: c => {\n                ManifestPublicUrlsFeature.register(c);\n            },\n            // Real AWS WebSocket transport (API Gateway Management API), registered right after\n            // WebsocketsFeature so it overrides the NullWebsocketsTransport.\n            realtime: c => {\n                WebsocketsAwsFeature.register(c);\n            },\n            // Scheduler transport: the scheduler-aws extension (EventBridge Scheduler).\n            scheduler: c => {\n                SchedulerAwsFeature.register(c);\n            },\n            // File-manager storage transport: S3 (asset delivery + S3 file operations + schema).\n            fileManager: c => {\n                FileManagerS3Feature.register(c, {});\n            }\n        }\n    });\n}\n"],"names":["registerWebinyApiChild","container","config","registerApiRequestStack","c","ManifestPublicUrlsFeature","WebsocketsAwsFeature","SchedulerAwsFeature","FileManagerS3Feature"],"mappings":";;;;;AAeO,eAAeA,uBAClBC,SAAoB,EACpBC,MAAkC;IAElC,MAAMC,wBAAwBF,WAAW;QACrC,YAAYC,OAAO,UAAU;QAC7B,YAAY;YAGR,eAAeE,CAAAA;gBACXC,0BAA0B,QAAQ,CAACD;YACvC;YAGA,UAAUA,CAAAA;gBACNE,qBAAqB,QAAQ,CAACF;YAClC;YAEA,WAAWA,CAAAA;gBACPG,oBAAoB,QAAQ,CAACH;YACjC;YAEA,aAAaA,CAAAA;gBACTI,qBAAqB,QAAQ,CAACJ,GAAG,CAAC;YACtC;QACJ;IACJ;AACJ"}

package/composition/registerWebinyApiRoot.d.ts

@@ -0,0 +1,8 @@
+import type { Container } from "@webiny/di";
+import type { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import type { WebinyApiCompositionConfig } from "./types.js";
+/**
+ * ROOT container registration that is not transport-specific: database, caches, and the storage
+ * variant. Shared by both AWS Lambda composition roots.
+ */
+export declare function registerWebinyApiRoot(container: Container, config: WebinyApiCompositionConfig, documentClient: ReturnType<typeof getDocumentClient>): Promise<void>;

package/composition/registerWebinyApiRoot.js

@@ -0,0 +1,27 @@
+import { DynamoDBCoreFeature } from "@webiny/db-dynamodb";
+import { GraphQLSchemaCacheFeature } from "@webiny/api-graphql";
+import { EncryptionKeyCacheFeature } from "@webiny/api-core/features/encryption/index.js";
+import { JwksStoreFeature } from "@webiny/api-core/idp/index.js";
+import { createLogger } from "@webiny/logger";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { StructuredLogFormatter, pinoLambdaDestination } from "pino-lambda";
+async function registerWebinyApiRoot(container, config, documentClient) {
+    const formatter = new StructuredLogFormatter();
+    const destination = pinoLambdaDestination({
+        formatter
+    });
+    const logger = createLogger(destination);
+    container.registerInstance(Logger, logger);
+    DynamoDBCoreFeature.register(container, {
+        documentClient
+    });
+    GraphQLSchemaCacheFeature.register(container);
+    EncryptionKeyCacheFeature.register(container);
+    JwksStoreFeature.register(container);
+    await config.registerRootStorage(container, {
+        documentClient
+    });
+}
+export { registerWebinyApiRoot };
+
+//# sourceMappingURL=registerWebinyApiRoot.js.map

package/composition/registerWebinyApiRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition/registerWebinyApiRoot.js","sources":["../../src/composition/registerWebinyApiRoot.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport type { getDocumentClient } from \"@webiny/aws-sdk/client-dynamodb/index.js\";\nimport { DynamoDBCoreFeature } from \"@webiny/db-dynamodb\";\nimport { GraphQLSchemaCacheFeature } from \"@webiny/api-graphql\";\nimport { EncryptionKeyCacheFeature } from \"@webiny/api-core/features/encryption/index.js\";\nimport { JwksStoreFeature } from \"@webiny/api-core/idp/index.js\";\nimport { createLogger } from \"@webiny/logger\";\nimport { Logger } from \"@webiny/api-core/features/logger/index.js\";\nimport { pinoLambdaDestination } from \"pino-lambda\";\nimport { StructuredLogFormatter } from \"pino-lambda\";\nimport type { WebinyApiCompositionConfig } from \"./types.js\";\n\n/**\n * ROOT container registration that is not transport-specific: database, caches, and the storage\n * variant. Shared by both AWS Lambda composition roots.\n */\nexport async function registerWebinyApiRoot(\n    container: Container,\n    config: WebinyApiCompositionConfig,\n    documentClient: ReturnType<typeof getDocumentClient>\n): Promise<void> {\n    // ── Logger ─────────────────────────────────────────────────\n    // One per Lambda instance, in CloudWatch's structured format. Every request container inherits it.\n    const formatter = new StructuredLogFormatter();\n    const destination = pinoLambdaDestination({ formatter });\n    const logger = createLogger(destination);\n    container.registerInstance(Logger, logger);\n\n    // ── Database ───────────────────────────────────────────────\n    DynamoDBCoreFeature.register(container, { documentClient });\n\n    // Identity providers are not registered here. Each one comes from its project extension (e.g.\n    // `<Cognito/>` registers CognitoIdpFeature), which registers in the request container. The\n    // request auth step resolves from that container after extensions have registered, so it sees\n    // them.\n\n    // ── GraphQL schema cache ───────────────────────────────────\n    // Root, so a built schema outlives the request that built it: one build per Lambda instance\n    // instead of one per request.\n    GraphQLSchemaCacheFeature.register(container);\n\n    // ── Encryption key cache ───────────────────────────────────\n    // Root, so the scrypt-derived key is computed once per Lambda instance instead of per request.\n    EncryptionKeyCacheFeature.register(container);\n    // Root, so identity providers' signing keys are fetched once per process, not per request.\n    JwksStoreFeature.register(container);\n\n    // ── Storage (variant-specific: CMS storage ops, DDB registries, OpenSearch core) ──\n    await config.registerRootStorage(container, { documentClient });\n}\n"],"names":["registerWebinyApiRoot","container","config","documentClient","formatter","StructuredLogFormatter","destination","pinoLambdaDestination","logger","createLogger","Logger","DynamoDBCoreFeature","GraphQLSchemaCacheFeature","EncryptionKeyCacheFeature","JwksStoreFeature"],"mappings":";;;;;;;AAgBO,eAAeA,sBAClBC,SAAoB,EACpBC,MAAkC,EAClCC,cAAoD;IAIpD,MAAMC,YAAY,IAAIC;IACtB,MAAMC,cAAcC,sBAAsB;QAAEH;IAAU;IACtD,MAAMI,SAASC,aAAaH;IAC5BL,UAAU,gBAAgB,CAACS,QAAQF;IAGnCG,oBAAoB,QAAQ,CAACV,WAAW;QAAEE;IAAe;IAUzDS,0BAA0B,QAAQ,CAACX;IAInCY,0BAA0B,QAAQ,CAACZ;IAEnCa,iBAAiB,QAAQ,CAACb;IAG1B,MAAMC,OAAO,mBAAmB,CAACD,WAAW;QAAEE;IAAe;AACjE"}

package/composition/types.d.ts

@@ -0,0 +1,30 @@
+import type { Container } from "@webiny/di";
+import type { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import type { registerExtensions } from "@webiny/handler";
+export interface RegisterRootStorageContext {
+    documentClient: ReturnType<typeof getDocumentClient>;
+}
+/**
+ * The transport-agnostic half of a Webiny AWS Lambda composition root, shared by the buffered API
+ * Gateway handler (`createWebinyApiHandler`) and the response-streaming Function URL handler
+ * (`createWebinyStreamApiHandler`) so the two cannot drift on storage, identity providers, or the
+ * per-request feature stack.
+ */
+export interface WebinyApiCompositionConfig {
+    /**
+     * Project-defined extensions, applied at register() time. This is the one project-specific
+     * input; everything else is standard AWS/env wiring owned by this package.
+     */
+    extensions: () => Parameters<typeof registerExtensions>[1];
+    /**
+     * DynamoDB document client. Defaults to the standard AWS client (`getDocumentClient()`).
+     * Injectable so integration tests can point the handler at a local (dynalite) DynamoDB.
+     */
+    documentClient?: ReturnType<typeof getDocumentClient>;
+    /**
+     * Register the storage-variant features in the ROOT container: the CMS storage operations, the
+     * DDB storage registries, and (for the OpenSearch variant) the OpenSearch core. Supplied by the
+     * variant package.
+     */
+    registerRootStorage: (container: Container, ctx: RegisterRootStorageContext) => void | Promise<void>;
+}

package/createWebinyApiHandler.d.ts

@@ -0,0 +1,4 @@
+import type { WebinyApiCompositionConfig } from "./composition/index.js";
+export type { RegisterRootStorageContext } from "./composition/index.js";
+export type CreateWebinyApiHandlerConfig = WebinyApiCompositionConfig;
+export declare function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig): (event: any, context?: import("aws-lambda").Context) => Promise<any>;

package/createWebinyApiHandler.js

@@ -0,0 +1,24 @@
+import { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import { ApiGatewayFeature, createLambdaHandler } from "@webiny/event-handler-aws";
+import { ApiGatewayIdentityLoaderDecorator } from "./handlers/ApiGatewayIdentityLoaderDecorator.js";
+import { ApiGatewayTenantLoaderDecorator } from "./handlers/ApiGatewayTenantLoaderDecorator.js";
+import { ApiGatewayAssumePermissionsDecorator } from "./handlers/ApiGatewayAssumePermissionsDecorator.js";
+import { registerInboundEventTypes, registerWebinyApiChild, registerWebinyApiRoot } from "./composition/index.js";
+function createWebinyApiHandler(config) {
+    return createLambdaHandler({
+        root: async (container)=>{
+            ApiGatewayFeature.register(container);
+            container.registerDecorator(ApiGatewayIdentityLoaderDecorator);
+            container.registerDecorator(ApiGatewayTenantLoaderDecorator);
+            container.registerDecorator(ApiGatewayAssumePermissionsDecorator);
+            registerInboundEventTypes(container);
+            await registerWebinyApiRoot(container, config, config.documentClient ?? getDocumentClient());
+        },
+        child: async (container)=>{
+            await registerWebinyApiChild(container, config);
+        }
+    });
+}
+export { createWebinyApiHandler };
+
+//# sourceMappingURL=createWebinyApiHandler.js.map

package/createWebinyApiHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWebinyApiHandler.js","sources":["../src/createWebinyApiHandler.ts"],"sourcesContent":["/**\n * DI-native Webiny API handler for the AWS Lambda transport — storage-agnostic BASE.\n *\n * The ROOT container wires the AWS transport (API Gateway HTTP + auth/tenant loaders, background-task\n * and WebSocket Lambda invocations, DynamoDB, Cognito, storage). Everything that is not\n * transport-specific — database, identity providers, storage, and the transport-AGNOSTIC per-request\n * feature stack — lives in `composition/`, shared with the response-streaming handler\n * (`createWebinyStreamApiHandler`) so the two roots cannot drift. The storage variant is injected via\n * `registerRootStorage` by a thin variant package\n * (`@webiny/api-event-handler-aws-ddb`, `-aws-ddb-os`). Keeping the wiring in real packages (not an app\n * template) is what makes it unit/integration testable.\n */\nimport { getDocumentClient } from \"@webiny/aws-sdk/client-dynamodb/index.js\";\nimport { createLambdaHandler, ApiGatewayFeature } from \"@webiny/event-handler-aws\";\nimport { ApiGatewayIdentityLoaderDecorator } from \"~/handlers/ApiGatewayIdentityLoaderDecorator.js\";\nimport { ApiGatewayTenantLoaderDecorator } from \"~/handlers/ApiGatewayTenantLoaderDecorator.js\";\nimport { ApiGatewayAssumePermissionsDecorator } from \"~/handlers/ApiGatewayAssumePermissionsDecorator.js\";\nimport {\n    registerInboundEventTypes,\n    registerWebinyApiChild,\n    registerWebinyApiRoot\n} from \"~/composition/index.js\";\nimport type { WebinyApiCompositionConfig } from \"~/composition/index.js\";\n\nexport type { RegisterRootStorageContext } from \"~/composition/index.js\";\n\nexport type CreateWebinyApiHandlerConfig = WebinyApiCompositionConfig;\n\nexport function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig) {\n    return createLambdaHandler({\n        root: async container => {\n            // ── Transport ──────────────────────────────────────────────\n            // ApiGatewayFeature registers the HTTP transport (event type + router + HttpFeature).\n            ApiGatewayFeature.register(container);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // These decorators depend on api-core (RequestTenantLoader/RequestIdentityLoader), so\n            // they live in this composition layer, not event-handler-aws. registerDecorator applies\n            // LATER registrations as the OUTER wrapper (whose execute() runs first). TENANT must be\n            // established before IDENTITY: API-key authentication resolves the key by tenant partition\n            // (ApiKeysRepository reads TenantContext.getTenant()), so identity establishment depends on\n            // the tenant. The reverse is not true — RequestTenantLoader has no identity dependency. So\n            // register identity first (inner) and tenant last (outer) → tenant runs, then identity,\n            // then the router.\n            container.registerDecorator(ApiGatewayIdentityLoaderDecorator);\n            container.registerDecorator(ApiGatewayTenantLoaderDecorator);\n\n            /*\n             * Preview-as. Outermost, so the header lands in RawAssumePermissions before anything\n             * can ask for permissions. Order is not load-bearing beyond that: the holder is read\n             * lazily, and AssumedPermissions checks the caller's real permissions before it\n             * honours the header.\n             */\n            container.registerDecorator(ApiGatewayAssumePermissionsDecorator);\n\n            // Every non-HTTP invocation shape (background tasks, EventBridge, scheduled actions,\n            // WebSockets) with its handler. Kept in one function so the set is testable and an\n            // inbound transport can't be half-wired.\n            registerInboundEventTypes(container);\n\n            // Resolved here rather than at factory time: one bundle exports BOTH this handler and the\n            // streaming one, so building the client eagerly would open a second DynamoDB client on\n            // every cold start. `root` runs once, lazily.\n            await registerWebinyApiRoot(\n                container,\n                config,\n                config.documentClient ?? getDocumentClient()\n            );\n        },\n\n        child: async container => {\n            await registerWebinyApiChild(container, config);\n        }\n    });\n}\n"],"names":["createWebinyApiHandler","config","createLambdaHandler","container","ApiGatewayFeature","ApiGatewayIdentityLoaderDecorator","ApiGatewayTenantLoaderDecorator","ApiGatewayAssumePermissionsDecorator","registerInboundEventTypes","registerWebinyApiRoot","getDocumentClient","registerWebinyApiChild"],"mappings":";;;;;;AA4BO,SAASA,uBAAuBC,MAAoC;IACvE,OAAOC,oBAAoB;QACvB,MAAM,OAAMC;YAGRC,kBAAkB,QAAQ,CAACD;YAW3BA,UAAU,iBAAiB,CAACE;YAC5BF,UAAU,iBAAiB,CAACG;YAQ5BH,UAAU,iBAAiB,CAACI;YAK5BC,0BAA0BL;YAK1B,MAAMM,sBACFN,WACAF,QACAA,OAAO,cAAc,IAAIS;QAEjC;QAEA,OAAO,OAAMP;YACT,MAAMQ,uBAAuBR,WAAWF;QAC5C;IACJ;AACJ"}

package/createWebinyStreamApiHandler.d.ts

@@ -0,0 +1,3 @@
+import type { WebinyApiCompositionConfig } from "./composition/index.js";
+export type CreateWebinyStreamApiHandlerConfig = WebinyApiCompositionConfig;
+export declare function createWebinyStreamApiHandler(config: CreateWebinyStreamApiHandlerConfig): import("@webiny/event-handler-aws").StreamLambdaHandler;

package/createWebinyStreamApiHandler.js

@@ -0,0 +1,25 @@
+import { getDocumentClient } from "@webiny/aws-sdk/client-dynamodb/index.js";
+import { FunctionUrlStreamFeature, createStreamLambdaHandler } from "@webiny/event-handler-aws";
+import { BackgroundTasksAwsFeature } from "@webiny/background-tasks-aws";
+import { FunctionUrlStreamIdentityLoaderDecorator } from "./handlers/FunctionUrlStreamIdentityLoaderDecorator.js";
+import { FunctionUrlStreamTenantLoaderDecorator } from "./handlers/FunctionUrlStreamTenantLoaderDecorator.js";
+import { FunctionUrlStreamAssumePermissionsDecorator } from "./handlers/FunctionUrlStreamAssumePermissionsDecorator.js";
+import { registerWebinyApiChild, registerWebinyApiRoot } from "./composition/index.js";
+function createWebinyStreamApiHandler(config) {
+    return createStreamLambdaHandler({
+        root: async (container)=>{
+            FunctionUrlStreamFeature.register(container);
+            container.registerDecorator(FunctionUrlStreamIdentityLoaderDecorator);
+            container.registerDecorator(FunctionUrlStreamTenantLoaderDecorator);
+            container.registerDecorator(FunctionUrlStreamAssumePermissionsDecorator);
+            BackgroundTasksAwsFeature.register(container);
+            await registerWebinyApiRoot(container, config, config.documentClient ?? getDocumentClient());
+        },
+        child: async (container)=>{
+            await registerWebinyApiChild(container, config);
+        }
+    });
+}
+export { createWebinyStreamApiHandler };
+
+//# sourceMappingURL=createWebinyStreamApiHandler.js.map

package/createWebinyStreamApiHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWebinyStreamApiHandler.js","sources":["../src/createWebinyStreamApiHandler.ts"],"sourcesContent":["/**\n * DI-native Webiny API handler for AWS Lambda **response streaming** — storage-agnostic BASE.\n *\n * This is a SECOND Lambda function sharing the buffered function's code bundle, not a second entry on\n * the same function: a Lambda's handler entry is fixed per function, and a `streamifyResponse` handler\n * is only meaningful under `InvokeMode: RESPONSE_STREAM`. It is reached through a Lambda Function URL\n * (fronted by CloudFront), because API Gateway buffers the entire Lambda response and therefore cannot\n * stream at all.\n *\n * Root/request registration is shared with `createWebinyApiHandler` via `composition/`; only\n * the transport differs. Notably NOT registered here: the background-task and WebSocket **event\n * types**. Those match inbound invocations that only ever target the buffered function, so\n * registering them would add cold-start cost for events this function never receives.\n *\n * Outbound transports are a different matter, and both ARE present: websockets push completion\n * messages from the shared per-request stack, and `BackgroundTasksAwsFeature` supplies the Step\n * Functions dispatcher that `TaskService.trigger()` needs. Omitting the latter does not disable\n * task triggering — it breaks it silently, because the shared root registers `TaskService` either\n * way and its callers treat a failed trigger as a no-op (ACO's FLP handlers, for one, swallow it),\n * so writes land while their projections never update.\n */\nimport { getDocumentClient } from \"@webiny/aws-sdk/client-dynamodb/index.js\";\nimport { createStreamLambdaHandler, FunctionUrlStreamFeature } from \"@webiny/event-handler-aws\";\nimport { BackgroundTasksAwsFeature } from \"@webiny/background-tasks-aws\";\nimport { FunctionUrlStreamIdentityLoaderDecorator } from \"~/handlers/FunctionUrlStreamIdentityLoaderDecorator.js\";\nimport { FunctionUrlStreamTenantLoaderDecorator } from \"~/handlers/FunctionUrlStreamTenantLoaderDecorator.js\";\nimport { FunctionUrlStreamAssumePermissionsDecorator } from \"~/handlers/FunctionUrlStreamAssumePermissionsDecorator.js\";\nimport { registerWebinyApiChild, registerWebinyApiRoot } from \"~/composition/index.js\";\nimport type { WebinyApiCompositionConfig } from \"~/composition/index.js\";\n\nexport type CreateWebinyStreamApiHandlerConfig = WebinyApiCompositionConfig;\n\nexport function createWebinyStreamApiHandler(config: CreateWebinyStreamApiHandlerConfig) {\n    return createStreamLambdaHandler({\n        root: async container => {\n            // ── Transport ──────────────────────────────────────────────\n            // Registers the Function URL event type + router + the streaming terminal handler.\n            // Deliberately NOT alongside ApiGatewayFeature: both event types match the same payload\n            // shape, so they must never share a container.\n            FunctionUrlStreamFeature.register(container);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // registerDecorator applies LATER registrations as the OUTER wrapper (whose execute() runs\n            // first). TENANT must be established before IDENTITY: API-key authentication resolves the\n            // key by tenant partition (ApiKeysRepository reads TenantContext.getTenant()), so identity\n            // establishment depends on the tenant. The reverse is not true. So register identity first\n            // (inner) and tenant last (outer) → tenant runs, then identity, then the router. Mirrors\n            // the buffered handler.\n            container.registerDecorator(FunctionUrlStreamIdentityLoaderDecorator);\n            container.registerDecorator(FunctionUrlStreamTenantLoaderDecorator);\n\n            // Preview-as. Mirrors the buffered handler.\n            container.registerDecorator(FunctionUrlStreamAssumePermissionsDecorator);\n\n            // ── Background tasks: outbound dispatch only ───────────────\n            // Registers StepFunctionService, which is what a `TaskService.trigger()` resolves to\n            // actually start an execution. Without it the trigger throws deep inside the container\n            // and every caller that ignores the failure just carries on. `BackgroundTaskEventType`\n            // is deliberately left out, so the handler this also registers stays unreachable here:\n            // Step Functions invokes the buffered function, never this one.\n            BackgroundTasksAwsFeature.register(container);\n\n            // Resolved here rather than at factory time: one bundle exports BOTH this handler and the\n            // buffered one, so building the client eagerly would open a second DynamoDB client on every\n            // cold start of whichever function isn't streaming. `root` runs once, lazily.\n            await registerWebinyApiRoot(\n                container,\n                config,\n                config.documentClient ?? getDocumentClient()\n            );\n        },\n\n        child: async container => {\n            await registerWebinyApiChild(container, config);\n        }\n    });\n}\n"],"names":["createWebinyStreamApiHandler","config","createStreamLambdaHandler","container","FunctionUrlStreamFeature","FunctionUrlStreamIdentityLoaderDecorator","FunctionUrlStreamTenantLoaderDecorator","FunctionUrlStreamAssumePermissionsDecorator","BackgroundTasksAwsFeature","registerWebinyApiRoot","getDocumentClient","registerWebinyApiChild"],"mappings":";;;;;;;AAgCO,SAASA,6BAA6BC,MAA0C;IACnF,OAAOC,0BAA0B;QAC7B,MAAM,OAAMC;YAKRC,yBAAyB,QAAQ,CAACD;YASlCA,UAAU,iBAAiB,CAACE;YAC5BF,UAAU,iBAAiB,CAACG;YAG5BH,UAAU,iBAAiB,CAACI;YAQ5BC,0BAA0B,QAAQ,CAACL;YAKnC,MAAMM,sBACFN,WACAF,QACAA,OAAO,cAAc,IAAIS;QAEjC;QAEA,OAAO,OAAMP;YACT,MAAMQ,uBAAuBR,WAAWF;QAC5C;IACJ;AACJ"}

package/handlers/ApiGatewayAssumePermissionsDecorator.d.ts

@@ -0,0 +1,23 @@
+import type { APIGatewayProxyEvent } from "@webiny/aws-sdk/types/index.js";
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAssumePermissions } from "@webiny/api-core/features/requestContext/index.js";
+import type { EventContext } from "@webiny/event-handler-core";
+import type { NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the `x-webiny-assume-permissions` header of an API Gateway
+ * event into RawAssumePermissions, so AssumedPermissions can evaluate the request against that
+ * role instead of the caller's own. There is no LOAD step: the holder is read lazily, the first
+ * time something asks for permissions.
+ *
+ * A missing header leaves RawAssumePermissions null, which is the normal case.
+ */
+declare class ApiGatewayAssumePermissionsDecoratorImpl implements ApiGatewayEventHandler.Interface {
+    private rawAssumePermissions;
+    private decoratee;
+    constructor(rawAssumePermissions: RawAssumePermissions.Interface, decoratee: ApiGatewayEventHandler.Interface);
+    execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any>;
+}
+export declare const ApiGatewayAssumePermissionsDecorator: typeof ApiGatewayAssumePermissionsDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IApiGatewayEventHandler>;
+};
+export {};

package/handlers/ApiGatewayAssumePermissionsDecorator.js

@@ -0,0 +1,23 @@
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAssumePermissions, extractAssumePermissions } from "@webiny/api-core/features/requestContext/index.js";
+class ApiGatewayAssumePermissionsDecoratorImpl {
+    constructor(rawAssumePermissions, decoratee){
+        this.rawAssumePermissions = rawAssumePermissions;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = ctx.event?.headers;
+        const requested = extractAssumePermissions(headers);
+        this.rawAssumePermissions.set(requested);
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const ApiGatewayAssumePermissionsDecorator = ApiGatewayEventHandler.createDecorator({
+    decorator: ApiGatewayAssumePermissionsDecoratorImpl,
+    dependencies: [
+        RawAssumePermissions
+    ]
+});
+export { ApiGatewayAssumePermissionsDecorator };
+
+//# sourceMappingURL=ApiGatewayAssumePermissionsDecorator.js.map

package/handlers/ApiGatewayAssumePermissionsDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/ApiGatewayAssumePermissionsDecorator.js","sources":["../../src/handlers/ApiGatewayAssumePermissionsDecorator.ts"],"sourcesContent":["import type { APIGatewayProxyEvent } from \"@webiny/aws-sdk/types/index.js\";\nimport { ApiGatewayEventHandler } from \"@webiny/event-handler-aws\";\nimport { RawAssumePermissions } from \"@webiny/api-core/features/requestContext/index.js\";\nimport { extractAssumePermissions } from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { EventContext } from \"@webiny/event-handler-core\";\nimport type { NextFunction } from \"@webiny/event-handler-core\";\n\n/**\n * EXTRACT (transport-specific): reads the `x-webiny-assume-permissions` header of an API Gateway\n * event into RawAssumePermissions, so AssumedPermissions can evaluate the request against that\n * role instead of the caller's own. There is no LOAD step: the holder is read lazily, the first\n * time something asks for permissions.\n *\n * A missing header leaves RawAssumePermissions null, which is the normal case.\n */\nclass ApiGatewayAssumePermissionsDecoratorImpl implements ApiGatewayEventHandler.Interface {\n    constructor(\n        private rawAssumePermissions: RawAssumePermissions.Interface,\n        private decoratee: ApiGatewayEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any> {\n        const headers = ctx.event?.headers;\n        const requested = extractAssumePermissions(headers);\n\n        this.rawAssumePermissions.set(requested);\n\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const ApiGatewayAssumePermissionsDecorator = ApiGatewayEventHandler.createDecorator({\n    decorator: ApiGatewayAssumePermissionsDecoratorImpl,\n    dependencies: [RawAssumePermissions]\n});\n"],"names":["ApiGatewayAssumePermissionsDecoratorImpl","rawAssumePermissions","decoratee","ctx","next","headers","requested","extractAssumePermissions","ApiGatewayAssumePermissionsDecorator","ApiGatewayEventHandler","RawAssumePermissions"],"mappings":";;AAeA,MAAMA;IACF,YACYC,oBAAoD,EACpDC,SAA2C,CACrD;aAFUD,oBAAoB,GAApBA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAuC,EAAEC,IAAkB,EAAgB;QACrF,MAAMC,UAAUF,IAAI,KAAK,EAAE;QAC3B,MAAMG,YAAYC,yBAAyBF;QAE3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAACC;QAE9B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACH,KAAKC;IACvC;AACJ;AAEO,MAAMI,uCAAuCC,uBAAuB,eAAe,CAAC;IACvF,WAAWT;IACX,cAAc;QAACU;KAAqB;AACxC"}

package/handlers/ApiGatewayIdentityLoaderDecorator.d.ts

@@ -0,0 +1,25 @@
+import type { APIGatewayProxyEvent } from "@webiny/aws-sdk/types/index.js";
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestIdentityLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the auth token from an API Gateway event — see
+ * {@link extractAuthToken} for the header precedence — into RawAuthToken, then invokes the shared LOAD
+ * step (RequestIdentityLoader) which authenticates it and sets IdentityContext.
+ *
+ * A missing token leaves RawAuthToken null → the loader authenticates as anonymous.
+ * Registered BEFORE ApiGatewayTenantLoaderDecorator so identity is established before tenant
+ * (see ApiGatewayFeature).
+ */
+declare class ApiGatewayIdentityLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {
+    private rawAuthToken;
+    private identityLoader;
+    private decoratee;
+    constructor(rawAuthToken: RawAuthToken.Interface, identityLoader: IRequestIdentityLoader, decoratee: ApiGatewayEventHandler.Interface);
+    execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any>;
+}
+export declare const ApiGatewayIdentityLoaderDecorator: typeof ApiGatewayIdentityLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IApiGatewayEventHandler>;
+};
+export {};

package/handlers/ApiGatewayIdentityLoaderDecorator.js

@@ -0,0 +1,27 @@
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken, RequestIdentityLoader } from "@webiny/api-core/features/requestContext/index.js";
+import { extractAuthToken } from "./extractRequestAuth.js";
+class ApiGatewayIdentityLoaderDecoratorImpl {
+    constructor(rawAuthToken, identityLoader, decoratee){
+        this.rawAuthToken = rawAuthToken;
+        this.identityLoader = identityLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = ctx.event?.headers;
+        const authToken = extractAuthToken(headers);
+        this.rawAuthToken.set(authToken);
+        await this.identityLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const ApiGatewayIdentityLoaderDecorator = ApiGatewayEventHandler.createDecorator({
+    decorator: ApiGatewayIdentityLoaderDecoratorImpl,
+    dependencies: [
+        RawAuthToken,
+        RequestIdentityLoader
+    ]
+});
+export { ApiGatewayIdentityLoaderDecorator };
+
+//# sourceMappingURL=ApiGatewayIdentityLoaderDecorator.js.map

package/handlers/ApiGatewayIdentityLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/ApiGatewayIdentityLoaderDecorator.js","sources":["../../src/handlers/ApiGatewayIdentityLoaderDecorator.ts"],"sourcesContent":["import type { APIGatewayProxyEvent } from \"@webiny/aws-sdk/types/index.js\";\nimport { ApiGatewayEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawAuthToken,\n    RequestIdentityLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestIdentityLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\nimport { extractAuthToken } from \"./extractRequestAuth.js\";\n\n/**\n * EXTRACT (transport-specific): reads the auth token from an API Gateway event — see\n * {@link extractAuthToken} for the header precedence — into RawAuthToken, then invokes the shared LOAD\n * step (RequestIdentityLoader) which authenticates it and sets IdentityContext.\n *\n * A missing token leaves RawAuthToken null → the loader authenticates as anonymous.\n * Registered BEFORE ApiGatewayTenantLoaderDecorator so identity is established before tenant\n * (see ApiGatewayFeature).\n */\nclass ApiGatewayIdentityLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {\n    constructor(\n        private rawAuthToken: RawAuthToken.Interface,\n        private identityLoader: IRequestIdentityLoader,\n        private decoratee: ApiGatewayEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any> {\n        const headers = ctx.event?.headers as Record<string, string>;\n        const authToken = extractAuthToken(headers);\n\n        this.rawAuthToken.set(authToken);\n\n        await this.identityLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const ApiGatewayIdentityLoaderDecorator = ApiGatewayEventHandler.createDecorator({\n    decorator: ApiGatewayIdentityLoaderDecoratorImpl,\n    dependencies: [RawAuthToken, RequestIdentityLoader]\n});\n"],"names":["ApiGatewayIdentityLoaderDecoratorImpl","rawAuthToken","identityLoader","decoratee","ctx","next","headers","authToken","extractAuthToken","ApiGatewayIdentityLoaderDecorator","ApiGatewayEventHandler","RawAuthToken","RequestIdentityLoader"],"mappings":";;;AAmBA,MAAMA;IACF,YACYC,YAAoC,EACpCC,cAAsC,EACtCC,SAA2C,CACrD;aAHUF,YAAY,GAAZA;aACAC,cAAc,GAAdA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAuC,EAAEC,IAAkB,EAAgB;QACrF,MAAMC,UAAUF,IAAI,KAAK,EAAE;QAC3B,MAAMG,YAAYC,iBAAiBF;QAEnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAACC;QAEtB,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACH,KAAKC;IACvC;AACJ;AAEO,MAAMI,oCAAoCC,uBAAuB,eAAe,CAAC;IACpF,WAAWV;IACX,cAAc;QAACW;QAAcC;KAAsB;AACvD"}

package/handlers/ApiGatewayTenantLoaderDecorator.d.ts

@@ -0,0 +1,24 @@
+import type { APIGatewayProxyEvent } from "@webiny/aws-sdk/types/index.js";
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of an API Gateway
+ * event into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which
+ * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the
+ * loader defaults to the "root" tenant.
+ *
+ * Registered AFTER ApiGatewayIdentityLoaderDecorator (see ApiGatewayFeature).
+ */
+declare class ApiGatewayTenantLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: ApiGatewayEventHandler.Interface);
+    execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any>;
+}
+export declare const ApiGatewayTenantLoaderDecorator: typeof ApiGatewayTenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IApiGatewayEventHandler>;
+};
+export {};

package/handlers/ApiGatewayTenantLoaderDecorator.js

@@ -0,0 +1,25 @@
+import { ApiGatewayEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+class ApiGatewayTenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = ctx.event?.headers;
+        this.rawTenantId.set(headers ? headers["x-tenant"] ?? headers["X-Tenant"] ?? null : null);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const ApiGatewayTenantLoaderDecorator = ApiGatewayEventHandler.createDecorator({
+    decorator: ApiGatewayTenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { ApiGatewayTenantLoaderDecorator };
+
+//# sourceMappingURL=ApiGatewayTenantLoaderDecorator.js.map

package/handlers/ApiGatewayTenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/ApiGatewayTenantLoaderDecorator.js","sources":["../../src/handlers/ApiGatewayTenantLoaderDecorator.ts"],"sourcesContent":["import type { APIGatewayProxyEvent } from \"@webiny/aws-sdk/types/index.js\";\nimport { ApiGatewayEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of an API Gateway\n * event into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which\n * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the\n * loader defaults to the \"root\" tenant.\n *\n * Registered AFTER ApiGatewayIdentityLoaderDecorator (see ApiGatewayFeature).\n */\nclass ApiGatewayTenantLoaderDecoratorImpl implements ApiGatewayEventHandler.Interface {\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: ApiGatewayEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<APIGatewayProxyEvent>, next: NextFunction): Promise<any> {\n        const headers = ctx.event?.headers;\n        this.rawTenantId.set(headers ? (headers[\"x-tenant\"] ?? headers[\"X-Tenant\"] ?? null) : null);\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const ApiGatewayTenantLoaderDecorator = ApiGatewayEventHandler.createDecorator({\n    decorator: ApiGatewayTenantLoaderDecoratorImpl,\n    dependencies: [RawTenantId, RequestTenantLoader]\n});\n"],"names":["ApiGatewayTenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","headers","ApiGatewayTenantLoaderDecorator","ApiGatewayEventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;AAiBA,MAAMA;IACF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAA2C,CACrD;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAuC,EAAEC,IAAkB,EAAgB;QACrF,MAAMC,UAAUF,IAAI,KAAK,EAAE;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAACE,UAAWA,OAAO,CAAC,WAAW,IAAIA,OAAO,CAAC,WAAW,IAAI,OAAQ;QACtF,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,KAAKC;IACvC;AACJ;AAEO,MAAME,kCAAkCC,uBAAuB,eAAe,CAAC;IAClF,WAAWR;IACX,cAAc;QAACS;QAAaC;KAAoB;AACpD"}

package/handlers/FunctionUrlStreamAssumePermissionsDecorator.d.ts

@@ -0,0 +1,18 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawAssumePermissions } from "@webiny/api-core/features/requestContext/index.js";
+import type { EventContext } from "@webiny/event-handler-core";
+import type { NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the `x-webiny-assume-permissions` header of a Function URL
+ * event into RawAssumePermissions. Function URL mirror of ApiGatewayAssumePermissionsDecorator.
+ */
+declare class FunctionUrlStreamAssumePermissionsDecoratorImpl implements FunctionUrlStreamEventHandler.Interface {
+    private rawAssumePermissions;
+    private decoratee;
+    constructor(rawAssumePermissions: RawAssumePermissions.Interface, decoratee: FunctionUrlStreamEventHandler.Interface);
+    execute(ctx: EventContext<any>, next: NextFunction): Promise<void>;
+}
+export declare const FunctionUrlStreamAssumePermissionsDecorator: typeof FunctionUrlStreamAssumePermissionsDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IFunctionUrlStreamEventHandler>;
+};
+export {};

package/handlers/FunctionUrlStreamAssumePermissionsDecorator.js

@@ -0,0 +1,24 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawAssumePermissions, extractAssumePermissions } from "@webiny/api-core/features/requestContext/index.js";
+import { headersFromFunctionUrlEvent } from "./extractRequestAuth.js";
+class FunctionUrlStreamAssumePermissionsDecoratorImpl {
+    constructor(rawAssumePermissions, decoratee){
+        this.rawAssumePermissions = rawAssumePermissions;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = headersFromFunctionUrlEvent(ctx.event);
+        const requested = extractAssumePermissions(headers);
+        this.rawAssumePermissions.set(requested);
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const FunctionUrlStreamAssumePermissionsDecorator = FunctionUrlStreamEventHandler.createDecorator({
+    decorator: FunctionUrlStreamAssumePermissionsDecoratorImpl,
+    dependencies: [
+        RawAssumePermissions
+    ]
+});
+export { FunctionUrlStreamAssumePermissionsDecorator };
+
+//# sourceMappingURL=FunctionUrlStreamAssumePermissionsDecorator.js.map

package/handlers/FunctionUrlStreamAssumePermissionsDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/FunctionUrlStreamAssumePermissionsDecorator.js","sources":["../../src/handlers/FunctionUrlStreamAssumePermissionsDecorator.ts"],"sourcesContent":["import { FunctionUrlStreamEventHandler } from \"@webiny/event-handler-aws\";\nimport { RawAssumePermissions } from \"@webiny/api-core/features/requestContext/index.js\";\nimport { extractAssumePermissions } from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { EventContext } from \"@webiny/event-handler-core\";\nimport type { NextFunction } from \"@webiny/event-handler-core\";\nimport { headersFromFunctionUrlEvent } from \"./extractRequestAuth.js\";\n\n/**\n * EXTRACT (transport-specific): reads the `x-webiny-assume-permissions` header of a Function URL\n * event into RawAssumePermissions. Function URL mirror of ApiGatewayAssumePermissionsDecorator.\n */\nclass FunctionUrlStreamAssumePermissionsDecoratorImpl\n    implements FunctionUrlStreamEventHandler.Interface\n{\n    constructor(\n        private rawAssumePermissions: RawAssumePermissions.Interface,\n        private decoratee: FunctionUrlStreamEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<any>, next: NextFunction): Promise<void> {\n        const headers = headersFromFunctionUrlEvent(ctx.event);\n        const requested = extractAssumePermissions(headers);\n\n        this.rawAssumePermissions.set(requested);\n\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const FunctionUrlStreamAssumePermissionsDecorator =\n    FunctionUrlStreamEventHandler.createDecorator({\n        decorator: FunctionUrlStreamAssumePermissionsDecoratorImpl,\n        dependencies: [RawAssumePermissions]\n    });\n"],"names":["FunctionUrlStreamAssumePermissionsDecoratorImpl","rawAssumePermissions","decoratee","ctx","next","headers","headersFromFunctionUrlEvent","requested","extractAssumePermissions","FunctionUrlStreamAssumePermissionsDecorator","FunctionUrlStreamEventHandler","RawAssumePermissions"],"mappings":";;;AAWA,MAAMA;IAGF,YACYC,oBAAoD,EACpDC,SAAkD,CAC5D;aAFUD,oBAAoB,GAApBA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAsB,EAAEC,IAAkB,EAAiB;QACrE,MAAMC,UAAUC,4BAA4BH,IAAI,KAAK;QACrD,MAAMI,YAAYC,yBAAyBH;QAE3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAACE;QAE9B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACJ,KAAKC;IACvC;AACJ;AAEO,MAAMK,8CACTC,8BAA8B,eAAe,CAAC;IAC1C,WAAWV;IACX,cAAc;QAACW;KAAqB;AACxC"}

package/handlers/FunctionUrlStreamIdentityLoaderDecorator.d.ts

@@ -0,0 +1,22 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestIdentityLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): the Function URL streaming counterpart of
+ * `ApiGatewayIdentityLoaderDecorator`. Same shared LOAD step; the only difference is that Function URL
+ * events carry cookies as an array, so the headers are normalised first.
+ *
+ * Registered BEFORE FunctionUrlStreamTenantLoaderDecorator so identity is established before tenant.
+ */
+declare class FunctionUrlStreamIdentityLoaderDecoratorImpl implements FunctionUrlStreamEventHandler.Interface {
+    private rawAuthToken;
+    private identityLoader;
+    private decoratee;
+    constructor(rawAuthToken: RawAuthToken.Interface, identityLoader: IRequestIdentityLoader, decoratee: FunctionUrlStreamEventHandler.Interface);
+    execute(ctx: EventContext<any>, next: NextFunction): Promise<void>;
+}
+export declare const FunctionUrlStreamIdentityLoaderDecorator: typeof FunctionUrlStreamIdentityLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IFunctionUrlStreamEventHandler>;
+};
+export {};

package/handlers/FunctionUrlStreamIdentityLoaderDecorator.js

@@ -0,0 +1,27 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawAuthToken, RequestIdentityLoader } from "@webiny/api-core/features/requestContext/index.js";
+import { extractAuthToken, headersFromFunctionUrlEvent } from "./extractRequestAuth.js";
+class FunctionUrlStreamIdentityLoaderDecoratorImpl {
+    constructor(rawAuthToken, identityLoader, decoratee){
+        this.rawAuthToken = rawAuthToken;
+        this.identityLoader = identityLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = headersFromFunctionUrlEvent(ctx.event);
+        const authToken = extractAuthToken(headers);
+        this.rawAuthToken.set(authToken);
+        await this.identityLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const FunctionUrlStreamIdentityLoaderDecorator = FunctionUrlStreamEventHandler.createDecorator({
+    decorator: FunctionUrlStreamIdentityLoaderDecoratorImpl,
+    dependencies: [
+        RawAuthToken,
+        RequestIdentityLoader
+    ]
+});
+export { FunctionUrlStreamIdentityLoaderDecorator };
+
+//# sourceMappingURL=FunctionUrlStreamIdentityLoaderDecorator.js.map

package/handlers/FunctionUrlStreamIdentityLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/FunctionUrlStreamIdentityLoaderDecorator.js","sources":["../../src/handlers/FunctionUrlStreamIdentityLoaderDecorator.ts"],"sourcesContent":["import { FunctionUrlStreamEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawAuthToken,\n    RequestIdentityLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestIdentityLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\nimport { extractAuthToken, headersFromFunctionUrlEvent } from \"./extractRequestAuth.js\";\n\n/**\n * EXTRACT (transport-specific): the Function URL streaming counterpart of\n * `ApiGatewayIdentityLoaderDecorator`. Same shared LOAD step; the only difference is that Function URL\n * events carry cookies as an array, so the headers are normalised first.\n *\n * Registered BEFORE FunctionUrlStreamTenantLoaderDecorator so identity is established before tenant.\n */\nclass FunctionUrlStreamIdentityLoaderDecoratorImpl\n    implements FunctionUrlStreamEventHandler.Interface\n{\n    constructor(\n        private rawAuthToken: RawAuthToken.Interface,\n        private identityLoader: IRequestIdentityLoader,\n        private decoratee: FunctionUrlStreamEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<any>, next: NextFunction): Promise<void> {\n        const headers = headersFromFunctionUrlEvent(ctx.event);\n        const authToken = extractAuthToken(headers);\n\n        this.rawAuthToken.set(authToken);\n\n        await this.identityLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const FunctionUrlStreamIdentityLoaderDecorator =\n    FunctionUrlStreamEventHandler.createDecorator({\n        decorator: FunctionUrlStreamIdentityLoaderDecoratorImpl,\n        dependencies: [RawAuthToken, RequestIdentityLoader]\n    });\n"],"names":["FunctionUrlStreamIdentityLoaderDecoratorImpl","rawAuthToken","identityLoader","decoratee","ctx","next","headers","headersFromFunctionUrlEvent","authToken","extractAuthToken","FunctionUrlStreamIdentityLoaderDecorator","FunctionUrlStreamEventHandler","RawAuthToken","RequestIdentityLoader"],"mappings":";;;AAgBA,MAAMA;IAGF,YACYC,YAAoC,EACpCC,cAAsC,EACtCC,SAAkD,CAC5D;aAHUF,YAAY,GAAZA;aACAC,cAAc,GAAdA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAsB,EAAEC,IAAkB,EAAiB;QACrE,MAAMC,UAAUC,4BAA4BH,IAAI,KAAK;QACrD,MAAMI,YAAYC,iBAAiBH;QAEnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAACE;QAEtB,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACJ,KAAKC;IACvC;AACJ;AAEO,MAAMK,2CACTC,8BAA8B,eAAe,CAAC;IAC1C,WAAWX;IACX,cAAc;QAACY;QAAcC;KAAsB;AACvD"}

package/handlers/FunctionUrlStreamTenantLoaderDecorator.d.ts

@@ -0,0 +1,22 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of a Function URL event
+ * into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader). A missing header leaves
+ * RawTenantId null → the loader defaults to the "root" tenant.
+ *
+ * Registered AFTER FunctionUrlStreamIdentityLoaderDecorator.
+ */
+declare class FunctionUrlStreamTenantLoaderDecoratorImpl implements FunctionUrlStreamEventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: FunctionUrlStreamEventHandler.Interface);
+    execute(ctx: EventContext<any>, next: NextFunction): Promise<void>;
+}
+export declare const FunctionUrlStreamTenantLoaderDecorator: typeof FunctionUrlStreamTenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IFunctionUrlStreamEventHandler>;
+};
+export {};

package/handlers/FunctionUrlStreamTenantLoaderDecorator.js

@@ -0,0 +1,27 @@
+import { FunctionUrlStreamEventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+import { extractTenantId, headersFromFunctionUrlEvent } from "./extractRequestAuth.js";
+class FunctionUrlStreamTenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = headersFromFunctionUrlEvent(ctx.event);
+        const tenantId = extractTenantId(headers);
+        this.rawTenantId.set(tenantId);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const FunctionUrlStreamTenantLoaderDecorator = FunctionUrlStreamEventHandler.createDecorator({
+    decorator: FunctionUrlStreamTenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { FunctionUrlStreamTenantLoaderDecorator };
+
+//# sourceMappingURL=FunctionUrlStreamTenantLoaderDecorator.js.map

package/handlers/FunctionUrlStreamTenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/FunctionUrlStreamTenantLoaderDecorator.js","sources":["../../src/handlers/FunctionUrlStreamTenantLoaderDecorator.ts"],"sourcesContent":["import { FunctionUrlStreamEventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\nimport { extractTenantId, headersFromFunctionUrlEvent } from \"./extractRequestAuth.js\";\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of a Function URL event\n * into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader). A missing header leaves\n * RawTenantId null → the loader defaults to the \"root\" tenant.\n *\n * Registered AFTER FunctionUrlStreamIdentityLoaderDecorator.\n */\nclass FunctionUrlStreamTenantLoaderDecoratorImpl\n    implements FunctionUrlStreamEventHandler.Interface\n{\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: FunctionUrlStreamEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<any>, next: NextFunction): Promise<void> {\n        const headers = headersFromFunctionUrlEvent(ctx.event);\n        const tenantId = extractTenantId(headers);\n\n        this.rawTenantId.set(tenantId);\n\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const FunctionUrlStreamTenantLoaderDecorator = FunctionUrlStreamEventHandler.createDecorator(\n    {\n        decorator: FunctionUrlStreamTenantLoaderDecoratorImpl,\n        dependencies: [RawTenantId, RequestTenantLoader]\n    }\n);\n"],"names":["FunctionUrlStreamTenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","headers","headersFromFunctionUrlEvent","tenantId","extractTenantId","FunctionUrlStreamTenantLoaderDecorator","FunctionUrlStreamEventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;;AAgBA,MAAMA;IAGF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAAkD,CAC5D;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAsB,EAAEC,IAAkB,EAAiB;QACrE,MAAMC,UAAUC,4BAA4BH,IAAI,KAAK;QACrD,MAAMI,WAAWC,gBAAgBH;QAEjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAACE;QAErB,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACJ,KAAKC;IACvC;AACJ;AAEO,MAAMK,yCAAyCC,8BAA8B,eAAe,CAC/F;IACI,WAAWX;IACX,cAAc;QAACY;QAAaC;KAAoB;AACpD"}

package/handlers/S3TenantLoaderDecorator.d.ts

@@ -0,0 +1,22 @@
+import type { S3Event } from "@webiny/aws-sdk/types/index.js";
+import { S3EventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from an S3 event's bucket name (convention
+ * "<tenant>-…" → "<tenant>") into RawTenantId, then invokes the shared LOAD step
+ * (RequestTenantLoader). Mirrors the API Gateway tenant decorator — same shared load, different
+ * extract. S3 events carry no user identity, so no auth token is extracted.
+ */
+declare class S3TenantLoaderDecoratorImpl implements S3EventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: S3EventHandler.Interface);
+    execute(ctx: EventContext<S3Event>, next: NextFunction): Promise<any>;
+}
+export declare const S3TenantLoaderDecorator: typeof S3TenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-aws").IS3EventHandler>;
+};
+export {};

package/handlers/S3TenantLoaderDecorator.js

@@ -0,0 +1,25 @@
+import { S3EventHandler } from "@webiny/event-handler-aws";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+class S3TenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const bucket = ctx.event?.Records?.[0]?.s3?.bucket?.name;
+        this.rawTenantId.set(bucket ? bucket.split("-")[0] ?? null : null);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const S3TenantLoaderDecorator = S3EventHandler.createDecorator({
+    decorator: S3TenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { S3TenantLoaderDecorator };
+
+//# sourceMappingURL=S3TenantLoaderDecorator.js.map

package/handlers/S3TenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/S3TenantLoaderDecorator.js","sources":["../../src/handlers/S3TenantLoaderDecorator.ts"],"sourcesContent":["import type { S3Event } from \"@webiny/aws-sdk/types/index.js\";\nimport { S3EventHandler } from \"@webiny/event-handler-aws\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from an S3 event's bucket name (convention\n * \"<tenant>-…\" → \"<tenant>\") into RawTenantId, then invokes the shared LOAD step\n * (RequestTenantLoader). Mirrors the API Gateway tenant decorator — same shared load, different\n * extract. S3 events carry no user identity, so no auth token is extracted.\n */\nclass S3TenantLoaderDecoratorImpl implements S3EventHandler.Interface {\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: S3EventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<S3Event>, next: NextFunction): Promise<any> {\n        const bucket = ctx.event?.Records?.[0]?.s3?.bucket?.name;\n        this.rawTenantId.set(bucket ? (bucket.split(\"-\")[0] ?? null) : null);\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const S3TenantLoaderDecorator = S3EventHandler.createDecorator({\n    decorator: S3TenantLoaderDecoratorImpl,\n    dependencies: [RawTenantId, RequestTenantLoader]\n});\n"],"names":["S3TenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","bucket","S3TenantLoaderDecorator","S3EventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;AAeA,MAAMA;IACF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAAmC,CAC7C;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAA0B,EAAEC,IAAkB,EAAgB;QACxE,MAAMC,SAASF,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,QAAQ;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAACE,SAAUA,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,OAAQ;QAC/D,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,KAAKC;IACvC;AACJ;AAEO,MAAME,0BAA0BC,eAAe,eAAe,CAAC;IAClE,WAAWR;IACX,cAAc;QAACS;QAAaC;KAAoB;AACpD"}

package/handlers/extractRequestAuth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Header parsing shared by the API Gateway and Function URL auth/tenant decorators, so the two
+ * transports can't drift on how a caller authenticates.
+ */
+export declare const WEBINY_AUTHORIZATION_HEADER = "x-webiny-authorization";
+/**
+ * Reads the auth token, preferring `x-webiny-authorization` over `Authorization`.
+ *
+ * That order exists for CloudFront → Lambda Function URL with Origin Access Control: OAC signs the
+ * request with SigV4, which occupies the `Authorization` header, so a viewer's bearer token cannot
+ * survive to the origin. Clients that may traverse an OAC-signed origin send the token in the
+ * `x-webiny-authorization` header instead. Plain `Authorization` stays supported for every other
+ * caller, and the `wby-id-token` cookie remains the last resort.
+ */
+export declare function extractAuthToken(headers: Record<string, string> | undefined): string | null;
+export declare function extractTenantId(headers: Record<string, string> | undefined): string | null;
+/**
+ * Function URL events (payload format 2.0) deliver cookies as a `cookies` ARRAY rather than a `cookie`
+ * header. Fold them back so the extractors above see a normal header map.
+ */
+export declare function headersFromFunctionUrlEvent(event: any): Record<string, string>;

package/handlers/extractRequestAuth.js

@@ -0,0 +1,34 @@
+const WEBINY_AUTHORIZATION_HEADER = "x-webiny-authorization";
+function parseCookieHeader(cookieHeader) {
+    return cookieHeader.split(";").reduce((acc, pair)=>{
+        const idx = pair.indexOf("=");
+        if (idx > 0) acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());
+        return acc;
+    }, {});
+}
+function getHeader(headers, name) {
+    if (!headers) return "";
+    for (const key of Object.keys(headers))if (key.toLowerCase() === name) return headers[key] ?? "";
+    return "";
+}
+function extractAuthToken(headers) {
+    const webinyAuth = getHeader(headers, WEBINY_AUTHORIZATION_HEADER).replace(/^Bearer\s+/i, "");
+    if (webinyAuth) return webinyAuth;
+    const bearer = getHeader(headers, "authorization").replace(/^Bearer\s+/i, "");
+    if (bearer) return bearer;
+    const cookieHeader = getHeader(headers, "cookie");
+    return parseCookieHeader(cookieHeader)["wby-id-token"] ?? null;
+}
+function extractTenantId(headers) {
+    return getHeader(headers, "x-tenant") || null;
+}
+function headersFromFunctionUrlEvent(event) {
+    const headers = {
+        ...event?.headers || {}
+    };
+    if (Array.isArray(event?.cookies) && event.cookies.length > 0) headers.cookie = event.cookies.join("; ");
+    return headers;
+}
+export { WEBINY_AUTHORIZATION_HEADER, extractAuthToken, extractTenantId, headersFromFunctionUrlEvent };
+
+//# sourceMappingURL=extractRequestAuth.js.map

package/handlers/extractRequestAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/extractRequestAuth.js","sources":["../../src/handlers/extractRequestAuth.ts"],"sourcesContent":["/**\n * Header parsing shared by the API Gateway and Function URL auth/tenant decorators, so the two\n * transports can't drift on how a caller authenticates.\n */\n\nexport const WEBINY_AUTHORIZATION_HEADER = \"x-webiny-authorization\";\n\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n    return cookieHeader.split(\";\").reduce<Record<string, string>>((acc, pair) => {\n        const idx = pair.indexOf(\"=\");\n        if (idx > 0) {\n            acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());\n        }\n        return acc;\n    }, {});\n}\n\nfunction getHeader(headers: Record<string, string> | undefined, name: string): string {\n    if (!headers) {\n        return \"\";\n    }\n    // Header names are case-insensitive, and the casing that reaches us depends on the transport and\n    // on the client, so match on the lowercased key rather than guessing a spelling.\n    for (const key of Object.keys(headers)) {\n        if (key.toLowerCase() === name) {\n            return headers[key] ?? \"\";\n        }\n    }\n    return \"\";\n}\n\n/**\n * Reads the auth token, preferring `x-webiny-authorization` over `Authorization`.\n *\n * That order exists for CloudFront → Lambda Function URL with Origin Access Control: OAC signs the\n * request with SigV4, which occupies the `Authorization` header, so a viewer's bearer token cannot\n * survive to the origin. Clients that may traverse an OAC-signed origin send the token in the\n * `x-webiny-authorization` header instead. Plain `Authorization` stays supported for every other\n * caller, and the `wby-id-token` cookie remains the last resort.\n */\nexport function extractAuthToken(headers: Record<string, string> | undefined): string | null {\n    const webinyAuth = getHeader(headers, WEBINY_AUTHORIZATION_HEADER).replace(/^Bearer\\s+/i, \"\");\n    if (webinyAuth) {\n        return webinyAuth;\n    }\n\n    const bearer = getHeader(headers, \"authorization\").replace(/^Bearer\\s+/i, \"\");\n    if (bearer) {\n        return bearer;\n    }\n\n    const cookieHeader = getHeader(headers, \"cookie\");\n    return parseCookieHeader(cookieHeader)[\"wby-id-token\"] ?? null;\n}\n\nexport function extractTenantId(headers: Record<string, string> | undefined): string | null {\n    return getHeader(headers, \"x-tenant\") || null;\n}\n\n/**\n * Function URL events (payload format 2.0) deliver cookies as a `cookies` ARRAY rather than a `cookie`\n * header. Fold them back so the extractors above see a normal header map.\n */\nexport function headersFromFunctionUrlEvent(event: any): Record<string, string> {\n    const headers: Record<string, string> = {\n        ...((event?.headers as Record<string, string>) || {})\n    };\n\n    if (Array.isArray(event?.cookies) && event.cookies.length > 0) {\n        headers.cookie = event.cookies.join(\"; \");\n    }\n\n    return headers;\n}\n"],"names":["WEBINY_AUTHORIZATION_HEADER","parseCookieHeader","cookieHeader","acc","pair","idx","decodeURIComponent","getHeader","headers","name","key","Object","extractAuthToken","webinyAuth","bearer","extractTenantId","headersFromFunctionUrlEvent","event","Array"],"mappings":"AAKO,MAAMA,8BAA8B;AAE3C,SAASC,kBAAkBC,YAAoB;IAC3C,OAAOA,aAAa,KAAK,CAAC,KAAK,MAAM,CAAyB,CAACC,KAAKC;QAChE,MAAMC,MAAMD,KAAK,OAAO,CAAC;QACzB,IAAIC,MAAM,GACNF,GAAG,CAACC,KAAK,KAAK,CAAC,GAAGC,KAAK,IAAI,GAAG,GAAGC,mBAAmBF,KAAK,KAAK,CAACC,MAAM,GAAG,IAAI;QAEhF,OAAOF;IACX,GAAG,CAAC;AACR;AAEA,SAASI,UAAUC,OAA2C,EAAEC,IAAY;IACxE,IAAI,CAACD,SACD,OAAO;IAIX,KAAK,MAAME,OAAOC,OAAO,IAAI,CAACH,SAC1B,IAAIE,IAAI,WAAW,OAAOD,MACtB,OAAOD,OAAO,CAACE,IAAI,IAAI;IAG/B,OAAO;AACX;AAWO,SAASE,iBAAiBJ,OAA2C;IACxE,MAAMK,aAAaN,UAAUC,SAASR,6BAA6B,OAAO,CAAC,eAAe;IAC1F,IAAIa,YACA,OAAOA;IAGX,MAAMC,SAASP,UAAUC,SAAS,iBAAiB,OAAO,CAAC,eAAe;IAC1E,IAAIM,QACA,OAAOA;IAGX,MAAMZ,eAAeK,UAAUC,SAAS;IACxC,OAAOP,kBAAkBC,aAAa,CAAC,eAAe,IAAI;AAC9D;AAEO,SAASa,gBAAgBP,OAA2C;IACvE,OAAOD,UAAUC,SAAS,eAAe;AAC7C;AAMO,SAASQ,4BAA4BC,KAAU;IAClD,MAAMT,UAAkC;QACpC,GAAKS,OAAO,WAAsC,CAAC,CAAC;IACxD;IAEA,IAAIC,MAAM,OAAO,CAACD,OAAO,YAAYA,MAAM,OAAO,CAAC,MAAM,GAAG,GACxDT,QAAQ,MAAM,GAAGS,MAAM,OAAO,CAAC,IAAI,CAAC;IAGxC,OAAOT;AACX"}

package/handlers/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./ApiGatewayIdentityLoaderDecorator.js";
+export * from "./FunctionUrlStreamIdentityLoaderDecorator.js";
+export * from "./FunctionUrlStreamTenantLoaderDecorator.js";
+export * from "./extractRequestAuth.js";
+export * from "./ApiGatewayTenantLoaderDecorator.js";
+export * from "./S3TenantLoaderDecorator.js";
+export * from "./ApiGatewayAssumePermissionsDecorator.js";
+export * from "./FunctionUrlStreamAssumePermissionsDecorator.js";

package/handlers/index.js

@@ -0,0 +1,8 @@
+export * from "./ApiGatewayIdentityLoaderDecorator.js";
+export * from "./FunctionUrlStreamIdentityLoaderDecorator.js";
+export * from "./FunctionUrlStreamTenantLoaderDecorator.js";
+export * from "./extractRequestAuth.js";
+export * from "./ApiGatewayTenantLoaderDecorator.js";
+export * from "./S3TenantLoaderDecorator.js";
+export * from "./ApiGatewayAssumePermissionsDecorator.js";
+export * from "./FunctionUrlStreamAssumePermissionsDecorator.js";

package/index.d.ts

@@ -0,0 +1,6 @@
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";
+export type { CreateWebinyApiHandlerConfig, RegisterRootStorageContext } from "./createWebinyApiHandler.js";
+export { createWebinyStreamApiHandler } from "./createWebinyStreamApiHandler.js";
+export type { CreateWebinyStreamApiHandlerConfig } from "./createWebinyStreamApiHandler.js";
+export type { WebinyApiCompositionConfig } from "./composition/index.js";
+export * from "./handlers/index.js";

package/index.js

@@ -0,0 +1,3 @@
+export * from "./handlers/index.js";
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";
+export { createWebinyStreamApiHandler } from "./createWebinyStreamApiHandler.js";

package/package.json

@@ -0,0 +1,63 @@
+{
+	"name": "@webiny/api-event-handler-aws",
+	"version": "0.0.0-unstable.0156a4c312",
+	"type": "module",
+	"main": "index.js",
+	"exports": {
+		".": "./index.js",
+		"./*": "./*"
+	},
+	"types": "index.d.ts",
+	"description": "Composition layer: assembles the Webiny API handler for the AWS Lambda transport.",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/webiny/webiny-js.git"
+	},
+	"contributors": [
+		"Webiny Team"
+	],
+	"license": "MIT",
+	"dependencies": {
+		"@webiny/api-core": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-event-handler-core": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-file-manager-s3": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-graphql": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-headless-cms-bulk-actions-aws": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-scheduler": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-scheduler-aws": "0.0.0-unstable.0156a4c312",
+		"@webiny/api-websockets-aws": "0.0.0-unstable.0156a4c312",
+		"@webiny/aws-sdk": "0.0.0-unstable.0156a4c312",
+		"@webiny/background-tasks-aws": "0.0.0-unstable.0156a4c312",
+		"@webiny/db-dynamodb": "0.0.0-unstable.0156a4c312",
+		"@webiny/event-handler-aws": "0.0.0-unstable.0156a4c312",
+		"@webiny/event-handler-core": "0.0.0-unstable.0156a4c312",
+		"@webiny/feature": "0.0.0-unstable.0156a4c312",
+		"@webiny/handler": "0.0.0-unstable.0156a4c312",
+		"@webiny/logger": "0.0.0-unstable.0156a4c312",
+		"pino": "10.4.0",
+		"pino-lambda": "4.4.1"
+	},
+	"peerDependencies": {
+		"@webiny/di": "^2.0.0"
+	},
+	"devDependencies": {
+		"@webiny/build-tools": "0.0.0-unstable.0156a4c312",
+		"@webiny/di": "2.0.0",
+		"rimraf": "6.1.3",
+		"typescript": "7.0.2",
+		"vitest": "5.0.5"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"webiny": {
+		"publishFrom": "dist"
+	},
+	"adio": {
+		"ignore": {
+			"dependencies": [
+				"pino"
+			]
+		}
+	}
+}

package/publicUrls/ManifestPublicUrls.d.ts

@@ -0,0 +1,15 @@
+import { PublicUrl } from "@webiny/api-core/features/publicUrls/index.js";
+import { PublicUrls } from "@webiny/api-core/features/publicUrls/index.js";
+/**
+ * AWS: the `api` and `admin` Pulumi apps write their public URL (custom domain if set, CloudFront
+ * otherwise) into the service manifest at deploy time. The API is deployed before the Admin app, so
+ * the Admin URL is unknown until the Admin app has been deployed.
+ */
+declare class ManifestPublicUrlsImpl implements PublicUrls.Interface {
+    getApiUrl(): Promise<PublicUrl>;
+    getAdminUrl(): Promise<PublicUrl>;
+}
+export declare const ManifestPublicUrls: typeof ManifestPublicUrlsImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/publicUrls/abstractions").IPublicUrls>;
+};
+export {};

package/publicUrls/ManifestPublicUrls.js

@@ -0,0 +1,19 @@
+import { PublicUrl, PublicUrls } from "@webiny/api-core/features/publicUrls/index.js";
+import { ServiceDiscovery } from "@webiny/api-core/features/serviceDiscovery/index.js";
+class ManifestPublicUrlsImpl {
+    async getApiUrl() {
+        const manifest = await ServiceDiscovery.load();
+        return PublicUrl.from(manifest?.api?.url);
+    }
+    async getAdminUrl() {
+        const manifest = await ServiceDiscovery.load();
+        return PublicUrl.from(manifest?.admin?.url);
+    }
+}
+const ManifestPublicUrls = PublicUrls.createImplementation({
+    implementation: ManifestPublicUrlsImpl,
+    dependencies: []
+});
+export { ManifestPublicUrls };
+
+//# sourceMappingURL=ManifestPublicUrls.js.map

package/publicUrls/ManifestPublicUrls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicUrls/ManifestPublicUrls.js","sources":["../../src/publicUrls/ManifestPublicUrls.ts"],"sourcesContent":["import { PublicUrl } from \"@webiny/api-core/features/publicUrls/index.js\";\nimport { PublicUrls } from \"@webiny/api-core/features/publicUrls/index.js\";\nimport { ServiceDiscovery } from \"@webiny/api-core/features/serviceDiscovery/index.js\";\n\n/**\n * AWS: the `api` and `admin` Pulumi apps write their public URL (custom domain if set, CloudFront\n * otherwise) into the service manifest at deploy time. The API is deployed before the Admin app, so\n * the Admin URL is unknown until the Admin app has been deployed.\n */\nclass ManifestPublicUrlsImpl implements PublicUrls.Interface {\n    async getApiUrl() {\n        const manifest = await ServiceDiscovery.load();\n        return PublicUrl.from(manifest?.api?.url);\n    }\n\n    async getAdminUrl() {\n        const manifest = await ServiceDiscovery.load();\n        return PublicUrl.from(manifest?.admin?.url);\n    }\n}\n\nexport const ManifestPublicUrls = PublicUrls.createImplementation({\n    implementation: ManifestPublicUrlsImpl,\n    dependencies: []\n});\n"],"names":["ManifestPublicUrlsImpl","manifest","ServiceDiscovery","PublicUrl","ManifestPublicUrls","PublicUrls"],"mappings":";;AASA,MAAMA;IACF,MAAM,YAAY;QACd,MAAMC,WAAW,MAAMC,iBAAiB,IAAI;QAC5C,OAAOC,UAAU,IAAI,CAACF,UAAU,KAAK;IACzC;IAEA,MAAM,cAAc;QAChB,MAAMA,WAAW,MAAMC,iBAAiB,IAAI;QAC5C,OAAOC,UAAU,IAAI,CAACF,UAAU,OAAO;IAC3C;AACJ;AAEO,MAAMG,qBAAqBC,WAAW,oBAAoB,CAAC;IAC9D,gBAAgBL;IAChB,cAAc,EAAE;AACpB"}

package/publicUrls/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const ManifestPublicUrlsFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/publicUrls/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { ManifestPublicUrls } from "./ManifestPublicUrls.js";
+const ManifestPublicUrlsFeature = createFeature({
+    name: "ManifestPublicUrlsFeature",
+    register (container) {
+        container.register(ManifestPublicUrls);
+    }
+});
+export { ManifestPublicUrlsFeature };
+
+//# sourceMappingURL=feature.js.map

package/publicUrls/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicUrls/feature.js","sources":["../../src/publicUrls/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { ManifestPublicUrls } from \"./ManifestPublicUrls.js\";\n\nexport const ManifestPublicUrlsFeature = createFeature({\n    name: \"ManifestPublicUrlsFeature\",\n    register(container) {\n        container.register(ManifestPublicUrls);\n    }\n});\n"],"names":["ManifestPublicUrlsFeature","createFeature","container","ManifestPublicUrls"],"mappings":";;AAGO,MAAMA,4BAA4BC,cAAc;IACnD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}