@webiny/api-event-handler-standalone 0.0.0-unstable.9609e4e0c9 → 0.0.0-unstable.a85ef555b2

package/config/abstractions.d.ts

@@ -10,16 +10,6 @@ export interface IStandaloneConfig {
         /** `WEBINY_UPLOAD_SECRET`. Required. */
         readonly uploadSecret: string;
     };
-    readonly encryption: {
-        /** `WEBINY_ENCRYPTION_PASSPHRASE`. Required: standalone always encrypts. */
-        readonly passphrase: string;
-        /** `WEBINY_ENCRYPTION_SALT`. Optional. */
-        readonly salt: string;
-    };
-    readonly hashing: {
-        /** `WEBINY_HASHING_PEPPER`. Required: standalone always peppers its hashes. */
-        readonly pepper: string;
-    };
     /**
      * `WEBINY_REDIS_URL`. Optional. When set, websocket messages travel between API processes
      * through this Redis or Valkey server; required when more than one API process runs.

package/config/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"file":"config/abstractions.js","sources":["../../src/config/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { PublicUrl } from \"@webiny/api-core/features/publicUrls/index.js\";\n\nexport interface IStandaloneConfig {\n    /** `WEBINY_API_URL`. Required. */\n    readonly apiUrl: PublicUrl;\n    /** `WEBINY_ADMIN_URL`. Optional: unknown when not set. */\n    readonly adminUrl: PublicUrl;\n    readonly fileStorage: {\n        /** `WEBINY_LOCAL_STORAGE_PATH`, resolved to an absolute path. Required. */\n        readonly storagePath: string;\n        /** `WEBINY_UPLOAD_SECRET`. Required. */\n        readonly uploadSecret: string;\n    };\n    readonly encryption: {\n        /** `WEBINY_ENCRYPTION_PASSPHRASE`. Required: standalone always encrypts. */\n        readonly passphrase: string;\n        /** `WEBINY_ENCRYPTION_SALT`. Optional. */\n        readonly salt: string;\n    };\n    readonly hashing: {\n        /** `WEBINY_HASHING_PEPPER`. Required: standalone always peppers its hashes. */\n        readonly pepper: string;\n    };\n    /**\n     * `WEBINY_REDIS_URL`. Optional. When set, websocket messages travel between API processes\n     * through this Redis or Valkey server; required when more than one API process runs.\n     */\n    readonly redisUrl: string | undefined;\n}\n\n/**\n * Deployment-specific settings of a standalone API, read from env once when the server starts.\n * Nothing here is baked into the build, so one build runs in every environment.\n */\nexport const StandaloneConfig = createAbstraction<IStandaloneConfig>(\"Standalone/Config\");\n\nexport namespace StandaloneConfig {\n    export type Interface = IStandaloneConfig;\n}\n"],"names":["StandaloneConfig","createAbstraction"],"mappings":";AAmCO,MAAMA,mBAAmBC,kBAAqC"}
+{"version":3,"file":"config/abstractions.js","sources":["../../src/config/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { PublicUrl } from \"@webiny/api-core/features/publicUrls/index.js\";\n\nexport interface IStandaloneConfig {\n    /** `WEBINY_API_URL`. Required. */\n    readonly apiUrl: PublicUrl;\n    /** `WEBINY_ADMIN_URL`. Optional: unknown when not set. */\n    readonly adminUrl: PublicUrl;\n    readonly fileStorage: {\n        /** `WEBINY_LOCAL_STORAGE_PATH`, resolved to an absolute path. Required. */\n        readonly storagePath: string;\n        /** `WEBINY_UPLOAD_SECRET`. Required. */\n        readonly uploadSecret: string;\n    };\n    /**\n     * `WEBINY_REDIS_URL`. Optional. When set, websocket messages travel between API processes\n     * through this Redis or Valkey server; required when more than one API process runs.\n     */\n    readonly redisUrl: string | undefined;\n}\n\n/**\n * Deployment-specific settings of a standalone API, read from env once when the server starts.\n * Nothing here is baked into the build, so one build runs in every environment.\n */\nexport const StandaloneConfig = createAbstraction<IStandaloneConfig>(\"Standalone/Config\");\n\nexport namespace StandaloneConfig {\n    export type Interface = IStandaloneConfig;\n}\n"],"names":["StandaloneConfig","createAbstraction"],"mappings":";AAyBO,MAAMA,mBAAmBC,kBAAqC"}

package/config/readStandaloneConfig.d.ts

@@ -5,8 +5,8 @@ type Env = Record<string, string | undefined>;
  * variable, so a misconfigured container fails at boot instead of on the first upload or login.
  *
  * Nothing falls back to a default: `webiny watch` and `webiny serve` get their values from
- * `<Infra.ApiUrl>`, `<Infra.AdminUrl>`, `<Infra.FileStorage>` and `<Infra.Crypto.*>` in
- * webiny.config, and a deployed container must set them explicitly.
+ * `<Infra.ApiUrl>`, `<Infra.AdminUrl>` and `<Infra.FileStorage>` in webiny.config, and a deployed
+ * container must set them explicitly.
  */
 export declare function readStandaloneConfig(env: Env): StandaloneConfig.Interface;
 export {};

package/config/readStandaloneConfig.js

@@ -3,10 +3,6 @@ import { PublicUrl } from "@webiny/api-core/features/publicUrls/index.js";
 function read(env, name) {
     return env[name]?.trim() ?? "";
 }
-function readSecret(env, name) {
-    const value = env[name] ?? "";
-    return value.trim() ? value : "";
-}
 function readStandaloneConfig(env) {
     const problems = [];
     const apiUrlValue = read(env, "WEBINY_API_URL");
@@ -19,21 +15,14 @@ function readStandaloneConfig(env) {
     if (adminUrlValue && !adminUrl.isKnown()) problems.push(`WEBINY_ADMIN_URL is not an absolute http(s) URL: "${adminUrlValue}".`);
     const storagePath = read(env, "WEBINY_LOCAL_STORAGE_PATH");
     if (!storagePath) problems.push("WEBINY_LOCAL_STORAGE_PATH is not set.");
-    const uploadSecret = readSecret(env, "WEBINY_UPLOAD_SECRET");
+    const uploadSecret = read(env, "WEBINY_UPLOAD_SECRET");
     if (!uploadSecret) problems.push("WEBINY_UPLOAD_SECRET is not set.");
-    const encryptionPassphrase = readSecret(env, "WEBINY_ENCRYPTION_PASSPHRASE");
-    if (!encryptionPassphrase) problems.push("WEBINY_ENCRYPTION_PASSPHRASE is not set.");
-    const hashingPepper = readSecret(env, "WEBINY_HASHING_PEPPER");
-    if (!hashingPepper) problems.push("WEBINY_HASHING_PEPPER is not set.");
     const redisUrl = read(env, "WEBINY_REDIS_URL");
     if (redisUrl && !/^rediss?:\/\//.test(redisUrl)) problems.push("WEBINY_REDIS_URL must start with redis:// or rediss://.");
-    if (problems.length > 0) {
-        const message = [
-            "The standalone API is missing required configuration:",
-            ...problems
-        ].join("\n  ");
-        throw new Error(message);
-    }
+    if (problems.length > 0) throw new Error([
+        "The standalone API is missing required configuration:",
+        ...problems
+    ].join("\n  "));
     return {
         apiUrl,
         adminUrl,
@@ -41,13 +30,6 @@ function readStandaloneConfig(env) {
             storagePath: node_path.resolve(storagePath),
             uploadSecret
         },
-        encryption: {
-            passphrase: encryptionPassphrase,
-            salt: readSecret(env, "WEBINY_ENCRYPTION_SALT")
-        },
-        hashing: {
-            pepper: hashingPepper
-        },
         redisUrl: redisUrl || void 0
     };
 }

package/config/readStandaloneConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"config/readStandaloneConfig.js","sources":["../../src/config/readStandaloneConfig.ts"],"sourcesContent":["import nodePath from \"node:path\";\nimport { PublicUrl } from \"@webiny/api-core/features/publicUrls/index.js\";\nimport type { StandaloneConfig } from \"./abstractions.js\";\n\ntype Env = Record<string, string | undefined>;\n\nfunction read(env: Env, name: string): string {\n    return env[name]?.trim() ?? \"\";\n}\n\n/**\n * Secrets are used exactly as given: trimming would change the derived key or signature, so a value\n * with surrounding whitespace would no longer match what was encrypted, hashed or signed with it.\n * A blank value counts as unset.\n */\nfunction readSecret(env: Env, name: string): string {\n    const value = env[name] ?? \"\";\n    return value.trim() ? value : \"\";\n}\n\n/**\n * Reads the standalone API's settings from env. Throws one error naming every missing or invalid\n * variable, so a misconfigured container fails at boot instead of on the first upload or login.\n *\n * Nothing falls back to a default: `webiny watch` and `webiny serve` get their values from\n * `<Infra.ApiUrl>`, `<Infra.AdminUrl>`, `<Infra.FileStorage>` and `<Infra.Crypto.*>` in\n * webiny.config, and a deployed container must set them explicitly.\n */\nexport function readStandaloneConfig(env: Env): StandaloneConfig.Interface {\n    const problems: string[] = [];\n\n    const apiUrlValue = read(env, \"WEBINY_API_URL\");\n    const apiUrl = PublicUrl.from(apiUrlValue);\n    if (!apiUrlValue) {\n        problems.push(\"WEBINY_API_URL is not set.\");\n    } else if (!apiUrl.isKnown()) {\n        problems.push(`WEBINY_API_URL is not an absolute http(s) URL: \"${apiUrlValue}\".`);\n    }\n\n    const adminUrlValue = read(env, \"WEBINY_ADMIN_URL\");\n    const adminUrl = PublicUrl.from(adminUrlValue);\n    if (adminUrlValue && !adminUrl.isKnown()) {\n        problems.push(`WEBINY_ADMIN_URL is not an absolute http(s) URL: \"${adminUrlValue}\".`);\n    }\n\n    const storagePath = read(env, \"WEBINY_LOCAL_STORAGE_PATH\");\n    if (!storagePath) {\n        problems.push(\"WEBINY_LOCAL_STORAGE_PATH is not set.\");\n    }\n\n    const uploadSecret = readSecret(env, \"WEBINY_UPLOAD_SECRET\");\n    if (!uploadSecret) {\n        problems.push(\"WEBINY_UPLOAD_SECRET is not set.\");\n    }\n\n    /*\n     * Always required: a standalone project always encrypts and always peppers its hashes. There is\n     * no deploy step that could check this for production, so it is checked here for every start.\n     */\n    const encryptionPassphrase = readSecret(env, \"WEBINY_ENCRYPTION_PASSPHRASE\");\n    if (!encryptionPassphrase) {\n        problems.push(\"WEBINY_ENCRYPTION_PASSPHRASE is not set.\");\n    }\n\n    const hashingPepper = readSecret(env, \"WEBINY_HASHING_PEPPER\");\n    if (!hashingPepper) {\n        problems.push(\"WEBINY_HASHING_PEPPER is not set.\");\n    }\n\n    const redisUrl = read(env, \"WEBINY_REDIS_URL\");\n    if (redisUrl && !/^rediss?:\\/\\//.test(redisUrl)) {\n        problems.push(\"WEBINY_REDIS_URL must start with redis:// or rediss://.\");\n    }\n\n    if (problems.length > 0) {\n        const message = [\"The standalone API is missing required configuration:\", ...problems].join(\n            \"\\n  \"\n        );\n        throw new Error(message);\n    }\n\n    return {\n        apiUrl,\n        adminUrl,\n        fileStorage: {\n            storagePath: nodePath.resolve(storagePath),\n            uploadSecret\n        },\n        encryption: {\n            passphrase: encryptionPassphrase,\n            salt: readSecret(env, \"WEBINY_ENCRYPTION_SALT\")\n        },\n        hashing: {\n            pepper: hashingPepper\n        },\n        redisUrl: redisUrl || undefined\n    };\n}\n"],"names":["read","env","name","readSecret","value","readStandaloneConfig","problems","apiUrlValue","apiUrl","PublicUrl","adminUrlValue","adminUrl","storagePath","uploadSecret","encryptionPassphrase","hashingPepper","redisUrl","message","Error","nodePath","undefined"],"mappings":";;AAMA,SAASA,KAAKC,GAAQ,EAAEC,IAAY;IAChC,OAAOD,GAAG,CAACC,KAAK,EAAE,UAAU;AAChC;AAOA,SAASC,WAAWF,GAAQ,EAAEC,IAAY;IACtC,MAAME,QAAQH,GAAG,CAACC,KAAK,IAAI;IAC3B,OAAOE,MAAM,IAAI,KAAKA,QAAQ;AAClC;AAUO,SAASC,qBAAqBJ,GAAQ;IACzC,MAAMK,WAAqB,EAAE;IAE7B,MAAMC,cAAcP,KAAKC,KAAK;IAC9B,MAAMO,SAASC,UAAU,IAAI,CAACF;IAC9B,IAAKA,aAEE;QAAA,IAAI,CAACC,OAAO,OAAO,IACtBF,SAAS,IAAI,CAAC,CAAC,gDAAgD,EAAEC,YAAY,EAAE,CAAC;IACpF,OAHID,SAAS,IAAI,CAAC;IAKlB,MAAMI,gBAAgBV,KAAKC,KAAK;IAChC,MAAMU,WAAWF,UAAU,IAAI,CAACC;IAChC,IAAIA,iBAAiB,CAACC,SAAS,OAAO,IAClCL,SAAS,IAAI,CAAC,CAAC,kDAAkD,EAAEI,cAAc,EAAE,CAAC;IAGxF,MAAME,cAAcZ,KAAKC,KAAK;IAC9B,IAAI,CAACW,aACDN,SAAS,IAAI,CAAC;IAGlB,MAAMO,eAAeV,WAAWF,KAAK;IACrC,IAAI,CAACY,cACDP,SAAS,IAAI,CAAC;IAOlB,MAAMQ,uBAAuBX,WAAWF,KAAK;IAC7C,IAAI,CAACa,sBACDR,SAAS,IAAI,CAAC;IAGlB,MAAMS,gBAAgBZ,WAAWF,KAAK;IACtC,IAAI,CAACc,eACDT,SAAS,IAAI,CAAC;IAGlB,MAAMU,WAAWhB,KAAKC,KAAK;IAC3B,IAAIe,YAAY,CAAC,gBAAgB,IAAI,CAACA,WAClCV,SAAS,IAAI,CAAC;IAGlB,IAAIA,SAAS,MAAM,GAAG,GAAG;QACrB,MAAMW,UAAU;YAAC;eAA4DX;SAAS,CAAC,IAAI,CACvF;QAEJ,MAAM,IAAIY,MAAMD;IACpB;IAEA,OAAO;QACHT;QACAG;QACA,aAAa;YACT,aAAaQ,UAAAA,OAAgB,CAACP;YAC9BC;QACJ;QACA,YAAY;YACR,YAAYC;YACZ,MAAMX,WAAWF,KAAK;QAC1B;QACA,SAAS;YACL,QAAQc;QACZ;QACA,UAAUC,YAAYI;IAC1B;AACJ"}
+{"version":3,"file":"config/readStandaloneConfig.js","sources":["../../src/config/readStandaloneConfig.ts"],"sourcesContent":["import nodePath from \"node:path\";\nimport { PublicUrl } from \"@webiny/api-core/features/publicUrls/index.js\";\nimport type { StandaloneConfig } from \"./abstractions.js\";\n\ntype Env = Record<string, string | undefined>;\n\nfunction read(env: Env, name: string): string {\n    return env[name]?.trim() ?? \"\";\n}\n\n/**\n * Reads the standalone API's settings from env. Throws one error naming every missing or invalid\n * variable, so a misconfigured container fails at boot instead of on the first upload or login.\n *\n * Nothing falls back to a default: `webiny watch` and `webiny serve` get their values from\n * `<Infra.ApiUrl>`, `<Infra.AdminUrl>` and `<Infra.FileStorage>` in webiny.config, and a deployed\n * container must set them explicitly.\n */\nexport function readStandaloneConfig(env: Env): StandaloneConfig.Interface {\n    const problems: string[] = [];\n\n    const apiUrlValue = read(env, \"WEBINY_API_URL\");\n    const apiUrl = PublicUrl.from(apiUrlValue);\n    if (!apiUrlValue) {\n        problems.push(\"WEBINY_API_URL is not set.\");\n    } else if (!apiUrl.isKnown()) {\n        problems.push(`WEBINY_API_URL is not an absolute http(s) URL: \"${apiUrlValue}\".`);\n    }\n\n    const adminUrlValue = read(env, \"WEBINY_ADMIN_URL\");\n    const adminUrl = PublicUrl.from(adminUrlValue);\n    if (adminUrlValue && !adminUrl.isKnown()) {\n        problems.push(`WEBINY_ADMIN_URL is not an absolute http(s) URL: \"${adminUrlValue}\".`);\n    }\n\n    const storagePath = read(env, \"WEBINY_LOCAL_STORAGE_PATH\");\n    if (!storagePath) {\n        problems.push(\"WEBINY_LOCAL_STORAGE_PATH is not set.\");\n    }\n\n    const uploadSecret = read(env, \"WEBINY_UPLOAD_SECRET\");\n    if (!uploadSecret) {\n        problems.push(\"WEBINY_UPLOAD_SECRET is not set.\");\n    }\n\n    const redisUrl = read(env, \"WEBINY_REDIS_URL\");\n    if (redisUrl && !/^rediss?:\\/\\//.test(redisUrl)) {\n        problems.push(\"WEBINY_REDIS_URL must start with redis:// or rediss://.\");\n    }\n\n    if (problems.length > 0) {\n        throw new Error(\n            [\"The standalone API is missing required configuration:\", ...problems].join(\"\\n  \")\n        );\n    }\n\n    return {\n        apiUrl,\n        adminUrl,\n        fileStorage: {\n            storagePath: nodePath.resolve(storagePath),\n            uploadSecret\n        },\n        redisUrl: redisUrl || undefined\n    };\n}\n"],"names":["read","env","name","readStandaloneConfig","problems","apiUrlValue","apiUrl","PublicUrl","adminUrlValue","adminUrl","storagePath","uploadSecret","redisUrl","Error","nodePath","undefined"],"mappings":";;AAMA,SAASA,KAAKC,GAAQ,EAAEC,IAAY;IAChC,OAAOD,GAAG,CAACC,KAAK,EAAE,UAAU;AAChC;AAUO,SAASC,qBAAqBF,GAAQ;IACzC,MAAMG,WAAqB,EAAE;IAE7B,MAAMC,cAAcL,KAAKC,KAAK;IAC9B,MAAMK,SAASC,UAAU,IAAI,CAACF;IAC9B,IAAKA,aAEE;QAAA,IAAI,CAACC,OAAO,OAAO,IACtBF,SAAS,IAAI,CAAC,CAAC,gDAAgD,EAAEC,YAAY,EAAE,CAAC;IACpF,OAHID,SAAS,IAAI,CAAC;IAKlB,MAAMI,gBAAgBR,KAAKC,KAAK;IAChC,MAAMQ,WAAWF,UAAU,IAAI,CAACC;IAChC,IAAIA,iBAAiB,CAACC,SAAS,OAAO,IAClCL,SAAS,IAAI,CAAC,CAAC,kDAAkD,EAAEI,cAAc,EAAE,CAAC;IAGxF,MAAME,cAAcV,KAAKC,KAAK;IAC9B,IAAI,CAACS,aACDN,SAAS,IAAI,CAAC;IAGlB,MAAMO,eAAeX,KAAKC,KAAK;IAC/B,IAAI,CAACU,cACDP,SAAS,IAAI,CAAC;IAGlB,MAAMQ,WAAWZ,KAAKC,KAAK;IAC3B,IAAIW,YAAY,CAAC,gBAAgB,IAAI,CAACA,WAClCR,SAAS,IAAI,CAAC;IAGlB,IAAIA,SAAS,MAAM,GAAG,GAClB,MAAM,IAAIS,MACN;QAAC;WAA4DT;KAAS,CAAC,IAAI,CAAC;IAIpF,OAAO;QACHE;QACAG;QACA,aAAa;YACT,aAAaK,UAAAA,OAAgB,CAACJ;YAC9BC;QACJ;QACA,UAAUC,YAAYG;IAC1B;AACJ"}

package/createWebinyApiHandler.js

@@ -18,9 +18,6 @@ import { mkdirSync } from "node:fs";
 import { ConfigPublicUrlsFeature } from "./publicUrls/feature.js";
 import { StandaloneConfig } from "./config/abstractions.js";
 import { readStandaloneConfig } from "./config/readStandaloneConfig.js";
-import { readBuildParams } from "./config/readBuildParams.js";
-import { assertNoBakedSecrets } from "./config/bakedSecrets.js";
-import { StandaloneCryptoConfigFeature } from "./crypto/feature.js";
 import { consoleLogger } from "./logger/consoleLogger.js";
 const SHUTDOWN_WAIT_MS = 6000;
 function createWebinyApiHandler(config) {
@@ -31,9 +28,6 @@ function createWebinyApiHandler(config) {
     const standaloneConfig = readStandaloneConfig(process.env);
     return createServerHandler({
         root: async (rootContainer)=>{
-            const extensions = config.extensions();
-            const buildParams = await readBuildParams(extensions);
-            assertNoBakedSecrets(buildParams);
             rootContainer.registerInstance(StandaloneConfig, standaloneConfig);
             rootContainer.register(RandomProcessOwner).inSingletonScope();
             mkdirSync(standaloneConfig.fileStorage.storagePath, {
@@ -62,9 +56,8 @@ function createWebinyApiHandler(config) {
             await registerApiRequestStack(container, {
                 extensions: config.extensions,
                 transports: {
-                    hostingConfig: (requestContainer)=>{
+                    publicUrls: (requestContainer)=>{
                         ConfigPublicUrlsFeature.register(requestContainer);
-                        StandaloneCryptoConfigFeature.register(requestContainer);
                     },
                     realtime: (requestContainer)=>{
                         WebsocketsStandaloneFeature.register(requestContainer);

package/createWebinyApiHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"createWebinyApiHandler.js","sources":["../src/createWebinyApiHandler.ts"],"sourcesContent":["/**\n * Webiny API handler for the standalone Node HTTP server transport — storage-agnostic BASE.\n *\n * The ROOT container wires the Node HTTP transport (NodeHttpFeature = event type + router + HttpFeature)\n * plus the auth/tenant loader decorators (extract token / x-tenant from the IncomingMessage → shared\n * RequestIdentityLoader / RequestTenantLoader). The per-request feature stack is the transport-agnostic\n * `registerApiRequestStack` from `@webiny/api-event-handler-core` — the SAME stack the AWS handler uses.\n * The realtime transport hook installs the server WebSockets transport (vs AWS's API Gateway Management\n * API) with a SINGLE-PROCESS, in-process implementation. Background tasks and the Bree scheduler are\n * ROOT-container singletons (below) — mirroring how the AWS handler registers background tasks at root,\n * and the WebSockets connection manager — rather than per-request transports; the scheduler fires timers\n * in-process (vs AWS's EventBridge). The storage variant (and identity provider) is injected via\n * `registerRootStorage`.\n *\n * The identity provider (e.g. `@webiny/self-hosted-auth`'s JWT IdP) must be registered by the variant\n * in `registerRootStorage`, so the RequestIdentityLoader driven by the identity decorator can resolve it.\n */\nimport { GraphQLSchemaCacheFeature } from \"@webiny/api-graphql\";\nimport { EncryptionKeyCacheFeature } from \"@webiny/api-core/features/encryption/index.js\";\nimport { JwksStoreFeature } from \"@webiny/api-core/idp/index.js\";\nimport type { Container } from \"@webiny/di\";\nimport { createServerHandler, NodeHttpFeature } from \"@webiny/event-handler-standalone\";\nimport { RandomProcessOwner } from \"@webiny/event-handler-standalone\";\nimport { registerExtensions } from \"@webiny/handler\";\nimport { registerApiRequestStack } from \"@webiny/api-event-handler-core\";\nimport {\n    ServerConnectionManager,\n    NodeWsAdapter,\n    WebsocketsStandaloneFeature,\n    WebsocketsConnectionManager,\n    attachWebsocketsServer\n} from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsServerAdapter } from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsMessageBus } from \"@webiny/api-websockets-standalone\";\nimport { InProcessMessageBus } from \"@webiny/api-websockets-standalone\";\nimport { createBusMessageHandler } from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsRedisFeature } from \"@webiny/api-websockets-standalone-redis\";\nimport { ProcessOwner } from \"@webiny/event-handler-standalone\";\nimport { BackgroundTasksStandaloneFeature } from \"@webiny/background-tasks-standalone\";\nimport { startTaskRecovery } from \"@webiny/background-tasks-standalone\";\nimport { stopBackgroundTasks } from \"@webiny/background-tasks-standalone\";\nimport { FileManagerStandaloneFeature } from \"@webiny/api-file-manager-standalone\";\nimport { registerSchedulerServer, startSchedulerServer } from \"~/scheduler/schedulerServer.js\";\nimport { startBulkActionsServer } from \"~/bulkActions/bulkActionsServer.js\";\nimport { NodeHttpIdentityLoaderDecorator } from \"~/handlers/NodeHttpIdentityLoaderDecorator.js\";\nimport { NodeHttpTenantLoaderDecorator } from \"~/handlers/NodeHttpTenantLoaderDecorator.js\";\nimport { NodeHttpAssumePermissionsDecorator } from \"~/handlers/NodeHttpAssumePermissionsDecorator.js\";\nimport { createWebsocketsAuthenticator } from \"~/websockets/createWebsocketsAuthenticator.js\";\nimport { EmptyTrashBinsFeature } from \"@webiny/api-headless-cms-bulk-actions-standalone\";\nimport { mkdirSync } from \"node:fs\";\nimport { ConfigPublicUrlsFeature } from \"~/publicUrls/feature.js\";\nimport { StandaloneConfig } from \"~/config/abstractions.js\";\nimport { readStandaloneConfig } from \"~/config/readStandaloneConfig.js\";\nimport { readBuildParams } from \"~/config/readBuildParams.js\";\nimport { assertNoBakedSecrets } from \"~/config/bakedSecrets.js\";\nimport { StandaloneCryptoConfigFeature } from \"~/crypto/feature.js\";\nimport { consoleLogger } from \"~/logger/consoleLogger.js\";\n\nexport interface CreateWebinyApiHandlerConfig {\n    /**\n     * Project-defined extensions, applied at register() time.\n     */\n    extensions: () => Parameters<typeof registerExtensions>[1];\n    /**\n     * Register ALL root-container storage for this deployment (the DB feature + CMS storage ops +\n     * registries) AND the identity provider. Unlike the AWS base, the server base bakes in no DB or\n     * IdP assumption — the variant supplies the complete storage + auth wiring.\n     */\n    registerRootStorage: (container: Container) => void | Promise<void>;\n}\n\n/*\n * The part of the 8 seconds a shutdown gets that running tasks and scheduled actions may spend\n * finishing or handing back; both wait at the same time. The rest leaves room to exit before a\n * process manager loses patience.\n */\nconst SHUTDOWN_WAIT_MS = 6000;\n\nexport function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig) {\n    let stopTaskRecovery: (() => void) | undefined;\n    let stopScheduler: ((timeoutMs: number) => Promise<void>) | undefined;\n    let stopWebsockets: (() => Promise<void>) | undefined;\n    let closeMessageBus: (() => Promise<void>) | undefined;\n\n    /*\n     * Deployment-specific settings (public URLs, file storage, secrets) come from env, read once here\n     * so a missing value stops the server at boot. Nothing deployment-specific is baked into the build.\n     */\n    const standaloneConfig = readStandaloneConfig(process.env);\n\n    return createServerHandler({\n        root: async rootContainer => {\n            /*\n             * Secrets come from env only. A build that bakes one (the shared <Infra.Crypto.*> from\n             * @webiny/project) is refused here, before the server accepts a request.\n             */\n            const extensions = config.extensions();\n            const buildParams = await readBuildParams(extensions);\n            assertNoBakedSecrets(buildParams);\n\n            rootContainer.registerInstance(StandaloneConfig, standaloneConfig);\n\n            // Names this process in shared storage: task claims and websocket connections.\n            rootContainer.register(RandomProcessOwner).inSingletonScope();\n            mkdirSync(standaloneConfig.fileStorage.storagePath, { recursive: true });\n\n            // ── Transport (Node HTTP) ──────────────────────────────────\n            // NodeHttpFeature registers the event type + HttpFeature (router) + the routing terminal.\n            NodeHttpFeature.register(rootContainer);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // registerDecorator applies LATER registrations as the OUTER wrapper (whose execute()\n            // runs first). TENANT must be established before IDENTITY: API-key authentication resolves\n            // the key by tenant partition (ApiKeysRepository reads TenantContext.getTenant()), so\n            // identity depends on the tenant; the reverse is not true (RequestTenantLoader has no\n            // identity dependency). Register identity first (inner) and tenant last (outer) → tenant\n            // runs, then identity, then the router.\n            rootContainer.registerDecorator(NodeHttpIdentityLoaderDecorator);\n            rootContainer.registerDecorator(NodeHttpTenantLoaderDecorator);\n\n            // Preview-as. Mirrors the AWS handler.\n            rootContainer.registerDecorator(NodeHttpAssumePermissionsDecorator);\n\n            // ── Storage + identity provider (variant-supplied) ─────────\n            await config.registerRootStorage(rootContainer);\n\n            // ── WebSockets transport (root) ────────────────────────────\n            // Live-socket registry + adapter live in the root as singletons: the connection manager\n            // is shared between the upgrade acceptor (attachWebsocketsServer, below) and the\n            // per-request ServerWebsocketsTransport that sends to those live sockets. The persistent\n            // connection registry (ConnectionRegistry) is the storage variant's job (e.g. sql).\n            rootContainer.register(ServerConnectionManager).inSingletonScope();\n            rootContainer.register(NodeWsAdapter).inSingletonScope();\n\n            /*\n             * How a send reaches a socket another API process holds. Without a Redis URL there is\n             * one process, and every socket is in it.\n             */\n            if (standaloneConfig.redisUrl) {\n                WebsocketsRedisFeature.register(rootContainer, {\n                    url: standaloneConfig.redisUrl,\n                    logger: consoleLogger\n                });\n            } else {\n                rootContainer.register(InProcessMessageBus).inSingletonScope();\n            }\n\n            // ── GraphQL schema cache (root) ────────────────────────────\n            // Root, so a built schema outlives the request that built it.\n            GraphQLSchemaCacheFeature.register(rootContainer);\n\n            // ── Encryption key cache (root) ────────────────────────────\n            // Root, so the scrypt-derived key is computed once per process instead of per request.\n            EncryptionKeyCacheFeature.register(rootContainer);\n            // Root, so identity providers' signing keys are fetched once per process, not per request.\n            JwksStoreFeature.register(rootContainer);\n\n            // ── Background tasks (root) ────────────────────────────────\n            // Mirrors the AWS handler registering its background-task transport at root. Where AWS\n            // has Step Functions invoke the Lambda once per iteration, a root task loop dispatches a\n            // BackgroundTaskEvent per iteration through the EventDispatcher (registered by\n            // createServerHandler), and each one runs in a fresh request container.\n            BackgroundTasksStandaloneFeature.register(rootContainer);\n\n            // ── Scheduler (root) ───────────────────────────────────────\n            // The Bree scheduler is a single long-lived instance for ALL tenants, started once at boot\n            // (onServer, below) — the counterpart of the WebSockets connection manager, NOT a per-request\n            // transport. Registered here as SchedulerService (per-request create/update/delete during\n            // mutations manipulate this one live timer set) plus the run/recover event handlers. When a\n            // timer fires (outside any request) it dispatches a ScheduledActionEvent, handled in a fresh\n            // request container by the same handler AWS uses.\n            registerSchedulerServer(rootContainer);\n\n            // ── Bulk actions (root) ───────────────────────────────────\n            // Registers the EmptyTrashBinsEvent handler that the periodic trigger\n            // (startBulkActionsServer, onServer below) dispatches.\n            EmptyTrashBinsFeature.register(rootContainer);\n        },\n\n        child: async container => {\n            // The transport-agnostic per-request stack. The realtime hook installs the server\n            // WebSockets transport (overriding the domain's NullWebsocketsTransport); it resolves the\n            // shared connection manager + adapter from the root. Scheduler is NOT a per-request\n            // transport here — it's a root singleton wired in `root` + `onServer` (see above).\n            await registerApiRequestStack(container, {\n                extensions: config.extensions,\n                // Why hooks (and not just registering the transports ourselves): `.register()` calls\n                // are otherwise order-independent — you can register Features in any order, because\n                // they only REGISTER, they don't RESOLVE during registration (resolution happens\n                // later, in Initializers / SchemaFactories). The one thing that makes order matter is\n                // a DEFAULT registration: e.g. `WebsocketsFeature` registers `NullWebsocketsTransport`\n                // so the abstraction is always resolvable. Overriding it (last-registration-wins) means\n                // our transport MUST be registered AFTER that Feature. These hooks are the seams\n                // `registerApiRequestStack` provides for exactly that — each runs right after its Null\n                // default, so the override is guaranteed without the caller knowing the internal order.\n                transports: {\n                    /*\n                     * Public URLs and crypto secrets: no deploy step to discover them from, so they\n                     * come from env (StandaloneConfig, registered on the root).\n                     */\n                    hostingConfig: requestContainer => {\n                        ConfigPublicUrlsFeature.register(requestContainer);\n                        StandaloneCryptoConfigFeature.register(requestContainer);\n                    },\n                    // Server WebSockets transport; resolves the shared connection manager + adapter\n                    // from the root (registered as singletons above).\n                    realtime: requestContainer => {\n                        WebsocketsStandaloneFeature.register(requestContainer);\n                    },\n                    // File-manager storage transport: local disk. Where AWS uses S3 (+ a separate asset-\n                    // delivery Lambda), the single-process server stores files on disk and serves them\n                    // in-process — FileManagerStandaloneFeature registers local asset delivery (overriding\n                    // the domain's null impls), the upload/multipart HTTP routes, and disk file ops.\n                    fileManager: requestContainer => {\n                        FileManagerStandaloneFeature.register(\n                            requestContainer,\n                            standaloneConfig.fileStorage\n                        );\n                    }\n                }\n            });\n        },\n\n        onServer: async (server, rootContainer) => {\n            // Attach the WebSockets upgrade handler to the running HTTP server, backed by the shared\n            // (root) connection manager so request-time sends reach the live sockets.\n            //\n            // Authenticate each WebSocket connection from its `?token` JWT so it's registered under\n            // the real identity (targeted server→client sends match by identity id). It's a callback\n            // the handler supplies rather than something the WS server resolves itself — see\n            // createWebsocketsAuthenticator for why (AuthenticationContext is per-request, unreachable\n            // from the root container the WS server is attached to).\n            const connectionManager = rootContainer.resolve(WebsocketsConnectionManager);\n            const websockets = attachWebsocketsServer({\n                server,\n                connectionManager,\n                authenticate: createWebsocketsAuthenticator(rootContainer, config.extensions)\n            });\n            await websockets.start();\n            stopWebsockets = () => websockets.stop();\n\n            // Receive sends and disconnects other API processes publish for this one's sockets.\n            const messageBus = rootContainer.resolve(WebsocketsMessageBus);\n            const processOwner = rootContainer.resolve(ProcessOwner);\n            const adapter = rootContainer.resolve(WebsocketsServerAdapter);\n            const handleBusMessage = createBusMessageHandler({\n                connectionManager,\n                adapter,\n                logger: consoleLogger\n            });\n            await messageBus.subscribe(processOwner.id, handleBusMessage);\n            closeMessageBus = () => messageBus.close();\n            consoleLogger.info(\n                { messageBus: standaloneConfig.redisUrl ? \"redis\" : \"in-process\" },\n                \"[websockets] using message bus\"\n            );\n\n            /*\n             * Start the in-process scheduler timers, then re-arm persisted schedules in the\n             * background, at boot and then every minute (see startSchedulerServer).\n             */\n            stopScheduler = await startSchedulerServer(rootContainer);\n\n            // Start the periodic empty-trash-bin trigger.\n            startBulkActionsServer(rootContainer);\n\n            /*\n             * Take over tasks a restart or another process left behind, at boot and then every\n             * minute (see startTaskRecovery).\n             */\n            stopTaskRecovery = startTaskRecovery(rootContainer);\n        },\n\n        onShutdown: async rootContainer => {\n            /*\n             * Stop starting new work first: task recovery, and the scheduler's timers and recovery.\n             * Then wait for what is running: tasks hand themselves back, so another process picks\n             * them up at its next sweep, and scheduled actions already running get to finish.\n             * Websockets close at the same time, with 1012 so clients reconnect to a process that\n             * is up, and their connections leave the registry; that takes about a second. The\n             * message bus closes last, once tasks and scheduled actions are done: what they still\n             * send to browsers on other processes goes through it.\n             */\n            stopTaskRecovery?.();\n            const tasks = stopBackgroundTasks(rootContainer, SHUTDOWN_WAIT_MS);\n            const scheduledActions = stopScheduler?.(SHUTDOWN_WAIT_MS);\n            const websockets = stopWebsockets?.();\n            const workDone = Promise.allSettled([tasks, scheduledActions]);\n            const messageBus = workDone.then(() => closeMessageBus?.());\n\n            // One failing part must not cut the others short; the first failure is reported after.\n            const results = await Promise.allSettled([\n                tasks,\n                scheduledActions,\n                websockets,\n                messageBus\n            ]);\n            const failed = results.find((result): result is PromiseRejectedResult => {\n                return result.status === \"rejected\";\n            });\n            if (failed) {\n                throw failed.reason;\n            }\n        }\n    });\n}\n"],"names":["SHUTDOWN_WAIT_MS","createWebinyApiHandler","config","stopTaskRecovery","stopScheduler","stopWebsockets","closeMessageBus","standaloneConfig","readStandaloneConfig","process","createServerHandler","rootContainer","extensions","buildParams","readBuildParams","assertNoBakedSecrets","StandaloneConfig","RandomProcessOwner","mkdirSync","NodeHttpFeature","NodeHttpIdentityLoaderDecorator","NodeHttpTenantLoaderDecorator","NodeHttpAssumePermissionsDecorator","ServerConnectionManager","NodeWsAdapter","WebsocketsRedisFeature","consoleLogger","InProcessMessageBus","GraphQLSchemaCacheFeature","EncryptionKeyCacheFeature","JwksStoreFeature","BackgroundTasksStandaloneFeature","registerSchedulerServer","EmptyTrashBinsFeature","container","registerApiRequestStack","requestContainer","ConfigPublicUrlsFeature","StandaloneCryptoConfigFeature","WebsocketsStandaloneFeature","FileManagerStandaloneFeature","server","connectionManager","WebsocketsConnectionManager","websockets","attachWebsocketsServer","createWebsocketsAuthenticator","messageBus","WebsocketsMessageBus","processOwner","ProcessOwner","adapter","WebsocketsServerAdapter","handleBusMessage","createBusMessageHandler","startSchedulerServer","startBulkActionsServer","startTaskRecovery","tasks","stopBackgroundTasks","scheduledActions","workDone","Promise","results","failed","result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4EA,MAAMA,mBAAmB;AAElB,SAASC,uBAAuBC,MAAoC;IACvE,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAMJ,MAAMC,mBAAmBC,qBAAqBC,QAAQ,GAAG;IAEzD,OAAOC,oBAAoB;QACvB,MAAM,OAAMC;YAKR,MAAMC,aAAaV,OAAO,UAAU;YACpC,MAAMW,cAAc,MAAMC,gBAAgBF;YAC1CG,qBAAqBF;YAErBF,cAAc,gBAAgB,CAACK,kBAAkBT;YAGjDI,cAAc,QAAQ,CAACM,oBAAoB,gBAAgB;YAC3DC,UAAUX,iBAAiB,WAAW,CAAC,WAAW,EAAE;gBAAE,WAAW;YAAK;YAItEY,gBAAgB,QAAQ,CAACR;YASzBA,cAAc,iBAAiB,CAACS;YAChCT,cAAc,iBAAiB,CAACU;YAGhCV,cAAc,iBAAiB,CAACW;YAGhC,MAAMpB,OAAO,mBAAmB,CAACS;YAOjCA,cAAc,QAAQ,CAACY,yBAAyB,gBAAgB;YAChEZ,cAAc,QAAQ,CAACa,eAAe,gBAAgB;YAMtD,IAAIjB,iBAAiB,QAAQ,EACzBkB,uBAAuB,QAAQ,CAACd,eAAe;gBAC3C,KAAKJ,iBAAiB,QAAQ;gBAC9B,QAAQmB;YACZ;iBAEAf,cAAc,QAAQ,CAACgB,qBAAqB,gBAAgB;YAKhEC,0BAA0B,QAAQ,CAACjB;YAInCkB,0BAA0B,QAAQ,CAAClB;YAEnCmB,iBAAiB,QAAQ,CAACnB;YAO1BoB,iCAAiC,QAAQ,CAACpB;YAS1CqB,wBAAwBrB;YAKxBsB,sBAAsB,QAAQ,CAACtB;QACnC;QAEA,OAAO,OAAMuB;YAKT,MAAMC,wBAAwBD,WAAW;gBACrC,YAAYhC,OAAO,UAAU;gBAU7B,YAAY;oBAKR,eAAekC,CAAAA;wBACXC,wBAAwB,QAAQ,CAACD;wBACjCE,8BAA8B,QAAQ,CAACF;oBAC3C;oBAGA,UAAUA,CAAAA;wBACNG,4BAA4B,QAAQ,CAACH;oBACzC;oBAKA,aAAaA,CAAAA;wBACTI,6BAA6B,QAAQ,CACjCJ,kBACA7B,iBAAiB,WAAW;oBAEpC;gBACJ;YACJ;QACJ;QAEA,UAAU,OAAOkC,QAAQ9B;YASrB,MAAM+B,oBAAoB/B,cAAc,OAAO,CAACgC;YAChD,MAAMC,aAAaC,uBAAuB;gBACtCJ;gBACAC;gBACA,cAAcI,8BAA8BnC,eAAeT,OAAO,UAAU;YAChF;YACA,MAAM0C,WAAW,KAAK;YACtBvC,iBAAiB,IAAMuC,WAAW,IAAI;YAGtC,MAAMG,aAAapC,cAAc,OAAO,CAACqC;YACzC,MAAMC,eAAetC,cAAc,OAAO,CAACuC;YAC3C,MAAMC,UAAUxC,cAAc,OAAO,CAACyC;YACtC,MAAMC,mBAAmBC,wBAAwB;gBAC7CZ;gBACAS;gBACA,QAAQzB;YACZ;YACA,MAAMqB,WAAW,SAAS,CAACE,aAAa,EAAE,EAAEI;YAC5C/C,kBAAkB,IAAMyC,WAAW,KAAK;YACxCrB,cAAc,IAAI,CACd;gBAAE,YAAYnB,iBAAiB,QAAQ,GAAG,UAAU;YAAa,GACjE;YAOJH,gBAAgB,MAAMmD,qBAAqB5C;YAG3C6C,uBAAuB7C;YAMvBR,mBAAmBsD,kBAAkB9C;QACzC;QAEA,YAAY,OAAMA;YAUdR;YACA,MAAMuD,QAAQC,oBAAoBhD,eAAeX;YACjD,MAAM4D,mBAAmBxD,gBAAgBJ;YACzC,MAAM4C,aAAavC;YACnB,MAAMwD,WAAWC,QAAQ,UAAU,CAAC;gBAACJ;gBAAOE;aAAiB;YAC7D,MAAMb,aAAac,SAAS,IAAI,CAAC,IAAMvD;YAGvC,MAAMyD,UAAU,MAAMD,QAAQ,UAAU,CAAC;gBACrCJ;gBACAE;gBACAhB;gBACAG;aACH;YACD,MAAMiB,SAASD,QAAQ,IAAI,CAAC,CAACE,SAClBA,AAAkB,eAAlBA,OAAO,MAAM;YAExB,IAAID,QACA,MAAMA,OAAO,MAAM;QAE3B;IACJ;AACJ"}
+{"version":3,"file":"createWebinyApiHandler.js","sources":["../src/createWebinyApiHandler.ts"],"sourcesContent":["/**\n * Webiny API handler for the standalone Node HTTP server transport — storage-agnostic BASE.\n *\n * The ROOT container wires the Node HTTP transport (NodeHttpFeature = event type + router + HttpFeature)\n * plus the auth/tenant loader decorators (extract token / x-tenant from the IncomingMessage → shared\n * RequestIdentityLoader / RequestTenantLoader). The per-request feature stack is the transport-agnostic\n * `registerApiRequestStack` from `@webiny/api-event-handler-core` — the SAME stack the AWS handler uses.\n * The realtime transport hook installs the server WebSockets transport (vs AWS's API Gateway Management\n * API) with a SINGLE-PROCESS, in-process implementation. Background tasks and the Bree scheduler are\n * ROOT-container singletons (below) — mirroring how the AWS handler registers background tasks at root,\n * and the WebSockets connection manager — rather than per-request transports; the scheduler fires timers\n * in-process (vs AWS's EventBridge). The storage variant (and identity provider) is injected via\n * `registerRootStorage`.\n *\n * The identity provider (e.g. `@webiny/self-hosted-auth`'s JWT IdP) must be registered by the variant\n * in `registerRootStorage`, so the RequestIdentityLoader driven by the identity decorator can resolve it.\n */\nimport { GraphQLSchemaCacheFeature } from \"@webiny/api-graphql\";\nimport { EncryptionKeyCacheFeature } from \"@webiny/api-core/features/encryption/index.js\";\nimport { JwksStoreFeature } from \"@webiny/api-core/idp/index.js\";\nimport type { Container } from \"@webiny/di\";\nimport { createServerHandler, NodeHttpFeature } from \"@webiny/event-handler-standalone\";\nimport { RandomProcessOwner } from \"@webiny/event-handler-standalone\";\nimport { registerExtensions } from \"@webiny/handler\";\nimport { registerApiRequestStack } from \"@webiny/api-event-handler-core\";\nimport {\n    ServerConnectionManager,\n    NodeWsAdapter,\n    WebsocketsStandaloneFeature,\n    WebsocketsConnectionManager,\n    attachWebsocketsServer\n} from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsServerAdapter } from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsMessageBus } from \"@webiny/api-websockets-standalone\";\nimport { InProcessMessageBus } from \"@webiny/api-websockets-standalone\";\nimport { createBusMessageHandler } from \"@webiny/api-websockets-standalone\";\nimport { WebsocketsRedisFeature } from \"@webiny/api-websockets-standalone-redis\";\nimport { ProcessOwner } from \"@webiny/event-handler-standalone\";\nimport { BackgroundTasksStandaloneFeature } from \"@webiny/background-tasks-standalone\";\nimport { startTaskRecovery } from \"@webiny/background-tasks-standalone\";\nimport { stopBackgroundTasks } from \"@webiny/background-tasks-standalone\";\nimport { FileManagerStandaloneFeature } from \"@webiny/api-file-manager-standalone\";\nimport { registerSchedulerServer, startSchedulerServer } from \"~/scheduler/schedulerServer.js\";\nimport { startBulkActionsServer } from \"~/bulkActions/bulkActionsServer.js\";\nimport { NodeHttpIdentityLoaderDecorator } from \"~/handlers/NodeHttpIdentityLoaderDecorator.js\";\nimport { NodeHttpTenantLoaderDecorator } from \"~/handlers/NodeHttpTenantLoaderDecorator.js\";\nimport { NodeHttpAssumePermissionsDecorator } from \"~/handlers/NodeHttpAssumePermissionsDecorator.js\";\nimport { createWebsocketsAuthenticator } from \"~/websockets/createWebsocketsAuthenticator.js\";\nimport { EmptyTrashBinsFeature } from \"@webiny/api-headless-cms-bulk-actions-standalone\";\nimport { mkdirSync } from \"node:fs\";\nimport { ConfigPublicUrlsFeature } from \"~/publicUrls/feature.js\";\nimport { StandaloneConfig } from \"~/config/abstractions.js\";\nimport { readStandaloneConfig } from \"~/config/readStandaloneConfig.js\";\nimport { consoleLogger } from \"~/logger/consoleLogger.js\";\n\nexport interface CreateWebinyApiHandlerConfig {\n    /**\n     * Project-defined extensions, applied at register() time.\n     */\n    extensions: () => Parameters<typeof registerExtensions>[1];\n    /**\n     * Register ALL root-container storage for this deployment (the DB feature + CMS storage ops +\n     * registries) AND the identity provider. Unlike the AWS base, the server base bakes in no DB or\n     * IdP assumption — the variant supplies the complete storage + auth wiring.\n     */\n    registerRootStorage: (container: Container) => void | Promise<void>;\n}\n\n/*\n * The part of the 8 seconds a shutdown gets that running tasks and scheduled actions may spend\n * finishing or handing back; both wait at the same time. The rest leaves room to exit before a\n * process manager loses patience.\n */\nconst SHUTDOWN_WAIT_MS = 6000;\n\nexport function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig) {\n    let stopTaskRecovery: (() => void) | undefined;\n    let stopScheduler: ((timeoutMs: number) => Promise<void>) | undefined;\n    let stopWebsockets: (() => Promise<void>) | undefined;\n    let closeMessageBus: (() => Promise<void>) | undefined;\n\n    // Deployment-specific settings (public URLs, file storage) come from env, read once here so a\n    // missing value stops the server at boot. Nothing deployment-specific is baked into the build.\n    const standaloneConfig = readStandaloneConfig(process.env);\n\n    return createServerHandler({\n        root: async rootContainer => {\n            rootContainer.registerInstance(StandaloneConfig, standaloneConfig);\n\n            // Names this process in shared storage: task claims and websocket connections.\n            rootContainer.register(RandomProcessOwner).inSingletonScope();\n            mkdirSync(standaloneConfig.fileStorage.storagePath, { recursive: true });\n\n            // ── Transport (Node HTTP) ──────────────────────────────────\n            // NodeHttpFeature registers the event type + HttpFeature (router) + the routing terminal.\n            NodeHttpFeature.register(rootContainer);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // registerDecorator applies LATER registrations as the OUTER wrapper (whose execute()\n            // runs first). TENANT must be established before IDENTITY: API-key authentication resolves\n            // the key by tenant partition (ApiKeysRepository reads TenantContext.getTenant()), so\n            // identity depends on the tenant; the reverse is not true (RequestTenantLoader has no\n            // identity dependency). Register identity first (inner) and tenant last (outer) → tenant\n            // runs, then identity, then the router.\n            rootContainer.registerDecorator(NodeHttpIdentityLoaderDecorator);\n            rootContainer.registerDecorator(NodeHttpTenantLoaderDecorator);\n\n            // Preview-as. Mirrors the AWS handler.\n            rootContainer.registerDecorator(NodeHttpAssumePermissionsDecorator);\n\n            // ── Storage + identity provider (variant-supplied) ─────────\n            await config.registerRootStorage(rootContainer);\n\n            // ── WebSockets transport (root) ────────────────────────────\n            // Live-socket registry + adapter live in the root as singletons: the connection manager\n            // is shared between the upgrade acceptor (attachWebsocketsServer, below) and the\n            // per-request ServerWebsocketsTransport that sends to those live sockets. The persistent\n            // connection registry (ConnectionRegistry) is the storage variant's job (e.g. sql).\n            rootContainer.register(ServerConnectionManager).inSingletonScope();\n            rootContainer.register(NodeWsAdapter).inSingletonScope();\n\n            /*\n             * How a send reaches a socket another API process holds. Without a Redis URL there is\n             * one process, and every socket is in it.\n             */\n            if (standaloneConfig.redisUrl) {\n                WebsocketsRedisFeature.register(rootContainer, {\n                    url: standaloneConfig.redisUrl,\n                    logger: consoleLogger\n                });\n            } else {\n                rootContainer.register(InProcessMessageBus).inSingletonScope();\n            }\n\n            // ── GraphQL schema cache (root) ────────────────────────────\n            // Root, so a built schema outlives the request that built it.\n            GraphQLSchemaCacheFeature.register(rootContainer);\n\n            // ── Encryption key cache (root) ────────────────────────────\n            // Root, so the scrypt-derived key is computed once per process instead of per request.\n            EncryptionKeyCacheFeature.register(rootContainer);\n            // Root, so identity providers' signing keys are fetched once per process, not per request.\n            JwksStoreFeature.register(rootContainer);\n\n            // ── Background tasks (root) ────────────────────────────────\n            // Mirrors the AWS handler registering its background-task transport at root. Where AWS\n            // has Step Functions invoke the Lambda once per iteration, a root task loop dispatches a\n            // BackgroundTaskEvent per iteration through the EventDispatcher (registered by\n            // createServerHandler), and each one runs in a fresh request container.\n            BackgroundTasksStandaloneFeature.register(rootContainer);\n\n            // ── Scheduler (root) ───────────────────────────────────────\n            // The Bree scheduler is a single long-lived instance for ALL tenants, started once at boot\n            // (onServer, below) — the counterpart of the WebSockets connection manager, NOT a per-request\n            // transport. Registered here as SchedulerService (per-request create/update/delete during\n            // mutations manipulate this one live timer set) plus the run/recover event handlers. When a\n            // timer fires (outside any request) it dispatches a ScheduledActionEvent, handled in a fresh\n            // request container by the same handler AWS uses.\n            registerSchedulerServer(rootContainer);\n\n            // ── Bulk actions (root) ───────────────────────────────────\n            // Registers the EmptyTrashBinsEvent handler that the periodic trigger\n            // (startBulkActionsServer, onServer below) dispatches.\n            EmptyTrashBinsFeature.register(rootContainer);\n        },\n\n        child: async container => {\n            // The transport-agnostic per-request stack. The realtime hook installs the server\n            // WebSockets transport (overriding the domain's NullWebsocketsTransport); it resolves the\n            // shared connection manager + adapter from the root. Scheduler is NOT a per-request\n            // transport here — it's a root singleton wired in `root` + `onServer` (see above).\n            await registerApiRequestStack(container, {\n                extensions: config.extensions,\n                // Why hooks (and not just registering the transports ourselves): `.register()` calls\n                // are otherwise order-independent — you can register Features in any order, because\n                // they only REGISTER, they don't RESOLVE during registration (resolution happens\n                // later, in Initializers / SchemaFactories). The one thing that makes order matter is\n                // a DEFAULT registration: e.g. `WebsocketsFeature` registers `NullWebsocketsTransport`\n                // so the abstraction is always resolvable. Overriding it (last-registration-wins) means\n                // our transport MUST be registered AFTER that Feature. These hooks are the seams\n                // `registerApiRequestStack` provides for exactly that — each runs right after its Null\n                // default, so the override is guaranteed without the caller knowing the internal order.\n                transports: {\n                    // Public URLs: no deploy step to discover them from, so they come from\n                    // `WEBINY_API_URL` / `WEBINY_ADMIN_URL` (StandaloneConfig, registered on the root).\n                    publicUrls: requestContainer => {\n                        ConfigPublicUrlsFeature.register(requestContainer);\n                    },\n                    // Server WebSockets transport; resolves the shared connection manager + adapter\n                    // from the root (registered as singletons above).\n                    realtime: requestContainer => {\n                        WebsocketsStandaloneFeature.register(requestContainer);\n                    },\n                    // File-manager storage transport: local disk. Where AWS uses S3 (+ a separate asset-\n                    // delivery Lambda), the single-process server stores files on disk and serves them\n                    // in-process — FileManagerStandaloneFeature registers local asset delivery (overriding\n                    // the domain's null impls), the upload/multipart HTTP routes, and disk file ops.\n                    fileManager: requestContainer => {\n                        FileManagerStandaloneFeature.register(\n                            requestContainer,\n                            standaloneConfig.fileStorage\n                        );\n                    }\n                }\n            });\n        },\n\n        onServer: async (server, rootContainer) => {\n            // Attach the WebSockets upgrade handler to the running HTTP server, backed by the shared\n            // (root) connection manager so request-time sends reach the live sockets.\n            //\n            // Authenticate each WebSocket connection from its `?token` JWT so it's registered under\n            // the real identity (targeted server→client sends match by identity id). It's a callback\n            // the handler supplies rather than something the WS server resolves itself — see\n            // createWebsocketsAuthenticator for why (AuthenticationContext is per-request, unreachable\n            // from the root container the WS server is attached to).\n            const connectionManager = rootContainer.resolve(WebsocketsConnectionManager);\n            const websockets = attachWebsocketsServer({\n                server,\n                connectionManager,\n                authenticate: createWebsocketsAuthenticator(rootContainer, config.extensions)\n            });\n            await websockets.start();\n            stopWebsockets = () => websockets.stop();\n\n            // Receive sends and disconnects other API processes publish for this one's sockets.\n            const messageBus = rootContainer.resolve(WebsocketsMessageBus);\n            const processOwner = rootContainer.resolve(ProcessOwner);\n            const adapter = rootContainer.resolve(WebsocketsServerAdapter);\n            const handleBusMessage = createBusMessageHandler({\n                connectionManager,\n                adapter,\n                logger: consoleLogger\n            });\n            await messageBus.subscribe(processOwner.id, handleBusMessage);\n            closeMessageBus = () => messageBus.close();\n            consoleLogger.info(\n                { messageBus: standaloneConfig.redisUrl ? \"redis\" : \"in-process\" },\n                \"[websockets] using message bus\"\n            );\n\n            /*\n             * Start the in-process scheduler timers, then re-arm persisted schedules in the\n             * background, at boot and then every minute (see startSchedulerServer).\n             */\n            stopScheduler = await startSchedulerServer(rootContainer);\n\n            // Start the periodic empty-trash-bin trigger.\n            startBulkActionsServer(rootContainer);\n\n            /*\n             * Take over tasks a restart or another process left behind, at boot and then every\n             * minute (see startTaskRecovery).\n             */\n            stopTaskRecovery = startTaskRecovery(rootContainer);\n        },\n\n        onShutdown: async rootContainer => {\n            /*\n             * Stop starting new work first: task recovery, and the scheduler's timers and recovery.\n             * Then wait for what is running: tasks hand themselves back, so another process picks\n             * them up at its next sweep, and scheduled actions already running get to finish.\n             * Websockets close at the same time, with 1012 so clients reconnect to a process that\n             * is up, and their connections leave the registry; that takes about a second. The\n             * message bus closes last, once tasks and scheduled actions are done: what they still\n             * send to browsers on other processes goes through it.\n             */\n            stopTaskRecovery?.();\n            const tasks = stopBackgroundTasks(rootContainer, SHUTDOWN_WAIT_MS);\n            const scheduledActions = stopScheduler?.(SHUTDOWN_WAIT_MS);\n            const websockets = stopWebsockets?.();\n            const workDone = Promise.allSettled([tasks, scheduledActions]);\n            const messageBus = workDone.then(() => closeMessageBus?.());\n\n            // One failing part must not cut the others short; the first failure is reported after.\n            const results = await Promise.allSettled([\n                tasks,\n                scheduledActions,\n                websockets,\n                messageBus\n            ]);\n            const failed = results.find((result): result is PromiseRejectedResult => {\n                return result.status === \"rejected\";\n            });\n            if (failed) {\n                throw failed.reason;\n            }\n        }\n    });\n}\n"],"names":["SHUTDOWN_WAIT_MS","createWebinyApiHandler","config","stopTaskRecovery","stopScheduler","stopWebsockets","closeMessageBus","standaloneConfig","readStandaloneConfig","process","createServerHandler","rootContainer","StandaloneConfig","RandomProcessOwner","mkdirSync","NodeHttpFeature","NodeHttpIdentityLoaderDecorator","NodeHttpTenantLoaderDecorator","NodeHttpAssumePermissionsDecorator","ServerConnectionManager","NodeWsAdapter","WebsocketsRedisFeature","consoleLogger","InProcessMessageBus","GraphQLSchemaCacheFeature","EncryptionKeyCacheFeature","JwksStoreFeature","BackgroundTasksStandaloneFeature","registerSchedulerServer","EmptyTrashBinsFeature","container","registerApiRequestStack","requestContainer","ConfigPublicUrlsFeature","WebsocketsStandaloneFeature","FileManagerStandaloneFeature","server","connectionManager","WebsocketsConnectionManager","websockets","attachWebsocketsServer","createWebsocketsAuthenticator","messageBus","WebsocketsMessageBus","processOwner","ProcessOwner","adapter","WebsocketsServerAdapter","handleBusMessage","createBusMessageHandler","startSchedulerServer","startBulkActionsServer","startTaskRecovery","tasks","stopBackgroundTasks","scheduledActions","workDone","Promise","results","failed","result"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyEA,MAAMA,mBAAmB;AAElB,SAASC,uBAAuBC,MAAoC;IACvE,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAIJ,MAAMC,mBAAmBC,qBAAqBC,QAAQ,GAAG;IAEzD,OAAOC,oBAAoB;QACvB,MAAM,OAAMC;YACRA,cAAc,gBAAgB,CAACC,kBAAkBL;YAGjDI,cAAc,QAAQ,CAACE,oBAAoB,gBAAgB;YAC3DC,UAAUP,iBAAiB,WAAW,CAAC,WAAW,EAAE;gBAAE,WAAW;YAAK;YAItEQ,gBAAgB,QAAQ,CAACJ;YASzBA,cAAc,iBAAiB,CAACK;YAChCL,cAAc,iBAAiB,CAACM;YAGhCN,cAAc,iBAAiB,CAACO;YAGhC,MAAMhB,OAAO,mBAAmB,CAACS;YAOjCA,cAAc,QAAQ,CAACQ,yBAAyB,gBAAgB;YAChER,cAAc,QAAQ,CAACS,eAAe,gBAAgB;YAMtD,IAAIb,iBAAiB,QAAQ,EACzBc,uBAAuB,QAAQ,CAACV,eAAe;gBAC3C,KAAKJ,iBAAiB,QAAQ;gBAC9B,QAAQe;YACZ;iBAEAX,cAAc,QAAQ,CAACY,qBAAqB,gBAAgB;YAKhEC,0BAA0B,QAAQ,CAACb;YAInCc,0BAA0B,QAAQ,CAACd;YAEnCe,iBAAiB,QAAQ,CAACf;YAO1BgB,iCAAiC,QAAQ,CAAChB;YAS1CiB,wBAAwBjB;YAKxBkB,sBAAsB,QAAQ,CAAClB;QACnC;QAEA,OAAO,OAAMmB;YAKT,MAAMC,wBAAwBD,WAAW;gBACrC,YAAY5B,OAAO,UAAU;gBAU7B,YAAY;oBAGR,YAAY8B,CAAAA;wBACRC,wBAAwB,QAAQ,CAACD;oBACrC;oBAGA,UAAUA,CAAAA;wBACNE,4BAA4B,QAAQ,CAACF;oBACzC;oBAKA,aAAaA,CAAAA;wBACTG,6BAA6B,QAAQ,CACjCH,kBACAzB,iBAAiB,WAAW;oBAEpC;gBACJ;YACJ;QACJ;QAEA,UAAU,OAAO6B,QAAQzB;YASrB,MAAM0B,oBAAoB1B,cAAc,OAAO,CAAC2B;YAChD,MAAMC,aAAaC,uBAAuB;gBACtCJ;gBACAC;gBACA,cAAcI,8BAA8B9B,eAAeT,OAAO,UAAU;YAChF;YACA,MAAMqC,WAAW,KAAK;YACtBlC,iBAAiB,IAAMkC,WAAW,IAAI;YAGtC,MAAMG,aAAa/B,cAAc,OAAO,CAACgC;YACzC,MAAMC,eAAejC,cAAc,OAAO,CAACkC;YAC3C,MAAMC,UAAUnC,cAAc,OAAO,CAACoC;YACtC,MAAMC,mBAAmBC,wBAAwB;gBAC7CZ;gBACAS;gBACA,QAAQxB;YACZ;YACA,MAAMoB,WAAW,SAAS,CAACE,aAAa,EAAE,EAAEI;YAC5C1C,kBAAkB,IAAMoC,WAAW,KAAK;YACxCpB,cAAc,IAAI,CACd;gBAAE,YAAYf,iBAAiB,QAAQ,GAAG,UAAU;YAAa,GACjE;YAOJH,gBAAgB,MAAM8C,qBAAqBvC;YAG3CwC,uBAAuBxC;YAMvBR,mBAAmBiD,kBAAkBzC;QACzC;QAEA,YAAY,OAAMA;YAUdR;YACA,MAAMkD,QAAQC,oBAAoB3C,eAAeX;YACjD,MAAMuD,mBAAmBnD,gBAAgBJ;YACzC,MAAMuC,aAAalC;YACnB,MAAMmD,WAAWC,QAAQ,UAAU,CAAC;gBAACJ;gBAAOE;aAAiB;YAC7D,MAAMb,aAAac,SAAS,IAAI,CAAC,IAAMlD;YAGvC,MAAMoD,UAAU,MAAMD,QAAQ,UAAU,CAAC;gBACrCJ;gBACAE;gBACAhB;gBACAG;aACH;YACD,MAAMiB,SAASD,QAAQ,IAAI,CAAC,CAACE,SAClBA,AAAkB,eAAlBA,OAAO,MAAM;YAExB,IAAID,QACA,MAAMA,OAAO,MAAM;QAE3B;IACJ;AACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@webiny/api-event-handler-standalone",
-	"version": "0.0.0-unstable.9609e4e0c9",
+	"version": "0.0.0-unstable.a85ef555b2",
 	"type": "module",
 	"main": "index.js",
 	"exports": {
@@ -18,30 +18,30 @@
 	],
 	"license": "MIT",
 	"dependencies": {
-		"@webiny/api-core": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-event-handler-core": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-file-manager-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-graphql": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-headless-cms-bulk-actions-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-scheduler": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-scheduler-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-websockets-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/api-websockets-standalone-redis": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/background-tasks-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/event-handler-core": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/event-handler-standalone": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/feature": "0.0.0-unstable.9609e4e0c9",
-		"@webiny/handler": "0.0.0-unstable.9609e4e0c9"
+		"@webiny/api-core": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-event-handler-core": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-file-manager-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-graphql": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-headless-cms-bulk-actions-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-scheduler": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-scheduler-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-websockets-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/api-websockets-standalone-redis": "0.0.0-unstable.a85ef555b2",
+		"@webiny/background-tasks-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/event-handler-core": "0.0.0-unstable.a85ef555b2",
+		"@webiny/event-handler-standalone": "0.0.0-unstable.a85ef555b2",
+		"@webiny/feature": "0.0.0-unstable.a85ef555b2",
+		"@webiny/handler": "0.0.0-unstable.a85ef555b2"
 	},
 	"peerDependencies": {
 		"@webiny/di": "^2.0.0"
 	},
 	"devDependencies": {
-		"@webiny/build-tools": "0.0.0-unstable.9609e4e0c9",
+		"@webiny/build-tools": "0.0.0-unstable.a85ef555b2",
 		"@webiny/di": "2.0.0",
 		"rimraf": "6.1.3",
 		"typescript": "7.0.2",
-		"vitest": "5.0.5"
+		"vitest": "4.1.11"
 	},
 	"publishConfig": {
 		"access": "public"

package/config/bakedSecrets.d.ts

@@ -1,8 +0,0 @@
-import type { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-/**
- * Throws when the build contains the encryption passphrase or the hashing pepper. That happens when
- * webiny.config.tsx uses the shared <Infra.Crypto.*> from @webiny/project instead of the standalone
- * ones: the secret would sit in the image, and a different value in env would not match what the
- * project was configured with.
- */
-export declare function assertNoBakedSecrets(buildParams: BuildParams.Interface): void;

package/config/bakedSecrets.js

@@ -1,17 +0,0 @@
-const BAKED_ENCRYPTION_PASSPHRASE_BUILD_PARAM = "EncryptionPassphrase";
-const BAKED_HASHING_PEPPER_BUILD_PARAM = "HashingPepper";
-function assertNoBakedSecrets(buildParams) {
-    const problems = [];
-    if (buildParams.get(BAKED_ENCRYPTION_PASSPHRASE_BUILD_PARAM)) problems.push("The build contains the encryption passphrase (EncryptionPassphrase build param), so webiny.config.tsx uses <Infra.Crypto.Encryption> from @webiny/project. Use the one from @webiny/project-standalone, which reads WEBINY_ENCRYPTION_PASSPHRASE at startup.");
-    if (buildParams.get(BAKED_HASHING_PEPPER_BUILD_PARAM)) problems.push("The build contains the hashing pepper (HashingPepper build param), so webiny.config.tsx uses <Infra.Crypto.Hashing> from @webiny/project. Use the one from @webiny/project-standalone, which reads WEBINY_HASHING_PEPPER at startup.");
-    if (problems.length > 0) {
-        const message = [
-            "The standalone API build is misconfigured:",
-            ...problems
-        ].join("\n  ");
-        throw new Error(message);
-    }
-}
-export { assertNoBakedSecrets };
-
-//# sourceMappingURL=bakedSecrets.js.map

package/config/bakedSecrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config/bakedSecrets.js","sources":["../../src/config/bakedSecrets.ts"],"sourcesContent":["import type { BuildParams } from \"@webiny/api-core/features/buildParams/index.js\";\n\n// Baked by the shared <Infra.Crypto.*> from @webiny/project (used on AWS). Never valid in standalone.\nconst BAKED_ENCRYPTION_PASSPHRASE_BUILD_PARAM = \"EncryptionPassphrase\";\nconst BAKED_HASHING_PEPPER_BUILD_PARAM = \"HashingPepper\";\n\n/**\n * Throws when the build contains the encryption passphrase or the hashing pepper. That happens when\n * webiny.config.tsx uses the shared <Infra.Crypto.*> from @webiny/project instead of the standalone\n * ones: the secret would sit in the image, and a different value in env would not match what the\n * project was configured with.\n */\nexport function assertNoBakedSecrets(buildParams: BuildParams.Interface): void {\n    const problems: string[] = [];\n\n    if (buildParams.get<string>(BAKED_ENCRYPTION_PASSPHRASE_BUILD_PARAM)) {\n        problems.push(\n            \"The build contains the encryption passphrase (EncryptionPassphrase build param), so \" +\n                \"webiny.config.tsx uses <Infra.Crypto.Encryption> from @webiny/project. Use the one \" +\n                \"from @webiny/project-standalone, which reads WEBINY_ENCRYPTION_PASSPHRASE at startup.\"\n        );\n    }\n\n    if (buildParams.get<string>(BAKED_HASHING_PEPPER_BUILD_PARAM)) {\n        problems.push(\n            \"The build contains the hashing pepper (HashingPepper build param), so webiny.config.tsx \" +\n                \"uses <Infra.Crypto.Hashing> from @webiny/project. Use the one from \" +\n                \"@webiny/project-standalone, which reads WEBINY_HASHING_PEPPER at startup.\"\n        );\n    }\n\n    if (problems.length > 0) {\n        const message = [\"The standalone API build is misconfigured:\", ...problems].join(\"\\n  \");\n        throw new Error(message);\n    }\n}\n"],"names":["BAKED_ENCRYPTION_PASSPHRASE_BUILD_PARAM","BAKED_HASHING_PEPPER_BUILD_PARAM","assertNoBakedSecrets","buildParams","problems","message","Error"],"mappings":"AAGA,MAAMA,0CAA0C;AAChD,MAAMC,mCAAmC;AAQlC,SAASC,qBAAqBC,WAAkC;IACnE,MAAMC,WAAqB,EAAE;IAE7B,IAAID,YAAY,GAAG,CAASH,0CACxBI,SAAS,IAAI,CACT;IAMR,IAAID,YAAY,GAAG,CAASF,mCACxBG,SAAS,IAAI,CACT;IAMR,IAAIA,SAAS,MAAM,GAAG,GAAG;QACrB,MAAMC,UAAU;YAAC;eAAiDD;SAAS,CAAC,IAAI,CAAC;QACjF,MAAM,IAAIE,MAAMD;IACpB;AACJ"}

package/config/readBuildParams.d.ts

@@ -1,10 +0,0 @@
-import { registerBuildParams } from "@webiny/handler";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-type Extensions = Parameters<typeof registerBuildParams>[1];
-/**
- * The build params the project was built with, read once at startup in a throwaway container.
- * Requests register them in their own containers; this copy only lets the server check them before
- * it accepts any.
- */
-export declare function readBuildParams(extensions: Extensions): Promise<BuildParams.Interface>;
-export {};

package/config/readBuildParams.js

@@ -1,13 +0,0 @@
-import { Container } from "@webiny/feature/api";
-import { registerBuildParams } from "@webiny/handler";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-import { BuildParamsFeature } from "@webiny/api-core/features/buildParams/feature.js";
-async function readBuildParams(extensions) {
-    const container = new Container();
-    BuildParamsFeature.register(container);
-    await registerBuildParams(container, extensions);
-    return container.resolve(BuildParams);
-}
-export { readBuildParams };
-
-//# sourceMappingURL=readBuildParams.js.map

package/config/readBuildParams.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config/readBuildParams.js","sources":["../../src/config/readBuildParams.ts"],"sourcesContent":["import { Container } from \"@webiny/feature/api\";\nimport { registerBuildParams } from \"@webiny/handler\";\nimport { BuildParams } from \"@webiny/api-core/features/buildParams/index.js\";\nimport { BuildParamsFeature } from \"@webiny/api-core/features/buildParams/feature.js\";\n\ntype Extensions = Parameters<typeof registerBuildParams>[1];\n\n/**\n * The build params the project was built with, read once at startup in a throwaway container.\n * Requests register them in their own containers; this copy only lets the server check them before\n * it accepts any.\n */\nexport async function readBuildParams(extensions: Extensions): Promise<BuildParams.Interface> {\n    const container = new Container();\n    BuildParamsFeature.register(container);\n    await registerBuildParams(container, extensions);\n    return container.resolve(BuildParams);\n}\n"],"names":["readBuildParams","extensions","container","Container","BuildParamsFeature","registerBuildParams","BuildParams"],"mappings":";;;;AAYO,eAAeA,gBAAgBC,UAAsB;IACxD,MAAMC,YAAY,IAAIC;IACtBC,mBAAmB,QAAQ,CAACF;IAC5B,MAAMG,oBAAoBH,WAAWD;IACrC,OAAOC,UAAU,OAAO,CAACI;AAC7B"}

package/crypto/StandaloneEncryptionConfig.d.ts

@@ -1,17 +0,0 @@
-import { EncryptionConfig } from "@webiny/api-core/features/encryption/index.js";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-import { StandaloneConfig } from "../config/abstractions.js";
-/**
- * Standalone: encryption is always on. The passphrase and salt come from env
- * (`WEBINY_ENCRYPTION_PASSPHRASE`, `WEBINY_ENCRYPTION_SALT`), the algorithm from the build.
- */
-declare class StandaloneEncryptionConfigImpl implements EncryptionConfig.Interface {
-    readonly passphrase: string;
-    readonly salt: string;
-    readonly algorithm: string;
-    constructor(config: StandaloneConfig.Interface, buildParams: BuildParams.Interface);
-}
-export declare const StandaloneEncryptionConfig: typeof StandaloneEncryptionConfigImpl & {
-    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/encryption/abstractions").IEncryptionConfig>;
-};
-export {};

package/crypto/StandaloneEncryptionConfig.js

@@ -1,20 +0,0 @@
-import { DEFAULT_ENCRYPTION_ALGORITHM, EncryptionConfig } from "@webiny/api-core/features/encryption/index.js";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-import { StandaloneConfig } from "../config/abstractions.js";
-class StandaloneEncryptionConfigImpl {
-    constructor(config, buildParams){
-        this.passphrase = config.encryption.passphrase;
-        this.salt = config.encryption.salt;
-        this.algorithm = buildParams.get("EncryptionAlgorithm") ?? DEFAULT_ENCRYPTION_ALGORITHM;
-    }
-}
-const StandaloneEncryptionConfig = EncryptionConfig.createImplementation({
-    implementation: StandaloneEncryptionConfigImpl,
-    dependencies: [
-        StandaloneConfig,
-        BuildParams
-    ]
-});
-export { StandaloneEncryptionConfig };
-
-//# sourceMappingURL=StandaloneEncryptionConfig.js.map

package/crypto/StandaloneEncryptionConfig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto/StandaloneEncryptionConfig.js","sources":["../../src/crypto/StandaloneEncryptionConfig.ts"],"sourcesContent":["import { EncryptionConfig } from \"@webiny/api-core/features/encryption/index.js\";\nimport { DEFAULT_ENCRYPTION_ALGORITHM } from \"@webiny/api-core/features/encryption/index.js\";\nimport { BuildParams } from \"@webiny/api-core/features/buildParams/index.js\";\nimport { StandaloneConfig } from \"~/config/abstractions.js\";\n\n/**\n * Standalone: encryption is always on. The passphrase and salt come from env\n * (`WEBINY_ENCRYPTION_PASSPHRASE`, `WEBINY_ENCRYPTION_SALT`), the algorithm from the build.\n */\nclass StandaloneEncryptionConfigImpl implements EncryptionConfig.Interface {\n    readonly passphrase: string;\n    readonly salt: string;\n    readonly algorithm: string;\n\n    constructor(config: StandaloneConfig.Interface, buildParams: BuildParams.Interface) {\n        this.passphrase = config.encryption.passphrase;\n        this.salt = config.encryption.salt;\n        this.algorithm =\n            buildParams.get<string>(\"EncryptionAlgorithm\") ?? DEFAULT_ENCRYPTION_ALGORITHM;\n    }\n}\n\nexport const StandaloneEncryptionConfig = EncryptionConfig.createImplementation({\n    implementation: StandaloneEncryptionConfigImpl,\n    dependencies: [StandaloneConfig, BuildParams]\n});\n"],"names":["StandaloneEncryptionConfigImpl","config","buildParams","DEFAULT_ENCRYPTION_ALGORITHM","StandaloneEncryptionConfig","EncryptionConfig","StandaloneConfig","BuildParams"],"mappings":";;;AASA,MAAMA;IAKF,YAAYC,MAAkC,EAAEC,WAAkC,CAAE;QAChF,IAAI,CAAC,UAAU,GAAGD,OAAO,UAAU,CAAC,UAAU;QAC9C,IAAI,CAAC,IAAI,GAAGA,OAAO,UAAU,CAAC,IAAI;QAClC,IAAI,CAAC,SAAS,GACVC,YAAY,GAAG,CAAS,0BAA0BC;IAC1D;AACJ;AAEO,MAAMC,6BAA6BC,iBAAiB,oBAAoB,CAAC;IAC5E,gBAAgBL;IAChB,cAAc;QAACM;QAAkBC;KAAY;AACjD"}

package/crypto/StandaloneHashingConfig.d.ts

@@ -1,16 +0,0 @@
-import { HashingConfig } from "@webiny/api-core/features/hashing/index.js";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-import { StandaloneConfig } from "../config/abstractions.js";
-/**
- * Standalone: every hash is peppered. The pepper comes from env (`WEBINY_HASHING_PEPPER`), the cost
- * from the build.
- */
-declare class StandaloneHashingConfigImpl implements HashingConfig.Interface {
-    readonly pepper: string;
-    readonly costN: number | null;
-    constructor(config: StandaloneConfig.Interface, buildParams: BuildParams.Interface);
-}
-export declare const StandaloneHashingConfig: typeof StandaloneHashingConfigImpl & {
-    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/hashing/abstractions").IHashingConfig>;
-};
-export {};

package/crypto/StandaloneHashingConfig.js

@@ -1,20 +0,0 @@
-import { HashingConfig } from "@webiny/api-core/features/hashing/index.js";
-import { BuildParams } from "@webiny/api-core/features/buildParams/index.js";
-import { StandaloneConfig } from "../config/abstractions.js";
-class StandaloneHashingConfigImpl {
-    constructor(config, buildParams){
-        this.pepper = config.hashing.pepper;
-        const costN = buildParams.get("HashingCost");
-        this.costN = costN ? Number(costN) : null;
-    }
-}
-const StandaloneHashingConfig = HashingConfig.createImplementation({
-    implementation: StandaloneHashingConfigImpl,
-    dependencies: [
-        StandaloneConfig,
-        BuildParams
-    ]
-});
-export { StandaloneHashingConfig };
-
-//# sourceMappingURL=StandaloneHashingConfig.js.map

package/crypto/StandaloneHashingConfig.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto/StandaloneHashingConfig.js","sources":["../../src/crypto/StandaloneHashingConfig.ts"],"sourcesContent":["import { HashingConfig } from \"@webiny/api-core/features/hashing/index.js\";\nimport { BuildParams } from \"@webiny/api-core/features/buildParams/index.js\";\nimport { StandaloneConfig } from \"~/config/abstractions.js\";\n\n/**\n * Standalone: every hash is peppered. The pepper comes from env (`WEBINY_HASHING_PEPPER`), the cost\n * from the build.\n */\nclass StandaloneHashingConfigImpl implements HashingConfig.Interface {\n    readonly pepper: string;\n    readonly costN: number | null;\n\n    constructor(config: StandaloneConfig.Interface, buildParams: BuildParams.Interface) {\n        this.pepper = config.hashing.pepper;\n        const costN = buildParams.get<number | string>(\"HashingCost\");\n        this.costN = costN ? Number(costN) : null;\n    }\n}\n\nexport const StandaloneHashingConfig = HashingConfig.createImplementation({\n    implementation: StandaloneHashingConfigImpl,\n    dependencies: [StandaloneConfig, BuildParams]\n});\n"],"names":["StandaloneHashingConfigImpl","config","buildParams","costN","Number","StandaloneHashingConfig","HashingConfig","StandaloneConfig","BuildParams"],"mappings":";;;AAQA,MAAMA;IAIF,YAAYC,MAAkC,EAAEC,WAAkC,CAAE;QAChF,IAAI,CAAC,MAAM,GAAGD,OAAO,OAAO,CAAC,MAAM;QACnC,MAAME,QAAQD,YAAY,GAAG,CAAkB;QAC/C,IAAI,CAAC,KAAK,GAAGC,QAAQC,OAAOD,SAAS;IACzC;AACJ;AAEO,MAAME,0BAA0BC,cAAc,oBAAoB,CAAC;IACtE,gBAAgBN;IAChB,cAAc;QAACO;QAAkBC;KAAY;AACjD"}

package/crypto/feature.d.ts

@@ -1,5 +0,0 @@
-/** Replaces api-core's build-param crypto configs with ones that read secrets from env. */
-export declare const StandaloneCryptoConfigFeature: {
-    name: string;
-    register(container: import("@webiny/di").Container): void;
-};

package/crypto/feature.js

@@ -1,13 +0,0 @@
-import { createFeature } from "@webiny/feature/api";
-import { StandaloneEncryptionConfig } from "./StandaloneEncryptionConfig.js";
-import { StandaloneHashingConfig } from "./StandaloneHashingConfig.js";
-const StandaloneCryptoConfigFeature = createFeature({
-    name: "StandaloneCryptoConfigFeature",
-    register (container) {
-        container.register(StandaloneEncryptionConfig);
-        container.register(StandaloneHashingConfig);
-    }
-});
-export { StandaloneCryptoConfigFeature };
-
-//# sourceMappingURL=feature.js.map

package/crypto/feature.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto/feature.js","sources":["../../src/crypto/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { StandaloneEncryptionConfig } from \"./StandaloneEncryptionConfig.js\";\nimport { StandaloneHashingConfig } from \"./StandaloneHashingConfig.js\";\n\n/** Replaces api-core's build-param crypto configs with ones that read secrets from env. */\nexport const StandaloneCryptoConfigFeature = createFeature({\n    name: \"StandaloneCryptoConfigFeature\",\n    register(container) {\n        container.register(StandaloneEncryptionConfig);\n        container.register(StandaloneHashingConfig);\n    }\n});\n"],"names":["StandaloneCryptoConfigFeature","createFeature","container","StandaloneEncryptionConfig","StandaloneHashingConfig"],"mappings":";;;AAKO,MAAMA,gCAAgCC,cAAc;IACvD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;IACvB;AACJ"}