@webiny/api-event-handler-standalone 6.6.0-alpha.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Webiny
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @webiny/api-event-handler-standalone
+
+> [!NOTE]
+> This package is part of the [Webiny](https://www.webiny.com) monorepo.
+> It’s **included in every Webiny project by default** and is not meant to be used as a standalone package.
+
+📘 **Documentation:** [https://www.webiny.com/docs](https://www.webiny.com/docs)
+
+---
+
+_This README file is automatically generated during the publish process._

package/bulkActions/bulkActionsServer.d.ts

@@ -0,0 +1,2 @@
+import type { Container } from "@webiny/di";
+export declare function startBulkActionsServer(rootContainer: Container): void;

package/bulkActions/bulkActionsServer.js

@@ -0,0 +1,31 @@
+import { BulkActionsInternalToken } from "@webiny/api-headless-cms-bulk-actions-standalone";
+const BULK_ACTIONS_HEADER = "x-webiny-bulk-actions-token";
+const serverBase = ()=>`http://localhost:${process.env.PORT || "3002"}`;
+const EMPTY_TRASH_INTERVAL_MS = 21600000;
+function startBulkActionsServer(rootContainer) {
+    const token = rootContainer.resolve(BulkActionsInternalToken).value;
+    const trigger = async ()=>{
+        try {
+            const res = await fetch(`${serverBase()}/empty-trash-bins`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    [BULK_ACTIONS_HEADER]: token
+                },
+                body: JSON.stringify({})
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(()=>"");
+                console.error(`[bulk-actions] empty-trash-bins returned HTTP ${res.status}: ${body}`);
+            }
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`[bulk-actions] failed to reach empty-trash-bins route: ${message}`);
+        }
+    };
+    setTimeout(trigger, 5000);
+    setInterval(trigger, EMPTY_TRASH_INTERVAL_MS);
+}
+export { startBulkActionsServer };
+
+//# sourceMappingURL=bulkActionsServer.js.map

package/bulkActions/bulkActionsServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulkActions/bulkActionsServer.js","sources":["../../src/bulkActions/bulkActionsServer.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport { BulkActionsInternalToken } from \"@webiny/api-headless-cms-bulk-actions-standalone\";\n\nconst BULK_ACTIONS_HEADER = \"x-webiny-bulk-actions-token\";\nconst serverBase = () => `http://localhost:${process.env.PORT || \"3002\"}`;\n\n// Default: trigger every 6 hours (in milliseconds).\nconst EMPTY_TRASH_INTERVAL_MS = 6 * 60 * 60 * 1000;\n\nexport function startBulkActionsServer(rootContainer: Container): void {\n    const token = rootContainer.resolve(BulkActionsInternalToken).value;\n\n    const trigger = async () => {\n        try {\n            const res = await fetch(`${serverBase()}/empty-trash-bins`, {\n                method: \"POST\",\n                headers: { \"content-type\": \"application/json\", [BULK_ACTIONS_HEADER]: token },\n                body: JSON.stringify({})\n            });\n            if (!res.ok) {\n                const body = await res.text().catch(() => \"\");\n                console.error(\n                    `[bulk-actions] empty-trash-bins returned HTTP ${res.status}: ${body}`\n                );\n            }\n        } catch (err) {\n            const message = err instanceof Error ? err.message : String(err);\n            console.error(`[bulk-actions] failed to reach empty-trash-bins route: ${message}`);\n        }\n    };\n\n    // Deferred initial trigger + periodic interval.\n    setTimeout(trigger, 5000);\n    setInterval(trigger, EMPTY_TRASH_INTERVAL_MS);\n}\n"],"names":["BULK_ACTIONS_HEADER","serverBase","process","EMPTY_TRASH_INTERVAL_MS","startBulkActionsServer","rootContainer","token","BulkActionsInternalToken","trigger","res","fetch","JSON","body","console","err","message","Error","String","setTimeout","setInterval"],"mappings":";AAGA,MAAMA,sBAAsB;AAC5B,MAAMC,aAAa,IAAM,CAAC,iBAAiB,EAAEC,QAAQ,GAAG,CAAC,IAAI,IAAI,QAAQ;AAGzE,MAAMC,0BAA0B;AAEzB,SAASC,uBAAuBC,aAAwB;IAC3D,MAAMC,QAAQD,cAAc,OAAO,CAACE,0BAA0B,KAAK;IAEnE,MAAMC,UAAU;QACZ,IAAI;YACA,MAAMC,MAAM,MAAMC,MAAM,GAAGT,aAAa,iBAAiB,CAAC,EAAE;gBACxD,QAAQ;gBACR,SAAS;oBAAE,gBAAgB;oBAAoB,CAACD,oBAAoB,EAAEM;gBAAM;gBAC5E,MAAMK,KAAK,SAAS,CAAC,CAAC;YAC1B;YACA,IAAI,CAACF,IAAI,EAAE,EAAE;gBACT,MAAMG,OAAO,MAAMH,IAAI,IAAI,GAAG,KAAK,CAAC,IAAM;gBAC1CI,QAAQ,KAAK,CACT,CAAC,8CAA8C,EAAEJ,IAAI,MAAM,CAAC,EAAE,EAAEG,MAAM;YAE9E;QACJ,EAAE,OAAOE,KAAK;YACV,MAAMC,UAAUD,eAAeE,QAAQF,IAAI,OAAO,GAAGG,OAAOH;YAC5DD,QAAQ,KAAK,CAAC,CAAC,uDAAuD,EAAEE,SAAS;QACrF;IACJ;IAGAG,WAAWV,SAAS;IACpBW,YAAYX,SAASL;AACzB"}

package/createWebinyApiHandler.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Webiny API handler for the standalone Node HTTP server transport — storage-agnostic BASE.
+ *
+ * The ROOT container wires the Node HTTP transport (NodeHttpFeature = event type + router + HttpFeature)
+ * plus the auth/tenant loader decorators (extract token / x-tenant from the IncomingMessage → shared
+ * RequestIdentityLoader / RequestTenantLoader). The per-request feature stack is the transport-agnostic
+ * `registerApiRequestStack` from `@webiny/api-event-handler-core` — the SAME stack the AWS handler uses.
+ * The realtime transport hook installs the server WebSockets transport (vs AWS's API Gateway Management
+ * API) with a SINGLE-PROCESS, in-process implementation. Background tasks and the Bree scheduler are
+ * ROOT-container singletons (below) — mirroring how the AWS handler registers background tasks at root,
+ * and the WebSockets connection manager — rather than per-request transports; the scheduler fires timers
+ * in-process (vs AWS's EventBridge). The storage variant (and identity provider) is injected via
+ * `registerRootStorage`.
+ *
+ * The identity provider (e.g. `@webiny/self-hosted-auth`'s JWT IdP) must be registered by the variant
+ * in `registerRootStorage`, so the RequestIdentityLoader driven by the identity decorator can resolve it.
+ */
+import type { Container } from "@webiny/di";
+import { registerExtensions } from "@webiny/handler";
+export interface CreateWebinyApiHandlerConfig {
+    /**
+     * Project-defined extensions, applied at register() time.
+     */
+    extensions: () => Parameters<typeof registerExtensions>[1];
+    /**
+     * Register ALL root-container storage for this deployment (the DB feature + CMS storage ops +
+     * registries) AND the identity provider. Unlike the AWS base, the server base bakes in no DB or
+     * IdP assumption — the variant supplies the complete storage + auth wiring.
+     */
+    registerRootStorage: (container: Container) => void | Promise<void>;
+}
+export declare function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig): Promise<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>>;

package/createWebinyApiHandler.js

@@ -0,0 +1,52 @@
+import { NodeHttpFeature, createServerHandler } from "@webiny/event-handler-standalone";
+import { registerApiRequestStack } from "@webiny/api-event-handler-core";
+import { NodeWsAdapter, ServerConnectionManager, WebsocketsConnectionManager, WebsocketsStandaloneFeature, attachWebsocketsServer } from "@webiny/api-websockets-standalone";
+import { BackgroundTasksStandaloneFeature } from "@webiny/background-tasks-standalone";
+import { FileManagerStandaloneFeature } from "@webiny/api-file-manager-standalone";
+import { registerSchedulerServer, startSchedulerServer } from "./scheduler/schedulerServer.js";
+import { startBulkActionsServer } from "./bulkActions/bulkActionsServer.js";
+import { NodeHttpIdentityLoaderDecorator } from "./handlers/NodeHttpIdentityLoaderDecorator.js";
+import { NodeHttpTenantLoaderDecorator } from "./handlers/NodeHttpTenantLoaderDecorator.js";
+import { createWebsocketsAuthenticator } from "./websockets/createWebsocketsAuthenticator.js";
+import { EmptyTrashBinRouteFeature } from "@webiny/api-headless-cms-bulk-actions-standalone";
+function createWebinyApiHandler(config) {
+    return createServerHandler({
+        root: async (rootContainer)=>{
+            NodeHttpFeature.register(rootContainer);
+            rootContainer.registerDecorator(NodeHttpIdentityLoaderDecorator);
+            rootContainer.registerDecorator(NodeHttpTenantLoaderDecorator);
+            await config.registerRootStorage(rootContainer);
+            rootContainer.register(ServerConnectionManager).inSingletonScope();
+            rootContainer.register(NodeWsAdapter).inSingletonScope();
+            BackgroundTasksStandaloneFeature.register(rootContainer);
+            registerSchedulerServer(rootContainer);
+            EmptyTrashBinRouteFeature.register(rootContainer);
+        },
+        child: async (container)=>{
+            await registerApiRequestStack(container, {
+                extensions: config.extensions,
+                transports: {
+                    realtime: (requestContainer)=>{
+                        WebsocketsStandaloneFeature.register(requestContainer);
+                    },
+                    fileManager: (requestContainer)=>{
+                        FileManagerStandaloneFeature.register(requestContainer);
+                    }
+                }
+            });
+        },
+        onServer: async (server, rootContainer)=>{
+            const websockets = attachWebsocketsServer({
+                server,
+                connectionManager: rootContainer.resolve(WebsocketsConnectionManager),
+                authenticate: createWebsocketsAuthenticator(rootContainer, config.extensions)
+            });
+            await websockets.start();
+            await startSchedulerServer(rootContainer);
+            startBulkActionsServer(rootContainer);
+        }
+    });
+}
+export { createWebinyApiHandler };
+
+//# sourceMappingURL=createWebinyApiHandler.js.map

package/createWebinyApiHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWebinyApiHandler.js","sources":["../src/createWebinyApiHandler.ts"],"sourcesContent":["/**\n * Webiny API handler for the standalone Node HTTP server transport — storage-agnostic BASE.\n *\n * The ROOT container wires the Node HTTP transport (NodeHttpFeature = event type + router + HttpFeature)\n * plus the auth/tenant loader decorators (extract token / x-tenant from the IncomingMessage → shared\n * RequestIdentityLoader / RequestTenantLoader). The per-request feature stack is the transport-agnostic\n * `registerApiRequestStack` from `@webiny/api-event-handler-core` — the SAME stack the AWS handler uses.\n * The realtime transport hook installs the server WebSockets transport (vs AWS's API Gateway Management\n * API) with a SINGLE-PROCESS, in-process implementation. Background tasks and the Bree scheduler are\n * ROOT-container singletons (below) — mirroring how the AWS handler registers background tasks at root,\n * and the WebSockets connection manager — rather than per-request transports; the scheduler fires timers\n * in-process (vs AWS's EventBridge). The storage variant (and identity provider) is injected via\n * `registerRootStorage`.\n *\n * The identity provider (e.g. `@webiny/self-hosted-auth`'s JWT IdP) must be registered by the variant\n * in `registerRootStorage`, so the RequestIdentityLoader driven by the identity decorator can resolve it.\n */\nimport type { Container } from \"@webiny/di\";\nimport { createServerHandler, NodeHttpFeature } from \"@webiny/event-handler-standalone\";\nimport { registerExtensions } from \"@webiny/handler\";\nimport { registerApiRequestStack } from \"@webiny/api-event-handler-core\";\nimport {\n    ServerConnectionManager,\n    NodeWsAdapter,\n    WebsocketsStandaloneFeature,\n    WebsocketsConnectionManager,\n    attachWebsocketsServer\n} from \"@webiny/api-websockets-standalone\";\nimport { BackgroundTasksStandaloneFeature } from \"@webiny/background-tasks-standalone\";\nimport { FileManagerStandaloneFeature } from \"@webiny/api-file-manager-standalone\";\nimport { registerSchedulerServer, startSchedulerServer } from \"~/scheduler/schedulerServer.js\";\nimport { startBulkActionsServer } from \"~/bulkActions/bulkActionsServer.js\";\nimport { NodeHttpIdentityLoaderDecorator } from \"~/handlers/NodeHttpIdentityLoaderDecorator.js\";\nimport { NodeHttpTenantLoaderDecorator } from \"~/handlers/NodeHttpTenantLoaderDecorator.js\";\nimport { createWebsocketsAuthenticator } from \"~/websockets/createWebsocketsAuthenticator.js\";\nimport { EmptyTrashBinRouteFeature } from \"@webiny/api-headless-cms-bulk-actions-standalone\";\n\nexport interface CreateWebinyApiHandlerConfig {\n    /**\n     * Project-defined extensions, applied at register() time.\n     */\n    extensions: () => Parameters<typeof registerExtensions>[1];\n    /**\n     * Register ALL root-container storage for this deployment (the DB feature + CMS storage ops +\n     * registries) AND the identity provider. Unlike the AWS base, the server base bakes in no DB or\n     * IdP assumption — the variant supplies the complete storage + auth wiring.\n     */\n    registerRootStorage: (container: Container) => void | Promise<void>;\n}\n\nexport function createWebinyApiHandler(config: CreateWebinyApiHandlerConfig) {\n    return createServerHandler({\n        root: async rootContainer => {\n            // ── Transport (Node HTTP) ──────────────────────────────────\n            // NodeHttpFeature registers the event type + HttpFeature (router) + the routing terminal.\n            NodeHttpFeature.register(rootContainer);\n\n            // ── Tenant + auth (extract → shared load) ──────────────────\n            // registerDecorator applies LATER registrations as the OUTER wrapper (whose execute()\n            // runs first). TENANT must be established before IDENTITY: API-key authentication resolves\n            // the key by tenant partition (ApiKeysRepository reads TenantContext.getTenant()), so\n            // identity depends on the tenant; the reverse is not true (RequestTenantLoader has no\n            // identity dependency). Register identity first (inner) and tenant last (outer) → tenant\n            // runs, then identity, then the router.\n            rootContainer.registerDecorator(NodeHttpIdentityLoaderDecorator);\n            rootContainer.registerDecorator(NodeHttpTenantLoaderDecorator);\n\n            // ── Storage + identity provider (variant-supplied) ─────────\n            await config.registerRootStorage(rootContainer);\n\n            // ── WebSockets transport (root) ────────────────────────────\n            // Live-socket registry + adapter live in the root as singletons: the connection manager\n            // is shared between the upgrade acceptor (attachWebsocketsServer, below) and the\n            // per-request ServerWebsocketsTransport that sends to those live sockets. The persistent\n            // connection registry (ConnectionRegistry) is the storage variant's job (e.g. sql).\n            rootContainer.register(ServerConnectionManager).inSingletonScope();\n            rootContainer.register(NodeWsAdapter).inSingletonScope();\n\n            // ── Background tasks (root) ────────────────────────────────\n            // Mirrors the AWS handler registering its background-task transport at root. There is no\n            // Step Functions / Lambda re-invocation in a single process, so the transport is in-process:\n            // WorkerService (the BackgroundTasks/TaskService dispatch abstraction) runs each triggered\n            // task in a Node worker_thread that POSTs back to this server's `/background-task` HTTP route\n            // (BackgroundTaskRoute), which runs the task loop (continue/timeout/abort) in-process. Root,\n            // not per-request, is load-bearing: the shared InternalToken (registered here as a singleton)\n            // gates the route against the worker's callback, so dispatcher and route MUST see the SAME\n            // token — a per-request registration would mint a fresh token per request and always 403.\n            // The route is an HttpRoute; the per-request HttpRouter collects it via the parent chain.\n            BackgroundTasksStandaloneFeature.register(rootContainer);\n\n            // ── Scheduler (root) ───────────────────────────────────────\n            // The Bree scheduler is a single long-lived instance for ALL tenants, started once at boot\n            // (onServer, below) — the counterpart of the WebSockets connection manager, NOT a per-request\n            // transport. Registered here as SchedulerService (per-request create/update/delete during\n            // mutations manipulate this one live timer set) plus the run/recover HTTP routes + internal\n            // token. When a timer fires (outside any request) it POSTs `/scheduled-action-run`, which\n            // rebuilds the tenant's request context and executes the action.\n            registerSchedulerServer(rootContainer);\n\n            // ── Bulk actions (root) ───────────────────────────────────\n            // Registers the `/empty-trash-bins` HTTP route + internal token so the periodic trigger\n            // (startBulkActionsServer, onServer below) can POST to it after the server is listening.\n            EmptyTrashBinRouteFeature.register(rootContainer);\n        },\n\n        child: async container => {\n            // The transport-agnostic per-request stack. The realtime hook installs the server\n            // WebSockets transport (overriding the domain's NullWebsocketsTransport); it resolves the\n            // shared connection manager + adapter from the root. Scheduler is NOT a per-request\n            // transport here — it's a root singleton wired in `root` + `onServer` (see above).\n            await registerApiRequestStack(container, {\n                extensions: config.extensions,\n                // Why hooks (and not just registering the transports ourselves): `.register()` calls\n                // are otherwise order-independent — you can register Features in any order, because\n                // they only REGISTER, they don't RESOLVE during registration (resolution happens\n                // later, in Initializers / SchemaFactories). The one thing that makes order matter is\n                // a DEFAULT registration: e.g. `WebsocketsFeature` registers `NullWebsocketsTransport`\n                // so the abstraction is always resolvable. Overriding it (last-registration-wins) means\n                // our transport MUST be registered AFTER that Feature. These hooks are the seams\n                // `registerApiRequestStack` provides for exactly that — each runs right after its Null\n                // default, so the override is guaranteed without the caller knowing the internal order.\n                transports: {\n                    // Server WebSockets transport; resolves the shared connection manager + adapter\n                    // from the root (registered as singletons above).\n                    realtime: requestContainer => {\n                        WebsocketsStandaloneFeature.register(requestContainer);\n                    },\n                    // File-manager storage transport: local disk. Where AWS uses S3 (+ a separate asset-\n                    // delivery Lambda), the single-process server stores files on disk and serves them\n                    // in-process — FileManagerStandaloneFeature registers local asset delivery (overriding\n                    // the domain's null impls), the upload/multipart HTTP routes, and disk file ops.\n                    fileManager: requestContainer => {\n                        FileManagerStandaloneFeature.register(requestContainer);\n                    }\n                }\n            });\n        },\n\n        onServer: async (server, rootContainer) => {\n            // Attach the WebSockets upgrade handler to the running HTTP server, backed by the shared\n            // (root) connection manager so request-time sends reach the live sockets.\n            //\n            // Authenticate each WebSocket connection from its `?token` JWT so it's registered under\n            // the real identity (targeted server→client sends match by identity id). It's a callback\n            // the handler supplies rather than something the WS server resolves itself — see\n            // createWebsocketsAuthenticator for why (AuthenticationContext is per-request, unreachable\n            // from the root container the WS server is attached to).\n            const websockets = attachWebsocketsServer({\n                server,\n                connectionManager: rootContainer.resolve(WebsocketsConnectionManager),\n                authenticate: createWebsocketsAuthenticator(rootContainer, config.extensions)\n            });\n            await websockets.start();\n\n            // Start the in-process scheduler timers, then re-arm persisted schedules (deferred until\n            // the server is listening — see startSchedulerServer).\n            await startSchedulerServer(rootContainer);\n\n            // Start the periodic empty-trash-bin trigger (deferred until the server is listening).\n            startBulkActionsServer(rootContainer);\n        }\n    });\n}\n"],"names":["createWebinyApiHandler","config","createServerHandler","rootContainer","NodeHttpFeature","NodeHttpIdentityLoaderDecorator","NodeHttpTenantLoaderDecorator","ServerConnectionManager","NodeWsAdapter","BackgroundTasksStandaloneFeature","registerSchedulerServer","EmptyTrashBinRouteFeature","container","registerApiRequestStack","requestContainer","WebsocketsStandaloneFeature","FileManagerStandaloneFeature","server","websockets","attachWebsocketsServer","WebsocketsConnectionManager","createWebsocketsAuthenticator","startSchedulerServer","startBulkActionsServer"],"mappings":";;;;;;;;;;;AAkDO,SAASA,uBAAuBC,MAAoC;IACvE,OAAOC,oBAAoB;QACvB,MAAM,OAAMC;YAGRC,gBAAgB,QAAQ,CAACD;YASzBA,cAAc,iBAAiB,CAACE;YAChCF,cAAc,iBAAiB,CAACG;YAGhC,MAAML,OAAO,mBAAmB,CAACE;YAOjCA,cAAc,QAAQ,CAACI,yBAAyB,gBAAgB;YAChEJ,cAAc,QAAQ,CAACK,eAAe,gBAAgB;YAYtDC,iCAAiC,QAAQ,CAACN;YAS1CO,wBAAwBP;YAKxBQ,0BAA0B,QAAQ,CAACR;QACvC;QAEA,OAAO,OAAMS;YAKT,MAAMC,wBAAwBD,WAAW;gBACrC,YAAYX,OAAO,UAAU;gBAU7B,YAAY;oBAGR,UAAUa,CAAAA;wBACNC,4BAA4B,QAAQ,CAACD;oBACzC;oBAKA,aAAaA,CAAAA;wBACTE,6BAA6B,QAAQ,CAACF;oBAC1C;gBACJ;YACJ;QACJ;QAEA,UAAU,OAAOG,QAAQd;YASrB,MAAMe,aAAaC,uBAAuB;gBACtCF;gBACA,mBAAmBd,cAAc,OAAO,CAACiB;gBACzC,cAAcC,8BAA8BlB,eAAeF,OAAO,UAAU;YAChF;YACA,MAAMiB,WAAW,KAAK;YAItB,MAAMI,qBAAqBnB;YAG3BoB,uBAAuBpB;QAC3B;IACJ;AACJ"}

package/handlers/NodeHttpIdentityLoaderDecorator.d.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage } from "node:http";
+import { NodeHttpEventHandler } from "@webiny/event-handler-standalone";
+import { RawAuthToken } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestIdentityLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the auth token from a Node `IncomingMessage` —
+ * `x-webiny-authorization` first, then the bearer `Authorization` header, then the `wby-id-token`
+ * cookie — into RawAuthToken, then invokes the shared LOAD step (RequestIdentityLoader) which
+ * authenticates it (via the registered identity provider, e.g. the self-hosted JWT IdP) and sets
+ * IdentityContext.
+ *
+ * `x-webiny-authorization` exists for AWS parity: behind CloudFront with Origin Access Control, SigV4
+ * occupies the `Authorization` header, so clients that may traverse such an origin send the token in
+ * that header instead. Standalone has no such constraint, but it accepts the same header so one
+ * client works against both deployments.
+ *
+ * Node mirror of ApiGatewayIdentityLoaderDecorator. Registered BEFORE the tenant loader so identity
+ * is established before tenant.
+ */
+declare class NodeHttpIdentityLoaderDecoratorImpl implements NodeHttpEventHandler.Interface {
+    private rawAuthToken;
+    private identityLoader;
+    private decoratee;
+    constructor(rawAuthToken: RawAuthToken.Interface, identityLoader: IRequestIdentityLoader, decoratee: NodeHttpEventHandler.Interface);
+    execute(ctx: EventContext<IncomingMessage>, next: NextFunction): Promise<any>;
+    private extractToken;
+}
+export declare const NodeHttpIdentityLoaderDecorator: typeof NodeHttpIdentityLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-standalone").INodeHttpEventHandler>;
+};
+export {};

package/handlers/NodeHttpIdentityLoaderDecorator.js

@@ -0,0 +1,45 @@
+import { NodeHttpEventHandler } from "@webiny/event-handler-standalone";
+import { RawAuthToken, RequestIdentityLoader } from "@webiny/api-core/features/requestContext/index.js";
+function headerValue(value) {
+    if (Array.isArray(value)) return value[0] ?? "";
+    return value ?? "";
+}
+function parseCookieHeader(cookieHeader) {
+    return cookieHeader.split(";").reduce((acc, pair)=>{
+        const idx = pair.indexOf("=");
+        if (idx > 0) acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());
+        return acc;
+    }, {});
+}
+class NodeHttpIdentityLoaderDecoratorImpl {
+    constructor(rawAuthToken, identityLoader, decoratee){
+        this.rawAuthToken = rawAuthToken;
+        this.identityLoader = identityLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        this.rawAuthToken.set(this.extractToken(ctx.event));
+        await this.identityLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+    extractToken(event) {
+        const headers = event?.headers;
+        if (!headers) return null;
+        const webinyAuth = headerValue(headers["x-webiny-authorization"] ?? headers["X-Webiny-Authorization"]).replace(/^Bearer\s+/i, "");
+        if (webinyAuth) return webinyAuth;
+        const bearer = headerValue(headers["authorization"] ?? headers["Authorization"]).replace(/^Bearer\s+/i, "");
+        if (bearer) return bearer;
+        const cookieHeader = headerValue(headers["cookie"] ?? headers["Cookie"]);
+        return parseCookieHeader(cookieHeader)["wby-id-token"] ?? null;
+    }
+}
+const NodeHttpIdentityLoaderDecorator = NodeHttpEventHandler.createDecorator({
+    decorator: NodeHttpIdentityLoaderDecoratorImpl,
+    dependencies: [
+        RawAuthToken,
+        RequestIdentityLoader
+    ]
+});
+export { NodeHttpIdentityLoaderDecorator };
+
+//# sourceMappingURL=NodeHttpIdentityLoaderDecorator.js.map

package/handlers/NodeHttpIdentityLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/NodeHttpIdentityLoaderDecorator.js","sources":["../../src/handlers/NodeHttpIdentityLoaderDecorator.ts"],"sourcesContent":["import type { IncomingMessage } from \"node:http\";\nimport { NodeHttpEventHandler } from \"@webiny/event-handler-standalone\";\nimport {\n    RawAuthToken,\n    RequestIdentityLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestIdentityLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\nfunction headerValue(value: string | string[] | undefined): string {\n    if (Array.isArray(value)) {\n        return value[0] ?? \"\";\n    }\n    return value ?? \"\";\n}\n\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n    return cookieHeader.split(\";\").reduce<Record<string, string>>((acc, pair) => {\n        const idx = pair.indexOf(\"=\");\n        if (idx > 0) {\n            acc[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());\n        }\n        return acc;\n    }, {});\n}\n\n/**\n * EXTRACT (transport-specific): reads the auth token from a Node `IncomingMessage` —\n * `x-webiny-authorization` first, then the bearer `Authorization` header, then the `wby-id-token`\n * cookie — into RawAuthToken, then invokes the shared LOAD step (RequestIdentityLoader) which\n * authenticates it (via the registered identity provider, e.g. the self-hosted JWT IdP) and sets\n * IdentityContext.\n *\n * `x-webiny-authorization` exists for AWS parity: behind CloudFront with Origin Access Control, SigV4\n * occupies the `Authorization` header, so clients that may traverse such an origin send the token in\n * that header instead. Standalone has no such constraint, but it accepts the same header so one\n * client works against both deployments.\n *\n * Node mirror of ApiGatewayIdentityLoaderDecorator. Registered BEFORE the tenant loader so identity\n * is established before tenant.\n */\nclass NodeHttpIdentityLoaderDecoratorImpl implements NodeHttpEventHandler.Interface {\n    constructor(\n        private rawAuthToken: RawAuthToken.Interface,\n        private identityLoader: IRequestIdentityLoader,\n        private decoratee: NodeHttpEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<IncomingMessage>, next: NextFunction): Promise<any> {\n        this.rawAuthToken.set(this.extractToken(ctx.event));\n        await this.identityLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n\n    private extractToken(event: IncomingMessage): string | null {\n        const headers = event?.headers;\n        if (!headers) {\n            return null;\n        }\n        const webinyAuth = headerValue(\n            headers[\"x-webiny-authorization\"] ?? headers[\"X-Webiny-Authorization\"]\n        ).replace(/^Bearer\\s+/i, \"\");\n        if (webinyAuth) {\n            return webinyAuth;\n        }\n        const bearer = headerValue(headers[\"authorization\"] ?? headers[\"Authorization\"]).replace(\n            /^Bearer\\s+/i,\n            \"\"\n        );\n        if (bearer) {\n            return bearer;\n        }\n        const cookieHeader = headerValue(headers[\"cookie\"] ?? headers[\"Cookie\"]);\n        return parseCookieHeader(cookieHeader)[\"wby-id-token\"] ?? null;\n    }\n}\n\nexport const NodeHttpIdentityLoaderDecorator = NodeHttpEventHandler.createDecorator({\n    decorator: NodeHttpIdentityLoaderDecoratorImpl,\n    dependencies: [RawAuthToken, RequestIdentityLoader]\n});\n"],"names":["headerValue","value","Array","parseCookieHeader","cookieHeader","acc","pair","idx","decodeURIComponent","NodeHttpIdentityLoaderDecoratorImpl","rawAuthToken","identityLoader","decoratee","ctx","next","event","headers","webinyAuth","bearer","NodeHttpIdentityLoaderDecorator","NodeHttpEventHandler","RawAuthToken","RequestIdentityLoader"],"mappings":";;AASA,SAASA,YAAYC,KAAoC;IACrD,IAAIC,MAAM,OAAO,CAACD,QACd,OAAOA,KAAK,CAAC,EAAE,IAAI;IAEvB,OAAOA,SAAS;AACpB;AAEA,SAASE,kBAAkBC,YAAoB;IAC3C,OAAOA,aAAa,KAAK,CAAC,KAAK,MAAM,CAAyB,CAACC,KAAKC;QAChE,MAAMC,MAAMD,KAAK,OAAO,CAAC;QACzB,IAAIC,MAAM,GACNF,GAAG,CAACC,KAAK,KAAK,CAAC,GAAGC,KAAK,IAAI,GAAG,GAAGC,mBAAmBF,KAAK,KAAK,CAACC,MAAM,GAAG,IAAI;QAEhF,OAAOF;IACX,GAAG,CAAC;AACR;AAiBA,MAAMI;IACF,YACYC,YAAoC,EACpCC,cAAsC,EACtCC,SAAyC,CACnD;aAHUF,YAAY,GAAZA;aACAC,cAAc,GAAdA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAkC,EAAEC,IAAkB,EAAgB;QAChF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAACD,IAAI,KAAK;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACA,KAAKC;IACvC;IAEQ,aAAaC,KAAsB,EAAiB;QACxD,MAAMC,UAAUD,OAAO;QACvB,IAAI,CAACC,SACD,OAAO;QAEX,MAAMC,aAAajB,YACfgB,OAAO,CAAC,yBAAyB,IAAIA,OAAO,CAAC,yBAAyB,EACxE,OAAO,CAAC,eAAe;QACzB,IAAIC,YACA,OAAOA;QAEX,MAAMC,SAASlB,YAAYgB,OAAO,CAAC,gBAAgB,IAAIA,OAAO,CAAC,gBAAgB,EAAE,OAAO,CACpF,eACA;QAEJ,IAAIE,QACA,OAAOA;QAEX,MAAMd,eAAeJ,YAAYgB,OAAO,CAAC,SAAS,IAAIA,OAAO,CAAC,SAAS;QACvE,OAAOb,kBAAkBC,aAAa,CAAC,eAAe,IAAI;IAC9D;AACJ;AAEO,MAAMe,kCAAkCC,qBAAqB,eAAe,CAAC;IAChF,WAAWX;IACX,cAAc;QAACY;QAAcC;KAAsB;AACvD"}

package/handlers/NodeHttpTenantLoaderDecorator.d.ts

@@ -0,0 +1,24 @@
+import type { IncomingMessage } from "node:http";
+import { NodeHttpEventHandler } from "@webiny/event-handler-standalone";
+import { RawTenantId } from "@webiny/api-core/features/requestContext/index.js";
+import type { IRequestTenantLoader } from "@webiny/api-core/features/requestContext/abstractions.js";
+import type { EventContext, NextFunction } from "@webiny/event-handler-core";
+/**
+ * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of a Node
+ * `IncomingMessage` into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which
+ * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the loader
+ * defaults to the "root" tenant.
+ *
+ * Node mirror of ApiGatewayTenantLoaderDecorator. Registered AFTER the identity loader.
+ */
+declare class NodeHttpTenantLoaderDecoratorImpl implements NodeHttpEventHandler.Interface {
+    private rawTenantId;
+    private tenantLoader;
+    private decoratee;
+    constructor(rawTenantId: RawTenantId.Interface, tenantLoader: IRequestTenantLoader, decoratee: NodeHttpEventHandler.Interface);
+    execute(ctx: EventContext<IncomingMessage>, next: NextFunction): Promise<any>;
+}
+export declare const NodeHttpTenantLoaderDecorator: typeof NodeHttpTenantLoaderDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-standalone").INodeHttpEventHandler>;
+};
+export {};

package/handlers/NodeHttpTenantLoaderDecorator.js

@@ -0,0 +1,29 @@
+import { NodeHttpEventHandler } from "@webiny/event-handler-standalone";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+function headerValue(value) {
+    if (Array.isArray(value)) return value[0] ?? null;
+    return value ?? null;
+}
+class NodeHttpTenantLoaderDecoratorImpl {
+    constructor(rawTenantId, tenantLoader, decoratee){
+        this.rawTenantId = rawTenantId;
+        this.tenantLoader = tenantLoader;
+        this.decoratee = decoratee;
+    }
+    async execute(ctx, next) {
+        const headers = ctx.event?.headers;
+        this.rawTenantId.set(headers ? headerValue(headers["x-tenant"] ?? headers["X-Tenant"]) : null);
+        await this.tenantLoader.establish();
+        return this.decoratee.execute(ctx, next);
+    }
+}
+const NodeHttpTenantLoaderDecorator = NodeHttpEventHandler.createDecorator({
+    decorator: NodeHttpTenantLoaderDecoratorImpl,
+    dependencies: [
+        RawTenantId,
+        RequestTenantLoader
+    ]
+});
+export { NodeHttpTenantLoaderDecorator };
+
+//# sourceMappingURL=NodeHttpTenantLoaderDecorator.js.map

package/handlers/NodeHttpTenantLoaderDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers/NodeHttpTenantLoaderDecorator.js","sources":["../../src/handlers/NodeHttpTenantLoaderDecorator.ts"],"sourcesContent":["import type { IncomingMessage } from \"node:http\";\nimport { NodeHttpEventHandler } from \"@webiny/event-handler-standalone\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport type { IRequestTenantLoader } from \"@webiny/api-core/features/requestContext/abstractions.js\";\nimport type { EventContext, NextFunction } from \"@webiny/event-handler-core\";\n\nfunction headerValue(value: string | string[] | undefined): string | null {\n    if (Array.isArray(value)) {\n        return value[0] ?? null;\n    }\n    return value ?? null;\n}\n\n/**\n * EXTRACT (transport-specific): reads the tenant id from the `x-tenant` header of a Node\n * `IncomingMessage` into RawTenantId, then invokes the shared LOAD step (RequestTenantLoader) which\n * resolves the Tenant and sets TenantContext. A missing header leaves RawTenantId null → the loader\n * defaults to the \"root\" tenant.\n *\n * Node mirror of ApiGatewayTenantLoaderDecorator. Registered AFTER the identity loader.\n */\nclass NodeHttpTenantLoaderDecoratorImpl implements NodeHttpEventHandler.Interface {\n    constructor(\n        private rawTenantId: RawTenantId.Interface,\n        private tenantLoader: IRequestTenantLoader,\n        private decoratee: NodeHttpEventHandler.Interface\n    ) {}\n\n    async execute(ctx: EventContext<IncomingMessage>, next: NextFunction): Promise<any> {\n        const headers = ctx.event?.headers;\n        this.rawTenantId.set(\n            headers ? headerValue(headers[\"x-tenant\"] ?? headers[\"X-Tenant\"]) : null\n        );\n        await this.tenantLoader.establish();\n        return this.decoratee.execute(ctx, next);\n    }\n}\n\nexport const NodeHttpTenantLoaderDecorator = NodeHttpEventHandler.createDecorator({\n    decorator: NodeHttpTenantLoaderDecoratorImpl,\n    dependencies: [RawTenantId, RequestTenantLoader]\n});\n"],"names":["headerValue","value","Array","NodeHttpTenantLoaderDecoratorImpl","rawTenantId","tenantLoader","decoratee","ctx","next","headers","NodeHttpTenantLoaderDecorator","NodeHttpEventHandler","RawTenantId","RequestTenantLoader"],"mappings":";;AASA,SAASA,YAAYC,KAAoC;IACrD,IAAIC,MAAM,OAAO,CAACD,QACd,OAAOA,KAAK,CAAC,EAAE,IAAI;IAEvB,OAAOA,SAAS;AACpB;AAUA,MAAME;IACF,YACYC,WAAkC,EAClCC,YAAkC,EAClCC,SAAyC,CACnD;aAHUF,WAAW,GAAXA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,GAAkC,EAAEC,IAAkB,EAAgB;QAChF,MAAMC,UAAUF,IAAI,KAAK,EAAE;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAChBE,UAAUT,YAAYS,OAAO,CAAC,WAAW,IAAIA,OAAO,CAAC,WAAW,IAAI;QAExE,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,KAAKC;IACvC;AACJ;AAEO,MAAME,gCAAgCC,qBAAqB,eAAe,CAAC;IAC9E,WAAWR;IACX,cAAc;QAACS;QAAaC;KAAoB;AACpD"}

package/index.d.ts

@@ -0,0 +1,4 @@
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";
+export type { CreateWebinyApiHandlerConfig } from "./createWebinyApiHandler.js";
+export { NodeHttpIdentityLoaderDecorator } from "./handlers/NodeHttpIdentityLoaderDecorator.js";
+export { NodeHttpTenantLoaderDecorator } from "./handlers/NodeHttpTenantLoaderDecorator.js";

package/index.js

@@ -0,0 +1,3 @@
+export { createWebinyApiHandler } from "./createWebinyApiHandler.js";
+export { NodeHttpIdentityLoaderDecorator } from "./handlers/NodeHttpIdentityLoaderDecorator.js";
+export { NodeHttpTenantLoaderDecorator } from "./handlers/NodeHttpTenantLoaderDecorator.js";

package/package.json

@@ -0,0 +1,52 @@
+{
+	"name": "@webiny/api-event-handler-standalone",
+	"version": "6.6.0-alpha.4",
+	"type": "module",
+	"main": "index.js",
+	"exports": {
+		".": "./index.js",
+		"./*": "./*"
+	},
+	"types": "index.d.ts",
+	"description": "EXPERIMENTAL: Webiny API handler for the standalone Node HTTP server transport.",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/webiny/webiny-js.git"
+	},
+	"contributors": [
+		"Webiny Team"
+	],
+	"license": "MIT",
+	"dependencies": {
+		"@webiny/api-core": "6.6.0-alpha.4",
+		"@webiny/api-event-handler-core": "6.6.0-alpha.4",
+		"@webiny/api-file-manager-standalone": "6.6.0-alpha.4",
+		"@webiny/api-graphql": "6.6.0-alpha.4",
+		"@webiny/api-headless-cms-bulk-actions-standalone": "6.6.0-alpha.4",
+		"@webiny/api-scheduler": "6.6.0-alpha.4",
+		"@webiny/api-scheduler-standalone": "6.6.0-alpha.4",
+		"@webiny/api-websockets-standalone": "6.6.0-alpha.4",
+		"@webiny/background-tasks-standalone": "6.6.0-alpha.4",
+		"@webiny/event-handler-core": "6.6.0-alpha.4",
+		"@webiny/event-handler-standalone": "6.6.0-alpha.4",
+		"@webiny/feature": "6.6.0-alpha.4",
+		"@webiny/handler": "6.6.0-alpha.4",
+		"@webiny/stdlib": "0.0.17"
+	},
+	"peerDependencies": {
+		"@webiny/di": ">=0.2.3"
+	},
+	"devDependencies": {
+		"@webiny/build-tools": "6.6.0-alpha.4",
+		"@webiny/di": "1.1.0",
+		"rimraf": "6.1.3",
+		"typescript": "7.0.2",
+		"vitest": "4.1.11"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"webiny": {
+		"publishFrom": "dist"
+	}
+}

package/scheduler/ScheduledActionRecoverRoute.d.ts

@@ -0,0 +1,34 @@
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import type { Container } from "@webiny/feature/api";
+import { SchedulerInternalToken } from "./abstractions/InternalToken.js";
+/**
+ * Re-arms the persisted (pending) scheduled actions for a tenant into the root Bree singleton — used
+ * at boot to restore schedules after a restart. Runs the full request-context bootstrap (like the run
+ * route) so ListScheduledActionsUseCase has its CMS model, then hands the results to the singleton's
+ * `recover()`. Defaults to the root tenant when no tenant is given.
+ *
+ * NOTE: recovers ONE tenant per call. Boot recovery for additional (non-root) tenants would enumerate
+ * tenants and call this per tenant — left as a follow-up; single/root-tenant deployments are covered.
+ */
+declare class ScheduledActionRecoverRouteImpl implements HttpRouteHandler.Interface {
+    private readonly container;
+    private readonly internalToken;
+    constructor(container: Container, internalToken: SchedulerInternalToken.Interface);
+    handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response): Promise<import("@webiny/event-handler-core").IHttpResponseBuilder>;
+}
+export declare const ScheduledActionRecoverRoute: typeof ScheduledActionRecoverRouteImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+};
+declare class ScheduledActionRecoverRouteDefinitionImpl implements HttpRouteDefinition.Interface {
+    readonly name = "scheduled-action-recover";
+    readonly method = "POST";
+    readonly path = "/scheduled-action-recover";
+    readonly handler: typeof ScheduledActionRecoverRouteImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+    };
+}
+/** What the router matches on. Zero dependencies, so building it costs nothing. */
+export declare const ScheduledActionRecoverRouteDefinition: typeof ScheduledActionRecoverRouteDefinitionImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRouteDefinition>;
+};
+export {};

package/scheduler/ScheduledActionRecoverRoute.js

@@ -0,0 +1,90 @@
+import { HttpRouteDefinition, HttpRouteHandler, RequestContainer } from "@webiny/event-handler-core";
+import { GraphQLContextEnhancer, GraphQLContextualSchema } from "@webiny/api-graphql";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+import { GetRootTenantUseCase } from "@webiny/api-core/features/tenancy/GetRootTenant/index.js";
+import { IdentityContext } from "@webiny/api-core/exports/api/security.js";
+import { ListScheduledActionsUseCase } from "@webiny/api-scheduler/features/ListScheduledActions/index.js";
+import { SchedulerInternalToken } from "./abstractions/InternalToken.js";
+import { SchedulerSingleton } from "./abstractions/SchedulerSingleton.js";
+const INTERNAL_HEADER = "x-webiny-scheduler-token";
+class ScheduledActionRecoverRouteImpl {
+    constructor(container, internalToken){
+        this.container = container;
+        this.internalToken = internalToken;
+    }
+    async handle(request, response) {
+        if (request.headers[INTERNAL_HEADER] !== this.internalToken.value) return response.status(403).json({
+            error: "Forbidden."
+        });
+        try {
+            let tenant = request.body?.tenant;
+            if (!tenant) {
+                const rootResult = await this.container.resolve(GetRootTenantUseCase).execute();
+                if (rootResult.isFail()) return response.json({
+                    status: "ok",
+                    recovered: 0
+                });
+                tenant = rootResult.value.id;
+            }
+            this.container.resolve(RawTenantId).set(tenant);
+            await this.container.resolve(RequestTenantLoader).establish();
+            const ctx = {
+                container: this.container
+            };
+            for (const enhancer of this.container.resolveAll(GraphQLContextEnhancer))await enhancer.enhance(ctx);
+            for (const schema of this.container.resolveAll(GraphQLContextualSchema))await schema.build(ctx);
+            const listResult = await this.container.resolve(IdentityContext).withoutAuthorization(()=>this.container.resolve(ListScheduledActionsUseCase).execute({
+                    where: {},
+                    limit: 1000
+                }));
+            if (listResult.isFail()) return response.status(500).json({
+                status: "error",
+                error: {
+                    message: listResult.error.message
+                }
+            });
+            const pending = listResult.value.items.map((action)=>({
+                    id: action.id,
+                    namespace: action.namespace,
+                    tenant: tenant,
+                    scheduledFor: action.scheduledFor
+                }));
+            await this.container.resolve(SchedulerSingleton).recover(pending);
+            return response.json({
+                status: "ok",
+                recovered: pending.length
+            });
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Scheduled action recover route error: ${message}`);
+            return response.status(500).json({
+                status: "error",
+                error: {
+                    message
+                }
+            });
+        }
+    }
+}
+const ScheduledActionRecoverRoute = HttpRouteHandler.createImplementation({
+    implementation: ScheduledActionRecoverRouteImpl,
+    dependencies: [
+        RequestContainer,
+        SchedulerInternalToken
+    ]
+});
+class ScheduledActionRecoverRouteDefinitionImpl {
+    constructor(){
+        this.name = "scheduled-action-recover";
+        this.method = "POST";
+        this.path = "/scheduled-action-recover";
+        this.handler = ScheduledActionRecoverRoute;
+    }
+}
+const ScheduledActionRecoverRouteDefinition = HttpRouteDefinition.createImplementation({
+    implementation: ScheduledActionRecoverRouteDefinitionImpl,
+    dependencies: []
+});
+export { ScheduledActionRecoverRoute, ScheduledActionRecoverRouteDefinition };
+
+//# sourceMappingURL=ScheduledActionRecoverRoute.js.map

package/scheduler/ScheduledActionRecoverRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler/ScheduledActionRecoverRoute.js","sources":["../../src/scheduler/ScheduledActionRecoverRoute.ts"],"sourcesContent":["import {\n    HttpRouteDefinition,\n    HttpRouteHandler,\n    RequestContainer\n} from \"@webiny/event-handler-core\";\nimport { GraphQLContextEnhancer, GraphQLContextualSchema } from \"@webiny/api-graphql\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport { GetRootTenantUseCase } from \"@webiny/api-core/features/tenancy/GetRootTenant/index.js\";\nimport { IdentityContext } from \"@webiny/api-core/exports/api/security.js\";\nimport { ListScheduledActionsUseCase } from \"@webiny/api-scheduler/features/ListScheduledActions/index.js\";\nimport type { Container } from \"@webiny/feature/api\";\nimport { SchedulerInternalToken } from \"./abstractions/InternalToken.js\";\nimport { SchedulerSingleton } from \"./abstractions/SchedulerSingleton.js\";\n\nconst INTERNAL_HEADER = \"x-webiny-scheduler-token\";\n\n/**\n * Re-arms the persisted (pending) scheduled actions for a tenant into the root Bree singleton — used\n * at boot to restore schedules after a restart. Runs the full request-context bootstrap (like the run\n * route) so ListScheduledActionsUseCase has its CMS model, then hands the results to the singleton's\n * `recover()`. Defaults to the root tenant when no tenant is given.\n *\n * NOTE: recovers ONE tenant per call. Boot recovery for additional (non-root) tenants would enumerate\n * tenants and call this per tenant — left as a follow-up; single/root-tenant deployments are covered.\n */\nclass ScheduledActionRecoverRouteImpl implements HttpRouteHandler.Interface {\n    public constructor(\n        private readonly container: Container,\n        private readonly internalToken: SchedulerInternalToken.Interface\n    ) {}\n\n    public async handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response) {\n        if (request.headers[INTERNAL_HEADER] !== this.internalToken.value) {\n            return response.status(403).json({ error: \"Forbidden.\" });\n        }\n\n        try {\n            let tenant: string | undefined = request.body?.tenant;\n            if (!tenant) {\n                const rootResult = await this.container.resolve(GetRootTenantUseCase).execute();\n                if (rootResult.isFail()) {\n                    return response.json({ status: \"ok\", recovered: 0 });\n                }\n                tenant = rootResult.value.id;\n            }\n\n            this.container.resolve(RawTenantId).set(tenant);\n            await this.container.resolve(RequestTenantLoader).establish();\n\n            const ctx: Record<string, any> = { container: this.container };\n            for (const enhancer of this.container.resolveAll(GraphQLContextEnhancer)) {\n                await enhancer.enhance(ctx);\n            }\n            for (const schema of this.container.resolveAll(GraphQLContextualSchema)) {\n                await schema.build(ctx);\n            }\n\n            // At boot there's no request and no identity, so we skip authorization for the list — the\n            // same thing ExecuteScheduledActionUseCase does on the run route. Without it, the\n            // permission check in ListScheduledActions sees the anonymous identity and fails with\n            // \"Not authorized!\".\n            const listResult = await this.container\n                .resolve(IdentityContext)\n                .withoutAuthorization(() =>\n                    this.container\n                        .resolve(ListScheduledActionsUseCase)\n                        .execute({ where: {}, limit: 1000 })\n                );\n\n            if (listResult.isFail()) {\n                return response\n                    .status(500)\n                    .json({ status: \"error\", error: { message: listResult.error.message } });\n            }\n\n            const pending = listResult.value.items.map(action => ({\n                id: action.id,\n                namespace: action.namespace,\n                tenant: tenant as string,\n                scheduledFor: action.scheduledFor\n            }));\n\n            await this.container.resolve(SchedulerSingleton).recover(pending);\n\n            return response.json({ status: \"ok\", recovered: pending.length });\n        } catch (err) {\n            const message = err instanceof Error ? err.message : String(err);\n            console.error(`Scheduled action recover route error: ${message}`);\n            return response.status(500).json({ status: \"error\", error: { message } });\n        }\n    }\n}\n\nexport const ScheduledActionRecoverRoute = HttpRouteHandler.createImplementation({\n    implementation: ScheduledActionRecoverRouteImpl,\n    dependencies: [RequestContainer, SchedulerInternalToken]\n});\n\nclass ScheduledActionRecoverRouteDefinitionImpl implements HttpRouteDefinition.Interface {\n    readonly name = \"scheduled-action-recover\";\n    readonly method = \"POST\";\n    readonly path = \"/scheduled-action-recover\";\n    readonly handler = ScheduledActionRecoverRoute;\n}\n\n/** What the router matches on. Zero dependencies, so building it costs nothing. */\nexport const ScheduledActionRecoverRouteDefinition = HttpRouteDefinition.createImplementation({\n    implementation: ScheduledActionRecoverRouteDefinitionImpl,\n    dependencies: []\n});\n"],"names":["INTERNAL_HEADER","ScheduledActionRecoverRouteImpl","container","internalToken","request","response","tenant","rootResult","GetRootTenantUseCase","RawTenantId","RequestTenantLoader","ctx","enhancer","GraphQLContextEnhancer","schema","GraphQLContextualSchema","listResult","IdentityContext","ListScheduledActionsUseCase","pending","action","SchedulerSingleton","err","message","Error","String","console","ScheduledActionRecoverRoute","HttpRouteHandler","RequestContainer","SchedulerInternalToken","ScheduledActionRecoverRouteDefinitionImpl","ScheduledActionRecoverRouteDefinition","HttpRouteDefinition"],"mappings":";;;;;;;;AAiBA,MAAMA,kBAAkB;AAWxB,MAAMC;IACF,YACqBC,SAAoB,EACpBC,aAA+C,CAClE;aAFmBD,SAAS,GAATA;aACAC,aAAa,GAAbA;IAClB;IAEH,MAAa,OAAOC,OAAiC,EAAEC,QAAmC,EAAE;QACxF,IAAID,QAAQ,OAAO,CAACJ,gBAAgB,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,EAC7D,OAAOK,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAa;QAG3D,IAAI;YACA,IAAIC,SAA6BF,QAAQ,IAAI,EAAE;YAC/C,IAAI,CAACE,QAAQ;gBACT,MAAMC,aAAa,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACC,sBAAsB,OAAO;gBAC7E,IAAID,WAAW,MAAM,IACjB,OAAOF,SAAS,IAAI,CAAC;oBAAE,QAAQ;oBAAM,WAAW;gBAAE;gBAEtDC,SAASC,WAAW,KAAK,CAAC,EAAE;YAChC;YAEA,IAAI,CAAC,SAAS,CAAC,OAAO,CAACE,aAAa,GAAG,CAACH;YACxC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACI,qBAAqB,SAAS;YAE3D,MAAMC,MAA2B;gBAAE,WAAW,IAAI,CAAC,SAAS;YAAC;YAC7D,KAAK,MAAMC,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAACC,wBAC7C,MAAMD,SAAS,OAAO,CAACD;YAE3B,KAAK,MAAMG,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,CAACC,yBAC3C,MAAMD,OAAO,KAAK,CAACH;YAOvB,MAAMK,aAAa,MAAM,IAAI,CAAC,SAAS,CAClC,OAAO,CAACC,iBACR,oBAAoB,CAAC,IAClB,IAAI,CAAC,SAAS,CACT,OAAO,CAACC,6BACR,OAAO,CAAC;oBAAE,OAAO,CAAC;oBAAG,OAAO;gBAAK;YAG9C,IAAIF,WAAW,MAAM,IACjB,OAAOX,SACF,MAAM,CAAC,KACP,IAAI,CAAC;gBAAE,QAAQ;gBAAS,OAAO;oBAAE,SAASW,WAAW,KAAK,CAAC,OAAO;gBAAC;YAAE;YAG9E,MAAMG,UAAUH,WAAW,KAAK,CAAC,KAAK,CAAC,GAAG,CAACI,CAAAA,SAAW;oBAClD,IAAIA,OAAO,EAAE;oBACb,WAAWA,OAAO,SAAS;oBAC3B,QAAQd;oBACR,cAAcc,OAAO,YAAY;gBACrC;YAEA,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACC,oBAAoB,OAAO,CAACF;YAEzD,OAAOd,SAAS,IAAI,CAAC;gBAAE,QAAQ;gBAAM,WAAWc,QAAQ,MAAM;YAAC;QACnE,EAAE,OAAOG,KAAK;YACV,MAAMC,UAAUD,eAAeE,QAAQF,IAAI,OAAO,GAAGG,OAAOH;YAC5DI,QAAQ,KAAK,CAAC,CAAC,sCAAsC,EAAEH,SAAS;YAChE,OAAOlB,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;gBAAE,QAAQ;gBAAS,OAAO;oBAAEkB;gBAAQ;YAAE;QAC3E;IACJ;AACJ;AAEO,MAAMI,8BAA8BC,iBAAiB,oBAAoB,CAAC;IAC7E,gBAAgB3B;IAChB,cAAc;QAAC4B;QAAkBC;KAAuB;AAC5D;AAEA,MAAMC;;aACO,IAAI,GAAG;aACP,MAAM,GAAG;aACT,IAAI,GAAG;aACP,OAAO,GAAGJ;;AACvB;AAGO,MAAMK,wCAAwCC,oBAAoB,oBAAoB,CAAC;IAC1F,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/scheduler/ScheduledActionRunRoute.d.ts

@@ -0,0 +1,31 @@
+import { HttpRouteDefinition, HttpRouteHandler } from "@webiny/event-handler-core";
+import type { Container } from "@webiny/feature/api";
+import { SchedulerInternalToken } from "./abstractions/InternalToken.js";
+/**
+ * Runs a single scheduled action. The in-process Bree singleton (root) POSTs here when a timer fires —
+ * the timer fires OUTSIDE any HTTP request, so this route rebuilds the full request context (tenant +
+ * CMS models via the request-context initializers + contextual schemas) for the action's tenant, then
+ * runs ExecuteScheduledActionUseCase. Mirrors the background-task run route.
+ */
+declare class ScheduledActionRunRouteImpl implements HttpRouteHandler.Interface {
+    private readonly container;
+    private readonly internalToken;
+    constructor(container: Container, internalToken: SchedulerInternalToken.Interface);
+    handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response): Promise<import("@webiny/event-handler-core").IHttpResponseBuilder>;
+}
+export declare const ScheduledActionRunRoute: typeof ScheduledActionRunRouteImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+};
+declare class ScheduledActionRunRouteDefinitionImpl implements HttpRouteDefinition.Interface {
+    readonly name = "scheduled-action-run";
+    readonly method = "POST";
+    readonly path = "/scheduled-action-run";
+    readonly handler: typeof ScheduledActionRunRouteImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRoute>;
+    };
+}
+/** What the router matches on. Zero dependencies, so building it costs nothing. */
+export declare const ScheduledActionRunRouteDefinition: typeof ScheduledActionRunRouteDefinitionImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/event-handler-core").IHttpRouteDefinition>;
+};
+export {};

package/scheduler/ScheduledActionRunRoute.js

@@ -0,0 +1,75 @@
+import { HttpRouteDefinition, HttpRouteHandler, RequestContainer } from "@webiny/event-handler-core";
+import { GraphQLContextEnhancer, GraphQLContextualSchema } from "@webiny/api-graphql";
+import { RawTenantId, RequestTenantLoader } from "@webiny/api-core/features/requestContext/index.js";
+import { ExecuteScheduledActionUseCase } from "@webiny/api-scheduler/features/ExecuteScheduledAction/index.js";
+import { SchedulerInternalToken } from "./abstractions/InternalToken.js";
+const INTERNAL_HEADER = "x-webiny-scheduler-token";
+class ScheduledActionRunRouteImpl {
+    constructor(container, internalToken){
+        this.container = container;
+        this.internalToken = internalToken;
+    }
+    async handle(request, response) {
+        if (request.headers[INTERNAL_HEADER] !== this.internalToken.value) return response.status(403).json({
+            error: "Forbidden."
+        });
+        const { id, namespace, tenant } = request.body ?? {};
+        if (!id || !namespace || !tenant) return response.status(400).json({
+            error: "Missing id, namespace or tenant."
+        });
+        try {
+            this.container.resolve(RawTenantId).set(tenant);
+            await this.container.resolve(RequestTenantLoader).establish();
+            const ctx = {
+                container: this.container
+            };
+            for (const enhancer of this.container.resolveAll(GraphQLContextEnhancer))await enhancer.enhance(ctx);
+            for (const schema of this.container.resolveAll(GraphQLContextualSchema))await schema.build(ctx);
+            const result = await this.container.resolve(ExecuteScheduledActionUseCase).execute({
+                id,
+                namespace,
+                tenant
+            });
+            if (result.isFail()) return response.status(500).json({
+                status: "error",
+                error: {
+                    message: result.error.message
+                }
+            });
+            return response.json({
+                status: "ok"
+            });
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Scheduled action run route error: ${message}`);
+            return response.status(500).json({
+                status: "error",
+                error: {
+                    message
+                }
+            });
+        }
+    }
+}
+const ScheduledActionRunRoute = HttpRouteHandler.createImplementation({
+    implementation: ScheduledActionRunRouteImpl,
+    dependencies: [
+        RequestContainer,
+        SchedulerInternalToken
+    ]
+});
+class ScheduledActionRunRouteDefinitionImpl {
+    constructor(){
+        this.name = "scheduled-action-run";
+        this.method = "POST";
+        this.path = "/scheduled-action-run";
+        this.handler = ScheduledActionRunRoute;
+    }
+}
+const ScheduledActionRunRouteDefinition = HttpRouteDefinition.createImplementation({
+    implementation: ScheduledActionRunRouteDefinitionImpl,
+    dependencies: []
+});
+export { ScheduledActionRunRoute, ScheduledActionRunRouteDefinition };
+
+//# sourceMappingURL=ScheduledActionRunRoute.js.map

package/scheduler/ScheduledActionRunRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler/ScheduledActionRunRoute.js","sources":["../../src/scheduler/ScheduledActionRunRoute.ts"],"sourcesContent":["import {\n    HttpRouteDefinition,\n    HttpRouteHandler,\n    RequestContainer\n} from \"@webiny/event-handler-core\";\nimport { GraphQLContextEnhancer, GraphQLContextualSchema } from \"@webiny/api-graphql\";\nimport {\n    RawTenantId,\n    RequestTenantLoader\n} from \"@webiny/api-core/features/requestContext/index.js\";\nimport { ExecuteScheduledActionUseCase } from \"@webiny/api-scheduler/features/ExecuteScheduledAction/index.js\";\nimport type { Container } from \"@webiny/feature/api\";\nimport { SchedulerInternalToken } from \"./abstractions/InternalToken.js\";\n\n/* Shared between the Bree singleton and this route to gate access. */\nconst INTERNAL_HEADER = \"x-webiny-scheduler-token\";\n\n/**\n * Runs a single scheduled action. The in-process Bree singleton (root) POSTs here when a timer fires —\n * the timer fires OUTSIDE any HTTP request, so this route rebuilds the full request context (tenant +\n * CMS models via the request-context initializers + contextual schemas) for the action's tenant, then\n * runs ExecuteScheduledActionUseCase. Mirrors the background-task run route.\n */\nclass ScheduledActionRunRouteImpl implements HttpRouteHandler.Interface {\n    public constructor(\n        private readonly container: Container,\n        private readonly internalToken: SchedulerInternalToken.Interface\n    ) {}\n\n    public async handle(request: HttpRouteHandler.Request, response: HttpRouteHandler.Response) {\n        if (request.headers[INTERNAL_HEADER] !== this.internalToken.value) {\n            return response.status(403).json({ error: \"Forbidden.\" });\n        }\n\n        const { id, namespace, tenant } = request.body ?? {};\n        if (!id || !namespace || !tenant) {\n            return response.status(400).json({ error: \"Missing id, namespace or tenant.\" });\n        }\n\n        try {\n            this.container.resolve(RawTenantId).set(tenant);\n            await this.container.resolve(RequestTenantLoader).establish();\n\n            /* TODO: remove once legacy ctx is gone — resolve services directly from the container. */\n            const ctx: Record<string, any> = { container: this.container };\n            for (const enhancer of this.container.resolveAll(GraphQLContextEnhancer)) {\n                await enhancer.enhance(ctx);\n            }\n            for (const schema of this.container.resolveAll(GraphQLContextualSchema)) {\n                await schema.build(ctx);\n            }\n\n            const result = await this.container\n                .resolve(ExecuteScheduledActionUseCase)\n                .execute({ id, namespace, tenant });\n\n            if (result.isFail()) {\n                return response\n                    .status(500)\n                    .json({ status: \"error\", error: { message: result.error.message } });\n            }\n\n            return response.json({ status: \"ok\" });\n        } catch (err) {\n            const message = err instanceof Error ? err.message : String(err);\n            console.error(`Scheduled action run route error: ${message}`);\n            return response.status(500).json({ status: \"error\", error: { message } });\n        }\n    }\n}\n\nexport const ScheduledActionRunRoute = HttpRouteHandler.createImplementation({\n    implementation: ScheduledActionRunRouteImpl,\n    dependencies: [RequestContainer, SchedulerInternalToken]\n});\n\nclass ScheduledActionRunRouteDefinitionImpl implements HttpRouteDefinition.Interface {\n    readonly name = \"scheduled-action-run\";\n    readonly method = \"POST\";\n    readonly path = \"/scheduled-action-run\";\n    readonly handler = ScheduledActionRunRoute;\n}\n\n/** What the router matches on. Zero dependencies, so building it costs nothing. */\nexport const ScheduledActionRunRouteDefinition = HttpRouteDefinition.createImplementation({\n    implementation: ScheduledActionRunRouteDefinitionImpl,\n    dependencies: []\n});\n"],"names":["INTERNAL_HEADER","ScheduledActionRunRouteImpl","container","internalToken","request","response","id","namespace","tenant","RawTenantId","RequestTenantLoader","ctx","enhancer","GraphQLContextEnhancer","schema","GraphQLContextualSchema","result","ExecuteScheduledActionUseCase","err","message","Error","String","console","ScheduledActionRunRoute","HttpRouteHandler","RequestContainer","SchedulerInternalToken","ScheduledActionRunRouteDefinitionImpl","ScheduledActionRunRouteDefinition","HttpRouteDefinition"],"mappings":";;;;;AAeA,MAAMA,kBAAkB;AAQxB,MAAMC;IACF,YACqBC,SAAoB,EACpBC,aAA+C,CAClE;aAFmBD,SAAS,GAATA;aACAC,aAAa,GAAbA;IAClB;IAEH,MAAa,OAAOC,OAAiC,EAAEC,QAAmC,EAAE;QACxF,IAAID,QAAQ,OAAO,CAACJ,gBAAgB,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,EAC7D,OAAOK,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAa;QAG3D,MAAM,EAAEC,EAAE,EAAEC,SAAS,EAAEC,MAAM,EAAE,GAAGJ,QAAQ,IAAI,IAAI,CAAC;QACnD,IAAI,CAACE,MAAM,CAACC,aAAa,CAACC,QACtB,OAAOH,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO;QAAmC;QAGjF,IAAI;YACA,IAAI,CAAC,SAAS,CAAC,OAAO,CAACI,aAAa,GAAG,CAACD;YACxC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACE,qBAAqB,SAAS;YAG3D,MAAMC,MAA2B;gBAAE,WAAW,IAAI,CAAC,SAAS;YAAC;YAC7D,KAAK,MAAMC,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAACC,wBAC7C,MAAMD,SAAS,OAAO,CAACD;YAE3B,KAAK,MAAMG,UAAU,IAAI,CAAC,SAAS,CAAC,UAAU,CAACC,yBAC3C,MAAMD,OAAO,KAAK,CAACH;YAGvB,MAAMK,SAAS,MAAM,IAAI,CAAC,SAAS,CAC9B,OAAO,CAACC,+BACR,OAAO,CAAC;gBAAEX;gBAAIC;gBAAWC;YAAO;YAErC,IAAIQ,OAAO,MAAM,IACb,OAAOX,SACF,MAAM,CAAC,KACP,IAAI,CAAC;gBAAE,QAAQ;gBAAS,OAAO;oBAAE,SAASW,OAAO,KAAK,CAAC,OAAO;gBAAC;YAAE;YAG1E,OAAOX,SAAS,IAAI,CAAC;gBAAE,QAAQ;YAAK;QACxC,EAAE,OAAOa,KAAK;YACV,MAAMC,UAAUD,eAAeE,QAAQF,IAAI,OAAO,GAAGG,OAAOH;YAC5DI,QAAQ,KAAK,CAAC,CAAC,kCAAkC,EAAEH,SAAS;YAC5D,OAAOd,SAAS,MAAM,CAAC,KAAK,IAAI,CAAC;gBAAE,QAAQ;gBAAS,OAAO;oBAAEc;gBAAQ;YAAE;QAC3E;IACJ;AACJ;AAEO,MAAMI,0BAA0BC,iBAAiB,oBAAoB,CAAC;IACzE,gBAAgBvB;IAChB,cAAc;QAACwB;QAAkBC;KAAuB;AAC5D;AAEA,MAAMC;;aACO,IAAI,GAAG;aACP,MAAM,GAAG;aACT,IAAI,GAAG;aACP,OAAO,GAAGJ;;AACvB;AAGO,MAAMK,oCAAoCC,oBAAoB,oBAAoB,CAAC;IACtF,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/scheduler/abstractions/InternalToken.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Per-process token generated at startup, shared between the in-process Bree scheduler singleton and
+ * the scheduler routes via DI. The singleton sends it as a header when a timer fires; the routes
+ * reject requests without a matching value. Single-process only — for multi-server, replace with a
+ * shared secret. Mirrors the background-tasks InternalToken.
+ */
+interface IInternalToken {
+    readonly value: string;
+}
+export declare const SchedulerInternalToken: import("@webiny/di").Abstraction<IInternalToken>;
+export declare namespace SchedulerInternalToken {
+    type Interface = IInternalToken;
+}
+export {};

package/scheduler/abstractions/InternalToken.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const SchedulerInternalToken = createAbstraction("SchedulerServer/InternalToken");
+export { SchedulerInternalToken };
+
+//# sourceMappingURL=InternalToken.js.map

package/scheduler/abstractions/InternalToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler/abstractions/InternalToken.js","sources":["../../../src/scheduler/abstractions/InternalToken.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\n/**\n * Per-process token generated at startup, shared between the in-process Bree scheduler singleton and\n * the scheduler routes via DI. The singleton sends it as a header when a timer fires; the routes\n * reject requests without a matching value. Single-process only — for multi-server, replace with a\n * shared secret. Mirrors the background-tasks InternalToken.\n */\ninterface IInternalToken {\n    readonly value: string;\n}\n\nexport const SchedulerInternalToken = createAbstraction<IInternalToken>(\n    \"SchedulerServer/InternalToken\"\n);\n\nexport namespace SchedulerInternalToken {\n    export type Interface = IInternalToken;\n}\n"],"names":["SchedulerInternalToken","createAbstraction"],"mappings":";AAYO,MAAMA,yBAAyBC,kBAClC"}

package/scheduler/abstractions/SchedulerSingleton.d.ts

@@ -0,0 +1,10 @@
+import type { BreeSchedulerService } from "@webiny/api-scheduler-standalone";
+/**
+ * DI token for the single root Bree scheduler instance. Distinct from the `SchedulerService`
+ * abstraction (create/update/delete/exists): this exposes the concrete service so the recover route +
+ * boot step can call `recover()`, which isn't part of the SchedulerService contract.
+ */
+export declare const SchedulerSingleton: import("@webiny/di").Abstraction<BreeSchedulerService>;
+export declare namespace SchedulerSingleton {
+    type Interface = BreeSchedulerService;
+}

package/scheduler/abstractions/SchedulerSingleton.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const SchedulerSingleton = createAbstraction("SchedulerServer/Singleton");
+export { SchedulerSingleton };
+
+//# sourceMappingURL=SchedulerSingleton.js.map

package/scheduler/abstractions/SchedulerSingleton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler/abstractions/SchedulerSingleton.js","sources":["../../../src/scheduler/abstractions/SchedulerSingleton.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { BreeSchedulerService } from \"@webiny/api-scheduler-standalone\";\n\n/**\n * DI token for the single root Bree scheduler instance. Distinct from the `SchedulerService`\n * abstraction (create/update/delete/exists): this exposes the concrete service so the recover route +\n * boot step can call `recover()`, which isn't part of the SchedulerService contract.\n */\nexport const SchedulerSingleton = createAbstraction<BreeSchedulerService>(\n    \"SchedulerServer/Singleton\"\n);\n\nexport namespace SchedulerSingleton {\n    export type Interface = BreeSchedulerService;\n}\n"],"names":["SchedulerSingleton","createAbstraction"],"mappings":";AAQO,MAAMA,qBAAqBC,kBAC9B"}

package/scheduler/schedulerServer.d.ts

@@ -0,0 +1,20 @@
+import type { Container } from "@webiny/di";
+/**
+ * ROOT wiring for the standalone (Bree, in-process) scheduler. Unlike AWS (per-request EventBridge
+ * binding), the server holds ONE long-lived Bree instance for all tenants, started once at boot — the
+ * counterpart of the WebSockets connection manager. Registered as `SchedulerService` so per-request
+ * create/update/delete (during GraphQL mutations) manipulate that single live timer set.
+ *
+ * When a timer fires (outside any request), the singleton POSTs to `/scheduled-action-run`, which
+ * rebuilds the request context for the action's tenant and executes it (see the route).
+ */
+export declare function registerSchedulerServer(rootContainer: Container): void;
+/**
+ * Boot step (onServer): start the timers, then re-arm persisted schedules by POSTing the recover route
+ * (root tenant).
+ *
+ * `onServer` runs BEFORE the HTTP server starts listening, so the recover POST (which hits this same
+ * server) is DEFERRED to the next tick — by then `createServerHandler` has returned and the runner has
+ * called `.listen()`. Fire-and-forget: a recovery failure must never block or crash startup.
+ */
+export declare function startSchedulerServer(rootContainer: Container): Promise<void>;

package/scheduler/schedulerServer.js

@@ -0,0 +1,81 @@
+import { uuid } from "@webiny/stdlib";
+import { SchedulerService } from "@webiny/api-scheduler/shared/abstractions.js";
+import { BreeSchedulerService } from "@webiny/api-scheduler-standalone";
+import { SchedulerInternalToken } from "./abstractions/InternalToken.js";
+import { SchedulerSingleton } from "./abstractions/SchedulerSingleton.js";
+import { ScheduledActionRunRouteDefinition } from "./ScheduledActionRunRoute.js";
+import { ScheduledActionRecoverRouteDefinition } from "./ScheduledActionRecoverRoute.js";
+const SCHEDULER_HEADER = "x-webiny-scheduler-token";
+const consoleLogger = {
+    trace: (...args)=>console.trace(...args),
+    debug: (...args)=>console.debug(...args),
+    info: (...args)=>console.info(...args),
+    warn: (...args)=>console.warn(...args),
+    error: (...args)=>console.error(...args),
+    fatal: (...args)=>console.error(...args),
+    log: (...args)=>console.log(...args)
+};
+const serverBase = ()=>`http://localhost:${process.env.PORT || "3002"}`;
+function registerSchedulerServer(rootContainer) {
+    const token = uuid();
+    rootContainer.registerInstance(SchedulerInternalToken, {
+        value: token
+    });
+    const service = new BreeSchedulerService({
+        logger: consoleLogger,
+        onTrigger: async (id, namespace, tenant)=>{
+            console.log(`[scheduler] timer fired for "${id}" (namespace=${namespace}, tenant=${tenant}); calling run route`);
+            try {
+                const res = await fetch(`${serverBase()}/scheduled-action-run`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        [SCHEDULER_HEADER]: token
+                    },
+                    body: JSON.stringify({
+                        id,
+                        namespace,
+                        tenant
+                    })
+                });
+                if (!res.ok) {
+                    const body = await res.text().catch(()=>"");
+                    console.error(`[scheduler] run route returned HTTP ${res.status} for "${id}": ${body}`);
+                }
+            } catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                console.error(`Scheduler trigger for "${id}" failed to reach the run route: ${message}`);
+            }
+        }
+    });
+    rootContainer.registerInstance(SchedulerSingleton, service);
+    rootContainer.registerInstance(SchedulerService, service);
+    rootContainer.register(ScheduledActionRunRouteDefinition);
+    rootContainer.register(ScheduledActionRecoverRouteDefinition);
+}
+async function startSchedulerServer(rootContainer) {
+    await rootContainer.resolve(SchedulerSingleton).start();
+    const token = rootContainer.resolve(SchedulerInternalToken).value;
+    console.log(`[scheduler] boot: re-arming persisted schedules via ${serverBase()} ...`);
+    setTimeout(async ()=>{
+        try {
+            const res = await fetch(`${serverBase()}/scheduled-action-recover`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    [SCHEDULER_HEADER]: token
+                },
+                body: JSON.stringify({})
+            });
+            const body = await res.json().catch(()=>({}));
+            if (!res.ok) return void console.error(`[scheduler] boot recovery failed: HTTP ${res.status}`, body);
+            console.log(`[scheduler] boot recovery: re-armed ${body.recovered ?? "?"} pending action(s)`);
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`[scheduler] boot recovery failed to reach the recover route: ${message}`);
+        }
+    }, 1000);
+}
+export { registerSchedulerServer, startSchedulerServer };
+
+//# sourceMappingURL=schedulerServer.js.map

package/scheduler/schedulerServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler/schedulerServer.js","sources":["../../src/scheduler/schedulerServer.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport { uuid } from \"@webiny/stdlib\";\nimport { SchedulerService } from \"@webiny/api-scheduler/shared/abstractions.js\";\nimport { BreeSchedulerService } from \"@webiny/api-scheduler-standalone\";\nimport type { Logger } from \"@webiny/api-core/features/logger/abstractions.js\";\nimport { SchedulerInternalToken } from \"./abstractions/InternalToken.js\";\nimport { SchedulerSingleton } from \"./abstractions/SchedulerSingleton.js\";\nimport { ScheduledActionRunRouteDefinition } from \"./ScheduledActionRunRoute.js\";\nimport { ScheduledActionRecoverRouteDefinition } from \"./ScheduledActionRecoverRoute.js\";\n\nconst SCHEDULER_HEADER = \"x-webiny-scheduler-token\";\n\n/**\n * Minimal console-backed logger for the root scheduler singleton. The real DI Logger is registered\n * per-request (via ApiCoreFeature/LoggerFeature), so it isn't resolvable here at the root where the\n * singleton is built. And even if we bridged to it, timers fire outside any request — there's no\n * request context for a context-aware logger to enrich — so console is functionally equivalent, not\n * a downgrade. Revisit (a shared boot-time logger for all root singletons) tracked in\n * https://github.com/webiny/webiny-js/issues/5446.\n */\nconst consoleLogger: Logger.Interface = {\n    trace: (...args: any[]) => console.trace(...args),\n    debug: (...args: any[]) => console.debug(...args),\n    info: (...args: any[]) => console.info(...args),\n    warn: (...args: any[]) => console.warn(...args),\n    error: (...args: any[]) => console.error(...args),\n    fatal: (...args: any[]) => console.error(...args),\n    log: (...args: any[]) => console.log(...args)\n};\n\n// Self-callback base. process.env.PORT is the resolved listening port injected by spawnApiServer;\n// the 3002 fallback matches findFreePort's search base (and the background-tasks default) so every\n// self-callback agrees, though in practice PORT is always set. A shared helper + fail-loud handling\n// is tracked in https://github.com/webiny/webiny-js/issues/5448.\nconst serverBase = () => `http://localhost:${process.env.PORT || \"3002\"}`;\n\n/**\n * ROOT wiring for the standalone (Bree, in-process) scheduler. Unlike AWS (per-request EventBridge\n * binding), the server holds ONE long-lived Bree instance for all tenants, started once at boot — the\n * counterpart of the WebSockets connection manager. Registered as `SchedulerService` so per-request\n * create/update/delete (during GraphQL mutations) manipulate that single live timer set.\n *\n * When a timer fires (outside any request), the singleton POSTs to `/scheduled-action-run`, which\n * rebuilds the request context for the action's tenant and executes it (see the route).\n */\nexport function registerSchedulerServer(rootContainer: Container): void {\n    const token = uuid();\n    rootContainer.registerInstance(SchedulerInternalToken, { value: token });\n\n    const service = new BreeSchedulerService({\n        logger: consoleLogger,\n        onTrigger: async (id, namespace, tenant) => {\n            console.log(\n                `[scheduler] timer fired for \"${id}\" (namespace=${namespace}, tenant=${tenant}); calling run route`\n            );\n            try {\n                const res = await fetch(`${serverBase()}/scheduled-action-run`, {\n                    method: \"POST\",\n                    headers: { \"content-type\": \"application/json\", [SCHEDULER_HEADER]: token },\n                    body: JSON.stringify({ id, namespace, tenant })\n                });\n                // fetch only throws on network errors; a 403 or 500 comes back as a normal non-ok\n                // response, so we check for that explicitly — otherwise a failed run would be silent.\n                if (!res.ok) {\n                    const body = await res.text().catch(() => \"\");\n                    console.error(\n                        `[scheduler] run route returned HTTP ${res.status} for \"${id}\": ${body}`\n                    );\n                }\n            } catch (err) {\n                const message = err instanceof Error ? err.message : String(err);\n                console.error(\n                    `Scheduler trigger for \"${id}\" failed to reach the run route: ${message}`\n                );\n            }\n        }\n    });\n\n    // Register the ONE Bree instance under TWO tokens — two views of the same object:\n    //\n    //   - SchedulerService: the hosting-agnostic contract (create/update/delete/exists) that AWS\n    //     implements too. This is what per-request GraphQL mutations resolve to schedule/reschedule.\n    //   - SchedulerSingleton: typed as the CONCRETE BreeSchedulerService, so it also exposes the\n    //     methods that aren't on that contract — start() and recover(). Those are Bree-only: AWS's\n    //     EventBridge is managed infra (nothing to start) and persists its own schedules (nothing to\n    //     recover), so they don't belong on the shared interface. The boot step + recover route resolve\n    //     this token precisely because they need start()/recover().\n    //\n    // registerInstance (not register) because it's a single live object holding all tenants' timers —\n    // every caller must get the SAME instance, not a per-scope construction. Registered at root, so\n    // per-request child containers inherit it via the parent chain; nothing registers a per-request\n    // SchedulerService default that would shadow it (unlike e.g. the WS transport's Null default).\n    rootContainer.registerInstance(SchedulerSingleton, service);\n    rootContainer.registerInstance(SchedulerService, service);\n\n    rootContainer.register(ScheduledActionRunRouteDefinition);\n    rootContainer.register(ScheduledActionRecoverRouteDefinition);\n}\n\n/**\n * Boot step (onServer): start the timers, then re-arm persisted schedules by POSTing the recover route\n * (root tenant).\n *\n * `onServer` runs BEFORE the HTTP server starts listening, so the recover POST (which hits this same\n * server) is DEFERRED to the next tick — by then `createServerHandler` has returned and the runner has\n * called `.listen()`. Fire-and-forget: a recovery failure must never block or crash startup.\n */\nexport async function startSchedulerServer(rootContainer: Container): Promise<void> {\n    await rootContainer.resolve(SchedulerSingleton).start();\n\n    const token = rootContainer.resolve(SchedulerInternalToken).value;\n\n    // Deferred: give the runner a moment to bind the listener before we call back into it.\n    console.log(`[scheduler] boot: re-arming persisted schedules via ${serverBase()} ...`);\n    setTimeout(async () => {\n        try {\n            const res = await fetch(`${serverBase()}/scheduled-action-recover`, {\n                method: \"POST\",\n                headers: { \"content-type\": \"application/json\", [SCHEDULER_HEADER]: token },\n                body: JSON.stringify({})\n            });\n            const body = await res.json().catch(() => ({}) as Record<string, unknown>);\n            // fetch only throws on network errors; a 403 or 500 comes back as a normal non-ok\n            // response, so we check for it here (a token-mismatch 403 used to fail silently).\n            if (!res.ok) {\n                console.error(`[scheduler] boot recovery failed: HTTP ${res.status}`, body);\n                return;\n            }\n            console.log(\n                `[scheduler] boot recovery: re-armed ${body.recovered ?? \"?\"} pending action(s)`\n            );\n        } catch (err) {\n            const message = err instanceof Error ? err.message : String(err);\n            console.error(\n                `[scheduler] boot recovery failed to reach the recover route: ${message}`\n            );\n        }\n    }, 1000);\n}\n"],"names":["SCHEDULER_HEADER","consoleLogger","args","console","serverBase","process","registerSchedulerServer","rootContainer","token","uuid","SchedulerInternalToken","service","BreeSchedulerService","id","namespace","tenant","res","fetch","JSON","body","err","message","Error","String","SchedulerSingleton","SchedulerService","ScheduledActionRunRouteDefinition","ScheduledActionRecoverRouteDefinition","startSchedulerServer","setTimeout"],"mappings":";;;;;;;AAUA,MAAMA,mBAAmB;AAUzB,MAAMC,gBAAkC;IACpC,OAAO,CAAC,GAAGC,OAAgBC,QAAQ,KAAK,IAAID;IAC5C,OAAO,CAAC,GAAGA,OAAgBC,QAAQ,KAAK,IAAID;IAC5C,MAAM,CAAC,GAAGA,OAAgBC,QAAQ,IAAI,IAAID;IAC1C,MAAM,CAAC,GAAGA,OAAgBC,QAAQ,IAAI,IAAID;IAC1C,OAAO,CAAC,GAAGA,OAAgBC,QAAQ,KAAK,IAAID;IAC5C,OAAO,CAAC,GAAGA,OAAgBC,QAAQ,KAAK,IAAID;IAC5C,KAAK,CAAC,GAAGA,OAAgBC,QAAQ,GAAG,IAAID;AAC5C;AAMA,MAAME,aAAa,IAAM,CAAC,iBAAiB,EAAEC,QAAQ,GAAG,CAAC,IAAI,IAAI,QAAQ;AAWlE,SAASC,wBAAwBC,aAAwB;IAC5D,MAAMC,QAAQC;IACdF,cAAc,gBAAgB,CAACG,wBAAwB;QAAE,OAAOF;IAAM;IAEtE,MAAMG,UAAU,IAAIC,qBAAqB;QACrC,QAAQX;QACR,WAAW,OAAOY,IAAIC,WAAWC;YAC7BZ,QAAQ,GAAG,CACP,CAAC,6BAA6B,EAAEU,GAAG,aAAa,EAAEC,UAAU,SAAS,EAAEC,OAAO,oBAAoB,CAAC;YAEvG,IAAI;gBACA,MAAMC,MAAM,MAAMC,MAAM,GAAGb,aAAa,qBAAqB,CAAC,EAAE;oBAC5D,QAAQ;oBACR,SAAS;wBAAE,gBAAgB;wBAAoB,CAACJ,iBAAiB,EAAEQ;oBAAM;oBACzE,MAAMU,KAAK,SAAS,CAAC;wBAAEL;wBAAIC;wBAAWC;oBAAO;gBACjD;gBAGA,IAAI,CAACC,IAAI,EAAE,EAAE;oBACT,MAAMG,OAAO,MAAMH,IAAI,IAAI,GAAG,KAAK,CAAC,IAAM;oBAC1Cb,QAAQ,KAAK,CACT,CAAC,oCAAoC,EAAEa,IAAI,MAAM,CAAC,MAAM,EAAEH,GAAG,GAAG,EAAEM,MAAM;gBAEhF;YACJ,EAAE,OAAOC,KAAK;gBACV,MAAMC,UAAUD,eAAeE,QAAQF,IAAI,OAAO,GAAGG,OAAOH;gBAC5DjB,QAAQ,KAAK,CACT,CAAC,uBAAuB,EAAEU,GAAG,iCAAiC,EAAEQ,SAAS;YAEjF;QACJ;IACJ;IAgBAd,cAAc,gBAAgB,CAACiB,oBAAoBb;IACnDJ,cAAc,gBAAgB,CAACkB,kBAAkBd;IAEjDJ,cAAc,QAAQ,CAACmB;IACvBnB,cAAc,QAAQ,CAACoB;AAC3B;AAUO,eAAeC,qBAAqBrB,aAAwB;IAC/D,MAAMA,cAAc,OAAO,CAACiB,oBAAoB,KAAK;IAErD,MAAMhB,QAAQD,cAAc,OAAO,CAACG,wBAAwB,KAAK;IAGjEP,QAAQ,GAAG,CAAC,CAAC,oDAAoD,EAAEC,aAAa,IAAI,CAAC;IACrFyB,WAAW;QACP,IAAI;YACA,MAAMb,MAAM,MAAMC,MAAM,GAAGb,aAAa,yBAAyB,CAAC,EAAE;gBAChE,QAAQ;gBACR,SAAS;oBAAE,gBAAgB;oBAAoB,CAACJ,iBAAiB,EAAEQ;gBAAM;gBACzE,MAAMU,KAAK,SAAS,CAAC,CAAC;YAC1B;YACA,MAAMC,OAAO,MAAMH,IAAI,IAAI,GAAG,KAAK,CAAC,IAAO,EAAC;YAG5C,IAAI,CAACA,IAAI,EAAE,EAAE,YACTb,QAAQ,KAAK,CAAC,CAAC,uCAAuC,EAAEa,IAAI,MAAM,EAAE,EAAEG;YAG1EhB,QAAQ,GAAG,CACP,CAAC,oCAAoC,EAAEgB,KAAK,SAAS,IAAI,IAAI,kBAAkB,CAAC;QAExF,EAAE,OAAOC,KAAK;YACV,MAAMC,UAAUD,eAAeE,QAAQF,IAAI,OAAO,GAAGG,OAAOH;YAC5DjB,QAAQ,KAAK,CACT,CAAC,6DAA6D,EAAEkB,SAAS;QAEjF;IACJ,GAAG;AACP"}

package/websockets/createWebsocketsAuthenticator.d.ts

@@ -0,0 +1,24 @@
+import type { Container } from "@webiny/di";
+import { type RegisterApiRequestStackConfig } from "@webiny/api-event-handler-core";
+import type { WebsocketsConnectionAuthenticator } from "@webiny/api-websockets-standalone";
+/**
+ * Builds the `authenticate` callback the server WebSocket upgrade acceptor uses to turn a
+ * connection's `?token` JWT into an identity.
+ *
+ * Each new WebSocket connection (the HTTP upgrade handshake) is authenticated from its `?token` JWT
+ * so the connection is registered under the real identity — targeted server→client sends need this,
+ * since SendToIdentity matches connections by identity id. The catch is that AuthenticationContext
+ * lives in the per-request stack (registered by ApiCoreFeature, not registerRootStorage), so we can't
+ * resolve it from the root container. Instead we spin up a short-lived request-scoped child container,
+ * the same way createHandler does for each HTTP request, and resolve it there. We only need the core
+ * stack, not the transports, because this is just the token→identity step the HTTP stack already runs
+ * via RequestIdentityLoader — and that step doesn't depend on the tenant (the HTTP stack resolves
+ * identity before tenant), so there's no request or tenant state to set up. Connections are rare (one
+ * per admin session), so a fresh child per connection is cheap enough.
+ *
+ * This is also why the WebSocket server takes `authenticate` as a plain callback instead of resolving
+ * auth itself: AuthenticationContext isn't reachable from the root container (it's per-request), so
+ * only the handler — which can build a request-scoped child — can supply it. So authenticate has to be
+ * a callback the handler builds, regardless of DI.
+ */
+export declare function createWebsocketsAuthenticator(rootContainer: Container, extensions: RegisterApiRequestStackConfig["extensions"]): WebsocketsConnectionAuthenticator;

package/websockets/createWebsocketsAuthenticator.js

@@ -0,0 +1,22 @@
+import { RequestContainer } from "@webiny/event-handler-core";
+import { registerApiRequestStack } from "@webiny/api-event-handler-core";
+import { AuthenticationContext } from "@webiny/api-core/features/security/authentication/AuthenticationContext/index.js";
+function createWebsocketsAuthenticator(rootContainer, extensions) {
+    return async (token)=>{
+        const child = rootContainer.createChildContainer();
+        child.registerInstance(RequestContainer, child);
+        await registerApiRequestStack(child, {
+            extensions
+        });
+        const identity = await child.resolve(AuthenticationContext).authenticate(token);
+        if (!identity?.id) return null;
+        return {
+            id: identity.id,
+            displayName: identity.displayName,
+            type: identity.type
+        };
+    };
+}
+export { createWebsocketsAuthenticator };
+
+//# sourceMappingURL=createWebsocketsAuthenticator.js.map

package/websockets/createWebsocketsAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websockets/createWebsocketsAuthenticator.js","sources":["../../src/websockets/createWebsocketsAuthenticator.ts"],"sourcesContent":["import type { Container } from \"@webiny/di\";\nimport { RequestContainer } from \"@webiny/event-handler-core\";\nimport {\n    registerApiRequestStack,\n    type RegisterApiRequestStackConfig\n} from \"@webiny/api-event-handler-core\";\nimport { AuthenticationContext } from \"@webiny/api-core/features/security/authentication/AuthenticationContext/index.js\";\nimport type { WebsocketsConnectionAuthenticator } from \"@webiny/api-websockets-standalone\";\n\n/**\n * Builds the `authenticate` callback the server WebSocket upgrade acceptor uses to turn a\n * connection's `?token` JWT into an identity.\n *\n * Each new WebSocket connection (the HTTP upgrade handshake) is authenticated from its `?token` JWT\n * so the connection is registered under the real identity — targeted server→client sends need this,\n * since SendToIdentity matches connections by identity id. The catch is that AuthenticationContext\n * lives in the per-request stack (registered by ApiCoreFeature, not registerRootStorage), so we can't\n * resolve it from the root container. Instead we spin up a short-lived request-scoped child container,\n * the same way createHandler does for each HTTP request, and resolve it there. We only need the core\n * stack, not the transports, because this is just the token→identity step the HTTP stack already runs\n * via RequestIdentityLoader — and that step doesn't depend on the tenant (the HTTP stack resolves\n * identity before tenant), so there's no request or tenant state to set up. Connections are rare (one\n * per admin session), so a fresh child per connection is cheap enough.\n *\n * This is also why the WebSocket server takes `authenticate` as a plain callback instead of resolving\n * auth itself: AuthenticationContext isn't reachable from the root container (it's per-request), so\n * only the handler — which can build a request-scoped child — can supply it. So authenticate has to be\n * a callback the handler builds, regardless of DI.\n */\nexport function createWebsocketsAuthenticator(\n    rootContainer: Container,\n    extensions: RegisterApiRequestStackConfig[\"extensions\"]\n): WebsocketsConnectionAuthenticator {\n    return async token => {\n        const child = rootContainer.createChildContainer();\n        child.registerInstance(RequestContainer, child);\n        await registerApiRequestStack(child, { extensions });\n        const identity = await child.resolve(AuthenticationContext).authenticate(token);\n        if (!identity?.id) {\n            return null;\n        }\n        return {\n            id: identity.id,\n            displayName: identity.displayName,\n            type: identity.type\n        };\n    };\n}\n"],"names":["createWebsocketsAuthenticator","rootContainer","extensions","token","child","RequestContainer","registerApiRequestStack","identity","AuthenticationContext"],"mappings":";;;AA6BO,SAASA,8BACZC,aAAwB,EACxBC,UAAuD;IAEvD,OAAO,OAAMC;QACT,MAAMC,QAAQH,cAAc,oBAAoB;QAChDG,MAAM,gBAAgB,CAACC,kBAAkBD;QACzC,MAAME,wBAAwBF,OAAO;YAAEF;QAAW;QAClD,MAAMK,WAAW,MAAMH,MAAM,OAAO,CAACI,uBAAuB,YAAY,CAACL;QACzE,IAAI,CAACI,UAAU,IACX,OAAO;QAEX,OAAO;YACH,IAAIA,SAAS,EAAE;YACf,aAAaA,SAAS,WAAW;YACjC,MAAMA,SAAS,IAAI;QACvB;IACJ;AACJ"}