@spinajs/authz-queue 0.0.0-stage → 3.0.1

package/README.md

@@ -1,3 +1,23 @@
-# Temporary Holding Version
+# `@spinajs/authz-queue`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Queue integration for SpinaJS authorization.
+
+Importing the package registers `AuthzQueueHook` as a `QueueMessageHook` of `@spinajs/queue`.
+
+- On emit it writes `message.Initiator` (`{ type, id, ceiling? }`) from the principal in the current async context. Nothing is written when there is none (unattended), and an `Initiator` the caller set is removed.
+- A handler runs as `UNATTENDED` unless its job says otherwise. Every check it makes is denied.
+  - `@Job({ runAs: 'initiator' })`: the handler runs as the principal that emitted the message. A message without a usable `Initiator` runs unattended.
+  - `@Job({ runAs: 'system' })`: the handler runs as `SYSTEM`.
+- Every handler run is wrapped in `runAs`, with the reason `job:<name>`, so it shows in the audit when `authz.domains.<domain>.audit.runAs` is on.
+
+The hook uses the authz domain named by `authz.queue.domain` (default `root`).
+
+`Initiator` crosses the broker as plain data, so the broker is trusted to carry it unchanged. The default `InitiatorPrincipalFactory` builds the principal from the stamp alone (no attributes, `source: 'queue'`) and warns once about it through the `authz-queue` log (the console when no `Log` is registered). `authz.queue.stampedInitiatorWarning: false` silences the warning; a wrapper built with `new` that does reload the user passes `{ warn: false }` instead (or `{ warn: true }`), which decides without reading the config. Without the option the config is read, so a factory built with `new` needs a resolved `Configuration`. An app that must reload the user registers its own: `DI.register(MyFactory).as(InitiatorPrincipalFactory)`; the hook captures the factory when it is built, so register it before the queue starts. The stamp does not carry `onBehalfOf` or `authn` facts, so an agent or impersonating principal is rebuilt without them.
+
+## Change bus
+
+`QueueChangeBus` retries a failed listen every 5 s and then drops all caches. It carries `AuthzChange`s to the other nodes as `AuthzChangeEvent` queue events. Importing the package registers it as a `ChangeBus`, so it becomes the default bus of every domain without `authz.bus.service`; set that key to choose explicitly (`'QueueChangeBus'` or `'InProcessChangeBus'`). Subscribers on the publishing node hear a change at once and skip the copy that returns from the broker. A publish the queue refuses rejects. `authz.bus.topic`, when set and `queue.routing` has no route for `AuthzChangeEvent`, becomes that route's channel. `AuthzBusRouteSource`, a configuration source registered at import, adds the route when the `Configuration` loads, after the config files; a topic set at runtime does not change the routing.
+
+## Job rows
+
+`import '@spinajs/authz-queue/jobs'` registers `JobModel` (`queue_jobs`) as the `job` resource. The subpath needs `@spinajs/authz-orm`, an optional peer dependency; the package root does not load it, so an app that only wants the hooks or `QueueChangeBus` does not install authz-orm. The resource's `owner` is the initiator (`InitiatorType` and `InitiatorId`), so a principal owns a job only when both its type and its id match. The subpath also contributes, as a configuration source registered at import, the grant that gives the `user` role `job:read` on `owner` in `authz.rbac.roles`. The grant comes with the import, not with the install: a package that is installed but never imported adds nothing, so the boot does not fail on a permission nobody registered. The source loads before the config files, so the application's own `authz.rbac.roles.user` still adds grants and overrides scalar keys. It is read when the `Configuration` resolves its sources, so import the subpath before that; a later import takes effect on the next `Configuration` resolve, and `load()` alone reuses the sources already collected. The queue's own reads and writes of job rows (tracking, progress, retention) run as `SYSTEM` through `AuthzQueueTrackingHook` (a `QueueTrackingHook`, also from the subpath), with the reason `queue:tracking`. Any other multi-row select on `JobModel` follows the usual rules: it needs `.accessible(permission)`, `.unscoped(reason)` or `runAs(SYSTEM)`, or authz-orm's runtime guard flags it (an `AuthzConfigError` in the `test` env, a warning in development). `queue-http-progress`'s `GET jobs/v1/:jobId/status` checks `job:read` on the row and answers 404 for an unknown job and for one the caller may not read.

package/lib/cjs/api.d.ts

@@ -0,0 +1,9 @@
+import type { Ceiling, PrincipalType } from '@spinajs/authz';
+export { QueueMessageHook } from '@spinajs/queue';
+export type { JobOptions } from '@spinajs/queue';
+export interface Initiator {
+    readonly type: PrincipalType;
+    readonly id: string;
+    readonly ceiling?: Ceiling;
+}
+//# sourceMappingURL=api.d.ts.map

package/lib/cjs/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/lib/cjs/api.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueueMessageHook = void 0;
+var queue_1 = require("@spinajs/queue");
+Object.defineProperty(exports, "QueueMessageHook", { enumerable: true, get: function () { return queue_1.QueueMessageHook; } });
+//# sourceMappingURL=api.js.map

package/lib/cjs/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":";;;AAEA,wCAAkD;AAAzC,yGAAA,gBAAgB,OAAA"}

package/lib/cjs/bus/change-bus.d.ts

@@ -0,0 +1,44 @@
+import { ChangeBus } from '@spinajs/authz';
+import type { AuthzChange } from '@spinajs/authz';
+import { QueueEvent, QueueService } from '@spinajs/queue';
+interface WireChange {
+    domain?: unknown;
+    tags?: unknown;
+    actor?: unknown;
+    at?: unknown;
+}
+/** What nodes send each other: the change, and the node that made it so that it can skip its own echo. */
+export declare class AuthzChangeEvent extends QueueEvent {
+    Node: string;
+    Change: WireChange;
+}
+/** Rebuilds a change that went through a JSON broker; undefined when it cannot be one. */
+export declare function reviveChange(raw: unknown): AuthzChange | undefined;
+/**
+ * A ChangeBus that carries changes to the other nodes over the queue (design §14.2).
+ * Select it with `authz.bus.service: 'QueueChangeBus'`. Subscribers on this node hear a change at once;
+ * the copy that comes back from the broker is skipped.
+ */
+export declare class QueueChangeBus extends ChangeBus {
+    protected readonly node: `${string}-${string}-${string}-${string}-${string}`;
+    private readonly subscribers;
+    private readonly log;
+    private queue?;
+    private retried;
+    private disposed;
+    private timer?;
+    protected retryMs: number;
+    publish(change: AuthzChange): Promise<void>;
+    subscribe(fn: (c: AuthzChange) => void): () => void;
+    /** AuthzService subscribes once, at boot: a queue that is not ready yet must not leave the node deaf. */
+    private listenWithRetry;
+    dispose(): Promise<void>;
+    /** Resolved per start, not injected: a queue that cannot start yet must not fail the bus, which retries. */
+    protected queueService(): Promise<QueueService>;
+    protected start(): Promise<QueueService>;
+    private listen;
+    private deliver;
+    private fail;
+}
+export {};
+//# sourceMappingURL=change-bus.d.ts.map

package/lib/cjs/bus/change-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bus.d.ts","sourceRoot":"","sources":["../../../src/bus/change-bus.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAA0B,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAS,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED,0GAA0G;AAC1G,qBACa,gBAAiB,SAAQ,UAAU;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CAC3B;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAoBlE;AAED;;;;GAIG;AACH,qBAEa,cAAe,SAAQ,SAAS;IAC3C,SAAS,CAAC,QAAQ,CAAC,IAAI,sDAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAgC;IACpD,OAAO,CAAC,KAAK,CAAC,CAAwB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,SAAS,CAAC,OAAO,SAAQ;IAEnB,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhD;IAED,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAOlD;IAED,yGAAyG;IACzG,OAAO,CAAC,eAAe;IAsBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ7B;IAED,4GAA4G;IAC5G,UAAgB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAEpD;IAED,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,CASvC;YAEa,MAAM;IAcpB,OAAO,CAAC,OAAO;IAWf,OAAO,CAAC,IAAI;CAGb"}

package/lib/cjs/bus/change-bus.js

@@ -0,0 +1,159 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueueChangeBus = exports.AuthzChangeEvent = void 0;
+exports.reviveChange = reviveChange;
+const node_crypto_1 = require("node:crypto");
+const di_1 = require("@spinajs/di");
+const authz_1 = require("@spinajs/authz");
+const queue_1 = require("@spinajs/queue");
+const util_1 = require("@spinajs/util");
+/** What nodes send each other: the change, and the node that made it so that it can skip its own echo. */
+let AuthzChangeEvent = class AuthzChangeEvent extends queue_1.QueueEvent {
+};
+exports.AuthzChangeEvent = AuthzChangeEvent;
+exports.AuthzChangeEvent = AuthzChangeEvent = __decorate([
+    (0, queue_1.Event)()
+], AuthzChangeEvent);
+/** Rebuilds a change that went through a JSON broker; undefined when it cannot be one. */
+function reviveChange(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return undefined;
+    const c = raw;
+    if (!(0, util_1.isStringArray)(c.tags))
+        return undefined;
+    if (c.domain !== undefined && typeof c.domain !== 'string')
+        return undefined;
+    let actor;
+    if (c.actor !== undefined) {
+        const a = c.actor;
+        if (a === null || typeof a !== 'object' || typeof a.type !== 'string' || typeof a.id !== 'string')
+            return undefined;
+        actor = { type: a.type, id: a.id };
+    }
+    const at = new Date(typeof c.at === 'string' || typeof c.at === 'number' || c.at instanceof Date ? c.at : NaN);
+    return {
+        ...(c.domain === undefined ? {} : { domain: c.domain }),
+        tags: [...c.tags],
+        ...(actor ? { actor } : {}),
+        at: Number.isNaN(at.getTime()) ? new Date() : at,
+    };
+}
+/**
+ * A ChangeBus that carries changes to the other nodes over the queue (design §14.2).
+ * Select it with `authz.bus.service: 'QueueChangeBus'`. Subscribers on this node hear a change at once;
+ * the copy that comes back from the broker is skipped.
+ */
+let QueueChangeBus = class QueueChangeBus extends authz_1.ChangeBus {
+    constructor() {
+        super(...arguments);
+        this.node = (0, node_crypto_1.randomUUID)();
+        this.subscribers = new Set();
+        this.log = (0, authz_1.engineLog)('authz-queue-bus');
+        this.retried = false;
+        this.disposed = false;
+        this.retryMs = 5000;
+    }
+    async publish(change) {
+        this.deliver(change);
+        const queue = await this.start();
+        const event = new AuthzChangeEvent();
+        event.Node = this.node;
+        event.Change = { domain: change.domain, tags: [...change.tags], actor: change.actor, at: change.at };
+        await queue.emit(event);
+    }
+    subscribe(fn) {
+        const entry = (c) => fn(c);
+        this.subscribers.add(entry);
+        this.listenWithRetry();
+        return () => {
+            this.subscribers.delete(entry);
+        };
+    }
+    /** AuthzService subscribes once, at boot: a queue that is not ready yet must not leave the node deaf. */
+    listenWithRetry() {
+        this.start().then(() => {
+            // Changes made while the node was deaf are unknown: drop everything.
+            if (this.retried) {
+                this.retried = false;
+                this.deliver({ tags: ['*'], at: new Date() });
+            }
+        }, (err) => {
+            this.log.error({ error: (0, authz_1.thrownError)(err) }, 'authz change bus: cannot listen on the queue, retrying');
+            this.retried = true;
+            if (this.disposed || this.timer)
+                return;
+            this.timer = setTimeout(() => {
+                this.timer = undefined;
+                if (!this.disposed)
+                    this.listenWithRetry();
+            }, this.retryMs);
+            this.timer.unref?.();
+        });
+    }
+    async dispose() {
+        this.disposed = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+        this.subscribers.clear();
+        const started = this.queue;
+        this.queue = undefined;
+        if (started)
+            await (await started.catch(() => undefined))?.stopConsuming(AuthzChangeEvent);
+    }
+    /** Resolved per start, not injected: a queue that cannot start yet must not fail the bus, which retries. */
+    async queueService() {
+        return di_1.DI.resolve(queue_1.QueueService);
+    }
+    start() {
+        if (this.queue === undefined) {
+            this.queue = this.listen();
+            // A failed start is retried by the next call.
+            this.queue.catch(() => {
+                this.queue = undefined;
+            });
+        }
+        return this.queue;
+    }
+    async listen() {
+        const queue = await this.queueService();
+        await queue.consume(AuthzChangeEvent, async (e) => {
+            if (e.Node === this.node)
+                return;
+            const change = reviveChange(e.Change);
+            if (change === undefined) {
+                this.log.warn('authz change bus: dropped a malformed change');
+                return;
+            }
+            this.deliver(change);
+        });
+        return queue;
+    }
+    deliver(change) {
+        for (const fn of [...this.subscribers]) {
+            try {
+                const r = fn(change);
+                if (r !== null && typeof r === 'object' && typeof r.then === 'function')
+                    r.then(undefined, (err) => this.fail(err));
+            }
+            catch (err) {
+                this.fail(err);
+            }
+        }
+    }
+    fail(err) {
+        this.log.error({ error: (0, authz_1.thrownError)(err) }, 'authz change subscriber failed');
+    }
+};
+exports.QueueChangeBus = QueueChangeBus;
+exports.QueueChangeBus = QueueChangeBus = __decorate([
+    (0, di_1.Singleton)(),
+    (0, di_1.Injectable)(authz_1.ChangeBus)
+], QueueChangeBus);
+//# sourceMappingURL=change-bus.js.map

package/lib/cjs/bus/change-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bus.js","sourceRoot":"","sources":["../../../src/bus/change-bus.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,6CAAyC;AAEzC,oCAAwD;AACxD,0CAAmE;AAEnE,0CAAiE;AACjE,wCAA8C;AAS9C,0GAA0G;AAEnG,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,kBAAU;CAG/C,CAAA;;2BAHY,gBAAgB;IAD5B,IAAA,aAAK,GAAE;GACK,gBAAgB,CAG5B;AAED,0FAA0F;AAC1F,sBAA6B,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,GAAiB,CAAC;IAC5B,IAAI,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE7E,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgD,CAAC;QAC7D,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpH,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/G,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,GAAI,CAAC,CAAC,IAAiB,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,iBAAS;IAAtC;;QACc,SAAI,GAAG,IAAA,wBAAU,GAAE,CAAC;QACtB,gBAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QAClD,QAAG,GAAG,IAAA,iBAAS,EAAC,iBAAiB,CAAC,CAAC;QAE5C,YAAO,GAAG,KAAK,CAAC;QAChB,aAAQ,GAAG,KAAK,CAAC;QAEf,YAAO,GAAG,IAAI,CAAC;IAiG3B,CAAC;IA/FC,KAAK,CAAC,OAAO,CAAC,MAAmB;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACrG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,EAA4B;QACpC,MAAM,KAAK,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,eAAe;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CACf,GAAG,EAAE;YACH,qEAAqE;YACrE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAA,mBAAW,EAAC,GAAG,CAAC,EAAE,EAAE,wDAAwD,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO;YACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7C,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,OAAO;YAAE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;IAED,4GAA4G;IAClG,KAAK,CAAC,YAAY;QAC1B,OAAO,OAAE,CAAC,OAAO,CAAC,oBAAY,CAAC,CAAC;IAClC,CAAC;IAES,KAAK;QACb,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,8CAA8C;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;gBACpB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAmB,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAmB;QACjC,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAY,CAAC;gBAChC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,IAAI,KAAK,UAAU;oBAAG,CAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClK,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAY;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAA,mBAAW,EAAC,GAAG,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;IAChF,CAAC;CACF,CAAA;;yBAzGY,cAAc;IAF1B,IAAA,cAAS,GAAE;IACX,IAAA,eAAU,EAAC,iBAAS,CAAC;GACT,cAAc,CAyG1B"}

package/lib/cjs/bus/index.d.ts

@@ -0,0 +1,3 @@
+export * from './change-bus.js';
+export * from './route-source.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/bus/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/bus/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/lib/cjs/bus/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./change-bus.js"), exports);
+__exportStar(require("./route-source.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/bus/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/bus/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,oDAAkC"}

package/lib/cjs/bus/route-source.d.ts

@@ -0,0 +1,11 @@
+import { ConfigurationSource } from '@spinajs/configuration';
+import type { Configuration, IConfigLike } from '@spinajs/configuration';
+/**
+ * `authz.bus.topic` becomes the channel of `AuthzChangeEvent` unless `queue.routing` already routes it.
+ * Order 2 loads after the file sources (1), so it sees the application's topic and routing.
+ */
+export declare class AuthzBusRouteSource extends ConfigurationSource {
+    get Order(): number;
+    Load(configuration: Configuration): Promise<IConfigLike>;
+}
+//# sourceMappingURL=route-source.d.ts.map

package/lib/cjs/bus/route-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-source.d.ts","sourceRoot":"","sources":["../../../src/bus/route-source.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIzE;;;GAGG;AACH,qBACa,mBAAoB,SAAQ,mBAAmB;IAC1D,IAAW,KAAK,IAAI,MAAM,CAEzB;IAEM,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAK9D;CACF"}

package/lib/cjs/bus/route-source.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzBusRouteSource = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const change_bus_js_1 = require("./change-bus.js");
+/**
+ * `authz.bus.topic` becomes the channel of `AuthzChangeEvent` unless `queue.routing` already routes it.
+ * Order 2 loads after the file sources (1), so it sees the application's topic and routing.
+ */
+let AuthzBusRouteSource = class AuthzBusRouteSource extends configuration_1.ConfigurationSource {
+    get Order() {
+        return 2;
+    }
+    Load(configuration) {
+        const route = ['queue', 'routing', change_bus_js_1.AuthzChangeEvent.name];
+        const topic = configuration.get(['authz', 'bus', 'topic']);
+        const skip = configuration.get(route) !== undefined || typeof topic !== 'string' || topic === '';
+        return Promise.resolve((skip ? {} : { queue: { routing: { [change_bus_js_1.AuthzChangeEvent.name]: { channel: topic } } } }));
+    }
+};
+exports.AuthzBusRouteSource = AuthzBusRouteSource;
+exports.AuthzBusRouteSource = AuthzBusRouteSource = __decorate([
+    (0, di_1.Injectable)(configuration_1.ConfigurationSource)
+], AuthzBusRouteSource);
+//# sourceMappingURL=route-source.js.map

package/lib/cjs/bus/route-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-source.js","sourceRoot":"","sources":["../../../src/bus/route-source.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,0DAA6D;AAG7D,mDAAmD;AAEnD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,mCAAmB;IAC1D,IAAW,KAAK;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAEM,IAAI,CAAC,aAA4B;QACtC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgB,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAU,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAU,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1G,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,gCAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAA2B,CAAC,CAAC;IAC1I,CAAC;CACF,CAAA;;8BAXY,mBAAmB;IAD/B,IAAA,eAAU,EAAC,mCAAmB,CAAC;GACnB,mBAAmB,CAW/B"}

package/lib/cjs/hook/hook.d.ts

@@ -0,0 +1,21 @@
+import { AuthzDomains } from '@spinajs/authz';
+import type { AuthzService, Principal } from '@spinajs/authz';
+import { QueueMessageHook } from '@spinajs/queue';
+import type { IQueueMessage } from '@spinajs/queue';
+import type { Initiator } from '../api.js';
+import { InitiatorPrincipalFactory } from './initiator.js';
+/**
+ * Stamps who emitted a message and decides whose authority its handler has (design §14.2, B30).
+ * A handler runs unattended unless its `@Job` says `runAs: 'initiator'` or `'system'`.
+ */
+export declare class AuthzQueueHook extends QueueMessageHook {
+    /** The authz domain whose principal is stamped and whose `runAs` the handler uses. */
+    protected Domain: string;
+    protected Initiators: InitiatorPrincipalFactory;
+    protected Domains: AuthzDomains;
+    beforeEmit(message: IQueueMessage): Promise<void>;
+    aroundHandle<T>(message: IQueueMessage, next: () => Promise<T>): Promise<T>;
+    protected initiator(initiator: Initiator): Promise<Principal>;
+    protected service(): Promise<AuthzService>;
+}
+//# sourceMappingURL=hook.d.ts.map

package/lib/cjs/hook/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../../src/hook/hook.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAsB,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAiB,MAAM,gBAAgB,CAAC;AAO1E;;;GAGG;AACH,qBACa,cAAe,SAAQ,gBAAgB;IAClD,sFAAsF;IAEtF,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAGhD,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAE1B,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtD;IAEK,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAUhF;IAED,UAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAElE;IAED,UAAgB,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAE/C;CACF"}

package/lib/cjs/hook/hook.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzQueueHook = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const authz_1 = require("@spinajs/authz");
+const queue_1 = require("@spinajs/queue");
+const initiator_js_1 = require("./initiator.js");
+// The engine reads a ceiling whose expiresAt is not a Date, or whose reason is empty, as deny-all; revival must not repair it.
+const isStrictCeiling = (c) => (c.expiresAt === undefined || c.expiresAt instanceof Date) && (c.reason === undefined || (typeof c.reason === 'string' && c.reason !== ''));
+const isPlain = (v) => v !== null && typeof v === 'object' && Object.getPrototypeOf(v) === Object.prototype;
+/**
+ * Stamps who emitted a message and decides whose authority its handler has (design §14.2, B30).
+ * A handler runs unattended unless its `@Job` says `runAs: 'initiator'` or `'system'`.
+ */
+let AuthzQueueHook = class AuthzQueueHook extends queue_1.QueueMessageHook {
+    async beforeEmit(message) {
+        // Whatever the caller put there is dropped: only the ambient principal may be named.
+        delete message.Initiator;
+        const principal = (await this.service()).current();
+        if (principal === authz_1.UNATTENDED || principal.type === 'unattended')
+            return;
+        // A system-typed principal that is not the singleton is forged; stamping it would later become SYSTEM.
+        if (principal.type === 'system' && principal !== authz_1.SYSTEM)
+            return;
+        // The stamp cannot carry these; rebuilding without them would widen the job's authority.
+        if (principal.onBehalfOf !== undefined || principal.delegation !== undefined || principal.authn?.impersonator !== undefined)
+            return;
+        const stamp = { type: principal.type, id: String(principal.id) };
+        if (principal.ceiling === undefined) {
+            message.Initiator = stamp;
+            return;
+        }
+        // A ceiling that is not a plain, well-formed one is stamped as deny-all, never as no restriction.
+        const ceiling = isPlain(principal.ceiling) && isStrictCeiling(principal.ceiling) ? (0, initiator_js_1.reviveCeiling)(principal.ceiling) : undefined;
+        message.Initiator = { ...stamp, ceiling: ceiling ?? { permissions: [] } };
+    }
+    async aroundHandle(message, next) {
+        const service = await this.service();
+        const { runAs } = (0, queue_1.jobOptions)(message);
+        let principal = authz_1.UNATTENDED;
+        if (runAs === 'system')
+            principal = authz_1.SYSTEM;
+        else if (runAs === 'initiator' && message.Initiator)
+            principal = await this.initiator(message.Initiator);
+        // Also for unattended: a consumer running inside the emitter's async context must not inherit its principal.
+        return service.runAs(principal, `job:${message.Name}`, next);
+    }
+    async initiator(initiator) {
+        return this.Initiators.principalOf(initiator);
+    }
+    async service() {
+        return this.Domains.service(this.Domain);
+    }
+};
+exports.AuthzQueueHook = AuthzQueueHook;
+__decorate([
+    (0, configuration_1.Config)('authz.queue.domain'),
+    __metadata("design:type", String)
+], AuthzQueueHook.prototype, "Domain", void 0);
+__decorate([
+    (0, di_1.Autoinject)(initiator_js_1.InitiatorPrincipalFactory),
+    __metadata("design:type", initiator_js_1.InitiatorPrincipalFactory)
+], AuthzQueueHook.prototype, "Initiators", void 0);
+__decorate([
+    (0, di_1.Autoinject)(authz_1.AuthzDomains),
+    __metadata("design:type", authz_1.AuthzDomains)
+], AuthzQueueHook.prototype, "Domains", void 0);
+exports.AuthzQueueHook = AuthzQueueHook = __decorate([
+    (0, di_1.Injectable)(queue_1.QueueMessageHook)
+], AuthzQueueHook);
+//# sourceMappingURL=hook.js.map

package/lib/cjs/hook/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/hook/hook.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,0DAAgD;AAChD,0CAAkE;AAElE,0CAA8D;AAG9D,iDAA0E;AAE1E,+HAA+H;AAC/H,MAAM,eAAe,GAAG,CAAC,CAA4C,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC;AAE/N,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC;AAE9H;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,wBAAgB;IAWlD,KAAK,CAAC,UAAU,CAAC,OAAsB;QACrC,qFAAqF;QACrF,OAAO,OAAO,CAAC,SAAS,CAAC;QAEzB,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,SAAS,KAAK,kBAAU,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACxE,uGAAuG;QACvG,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,KAAK,cAAM;YAAE,OAAO;QAEhE,yFAAyF;QACzF,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS;YAAE,OAAO;QAEpI,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChI,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,YAAY,CAAI,OAAsB,EAAE,IAAsB;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,SAAS,GAAc,kBAAU,CAAC;QACtC,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAS,GAAG,cAAM,CAAC;aACtC,IAAI,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS;YAAE,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAC;QAEtH,6GAA6G;QAC7G,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,SAAoB;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;;AAjDW;IADT,IAAA,sBAAM,EAAC,oBAAoB,CAAC;;8CACJ;AAGf;IADT,IAAA,eAAU,EAAC,wCAAyB,CAAC;8BAChB,wCAAyB;kDAAC;AAGtC;IADT,IAAA,eAAU,EAAC,oBAAY,CAAC;8BACN,oBAAY;+CAAC;yBATrB,cAAc;IAD1B,IAAA,eAAU,EAAC,wBAAgB,CAAC;GAChB,cAAc,CAoD1B"}

package/lib/cjs/hook/index.d.ts

@@ -0,0 +1,3 @@
+export * from './hook.js';
+export * from './initiator.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/hook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hook/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/hook/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./hook.js"), exports);
+__exportStar(require("./initiator.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/hook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hook/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,iDAA+B"}

package/lib/cjs/hook/initiator.d.ts

@@ -0,0 +1,28 @@
+import type { Ceiling, HostLog, Principal } from '@spinajs/authz';
+import type { Initiator } from '../api.js';
+/**
+ * Builds the principal a job runs as from the `Initiator` on its message. An app that must reload
+ * the user (attributes, deactivation) registers its own with `DI.register(X).as(InitiatorPrincipalFactory)`.
+ * Return `UNATTENDED` for an initiator that can no longer act; throw only for a failure worth a retry.
+ */
+export declare abstract class InitiatorPrincipalFactory {
+    abstract principalOf(initiator: Initiator): Promise<Principal>;
+}
+/** Rebuilds a Ceiling that went through a JSON broker (`expiresAt` is a string there); undefined when the shape is wrong. */
+export declare function reviveCeiling(raw: unknown): Ceiling | undefined;
+/** Trusts the stamp: type, id and ceiling are all the principal has. A malformed stamp yields `UNATTENDED`. */
+export declare class StampedInitiatorPrincipalFactory extends InitiatorPrincipalFactory {
+    private warned;
+    private readonly warn;
+    protected Log: HostLog;
+    protected WarningSwitch: boolean;
+    /**
+     * `warn` decides the one-time warning without reading the config, for a wrapper built with `new` that does reload the user.
+     * Without it, `authz.queue.stampedInitiatorWarning` decides, so a `new` instance needs a resolved Configuration.
+     */
+    constructor(options?: {
+        readonly warn?: boolean;
+    });
+    principalOf(initiator: Initiator): Promise<Principal>;
+}
+//# sourceMappingURL=initiator.d.ts.map

package/lib/cjs/hook/initiator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiator.d.ts","sourceRoot":"","sources":["../../../src/hook/initiator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AACH,8BAAsB,yBAAyB;IAC7C,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAQD,6HAA6H;AAC7H,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAiC/D;AAED,+GAA+G;AAC/G,qBACa,gCAAiC,SAAQ,yBAAyB;IAC7E,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAE3C,SAAS,CAAC,GAAG,EAAE,OAAO,CAA4B;IAGlD,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC;IAEjC;;;OAGG;IACH,YAAY,OAAO,GAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,EAGpD;IAEK,WAAW,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CA2B1D;CACF"}