@authzflow/server 0.1.0-alpha.8 → 0.1.0-beta.1

package/README.md

@@ -1,6 +1,6 @@
 # @authzflow/server
 
-MIT-licensed alpha complete-check provider maintained by Accelflow Inc. Ships ESM JavaScript and TypeScript declarations, with no runtime dependencies or Rust build required.
+MIT-licensed beta complete-check provider maintained by Accelflow Inc. Ships ESM JavaScript and TypeScript declarations, with no runtime dependencies or Rust build required.
 
 ```js
 import { createCheckProvider } from '@authzflow/server';
@@ -10,6 +10,13 @@ Connect existing authentication and authorization with the async `authenticate`
 
 See https://github.com/Accelflow/AuthzFlow/blob/main/docs-public/adapters.md and https://github.com/Accelflow/AuthzFlow/blob/main/docs-public/protocol.md for callback and wire contracts. Node 22/24 and TypeScript 5.9+ are initial targets. Native Rust servers can use the companion authzflow-server source crate with the same wire fixtures.
 
-The checked reader in @authzflow/core validates these responses before returning content. Always keep authorization on ordinary product content APIs. Reliable event streams and cursor recovery are outside this complete-check alpha.
+The checked reader in @authzflow/core validates these responses before returning content. Always keep authorization on ordinary product content APIs. Reliable event streams and cursor recovery are outside this complete-check beta.
 
 LICENSE and THIRD_PARTY_NOTICES.md are included. Security reporting: https://github.com/Accelflow/AuthzFlow/security/advisories/new .
+
+`createResourceGroupFeed` is the opt-in metadata-only protocol v2 feed.
+`createResourceGroupCheck` attaches the server-selected Group watermark to an
+existing successful Resource check inside the host journal barrier. Products
+retain ACL decisions, transactional journal durability, cursor authentication,
+former-subscriber entitlement, and retention. The feed discloses only Group-wide
+revoke/revalidate events. It does not grant article access or replace existing v1.

package/dist/index.d.ts

@@ -68,3 +68,4 @@ export type CheckProvider<Context, Target> = {
     }): Promise<CheckResult>;
 };
 export declare function createCheckProvider<Context, Principal, Target>(options: ProviderOptions<Context, Principal, Target>): CheckProvider<Context, Target>;
+export { createResourceGroupFeed, createResourceGroupCheck, type ResourceGroupJournal, type ResourceGroupTarget, type ResourceGroupPosition, type ResourceGroupFeedOptions } from './resource-group-feed.js';

package/dist/index.js

@@ -58,3 +58,4 @@ export function createCheckProvider(options) {
         },
     };
 }
+export { createResourceGroupFeed, createResourceGroupCheck } from './resource-group-feed.js';

package/dist/resource-group-feed.d.ts

@@ -0,0 +1,75 @@
+export interface ResourceGroupTarget {
+    resourceGroupId: string;
+}
+export interface ResourceGroupPosition {
+    epoch: string;
+    sequence: string;
+    cursor: string;
+}
+export interface ResourceGroupJournal<Target extends ResourceGroupTarget> {
+    barrier<T>(work: () => Promise<T>): Promise<T>;
+    /** Authoritative entitlement, including a bounded former-subscriber revocation path. */
+    subscribe(binding: string, target: Target): Promise<ResourceGroupPosition>;
+    read(binding: string, target: Target, cursor: string, limit: number): Promise<{
+        batch: {
+            binding: string;
+            resourceGroupId: string;
+            epoch: string;
+            fromSequence: string;
+            throughSequence: string;
+            nextCursor: string;
+            changes: {
+                sequence: string;
+                action: 'revoke' | 'revalidate';
+            }[];
+        };
+        hasMore: boolean;
+    }>;
+}
+type FeedResult = {
+    status: number;
+    headers: Readonly<{
+        'Cache-Control': 'no-store';
+    }>;
+    body: unknown;
+};
+export interface ResourceGroupFeedOptions<Context, Target extends ResourceGroupTarget> {
+    authenticate(context: Context): Promise<{
+        binding: string;
+    } | null>;
+    journal: ResourceGroupJournal<Target>;
+}
+/** Metadata-only Group feed. Product journal must enforce cursor and subscriber binding. */
+export declare function createResourceGroupFeed<Context, Target extends ResourceGroupTarget>(options: ResourceGroupFeedOptions<Context, Target>): {
+    subscribe({ query: q, context, target }: {
+        query: Readonly<Record<string, unknown>>;
+        context: Context;
+        target: Target;
+    }): Promise<FeedResult>;
+    changes({ query: q, context, target }: {
+        query: Readonly<Record<string, unknown>>;
+        context: Context;
+        target: Target;
+    }): Promise<FeedResult>;
+};
+/** Attach a trusted Group watermark inside the SAME ACL/journal barrier. No group-wide allow. */
+export declare function createResourceGroupCheck<Context, Target>(options: {
+    check(input: {
+        query: Readonly<Record<string, unknown>>;
+        context: Context;
+        target: Target;
+    }): Promise<{
+        status: number;
+        headers: Readonly<{
+            'Cache-Control': 'no-store';
+        }>;
+        body: unknown;
+    }>;
+    resolveGroup(target: Target): Promise<ResourceGroupTarget>;
+    journal: ResourceGroupJournal<ResourceGroupTarget>;
+}): (input: {
+    query: Readonly<Record<string, unknown>>;
+    context: Context;
+    target: Target;
+}) => Promise<FeedResult>;
+export {};

package/dist/resource-group-feed.js

@@ -0,0 +1,78 @@
+/** Metadata-only Group feed. Product journal must enforce cursor and subscriber binding. */
+export function createResourceGroupFeed(options) {
+    const headers = Object.freeze({ 'Cache-Control': 'no-store' });
+    const error = (status, code) => ({ status, headers, body: { error: { code } } });
+    const identity = async (context) => {
+        const actor = await options.authenticate(context);
+        if (actor && (typeof actor.binding !== 'string' || !actor.binding || actor.binding.length > 4096))
+            throw Error('group_identity_invalid');
+        return actor;
+    };
+    const query = (value, cursor) => value && !Array.isArray(value) && typeof value.requestId === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(value.requestId) && Object.keys(value).length === (cursor ? 2 : 1) && (!cursor || typeof value.cursor === 'string' && value.cursor.length > 0 && value.cursor.length <= 8192);
+    return {
+        async subscribe({ query: q, context, target }) {
+            if (!query(q, false) || typeof target?.resourceGroupId !== 'string' || !target.resourceGroupId || target.resourceGroupId.length > 4096)
+                return error(400, 'invalid_group_request');
+            try {
+                const actor = await identity(context);
+                if (!actor)
+                    return error(401, 'user_session_required');
+                const position = await options.journal.barrier(() => options.journal.subscribe(actor.binding, target));
+                if (!position || Object.keys(position).sort().join(',') !== 'cursor,epoch,sequence' || typeof position.epoch !== 'string' || !position.epoch || position.epoch.length > 128 || typeof position.cursor !== 'string' || !position.cursor || position.cursor.length > 8192 || typeof position.sequence !== 'string' || !/^(0|[1-9][0-9]*)$/.test(position.sequence) || position.sequence.length > 20 || BigInt(position.sequence) > 18446744073709551615n)
+                    throw Error('group_position_invalid');
+                return { status: 200, headers, body: { schemaVersion: 2, kind: 'resource_group', requestId: q.requestId, binding: actor.binding, resourceGroupId: target.resourceGroupId, position } };
+            }
+            catch (failure) {
+                return failure instanceof Error && failure.message === 'access_required' ? error(403, 'access_required') : error(503, 'group_unavailable');
+            }
+        },
+        async changes({ query: q, context, target }) {
+            if (!query(q, true) || typeof target?.resourceGroupId !== 'string' || !target.resourceGroupId || target.resourceGroupId.length > 4096)
+                return error(400, 'invalid_group_request');
+            try {
+                const actor = await identity(context);
+                if (!actor)
+                    return error(401, 'user_session_required');
+                const result = await options.journal.barrier(() => options.journal.read(actor.binding, target, q.cursor, 100));
+                // The producer also rejects Resource IDs/unknown event fields, not just the consumer.
+                const b = result.batch;
+                if (!b || Object.keys(b).sort().join(',') !== 'binding,changes,epoch,fromSequence,nextCursor,resourceGroupId,throughSequence' || typeof result.hasMore !== 'boolean' || b.binding !== actor.binding || b.resourceGroupId !== target.resourceGroupId || typeof b.epoch !== 'string' || !b.epoch || b.epoch.length > 128 || typeof b.nextCursor !== 'string' || !b.nextCursor || b.nextCursor.length > 8192 || !Array.isArray(b.changes) || b.changes.length > 100 || b.changes.some(e => Object.keys(e).sort().join(',') !== 'action,sequence' || !['revoke', 'revalidate'].includes(e.action)))
+                    throw Error('group_batch_invalid');
+                let previous = BigInt(b.fromSequence);
+                if (!/^(0|[1-9][0-9]*)$/.test(b.fromSequence) || !/^(0|[1-9][0-9]*)$/.test(b.throughSequence))
+                    throw Error('group_batch_invalid');
+                for (const e of b.changes) {
+                    previous++;
+                    if (String(previous) !== e.sequence)
+                        throw Error('group_batch_invalid');
+                }
+                if (String(previous) !== b.throughSequence || previous > 18446744073709551615n)
+                    throw Error('group_batch_invalid');
+                return { status: 200, headers, body: { schemaVersion: 2, kind: 'resource_group', requestId: q.requestId, batch: b, hasMore: result.hasMore } };
+            }
+            catch (failure) {
+                return failure instanceof Error && failure.message === 'cursor_reset_required' ? error(409, 'reset_required') : error(503, 'group_unavailable');
+            }
+        },
+    };
+}
+/** Attach a trusted Group watermark inside the SAME ACL/journal barrier. No group-wide allow. */
+export function createResourceGroupCheck(options) {
+    return async (input) => {
+        try {
+            return await options.journal.barrier(async () => {
+                const result = await options.check(input);
+                if (result.status !== 200)
+                    return result;
+                const body = result.body;
+                if (typeof body?.binding !== 'string')
+                    throw Error('group_identity_invalid');
+                const target = await options.resolveGroup(input.target), position = await options.journal.subscribe(body.binding, target);
+                return { ...result, headers: { 'Cache-Control': 'no-store' }, body: { ...body, resourceGroup: { resourceGroupId: target.resourceGroupId, epoch: position.epoch, sequence: position.sequence } } };
+            });
+        }
+        catch {
+            return { status: 503, headers: { 'Cache-Control': 'no-store' }, body: { error: { code: 'group_check_unavailable' } } };
+        }
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authzflow/server",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0-beta.1",
   "private": false,
   "type": "module",
   "author": "Accelflow Inc.",