jinaga-server 3.5.4 → 3.6.0

package/.github/workflows/publish.yml

@@ -7,14 +7,17 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
-      # Setup .npmrc file to publish to npm
       - uses: actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'
+      - run: npm install -g npm@latest
       - run: npm install
       - run: npm publish
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ''

package/.github/workflows/upgrade-jinaga.yml

@@ -0,0 +1,51 @@
+name: Upgrade jinaga
+
+on:
+  schedule:
+    - cron: '0 6 * * *'   # daily at 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: Get versions
+        id: versions
+        run: |
+          CURRENT=$(node -p "require('./package.json').dependencies.jinaga.replace(/[\^~]/, '')")
+          LATEST=$(npm view jinaga dist-tags.latest)
+          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
+          echo "latest=$LATEST"   >> "$GITHUB_OUTPUT"
+
+      - name: Update root
+        if: steps.versions.outputs.current != steps.versions.outputs.latest
+        run: npm install jinaga@${{ steps.versions.outputs.latest }}
+
+      - name: Update integration-test
+        if: steps.versions.outputs.current != steps.versions.outputs.latest
+        working-directory: integration-test/jinaga-test
+        run: npm install jinaga@${{ steps.versions.outputs.latest }}
+
+      - name: Open PR
+        if: steps.versions.outputs.current != steps.versions.outputs.latest
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: upgrade/jinaga-${{ steps.versions.outputs.latest }}
+          commit-message: "Upgraded Jinaga to ${{ steps.versions.outputs.latest }}"
+          title: "Upgraded Jinaga to ${{ steps.versions.outputs.latest }}"
+          body: |
+            Automated upgrade of `jinaga` from `${{ steps.versions.outputs.current }}` to `${{ steps.versions.outputs.latest }}`.
+          labels: dependencies
+          delete-branch: true

package/CLAUDE.md

@@ -0,0 +1,77 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Commands
+
+```bash
+npm run build          # Compile TypeScript to dist/
+npm test               # Type-check + run Jest tests
+npm run test:watch     # Jest in watch mode
+npm run clean          # Remove dist/ and integration-test artifacts
+npm run integration    # Full build + integration tests (requires Postgres)
+npm run debug          # Run debug.ts entry point (configure DB in src/debug.ts first)
+```
+
+Run a single test file:
+```bash
+npx jest test/postgres/postgresReadSpec.ts
+```
+
+Run tests matching a pattern:
+```bash
+npx jest --testNamePattern="should read"
+```
+
+## Architecture
+
+Jinaga Server is a middle-tier backend that syncs immutable facts between clients and PostgreSQL. Facts are append-only records (never mutated), signed by user/device identities, and queried via declarative Specifications rather than SQL.
+
+### Layers (top to bottom)
+
+**HTTP** (`src/http/router.ts`) — Express router with three endpoints:
+- `POST /jinaga/write` — accept FactEnvelopes from clients
+- `POST /jinaga/read` — query facts by Specification
+- `POST /jinaga/feed` — long-lived streaming subscription (`application/x-jinaga-feed-stream`)
+
+**Authentication** (`src/authentication/`) — Associates each request with a user/device identity. `AuthenticationDevice` is for server-local operations; `AuthenticationSession` is for per-request user context.
+
+**Authorization** (`src/authorization/authorization-keystore.ts`) — Enforces who can write facts and who can receive them, using `AuthorizationEngine` and `DistributionEngine` from the `jinaga` core library.
+
+**Core** — `FactManager` from the `jinaga` library handles fact storage coordination. This server implements the `Storage` and `Keystore` interfaces that `FactManager` depends on.
+
+**Storage** (`src/postgres/`, `src/memory/`) — Two implementations:
+- `PostgresStore` + `PostgresKeystore` — production persistence in PostgreSQL
+- `MemoryKeystore` (in-memory) — used in tests and development
+
+### Assembly
+
+`JinagaServer.create(config)` in `src/jinaga-server.ts` wires everything together via dependency injection. It reads the config to determine which storage strategy, fork strategy (pass-through, transient, or persistent for upstream replication), and authorization/distribution rules to use.
+
+### Specification → SQL
+
+The most complex translation in the codebase is in `src/postgres/specification-sql.ts`, which converts a `Specification` object (from the `jinaga` library's query DSL) into SQL JOIN queries. Related: `src/postgres/specification-result-sql.ts` for result projection and `src/postgres/purge-sql.ts` for deletions.
+
+### Feed streaming
+
+`src/http/stream.ts` manages long-lived HTTP connections. When new facts arrive that match a subscription, they're pushed to all connected clients via the queue-based event system.
+
+### Fork strategies
+
+Forks determine how facts propagate upstream:
+- `PassThroughFork` — no upstream, single-server
+- `TransientFork` — in-memory queue (dev/test)
+- `PersistentFork` — `postgres-queue.ts` backed queue for reliable upstream replication to other Jinaga servers
+
+## Key interfaces
+
+- `Storage` (from `jinaga`) — `save()`, `read()`, `feed()`, `remove()`
+- `Keystore` (`src/keystore.ts`) — `getOrCreateUserFact()`, `signFacts()`, etc.
+
+## Database schema
+
+`setup.sql` initializes the schema. Key tables: `fact`, `fact_type`, `role`, `ancestor`, `signature`, `public_key`, `user`, `device`. Facts are immutable once written. The `ancestor` table tracks relationships between facts (predecessor/successor edges).
+
+## Testing
+
+Tests live in `test/` matching pattern `**/test/**/*Spec.ts`. Tests use the in-memory keystore and often the actual `PostgresStore` against a real database for integration-level unit tests. See `test/models/blog.ts` for the canonical test data model.

package/dist/authorization/authorization-keystore.d.ts

@@ -1,6 +1,29 @@
 import { Authorization, AuthorizationRules, DistributionRules, FactEnvelope, FactFeed, FactManager, FactReference, ReferencesByName, Specification, Storage, UserIdentity } from "jinaga";
+export interface DistributionIntersectionBranch {
+    start: FactReference[];
+    specification: Specification;
+}
+export type DistributionBranchesResult = {
+    type: "success";
+    branches: DistributionIntersectionBranch[];
+} | {
+    type: "denied";
+    reason: string;
+};
+export type FeedResult = {
+    type: "success";
+    feed: FactFeed;
+} | {
+    type: "denied";
+    reason: string;
+};
+export interface SubscriptionAuthorizer {
+    verifyDistributionOrIntersect(userIdentity: UserIdentity | null, specification: Specification, namedStart: ReferencesByName): Promise<DistributionBranchesResult>;
+    feedPreVerified(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FactFeed>;
+    feedWithDistribution(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FeedResult>;
+}
 import { Keystore } from "../keystore";
-export declare class AuthorizationKeystore implements Authorization {
+export declare class AuthorizationKeystore implements Authorization, SubscriptionAuthorizer {
     private factManager;
     private store;
     private keystore;
@@ -11,7 +34,10 @@ export declare class AuthorizationKeystore implements Authorization {
     getOrCreateUserFact(userIdentity: UserIdentity): Promise<import("jinaga").FactRecord>;
     read(userIdentity: UserIdentity | null, start: FactReference[], specification: Specification): Promise<import("jinaga").ProjectedResult[]>;
     feed(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FactFeed>;
+    feedWithDistribution(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FeedResult>;
+    feedPreVerified(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FactFeed>;
     load(userIdentity: UserIdentity, references: FactReference[]): Promise<FactEnvelope[]>;
     save(userIdentity: UserIdentity | null, envelopes: FactEnvelope[]): Promise<FactEnvelope[]>;
     verifyDistribution(userIdentity: UserIdentity | null, feeds: Specification[], namedStart: ReferencesByName): Promise<void>;
+    verifyDistributionOrIntersect(userIdentity: UserIdentity | null, specification: Specification, namedStart: ReferencesByName): Promise<DistributionBranchesResult>;
 }

package/dist/authorization/authorization-keystore.js

@@ -54,6 +54,15 @@ class AuthorizationKeystore {
         });
     }
     feed(userIdentity, specification, start, bookmark) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this.feedWithDistribution(userIdentity, specification, start, bookmark);
+            if (result.type === "denied") {
+                throw new jinaga_1.Forbidden(result.reason);
+            }
+            return result.feed;
+        });
+    }
+    feedWithDistribution(userIdentity, specification, start, bookmark) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.distributionEngine) {
                 const userReference = userIdentity
@@ -62,18 +71,36 @@ class AuthorizationKeystore {
                 const namedStart = specification.given.reduce((map, g, index) => (Object.assign(Object.assign({}, map), { [g.label.name]: start[index] })), {});
                 const canDistribute = yield this.distributionEngine.canDistributeToAll([specification], namedStart, userReference);
                 if (canDistribute.type === "failure") {
-                    throw new jinaga_1.Forbidden(canDistribute.reason);
+                    return { type: "denied", reason: canDistribute.reason };
                 }
                 const factFeed = yield this.store.feed(specification, start, bookmark);
                 const factReferences = factFeed.tuples
                     .flatMap(tuple => tuple.facts)
                     .filter((value, index, self) => self.findIndex((0, jinaga_1.factReferenceEquals)(value)) === index);
                 this.distributedFacts.add(factReferences, userReference);
-                return factFeed;
+                return { type: "success", feed: factFeed };
             }
-            else {
-                return yield this.store.feed(specification, start, bookmark);
+            return { type: "success", feed: yield this.store.feed(specification, start, bookmark) };
+        });
+    }
+    feedPreVerified(userIdentity, specification, start, bookmark) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Caller has already established that this feed is safe to serve
+            // (e.g. produced by intersectForSubscribe — the spec lifts its own
+            // authorization condition into the matches and therefore self-
+            // filters). Skip the redundant per-query distribution check, but
+            // keep tracking the returned references so /load stays consistent.
+            const factFeed = yield this.store.feed(specification, start, bookmark);
+            if (this.distributionEngine) {
+                const userReference = userIdentity
+                    ? yield this.keystore.getUserFact(userIdentity)
+                    : null;
+                const factReferences = factFeed.tuples
+                    .flatMap(tuple => tuple.facts)
+                    .filter((value, index, self) => self.findIndex((0, jinaga_1.factReferenceEquals)(value)) === index);
+                this.distributedFacts.add(factReferences, userReference);
             }
+            return factFeed;
         });
     }
     load(userIdentity, references) {
@@ -150,6 +177,27 @@ class AuthorizationKeystore {
             }
         });
     }
+    verifyDistributionOrIntersect(userIdentity, specification, namedStart) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const start = specification.given.map(g => namedStart[g.label.name]);
+            if (!this.distributionEngine) {
+                return { type: "success", branches: [{ start, specification }] };
+            }
+            const userReference = userIdentity
+                ? yield this.keystore.getUserFact(userIdentity)
+                : null;
+            const targetFeeds = (0, jinaga_1.buildFeeds)(specification);
+            const canDistribute = yield this.distributionEngine.canDistributeToAll(targetFeeds, namedStart, userReference);
+            if (canDistribute.type === "success") {
+                return { type: "success", branches: [{ start, specification }] };
+            }
+            const result = yield this.distributionEngine.intersectForSubscribe(start, specification, userReference);
+            if (!result.intersected) {
+                return { type: "denied", reason: canDistribute.reason };
+            }
+            return { type: "success", branches: result.branches };
+        });
+    }
 }
 exports.AuthorizationKeystore = AuthorizationKeystore;
 //# sourceMappingURL=authorization-keystore.js.map

package/dist/authorization/authorization-keystore.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-keystore.js","sourceRoot":"","sources":["../../src/authorization/authorization-keystore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAiBgB;AAGhB,qEAAgE;AAEhE,MAAa,qBAAqB;IAK9B,YACY,WAAwB,EACxB,KAAc,EACd,QAAkB,EAC1B,kBAA6C,EAC7C,iBAA2C;QAJnC,gBAAW,GAAX,WAAW,CAAa;QACxB,UAAK,GAAL,KAAK,CAAS;QACd,aAAQ,GAAR,QAAQ,CAAU;QALtB,qBAAgB,GAAyB,IAAI,6CAAoB,EAAE,CAAC;QASxE,IAAI,CAAC,mBAAmB,GAAG,kBAAkB;YACzC,IAAI,4BAAmB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,kBAAkB,GAAG,iBAAiB;YACvC,IAAI,2BAAkB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAEK,mBAAmB,CAAC,YAA0B;;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG;gBACA;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE;iBACjB;aACJ,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,QAAQ,CAAC;QACpB,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,KAAsB,EAAE,aAA4B;;YAC9F,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,aAAa,GAAyB,YAAY;oBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iCAC1D,GAAG,KACN,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAC9B,EAAE,EAAsB,CAAC,CAAC;gBAC5B,6DAA6D;gBAC7D,MAAM,KAAK,GAAG,IAAA,mBAAU,EAAC,aAAa,CAAC,CAAC;gBACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;gBACzG,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;oBAClC,MAAM,IAAI,kBAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;iBAC7C;aACJ;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,aAA4B,EAAE,KAAsB,EAAE,QAAgB;;YAChH,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,aAAa,GAAyB,YAAY;oBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iCAC1D,GAAG,KACN,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAC9B,EAAE,EAAsB,CAAC,CAAC;gBAC5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;gBACnH,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;oBAClC,MAAM,IAAI,kBAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;iBAC7C;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM;qBACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;qBAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAC1F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;gBACzD,OAAO,QAAQ,CAAC;aACnB;iBACI;gBACD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;aAChE;QACL,CAAC;KAAA;IAEK,IAAI,CAAC,YAA0B,EAAE,UAA2B;;YAC9D,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC9E,IAAI,CAAC,aAAa,EAAE;oBAChB,MAAM,IAAI,kBAAS,CAAC,cAAc,CAAC,CAAC;iBACvC;aACJ;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,SAAyB;;YACnE,IAAI,IAAI,CAAC,mBAAmB,EAAE;gBAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACnF,MAAM,QAAQ,GAAc,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACjF,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAE;oBAC/B,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,WAAW,GAAG,OAAO;qBACtB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;qBACtF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;oBACxD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,mBAAmB,GAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;oBACxD,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBACrD,IAAI,CAAC,QAAQ,EAAE;wBACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;qBACnD;oBACD,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE;wBACxB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzD,MAAM,cAAc,GAAG,UAAU;4BAC7B,CAAC,CAAC,UAAU,CAAC,UAAU;4BACvB,CAAC,CAAC,EAAE,CAAC;wBACT,OAAO;4BACH,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,UAAU,EAAE,QAAQ,CAAC,UAAU;iCAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iCAClD,MAAM,CAAC,cAAc,CAAC;yBAC9B,CAAC;qBACL;yBACI,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE;wBAC/B,OAAO,QAAQ,CAAC;qBACnB;yBACI;wBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;qBAC1C;gBACL,CAAC,CAAC,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACxE,OAAO,cAAc,CAAC;aACzB;iBACI;gBACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9D,OAAO,cAAc,CAAC;aACzB;QACL,CAAC;KAAA;IAEK,kBAAkB,CAAC,YAAiC,EAAE,KAAsB,EAAE,UAA4B;;YAC5G,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC1B,OAAO;aACV;YAED,MAAM,aAAa,GAAyB,YAAY;gBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACzG,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;gBAClC,MAAM,IAAI,kBAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;aAC7C;QACL,CAAC;KAAA;CACJ;AAjJD,sDAiJC"}
+{"version":3,"file":"authorization-keystore.js","sourceRoot":"","sources":["../../src/authorization/authorization-keystore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAiBgB;AAoChB,qEAAgE;AAEhE,MAAa,qBAAqB;IAK9B,YACY,WAAwB,EACxB,KAAc,EACd,QAAkB,EAC1B,kBAA6C,EAC7C,iBAA2C;QAJnC,gBAAW,GAAX,WAAW,CAAa;QACxB,UAAK,GAAL,KAAK,CAAS;QACd,aAAQ,GAAR,QAAQ,CAAU;QALtB,qBAAgB,GAAyB,IAAI,6CAAoB,EAAE,CAAC;QASxE,IAAI,CAAC,mBAAmB,GAAG,kBAAkB;YACzC,IAAI,4BAAmB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,kBAAkB,GAAG,iBAAiB;YACvC,IAAI,2BAAkB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAEK,mBAAmB,CAAC,YAA0B;;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG;gBACA;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE;iBACjB;aACJ,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,QAAQ,CAAC;QACpB,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,KAAsB,EAAE,aAA4B;;YAC9F,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,aAAa,GAAyB,YAAY;oBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iCAC1D,GAAG,KACN,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAC9B,EAAE,EAAsB,CAAC,CAAC;gBAC5B,6DAA6D;gBAC7D,MAAM,KAAK,GAAG,IAAA,mBAAU,EAAC,aAAa,CAAC,CAAC;gBACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;gBACzG,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;oBAClC,MAAM,IAAI,kBAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;iBAC7C;aACJ;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,aAA4B,EAAE,KAAsB,EAAE,QAAgB;;YAChH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE;gBAC1B,MAAM,IAAI,kBAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aACtC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;KAAA;IAEK,oBAAoB,CAAC,YAAiC,EAAE,aAA4B,EAAE,KAAsB,EAAE,QAAgB;;YAChI,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,aAAa,GAAyB,YAAY;oBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iCAC1D,GAAG,KACN,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAC9B,EAAE,EAAsB,CAAC,CAAC;gBAC5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;gBACnH,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;oBAClC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;iBAC3D;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM;qBACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;qBAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAC1F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;gBACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC9C;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5F,CAAC;KAAA;IAEK,eAAe,CAAC,YAAiC,EAAE,aAA4B,EAAE,KAAsB,EAAE,QAAgB;;YAC3H,iEAAiE;YACjE,mEAAmE;YACnE,+DAA+D;YAC/D,iEAAiE;YACjE,mEAAmE;YACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvE,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,aAAa,GAAyB,YAAY;oBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAC;gBACX,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM;qBACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;qBAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAA,4BAAmB,EAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;gBAC1F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;aAC5D;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;KAAA;IAEK,IAAI,CAAC,YAA0B,EAAE,UAA2B;;YAC9D,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC9E,IAAI,CAAC,aAAa,EAAE;oBAChB,MAAM,IAAI,kBAAS,CAAC,cAAc,CAAC,CAAC;iBACvC;aACJ;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;KAAA;IAEK,IAAI,CAAC,YAAiC,EAAE,SAAyB;;YACnE,IAAI,IAAI,CAAC,mBAAmB,EAAE;gBAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACnF,MAAM,QAAQ,GAAc,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACjF,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAE;oBAC/B,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,WAAW,GAAG,OAAO;qBACtB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;qBACtF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;oBACxD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,mBAAmB,GAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;oBACxD,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBACrD,IAAI,CAAC,QAAQ,EAAE;wBACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;qBACnD;oBACD,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE;wBACxB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzD,MAAM,cAAc,GAAG,UAAU;4BAC7B,CAAC,CAAC,UAAU,CAAC,UAAU;4BACvB,CAAC,CAAC,EAAE,CAAC;wBACT,OAAO;4BACH,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,UAAU,EAAE,QAAQ,CAAC,UAAU;iCAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iCAClD,MAAM,CAAC,cAAc,CAAC;yBAC9B,CAAC;qBACL;yBACI,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE;wBAC/B,OAAO,QAAQ,CAAC;qBACnB;yBACI;wBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;qBAC1C;gBACL,CAAC,CAAC,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACxE,OAAO,cAAc,CAAC;aACzB;iBACI;gBACD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9D,OAAO,cAAc,CAAC;aACzB;QACL,CAAC;KAAA;IAEK,kBAAkB,CAAC,YAAiC,EAAE,KAAsB,EAAE,UAA4B;;YAC5G,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC1B,OAAO;aACV;YAED,MAAM,aAAa,GAAyB,YAAY;gBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YACzG,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;gBAClC,MAAM,IAAI,kBAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;aAC7C;QACL,CAAC;KAAA;IAEK,6BAA6B,CAC/B,YAAiC,EACjC,aAA4B,EAC5B,UAA4B;;YAE5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;aACpE;YACD,MAAM,aAAa,GAAyB,YAAY;gBACpD,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;YAC/G,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE;gBAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;aACpE;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YACxG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;aAC3D;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;KAAA;CACJ;AAlMD,sDAkMC"}

package/dist/http/router.d.ts

@@ -1,5 +1,6 @@
 import { Handler } from "express";
 import { Authorization, FactManager, FeedCache, ProfileMessage } from "jinaga";
+import { SubscriptionAuthorizer } from "../authorization/authorization-keystore";
 export interface RequestUser {
     provider: string;
     id: string;
@@ -11,7 +12,8 @@ export declare class HttpRouter {
     private feedCache;
     private allowedOrigin;
     handler: Handler;
-    constructor(factManager: FactManager, authorization: Authorization, feedCache: FeedCache, allowedOrigin: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void));
+    private intersectedFeedOwners;
+    constructor(factManager: FactManager, authorization: Authorization & SubscriptionAuthorizer, feedCache: FeedCache, allowedOrigin: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void));
     private login;
     private load;
     private save;
@@ -24,6 +26,7 @@ export declare class HttpRouter {
     private readWithStreaming;
     private write;
     private feeds;
+    private queryFeed;
     private feed;
     private streamFeed;
     private streamAllInitialResults;

package/dist/http/router.js

@@ -228,6 +228,9 @@ function postReadWithStreaming(method) {
         }
     };
 }
+function subscriptionOwnerKey(userIdentity) {
+    return userIdentity ? `${userIdentity.provider}|${userIdentity.id}` : null;
+}
 function serializeUserIdentity(user) {
     if (!user) {
         return null;
@@ -293,6 +296,15 @@ class HttpRouter {
         this.authorization = authorization;
         this.feedCache = feedCache;
         this.allowedOrigin = allowedOrigin;
+        // Map from feed hash → owning user key, for feeds the server cleared
+        // via intersection. The cached spec self-filters by the lifted auth
+        // condition (the requesting user's fact is baked into start), so it
+        // is safe to skip the per-query distribution check — but ONLY for
+        // the same user who originally requested the subscription. Another
+        // authenticated user who somehow obtained the hash must go through
+        // the normal authorization.feed path, which will deny their request
+        // since the intersected spec is not authorizable in its own right.
+        this.intersectedFeedOwners = new Map();
         const router = (0, express_1.Router)();
         const applyAllowOrigin = this.applyAllowOrigin.bind(this);
         router.get('/login', applyAllowOrigin, getAuthenticate(user => this.login(user)));
@@ -436,16 +448,81 @@ class HttpRouter {
                 throw new jinaga_1.Invalid(failures.join("\n"));
             }
             const namedStart = specification.given.reduce((map, g, index) => (Object.assign(Object.assign({}, map), { [g.label.name]: start[index] })), {});
-            // Verify that I can distribute all feeds to the user.
-            const feeds = (0, jinaga_1.buildFeeds)(specification);
+            // Resolve distribution. When the user is not authorized for the
+            // original spec but the distribution rules can rewrite it via
+            // intersection (jinaga.js#130), accept the subscription with
+            // empty results and let the inverse engine activate it later.
+            //
+            // Even when no rule applies at all, accept the subscription:
+            // the per-query distribution check inside streamFeed /
+            // feed returns "denied" and keeps the stream alive so the
+            // client can be notified the moment the authorizing fact
+            // arrives. Failing /feeds here would force the client to
+            // re-subscribe on a poll loop.
             const userIdentity = serializeUserIdentity(user);
-            yield this.authorization.verifyDistribution(userIdentity, feeds, namedStart);
-            const feedHashes = this.feedCache.addFeeds(feeds, namedStart);
+            const intersectResult = yield this.authorization.verifyDistributionOrIntersect(userIdentity, specification, namedStart);
+            let branches;
+            let intersected;
+            if (intersectResult.type === "denied") {
+                jinaga_1.Trace.warn(`/feeds accepting spec without applicable distribution rule: ${intersectResult.reason}`);
+                branches = [{ start, specification }];
+                intersected = false;
+            }
+            else {
+                branches = intersectResult.branches;
+                intersected = branches.length !== 1 || branches[0].specification !== specification;
+            }
+            const ownerKey = subscriptionOwnerKey(userIdentity);
+            const feedHashes = [];
+            for (const branch of branches) {
+                const branchNamedStart = branch.specification.given.reduce((map, g, index) => (Object.assign(Object.assign({}, map), { [g.label.name]: branch.start[index] })), {});
+                const branchFeeds = (0, jinaga_1.buildFeeds)(branch.specification);
+                const branchHashes = this.feedCache.addFeeds(branchFeeds, branchNamedStart);
+                feedHashes.push(...branchHashes);
+                if (intersected) {
+                    for (const hash of branchHashes) {
+                        // Bind the hash to its owner so a different
+                        // authenticated user who obtains it cannot reuse
+                        // the cached spec — which carries the original
+                        // owner's user fact in its start — to fetch
+                        // facts authorized for that owner.
+                        //
+                        // The map allows only one owner per hash, which
+                        // relies on the invariant that intersected specs
+                        // bind the requesting user's fact into start —
+                        // making the hash user-specific. If two distinct
+                        // owners ever collide on the same hash, that
+                        // invariant has broken in intersectForSubscribe;
+                        // warn so we notice instead of silently
+                        // overwriting.
+                        const existing = this.intersectedFeedOwners.get(hash);
+                        if (existing !== undefined && existing !== ownerKey) {
+                            jinaga_1.Trace.warn(`Intersected feed hash ${hash} re-bound from owner ${existing} to ${ownerKey}; intersection invariant may be broken`);
+                        }
+                        this.intersectedFeedOwners.set(hash, ownerKey);
+                    }
+                }
+            }
             return {
                 feeds: feedHashes
             };
         }));
     }
+    queryFeed(feedHash, userIdentity, specification, start, bookmark) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cachedOwner = this.intersectedFeedOwners.get(feedHash);
+            const requesterOwner = subscriptionOwnerKey(userIdentity);
+            if (cachedOwner !== undefined && cachedOwner === requesterOwner) {
+                const feed = yield this.authorization.feedPreVerified(userIdentity, specification, start, bookmark);
+                return { type: "success", feed };
+            }
+            // For everyone else (different user, anonymous mismatch, or a
+            // non-intersected hash) go through the normal distribution-checked
+            // path. A "denied" result means the streaming / polling caller
+            // serves an empty page and keeps the subscription alive.
+            return yield this.authorization.feedWithDistribution(userIdentity, specification, start, bookmark);
+        });
+    }
     feed(user, params, query) {
         return jinaga_1.Trace.dependency("feed", params["hash"], () => __awaiter(this, void 0, void 0, function* () {
             var _a;
@@ -460,12 +537,19 @@ class HttpRouter {
             const bookmark = (_a = query["b"]) !== null && _a !== void 0 ? _a : "";
             const userIdentity = serializeUserIdentity(user);
             const start = feedDefinition.feed.given.map(g => feedDefinition.namedStart[g.label.name]);
-            const results = yield this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
+            const result = yield this.queryFeed(feedHash, userIdentity, feedDefinition.feed, start, bookmark);
+            if (result.type === "denied") {
+                // The subscription has been accepted; treat poll-time
+                // distribution failures as an empty page so the client
+                // can keep polling and pick up results when an
+                // authorizing fact arrives.
+                return { references: [], bookmark };
+            }
             // Return distinct fact references from all the tuples.
-            const references = results.tuples.flatMap(t => t.facts).filter((value, index, self) => self.findIndex(f => f.hash === value.hash && f.type === value.type) === index);
+            const references = result.feed.tuples.flatMap(t => t.facts).filter((value, index, self) => self.findIndex(f => f.hash === value.hash && f.type === value.type) === index);
             const response = {
                 references,
-                bookmark: results.bookmark
+                bookmark: result.feed.bookmark
             };
             return response;
         }));
@@ -497,7 +581,7 @@ class HttpRouter {
                 // Continuous initial query until exhausted
                 console.log(`[StreamFeed:${connectionId}] Starting initial data streaming...`);
                 const initialStart = Date.now();
-                bookmark = yield this.streamAllInitialResults(userIdentity, feedDefinition, start, bookmark, stream);
+                bookmark = yield this.streamAllInitialResults(feedHash, userIdentity, feedDefinition, start, bookmark, stream);
                 const initialDuration = Date.now() - initialStart;
                 console.log(`[StreamFeed:${connectionId}] Initial data streaming complete - Duration: ${initialDuration}ms, Final bookmark: ${bookmark || 'empty'}`);
                 // Set up real-time listeners after initial data is complete
@@ -516,7 +600,7 @@ class HttpRouter {
                             if (matchingResults.length != 0) {
                                 console.log(`[StreamFeed:${connectionId}] Processing matching results...`);
                                 const responseStart = Date.now();
-                                bookmark = yield this.streamFeedResponse(userIdentity, feedDefinition, start, bookmark, stream, true);
+                                bookmark = yield this.streamFeedResponse(feedHash, userIdentity, feedDefinition, start, bookmark, stream, true);
                                 const responseDuration = Date.now() - responseStart;
                                 console.log(`[StreamFeed:${connectionId}] Feed response sent - Duration: ${responseDuration}ms, New bookmark: ${bookmark || 'empty'}`);
                             }
@@ -534,9 +618,42 @@ class HttpRouter {
                     }));
                 });
                 console.log(`[StreamFeed:${connectionId}] All listeners registered - Count: ${listeners.length}`);
+                // Anchor listeners (jinaga.js#129): the inverse-listener path
+                // above only fires when a descendant of the given arrives. If
+                // the given fact itself isn't yet in the store when the client
+                // subscribes, neither the initial query nor any later inverse
+                // can deliver results until the given is recorded — and the
+                // given fact has no descendants whose save would re-trigger the
+                // inverse with the matching givenHash. Register a listener per
+                // unique anchor that re-runs streamFeedResponse the moment a
+                // saved fact matches the anchor's (type, hash).
+                const uniqueAnchors = start.filter((s, i, arr) => arr.findIndex(other => other.type === s.type && other.hash === s.hash) === i);
+                console.log(`[StreamFeed:${connectionId}] Registering ${uniqueAnchors.length} anchor listener(s)`);
+                const anchorListeners = uniqueAnchors.map(anchor => {
+                    const anchorSpec = {
+                        given: [{ label: { name: "x", type: anchor.type }, conditions: [] }],
+                        matches: [],
+                        projection: { type: "fact", label: "x" }
+                    };
+                    return this.factManager.addSpecificationListener(anchorSpec, (results) => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            const matched = results.some(pr => {
+                                const ref = pr.tuple && pr.tuple.x;
+                                return ref && ref.type === anchor.type && ref.hash === anchor.hash;
+                            });
+                            if (matched) {
+                                console.log(`[StreamFeed:${connectionId}] Anchor fact arrived - Type: ${anchor.type}, Hash: ${anchor.hash.substring(0, 8)}...`);
+                                bookmark = yield this.streamFeedResponse(feedHash, userIdentity, feedDefinition, start, bookmark, stream, true);
+                            }
+                        }
+                        catch (error) {
+                            console.error(`[StreamFeed:${connectionId}] ERROR in anchor listener: ${error}`);
+                        }
+                    }));
+                });
                 stream.done(() => {
                     const cleanupStart = Date.now();
-                    console.log(`[StreamFeed:${connectionId}] CLEANUP STARTED - Removing ${listeners.length} listeners`);
+                    console.log(`[StreamFeed:${connectionId}] CLEANUP STARTED - Removing ${listeners.length + anchorListeners.length} listener(s)`);
                     for (let i = 0; i < listeners.length; i++) {
                         try {
                             this.factManager.removeSpecificationListener(listeners[i]);
@@ -546,6 +663,14 @@ class HttpRouter {
                             console.error(`[StreamFeed:${connectionId}] ERROR removing listener ${i + 1}: ${error}`);
                         }
                     }
+                    for (let i = 0; i < anchorListeners.length; i++) {
+                        try {
+                            this.factManager.removeSpecificationListener(anchorListeners[i]);
+                        }
+                        catch (error) {
+                            console.error(`[StreamFeed:${connectionId}] ERROR removing anchor listener ${i + 1}: ${error}`);
+                        }
+                    }
                     const cleanupDuration = Date.now() - cleanupStart;
                     const totalDuration = Date.now() - startTime;
                     console.log(`[StreamFeed:${connectionId}] CLEANUP COMPLETE - Cleanup duration: ${cleanupDuration}ms, Total connection duration: ${totalDuration}ms`);
@@ -560,7 +685,7 @@ class HttpRouter {
             }
         });
     }
-    streamAllInitialResults(userIdentity, feedDefinition, start, initialBookmark, stream) {
+    streamAllInitialResults(feedHash, userIdentity, feedDefinition, start, initialBookmark, stream) {
         return __awaiter(this, void 0, void 0, function* () {
             const streamId = Math.random().toString(36).substring(2, 8);
             console.log(`[InitialResults:${streamId}] Starting initial data fetch - Bookmark: ${initialBookmark || 'empty'}`);
@@ -573,7 +698,17 @@ class HttpRouter {
             while (hasMoreResults && pageCount < maxPages) {
                 const pageStart = Date.now();
                 console.log(`[InitialResults:${streamId}] Fetching page ${pageCount + 1} - Bookmark: ${bookmark || 'empty'}`);
-                const results = yield this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
+                const queryResult = yield this.queryFeed(feedHash, userIdentity, feedDefinition.feed, start, bookmark);
+                if (queryResult.type === "denied") {
+                    // The subscription has already been accepted; tearing
+                    // down the stream on a distribution failure would force
+                    // the client to re-subscribe just to keep waiting.
+                    // Treat as empty and let the listener path re-evaluate
+                    // when an authorizing fact arrives.
+                    console.log(`[InitialResults:${streamId}] Distribution failed (${queryResult.reason}) - serving empty and keeping stream live`);
+                    return bookmark;
+                }
+                const results = queryResult.feed;
                 const fetchDuration = Date.now() - pageStart;
                 console.log(`[InitialResults:${streamId}] Page ${pageCount + 1} fetched - Tuples: ${results.tuples.length}, Duration: ${fetchDuration}ms`);
                 // Check if we got results
@@ -627,13 +762,21 @@ class HttpRouter {
             return bookmark;
         });
     }
-    streamFeedResponse(userIdentity, feedDefinition, start, bookmark, stream, skipIfEmpty = false) {
+    streamFeedResponse(feedHash, userIdentity, feedDefinition, start, bookmark, stream, skipIfEmpty = false) {
         return __awaiter(this, void 0, void 0, function* () {
             const responseId = Math.random().toString(36).substring(2, 6);
             const startTime = Date.now();
             console.log(`[FeedResponse:${responseId}] Starting feed response - Bookmark: ${bookmark || 'empty'}, Skip if empty: ${skipIfEmpty}`);
             const feedStart = Date.now();
-            const results = yield this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
+            const queryResult = yield this.queryFeed(feedHash, userIdentity, feedDefinition.feed, start, bookmark);
+            if (queryResult.type === "denied") {
+                // The subscription stays live across distribution failures
+                // so the inverse / anchor listeners can deliver results
+                // once the authorizing fact arrives.
+                console.log(`[FeedResponse:${responseId}] Distribution failed (${queryResult.reason}) - keeping stream live`);
+                return bookmark;
+            }
+            const results = queryResult.feed;
             const feedDuration = Date.now() - feedStart;
             console.log(`[FeedResponse:${responseId}] Authorization feed complete - Tuples: ${results.tuples.length}, Duration: ${feedDuration}ms`);
             // Return distinct fact references from all the tuples.