jinaga-server 3.5.5 → 3.7.0

package/src/http/router.ts

@@ -3,14 +3,14 @@ import {
     Authorization,
     buildFeeds,
     computeObjectHash,
-    computeTupleSubsetHash,
     Declaration,
+    DistributionDenialCode,
     FactEnvelope,
     FactManager,
     FactRecord,
     FactReference,
     FeedCache,
-    FeedObject,
+    FeedDecision,
     FeedResponse,
     FeedsResponse,
     Forbidden,
@@ -18,7 +18,6 @@ import {
     GraphSerializer,
     GraphSource,
     Invalid,
-    invertSpecification,
     LoadMessage,
     LoadResponse,
     parseLoadMessage,
@@ -32,6 +31,8 @@ import {
     UserIdentity,
     verifyEnvelopes
 } from "jinaga";
+import { DistributionIntersectionBranch, FeedResult, SubscriptionAuthorizer } from "../authorization/authorization-keystore";
+import { FeedStreamSession, FeedStreamSessionConfig } from "../feeds/feed-stream-session";
 import { CsvMetadata } from "./csv-metadata";
 import { validateSpecificationForCsv } from "./csv-validator";
 import { createLineReader } from "./line-reader";
@@ -286,6 +287,10 @@ function postReadWithStreaming(
     };
 }
 
+function subscriptionOwnerKey(userIdentity: UserIdentity | null): string | null {
+    return userIdentity ? `${userIdentity.provider}|${userIdentity.id}` : null;
+}
+
 function serializeUserIdentity(user: RequestUser | null): UserIdentity | null {
     if (!user) {
         return null;
@@ -366,12 +371,22 @@ export interface RequestUser {
 
 export class HttpRouter {
     handler: Handler;
+    // Map from feed hash → owning user key, for feeds the server cleared
+    // via intersection. The cached spec self-filters by the lifted auth
+    // condition (the requesting user's fact is baked into start), so it
+    // is safe to skip the per-query distribution check — but ONLY for
+    // the same user who originally requested the subscription. Another
+    // authenticated user who somehow obtained the hash must go through
+    // the normal authorization.feed path, which will deny their request
+    // since the intersected spec is not authorizable in its own right.
+    private intersectedFeedOwners = new Map<string, string | null>();
 
     constructor(
         private factManager: FactManager,
-        private authorization: Authorization,
+        private authorization: Authorization & SubscriptionAuthorizer,
         private feedCache: FeedCache,
-        private allowedOrigin: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void)
+        private allowedOrigin: string | string[] | ((origin: string, callback: (err: Error | null, allow?: boolean) => void) => void),
+        private feedStreamConfig: Partial<FeedStreamSessionConfig> = {}
     ) {
         const router = Router();
         const applyAllowOrigin = this.applyAllowOrigin.bind(this);
@@ -555,49 +570,187 @@ export class HttpRouter {
             if (failures.length > 0) {
                 throw new Invalid(failures.join("\n"));
             }
-            
+
             const namedStart = specification.given.reduce((map, g, index) => ({
                 ...map,
                 [g.label.name]: start[index]
             }), {} as ReferencesByName);
 
-            // Verify that I can distribute all feeds to the user.
-            const feeds = buildFeeds(specification);
+            // Resolve distribution. When the user is not authorized for the
+            // original spec but the distribution rules can rewrite it via
+            // intersection (jinaga.js#130), accept the subscription with
+            // empty results and let the inverse engine activate it later.
+            //
+            // Even when no rule applies at all, accept the subscription:
+            // the per-query distribution check inside streamFeed /
+            // feed returns "denied" and keeps the stream alive so the
+            // client can be notified the moment the authorizing fact
+            // arrives. Failing /feeds here would force the client to
+            // re-subscribe on a poll loop.
             const userIdentity = serializeUserIdentity(user);
-            await this.authorization.verifyDistribution(userIdentity, feeds, namedStart);
+            const intersectResult = await this.authorization.verifyDistributionOrIntersect(userIdentity, specification, namedStart);
+            let branches: DistributionIntersectionBranch[];
+            let intersected: boolean;
+            if (intersectResult.type === "denied") {
+                // Structured, dashboard-observable signal that a feed was
+                // registered without an applicable distribution rule (issue
+                // #168 S3). The metric name is stable so a backend sees
+                // bounded cardinality; the denial code (a fixed 4-value enum)
+                // is the measurement dimension, so authoring errors
+                // (no-matching-rule / spec-more-restrictive-than-rule) are
+                // distinguishable from auth states (principal-excluded /
+                // not-authenticated) in CI and dashboards without grepping
+                // logs. The human-readable line is retained for correlation.
+                Trace.metric("distribution.unmatched", { [intersectResult.code]: 1 });
+                Trace.warn(`/feeds accepting spec without applicable distribution rule (${intersectResult.code}): ${intersectResult.reason}`);
+                branches = [{ start, specification }];
+                intersected = false;
+            } else {
+                branches = intersectResult.branches;
+                intersected = branches.length !== 1 || branches[0].specification !== specification;
+            }
 
-            const feedHashes = this.feedCache.addFeeds(feeds, namedStart);
+            // Classify the spec's distribution decision once; it applies to
+            // every feed hash the spec produces (issue #168 S1). Registration
+            // and keep-alive are unchanged — reactive and denied feeds are
+            // still accepted and served exactly as before; this only reports
+            // the decision. `reactive` is authorized-via-intersection: denied
+            // now, self-heals when the authorizing fact arrives.
+            //
+            // S2: the decision is recomputed from verifyDistributionOrIntersect
+            // on every POST /feeds — it is NOT cached by feed hash — so a
+            // repeated request always returns the correct *per-user* decision.
+            // This matters because a non-intersected feed hash is shared across
+            // users (it excludes the requester's identity): the same hash is
+            // `authorized` for a permitted user and `denied` for another, and
+            // a `reactive` decision becomes `authorized` once the authorizing
+            // fact arrives. Caching the FeedDecision by hash would leak one
+            // user's decision to another. addFeeds stays idempotent on the
+            // hash; only the classification is per-request.
+            let decision: FeedDecision["decision"];
+            let decisionCode: DistributionDenialCode | undefined;
+            let decisionReason: string;
+            if (intersectResult.type === "denied") {
+                decision = "denied";
+                decisionCode = intersectResult.code;
+                decisionReason = intersectResult.reason;
+            } else if (intersected) {
+                decision = "reactive";
+                decisionCode = intersectResult.denial?.code;
+                decisionReason = intersectResult.denial?.reason
+                    ?? "Authorized via intersection; awaiting the authorizing fact.";
+            } else {
+                decision = "authorized";
+                decisionCode = undefined;
+                decisionReason = "Distribution authorized.";
+            }
+
+            const ownerKey = subscriptionOwnerKey(userIdentity);
+            const feedHashes: string[] = [];
+            const decisions: FeedDecision[] = [];
+            for (const branch of branches) {
+                const branchNamedStart = branch.specification.given.reduce((map, g, index) => ({
+                    ...map,
+                    [g.label.name]: branch.start[index]
+                }), {} as ReferencesByName);
+                const branchFeeds = buildFeeds(branch.specification);
+                const branchHashes = this.feedCache.addFeeds(branchFeeds, branchNamedStart);
+                feedHashes.push(...branchHashes);
+                for (const hash of branchHashes) {
+                    decisions.push({
+                        feed: hash,
+                        decision,
+                        ...(decisionCode !== undefined ? { code: decisionCode } : {}),
+                        reason: decisionReason
+                    });
+                }
+                if (intersected) {
+                    for (const hash of branchHashes) {
+                        // Bind the hash to its owner so a different
+                        // authenticated user who obtains it cannot reuse
+                        // the cached spec — which carries the original
+                        // owner's user fact in its start — to fetch
+                        // facts authorized for that owner.
+                        //
+                        // The map allows only one owner per hash, which
+                        // relies on the invariant that intersected specs
+                        // bind the requesting user's fact into start —
+                        // making the hash user-specific. If two distinct
+                        // owners ever collide on the same hash, that
+                        // invariant has broken in intersectForSubscribe;
+                        // warn so we notice instead of silently
+                        // overwriting.
+                        const existing = this.intersectedFeedOwners.get(hash);
+                        if (existing !== undefined && existing !== ownerKey) {
+                            Trace.warn(`Intersected feed hash ${hash} re-bound from owner ${existing} to ${ownerKey}; intersection invariant may be broken`);
+                        }
+                        this.intersectedFeedOwners.set(hash, ownerKey);
+                    }
+                }
+            }
 
             return {
-                feeds: feedHashes
+                feeds: feedHashes,
+                decisions
             }
         });
     }
 
+    private async queryFeed(
+        feedHash: string,
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        start: FactReference[],
+        bookmark: string
+    ): Promise<FeedResult> {
+        const cachedOwner = this.intersectedFeedOwners.get(feedHash);
+        const requesterOwner = subscriptionOwnerKey(userIdentity);
+        if (cachedOwner !== undefined && cachedOwner === requesterOwner) {
+            const feed = await this.authorization.feedPreVerified(userIdentity, specification, start, bookmark);
+            return { type: "success", feed };
+        }
+        // For everyone else (different user, anonymous mismatch, or a
+        // non-intersected hash) go through the normal distribution-checked
+        // path. A "denied" result means the streaming / polling caller
+        // serves an empty page and keeps the subscription alive.
+        return await this.authorization.feedWithDistribution(userIdentity, specification, start, bookmark);
+    }
+
     private feed(user: RequestUser | null, params: { [key: string]: string }, query: qs.ParsedQs): Promise<FeedResponse | null> {
         return Trace.dependency("feed", params["hash"], async () => {
             const feedHash = params["hash"];
             if (!feedHash) {
+                // No hash in the route at all — a wrong URL, not a feed lookup.
                 return null;
             }
 
             const feedDefinition = await this.feedCache.getFeed(feedHash);
             if (!feedDefinition) {
-                return null;
+                // Known route, but the feed hash is unknown or expired. Signal
+                // this distinctly (issue #168 S4) so the client can re-register
+                // via POST /feeds instead of treating it as a routing error.
+                throw new FeedNotFound(feedHash);
             }
 
             const bookmark = query["b"] as string ?? "";
 
             const userIdentity = serializeUserIdentity(user);
             const start = feedDefinition.feed.given.map(g => feedDefinition.namedStart[g.label.name]);
-            const results = await this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
+            const result = await this.queryFeed(feedHash, userIdentity, feedDefinition.feed, start, bookmark);
+            if (result.type === "denied") {
+                // The subscription has been accepted; treat poll-time
+                // distribution failures as an empty page so the client
+                // can keep polling and pick up results when an
+                // authorizing fact arrives.
+                return { references: [], bookmark } as FeedResponse;
+            }
             // Return distinct fact references from all the tuples.
-            const references = results.tuples.flatMap(t => t.facts).filter((value, index, self) =>
+            const references = result.feed.tuples.flatMap(t => t.facts).filter((value, index, self) =>
                 self.findIndex(f => f.hash === value.hash && f.type === value.type) === index
             );
             const response: FeedResponse = {
                 references,
-                bookmark: results.bookmark
+                bookmark: result.feed.bookmark
             };
             return response;
         });
@@ -605,244 +758,51 @@ export class HttpRouter {
 
     private async streamFeed(user: RequestUser | null, params: { [key: string]: string }, query: qs.ParsedQs): Promise<Stream<FeedResponse> | null> {
         const connectionId = Math.random().toString(36).substring(2, 10);
-        const startTime = Date.now();
-        
-        console.log(`[StreamFeed:${connectionId}] NEW CONNECTION - User: ${user?.id || 'anonymous'}, Hash: ${params["hash"]}`);
-        
+
         const feedHash = params["hash"];
         if (!feedHash) {
-            console.log(`[StreamFeed:${connectionId}] No feed hash provided`);
+            // No hash in the route at all — a wrong URL, not a feed lookup.
             return null;
         }
 
         const feedDefinition = await this.feedCache.getFeed(feedHash);
         if (!feedDefinition) {
-            console.log(`[StreamFeed:${connectionId}] Feed definition not found for hash: ${feedHash}`);
-            return null;
+            // Known route, but the feed hash is unknown or expired. Signal
+            // this distinctly (issue #168 S4) so the client can re-register
+            // via POST /feeds instead of treating it as a routing error.
+            throw new FeedNotFound(feedHash);
         }
 
-        let bookmark = query["b"] as string ?? "";
-        console.log(`[StreamFeed:${connectionId}] Initial bookmark: ${bookmark || 'empty'}`);
+        const bookmark = query["b"] as string ?? "";
 
         const userIdentity = serializeUserIdentity(user);
         const start = feedDefinition.feed.given.map(g => feedDefinition.namedStart[g.label.name]);
         const givenHash = computeObjectHash(feedDefinition.namedStart);
 
-        console.log(`[StreamFeed:${connectionId}] Feed setup - Given hash: ${givenHash.substring(0, 8)}..., Start facts: ${start.length}`);
-
         const stream = new Stream<FeedResponse>();
-        
-        try {
-            // Continuous initial query until exhausted
-            console.log(`[StreamFeed:${connectionId}] Starting initial data streaming...`);
-            const initialStart = Date.now();
-            bookmark = await this.streamAllInitialResults(userIdentity, feedDefinition, start, bookmark, stream);
-            const initialDuration = Date.now() - initialStart;
-            console.log(`[StreamFeed:${connectionId}] Initial data streaming complete - Duration: ${initialDuration}ms, Final bookmark: ${bookmark || 'empty'}`);
-            
-            // Set up real-time listeners after initial data is complete
-            console.log(`[StreamFeed:${connectionId}] Setting up real-time listeners...`);
-            const inverses = invertSpecification(feedDefinition.feed);
-            console.log(`[StreamFeed:${connectionId}] Created ${inverses.length} inverse specifications`);
-            
-            const listeners = inverses.map((inverse, index) => {
-                console.log(`[StreamFeed:${connectionId}] Adding listener ${index + 1}/${inverses.length}`);
-                
-                return this.factManager.addSpecificationListener(
-                    inverse.inverseSpecification,
-                    async (results) => {
-                        const eventStart = Date.now();
-                        console.log(`[StreamFeed:${connectionId}] EVENT RECEIVED - Listener ${index + 1}, Results: ${results.length}`);
-                        
-                        try {
-                            // Filter out results that do not match the given.
-                            const matchingResults = results.filter(pr =>
-                                givenHash === computeTupleSubsetHash(pr.tuple, inverse.givenSubset));
-                            
-                            console.log(`[StreamFeed:${connectionId}] Filtered results - Matching: ${matchingResults.length}/${results.length}`);
-                            
-                            if (matchingResults.length != 0) {
-                                console.log(`[StreamFeed:${connectionId}] Processing matching results...`);
-                                const responseStart = Date.now();
-                                bookmark = await this.streamFeedResponse(userIdentity, feedDefinition, start, bookmark, stream, true);
-                                const responseDuration = Date.now() - responseStart;
-                                console.log(`[StreamFeed:${connectionId}] Feed response sent - Duration: ${responseDuration}ms, New bookmark: ${bookmark || 'empty'}`);
-                            } else {
-                                console.log(`[StreamFeed:${connectionId}] No matching results - skipping response`);
-                            }
-                        } catch (error) {
-                            console.error(`[StreamFeed:${connectionId}] ERROR processing event: ${error}`);
-                        }
-                        
-                        const eventDuration = Date.now() - eventStart;
-                        if (eventDuration > 100) {
-                            console.warn(`[StreamFeed:${connectionId}] SLOW event processing - Duration: ${eventDuration}ms`);
-                        }
-                    }
-                );
-            });
-            
-            console.log(`[StreamFeed:${connectionId}] All listeners registered - Count: ${listeners.length}`);
-            
-            stream.done(() => {
-                const cleanupStart = Date.now();
-                console.log(`[StreamFeed:${connectionId}] CLEANUP STARTED - Removing ${listeners.length} listeners`);
-                
-                for (let i = 0; i < listeners.length; i++) {
-                    try {
-                        this.factManager.removeSpecificationListener(listeners[i]);
-                        console.log(`[StreamFeed:${connectionId}] Removed listener ${i + 1}/${listeners.length}`);
-                    } catch (error) {
-                        console.error(`[StreamFeed:${connectionId}] ERROR removing listener ${i + 1}: ${error}`);
-                    }
-                }
-                
-                const cleanupDuration = Date.now() - cleanupStart;
-                const totalDuration = Date.now() - startTime;
-                console.log(`[StreamFeed:${connectionId}] CLEANUP COMPLETE - Cleanup duration: ${cleanupDuration}ms, Total connection duration: ${totalDuration}ms`);
-            });
-            
-            const setupDuration = Date.now() - startTime;
-            console.log(`[StreamFeed:${connectionId}] Stream setup complete - Duration: ${setupDuration}ms`);
-            
-            return stream;
-            
-        } catch (error) {
-            console.error(`[StreamFeed:${connectionId}] ERROR during setup: ${error}`);
-            throw error;
-        }
-    }
 
-    private async streamAllInitialResults(
-        userIdentity: UserIdentity | null,
-        feedDefinition: FeedObject,
-        start: FactReference[],
-        initialBookmark: string,
-        stream: Stream<FeedResponse>
-    ): Promise<string> {
-        const streamId = Math.random().toString(36).substring(2, 8);
-        console.log(`[InitialResults:${streamId}] Starting initial data fetch - Bookmark: ${initialBookmark || 'empty'}`);
-        
-        let bookmark = initialBookmark;
-        let hasMoreResults = true;
-        let pageCount = 0;
-        let totalReferences = 0;
-        const maxPages = 1000; // Safety limit to prevent infinite loops
-        const startTime = Date.now();
-        
-        while (hasMoreResults && pageCount < maxPages) {
-            const pageStart = Date.now();
-            console.log(`[InitialResults:${streamId}] Fetching page ${pageCount + 1} - Bookmark: ${bookmark || 'empty'}`);
-            
-            const results = await this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
-            const fetchDuration = Date.now() - pageStart;
-            
-            console.log(`[InitialResults:${streamId}] Page ${pageCount + 1} fetched - Tuples: ${results.tuples.length}, Duration: ${fetchDuration}ms`);
-            
-            // Check if we got results
-            if (results.tuples.length === 0) {
-                console.log(`[InitialResults:${streamId}] No more results - ending pagination`);
-                hasMoreResults = false;
-                break;
-            }
-            
-            // Process and send results
-            const processStart = Date.now();
-            const references = results.tuples.flatMap(t => t.facts).filter((value, index, self) =>
-                self.findIndex(f => f.hash === value.hash && f.type === value.type) === index
-            );
-            const processDuration = Date.now() - processStart;
-            
-            console.log(`[InitialResults:${streamId}] Page ${pageCount + 1} processed - References: ${references.length}, Process duration: ${processDuration}ms`);
-            
-            if (references.length > 0) {
-                const response: FeedResponse = {
-                    references,
-                    bookmark: results.bookmark
-                };
-                
-                const feedStart = Date.now();
-                stream.feed(response);
-                const feedDuration = Date.now() - feedStart;
-                
-                totalReferences += references.length;
-                console.log(`[InitialResults:${streamId}] Page ${pageCount + 1} sent to stream - Feed duration: ${feedDuration}ms`);
-            }
-            
-            // Update bookmark for next iteration
-            const newBookmark = results.bookmark;
-            if (newBookmark === bookmark) {
-                console.log(`[InitialResults:${streamId}] Bookmark unchanged - ending pagination`);
-                hasMoreResults = false;
-            } else {
-                bookmark = newBookmark;
-            }
-            
-            // Check if we got fewer results than the page size (indicates end)
-            if (results.tuples.length < 100) {
-                console.log(`[InitialResults:${streamId}] Partial page received (${results.tuples.length} < 100) - ending pagination`);
-                hasMoreResults = false;
-            }
-            
-            pageCount++;
-            
-            // Add small delay to prevent overwhelming the database
-            if (hasMoreResults && pageCount % 10 === 0) {
-                console.log(`[InitialResults:${streamId}] Adding delay after ${pageCount} pages`);
-                await new Promise(resolve => setTimeout(resolve, 10));
-            }
-        }
-        
-        const totalDuration = Date.now() - startTime;
-        console.log(`[InitialResults:${streamId}] Initial data streaming complete - Pages: ${pageCount}, Total references: ${totalReferences}, Duration: ${totalDuration}ms, Final bookmark: ${bookmark || 'empty'}`);
-        
-        if (pageCount >= maxPages) {
-            console.warn(`[InitialResults:${streamId}] Hit maximum page limit (${maxPages}) - possible infinite loop`);
-        }
-        
-        return bookmark;
-    }
-
-    private async streamFeedResponse(userIdentity: UserIdentity | null, feedDefinition: FeedObject, start: FactReference[], bookmark: string, stream: Stream<FeedResponse>, skipIfEmpty = false): Promise<string> {
-        const responseId = Math.random().toString(36).substring(2, 6);
-        const startTime = Date.now();
-        
-        console.log(`[FeedResponse:${responseId}] Starting feed response - Bookmark: ${bookmark || 'empty'}, Skip if empty: ${skipIfEmpty}`);
-        
-        const feedStart = Date.now();
-        const results = await this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
-        const feedDuration = Date.now() - feedStart;
-        
-        console.log(`[FeedResponse:${responseId}] Authorization feed complete - Tuples: ${results.tuples.length}, Duration: ${feedDuration}ms`);
-        
-        // Return distinct fact references from all the tuples.
-        const processStart = Date.now();
-        const references = results.tuples.flatMap(t => t.facts).filter((value, index, self) =>
-            self.findIndex(f => f.hash === value.hash && f.type === value.type) === index
+        // The session serializes every fetch and stream operation through a
+        // single bookmark-driven query cycle. Inverse and anchor observers
+        // only enqueue references onto a waitlist and wake the cycle; they
+        // never fetch or stream directly. This removes the race between
+        // listener callbacks and bookmark mutation, guarantees tuple
+        // completeness, and ensures no update is lost between pages.
+        const session = new FeedStreamSession(
+            (b: string) => this.queryFeed(feedHash, userIdentity, feedDefinition.feed, start, b),
+            this.factManager,
+            feedDefinition,
+            start,
+            givenHash,
+            stream,
+            bookmark,
+            connectionId,
+            this.feedStreamConfig
         );
-        const processDuration = Date.now() - processStart;
-        
-        console.log(`[FeedResponse:${responseId}] References processed - Count: ${references.length}, Duration: ${processDuration}ms`);
-        
-        if (!skipIfEmpty || references.length > 0) {
-            const response: FeedResponse = {
-                references,
-                bookmark: results.bookmark
-            };
-            
-            const streamStart = Date.now();
-            stream.feed(response);
-            const streamDuration = Date.now() - streamStart;
-            
-            console.log(`[FeedResponse:${responseId}] Response sent to stream - Duration: ${streamDuration}ms`);
-        } else {
-            console.log(`[FeedResponse:${responseId}] Skipping empty response`);
-        }
-        
-        const totalDuration = Date.now() - startTime;
-        console.log(`[FeedResponse:${responseId}] Feed response complete - New bookmark: ${results.bookmark || 'empty'}, Total duration: ${totalDuration}ms`);
-        
-        return results.bookmark;
+
+        stream.done(() => session.dispose());
+        session.start();
+
+        return stream;
     }
 
     private async getKnownFacts(user: RequestUser | null): Promise<Declaration> {
@@ -1005,9 +965,24 @@ function extractResults(obj: any): { result: any, count: number } {
     }
 }
 
+// A known/expired feed hash missed the feed cache. Distinct from a route
+// miss (wrong URL) so clients can tell "unknown/expired feed hash" — which is
+// recoverable by re-registering via POST /feeds — from "wrong URL" (issue
+// #168 S4). handleError maps this to a 404 with a machine-readable body.
+export class FeedNotFound extends Error {
+    constructor(public readonly feedHash: string) {
+        super(`Feed not found: ${feedHash}`);
+        this.name = "FeedNotFound";
+    }
+}
+
 function handleError(error: any, req: Request, res: Response, next: NextFunction) {
     const requestPath = req.path;
-    if (error instanceof Forbidden) {
+    if (error instanceof FeedNotFound) {
+        Trace.warn(`Feed not found: ${error.feedHash} (Path: ${requestPath})`);
+        res.type("text");
+        res.status(404).send("feed_not_found");
+    } else if (error instanceof Forbidden) {
         Trace.warn(`Forbidden: ${error.message} (Path: ${requestPath})`);
         res.type("text");
         res.status(403).send(error.message);

package/src/index.ts

@@ -2,8 +2,9 @@ export { AuthenticationDevice } from "./authentication/authentication-device";
 export { AuthenticationSession } from "./authentication/authentication-session";
 export { AuthorizationKeystore } from "./authorization/authorization-keystore";
 export { DistributedFactCache } from "./authorization/distributed-fact-cache";
+export { FeedStreamSession, FeedStreamSessionConfig, defaultFeedStreamSessionConfig } from "./feeds/feed-stream-session";
 export { createLineReader } from "./http/line-reader";
-export { HttpRouter, RequestUser } from "./http/router";
+export { FeedNotFound, HttpRouter, RequestUser } from "./http/router";
 export { Stream } from "./http/stream";
 export { JinagaServer, JinagaServerConfig, JinagaServerInstance, tracePool } from "./jinaga-server";
 export { Keystore } from "./keystore";