@kumiai/hub-server 0.1.0 → 0.3.0

package/lib/handlers.js

@@ -1,4 +1,5 @@
 import { HandlerError } from '@enkaku/server';
+import { hubErrorCodeOf } from '@kumiai/hub-protocol';
 import { fromB64, toB64 } from '@sozai/codec';
 import { createRateLimiter } from './rateLimit.js';
 export const DEFAULT_RATE_LIMITS = {
@@ -23,6 +24,20 @@ function getClientDID(ctx) {
     }
     return iss;
 }
+/**
+ * Re-raise a named store error with its wire code, so the caller can tell a lost compare-and-set
+ * from an unreachable hub. Anything else is not ours and passes through untouched.
+ */ function rethrowAsHandlerError(error) {
+    const code = hubErrorCodeOf(error);
+    if (code != null) {
+        throw new HandlerError({
+            code,
+            message: error instanceof Error ? error.message : code,
+            cause: error
+        });
+    }
+    throw error;
+}
 export function createHandlers(params) {
     const { store, registry } = params;
     const authorize = params.authorize ?? (()=>true);
@@ -88,23 +103,44 @@ export function createHandlers(params) {
                 });
             }
             const payloadBytes = fromB64(payload);
-            const sequenceID = await store.publish({
-                senderDID,
-                topicID,
-                payload: payloadBytes
-            });
-            // Live-deliver to currently-connected subscribers (minus the sender).
-            const subscribers = await store.getSubscribers(topicID);
-            for (const recipientDID of subscribers){
-                if (recipientDID === senderDID) continue;
-                const client = registry.getClient(recipientDID);
-                if (client?.sendMessage != null) {
-                    client.sendMessage({
-                        sequenceID,
-                        senderDID,
-                        topicID,
-                        payload: payloadBytes
-                    });
+            let sequenceID;
+            let deduped;
+            try {
+                const result = await store.publish({
+                    senderDID,
+                    topicID,
+                    payload: payloadBytes,
+                    retain: ctx.param.retain,
+                    // Absent and null are different requests: null is the empty-topic sentinel, absent is
+                    // an unconditional publish. Spreading only when present keeps them apart.
+                    ...'expectedHead' in ctx.param ? {
+                        expectedHead: ctx.param.expectedHead
+                    } : {},
+                    publishID: ctx.param.publishID
+                });
+                sequenceID = result.sequenceID;
+                deduped = result.deduped;
+            } catch (error) {
+                rethrowAsHandlerError(error);
+            }
+            // A deduped publish appended nothing: the frame was already accepted, already fanned out to
+            // whoever was subscribed then, and its sequenceID may since have been acked and its delivery
+            // row removed. Re-running the loop would push a frame every current subscriber has already
+            // applied, named by a dead sequenceID. Live fan-out is for a genuine append only.
+            if (!deduped) {
+                // Live-deliver to currently-connected subscribers (minus the sender).
+                const subscribers = await store.getSubscribers(topicID);
+                for (const recipientDID of subscribers){
+                    if (recipientDID === senderDID) continue;
+                    const client = registry.getClient(recipientDID);
+                    if (client?.sendMessage != null) {
+                        client.sendMessage({
+                            sequenceID,
+                            senderDID,
+                            topicID,
+                            payload: payloadBytes
+                        });
+                    }
                 }
             }
             return {
@@ -120,11 +156,45 @@ export function createHandlers(params) {
                     message: 'Not authorized to subscribe to topic'
                 });
             }
-            await store.subscribe(clientDID, topicID);
+            try {
+                await store.subscribe({
+                    subscriberDID: clientDID,
+                    topicID,
+                    retention: ctx.param.retention
+                });
+            } catch (error) {
+                rethrowAsHandlerError(error);
+            }
             return {
                 subscribed: true
             };
         },
+        'hub/topic/fetch': async (ctx)=>{
+            const { topicID, after, limit } = ctx.param;
+            // The subscriber is the authenticated caller, taken from the verified issuer of the signed
+            // message — never a wire field, or any member could read a topic's log by naming another.
+            const subscriberDID = getClientDID(ctx);
+            try {
+                const result = await store.fetchTopic({
+                    subscriberDID,
+                    topicID,
+                    after,
+                    limit
+                });
+                return {
+                    messages: result.messages.map((message)=>({
+                            sequenceID: message.sequenceID,
+                            senderDID: message.senderDID,
+                            topicID: message.topicID,
+                            payload: toB64(message.payload)
+                        })),
+                    head: result.head,
+                    oldest: result.oldest
+                };
+            } catch (error) {
+                rethrowAsHandlerError(error);
+            }
+        },
         'hub/unsubscribe': async (ctx)=>{
             const { topicID } = ctx.param;
             const clientDID = getClientDID(ctx);

package/lib/hub.d.ts

@@ -13,7 +13,11 @@ export declare const DEFAULT_HUB_ACCESS_RULES: AccessRules;
 export type HubPurgeOptions = {
     /** Interval between purge runs in milliseconds. Default: 3600000 (1 hour) */
     interval?: number;
-    /** Age in seconds after which unacked stored messages are purged. Default: 604800 (7 days) */
+    /**
+     * The hub's default retention in seconds: the age bound applied to a topic no subscriber asked
+     * to keep for longer. Default: 604800 (7 days). The maximum a subscriber may ask for is the
+     * store's, since the store is the thing that refuses the subscribe.
+     */
     olderThan?: number;
 };
 export type CreateHubParams = {

package/lib/memoryStore.d.ts

@@ -1,12 +1,34 @@
 import type { HubStore } from '@kumiai/hub-protocol';
+export type MemoryStoreRetention = {
+    /** Floor, in seconds, on how long a topic's frames are kept. Default 0. */
+    default?: number;
+    /**
+     * Ceiling, in seconds, on what a subscriber may request. Above it: RetentionExceededError.
+     * Default {@link DEFAULT_MAX_RETENTION} (30 days), finite by design — an unbounded ceiling lets
+     * any subscriber pin a topic's frames forever with `subscribe({ retention: 2**31 })`. A host
+     * wanting no ceiling sets `Number.POSITIVE_INFINITY` explicitly.
+     */
+    max?: number;
+};
 export type MemoryStoreOptions = {
-    /** Per-topic max retained messages; oldest are trimmed beyond this. Default 1000. */
+    /** Per-topic max retained entries; oldest are trimmed beyond this. Default 1000. */
     maxDepth?: number;
+    retention?: MemoryStoreRetention;
 };
 /**
- * In-memory implementation of HubStore for testing and development.
+ * In-memory HubStore for testing and development.
+ *
+ * Retention is a class (per publish) and a duration (per subscribe):
+ * - `'mailbox'` (default) is delivery-derived: readers are known at publish time, so the last ack
+ *   frees the frame, and a publish nobody is subscribed to is dropped outright.
+ * - `'log'` is not: a subscriber that must read a frame may not exist when it is published, so no
+ *   refcount over current subscribers can free it. It is appended whether or not anyone is
+ *   subscribed, and only `trim` or the age bound removes it.
+ *
+ * The store is told the class; it never infers it, and never reads a payload.
  *
- * Single message copy + per-subscriber delivery index + refcount GC. Recipients
- * are resolved from the subscription table at publish time, never passed in.
+ * Both classes are age-bounded: frames live for the longest retention any subscriber asked for,
+ * floored at the hub's default. For mailbox that bound sits alongside the ack GC, ack usually
+ * winning.
  */
 export declare function createMemoryStore(options?: MemoryStoreOptions): HubStore;

package/lib/memoryStore.js

@@ -1,137 +1,234 @@
+import { HeadMismatchError, NotSubscribedError, RetentionExceededError } from '@kumiai/hub-protocol';
 import { EventEmitter } from '@sozai/event';
 const DEFAULT_MAX_DEPTH = 1000;
+/** 30 days, in seconds. A finite default ceiling on requested retention. */ const DEFAULT_MAX_RETENTION = 2_592_000;
 function formatSequenceID(counter) {
     return String(counter).padStart(12, '0');
 }
 /**
- * In-memory implementation of HubStore for testing and development.
+ * In-memory HubStore for testing and development.
  *
- * Single message copy + per-subscriber delivery index + refcount GC. Recipients
- * are resolved from the subscription table at publish time, never passed in.
+ * Retention is a class (per publish) and a duration (per subscribe):
+ * - `'mailbox'` (default) is delivery-derived: readers are known at publish time, so the last ack
+ *   frees the frame, and a publish nobody is subscribed to is dropped outright.
+ * - `'log'` is not: a subscriber that must read a frame may not exist when it is published, so no
+ *   refcount over current subscribers can free it. It is appended whether or not anyone is
+ *   subscribed, and only `trim` or the age bound removes it.
+ *
+ * The store is told the class; it never infers it, and never reads a payload.
+ *
+ * Both classes are age-bounded: frames live for the longest retention any subscriber asked for,
+ * floored at the hub's default. For mailbox that bound sits alongside the ack GC, ack usually
+ * winning.
  */ export function createMemoryStore(options = {}) {
     const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const defaultRetention = options.retention?.default ?? 0;
+    const maxRetention = options.retention?.max ?? DEFAULT_MAX_RETENTION;
     let counter = 0;
-    const messages = new Map();
+    const entries = new Map();
+    const topicLogs = new Map();
+    const heads = new Map();
     const deliveries = new Map();
-    const subscriptions = new Map();
-    const topicMessages = new Map();
+    /**
+   * publishID -> the sequenceID it was accepted as. Not a log entry and not reachable from one: no
+   * deleter takes a publishID, so `removeEntry`, `trim` and `purge` cannot touch this map even by
+   * mistake. Retained indefinitely — it is the only thing that lets a peer replaying its journal
+   * learn that a commit it never saw acknowledged had in fact landed.
+   */ const publishRecords = new Map();
+    /** Per topic: the subscribers, each with the retention it asked for. */ const subscriptions = new Map();
     const keyPackages = new Map();
     const events = new EventEmitter();
-    // Remove a message entirely: every recipient delivery list, the topic log,
-    // and the message record.
-    function deleteMessage(sequenceID) {
-        const record = messages.get(sequenceID);
-        if (record == null) return;
-        for (const recipient of record.recipients){
-            const list = deliveries.get(recipient);
+    // The age bound for a topic: the longest retention any of its subscribers asked for, floored
+    // by the hub's default and by the caller's own bound.
+    function retentionOf(topicID, floor) {
+        let retention = Math.max(floor, defaultRetention);
+        const subscribers = subscriptions.get(topicID);
+        if (subscribers != null) {
+            for (const requested of subscribers.values()){
+                if (requested > retention) retention = requested;
+            }
+        }
+        return retention;
+    }
+    // The only removal path for an entry. Pending deliveries of it go with it: they reference an
+    // entry that no longer exists, so they can no longer be pushed. `heads` is never touched — an
+    // empty log still has a head.
+    function removeEntry(sequenceID) {
+        const entry = entries.get(sequenceID);
+        if (entry == null) return;
+        for (const recipientDID of entry.pendingFor){
+            const list = deliveries.get(recipientDID);
             if (list != null) {
                 const index = list.indexOf(sequenceID);
                 if (index !== -1) list.splice(index, 1);
             }
         }
-        const topicLog = topicMessages.get(record.topicID);
-        if (topicLog != null) {
-            const index = topicLog.indexOf(sequenceID);
-            if (index !== -1) topicLog.splice(index, 1);
-            if (topicLog.length === 0) topicMessages.delete(record.topicID);
+        const log = topicLogs.get(entry.topicID);
+        if (log != null) {
+            const index = log.indexOf(sequenceID);
+            if (index !== -1) log.splice(index, 1);
+            if (log.length === 0) topicLogs.delete(entry.topicID);
         }
-        messages.delete(sequenceID);
+        entries.delete(sequenceID);
     }
-    // Drop one subscriber's delivery of a message; GC the message when its last
-    // recipient is gone (refcount → 0).
-    function removeDelivery(recipientDID, sequenceID) {
+    // Drop one recipient's pending delivery. A mailbox frame whose last delivery is gone has been
+    // read by everyone who was ever going to read it, so it goes with it. A log frame does not: the
+    // subscriber that needs it may not exist yet.
+    function dropDelivery(recipientDID, sequenceID) {
         const list = deliveries.get(recipientDID);
         if (list != null) {
             const index = list.indexOf(sequenceID);
             if (index !== -1) list.splice(index, 1);
         }
-        const record = messages.get(sequenceID);
-        if (record != null) {
-            record.recipients.delete(recipientDID);
-            if (record.recipients.size === 0) {
-                deleteMessage(sequenceID);
-            }
+        const entry = entries.get(sequenceID);
+        if (entry == null) return;
+        entry.pendingFor.delete(recipientDID);
+        if (entry.retain === 'mailbox' && entry.pendingFor.size === 0) {
+            removeEntry(sequenceID);
         }
     }
     return {
         events,
         async publish (params) {
+            const retain = params.retain ?? 'mailbox';
+            // The dedup check comes BEFORE the CAS; the order is load-bearing. A replay carries the
+            // already-accepted publishID and the journalled expectedHead, which the accepted publish
+            // itself made stale — comparing first would raise HeadMismatchError and tell the caller its
+            // commit was lost when it landed. The returned sequenceID may name an already-trimmed frame,
+            // which is correct: a replay asks "did my publish land?", not "give me my frame".
+            if (params.publishID != null) {
+                const accepted = publishRecords.get(params.publishID);
+                if (accepted !== undefined) {
+                    return {
+                        sequenceID: accepted,
+                        deduped: true
+                    };
+                }
+            }
+            // The CAS, before anything is minted or written. Head comparison, sequence mint, append and
+            // head advance are one indivisible step; a loser leaves log, head and sequence untouched (no
+            // entry, no delivery, no sequenceID consumed). Absent expectedHead this is skipped — the
+            // unconditional fast path every mailbox frame takes.
+            if (params.expectedHead !== undefined) {
+                const head = heads.get(params.topicID) ?? null;
+                if (head !== params.expectedHead) {
+                    throw new HeadMismatchError(`Publish to ${params.topicID} expected head ${params.expectedHead ?? 'null'}, but the head is ${head ?? 'null'}`);
+                }
+            }
             counter++;
             const sequenceID = formatSequenceID(counter);
-            // Recipients = current subscribers minus the sender. Zero recipients
-            // (no subscribers, or only the sender) → drop immediately, store nothing.
-            const subscribers = subscriptions.get(params.topicID);
+            if (params.publishID != null) {
+                publishRecords.set(params.publishID, sequenceID);
+            }
+            // Only a log publish moves the head. A head naming a mailbox frame is a head that the
+            // frame's own last ack deletes, leaving readers of the log a head they can never reach.
+            if (retain === 'log') {
+                heads.set(params.topicID, sequenceID);
+            }
+            // Recipients = current subscribers minus the sender.
             const recipients = new Set();
+            const subscribers = subscriptions.get(params.topicID);
             if (subscribers != null) {
-                for (const did of subscribers){
-                    if (did !== params.senderDID) recipients.add(did);
+                for (const subscriberDID of subscribers.keys()){
+                    if (subscriberDID !== params.senderDID) recipients.add(subscriberDID);
                 }
             }
-            if (recipients.size === 0) {
-                return sequenceID;
+            // A mailbox frame with no recipients has already been read by everyone who was going to
+            // read it. A log frame is kept regardless: its reader may not exist yet.
+            if (retain === 'mailbox' && recipients.size === 0) {
+                return {
+                    sequenceID,
+                    deduped: false
+                };
             }
-            const record = {
+            const entry = {
                 sequenceID,
                 senderDID: params.senderDID,
                 topicID: params.topicID,
                 payload: params.payload,
-                recipients,
-                storedAt: Date.now()
+                storedAt: Date.now(),
+                retain,
+                pendingFor: recipients
             };
-            messages.set(sequenceID, record);
-            for (const recipient of recipients){
-                let list = deliveries.get(recipient);
+            entries.set(sequenceID, entry);
+            let log = topicLogs.get(params.topicID);
+            if (log == null) {
+                log = [];
+                topicLogs.set(params.topicID, log);
+            }
+            log.push(sequenceID);
+            for (const recipientDID of recipients){
+                let list = deliveries.get(recipientDID);
                 if (list == null) {
                     list = [];
-                    deliveries.set(recipient, list);
+                    deliveries.set(recipientDID, list);
                 }
                 list.push(sequenceID);
             }
-            let topicLog = topicMessages.get(params.topicID);
-            if (topicLog == null) {
-                topicLog = [];
-                topicMessages.set(params.topicID, topicLog);
-            }
-            topicLog.push(sequenceID);
-            // Per-topic max-depth trim: drop oldest beyond the bound.
-            while(topicLog.length > maxDepth){
-                deleteMessage(topicLog[0]);
+            // Depth bound: a trim like any other (moves oldest, leaves head alone), counting LOG frames
+            // only. A mailbox frame is bounded by ack and age, not depth; counting it here would let any
+            // member evict the commit log with a mailbox flood. Only a log publish can push the log-class
+            // count over the bound, so this is skipped for the mailbox fast path.
+            if (retain === 'log') {
+                let logDepth = 0;
+                for (const id of log){
+                    if (entries.get(id)?.retain === 'log') logDepth++;
+                }
+                while(logDepth > maxDepth){
+                    const oldestLog = log.find((id)=>entries.get(id)?.retain === 'log');
+                    if (oldestLog == null) break;
+                    removeEntry(oldestLog);
+                    logDepth--;
+                }
             }
-            return sequenceID;
+            return {
+                sequenceID,
+                deduped: false
+            };
         },
         async fetch (params) {
             if (params.ack != null && params.ack.length > 0) {
                 for (const sequenceID of params.ack){
-                    removeDelivery(params.recipientDID, sequenceID);
+                    dropDelivery(params.recipientDID, sequenceID);
                 }
             }
-            const recipientDeliveries = deliveries.get(params.recipientDID);
-            if (recipientDeliveries == null || recipientDeliveries.length === 0) {
+            const pending = deliveries.get(params.recipientDID);
+            if (pending == null || pending.length === 0) {
                 return {
                     messages: [],
                     cursor: null
                 };
             }
-            let startIndex = 0;
-            if (params.after != null) {
-                const afterIndex = recipientDeliveries.indexOf(params.after);
-                if (afterIndex !== -1) {
-                    startIndex = afterIndex + 1;
+            // `after` is an exclusive cursor: the first pending delivery with sequenceID strictly greater
+            // than it. Pending is in append order (strictly increasing), so this is the position just
+            // past `after` whether or not `after` is still pending. Matching on the value (indexOf) would
+            // fall back to index 0 once the cursored delivery is acked or aged out between pages of a
+            // drain, silently restarting from the top and re-serving frames already handed out. Scanning
+            // for `> after` resumes where the cursor pointed even after its own entry is gone.
+            let startIndex = pending.length;
+            if (params.after == null) {
+                startIndex = 0;
+            } else {
+                for(let index = 0; index < pending.length; index++){
+                    if (pending[index] > params.after) {
+                        startIndex = index;
+                        break;
+                    }
                 }
             }
-            const available = recipientDeliveries.slice(startIndex);
+            const available = pending.slice(startIndex);
             const limit = params.limit ?? available.length;
             const selected = available.slice(0, limit);
             const hasMore = available.length > limit;
             const resultMessages = [];
             for (const sequenceID of selected){
-                const record = messages.get(sequenceID);
-                if (record != null) {
+                const entry = entries.get(sequenceID);
+                if (entry != null) {
                     resultMessages.push({
-                        sequenceID: record.sequenceID,
-                        senderDID: record.senderDID,
-                        topicID: record.topicID,
-                        payload: record.payload
+                        sequenceID: entry.sequenceID,
+                        senderDID: entry.senderDID,
+                        topicID: entry.topicID,
+                        payload: entry.payload
                     });
                 }
             }
@@ -145,20 +242,73 @@ function formatSequenceID(counter) {
             }
             return result;
         },
+        async fetchTopic (params) {
+            if (!subscriptions.get(params.topicID)?.has(params.subscriberDID)) {
+                throw new NotSubscribedError(`${params.subscriberDID} is not a subscriber of ${params.topicID}`);
+            }
+            // A topic's LOG is its log-class frames and nothing else. A mailbox frame published to a log
+            // topic is still delivered (push is untouched) but never enters the log: it does not move the
+            // head, so a reader that saw one would hold a cursor naming a position the head can never
+            // reach, and every CAS anchored there would lose forever. Only the publisher's own `retain`
+            // sets the class.
+            const log = (topicLogs.get(params.topicID) ?? []).filter((sequenceID)=>entries.get(sequenceID)?.retain === 'log');
+            const after = params.after;
+            // Filter to the class BEFORE the limit: a page of mailbox frames must not eat the limit and
+            // hand back an empty page while log frames wait — a caller draining until a short page would
+            // stop early and strand itself.
+            const selected = after == null ? log : log.filter((sequenceID)=>sequenceID > after);
+            const limited = params.limit == null ? selected : selected.slice(0, params.limit);
+            const messages = [];
+            for (const sequenceID of limited){
+                const entry = entries.get(sequenceID);
+                if (entry != null) {
+                    messages.push({
+                        sequenceID: entry.sequenceID,
+                        senderDID: entry.senderDID,
+                        topicID: entry.topicID,
+                        payload: entry.payload
+                    });
+                }
+            }
+            return {
+                messages,
+                head: heads.get(params.topicID) ?? null,
+                oldest: log.length > 0 ? log[0] : null
+            };
+        },
+        async trim (params) {
+            const log = topicLogs.get(params.topicID);
+            if (log == null) return;
+            for (const sequenceID of [
+                ...log
+            ]){
+                // Log-class frames only. A mailbox frame shares the topic's array but not its log: it is
+                // delivery-derived, freed by its last ack or by age, and trim never removes it — trimming
+                // the mixed array silently drops pending mail below the bound.
+                if (sequenceID < params.before && entries.get(sequenceID)?.retain === 'log') {
+                    removeEntry(sequenceID);
+                }
+            }
+        },
         async ack (params) {
             for (const sequenceID of params.sequenceIDs){
-                removeDelivery(params.recipientDID, sequenceID);
+                dropDelivery(params.recipientDID, sequenceID);
             }
         },
         async purge (params) {
-            const threshold = Date.now() - params.olderThan * 1000;
+            // The age bound, for both classes: the same removal path, the same invariants — head is
+            // untouched.
+            const now = Date.now();
             const purgedIDs = [];
-            for (const [sequenceID, record] of messages){
-                if (record.storedAt <= threshold) {
+            for (const [sequenceID, entry] of entries){
+                const retention = retentionOf(entry.topicID, params.olderThan);
+                if (entry.storedAt <= now - retention * 1000) {
                     purgedIDs.push(sequenceID);
-                    deleteMessage(sequenceID);
                 }
             }
+            for (const sequenceID of purgedIDs){
+                removeEntry(sequenceID);
+            }
             if (purgedIDs.length > 0) {
                 await events.emit('purge', {
                     sequenceIDs: purgedIDs
@@ -166,50 +316,43 @@ function formatSequenceID(counter) {
             }
             return purgedIDs;
         },
-        async subscribe (subscriberDID, topicID) {
-            let subs = subscriptions.get(topicID);
-            if (subs == null) {
-                subs = new Set();
-                subscriptions.set(topicID, subs);
+        async subscribe (params) {
+            const requested = params.retention ?? defaultRetention;
+            if (requested > maxRetention) {
+                throw new RetentionExceededError(`Requested retention of ${requested}s exceeds the maximum of ${maxRetention}s`);
             }
-            subs.add(subscriberDID);
+            let subscribers = subscriptions.get(params.topicID);
+            if (subscribers == null) {
+                subscribers = new Map();
+                subscriptions.set(params.topicID, subscribers);
+            }
+            subscribers.set(params.subscriberDID, requested);
         },
         async unsubscribe (subscriberDID, topicID) {
-            const subs = subscriptions.get(topicID);
-            if (subs != null) {
-                subs.delete(subscriberDID);
-                if (subs.size === 0) {
+            const subscribers = subscriptions.get(topicID);
+            if (subscribers != null) {
+                subscribers.delete(subscriberDID);
+                if (subscribers.size === 0) {
                     subscriptions.delete(topicID);
                 }
             }
-            // Drop this subscriber's pending deliveries for the topic.
-            const list = deliveries.get(subscriberDID);
-            if (list != null) {
+            // Drops this subscriber's pending deliveries for the topic — freeing a mailbox frame whose
+            // last delivery this was, and leaving a log frame standing.
+            const pending = deliveries.get(subscriberDID);
+            if (pending != null) {
                 for (const sequenceID of [
-                    ...list
+                    ...pending
                 ]){
-                    const record = messages.get(sequenceID);
-                    if (record != null && record.topicID === topicID) {
-                        removeDelivery(subscriberDID, sequenceID);
-                    }
-                }
-            }
-            // Last subscriber gone → drop the whole topic log immediately.
-            if (!subscriptions.has(topicID)) {
-                const topicLog = topicMessages.get(topicID);
-                if (topicLog != null) {
-                    for (const sequenceID of [
-                        ...topicLog
-                    ]){
-                        deleteMessage(sequenceID);
+                    if (entries.get(sequenceID)?.topicID === topicID) {
+                        dropDelivery(subscriberDID, sequenceID);
                     }
                 }
             }
         },
         async getSubscribers (topicID) {
-            const subs = subscriptions.get(topicID);
-            return subs == null ? [] : [
-                ...subs
+            const subscribers = subscriptions.get(topicID);
+            return subscribers == null ? [] : [
+                ...subscribers.keys()
             ];
         },
         async storeKeyPackage (ownerDID, keyPackage) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kumiai/hub-server",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "Hub server for Enkaku E2EE group message routing",
   "keywords": [
@@ -25,18 +25,19 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@sozai/codec": "^0.1.0",
-    "@sozai/event": "^0.1.0",
-    "@enkaku/protocol": "^0.18.0",
-    "@enkaku/server": "^0.18.0",
-    "@sozai/stream": "^0.1.0",
-    "@kokuin/token": "^0.1.0",
-    "@kumiai/mls": "^0.1.0",
-    "@kumiai/hub-protocol": "^0.1.0"
+    "@sozai/codec": "^0.2.0",
+    "@sozai/event": "^0.1.1",
+    "@enkaku/protocol": "^0.19.0",
+    "@enkaku/server": "^0.19.0",
+    "@sozai/stream": "^0.2.0",
+    "@kokuin/token": "^0.2.0",
+    "@kumiai/hub-protocol": "^0.3.0",
+    "@kumiai/mls": "^0.3.0"
   },
   "devDependencies": {
-    "@enkaku/client": "^0.18.0",
-    "@enkaku/transport": "^0.18.0"
+    "@enkaku/client": "^0.19.0",
+    "@enkaku/transport": "^0.19.1",
+    "@kumiai/hub-conformance": "^0.3.0"
   },
   "scripts": {
     "build:clean": "del lib",