@kumiai/hub-server 0.10.1 → 0.10.3

package/lib/handlers.js

@@ -405,7 +405,8 @@ export function createHandlers(params) {
                             payload: toB64(message.payload)
                         })),
                     head: result.head,
-                    oldest: result.oldest
+                    oldest: result.oldest,
+                    gap: result.gap
                 };
             } catch (error) {
                 rethrowAsHandlerError(error);

package/lib/hub.d.ts

@@ -1,5 +1,6 @@
 import type { ServerTransportOf } from '@enkaku/protocol';
 import type { AccessRules, ReplayOptions, ResourceLimits, Server } from '@enkaku/server';
+import type { VerifyTokenHook } from '@kokuin/capability';
 import type { Identity } from '@kokuin/token';
 import type { HubProtocol, HubStore, WakeRegistry, WakeSender } from '@kumiai/hub-protocol';
 import { type AuthorizeHook, type HubRateLimits, type HubStoreErrorHook, type KeyPackageFetchLimits } from './handlers.js';
@@ -41,6 +42,12 @@ export type CreateHubParams = {
      * allow-any-authed.
      */
     authorize?: AuthorizeHook;
+    /**
+     * Called for each capability in a delegation chain after it verifies; throw to reject. This is
+     * where a host plugs in revocation. Forwarded to `serve()`, which only consults it for
+     * delegated capabilities.
+     */
+    verifyToken?: VerifyTokenHook;
     /** Publish rate limits. Merged over {@link DEFAULT_RATE_LIMITS}. */
     rateLimits?: Partial<HubRateLimits>;
     /**
@@ -81,5 +88,10 @@ export type CreateHubParams = {
 export type HubInstance = {
     registry: HubClientRegistry;
     server: Server<HubProtocol>;
+    /**
+     * Stops the purge timer, waits for an in-flight purge and in-flight wake sends, then disposes the
+     * server. Idempotent: every call returns the same promise.
+     */
+    dispose(): Promise<void>;
 };
 export declare function createHub(params: CreateHubParams): HubInstance;

package/lib/hub.js

@@ -56,6 +56,7 @@ export function createHub(params) {
         transport: params.transport,
         identity: params.identity,
         accessRules: params.accessRules ?? DEFAULT_HUB_ACCESS_RULES,
+        verifyToken: params.verifyToken,
         replay: {
             ...params.replay,
             enabled: true,
@@ -63,27 +64,50 @@ export function createHub(params) {
         },
         limits
     });
+    let purgeTimer;
+    const purgesInFlight = new Set();
     if (params.purge !== false) {
         const interval = params.purge?.interval ?? 3_600_000;
         const olderThan = params.purge?.olderThan ?? 604_800;
-        const purgeTimer = setInterval(()=>{
-            params.store.purge({
+        purgeTimer = setInterval(()=>{
+            const run = params.store.purge({
                 olderThan
-            }).catch((error)=>{
+            }).then(()=>{}).catch((error)=>{
                 // Purge failures are non-fatal; retried on the next interval
                 storeErrorReporter({
                     method: 'purge',
                     error
                 });
             });
+            purgesInFlight.add(run);
+            void run.finally(()=>{
+                purgesInFlight.delete(run);
+            });
         }, interval);
-        server.disposed.then(()=>clearInterval(purgeTimer));
     }
-    if (wakeDispatcher != null) {
-        server.disposed.then(()=>wakeDispatcher.dispose());
+    // Stop background work first so nothing new starts, then drain what already did, then the server.
+    let teardown;
+    function stopBackground() {
+        teardown ??= (async ()=>{
+            if (purgeTimer != null) clearInterval(purgeTimer);
+            await Promise.all(purgesInFlight);
+            await wakeDispatcher?.dispose();
+        })();
+        return teardown;
+    }
+    let disposing;
+    function dispose() {
+        disposing ??= (async ()=>{
+            await stopBackground();
+            await server.dispose();
+        })();
+        return disposing;
     }
+    // Disposing the server directly must still stop purge and wake.
+    void server.disposed.then(stopBackground);
     return {
         registry,
-        server
+        server,
+        dispose
     };
 }

package/lib/memoryStore.js

@@ -54,6 +54,7 @@ function isLive(entry, nowSeconds) {
     const entries = new Map();
     const topicLogs = new Map();
     const heads = new Map();
+    const removedThrough = new Map();
     const deliveries = new Map();
     /**
    * publishID -> the sequenceID it was accepted as. Not a log entry and not reachable from one: no
@@ -87,6 +88,10 @@ function isLive(entry, nowSeconds) {
     function removeEntry(sequenceID) {
         const entry = entries.get(sequenceID);
         if (entry == null) return;
+        if (entry.retain === 'log') {
+            const removed = removedThrough.get(entry.topicID);
+            if (removed == null || sequenceID > removed) removedThrough.set(entry.topicID, sequenceID);
+        }
         for (const recipientDID of entry.pendingFor){
             const list = deliveries.get(recipientDID);
             if (list != null) {
@@ -295,7 +300,8 @@ function isLive(entry, nowSeconds) {
             return {
                 messages,
                 head: heads.get(params.topicID) ?? null,
-                oldest: log[0] ?? null
+                oldest: log[0] ?? null,
+                gap: removedThrough.has(params.topicID) && (after == null || removedThrough.get(params.topicID) > after)
             };
         },
         async trim (params) {
@@ -318,14 +324,17 @@ function isLive(entry, nowSeconds) {
             }
         },
         async purge (params) {
-            // The age bound, for both classes: the same removal path, the same invariants — head is
-            // untouched.
             const now = Date.now();
             const purgedIDs = [];
+            const retainedTopics = new Set();
+            // Insertion order is log-position order, even if the clock moves backwards.
             for (const [sequenceID, entry] of entries){
+                if (entry.retain === 'log' && retainedTopics.has(entry.topicID)) continue;
                 const retention = retentionOf(entry.topicID, params.olderThan);
                 if (entry.storedAt <= now - retention * 1000) {
                     purgedIDs.push(sequenceID);
+                } else if (entry.retain === 'log') {
+                    retainedTopics.add(entry.topicID);
                 }
             }
             for (const sequenceID of purgedIDs){

package/lib/wake.d.ts

@@ -20,7 +20,8 @@ export type WakeDispatcher = {
     notify(params: WakeNotifyParams): void;
     /** The device bound a receive channel: drop any pending trailing ping. */
     online(did: string): void;
-    dispose(): void;
+    /** Stops accepting frames, drops pending windows, and waits for every in-flight send to settle. */
+    dispose(): Promise<void>;
 };
 /**
  * Coalesces wake pings per DID on a LEADING edge: the first frame pings immediately, then a window

package/lib/wake.js

@@ -11,6 +11,7 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
  */ export function createWakeDispatcher(params) {
     const debounceMs = params.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     const pending = new Map();
+    const inFlight = new Set();
     let disposed = false;
     function report(did, error) {
         try {
@@ -25,7 +26,7 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
     function send(did, topicID, sequenceID, count) {
         // Deliberately not awaited: a slow or hanging provider must never delay the publish fan-out
         // this is called from.
-        void (async ()=>{
+        const task = (async ()=>{
             try {
                 const registration = await params.registry.get(did);
                 if (registration == null) return;
@@ -45,7 +46,8 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
                     case 'delivered':
                         break;
                     case 'gone':
-                        await params.registry.delete(did);
+                        // A hub being torn down must not write to a registry its host may already be closing.
+                        if (!disposed) await params.registry.delete(did);
                         break;
                     case 'retry':
                         report(did, new Error('Wake send failed transiently'));
@@ -59,6 +61,8 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
                 report(did, error);
             }
         })();
+        inFlight.add(task);
+        void task.finally(()=>inFlight.delete(task));
     }
     function openWindow(did) {
         const entry = {
@@ -103,10 +107,11 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
             clearTimeout(entry.timer);
             pending.delete(did);
         },
-        dispose () {
+        async dispose () {
             disposed = true;
             for (const entry of pending.values())clearTimeout(entry.timer);
             pending.clear();
+            await Promise.all(inFlight);
         }
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kumiai/hub-server",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Hub server for Enkaku E2EE group message routing",
   "keywords": [
     "hub",
@@ -25,18 +25,19 @@
     "lib/*"
   ],
   "dependencies": {
-    "@enkaku/protocol": "^0.21.3",
-    "@enkaku/server": "^0.21.3",
-    "@kokuin/token": "^0.5.0",
-    "@kumiai/hub-protocol": "^0.10.0",
-    "@sozai/codec": "^0.4.0",
-    "@sozai/event": "^0.1.3",
-    "@sozai/log": "^0.3.1"
+    "@enkaku/protocol": "^0.21.4",
+    "@enkaku/server": "^0.21.4",
+    "@kokuin/capability": "^0.4.1",
+    "@kokuin/token": "^0.5.1",
+    "@kumiai/hub-protocol": "^0.10.1",
+    "@sozai/codec": "^0.4.2",
+    "@sozai/event": "^0.1.5",
+    "@sozai/log": "^0.4.0"
   },
   "devDependencies": {
     "@enkaku/client": "^0.21.3",
     "@enkaku/transport": "^0.21.3",
-    "@kumiai/hub-conformance": "^0.10.0",
+    "@kumiai/hub-conformance": "^0.10.1",
     "@kumiai/hub-wake": "^0.10.0"
   },
   "publishConfig": {