@kumiai/hub-server 0.10.2 → 0.10.4

package/README.md

@@ -90,6 +90,7 @@ flood.
 
 Publish rate limits are per DID (20/s, burst 50) and per topic (100/s, burst 200), merged over
 `DEFAULT_RATE_LIMITS`; `hub/v1/keypackage/fetch` has its own request quota per requester DID.
+A request over a limit is refused with `HUB_RATE_LIMITED` (`RateLimitedError`) before it takes effect, so the caller waits and retries it.
 
 ## A store failure that is not a request failure
 

package/lib/handlers.js

@@ -239,13 +239,13 @@ export function createHandlers(params) {
             }
             if (!didLimiter.tryConsume(senderDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Publish rate limit exceeded for DID'
                 });
             }
             if (!topicLimiter.tryConsume(topicID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Publish rate limit exceeded for topic'
                 });
             }
@@ -357,7 +357,7 @@ export function createHandlers(params) {
             }
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Subscribe rate limit exceeded for DID'
                 });
             }
@@ -417,7 +417,7 @@ export function createHandlers(params) {
             const clientDID = getClientDID(ctx);
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Unsubscribe rate limit exceeded for DID'
                 });
             }
@@ -681,7 +681,7 @@ export function createHandlers(params) {
             }
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Key package upload rate limit exceeded for DID'
                 });
             }
@@ -844,7 +844,7 @@ export function createHandlers(params) {
             }
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Key package status rate limit exceeded for DID'
                 });
             }
@@ -895,7 +895,7 @@ export function createHandlers(params) {
             }
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Wake rate limit exceeded for DID'
                 });
             }
@@ -959,7 +959,7 @@ export function createHandlers(params) {
             // the same, or the uncounted half is the one an abusive caller uses.
             if (!didLimiter.tryConsume(clientDID)) {
                 throw new HandlerError({
-                    code: 'EK01',
+                    code: HUB_ERROR_CODES.rateLimited,
                     message: 'Wake rate limit exceeded for DID'
                 });
             }

package/lib/hub.d.ts

@@ -1,5 +1,6 @@
 import type { ServerTransportOf } from '@enkaku/protocol';
 import type { AccessRules, ReplayOptions, ResourceLimits, Server } from '@enkaku/server';
+import type { VerifyTokenHook } from '@kokuin/capability';
 import type { Identity } from '@kokuin/token';
 import type { HubProtocol, HubStore, WakeRegistry, WakeSender } from '@kumiai/hub-protocol';
 import { type AuthorizeHook, type HubRateLimits, type HubStoreErrorHook, type KeyPackageFetchLimits } from './handlers.js';
@@ -41,6 +42,12 @@ export type CreateHubParams = {
      * allow-any-authed.
      */
     authorize?: AuthorizeHook;
+    /**
+     * Called for each capability in a delegation chain after it verifies; throw to reject. This is
+     * where a host plugs in revocation. Forwarded to `serve()`, which only consults it for
+     * delegated capabilities.
+     */
+    verifyToken?: VerifyTokenHook;
     /** Publish rate limits. Merged over {@link DEFAULT_RATE_LIMITS}. */
     rateLimits?: Partial<HubRateLimits>;
     /**
@@ -81,5 +88,10 @@ export type CreateHubParams = {
 export type HubInstance = {
     registry: HubClientRegistry;
     server: Server<HubProtocol>;
+    /**
+     * Stops the purge timer, waits for an in-flight purge and in-flight wake sends, then disposes the
+     * server. Idempotent: every call returns the same promise.
+     */
+    dispose(): Promise<void>;
 };
 export declare function createHub(params: CreateHubParams): HubInstance;

package/lib/hub.js

@@ -56,6 +56,7 @@ export function createHub(params) {
         transport: params.transport,
         identity: params.identity,
         accessRules: params.accessRules ?? DEFAULT_HUB_ACCESS_RULES,
+        verifyToken: params.verifyToken,
         replay: {
             ...params.replay,
             enabled: true,
@@ -63,27 +64,50 @@ export function createHub(params) {
         },
         limits
     });
+    let purgeTimer;
+    const purgesInFlight = new Set();
     if (params.purge !== false) {
         const interval = params.purge?.interval ?? 3_600_000;
         const olderThan = params.purge?.olderThan ?? 604_800;
-        const purgeTimer = setInterval(()=>{
-            params.store.purge({
+        purgeTimer = setInterval(()=>{
+            const run = params.store.purge({
                 olderThan
-            }).catch((error)=>{
+            }).then(()=>{}).catch((error)=>{
                 // Purge failures are non-fatal; retried on the next interval
                 storeErrorReporter({
                     method: 'purge',
                     error
                 });
             });
+            purgesInFlight.add(run);
+            void run.finally(()=>{
+                purgesInFlight.delete(run);
+            });
         }, interval);
-        server.disposed.then(()=>clearInterval(purgeTimer));
     }
-    if (wakeDispatcher != null) {
-        server.disposed.then(()=>wakeDispatcher.dispose());
+    // Stop background work first so nothing new starts, then drain what already did, then the server.
+    let teardown;
+    function stopBackground() {
+        teardown ??= (async ()=>{
+            if (purgeTimer != null) clearInterval(purgeTimer);
+            await Promise.all(purgesInFlight);
+            await wakeDispatcher?.dispose();
+        })();
+        return teardown;
+    }
+    let disposing;
+    function dispose() {
+        disposing ??= (async ()=>{
+            await stopBackground();
+            await server.dispose();
+        })();
+        return disposing;
     }
+    // Disposing the server directly must still stop purge and wake.
+    void server.disposed.then(stopBackground);
     return {
         registry,
-        server
+        server,
+        dispose
     };
 }

package/lib/wake.d.ts

@@ -20,7 +20,8 @@ export type WakeDispatcher = {
     notify(params: WakeNotifyParams): void;
     /** The device bound a receive channel: drop any pending trailing ping. */
     online(did: string): void;
-    dispose(): void;
+    /** Stops accepting frames, drops pending windows, and waits for every in-flight send to settle. */
+    dispose(): Promise<void>;
 };
 /**
  * Coalesces wake pings per DID on a LEADING edge: the first frame pings immediately, then a window

package/lib/wake.js

@@ -11,6 +11,7 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
  */ export function createWakeDispatcher(params) {
     const debounceMs = params.debounceMs ?? DEFAULT_DEBOUNCE_MS;
     const pending = new Map();
+    const inFlight = new Set();
     let disposed = false;
     function report(did, error) {
         try {
@@ -25,7 +26,7 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
     function send(did, topicID, sequenceID, count) {
         // Deliberately not awaited: a slow or hanging provider must never delay the publish fan-out
         // this is called from.
-        void (async ()=>{
+        const task = (async ()=>{
             try {
                 const registration = await params.registry.get(did);
                 if (registration == null) return;
@@ -45,7 +46,8 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
                     case 'delivered':
                         break;
                     case 'gone':
-                        await params.registry.delete(did);
+                        // A hub being torn down must not write to a registry its host may already be closing.
+                        if (!disposed) await params.registry.delete(did);
                         break;
                     case 'retry':
                         report(did, new Error('Wake send failed transiently'));
@@ -59,6 +61,8 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
                 report(did, error);
             }
         })();
+        inFlight.add(task);
+        void task.finally(()=>inFlight.delete(task));
     }
     function openWindow(did) {
         const entry = {
@@ -103,10 +107,11 @@ const DEFAULT_DEBOUNCE_MS = 10_000;
             clearTimeout(entry.timer);
             pending.delete(did);
         },
-        dispose () {
+        async dispose () {
             disposed = true;
             for (const entry of pending.values())clearTimeout(entry.timer);
             pending.clear();
+            await Promise.all(inFlight);
         }
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kumiai/hub-server",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Hub server for Enkaku E2EE group message routing",
   "keywords": [
     "hub",
@@ -25,17 +25,18 @@
     "lib/*"
   ],
   "dependencies": {
-    "@enkaku/protocol": "^0.21.4",
-    "@enkaku/server": "^0.21.3",
-    "@kokuin/token": "^0.5.0",
-    "@kumiai/hub-protocol": "^0.10.1",
-    "@sozai/codec": "^0.4.2",
-    "@sozai/event": "^0.1.5",
+    "@enkaku/protocol": "^0.21.5",
+    "@enkaku/server": "^0.21.5",
+    "@kokuin/capability": "^0.4.2",
+    "@kokuin/token": "^0.5.1",
+    "@kumiai/hub-protocol": "^0.10.2",
+    "@sozai/codec": "^0.4.3",
+    "@sozai/event": "^0.1.6",
     "@sozai/log": "^0.4.0"
   },
   "devDependencies": {
-    "@enkaku/client": "^0.21.3",
-    "@enkaku/transport": "^0.21.3",
+    "@enkaku/client": "^0.21.5",
+    "@enkaku/transport": "^0.21.5",
     "@kumiai/hub-conformance": "^0.10.1",
     "@kumiai/hub-wake": "^0.10.0"
   },