@novasamatech/statement-store 0.7.0-0 → 0.7.0-1

package/dist/adapter/lazyClient.d.ts

@@ -1,6 +1,5 @@
 import type { RequestFn, SubscribeFn } from '@novasamatech/sdk-statement';
-import type { JsonRpcProvider } from '@polkadot-api/json-rpc-provider';
-import type { PolkadotClient } from 'polkadot-api';
+import type { JsonRpcProvider, PolkadotClient } from 'polkadot-api';
 export type LazyClient = ReturnType<typeof createLazyClient>;
 export declare const createLazyClient: (provider: JsonRpcProvider) => {
     getClient(): PolkadotClient;

package/dist/adapter/lazyClient.js

@@ -1,5 +1,7 @@
 import { createClient as createSubstrateClient } from '@polkadot-api/substrate-client';
 import { createClient as createPolkadotClient } from 'polkadot-api';
+// eslint-disable-next-line @typescript-eslint/no-empty-function
+const noop = () => { };
 export const createLazyClient = (provider) => {
     let polkadotClient = null;
     let substrateClient = null;
@@ -28,12 +30,31 @@ export const createLazyClient = (provider) => {
         getSubscribeFn() {
             const c = getSubstrateClient();
             return (method, params, onMessage, onError) => {
-                return c._request(method, params, {
-                    onSuccess: (subscriptionId, followSubscription) => {
-                        followSubscription(subscriptionId, { next: onMessage, error: onError });
+                let subscriptionId = null;
+                let unsubscribeLocal = null;
+                const cancelRequest = c._request(method, params, {
+                    onSuccess: (subId, followSubscription) => {
+                        subscriptionId = subId;
+                        unsubscribeLocal = followSubscription(subId, { next: onMessage, error: onError });
                     },
                     onError,
                 });
+                // Derive the unsubscribe RPC method from the subscribe method name
+                // e.g. statement_subscribeStatement -> statement_unsubscribeStatement
+                const unsubscribeMethod = method.replace('subscribe', 'unsubscribe');
+                return () => {
+                    if (unsubscribeLocal) {
+                        unsubscribeLocal();
+                        // Send the server-side unsubscribe RPC call
+                        c._request(unsubscribeMethod, [subscriptionId], {
+                            onSuccess: noop,
+                            onError: noop,
+                        });
+                    }
+                    else {
+                        cancelRequest();
+                    }
+                };
             };
         },
         disconnect() {

package/dist/adapter/rpc.js

@@ -1,15 +1,19 @@
+import { toHex } from '@novasamatech/scale';
 import { createStatementSdk } from '@novasamatech/sdk-statement';
-import { toHex } from '@polkadot-api/utils';
 import { errAsync, fromPromise, okAsync } from 'neverthrow';
 import { toError } from '../helpers.js';
 import { AccountFullError, AlreadyExpiredError, BadProofError, DataTooLargeError, EncodingTooLargeError, ExpiryTooLowError, InternalStoreError, KnownExpiredError, NoAllowanceError, NoProofError, StorageFullError, } from './types.js';
-function createKey(topics) {
-    return topics.map(toHex).sort().join('');
+function toSdkTopicFilter(filter) {
+    if ('matchAll' in filter) {
+        return { matchAll: filter.matchAll.map(toHex) };
+    }
+    return { matchAny: filter.matchAny.map(toHex) };
 }
-function toTopicFilter(topics) {
-    if (topics.length === 0)
-        return 'any';
-    return { matchAll: topics.map(t => toHex(t)) };
+function createKey(filter) {
+    if ('matchAll' in filter) {
+        return `matchAll:${filter.matchAll.map(toHex).sort().join(',')}`;
+    }
+    return `matchAny:${filter.matchAny.map(toHex).sort().join(',')}`;
 }
 export function createPapiStatementStoreAdapter(lazyClient) {
     const sdk = createStatementSdk(lazyClient.getRequestFn(), lazyClient.getSubscribeFn());
@@ -25,28 +29,24 @@ export function createPapiStatementStoreAdapter(lazyClient) {
         return list;
     }
     function removeCallback(key, callback) {
-        let list = callbacks.get(key);
+        const list = callbacks.get(key);
         if (!list)
             return [];
-        list = list.filter(x => x !== callback);
-        if (list.length === 0) {
+        const idx = list.indexOf(callback);
+        if (idx !== -1)
+            list.splice(idx, 1);
+        if (list.length === 0)
             callbacks.delete(key);
-        }
-        else {
-            callbacks.set(key, list);
-        }
         return list;
     }
     const adapter = {
-        queryStatements(topics) {
-            const filter = toTopicFilter(topics);
-            return fromPromise(sdk.getStatements(filter), toError);
+        queryStatements(filter) {
+            return fromPromise(sdk.getStatements(toSdkTopicFilter(filter)), toError);
         },
-        subscribeStatements(topics, callback) {
-            const key = createKey(topics);
+        subscribeStatements(filter, callback) {
+            const key = createKey(filter);
             const list = addCallback(key, callback);
             if (list.length === 1) {
-                const filter = toTopicFilter(topics);
                 let batch = [];
                 let flushScheduled = false;
                 const flush = () => {
@@ -58,11 +58,11 @@ export function createPapiStatementStoreAdapter(lazyClient) {
                     const currentCallbacks = callbacks.get(key);
                     if (currentCallbacks) {
                         for (const fn of currentCallbacks) {
-                            fn(statements);
+                            fn({ statements, isComplete: true });
                         }
                     }
                 };
-                const unsub = sdk.subscribeStatements(filter, statement => {
+                const unsub = sdk.subscribeStatements(toSdkTopicFilter(filter), statement => {
                     batch.push(statement);
                     if (!flushScheduled) {
                         flushScheduled = true;

package/dist/adapter/types.d.ts

@@ -1,8 +1,17 @@
 import type { SignedStatement, Statement } from '@novasamatech/sdk-statement';
 import type { ResultAsync } from 'neverthrow';
+export type TopicFilter = {
+    matchAll: Uint8Array[];
+} | {
+    matchAny: Uint8Array[];
+};
+export type StatementsPage = {
+    statements: Statement[];
+    isComplete: boolean;
+};
 export type StatementStoreAdapter = {
-    queryStatements(topics: Uint8Array[], destination?: Uint8Array): ResultAsync<Statement[], Error>;
-    subscribeStatements(topics: Uint8Array[], callback: (statements: Statement[]) => unknown): VoidFunction;
+    queryStatements(filter: TopicFilter, destination?: Uint8Array): ResultAsync<Statement[], Error>;
+    subscribeStatements(filter: TopicFilter, callback: (page: StatementsPage) => unknown): VoidFunction;
     submitStatement(statement: SignedStatement): ResultAsync<void, DataTooLargeError | ExpiryTooLowError | AccountFullError | StorageFullError | NoProofError | BadProofError | EncodingTooLargeError | NoAllowanceError | AlreadyExpiredError | KnownExpiredError | InternalStoreError | Error>;
 };
 export declare class DataTooLargeError extends Error {

package/dist/crypto.d.ts

@@ -4,7 +4,7 @@ export declare function stringToBytes(str: string): Uint8Array<ArrayBuffer>;
 /**
  * blake2b_256 with key
  */
-export declare function khash(secret: Uint8Array, message: Uint8Array): Uint8Array<ArrayBufferLike>;
+export declare function khash(secret: Uint8Array, message: Uint8Array): Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
 export declare function createSr25519Secret(entropy: Uint8Array, derivation?: string): Uint8Array<ArrayBufferLike>;
 export declare function createSr25519Derivation(secret: Uint8Array, derivation: string): Uint8Array<ArrayBufferLike>;
 export declare function deriveSr25519PublicKey(secret: Uint8Array): Uint8Array;

package/dist/model/session.js

@@ -1,4 +1,4 @@
-import { mergeUint8 } from '@polkadot-api/utils';
+import { mergeUint8 } from 'polkadot-api/utils';
 import { Bytes } from 'scale-ts';
 import { khash, stringToBytes } from '../crypto.js';
 export const SessionIdCodec = Bytes(32);

package/dist/session/encyption.js

@@ -2,8 +2,8 @@ import { gcm } from '@noble/ciphers/aes.js';
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { randomBytes } from '@noble/hashes/utils.js';
-import { mergeUint8 } from '@polkadot-api/utils';
 import { Result, fromThrowable } from 'neverthrow';
+import { mergeUint8 } from 'polkadot-api/utils';
 export function createEncryption(sharedSecret) {
     const salt = new Uint8Array(); // secure enough since P256 random keys provide enough entropy
     const info = new Uint8Array(); // no need to introduce any context

package/dist/session/messageMapper.js

@@ -1,20 +1,20 @@
+function decode(payload, codec) {
+    try {
+        return { status: 'parsed', value: codec.dec(payload) };
+    }
+    catch {
+        return { status: 'failed', value: payload };
+    }
+}
 export function toMessage(statementData, codec) {
     switch (statementData.tag) {
         case 'request': {
-            const decode = (payload) => {
-                try {
-                    return { status: 'parsed', value: codec.dec(payload) };
-                }
-                catch {
-                    return { status: 'failed', value: payload };
-                }
-            };
             return statementData.value.data.map((payload, index) => {
                 return {
                     type: 'request',
                     localId: `${statementData.value.requestId}-${index.toString()}`,
                     requestId: statementData.value.requestId,
-                    payload: decode(payload),
+                    payload: decode(payload, codec),
                 };
             });
         }

package/dist/session/session.js

@@ -1,7 +1,7 @@
 import { createExpiryFromDuration } from '@novasamatech/sdk-statement';
-import { toHex } from '@polkadot-api/utils';
 import { nanoid } from 'nanoid';
 import { ResultAsync, err, errAsync, fromPromise, fromThrowable, ok, okAsync } from 'neverthrow';
+import { toHex } from 'polkadot-api/utils';
 import { khash, stringToBytes } from '../crypto.js';
 import { nonNullable, toError } from '../helpers.js';
 import { createSessionId } from '../model/session.js';
@@ -30,6 +30,7 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
     let subscribers = [];
     const bufferedMessages = [];
     let storeUnsub = null;
+    let responseStoreUnsub = null;
     function submitStatementData(channel, topicSessionId, data) {
         state.expiry = nextExpiry(state.expiry);
         const expiry = state.expiry;
@@ -53,12 +54,14 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
         });
     }
     function deliverStatementData(statementData) {
-        if (subscribers.length === 0) {
-            if (state.phase === 'initialization') {
-                bufferedMessages.push(statementData);
-            }
-            return;
+        // Buffer 'request' statements unconditionally so that waitForRequestMessage
+        // registered after delivery (race condition) still receives them via subscribe() replay.
+        // Buffer everything else during initialization when there are no subscribers yet.
+        if (statementData.tag === 'request' || (subscribers.length === 0 && state.phase === 'initialization')) {
+            bufferedMessages.push(statementData);
         }
+        if (subscribers.length === 0)
+            return;
         for (const sub of subscribers) {
             const messages = toMessage(statementData, sub.codec);
             if (messages.length > 0)
@@ -76,7 +79,7 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
             .map(decrypted => StatementData.dec(decrypted))
             .orElse(() => ok(null));
     }
-    function processIncomingStatement(statement) {
+    function processIncomingStatement(statement, responsesOnly = false) {
         if (!statement.data)
             return;
         const key = toHex(statement.data);
@@ -87,6 +90,8 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
             if (!statementData)
                 return;
             if (statementData.tag === 'request') {
+                if (responsesOnly)
+                    return;
                 if (statementData.value.requestId === state.incomingRequest?.requestId)
                     return;
                 state.incomingRequest = { requestId: statementData.value.requestId };
@@ -147,16 +152,24 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
     function ensureStoreSubscription() {
         if (storeUnsub)
             return;
-        storeUnsub = statementStore.subscribeStatements([incomingSessionId], statements => {
-            for (const statement of statements) {
+        storeUnsub = statementStore.subscribeStatements({ matchAll: [incomingSessionId] }, page => {
+            for (const statement of page.statements) {
                 processIncomingStatement(statement);
             }
         });
+        // Subscribe to outgoing topic to receive peer ACK responses.
+        // Only process response-type statements — request-type statements on this topic
+        // are our own submissions echoed back and must be ignored.
+        responseStoreUnsub = statementStore.subscribeStatements({ matchAll: [outgoingSessionId] }, ({ statements }) => {
+            for (const statement of statements) {
+                processIncomingStatement(statement, true);
+            }
+        });
     }
     async function init() {
         const [ownResult, peerResult] = await Promise.all([
-            statementStore.queryStatements([outgoingSessionId]),
-            statementStore.queryStatements([incomingSessionId]),
+            statementStore.queryStatements({ matchAll: [outgoingSessionId] }),
+            statementStore.queryStatements({ matchAll: [incomingSessionId] }),
         ]);
         if (ownResult.isErr() || peerResult.isErr())
             return;
@@ -179,7 +192,7 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
         const peerRequest = peerDecoded.find(d => d.tag === 'request');
         const peerResponse = peerDecoded.find(d => d.tag === 'response');
         if (ownRequest?.tag === 'request') {
-            const hasResponse = peerResponse?.tag === 'response' && peerResponse.value.requestId === ownRequest.value.requestId;
+            const hasResponse = ownResponse?.tag === 'response' && ownResponse.value.requestId === ownRequest.value.requestId;
             if (!hasResponse) {
                 state.outgoingRequest = {
                     requestId: ownRequest.value.requestId,
@@ -191,7 +204,7 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
         if (peerRequest?.tag === 'request') {
             state.incomingRequest = { requestId: peerRequest.value.requestId };
             state.respondedIncomingRequest =
-                ownResponse?.tag === 'response' && ownResponse.value.requestId === peerRequest.value.requestId;
+                peerResponse?.tag === 'response' && peerResponse.value.requestId === peerRequest.value.requestId;
         }
         // Notify app of any unresponded incoming request.
         // Delivered while phase is still 'initialization' so that deliverStatementData
@@ -283,15 +296,23 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
             }
             return () => {
                 subscribers = subscribers.filter(s => s !== sub);
-                if (subscribers.length === 0 && storeUnsub) {
-                    storeUnsub();
-                    storeUnsub = null;
+                if (subscribers.length === 0) {
+                    if (storeUnsub) {
+                        storeUnsub();
+                        storeUnsub = null;
+                    }
+                    if (responseStoreUnsub) {
+                        responseStoreUnsub();
+                        responseStoreUnsub = null;
+                    }
                 }
             };
         },
         dispose() {
             storeUnsub?.();
             storeUnsub = null;
+            responseStoreUnsub?.();
+            responseStoreUnsub = null;
             subscribers = [];
             for (const [, deferred] of state.pendingDelivery) {
                 deferred.reject(new Error('Session disposed'));
@@ -302,7 +323,6 @@ export function createSession({ localAccount, remoteAccount, statementStore, enc
     void init();
     return session;
 }
-// ── module-level helpers ──────────────────────────────────────────────────────
 function mapResponseCode(responseCode) {
     switch (responseCode) {
         case 'success':

package/dist/session/session.spec.js

@@ -5,33 +5,18 @@ import { describe, expect, it, vi } from 'vitest';
 import { createAccountId, createLocalSessionAccount, createRemoteSessionAccount } from '../model/sessionAccount.js';
 import { StatementData } from './scale/statementData.js';
 import { createSession, nextExpiry } from './session.js';
-// ── test helpers ──────────────────────────────────────────────────────────────
+import { createSr25519Prover } from './statementProver.js';
 function makeAccounts() {
     const localAccount = createLocalSessionAccount(createAccountId(new Uint8Array(32).fill(1)));
     const remoteAccount = createRemoteSessionAccount(createAccountId(new Uint8Array(32).fill(2)), new Uint8Array(32).fill(3));
     return { localAccount, remoteAccount };
 }
-function makeEncryption() {
+function mockEncryption() {
     return {
         encrypt: (data) => ok(data),
         decrypt: (data) => ok(data),
     };
 }
-function makeProver() {
-    return {
-        generateMessageProof: s => okAsync({
-            ...s,
-            proof: {
-                type: 'sr25519',
-                value: {
-                    signature: `0x${'00'.repeat(64)}`,
-                    signer: `0x${'00'.repeat(32)}`,
-                },
-            },
-        }),
-        verifyMessageProof: () => okAsync(true),
-    };
-}
 function makeAdapter() {
     const unsub = vi.fn();
     return {
@@ -56,14 +41,14 @@ function makeSession(overrides) {
         localAccount,
         remoteAccount,
         statementStore: adapter,
-        encryption: makeEncryption(),
-        prover: makeProver(),
+        encryption: mockEncryption(),
+        prover: createSr25519Prover(new Uint8Array(64).fill(1)),
         maxRequestSize,
     });
     return { session, adapter };
 }
-async function flushPromises() {
-    await new Promise(resolve => setTimeout(resolve, 0));
+async function delay(ttl = 0) {
+    await new Promise(resolve => setTimeout(resolve, ttl));
 }
 describe('session', () => {
     describe('nextExpiry', () => {
@@ -94,7 +79,7 @@ describe('session', () => {
     describe('createSession initialization', () => {
         it('queries own and peer statements on creation', async () => {
             const { adapter } = makeSession();
-            await flushPromises();
+            await delay();
             expect(adapter.queryStatements).toHaveBeenCalledTimes(2);
         });
         it('expiry is initialized from max own statement expiry', async () => {
@@ -110,11 +95,11 @@ describe('session', () => {
                 return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // Submit a message to trigger a statement — its expiry must be greater than highExpiry
             const rawCodec = Bytes();
             void session.submitRequestMessage(rawCodec, new Uint8Array([1]));
-            await flushPromises();
+            await delay();
             const submittedStatement = adapter.submitStatement.mock.calls[0]?.[0];
             if (submittedStatement) {
                 expect(submittedStatement.expiry).toBeGreaterThan(highExpiry);
@@ -131,7 +116,7 @@ describe('session', () => {
                 return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // Register subscriber AFTER init — buffered incoming request should be delivered
             const callback = vi.fn();
             session.subscribe(Bytes(), callback);
@@ -140,11 +125,10 @@ describe('session', () => {
         it('transitions to active phase after queries complete', async () => {
             const { session, adapter } = makeSession();
             // Before init completes, submitRequestMessage queues the message
-            const rawCodec = str;
-            void session.submitRequestMessage(rawCodec, 'hello');
+            void session.submitRequestMessage(str, 'hello');
             // Statement should NOT be submitted yet (still initializing)
             expect(adapter.submitStatement).not.toHaveBeenCalled();
-            await flushPromises();
+            await delay();
             // After init, queued messages are processed → submitStatement called
             expect(adapter.submitStatement).toHaveBeenCalled();
         });
@@ -162,11 +146,11 @@ describe('session', () => {
                 return okAsync([]); // no peer response
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // If outgoingRequest was restored, a new message appends to it
             const codec = str;
             void session.submitRequestMessage(codec, 'hello');
-            await flushPromises();
+            await delay();
             expect(adapter.submitStatement).toHaveBeenCalled();
         });
         it('clears outgoingRequest when peer has a matching response', async () => {
@@ -177,16 +161,17 @@ describe('session', () => {
             let callCount = 0;
             adapter.queryStatements.mockImplementation(() => {
                 callCount++;
+                // Outgoing topic contains both our request AND the peer's response
                 if (callCount === 1)
-                    return okAsync([ownRequest]);
-                return okAsync([peerResponse]);
+                    return okAsync([ownRequest, peerResponse]);
+                return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // No pending outgoing request — new message creates a brand new request
             const codec = str;
             void session.submitRequestMessage(codec, 'hi');
-            await flushPromises();
+            await delay();
             // submitStatement called exactly once (for the new message only)
             expect(adapter.submitStatement).toHaveBeenCalledTimes(1);
         });
@@ -202,7 +187,7 @@ describe('session', () => {
                 return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // Calling submitResponseMessage with restored requestId should succeed
             const result = await session.submitResponseMessage(requestId, 'success');
             expect(result.isOk()).toBe(true);
@@ -216,11 +201,12 @@ describe('session', () => {
             adapter.queryStatements.mockImplementation(() => {
                 callCount++;
                 if (callCount === 1)
-                    return okAsync([ownResponse]);
-                return okAsync([peerRequest]);
+                    return okAsync([]);
+                // Incoming topic contains both the peer's request AND our response
+                return okAsync([peerRequest, ownResponse]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             // Already responded — submitResponseMessage should return ok without submitting again
             const submitsBefore = adapter.submitStatement.mock.calls.length;
             const result = await session.submitResponseMessage(requestId, 'success');
@@ -242,7 +228,7 @@ describe('session', () => {
                 return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises(); // init completes
+            await delay(); // init completes
             const callback = vi.fn();
             session.subscribe(rawCodec, callback);
             expect(callback).toHaveBeenCalledTimes(1);
@@ -264,7 +250,7 @@ describe('session', () => {
             const { session } = makeSession(adapter);
             const callback = vi.fn();
             session.subscribe(rawCodec, callback); // before init completes
-            await flushPromises();
+            await delay();
             expect(callback).toHaveBeenCalledTimes(1);
             const messages2 = callback.mock.calls[0][0];
             expect(messages2[0]?.requestId).toBe(requestId);
@@ -281,17 +267,17 @@ describe('session', () => {
                 return okAsync([]);
             });
             let subscribeCallback;
-            adapter.subscribeStatements.mockImplementation((_topics, cb) => {
+            adapter.subscribeStatements.mockImplementation((_filter, cb) => {
                 subscribeCallback = cb;
                 return vi.fn();
             });
             const { session } = makeSession(adapter);
-            await flushPromises(); // init sees peerRequest, adds to seenStatements
+            await delay(); // init sees peerRequest, adds to seenStatements
             const appCallback = vi.fn();
             session.subscribe(rawCodec, appCallback);
             // Simulate subscription delivering the same statement again
-            subscribeCallback([peerRequest]);
-            await flushPromises();
+            subscribeCallback({ statements: [peerRequest], isComplete: true });
+            await delay();
             // Should only be called once (from buffered init message), not again from subscription
             expect(appCallback).toHaveBeenCalledTimes(1);
         });
@@ -299,33 +285,139 @@ describe('session', () => {
             const requestId = 'no-auto-resp';
             const peerRequest = makeStatement({ tag: 'request', value: { requestId, data: [new Uint8Array([1])] } });
             const adapter = makeAdapter();
-            let subscribeCallback;
-            adapter.subscribeStatements.mockImplementation((_topics, cb) => {
-                subscribeCallback = cb;
+            const subscribeCallbacks = [];
+            adapter.subscribeStatements.mockImplementation((_filter, cb) => {
+                subscribeCallbacks.push(cb);
                 return vi.fn();
             });
             adapter.queryStatements.mockReturnValue(okAsync([]));
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             const callback = vi.fn();
             session.subscribe(rawCodec, callback);
             adapter.submitStatement.mockClear();
-            subscribeCallback([peerRequest]);
-            await flushPromises();
+            // Fire on the incoming topic callback (first subscription)
+            subscribeCallbacks[0]({ statements: [peerRequest], isComplete: true });
+            await delay();
             // Message delivered to app callback but no automatic response submitted
             expect(callback).toHaveBeenCalled();
             expect(adapter.submitStatement).not.toHaveBeenCalled();
         });
+        it('delivers peer request to a subscriber that registers after the batch notification (race condition)', async () => {
+            // Regression test for PB-439: when peer's request and the ACK response arrive in the
+            // same subscribeStatements batch, the request is processed before waitForRequestMessage
+            // has a chance to register its subscriber. The fix ensures request statements are always
+            // buffered so late subscribers (simulating waitForRequestMessage called in .andThen()
+            // after waitForResponseMessage resolves) still receive them.
+            const subscribeCallbacks = [];
+            const subscribeStatements = vi.fn().mockImplementation((_filter, cb) => {
+                subscribeCallbacks.push(cb);
+                return vi.fn();
+            });
+            const { session } = makeSession({ subscribeStatements });
+            await delay();
+            // Register a dummy subscriber to activate the store subscription (simulates
+            // any pre-existing subscriber in the session, e.g. the app listening for messages).
+            const dummyUnsub = session.subscribe(rawCodec, vi.fn());
+            const peerRequestId = 'race-condition-request';
+            const peerRequest = makeStatement({
+                tag: 'request',
+                value: { requestId: peerRequestId, data: [new Uint8Array([42])] },
+            });
+            // Peer request arrives on the incoming topic (first subscription) while the
+            // dummy subscriber is active but waitForRequestMessage hasn't registered its
+            // subscriber yet (the race condition scenario).
+            subscribeCallbacks[0]({ statements: [peerRequest], isComplete: true });
+            await delay();
+            // Now the late subscriber registers (simulates waitForRequestMessage being called
+            // in the .andThen() chain after waitForResponseMessage resolves).
+            const lateCallback = vi.fn();
+            session.subscribe(rawCodec, lateCallback);
+            // The late subscriber must receive the buffered peer request, otherwise
+            // waitForRequestMessage would hang indefinitely.
+            expect(lateCallback).toHaveBeenCalledTimes(1);
+            const messages = lateCallback.mock.calls[0][0];
+            expect(messages[0]?.type).toBe('request');
+            expect(messages[0]?.requestId).toBe(peerRequestId);
+            dummyUnsub();
+        });
         it('unsubscribing last subscriber tears down the store subscription', () => {
             const { session, adapter } = makeSession();
             const unsub = session.subscribe(rawCodec, vi.fn());
-            expect(adapter.subscribeStatements).toHaveBeenCalledTimes(1);
+            expect(adapter.subscribeStatements).toHaveBeenCalledTimes(2);
             unsub();
             // subscribeStatements returns a mock unsubscribe fn — verify it was called
             // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             const storeMockUnsub = adapter.subscribeStatements.mock.results[0].value;
             expect(storeMockUnsub).toHaveBeenCalled();
         });
+        it('subscribes to outgoing topic for peer responses alongside incoming topic', () => {
+            const { session, adapter } = makeSession();
+            session.subscribe(rawCodec, vi.fn());
+            // Two subscriptions: one for incoming (peer requests), one for outgoing (peer responses)
+            expect(adapter.subscribeStatements).toHaveBeenCalledTimes(2);
+        });
+        it('tears down outgoing subscription when last subscriber leaves', () => {
+            const { session, adapter } = makeSession();
+            const unsub = session.subscribe(rawCodec, vi.fn());
+            unsub();
+            // Both unsubscribe functions should be called
+            for (const result of adapter.subscribeStatements.mock.results) {
+                const mockUnsub = result.value;
+                expect(mockUnsub).toHaveBeenCalled();
+            }
+        });
+        it('delivers peer response from outgoing topic subscription to subscribers', async () => {
+            const subscribeCallbacks = [];
+            const subscribeStatements = vi.fn().mockImplementation((_topics, cb) => {
+                subscribeCallbacks.push(cb);
+                return vi.fn();
+            });
+            const { session, adapter } = makeSession({ subscribeStatements });
+            await delay();
+            // Submit a request so the session has an outgoingRequest
+            void session.submitRequestMessage(rawCodec, new Uint8Array([1]));
+            await delay();
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            const submitted = adapter.submitStatement.mock.calls[0][0];
+            const decoded = StatementData.dec(submitted.data);
+            const requestId = decoded.tag === 'request' ? decoded.value.requestId : '';
+            const callback = vi.fn();
+            session.subscribe(rawCodec, callback);
+            // Deliver the response via the SECOND subscription callback (outgoing topic)
+            // subscribeCallbacks[0] = incoming topic, subscribeCallbacks[1] = outgoing topic
+            const responseStatement = makeStatement({
+                tag: 'response',
+                value: { requestId, responseCode: 'success' },
+            });
+            subscribeCallbacks[1]({ statements: [responseStatement], isComplete: true });
+            await delay();
+            // Subscriber should receive the response
+            const allCalls = callback.mock.calls.flat();
+            const responseMessages = allCalls.flat().filter((m) => m.type === 'response');
+            expect(responseMessages.length).toBeGreaterThan(0);
+        });
+        it('ignores request-type statements from outgoing topic subscription', async () => {
+            const subscribeCallbacks = [];
+            const subscribeStatements = vi.fn().mockImplementation((_topics, cb) => {
+                subscribeCallbacks.push(cb);
+                return vi.fn();
+            });
+            const { session } = makeSession({ subscribeStatements });
+            await delay();
+            const callback = vi.fn();
+            session.subscribe(rawCodec, callback);
+            callback.mockClear(); // clear any buffered init messages
+            // Deliver a request via the outgoing topic subscription (would be our own echoed back)
+            const ownRequest = makeStatement({
+                tag: 'request',
+                value: { requestId: 'own-req', data: [new Uint8Array([1])] },
+            });
+            subscribeCallbacks[1]({ statements: [ownRequest], isComplete: true });
+            await delay();
+            // Should NOT be delivered to subscriber (filtered by responsesOnly flag)
+            expect(callback).not.toHaveBeenCalled();
+        });
     });
     describe('submitResponseMessage', () => {
         it('is idempotent — second call does not submit again', async () => {
@@ -340,7 +432,7 @@ describe('session', () => {
                 return okAsync([]);
             });
             const { session } = makeSession(adapter);
-            await flushPromises();
+            await delay();
             await session.submitResponseMessage(requestId, 'success');
             const submitsAfterFirst = adapter.submitStatement.mock.calls.length;
             await session.submitResponseMessage(requestId, 'success'); // second call
@@ -348,7 +440,7 @@ describe('session', () => {
         });
         it('returns error when requestId does not match incomingRequest', async () => {
             const { session } = makeSession();
-            await flushPromises();
+            await delay();
             const result = await session.submitResponseMessage('wrong-id', 'success');
             expect(result.isErr()).toBe(true);
         });
@@ -357,43 +449,41 @@ describe('session', () => {
         const rawCodec = Bytes();
         it('sends a single statement for the first message', async () => {
             const { session, adapter } = makeSession();
-            await flushPromises();
+            await delay();
             void session.submitRequestMessage(rawCodec, new Uint8Array([1, 2, 3]));
-            await flushPromises();
+            await delay();
             expect(adapter.submitStatement).toHaveBeenCalledTimes(1);
         });
         it('appends second message to existing request (resubmits with new requestId)', async () => {
             const { session, adapter } = makeSession();
-            await flushPromises();
+            await delay();
             void session.submitRequestMessage(rawCodec, new Uint8Array([1]));
             void session.submitRequestMessage(rawCodec, new Uint8Array([2]));
-            await flushPromises();
+            await delay();
             // Two submits: first for msg1, second for msg1+msg2 batched
             expect(adapter.submitStatement).toHaveBeenCalledTimes(2);
         });
         it('queues message that exceeds maxRequestSize', async () => {
             const { session, adapter } = makeSession({ maxRequestSize: 5 });
-            await flushPromises();
+            await delay();
             void session.submitRequestMessage(rawCodec, new Uint8Array([1, 2, 3])); // 3 bytes — fits
             void session.submitRequestMessage(rawCodec, new Uint8Array([4, 5, 6, 7])); // 4 bytes — doesn't fit with existing
-            await flushPromises();
+            await delay();
             // Only first message sent; second is queued
             expect(adapter.submitStatement).toHaveBeenCalledTimes(1);
         });
         it('drains message queue after response received', async () => {
             let subscribeCallback;
-            const subscribeStatements = vi
-                .fn()
-                .mockImplementation((_topics, cb) => {
+            const subscribeStatements = vi.fn().mockImplementation((_filter, cb) => {
                 subscribeCallback = cb;
                 return vi.fn();
             });
             const { session, adapter } = makeSession({ maxRequestSize: 5, subscribeStatements });
-            await flushPromises();
+            await delay();
             session.subscribe(Bytes(), vi.fn()); // ensure store subscription is active
             void session.submitRequestMessage(rawCodec, new Uint8Array([1, 2, 3])); // sent
             void session.submitRequestMessage(rawCodec, new Uint8Array([4, 5, 6])); // queued (doesn't fit)
-            await flushPromises();
+            await delay();
             const submitCountBefore = adapter.submitStatement.mock.calls.length;
             // Simulate peer responding to the first request
             // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
@@ -404,34 +494,33 @@ describe('session', () => {
                 tag: 'response',
                 value: { requestId: respondingRequestId, responseCode: 'success' },
             });
-            subscribeCallback([responseStatement]);
-            await flushPromises();
+            subscribeCallback({ statements: [responseStatement], isComplete: true });
+            await delay();
             // Queued message should now be submitted
             expect(adapter.submitStatement.mock.calls.length).toBeGreaterThan(submitCountBefore);
         });
         it('waitForResponseMessage resolves when response arrives for batch', async () => {
             let subscribeCallback;
-            const subscribeStatements = vi
-                .fn()
-                .mockImplementation((_topics, cb) => {
+            const subscribeStatements = vi.fn().mockImplementation((_filter, cb) => {
                 subscribeCallback = cb;
                 return vi.fn();
             });
             const { session, adapter } = makeSession({ subscribeStatements });
-            await flushPromises();
+            await delay();
             session.subscribe(Bytes(), vi.fn()); // ensure store subscription is active
             const submitResult = await session.submitRequestMessage(rawCodec, new Uint8Array([1]));
             const token = submitResult.unwrapOr({ requestId: '' }).requestId;
-            await flushPromises();
+            await delay();
             const responsePromise = session.waitForResponseMessage(token);
             // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             const lastStatement = adapter.submitStatement.mock.calls[adapter.submitStatement.mock.calls.length - 1][0];
             const decoded = StatementData.dec(lastStatement.data);
             const respondingId = decoded.tag === 'request' ? decoded.value.requestId : '';
-            subscribeCallback([
-                makeStatement({ tag: 'response', value: { requestId: respondingId, responseCode: 'success' } }),
-            ]);
-            await flushPromises();
+            subscribeCallback({
+                statements: [makeStatement({ tag: 'response', value: { requestId: respondingId, responseCode: 'success' } })],
+                isComplete: true,
+            });
+            await delay();
             const result = await responsePromise;
             expect(result.isOk()).toBe(true);
             expect(result.unwrapOr({ responseCode: 'unknown' }).responseCode).toBe('success');

package/dist/session/statementProver.js

@@ -1,7 +1,7 @@
 import { getStatementSigner, statementCodec } from '@novasamatech/sdk-statement';
 import { compact } from '@polkadot-api/substrate-bindings';
-import { fromHex } from '@polkadot-api/utils';
 import { errAsync, fromPromise, fromThrowable, okAsync } from 'neverthrow';
+import { fromHex } from 'polkadot-api/utils';
 import { deriveSr25519PublicKey, signWithSr25519Secret, verifySr25519Signature } from '../crypto.js';
 import { toError } from '../helpers.js';
 export function createSr25519Prover(secret) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/statement-store",
   "type": "module",
-  "version": "0.7.0-0",
+  "version": "0.7.0-1",
   "description": "Statement store integration",
   "license": "Apache-2.0",
   "repository": {
@@ -25,15 +25,16 @@
     "README.md"
   ],
   "dependencies": {
+    "@novasamatech/scale": "0.7.0-1",
     "@novasamatech/sdk-statement": "^0.5.0",
-    "@polkadot-api/substrate-bindings": "^0.17.0",
-    "@polkadot-api/substrate-client": "^0.5.0",
-    "@polkadot-api/utils": "0.2.0",
-    "@polkadot-labs/hdkd-helpers": "^0.0.28",
-    "@noble/hashes": "2.0.1",
-    "@noble/ciphers": "2.1.1",
+    "@polkadot-api/substrate-bindings": "^0.20.0",
+    "@polkadot-api/substrate-client": "^0.7.0",
+    "@polkadot-labs/hdkd-helpers": "^0.0.29",
+    "@noble/hashes": "2.2.0",
+    "@noble/ciphers": "2.2.0",
     "@scure/sr25519": "1.0.0",
-    "polkadot-api": "^1.23.3",
+    "polkadot-api": ">=2",
+    "nanoid": "5.1.9",
     "neverthrow": "^8.2.0",
     "scale-ts": "1.6.1"
   },