@cotal-ai/core 0.70.0 → 0.71.0

package/dist/endpoint.js

@@ -1,7 +1,7 @@
 import { EventEmitter } from "node:events";
 import { randomUUID } from "node:crypto";
 import { createConnection } from "node:net";
-import { connect, credsAuthenticator, headers, tokenAuthenticator, nanos, AuthorizationError, PermissionViolationError, UserAuthenticationExpiredError, NoRespondersError, RequestError, } from "@nats-io/transport-node";
+import { connect, credsAuthenticator, headers, tokenAuthenticator, nanos, AuthorizationError, PermissionViolationError, UserAuthenticationExpiredError, NoRespondersError, RequestError, TimeoutError, ClosedConnectionError, } from "@nats-io/transport-node";
 import { wsconnect } from "@nats-io/nats-core";
 import { parseLivenessAnswer, responderFromLease, responderFromProbe, isLivenessPlane, LIVENESS_PLANES, } from "./liveness.js";
 import { credsClaims, credsFingerprint, credsRenewalDelayMs, idFromCreds } from "./identity.js";
@@ -26,7 +26,7 @@ import { openMembersRegistry, commitMember, tombstoneMember, activateMember, rea
 import { openAclRegistry, readAcl, readAclForAlias, aclRetired, AmbiguousAclAlias, commitAcl as writeAclRecord, reissueAcl as writeAclReissue } from "./acls.js";
 import { openDeliveryRegistry } from "./lease.js";
 import { openChannelRegistry, effectiveReplay, effectiveReplayWindowMs, effectiveDeliveryClass, readChannelConfig, readChannelDefaults, } from "./channels.js";
-import { anycastSubject, CHANNEL_DEFAULTS_KEY, chatStream, chatHistDurable, chatSubject, controlServiceSubject, livenessSubject, livenessServeFilter, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, dmStream, dmDurable, dlvStream, dlvDurable, dlvSubject, dinboxSubject, inboxStream, parseDinboxPrincipal, FANOUT_DURABLE, INBOX_READER_DURABLE, leaseKey, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, managerLeaseKey, chatWildcard, assertValidChannel, channelInAllow, isConcreteChannel, normalizeMentions, parseSubject, isPrincipalOwnerToken, assertInboxConnId, presenceBucket, membershipBucket, MEMBERSHIP_FEED_KEY, principalKey, parsePrincipalKey, assertLifecycleToken, mintLifecycleUid, lifecycleNameKey, DEV_OWNER, spacePrefix, spaceWildcard, subjectMatches, taskStream, taskDurable, token, unicastSubject, unicastRecvFilter, } from "./subjects.js";
+import { anycastSubject, assertValidRole, CHANNEL_DEFAULTS_KEY, chatStream, chatHistDurable, chatSubject, controlServiceSubject, livenessSubject, livenessServeFilter, CONTROL_DELIVERY, CONTROL_DELIVERY_ADMIN, dmStream, dmDurable, dlvStream, dlvDurable, dlvSubject, dinboxSubject, inboxStream, parseDinboxPrincipal, FANOUT_DURABLE, INBOX_READER_DURABLE, leaseKey, managerBucket, MANAGER_LEASE_KEY, MANAGER_RENEWAL_LEASE_KEY, managerLeaseKey, chatWildcard, assertValidChannel, channelInAllow, isConcreteChannel, normalizeMentions, parseSubject, isPrincipalOwnerToken, assertInboxConnId, presenceBucket, membershipBucket, MEMBERSHIP_FEED_KEY, principalKey, parsePrincipalKey, assertLifecycleToken, mintLifecycleUid, lifecycleNameKey, DEV_OWNER, spacePrefix, spaceWildcard, subjectMatches, taskStream, taskDurable, token, unicastSubject, unicastRecvFilter, } from "./subjects.js";
 export const DEFAULT_SERVER = "nats://127.0.0.1:4222";
 const PLANE3_FRAME_HEADER = "Cotal-Delivery-Frame";
 /** Space joined when none is given on the CLI (the `cotal-<space>` cmux tab, etc.). */
@@ -403,8 +403,11 @@ export class CotalEndpoint extends EventEmitter {
         this.space = opts.space;
         // A display name is the client-side handle a peer is addressed by; reject the reserved `/`
         // (the future owner/name separator) and surrounding whitespace at the one identity choke
-        // point every join/spawn path flows through.
+        // point every join/spawn path flows through. A role is an address too, refused here before
+        // presence can advertise it.
         assertValidName(opts.card.name);
+        if (opts.card.role !== undefined)
+            assertValidRole(opts.card.role);
         // Auth mode is EITHER static creds (dev/no-login) OR a user bearer (login → callout) — never both.
         if (opts.bearer) {
             if (opts.creds || opts.token || opts.user || opts.pass)
@@ -1842,6 +1845,8 @@ export class CotalEndpoint extends EventEmitter {
     async anycastAttributed(service, text, opts) {
         if (!this.js)
             throw new Error(this.notLiveMsg());
+        // The subject builder admits `*` for allow rules; a publish needs one concrete role.
+        assertValidRole(service);
         const msg = {
             id: randomUUID(),
             ts: Date.now(),
@@ -2785,8 +2790,8 @@ export class CotalEndpoint extends EventEmitter {
                     watch.consumerName = undefined;
                 }
                 else {
-                    const closedEpoch = err.name === "ClosedConnectionError" || /^closed connection$/i.test(err.message);
-                    const timeout = isTimeoutError(err);
+                    const closedEpoch = err instanceof ClosedConnectionError;
+                    const timeout = err instanceof TimeoutError;
                     const dyingEpochTimeout = timeout && (this.reconnecting || !this.nc || this.nc.isClosed());
                     // Cleanup of an ordered consumer: a delete timeout means the broker did not answer in time,
                     // not that the endpoint is unusable. The broker reaps an idle/ephemeral consumer anyway.
@@ -4727,9 +4732,7 @@ export class CotalEndpoint extends EventEmitter {
     probeFailureOutcome(e) {
         if (e instanceof AuthorizationError || e instanceof PermissionViolationError)
             return "refused";
-        const name = e?.name;
-        const msg = e?.message ?? "";
-        if (name === "TimeoutError" || /timeout/i.test(msg))
+        if (e instanceof TimeoutError)
             return "timeout";
         // Anything else is a transport or client failure: it says something about our link, not about
         // the plane, so it is graded like a refusal rather than guessed at.
@@ -5472,7 +5475,9 @@ export class CotalEndpoint extends EventEmitter {
             await this.pump(taskStream(this.space), taskDurable(this.card.role));
         }
     }
-    /** Drive one consumer: decode, drop our own echo, and hand each message to listeners with ack control. */
+    /** Drive one consumer: decode and hand each message to listeners with ack control. Our own sends are
+     *  delivered too: on the DM inbox and the role queue they were addressed to us, so none is an echo,
+     *  and acking one unseen on the work queue would delete the only copy of the request. */
     async pump(stream, durable) {
         if (!this.js)
             throw new Error("endpoint not started");
@@ -5506,10 +5511,6 @@ export class CotalEndpoint extends EventEmitter {
                         `does not match subject sender ${parsed?.sender ?? "(unparseable)"}`));
                     continue;
                 }
-                if (msg.from.id === this.card.id) {
-                    m.ack(); // our own echo — advance past it
-                    continue;
-                }
                 // No-replay + dedup (chat only): drop a message at/below this channel's join watermark
                 // — pre-join history the New tail still carries for a *lagging* joiner (cursor behind the
                 // frontier), and the overlap a replay backfill already delivered. Must ack, or JetStream
@@ -7065,14 +7066,6 @@ export async function isReachable(servers = DEFAULT_SERVER, opts = {}) {
         return e instanceof AuthorizationError || e instanceof UserAuthenticationExpiredError;
     }
 }
-/** True when `err` is a dial/consumer-op timeout rather than a real refusal — the one shared test
- *  for "the operation ran out of its own budget", used both by {@link classifyProbeFailure} (#851:
- *  a probe timeout must never collapse into `unreachable`, which a TLS-required target then
- *  misreads as a trust failure) and by {@link Endpoint#disarmMembershipWatch}'s consumer-delete
- *  cleanup, which predates it. */
-function isTimeoutError(err) {
-    return err instanceof Error && (err.name === "TimeoutError" || /timeout/i.test(err.message));
-}
 /** Like {@link isReachable}, but distinguishes "up but won't take these creds" from "nothing there".
  *  `spawn` needs the difference: auth-required → name the trust dir + next step; unreachable → the
  *  mesh is down (prune the stale entry, tell the user to `cotal up`). Pass `creds` to confirm a
@@ -7138,10 +7131,10 @@ function classifyProbeFailure(e, opts) {
     // The broker answered but rejected these creds (so it IS up) — auth-required, not stale-auth.
     if (e instanceof AuthorizationError)
         return { ok: false, reason: "auth-required" };
-    // A dial that ran out of its own budget is neither a refusal nor a dead broker — it is latency.
-    // `e` is undefined when the tcpDialable gate refused before any connect() attempt; that path has
-    // no timeout to inspect and must stay `unreachable` (nothing answered at all).
-    if (e !== undefined && isTimeoutError(e))
+    // A dial that ran out of its own budget is neither a refusal nor a dead broker — it is latency,
+    // and grading it `unreachable` made a TLS-required target read as a trust failure (#851). Only
+    // nats-core's TimeoutError means that: a peer's `-ERR` that mentions a timeout answered at once.
+    if (e instanceof TimeoutError)
         return { ok: false, reason: "timeout" };
     return { ok: false, reason: "unreachable" };
 }