@volter/teams 0.1.38 → 0.1.40

package/channel.mjs

@@ -15,8 +15,9 @@
 import { EventEmitter } from 'node:events';
 
 const PROTOCOL = 'supercode-machine/1';
-/** The door vocabulary version. It grows; the framing under PROTOCOL never changes. */
-export const NODE_PROTOCOL = 2;
+/** The door vocabulary version. It grows; the framing under PROTOCOL never changes. 3: a `mail` turn carries a
+ *  `turn_key`, and the machine types each key once however often it is opened. */
+export const NODE_PROTOCOL = 3;
 const MAX_FRAME = 8 * 1024 * 1024;
 
 /** Reads u32-length-prefixed frames from a socket. */

package/machine-core.mjs

@@ -89,6 +89,19 @@ export class MachineCore extends EventEmitter {
     ensureSocketDirectory(this.socketPath);
     await clearStaleSocket(this.socketPath);
     await this.beforeListen();
+    try { await this.#listen(); } catch (error) {
+      // What beforeListen started (a product's children) goes with the start that failed, or it outlives this daemon.
+      await this.afterStop().catch(() => {});
+      throw error;
+    }
+    if (this.link) {
+      await this.refreshLinkConfiguration().catch((error) => this.emit('link', { event: 'configuration-failed', error: error.message }));
+      this.#connectLink();
+    }
+    return this.socketPath;
+  }
+
+  async #listen() {
     this.server = createServer((socket) => this.#accept(socket));
     // A Unix socket is bound under a name of this daemon's own and then renamed into place: Node unlinks the name it
     // bound when the server closes, and that name must never be the shared path, which a later daemon may serve from a
@@ -109,15 +122,25 @@ export class MachineCore extends EventEmitter {
     this.address = this.socketPath;
     writeJson(this.p.machine, { pid: process.pid, id: this.id, socket: this.socketPath, startedAt: Date.now(), version: MACHINE_VERSION, protocol: NODE_PROTOCOL, floor: this.floor, server: this.link?.server ?? null });
     this.emit('listening', this.socketPath);
-    if (this.link) {
-      await this.refreshLinkConfiguration().catch((error) => this.emit('link', { event: 'configuration-failed', error: error.message }));
-      this.#connectLink();
+    // The socket check at start has a gap (a daemon restarting has no socket for a moment), so two daemons can each
+    // start; the later rename wins the path and the other serves nobody while its children (a mail watcher that types
+    // waiting turns among them) run on beside the winner's. A daemon whose path now names another daemon's socket
+    // says so once; a daemon run on its own stops on it.
+    if (!isNamedPipe(this.socketPath)) {
+      this.socketWatch = setInterval(() => {
+        let inode = null;
+        try { inode = statSync(this.socketPath).ino; } catch { return; }
+        if (inode === this.socketInode) return;
+        clearInterval(this.socketWatch); this.socketWatch = null;
+        this.emit('superseded', this.socketPath);
+      }, SOCKET_WATCH_MS);
+      this.socketWatch.unref?.();
     }
-    return this.socketPath;
   }
 
   async stop() {
     this.stopping = true;
+    if (this.socketWatch) { clearInterval(this.socketWatch); this.socketWatch = null; }
     if (this.linkTimer) { clearTimeout(this.linkTimer); this.linkTimer = null; }
     // A close frame, so the server sees a machine that left rather than one that vanished.
     try { this.linkSocket?.close(1000, 'machine stopped'); } catch { this.linkSocket?.terminate(); }
@@ -408,6 +431,8 @@ export class MachineCore extends EventEmitter {
 
 }
 
+const SOCKET_WATCH_MS = 5_000;
+
 async function clearStaleSocket(path) {
   // A named pipe has no file to leave behind: only a live daemon holds its name.
   if (!isNamedPipe(path) && !existsSync(path)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/machine-link.mjs

@@ -14,6 +14,7 @@
 // A delegated caller (./delegated.mjs) holds no Teams credential: its verified token, when it names exactly a surface
 // the machine's custodian published to that workplace (./publications.mjs), becomes one machine grant on that target
 // and the caps the token names, expiring with the token; its channel closes then, or when the surface is unpublished.
+import { randomUUID } from 'node:crypto';
 import { Channel } from '../channel.mjs';
 import { bearer } from './auth.mjs';
 import { delegatedAccessOf, delegatedPrincipal, delegatedSessionOf, looksDelegated, surfaceCaps } from './delegated.mjs';
@@ -306,6 +307,8 @@ async function acceptLink(api, teamId, machineId, duplex, closeSocket) {
 }
 
 const LINK_WAIT_MS = 10_000;
+/** How long a typed line is retried on a machine that is linked but too loaded to open its stream. */
+const TURN_RETRY_MS = 120_000;
 
 /** The machine's live link, waiting up to `ms` for one that is relinking. */
 async function linkWithin(api, linkKey, ms) {
@@ -339,15 +342,24 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     entry.claim = claim;
     // A machine relinks within seconds of this server restarting (a deploy drops every link): a stream waits for its
     // link that long, and retries once on a link that closed under it, rather than refusing a message mid-relink.
+    // A line typed into a session is a person's words: a machine too loaded to answer the open in time is waited on,
+    // not refused, and every attempt carries one key so the machine types the line once however many reach it (an
+    // open that timed out here can still be accepted there). A machine below vocabulary 3 does not know the key and
+    // keeps the single attempt.
+    const turn = stream.name === 'mail' && stream.params?.request?.op === 'turn';
+    const params = turn ? { ...stream.params, request: { turn_key: `tk_${randomUUID()}`, ...stream.params.request } } : (stream.params ?? {});
+    const turnDeadline = Date.now() + TURN_RETRY_MS;
     let upstream;
     for (let attempt = 0; ; attempt += 1) {
       const link = await linkWithin(api, key(auth.team_id, machineId), LINK_WAIT_MS);
       if (!link) return refuse('machine_offline: the machine is not linked to this server');
       try {
-        upstream = await link.channel.open(stream.name, { ...(stream.params ?? {}), _admitted: claim });
+        upstream = await link.channel.open(stream.name, { ...params, _admitted: claim });
         break;
       } catch (error) {
         if (attempt === 0 && link.channel.closed) continue;
+        const keyed = turn && (link.channel.peer?.nv ?? 0) >= 3;
+        if (keyed && !stream.closed && Date.now() < turnDeadline && (link.channel.closed || /did not open within/.test(error.message))) continue;
         return refuse(error.message.replace(/^[a-z]+ refused: /, ''));
       }
     }