comq 0.21.0 → 0.23.0

package/discussions/one-parking-queue.md

@@ -0,0 +1,63 @@
+# One parking queue
+
+> Supersedes the parking queue's naming and lifetime in
+> [poison message handling](./poison-message-handling.md), Part 1. Everything else about
+> parking — when a message is parked, what it carries, what is published before what — is
+> unchanged.
+
+Everything a consumer could not process is kept in one queue, `comq.parked`, whatever it was
+consumed from. It is durable, it is declared once per channel beside the retry queues, and comq
+never removes it or what is in it.
+
+A parked message already says where it came from. `x-comq-queue` is the queue it was consumed
+from, `x-comq-exchange` and `x-comq-key` where it was originally published, and all three are
+recorded on the first failure rather than read at parking time. Reading one source's parked
+messages is a match on `x-comq-queue`.
+
+## What this changes
+
+| | before | after |
+|---|---|---|
+| parking queues | one per consumed queue | one |
+| its lifetime | the lifetime of the queue it served | durable, always |
+| what a groupless subscriber parks | went with its connection | kept |
+| scales with | how many queues the connection consumes | nothing |
+
+## Why the queue per source goes
+
+**It was measured.** The cost of this design was worked through when it was made, at 200 source
+queues and 200 parking queues, and accepted. In a deployment of about forty processes the
+parking queues came to 1318 of 2731 queues on the broker — 48 % — and every one of them was
+empty, with no consumer and no message it had ever held. At about 70 KB of broker memory per
+queue, that is the largest single item on a broker that had been blocking publishers on a memory
+alarm.
+
+The count is what makes it grow: one per consumed queue means the broker pays for how widely an
+application is decomposed, forever, whether or not anything ever fails.
+
+**Depth per source survives.** The reason recorded for the queue per source was that depth per
+consumer is how anyone notices a problem. What notices a problem is the `discard` diagnostic,
+which fires per parked message and names the queue it came from. Depth in `comq.parked` still
+says how much is waiting, and `x-comq-queue` still says what for.
+
+**The lifetime rule goes with it.** The parking queue mirrored its source's durability so that a
+durable parking queue would not be left behind an exclusive `amq.gen-*` source — one leaked per
+restart, forever. With a fixed name there is nothing to leak, and the rule that prevented the
+leak was throwing away the evidence it was meant to keep: a groupless subscriber's failures
+vanished with its connection, at the moment there was nobody left to tell.
+
+## Upgrading
+
+`comq.parked.<queue>` queues from an earlier version keep whatever they already hold. comq stops
+declaring them and stops publishing to them, so they are drained and deleted once, by hand.
+
+Nothing is redeclared with different arguments, so no assertion answers `PRECONDITION_FAILED`
+and no broker has to be emptied. During a rollout the processes still on the old version go on
+parking per source and the new ones park in `comq.parked`; both are readable, and both say
+which queue a message came from.
+
+## What comq says about it
+
+That the queue is there, that a message in it names its source, and that comq removes neither.
+What to do with a queue on a broker — a `max-length`, a TTL, an alert on depth — is read off
+those facts by whoever can see the broker.

package/discussions/one-reply-queue.md

@@ -0,0 +1,44 @@
+# One reply queue
+
+An `IO` receives every reply on one queue, `comq.reply..<id>`, whatever it sent the request to.
+
+A reply is found by its `correlationId`. `ReplyEmitter.next` builds one from eight random bytes
+and a counter, and it is unique across processes — it has to be, because a producer's control
+queue sees the requests of every consumer and tells them apart by nothing else. Routing a reply
+reads that identifier and nothing else: the queue it arrived on was never consulted.
+
+## What this changes
+
+| | before | after |
+|---|---|---|
+| reply queues | one per distinct queue or exchange requested | one |
+| its name | `<target>..<id>` | `comq.reply..<id>` |
+| scales with | how widely the caller fans out | nothing |
+
+Both are exclusive, so both go with the connection. A sharded connection holds one per shard, as
+it held one per target per shard before.
+
+## Why the queue per target goes
+
+The count was the caller's to set and the broker's to pay: a connection that requests fifty
+queues held fifty queues and fifty consumers for as long as it lived, whether or not it ever
+requested them again. Nothing bounded it but how widely the application was decomposed.
+
+The name was the argument for it — a queue named after what is being called says, to somebody
+reading the broker, who is waiting on what. It says it of a queue that carries no messages
+between requests, and the same thing is on every message that does pass through: `correlationId`
+identifies the request, and the reply-side handler knows which one it belongs to.
+
+## What is given up
+
+Reading the broker no longer tells you which operations a connection calls. A reply queue names
+its connection instead, and what it is waiting for is in flight rather than on the broker.
+
+## Upgrading
+
+Reply queues are exclusive and are asserted on the first request, so a process on the old
+version and one on the new hold different queues and neither declares the other's. Nothing is
+redeclared, and a rollout needs no order.
+
+A parked request keeps the `replyTo` it was sent with, so one parked by an old process still
+names the queue that process was listening on — which, as before, is gone once that process is.

package/discussions/poison-message-handling.md

@@ -7,7 +7,8 @@
 > where it survives a retry.
 >
 > **All three parts are implemented.** Text below is written as a proposal because that is what
-> it was; it describes what the code now does.
+> it was; it describes what the code now does — except for the parking queue's name and
+> lifetime, which [one parking queue](./one-parking-queue.md) supersedes.
 
 When a consumer callback rejects, comq is supposed to retry the message a few times and then
 give up on it. What it actually does is kill the process, and take every other consumer in that

package/docs/headers.md

@@ -26,7 +26,7 @@ the message properties.
 | `x-comq-attempt` | a retried message | Which attempt this delivery is, counting from one. Absent on the first, so read it as `headers?.['x-comq-attempt'] ?? 1`. The last attempt is one more than the number of rungs in the [backoff ladder](../readme.md#retries). |
 | `x-comq-exchange` | a retried or parked message | The exchange it was originally published to. |
 | `x-comq-key` | a retried or parked message | The routing key it was originally published with. |
-| `x-comq-queue` | a parked message | The queue it was consumed from. |
+| `x-comq-queue` | a parked message | The queue it was consumed from. One `comq.parked` queue holds what every source parked, so this is what tells them apart. |
 | `x-comq-reason` | a parked message | The `message` of the exception that ended its attempts. |
 | `x-comq-cause` | a parked message | The `message` of that exception's `cause`, when it has one — a verdict is usually thrown with the failure that prompted it. |
 | `x-comq-at` | a parked message | When it was parked, as `Date.now()`. |

package/features/parking.feature

@@ -0,0 +1,32 @@
+Feature: The parking queue
+
+  What a consumer could not process is kept in one queue, `comq.parked`, whatever it was
+  consumed from. The message says where it came from, so the queue does not have to.
+
+  Background:
+    Given an active connection to the broker
+
+  Scenario: Messages parked from two queues are kept in one
+
+    A queue per source would repeat what every parked message already carries, and
+    would stay on the broker for as long as the broker does.
+
+    Given that events from the `parking_left` exchange are causing exceptions
+    And that events from the `parking_right` exchange are causing exceptions
+    When an event is emitted to the `parking_left` exchange
+    And an event is emitted to the `parking_right` exchange
+    Then a message parked from the `parking_left` exchange is in the parking queue
+    And a message parked from the `parking_right` exchange is in the parking queue
+
+  Scenario: A message parked from a groupless subscription outlives its connection
+
+    A groupless subscriber consumes a queue of its own that the broker removes with the
+    connection. What it could not process is not ephemeral: it is waiting for a person,
+    and there is nobody left to tell.
+
+    Given that groupless events from the `parking_ephemeral` exchange are causing exceptions
+    When an event is emitted to the `parking_ephemeral` exchange
+    And the message is parked
+    And the connection is closed
+    And an active connection to the broker
+    Then a message parked from the `parking_ephemeral` exchange is in the parking queue

package/features/rpc.replies.feature

@@ -0,0 +1,26 @@
+Feature: Reply queues
+
+  A connection consumes its replies from one queue, whatever it sends requests to. The
+  reply is found by its correlation identifier, which is unique across processes, so the
+  queue does not have to name what was called.
+
+  Scenario: One reply queue however many queues are requested
+
+    Given an active connection to the broker
+    And a producer replying `replies_alpha` queue
+    And a producer replying `replies_beta` queue
+    When the consumer sends a request to the `replies_alpha` queue
+    Then the consumer receives the reply
+    When the consumer sends a request to the `replies_beta` queue
+    Then the consumer receives the reply
+    And the broker holds 1 reply queue
+
+  Scenario: One reply queue per shard
+
+    A shard is a broker of its own, and a request published to one is answered on it.
+
+    Given an active sharded connection
+    And a producer replying `replies_sharded` queue
+    When the consumer sends 10 requests to the `replies_sharded` queue
+    Then all replies have been received
+    And each broker holds 1 reply queue

package/features/steps/brokers.js

@@ -12,8 +12,13 @@ const IMAGE = 'rabbitmq:4.3-management'
 const USER = 'developer'
 const PASSWORD = 'secret'
 const AMQP_PORT = 5672
+const MANAGEMENT_PORT = 15672
 const BROKERS_AMOUNT = 2
 const HOST_PORTS = [5673, 5674]
+
+// what a scenario reads the topology from: a queue nothing holds open is
+// invisible over AMQP, and its absence is what some of them are about
+const MANAGEMENT_HOST_PORTS = [15673, 15674]
 const HEALTHCHECK_INTERVAL = global.COMQ_TESTING_HEALTHCHECK_INTERVAL ?? 1000
 
 /** @type {import('@testcontainers/rabbitmq').StartedRabbitMQContainer[]} */
@@ -33,7 +38,9 @@ async function startBrokers () {
         })
         .withAutoRemove(false)
         .withName(`comq-rmq-${n}`)
-        .withExposedPorts({ container: AMQP_PORT, host: hostPort })
+        .withExposedPorts(
+          { container: AMQP_PORT, host: hostPort },
+          { container: MANAGEMENT_PORT, host: MANAGEMENT_HOST_PORTS[n] })
         .withHealthCheck({
           test: ['CMD', 'rabbitmq-diagnostics', '-q', 'ping'],
           interval: 5000,
@@ -88,6 +95,22 @@ function getAddress (n = 0) {
   return `localhost:${HOST_PORTS[n]}`
 }
 
+/**
+ * The queues on a broker, by name.
+ *
+ * @param {number} [n]
+ * @returns {Promise<string[]>}
+ */
+async function queues (n = 0) {
+  const authorization = 'Basic ' + Buffer.from(`${USER}:${PASSWORD}`).toString('base64')
+  const url = `http://localhost:${MANAGEMENT_HOST_PORTS[n]}/api/queues/%2F?columns=name`
+  const response = await fetch(url, { headers: { authorization } })
+
+  if (!response.ok) throw new Error(`Cannot read the queues of broker ${n}: ${response.status}`)
+
+  return (await response.json()).map((queue) => queue.name)
+}
+
 /**
  * @param {number} [n]
  */
@@ -129,5 +152,6 @@ module.exports = {
   startBrokers,
   stopBrokers,
   getAddress,
+  queues,
   actions
 }

package/features/steps/parked.js

@@ -1,11 +1,10 @@
 'use strict'
 
 const assert = require('node:assert')
-const amqplib = require('amqplib')
 const { Given, When, Then } = require('@cucumber/cucumber')
 
-const { getAddress, USER, PASSWORD } = require('./brokers')
 const { until, timeout } = require('../../test/helpers')
+const { reading, pick } = require('./parking')
 
 Given('a producer failing every request to the {token} queue',
   /**
@@ -52,18 +51,9 @@ When('the parked request from the {token} queue is answered by hand',
    * @this {comq.features.Context}
    */
   async function (queue) {
-    const connection = await amqplib.connect(`amqp://${USER}:${PASSWORD}@${getAddress(0)}`)
-    const channel = await connection.createChannel()
-
-    try {
-      let parked
-
-      await channel.consume('comq.parked.' + queue, (message) => {
-        parked = message
-        channel.ack(message)
-      })
-
-      await until(() => parked !== undefined)
+    await reading(async (channel) => {
+      const parked = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-queue'] === queue)
 
       assert.notEqual(parked, undefined, `Nothing was parked from ${queue}`)
 
@@ -74,15 +64,14 @@ When('the parked request from the {token} queue is answered by hand',
 
       this.answer = { answered: true, was: JSON.parse(parked.content.toString()) }
 
+      channel.ack(parked)
+
       channel.sendToQueue(replyTo, Buffer.from(JSON.stringify(this.answer)),
         { correlationId, contentType })
 
       // let the frame reach the broker before the connection goes
       await timeout(100)
-    } finally {
-      await channel.close()
-      await connection.close()
-    }
+    })
   })
 
 Then('the caller receives the reply',

package/features/steps/parking.js

@@ -0,0 +1,113 @@
+'use strict'
+
+const assert = require('node:assert')
+const amqplib = require('amqplib')
+const { Given, When, Then } = require('@cucumber/cucumber')
+
+const { getAddress, USER, PASSWORD } = require('./brokers')
+const { timeout } = require('../../test/helpers')
+
+Given('(that )groupless events from the {token} exchange are causing exceptions',
+  /**
+   * @param {string} exchange
+   * @this {comq.features.Context}
+   */
+  async function (exchange) {
+    await this.io.consume(exchange, (payload, properties) => {
+      this.attempts.push(properties.headers?.['x-comq-attempt'] ?? 1)
+
+      throw new Error('Expected exception')
+    })
+  })
+
+When('the connection is closed',
+  /**
+   * @this {comq.features.Context}
+   */
+  async function () {
+    await this.disconnect()
+  })
+
+Then('a message parked from the {token} exchange is in the parking queue',
+  /**
+   * @param {string} exchange
+   * @this {comq.features.Context}
+   */
+  async function (exchange) {
+    await reading(async (channel) => {
+      const message = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-exchange'] === exchange)
+
+      assert.notEqual(message, undefined,
+        `Nothing in '${PARKED}' came from the '${exchange}' exchange`)
+
+      const headers = message.properties.headers
+
+      // a groupless subscriber consumes a name the broker chose, so what is asserted
+      // here is that the message says which queue, not which name that is
+      assert.notEqual(headers['x-comq-queue'], undefined,
+        'The parked message does not name the queue it came from')
+
+      assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
+
+      channel.nack(message, false, true)
+    })
+  })
+
+/**
+ * Runs `read` against a connection of its own, so that what it does to the parking
+ * queue is not what comq is doing to it.
+ *
+ * @param {(channel: import('amqplib').Channel) => Promise<void>} read
+ */
+async function reading (read) {
+  const connection = await amqplib.connect(`amqp://${USER}:${PASSWORD}@${getAddress(0)}`)
+  const channel = await connection.createChannel()
+
+  try {
+    await read(channel)
+  } finally {
+    await channel.close().catch(noop)
+    await connection.close().catch(noop)
+  }
+}
+
+/**
+ * The first message in the parking queue that `matches`, waited for. One queue holds what
+ * every scenario before this one left in it, so everything that does not match is given
+ * back; the match is left unacknowledged, for the caller to take or to return.
+ *
+ * @param {import('amqplib').Channel} channel
+ * @param {(message: import('amqplib').GetMessage) => boolean} matches
+ * @returns {Promise<import('amqplib').GetMessage | undefined>}
+ */
+async function pick (channel, matches) {
+  const deadline = Date.now() + DEADLINE
+
+  do {
+    const taken = []
+
+    let delivery
+
+    while ((delivery = await channel.get(PARKED, { noAck: false })) !== false) taken.push(delivery)
+
+    const match = taken.find(matches)
+
+    for (const one of taken) if (one !== match) channel.nack(one, false, true)
+
+    if (match !== undefined) return match
+
+    await timeout(50)
+  } while (Date.now() < deadline)
+}
+
+const PARKED = 'comq.parked'
+
+/** The ladder the suite runs on is half a second; this is room for it and the broker. */
+const DEADLINE = 5000
+
+function noop () {}
+
+exports.PARKED = PARKED
+exports.reading = reading
+exports.pick = pick

package/features/steps/poison.js

@@ -3,6 +3,7 @@
 const assert = require('node:assert')
 const { until } = require('../../test/helpers')
 const { Then } = require('@cucumber/cucumber')
+const { PARKED, reading, pick } = require('./parking')
 
 Then('the event is attempted {int} time(s)',
   /**
@@ -35,32 +36,29 @@ Then('the parked message is kept, and says it came from the {token} exchange',
    */
   async function (exchange) {
     const queue = exchange + '..exceptions' // the group the throwing consumer uses
-    const parked = 'comq.parked.' + queue
 
-    await this.io.process(parked, (payload, properties) => {
-      this.parked[queue] = { payload, properties }
-    })
-
-    await until(() => this.parked[queue] !== undefined)
+    await reading(async (channel) => {
+      const message = await pick(channel,
+        (one) => one.properties.headers?.['x-comq-queue'] === queue)
 
-    const message = this.parked[queue]
+      assert.notEqual(message, undefined, `Nothing in '${PARKED}' came from ${queue}`)
 
-    assert.notEqual(message, undefined, `Nothing was parked in ${parked}`)
+      const headers = message.properties.headers
 
-    const headers = message.properties.headers
+      assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
 
-    assert.equal(headers['x-comq-queue'], queue, 'The parked message does not name its queue')
-    assert.notEqual(headers['x-comq-reason'], undefined, 'The parked message has no reason')
+      // the message came back through the default exchange on every retry, so this
+      // is only right if the origin was recorded on the first failure
+      assert.equal(headers['x-comq-exchange'], exchange,
+        `The parked message says it came from '${headers['x-comq-exchange']}'`)
 
-    // the message came back through the default exchange on every retry, so this
-    // is only right if the origin was recorded on the first failure
-    assert.equal(headers['x-comq-exchange'], exchange,
-      `The parked message says it came from '${headers['x-comq-exchange']}'`)
+      // absent on a message parked from its first delivery, exactly as a consumer reads it;
+      // derived rather than stated, so it cannot drift from the configured ladder
+      assert.equal(headers['x-comq-attempt'] ?? 1, this.attempts.length,
+        'The parked message did not have as many attempts as the consumer saw')
 
-    // absent on a message parked from its first delivery, exactly as a consumer reads it;
-    // derived rather than stated, so it cannot drift from the configured ladder
-    assert.equal(headers['x-comq-attempt'] ?? 1, this.attempts.length,
-      'The parked message did not have as many attempts as the consumer saw')
+      channel.ack(message)
+    })
   })
 
 Then('{token} has received {int} event(s)',

package/features/steps/replies.js

@@ -0,0 +1,35 @@
+'use strict'
+
+const assert = require('node:assert')
+const { Then } = require('@cucumber/cucumber')
+
+const { queues, BROKERS_AMOUNT } = require('./brokers')
+
+Then('the broker holds {int} reply queue(s)',
+  /**
+   * @param {number} count
+   */
+  async function (count) {
+    await held(0, count)
+  })
+
+Then('each broker holds {int} reply queue(s)',
+  /**
+   * @param {number} count
+   */
+  async function (count) {
+    for (let n = 0; n < BROKERS_AMOUNT; n++) await held(n, count)
+  })
+
+/**
+ * @param {number} broker
+ * @param {number} count
+ */
+async function held (broker, count) {
+  const replies = (await queues(broker)).filter((name) => name.startsWith(PREFIX))
+
+  assert.equal(replies.length, count,
+    `Broker ${broker} holds ${replies.length} reply queue(s): ${replies.join(', ')}`)
+}
+
+const PREFIX = 'comq.reply'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comq",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "ComQ",
   "author": {
     "name": "Artem Gurtovoi",

package/readme.md

@@ -113,7 +113,8 @@ Send encoded Request message with `replyTo` and `correlationId` properties set a
 return decoded Reply content. The promise stays pending until the Reply arrives, or until the
 [timeout](#timeout) passes.
 
-On the initial call, queues for Requests and Replies are asserted.
+On the initial call, the queue for Requests is asserted, and so is the one this `IO` receives
+every Reply on.
 
 `options` is the encoding, or an object:
 
@@ -550,7 +551,9 @@ requests and are expecting replies.
 - An exchange is asserted as _fanout_ for [Emission](#emission)
   and [Consumption](#consumption), and as _direct_ for [Routing](#routing). One name is one or
   the other: asserting it as both is what the broker refuses.
-- Queues for Replies are _exclusive_ and _auto deleted_.
+- One queue takes every Reply an `IO` receives, `comq.reply..<id>`, _exclusive_ and gone with the
+  connection. A Reply is matched by its `correlationId`, which is unique across processes, so the
+  queue names neither what was called nor what is waiting.
 - A queue [`back`](#addressed-requests) holds is _exclusive_, bound under its Key to a _direct_
   exchange.
 
@@ -558,7 +561,8 @@ comq declares two kinds of queue of its own, for [failed messages](#retries):
 
 - `comq.retry.<delay>`, with a fanout exchange of the same name, one pair per distinct rung of
   the [backoff ladder](#retries), shared by every queue that uses it.
-- `comq.parked.<queue>`, one per consumed queue, declared to live as long as it does.
+- `comq.parked`, one queue for everything parked, whatever it was consumed from, always
+  _durable_.
 
 See [queue assertion options](https://amqp-node.github.io/amqplib/channel_api.html#channel_assertQueue).
 
@@ -638,8 +642,10 @@ verdict's own message.
 
 #### Parked messages
 
-A message that has run out of attempts is published to `comq.parked.<queue>` and acknowledged
-only once the broker confirms it. It is not deleted, and it does not depend on a broker-side
+A message that has run out of attempts is published to `comq.parked` and acknowledged
+only once the broker confirms it. There is one such queue, and it holds what every queue this
+connection consumes could not process — including a groupless subscription's, which the broker
+removes with the connection while what it could not process stays. It is not deleted, and it does not depend on a broker-side
 policy. The [`discard`](#diagnostics) diagnostic event is emitted when it happens, and
 [`retry`](#diagnostics) on every attempt before it.
 
@@ -648,9 +654,12 @@ name where it was originally published, `x-comq-queue` the queue it was consumed
 `x-comq-reason` the exception's message, and `x-comq-at` when it was parked. Its original
 properties are kept as they were.
 
-Parked queues grow until somebody drains them, which is deliberate — the alternative is deleting
-evidence. Alert on [`discard`](#diagnostics), and do not delete `comq.retry.*` or `comq.parked.*`
-queues on a running system.
+A message is found by the queue it names rather than by the queue it is in: `comq.parked` holds
+messages from every source, so reading one source's means matching on `x-comq-queue`.
+
+The queue grows until somebody drains it, which is deliberate — the alternative is deleting
+evidence. Nothing comq does removes it or what it holds. Alert on [`discard`](#diagnostics), and
+do not delete `comq.retry.*` or `comq.parked` on a running system.
 
 > **A parked Request is never answered.** A Consumer awaiting its Reply waits until its
 > [timeout](#timeout), or indefinitely without one, and with a limited prefetch that can deadlock

package/source/.io/ReplyPipe.js

@@ -60,12 +60,25 @@ class ReplyPipe extends EventEmitter {
       ok: { correlationId, replyTo: feedback.queue, ...CONTROL, headers: FLOW }
     }
 
+    // The source is not read until the confirmation is published, and a blocked broker holds the
+    // publish for as long as it stays blocked. A source failing in the meantime — a reply stream
+    // being relayed times out — would raise an `error` nobody listens to. How it failed is not
+    // reported to the consumer anyway: `#pump` ends the stream once it finds the source destroyed.
+    stream.on('error', noop)
+
     channel.diagnose('return', this.#onReturn)
     feedback.on(correlationId, this.#control)
   }
 
   async pipe () {
-    await this.#transmit(control.ok, this.#properties.ok)
+    try {
+      await this.#transmit(control.ok, this.#properties.ok)
+    } catch (exception) {
+      // nobody is going to read the source now
+      this.#interrupt()
+
+      throw exception
+    }
 
     if (this.#closed) return
 
@@ -198,4 +211,6 @@ const CONTROL = { type: 'control', mandatory: true }
 
 const FLOW = { [FLOW_HEADER]: true }
 
+function noop () {}
+
 exports.ReplyPipe = ReplyPipe

package/source/batch.js

@@ -10,9 +10,9 @@
  * end of the same turn: nothing waits for a timer, and nothing waits for a write that may never
  * come.
  *
- * This belongs in amqplib, whose loop does the writing, and is proposed there:
- * https://github.com/temich/amqplib/tree/perf/one-write-per-turn. It is done here until that
- * lands, and goes when it does.
+ * This belongs in amqplib, whose `Mux` writes the frames one at a time, and where corking that
+ * loop is six lines and needs no wrapping of a socket the library does not own. It is done here
+ * until amqplib carries it, and goes when it does.
  *
  * @param {import('node:net').Socket} socket
  */

package/source/channel.js

@@ -27,14 +27,6 @@ class Channel {
   /** @type {string[]} */
   #tags = []
 
-  /**
-   * How each queue was declared, so that the queue holding what it could not
-   * process is declared to live exactly as long as it does.
-   *
-   * @type {Map<string, comq.amqp.options.Queue>}
-   */
-  #queues = new Map()
-
   /**
    * The exchange and key each held queue is bound under, so that sealing withdraws them.
    *
@@ -88,8 +80,7 @@ class Channel {
     // the consumers of the previous channel went down with it, their tags mean nothing here
     this.#tags = []
 
-    // a fresh channel has declared nothing, and bound nothing
-    this.#queues.clear()
+    // a fresh channel has bound nothing
     this.#held.clear()
 
     await this.#channel.prefetch(this.#topology.prefetch)
@@ -384,8 +375,6 @@ class Channel {
 
     const { queue } = await this.#channel.assertQueue(name, options)
 
-    this.#queues.set(queue, options)
-
     return [queue]
   }
 
@@ -485,21 +474,23 @@ class Channel {
    * The queue a message is kept in once it has run out of attempts. It has no consumer
    * either: what is in it is waiting for a person.
    *
-   * It is declared to live exactly as long as the queue it serves, which for a groupless
-   * subscriber means an exclusive queue whose contents go when the connection does. That
-   * is deliberate: such a subscriber is ephemeral by construction, and a durable queue per
-   * generated name would leak one per restart, forever. An ephemeral subscriber's failures
-   * are ephemeral too.
+   * One queue serves every queue this channel consumes, as one retry queue serves every
+   * source that shares its delay. A parked message carries the queue it came from, so a
+   * queue per source would name what the message already says, and stay on the broker
+   * long after the queue it was named for has gone.
+   *
+   * It is durable whatever the channel is. A groupless subscriber's own queue goes with
+   * its connection, but what it could not process is waiting for a person, and there is
+   * nobody left to tell.
    *
-   * @param {string} queue the queue the message was consumed from
    * @returns {Promise<void>}
    */
-  async #assertParkedQueue (queue) {
+  async #assertParkedQueue () {
     if (!this.#topology.acknowledgments) return
 
-    const options = this.#queues.get(queue) ?? (this.#topology.durable ? DURABLE : EXCLUSIVE)
-
-    await this.#assertQueue(parkedQueueOf(queue), options)
+    // declared here rather than when a message is first parked, for the reason the retry
+    // queues are: the failure handler is the least likely moment for a declare to succeed
+    await this.#assertQueue(PARKED, DURABLE)
   }
 
   /** The waits between attempts, as a ladder even when it is one rung. */
@@ -556,8 +547,9 @@ class Channel {
   }
 
   /**
-   * The retry topology is asserted once per channel and a parked queue once per queue:
-   * `lazy` keys an initializer by the arguments it takes, and both again after a recovery.
+   * The retry and parking topology is asserted once per channel: `lazy` keys an
+   * initializer by the arguments it takes, and neither takes any. Both again after
+   * a recovery.
    */
   #consume = lazy(this, [this.#assertRetryQueue, this.#assertParkedQueue],
     /**
@@ -660,7 +652,7 @@ class Channel {
       [PARKED_AT_HEADER]: Date.now()
     })
 
-    await this.#publish(DEFAULT, parkedQueueOf(queue), message.content, properties)
+    await this.#publish(DEFAULT, PARKED, message.content, properties)
 
     this.#channel.ack(message)
 
@@ -775,9 +767,9 @@ const INTERRUPTION = /** @type {Error} */ Symbol('internal interruption')
 const RESOURCE_LOCKED = 405
 
 const RETRY_PREFIX = 'comq.retry.'
-const PARKED_PREFIX = 'comq.parked.'
 
-const parkedQueueOf = (queue) => PARKED_PREFIX + queue
+/** Where every message that has run out of attempts is kept, whatever it was consumed from. */
+const PARKED = 'comq.parked'
 
 // Everything comq writes onto a message, under its own prefix: AMQP defines no retry
 // counter, so this one is comq's invention rather than a convention, and an unprefixed

package/source/io.js

@@ -30,8 +30,15 @@ class IO {
   /** @type {comq.Channel} */
   #events
 
-  /** @type {Map<string, comq.ReplyEmitter>} */
-  #emitters = new Map()
+  /**
+   * Where this IO's replies arrive. One queue answers every request it makes: a reply is
+   * found by its correlation identifier, which is unique across processes, so a queue per
+   * target would name what the identifier already tells apart — and the broker would hold
+   * one for every distinct queue the caller has ever requested.
+   *
+   * @type {comq.ReplyEmitter}
+   */
+  #emitter
 
   /** @type {comq.ReplyEmitter | null} */
   #control = null
@@ -312,13 +319,20 @@ class IO {
     return [buffer, properties]
   }
 
-  async #consumeReplies (queue) {
-    const emitter = io.createReplyEmitter(queue)
-    const consumer = this.#getReplyConsumer(queue, emitter)
+  async #consumeReplies () {
+    this.#emitter = await this.#consumeRepliesOf(REPLY)
+  }
+
+  /**
+   * @param {string} label
+   * @returns {Promise<comq.ReplyEmitter>}
+   */
+  async #consumeRepliesOf (label) {
+    const emitter = io.createReplyEmitter(label)
 
-    this.#emitters.set(queue, emitter)
+    await this.#replies.consume(emitter.queue, this.#getReplyConsumer(emitter))
 
-    await this.#replies.consume(emitter.queue, consumer)
+    return emitter
   }
 
   // endregion
@@ -389,11 +403,10 @@ class IO {
       })
 
   /**
-   * @param {string} queue
    * @param {comq.ReplyEmitter} emitter
    * @returns {comq.channels.Consumer}
    */
-  #getReplyConsumer = (queue, emitter) =>
+  #getReplyConsumer = (emitter) =>
     (message) => {
       const payload = decode(message)
 
@@ -426,7 +439,7 @@ class IO {
     signal?.throwIfAborted()
 
     const [buffer, contentType] = this.#encode(payload, terms.encoding)
-    const request = this.#createRequest(target, contentType, signal)
+    const request = this.#createRequest(contentType, signal)
     const properties = { ...request.properties }
 
     if (expires !== undefined) {
@@ -493,13 +506,12 @@ class IO {
    * The request holds no copy of what was sent: a retransmission encodes the
    * payload anew, and an unanswered request would otherwise keep two of it.
    *
-   * @param {string} queue
    * @param {comq.Encoding} contentType
    * @param {AbortSignal} [signal]
    * @return {comq.Request}
    */
-  #createRequest (queue, contentType, signal) {
-    const emitter = this.#emitters.get(queue)
+  #createRequest (contentType, signal) {
+    const emitter = this.#emitter
     const correlationId = emitter.next()
 
     /** @type {comq.amqp.Properties} */
@@ -580,11 +592,7 @@ class IO {
    * @return {Promise<comq.ReplyEmitter>}
    */
   async #createControl () {
-    const queue = 'control'
-
-    await this.#consumeReplies(queue)
-
-    return this.#emitters.get(queue)
+    return await this.#consumeRepliesOf(CONTROL)
   }
 
   /**
@@ -693,6 +701,12 @@ const DEFAULT = 'application/json'
 
 const RETRANSMISSION = /** @type {Error} */ Symbol('retransmission')
 
+/** What this IO's replies arrive on, before the random suffix that makes the queue its own. */
+const REPLY = 'comq.reply'
+
+/** What a producer steers its reply streams from, likewise. */
+const CONTROL = 'control'
+
 /**
  * What a caller passed, settled once: a timeout becomes the moment the Request expires, so that
  * every attempt of it shares one deadline.

package/test/ReplyPipe.test.js

@@ -168,3 +168,43 @@ it('should heartbeat while idle', async () => {
 
   pipe.destroy()
 })
+
+// the confirmation is published before the source is read, and a blocked broker holds the publish
+// for as long as it is blocked: the source may fail in the meantime, and nobody listens to it yet
+it('should survive a source that fails before the confirmation is sent', async () => {
+  const gate = new Promex()
+
+  reply.mockImplementation(async (message, properties) => {
+    sent.push([message, properties])
+    await gate
+
+    return true
+  })
+
+  const source = new Readable({ objectMode: true, read () {} })
+  const creating = ReplyPipe.create(request, source, channel, feedback, reply)
+
+  source.destroy(new Error('nothing arrived'))
+
+  await timeout(10)
+
+  gate.resolve()
+
+  const pipe = await creating
+
+  await closing(pipe)
+
+  expect(source.destroyed).toStrictEqual(true)
+})
+
+it('should destroy the source if the confirmation cannot be sent', async () => {
+  reply.mockImplementation(async () => {
+    throw new Error('channel closed')
+  })
+
+  const source = new Readable({ objectMode: true, read () {} })
+
+  await expect(ReplyPipe.create(request, source, channel, feedback, reply)).rejects.toThrow('channel closed')
+
+  expect(source.destroyed).toStrictEqual(true)
+})

package/test/channel.test.js

@@ -1040,6 +1040,7 @@ describe('release', () => {
 describe('failed messages', () => {
   const DELAY = 1000
   const RETRY = 'comq.retry.' + DELAY
+  const PARKED = 'comq.parked'
 
   let queue
   let exception
@@ -1108,10 +1109,18 @@ describe('failed messages', () => {
     it('should assert the parked queue', async () => {
       await channel.consume(queue, consumer)
 
-      expect(chan.assertQueue).toHaveBeenCalledWith('comq.parked.' + queue,
+      expect(chan.assertQueue).toHaveBeenCalledWith(PARKED,
         expect.objectContaining({ durable: true }))
     })
 
+    it('should not name the parked queue after the queue it serves', async () => {
+      await channel.consume(queue, consumer)
+
+      const named = chan.assertQueue.mock.calls.filter(([name]) => name.includes(queue))
+
+      expect(named).toHaveLength(1) // the source queue itself
+    })
+
     it('should assert the source queue first', async () => {
       await channel.consume(queue, consumer)
 
@@ -1130,15 +1139,14 @@ describe('failed messages', () => {
       expect(queues).toHaveLength(1)
     })
 
-    it('should assert a parked queue per consumed queue', async () => {
-      const one = generate()
-      const another = generate()
+    it('should assert one parked queue however many queues are consumed', async () => {
+      await channel.consume(generate(), consumer)
+      await channel.consume(generate(), consumer)
+      await channel.consume(generate(), consumer)
 
-      await channel.consume(one, consumer)
-      await channel.consume(another, consumer)
+      const parked = chan.assertQueue.mock.calls.filter(([name]) => name === PARKED)
 
-      expect(chan.assertQueue).toHaveBeenCalledWith('comq.parked.' + one, expect.anything())
-      expect(chan.assertQueue).toHaveBeenCalledWith('comq.parked.' + another, expect.anything())
+      expect(parked).toHaveLength(1)
     })
 
     it('should not assert either without acknowledgments', async () => {
@@ -1156,7 +1164,9 @@ describe('failed messages', () => {
       expect(chan.assertExchange).not.toHaveBeenCalled()
     })
 
-    it('should declare the parked queue exclusive for an exclusive queue', async () => {
+    it('should declare the parked queue durable whatever the channel is', async () => {
+      // what a groupless subscriber could not process is waiting for a person, and
+      // there is nobody left to tell once its own queue has gone with its connection
       jest.clearAllMocks()
 
       topology.durable = false
@@ -1166,9 +1176,10 @@ describe('failed messages', () => {
       await channel.consume(queue, consumer)
 
       const [, options] = chan.assertQueue.mock.calls
-        .find(([name]) => name === 'comq.parked.' + queue)
+        .find(([name]) => name === PARKED)
 
-      expect(options).toMatchObject({ exclusive: true })
+      expect(options).toMatchObject({ durable: true })
+      expect(options.exclusive).toBeUndefined()
     })
 
     it('should re-assert after recovery', async () => {
@@ -1181,7 +1192,7 @@ describe('failed messages', () => {
       const repl = await getCreatedChannel(replacement)
 
       expect(repl.assertExchange).toHaveBeenCalledWith(RETRY, 'fanout', expect.anything())
-      expect(repl.assertQueue).toHaveBeenCalledWith('comq.parked.' + queue, expect.anything())
+      expect(repl.assertQueue).toHaveBeenCalledWith(PARKED, expect.anything())
     })
   })
 
@@ -1471,7 +1482,7 @@ describe('failed messages', () => {
 
       expect(asserted()).toStrictEqual(['comq.retry.1000'])
       expect(publications().map(([exchange, key]) => exchange || key))
-        .toStrictEqual(['comq.retry.1000', 'comq.parked.' + queue])
+        .toStrictEqual(['comq.retry.1000', PARKED])
     })
   })
 
@@ -1486,7 +1497,7 @@ describe('failed messages', () => {
       const [exchange, key] = publications()[0]
 
       expect(exchange).toStrictEqual('')
-      expect(key).toStrictEqual('comq.parked.' + queue)
+      expect(key).toStrictEqual(PARKED)
     })
 
     it('should not retry once the attempts are spent', async () => {
@@ -1563,7 +1574,7 @@ describe('failed messages', () => {
 
       const targets = publications().map(([, key]) => key)
 
-      expect(targets).toStrictEqual([queue, 'comq.parked.' + queue])
+      expect(targets).toStrictEqual([queue, PARKED])
     })
 
     it('should give a message one delivery more than the ladder has rungs', async () => {
@@ -1581,7 +1592,7 @@ describe('failed messages', () => {
 
       const targets = publications().map(([, key]) => key)
 
-      expect(targets).toStrictEqual([queue, queue, 'comq.parked.' + queue])
+      expect(targets).toStrictEqual([queue, queue, PARKED])
     })
   })
 
@@ -1596,7 +1607,7 @@ describe('failed messages', () => {
       const [exchange, key] = publications()[0]
 
       expect(exchange).toStrictEqual('')
-      expect(key).toStrictEqual('comq.parked.' + queue)
+      expect(key).toStrictEqual(PARKED)
       expect(publications()).toHaveLength(1)
     })
 
@@ -1684,7 +1695,7 @@ describe('failed messages', () => {
 
       await deliver(delivery({}))
 
-      expect(publications()[0][1]).toStrictEqual('comq.parked.' + queue)
+      expect(publications()[0][1]).toStrictEqual(PARKED)
     })
   })
 

package/test/io.request.test.js

@@ -41,7 +41,7 @@ let replies
 
 let promise
 
-const REPLY = new RegExp(`^${queue}..[0-9a-f]+$`)
+const REPLY = /^comq\.reply\.\.[0-9a-f]+$/
 
 beforeEach(async () => {
   promise = io.request(queue, payload)
@@ -62,6 +62,17 @@ it('should consume replies queue', async () => {
   expect(replies.consume).toHaveBeenCalledWith(expect.stringMatching(REPLY), expect.any(Function))
 })
 
+it('should consume one replies queue however many queues are requested', async () => {
+  // a reply is found by its correlation identifier, so a queue per target would
+  // name what the identifier already tells apart
+  io.request(generate(), payload)
+  io.request(generate(), payload)
+
+  await immediate()
+
+  expect(replies.consume).toHaveBeenCalledTimes(1)
+})
+
 describe('send', () => {
   let call
 
@@ -84,9 +95,8 @@ describe('send', () => {
 
   it('should set replyTo', async () => {
     const properties = call[2]
-    const rx = new RegExp(`^${queue}..[a-z0-9]+`)
 
-    expect(properties.replyTo).toMatch(rx)
+    expect(properties.replyTo).toMatch(REPLY)
   })
 
   it('should consume replyTo', async () => {