@bumail/queue 0.1.0 → 0.3.0

package/README.md

@@ -4,8 +4,9 @@ The outbound queue of a mail server: it keeps every message your server
 sends to another one, delivers it through `@bumail/smtp/client`, retries
 what failed for now, and sends a delivery status notification (RFC 3464)
 back when it gives up. Each recipient has its own state, the queue
-survives a restart on `bun:sqlite`, and several workers can share one
-queue. No runtime dependency: only peers.
+survives a restart on `bun:sqlite`, PostgreSQL or Redis, and several
+workers — on one machine, or on many with PostgreSQL or Redis — can
+share one queue. No runtime dependency: only peers.
 
 ## Install
 
@@ -25,6 +26,8 @@ queue that only uses a smarthost needs none.
 | `@bumail/queue` | `createQueue`, the `QueueStore` contract, `QueueError` and the types |
 | `@bumail/queue/memory` | `MemoryQueueStore`: in memory, lost on a restart — for specs and trials |
 | `@bumail/queue/sqlite` | `SqliteQueueStore`: on disk with `bun:sqlite`, shared by the processes of one machine |
+| `@bumail/queue/postgres` | `PostgresQueueStore`: on PostgreSQL through Bun's own `Bun.sql`, shared by instances on several machines |
+| `@bumail/queue/redis` | `RedisQueueStore`: on Redis through Bun's own `Bun.redis`, shared by instances on several machines |
 
 ## Usage
 
@@ -144,6 +147,67 @@ makes is 0700; one that exists keeps its mode.
 item opens one session per recipient domain — and `perDomain` (2) its
 sessions to one recipient domain.
 
+## PostgreSQL, for several machines
+
+```ts
+import { nodeResolver } from '@bumail/dns';
+import { createQueue } from '@bumail/queue';
+import { PostgresQueueStore } from '@bumail/queue/postgres';
+
+// In each instance, on the same database. A Bun.SQL client of your own works too:
+// PostgresQueueStore.open({ sql: new Bun.SQL({ url, max: 10 }) }).
+const store = PostgresQueueStore.open({
+	sql: Bun.env['DATABASE_URL'] ?? 'postgres://bumail@localhost:5432/mail',
+	tablePrefix: 'bumail_queue_', // the default: bumail_queue_items, …_messages, …_schema
+});
+await store.migrate(); // makes the tables; the first call would anyway
+const queue = createQueue({ store, hostname: 'mail.example.net', resolver: nodeResolver() });
+queue.start();
+
+process.on('SIGTERM', async () => {
+	await queue.stop();
+	await store.close(); // closes the client it opened for the URL, never yours
+});
+```
+
+A claim is one `UPDATE … RETURNING` whose item a `SELECT … FOR UPDATE
+SKIP LOCKED` picks: two instances never take the same item, and none
+waits on one another is taking. An instance that crashes loses its items
+when their leases expire, as with `bun:sqlite`. No driver to install:
+`Bun.sql` is Bun's.
+
+## Redis, for several machines
+
+```ts
+import { nodeResolver } from '@bumail/dns';
+import { createQueue } from '@bumail/queue';
+import { RedisQueueStore } from '@bumail/queue/redis';
+
+// In each instance, on the same Redis. A Bun.RedisClient of your own works too:
+// RedisQueueStore.open({ client: new Bun.RedisClient(url) }).
+const store = RedisQueueStore.open({
+	url: Bun.env['REDIS_URL'] ?? 'redis://localhost:6379',
+	keyPrefix: 'bumail:queue:', // the default: bumail:queue:items, …:item:<id>, …
+});
+const queue = createQueue({ store, hostname: 'mail.example.net', resolver: nodeResolver() });
+queue.start();
+
+process.on('SIGTERM', async () => {
+	await queue.stop();
+	await store.close(); // closes the client it opened for the URL, never yours
+});
+```
+
+Every operation that writes is one Lua script, which Redis runs whole:
+two instances never take the same item, and a crashed instance's items
+are claimed again once their leases expire. The message is kept byte for
+byte. One Redis, or a primary with replicas — not Redis Cluster. Redis
+acknowledges a write once it is in memory: with `appendfsync everysec`
+a crash loses up to a second of writes, and a failover to a replica can
+lose acknowledged ones, so keep `appendonly yes`, `appendfsync always`
+and `maxmemory-policy noeviction` where a lost message matters (the
+guide's Redis section). No driver to install: `Bun.redis` is Bun's.
+
 ## Events and admin
 
 ```ts
@@ -212,8 +276,8 @@ control character in it.
 
 ## Traps
 
-- **Bun only.** The store on disk uses `bun:sqlite`, so the package runs
-  on Bun 1.4.2 or later, not on Node.
+- **Bun only.** The stores use `bun:sqlite`, `Bun.sql` and `Bun.redis`,
+  so the package runs on Bun 1.4.2 or later, not on Node.
 - **It sends what you enqueue, to anyone.** The queue is not a relay
   policy: enqueue only what an authenticated user submitted, or what your
   own server writes, never what an unauthenticated client handed you.
@@ -232,12 +296,14 @@ control character in it.
 | `QueueError`, `QueueErrorCode` | `INVALID`, `MESSAGE_TOO_BIG`, `TOO_MANY_RECIPIENTS`, `QUEUE_FULL`, `CLOSED`, `LEASE_LOST` |
 | `MemoryQueueStore` | from `@bumail/queue/memory` |
 | `SqliteQueueStore`, `SqliteQueueStoreOptions` | from `@bumail/queue/sqlite`: `SqliteQueueStore.open({ directory, busyTimeout? })`, `close()` |
+| `PostgresQueueStore`, `PostgresQueueStoreOptions`, `PostgresClient`, `PostgresQueryable` | from `@bumail/queue/postgres`: `PostgresQueueStore.open({ sql, tablePrefix? })`, `migrate()`, `close()`; `sql` a `Bun.SQL` client or a `postgres://` URL |
+| `RedisQueueStore`, `RedisQueueStoreOptions`, `RedisQueueClientOptions`, `RedisQueueUrlOptions`, `RedisQueueClient` | from `@bumail/queue/redis`: `RedisQueueStore.open({ client \| url, keyPrefix? })`, `close()`; `client` a `Bun.RedisClient`, `url` a `redis://` URL |
 
 ## Documentation
 
 These pages ship in the package, under `docs/`.
 
 - [Index](https://github.com/softistx/bumail/blob/develop/packages/queue/docs/README.md): the pages, and when to read each.
-- [Guide](https://github.com/softistx/bumail/blob/develop/packages/queue/docs/guide.md): enqueuing, delivery and routing, the retry schedule, DSNs, several workers and leases, events and admin, the stores, testing, and writing a store of your own.
+- [Guide](https://github.com/softistx/bumail/blob/develop/packages/queue/docs/guide.md): enqueuing, delivery and routing, the retry schedule, DSNs, several workers and leases, events and admin, the stores (PostgreSQL and Redis included), testing, and writing a store of your own.
 - [Troubleshooting](https://github.com/softistx/bumail/blob/develop/packages/queue/docs/troubleshooting.md): every `QueueError`, and what to do about it.
 - [Roadmap](https://github.com/softistx/bumail/blob/develop/packages/queue/docs/roadmap.md): what is coming, and what is not planned.

package/dist/chunks/{index-xhsw4xcz.js → index-vg971acr.js}

@@ -1,6 +1,41 @@
-import {
-  invalid
-} from "./index-p4k4rjb7.js";
+// src/errors.ts
+class QueueError2 extends Error {
+  name = "QueueError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+var invalid = (message) => new QueueError2("INVALID", message);
+
+// src/text.ts
+var isControl = (code) => code < 32 || code >= 127 && code <= 159;
+function hasControl(text) {
+  for (let i = 0;i < text.length; i++) {
+    if (isControl(text.charCodeAt(i)))
+      return true;
+  }
+  return false;
+}
+function replaceControls(text, by) {
+  let out = "";
+  for (let i = 0;i < text.length; i++) {
+    out += isControl(text.charCodeAt(i)) ? by : text[i];
+  }
+  return out;
+}
+function cleanText(text, max) {
+  const clean = replaceControls(text.toWellFormed(), " ").replace(/ {2,}/g, " ").trim();
+  return clean.length > max ? `${cut(clean, max - 3)}...` : clean;
+}
+function cut(text, length) {
+  const head = text.slice(0, length);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+var isStorable = (text) => text.isWellFormed() && !text.includes("\x00");
+var asciiText = (text, max) => cleanText(text, max).replace(/[^ -~]/g, "?");
 
 // src/contract/checks.ts
 var isTime = (value) => typeof value === "number" && Number.isFinite(value);
@@ -9,22 +44,49 @@ function checkTime(name, value) {
     throw invalid(`${name} must be a finite number`);
   return value;
 }
+function checkStorable(name, text) {
+  if (!isStorable(text)) {
+    throw invalid(`${name} holds a NUL or a lone surrogate, which a store cannot keep`);
+  }
+}
 function checkOwner(owner) {
   if (typeof owner !== "string" || owner === "") {
     throw invalid("owner must be a non-empty string");
   }
+  checkStorable("owner", owner);
   return owner;
 }
+function checkUpdate(update) {
+  checkStorable("A recipient", update.address);
+  const reply = update.reply;
+  if (reply === undefined)
+    return;
+  if (typeof reply !== "object" || reply === null || typeof reply.text !== "string") {
+    throw invalid("A reply is an object with a text");
+  }
+  checkStorable("reply.text", reply.text);
+  for (const name of ["status", "host"]) {
+    const value = reply[name];
+    if (value === undefined)
+      continue;
+    if (typeof value !== "string")
+      throw invalid(`reply.${name} must be a string`);
+    checkStorable(`reply.${name}`, value);
+  }
+}
 function checkNewItem(item) {
   if (typeof item !== "object" || item === null) {
     throw invalid("A new item is an object");
   }
   if (typeof item.from !== "string")
     throw invalid("from must be a string");
+  checkStorable("from", item.from);
   const to = item.to;
   if (!Array.isArray(to) || to.length === 0 || !to.every((a) => typeof a === "string" && a !== "")) {
     throw invalid("to must be a non-empty array of addresses");
   }
+  for (const address of to)
+    checkStorable("A recipient", address);
   if (!(item.message instanceof Uint8Array)) {
     throw invalid("message must be a Uint8Array");
   }
@@ -64,6 +126,8 @@ function checkResult(result) {
   if (!Array.isArray(result.recipients) || !result.recipients.every((u) => typeof u?.address === "string" && statuses.includes(u.status))) {
     throw invalid("recipients must be an array of { address, status: delivered, deferred or failed }");
   }
+  for (const update of result.recipients)
+    checkUpdate(update);
 }
 function checkList(options = {}) {
   const offset = options.offset ?? 0;
@@ -113,7 +177,7 @@ function newItem(id, item) {
 }
 var claimable = (item, now) => item.nextAttemptAt <= now && (item.lease === undefined || item.lease.expiresAt <= now);
 
-export { checkTime, checkOwner, checkNewItem, checkMaxItems, checkClaim, checkResult, checkList, isDone, applyAttempt, newItem, claimable };
+export { QueueError2, invalid, hasControl, replaceControls, cleanText, isStorable, asciiText, checkTime, checkOwner, checkNewItem, checkMaxItems, checkClaim, checkResult, checkList, isDone, applyAttempt, newItem, claimable };
 
-//# debugId=70E823C3942B47A164756E2164756E21
-//# sourceMappingURL=index-xhsw4xcz.js.map
+//# debugId=81614FFC0DB6330C64756E2164756E21
+//# sourceMappingURL=index-vg971acr.js.map

package/dist/chunks/index-vg971acr.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/errors.ts", "../src/text.ts", "../src/contract/checks.ts"],
+  "sourcesContent": [
+    "/**\n * Why the queue or a store refused a call. `INVALID`: an option or an\n * argument it cannot take. `MESSAGE_TOO_BIG`, `TOO_MANY_RECIPIENTS` and\n * `QUEUE_FULL`: a limit `enqueue` enforces. `CLOSED`: a store used after\n * `close()`. `LEASE_LOST`: given to the `error` event when another worker\n * took an item before its outcome was recorded — or, once the lease's\n * expiry passed, when the item is gone: lost or cancelled.\n */\nexport type QueueErrorCode =\n\t| 'INVALID'\n\t| 'MESSAGE_TOO_BIG'\n\t| 'TOO_MANY_RECIPIENTS'\n\t| 'QUEUE_FULL'\n\t| 'CLOSED'\n\t| 'LEASE_LOST';\n\n/** Thrown by the queue and by every store, whichever answers the contract, with the same codes. */\nexport class QueueError extends Error {\n\toverride readonly name = 'QueueError';\n\treadonly code: QueueErrorCode;\n\n\tconstructor(code: QueueErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t}\n}\n\n/** `INVALID`, for an option or an argument. */\nexport const invalid = (message: string) => new QueueError('INVALID', message);\n",
+    "/** Text from the other side, made safe to keep and to write in a header field. */\n\n/** C0, DEL and C1: every control character, CR, LF and TAB included. */\nconst isControl = (code: number) =>\n\tcode < 0x20 || (code >= 0x7f && code <= 0x9f);\n\n/** Whether the text holds a control character. */\nexport function hasControl(text: string): boolean {\n\tfor (let i = 0; i < text.length; i++) {\n\t\tif (isControl(text.charCodeAt(i))) return true;\n\t}\n\treturn false;\n}\n\n/** Each control character replaced by `by`. */\nexport function replaceControls(text: string, by: string): string {\n\tlet out = '';\n\tfor (let i = 0; i < text.length; i++) {\n\t\tout += isControl(text.charCodeAt(i)) ? by : (text[i] as string);\n\t}\n\treturn out;\n}\n\n/**\n * Every control character (CR and LF included) as a space, a lone\n * surrogate as U+FFFD, runs of space as one, cut at `max` characters with\n * `...`, never inside a surrogate pair: what a reply leaves in an item,\n * an event and a DSN.\n */\nexport function cleanText(text: string, max: number): string {\n\tconst clean = replaceControls(text.toWellFormed(), ' ')\n\t\t.replace(/ {2,}/g, ' ')\n\t\t.trim();\n\treturn clean.length > max ? `${cut(clean, max - 3)}...` : clean;\n}\n\n/**\n * The first `length` UTF-16 units, never ending inside a surrogate pair:\n * a lone surrogate is text no store can keep (PostgreSQL's `jsonb` refuses\n * it), nor any UTF-8 encode.\n */\nfunction cut(text: string, length: number): string {\n\tconst head = text.slice(0, length);\n\tconst last = head.charCodeAt(head.length - 1);\n\treturn last >= 0xd800 && last <= 0xdbff ? head.slice(0, -1) : head;\n}\n\n/**\n * Text every store can keep: no NUL (PostgreSQL's `text` and `jsonb` hold\n * none) and no lone surrogate. `cleanText`'s output always is.\n */\nexport const isStorable = (text: string): boolean =>\n\ttext.isWellFormed() && !text.includes('\\0');\n\n/** `cleanText`, then anything not printable ASCII as `?`: for a `message/delivery-status` field. */\nexport const asciiText = (text: string, max: number): string =>\n\tcleanText(text, max).replace(/[^ -~]/g, '?');\n",
+    "import { invalid } from '../errors';\nimport { isStorable } from '../text';\nimport type {\n\tAttemptResult,\n\tClaimRequest,\n\tDiagnostic,\n\tNewQueueItem,\n\tQueueItem,\n\tQueueListOptions,\n\tRecipientState,\n\tRecipientUpdate,\n} from './types';\n\n/** What every store checks the same way, so each refuses the same input with the same error. */\n\nconst isTime = (value: unknown): value is number =>\n\ttypeof value === 'number' && Number.isFinite(value);\n\n/** A time in milliseconds since the epoch, or `INVALID` naming it. */\nexport function checkTime(name: string, value: unknown): number {\n\tif (!isTime(value)) throw invalid(`${name} must be a finite number`);\n\treturn value;\n}\n\n/**\n * Text a store keeps: refused, the same way by every store, when it holds\n * a NUL or a lone surrogate, which PostgreSQL cannot keep and no UTF-8\n * encode can carry.\n */\nexport function checkStorable(name: string, text: string): void {\n\tif (!isStorable(text)) {\n\t\tthrow invalid(\n\t\t\t`${name} holds a NUL or a lone surrogate, which a store cannot keep`,\n\t\t);\n\t}\n}\n\n/** A lease owner: a non-empty string. */\nexport function checkOwner(owner: unknown): string {\n\tif (typeof owner !== 'string' || owner === '') {\n\t\tthrow invalid('owner must be a non-empty string');\n\t}\n\tcheckStorable('owner', owner);\n\treturn owner;\n}\n\n/** Every text of a recipient's outcome. */\nfunction checkUpdate(update: RecipientUpdate): void {\n\tcheckStorable('A recipient', update.address);\n\tconst reply = update.reply as Partial<Diagnostic> | undefined;\n\tif (reply === undefined) return;\n\tif (\n\t\ttypeof reply !== 'object' ||\n\t\treply === null ||\n\t\ttypeof reply.text !== 'string'\n\t) {\n\t\tthrow invalid('A reply is an object with a text');\n\t}\n\tcheckStorable('reply.text', reply.text);\n\tfor (const name of ['status', 'host'] as const) {\n\t\tconst value = reply[name];\n\t\tif (value === undefined) continue;\n\t\tif (typeof value !== 'string')\n\t\t\tthrow invalid(`reply.${name} must be a string`);\n\t\tcheckStorable(`reply.${name}`, value);\n\t}\n}\n\nexport function checkNewItem(item: NewQueueItem): void {\n\tif (typeof item !== 'object' || item === null) {\n\t\tthrow invalid('A new item is an object');\n\t}\n\tif (typeof item.from !== 'string') throw invalid('from must be a string');\n\tcheckStorable('from', item.from);\n\tconst to = item.to as unknown;\n\tif (\n\t\t!Array.isArray(to) ||\n\t\tto.length === 0 ||\n\t\t!to.every((a) => typeof a === 'string' && a !== '')\n\t) {\n\t\tthrow invalid('to must be a non-empty array of addresses');\n\t}\n\tfor (const address of to as string[]) checkStorable('A recipient', address);\n\tif (!(item.message instanceof Uint8Array)) {\n\t\tthrow invalid('message must be a Uint8Array');\n\t}\n\tcheckTime('createdAt', item.createdAt);\n}\n\n/** `maxItems`: a positive integer, or nothing. */\nexport function checkMaxItems(max: unknown): number | undefined {\n\tif (max === undefined) return undefined;\n\tif (typeof max !== 'number' || !Number.isInteger(max) || max < 1) {\n\t\tthrow invalid(`maxItems must be an integer of at least 1, not ${max}`);\n\t}\n\treturn max;\n}\n\nexport function checkClaim(request: ClaimRequest): void {\n\tif (typeof request !== 'object' || request === null) {\n\t\tthrow invalid('A claim is an object');\n\t}\n\tcheckOwner(request.owner);\n\tcheckTime('now', request.now);\n\tif (!isTime(request.leaseMs) || request.leaseMs <= 0) {\n\t\tthrow invalid('leaseMs must be a positive number');\n\t}\n}\n\nexport function checkResult(result: AttemptResult): void {\n\tif (typeof result !== 'object' || result === null) {\n\t\tthrow invalid('An attempt result is an object');\n\t}\n\tcheckTime('now', result.now);\n\tcheckTime('nextAttemptAt', result.nextAttemptAt);\n\tif (!Number.isInteger(result.attempts) || result.attempts < 0) {\n\t\tthrow invalid('attempts must be an integer of at least 0');\n\t}\n\tif (typeof result.delayNotified !== 'boolean') {\n\t\tthrow invalid('delayNotified must be true or false');\n\t}\n\tconst statuses = ['delivered', 'deferred', 'failed'];\n\tif (\n\t\t!Array.isArray(result.recipients) ||\n\t\t!result.recipients.every(\n\t\t\t(u) => typeof u?.address === 'string' && statuses.includes(u.status),\n\t\t)\n\t) {\n\t\tthrow invalid(\n\t\t\t'recipients must be an array of { address, status: delivered, deferred or failed }',\n\t\t);\n\t}\n\tfor (const update of result.recipients) checkUpdate(update);\n}\n\n/** The offset and limit of a list: integers, the limit 1 to 1000. */\nexport function checkList(options: QueueListOptions = {}): {\n\toffset: number;\n\tlimit: number;\n} {\n\tconst offset = options.offset ?? 0;\n\tconst limit = options.limit ?? 100;\n\tif (!Number.isInteger(offset) || offset < 0) {\n\t\tthrow invalid(`offset must be an integer of at least 0, not ${offset}`);\n\t}\n\tif (!Number.isInteger(limit) || limit < 1 || limit > 1000) {\n\t\tthrow invalid(`limit must be an integer from 1 to 1000, not ${limit}`);\n\t}\n\treturn { offset, limit };\n}\n\n/** Every recipient is `delivered` or `failed`. */\nexport const isDone = (item: Pick<QueueItem, 'recipients'>): boolean =>\n\titem.recipients.every(\n\t\t(r) => r.status === 'delivered' || r.status === 'failed',\n\t);\n\n/**\n * The item once an attempt is recorded: its recipients' outcomes, a final\n * state never changed again, the schedule, and no lease.\n */\nexport function applyAttempt(\n\titem: QueueItem,\n\tresult: AttemptResult,\n): QueueItem {\n\tconst updates = new Map(result.recipients.map((u) => [u.address, u]));\n\tconst recipients = item.recipients.map((r): RecipientState => {\n\t\tconst update = updates.get(r.address);\n\t\tif (!update || r.status === 'delivered' || r.status === 'failed') return r;\n\t\treturn {\n\t\t\taddress: r.address,\n\t\t\tstatus: update.status,\n\t\t\t...(update.reply ? { reply: update.reply } : {}),\n\t\t\tupdatedAt: result.now,\n\t\t};\n\t});\n\tconst { lease: _, ...rest } = item;\n\treturn {\n\t\t...rest,\n\t\trecipients,\n\t\tnextAttemptAt: result.nextAttemptAt,\n\t\tattempts: result.attempts,\n\t\tdelayNotified: result.delayNotified,\n\t};\n}\n\n/** A new item as a store first keeps it. */\nexport function newItem(id: string, item: NewQueueItem): QueueItem {\n\treturn {\n\t\tid,\n\t\tfrom: item.from,\n\t\trecipients: item.to.map((address) => ({ address, status: 'pending' })),\n\t\tsize: item.message.length,\n\t\tcreatedAt: item.createdAt,\n\t\tnextAttemptAt: item.createdAt,\n\t\tattempts: 0,\n\t\tdelayNotified: false,\n\t};\n}\n\n/** Whether a lease, if any, leaves the item free to claim at `now`. */\nexport const claimable = (item: QueueItem, now: number): boolean =>\n\titem.nextAttemptAt <= now &&\n\t(item.lease === undefined || item.lease.expiresAt <= now);\n"
+  ],
+  "mappings": ";AAiBO,MAAM,oBAAmB,MAAM;AAAA,EACnB,OAAO;AAAA,EAChB;AAAA,EAET,WAAW,CAAC,MAAsB,SAAiB;AAAA,IAClD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEd;AAGO,IAAM,UAAU,CAAC,YAAoB,IAAI,YAAW,WAAW,OAAO;;;ACzB7E,IAAM,YAAY,CAAC,SAClB,OAAO,MAAS,QAAQ,OAAQ,QAAQ;AAGlC,SAAS,UAAU,CAAC,MAAuB;AAAA,EACjD,SAAS,IAAI,EAAG,IAAI,KAAK,QAAQ,KAAK;AAAA,IACrC,IAAI,UAAU,KAAK,WAAW,CAAC,CAAC;AAAA,MAAG,OAAO;AAAA,EAC3C;AAAA,EACA,OAAO;AAAA;AAID,SAAS,eAAe,CAAC,MAAc,IAAoB;AAAA,EACjE,IAAI,MAAM;AAAA,EACV,SAAS,IAAI,EAAG,IAAI,KAAK,QAAQ,KAAK;AAAA,IACrC,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,IAAI,KAAM,KAAK;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AASD,SAAS,SAAS,CAAC,MAAc,KAAqB;AAAA,EAC5D,MAAM,QAAQ,gBAAgB,KAAK,aAAa,GAAG,GAAG,EACpD,QAAQ,UAAU,GAAG,EACrB,KAAK;AAAA,EACP,OAAO,MAAM,SAAS,MAAM,GAAG,IAAI,OAAO,MAAM,CAAC,SAAS;AAAA;AAQ3D,SAAS,GAAG,CAAC,MAAc,QAAwB;AAAA,EAClD,MAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AAAA,EACjC,MAAM,OAAO,KAAK,WAAW,KAAK,SAAS,CAAC;AAAA,EAC5C,OAAO,QAAQ,SAAU,QAAQ,QAAS,KAAK,MAAM,GAAG,EAAE,IAAI;AAAA;AAOxD,IAAM,aAAa,CAAC,SAC1B,KAAK,aAAa,KAAK,CAAC,KAAK,SAAS,MAAI;AAGpC,IAAM,YAAY,CAAC,MAAc,QACvC,UAAU,MAAM,GAAG,EAAE,QAAQ,WAAW,GAAG;;;ACzC5C,IAAM,SAAS,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAG5C,SAAS,SAAS,CAAC,MAAc,OAAwB;AAAA,EAC/D,IAAI,CAAC,OAAO,KAAK;AAAA,IAAG,MAAM,QAAQ,GAAG,8BAA8B;AAAA,EACnE,OAAO;AAAA;AAQD,SAAS,aAAa,CAAC,MAAc,MAAoB;AAAA,EAC/D,IAAI,CAAC,WAAW,IAAI,GAAG;AAAA,IACtB,MAAM,QACL,GAAG,iEACJ;AAAA,EACD;AAAA;AAIM,SAAS,UAAU,CAAC,OAAwB;AAAA,EAClD,IAAI,OAAO,UAAU,YAAY,UAAU,IAAI;AAAA,IAC9C,MAAM,QAAQ,kCAAkC;AAAA,EACjD;AAAA,EACA,cAAc,SAAS,KAAK;AAAA,EAC5B,OAAO;AAAA;AAIR,SAAS,WAAW,CAAC,QAA+B;AAAA,EACnD,cAAc,eAAe,OAAO,OAAO;AAAA,EAC3C,MAAM,QAAQ,OAAO;AAAA,EACrB,IAAI,UAAU;AAAA,IAAW;AAAA,EACzB,IACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAO,MAAM,SAAS,UACrB;AAAA,IACD,MAAM,QAAQ,kCAAkC;AAAA,EACjD;AAAA,EACA,cAAc,cAAc,MAAM,IAAI;AAAA,EACtC,WAAW,QAAQ,CAAC,UAAU,MAAM,GAAY;AAAA,IAC/C,MAAM,QAAQ,MAAM;AAAA,IACpB,IAAI,UAAU;AAAA,MAAW;AAAA,IACzB,IAAI,OAAO,UAAU;AAAA,MACpB,MAAM,QAAQ,SAAS,uBAAuB;AAAA,IAC/C,cAAc,SAAS,QAAQ,KAAK;AAAA,EACrC;AAAA;AAGM,SAAS,YAAY,CAAC,MAA0B;AAAA,EACtD,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAAA,IAC9C,MAAM,QAAQ,yBAAyB;AAAA,EACxC;AAAA,EACA,IAAI,OAAO,KAAK,SAAS;AAAA,IAAU,MAAM,QAAQ,uBAAuB;AAAA,EACxE,cAAc,QAAQ,KAAK,IAAI;AAAA,EAC/B,MAAM,KAAK,KAAK;AAAA,EAChB,IACC,CAAC,MAAM,QAAQ,EAAE,KACjB,GAAG,WAAW,KACd,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,EAAE,GACjD;AAAA,IACD,MAAM,QAAQ,2CAA2C;AAAA,EAC1D;AAAA,EACA,WAAW,WAAW;AAAA,IAAgB,cAAc,eAAe,OAAO;AAAA,EAC1E,IAAI,EAAE,KAAK,mBAAmB,aAAa;AAAA,IAC1C,MAAM,QAAQ,8BAA8B;AAAA,EAC7C;AAAA,EACA,UAAU,aAAa,KAAK,SAAS;AAAA;AAI/B,SAAS,aAAa,CAAC,KAAkC;AAAA,EAC/D,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,GAAG;AAAA,IACjE,MAAM,QAAQ,kDAAkD,KAAK;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,UAAU,CAAC,SAA6B;AAAA,EACvD,IAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AAAA,IACpD,MAAM,QAAQ,sBAAsB;AAAA,EACrC;AAAA,EACA,WAAW,QAAQ,KAAK;AAAA,EACxB,UAAU,OAAO,QAAQ,GAAG;AAAA,EAC5B,IAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,QAAQ,WAAW,GAAG;AAAA,IACrD,MAAM,QAAQ,mCAAmC;AAAA,EAClD;AAAA;AAGM,SAAS,WAAW,CAAC,QAA6B;AAAA,EACxD,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AAAA,IAClD,MAAM,QAAQ,gCAAgC;AAAA,EAC/C;AAAA,EACA,UAAU,OAAO,OAAO,GAAG;AAAA,EAC3B,UAAU,iBAAiB,OAAO,aAAa;AAAA,EAC/C,IAAI,CAAC,OAAO,UAAU,OAAO,QAAQ,KAAK,OAAO,WAAW,GAAG;AAAA,IAC9D,MAAM,QAAQ,2CAA2C;AAAA,EAC1D;AAAA,EACA,IAAI,OAAO,OAAO,kBAAkB,WAAW;AAAA,IAC9C,MAAM,QAAQ,qCAAqC;AAAA,EACpD;AAAA,EACA,MAAM,WAAW,CAAC,aAAa,YAAY,QAAQ;AAAA,EACnD,IACC,CAAC,MAAM,QAAQ,OAAO,UAAU,KAChC,CAAC,OAAO,WAAW,MAClB,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,SAAS,SAAS,EAAE,MAAM,CACpE,GACC;AAAA,IACD,MAAM,QACL,mFACD;AAAA,EACD;AAAA,EACA,WAAW,UAAU,OAAO;AAAA,IAAY,YAAY,MAAM;AAAA;AAIpD,SAAS,SAAS,CAAC,UAA4B,CAAC,GAGrD;AAAA,EACD,MAAM,SAAS,QAAQ,UAAU;AAAA,EACjC,MAAM,QAAQ,QAAQ,SAAS;AAAA,EAC/B,IAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,GAAG;AAAA,IAC5C,MAAM,QAAQ,gDAAgD,QAAQ;AAAA,EACvE;AAAA,EACA,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,MAAM;AAAA,IAC1D,MAAM,QAAQ,gDAAgD,OAAO;AAAA,EACtE;AAAA,EACA,OAAO,EAAE,QAAQ,MAAM;AAAA;AAIjB,IAAM,SAAS,CAAC,SACtB,KAAK,WAAW,MACf,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE,WAAW,QACjD;AAMM,SAAS,YAAY,CAC3B,MACA,QACY;AAAA,EACZ,MAAM,UAAU,IAAI,IAAI,OAAO,WAAW,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAAA,EACpE,MAAM,aAAa,KAAK,WAAW,IAAI,CAAC,MAAsB;AAAA,IAC7D,MAAM,SAAS,QAAQ,IAAI,EAAE,OAAO;AAAA,IACpC,IAAI,CAAC,UAAU,EAAE,WAAW,eAAe,EAAE,WAAW;AAAA,MAAU,OAAO;AAAA,IACzE,OAAO;AAAA,MACN,SAAS,EAAE;AAAA,MACX,QAAQ,OAAO;AAAA,SACX,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MAC9C,WAAW,OAAO;AAAA,IACnB;AAAA,GACA;AAAA,EACD,QAAQ,OAAO,MAAM,SAAS;AAAA,EAC9B,OAAO;AAAA,OACH;AAAA,IACH;AAAA,IACA,eAAe,OAAO;AAAA,IACtB,UAAU,OAAO;AAAA,IACjB,eAAe,OAAO;AAAA,EACvB;AAAA;AAIM,SAAS,OAAO,CAAC,IAAY,MAA+B;AAAA,EAClE,OAAO;AAAA,IACN;AAAA,IACA,MAAM,KAAK;AAAA,IACX,YAAY,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,QAAQ,UAAU,EAAE;AAAA,IACrE,MAAM,KAAK,QAAQ;AAAA,IACnB,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK;AAAA,IACpB,UAAU;AAAA,IACV,eAAe;AAAA,EAChB;AAAA;AAIM,IAAM,YAAY,CAAC,MAAiB,QAC1C,KAAK,iBAAiB,QACrB,KAAK,UAAU,aAAa,KAAK,MAAM,aAAa;",
+  "debugId": "81614FFC0DB6330C64756E2164756E21",
+  "names": []
+}

package/dist/chunks/index-y3n1w2az.js

@@ -0,0 +1,18 @@
+// src/masked.ts
+function masked(text, raw) {
+  let decoded = raw;
+  try {
+    decoded = decodeURIComponent(raw);
+  } catch {}
+  let out = text;
+  for (const password of [raw, decoded]) {
+    if (password !== "")
+      out = out.replaceAll(password, "…");
+  }
+  return out;
+}
+
+export { masked };
+
+//# debugId=64BFD310901EABF064756E2164756E21
+//# sourceMappingURL=index-y3n1w2az.js.map

package/dist/chunks/index-y3n1w2az.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/masked.ts"],
+  "sourcesContent": [
+    "/**\n * `text` with a URL's password masked, as written in the URL and decoded,\n * if it decodes: what a store opening a URL repeats of the client's\n * reason, which may name it.\n */\nexport function masked(text: string, raw: string): string {\n\tlet decoded = raw;\n\ttry {\n\t\tdecoded = decodeURIComponent(raw);\n\t} catch {\n\t\t// Not percent-encoding a client reads either: the raw form is what it would repeat.\n\t}\n\tlet out = text;\n\tfor (const password of [raw, decoded]) {\n\t\tif (password !== '') out = out.replaceAll(password, '…');\n\t}\n\treturn out;\n}\n"
+  ],
+  "mappings": ";AAKO,SAAS,MAAM,CAAC,MAAc,KAAqB;AAAA,EACzD,IAAI,UAAU;AAAA,EACd,IAAI;AAAA,IACH,UAAU,mBAAmB,GAAG;AAAA,IAC/B,MAAM;AAAA,EAGR,IAAI,MAAM;AAAA,EACV,WAAW,YAAY,CAAC,KAAK,OAAO,GAAG;AAAA,IACtC,IAAI,aAAa;AAAA,MAAI,MAAM,IAAI,WAAW,UAAU,GAAG;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "64BFD310901EABF064756E2164756E21",
+  "names": []
+}

package/dist/contract/checks.d.ts

@@ -1,6 +1,12 @@
 import type { AttemptResult, ClaimRequest, NewQueueItem, QueueItem, QueueListOptions } from './types';
 /** A time in milliseconds since the epoch, or `INVALID` naming it. */
 export declare function checkTime(name: string, value: unknown): number;
+/**
+ * Text a store keeps: refused, the same way by every store, when it holds
+ * a NUL or a lone surrogate, which PostgreSQL cannot keep and no UTF-8
+ * encode can carry.
+ */
+export declare function checkStorable(name: string, text: string): void;
 /** A lease owner: a non-empty string. */
 export declare function checkOwner(owner: unknown): string;
 export declare function checkNewItem(item: NewQueueItem): void;

package/dist/contract/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/contract/checks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,gBAAgB,EAEhB,MAAM,SAAS,CAAC;AAOjB,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAG9D;AAED,yCAAyC;AACzC,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKjD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAiBrD;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM9D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAStD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAuBvD;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACd,CAUA;AAED,kDAAkD;AAClD,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,KAAG,OAG3D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,aAAa,GACnB,SAAS,CAoBX;AAED,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,SAAS,CAWjE;AAED,uEAAuE;AACvE,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,OAEC,CAAC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/contract/checks.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EAEZ,YAAY,EACZ,SAAS,EACT,gBAAgB,EAGhB,MAAM,SAAS,CAAC;AAOjB,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAG9D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAM9D;AAED,yCAAyC;AACzC,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMjD;AAwBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmBrD;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM9D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAStD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAwBvD;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACd,CAUA;AAED,kDAAkD;AAClD,eAAO,MAAM,MAAM,GAAI,MAAM,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,KAAG,OAG3D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,aAAa,GACnB,SAAS,CAoBX;AAED,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,SAAS,CAWjE;AAED,uEAAuE;AACvE,eAAO,MAAM,SAAS,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,OAEC,CAAC"}

package/dist/errors.d.ts

@@ -3,7 +3,8 @@
  * argument it cannot take. `MESSAGE_TOO_BIG`, `TOO_MANY_RECIPIENTS` and
  * `QUEUE_FULL`: a limit `enqueue` enforces. `CLOSED`: a store used after
  * `close()`. `LEASE_LOST`: given to the `error` event when another worker
- * took an item before its outcome was recorded.
+ * took an item before its outcome was recorded — or, once the lease's
+ * expiry passed, when the item is gone: lost or cancelled.
  */
 export type QueueErrorCode = 'INVALID' | 'MESSAGE_TOO_BIG' | 'TOO_MANY_RECIPIENTS' | 'QUEUE_FULL' | 'CLOSED' | 'LEASE_LOST';
 /** Thrown by the queue and by every store, whichever answers the contract, with the same codes. */

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACvB,SAAS,GACT,iBAAiB,GACjB,qBAAqB,GACrB,YAAY,GACZ,QAAQ,GACR,YAAY,CAAC;AAEhB,mGAAmG;AACnG,qBAAa,UAAW,SAAQ,KAAK;IACpC,SAAkB,IAAI,gBAAgB;IACtC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAIjD;AAED,+CAA+C;AAC/C,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,eAAuC,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GACvB,SAAS,GACT,iBAAiB,GACjB,qBAAqB,GACrB,YAAY,GACZ,QAAQ,GACR,YAAY,CAAC;AAEhB,mGAAmG;AACnG,qBAAa,UAAW,SAAQ,KAAK;IACpC,SAAkB,IAAI,gBAAgB;IACtC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;CAIjD;AAED,+CAA+C;AAC/C,eAAO,MAAM,OAAO,GAAI,SAAS,MAAM,eAAuC,CAAC"}

package/dist/index.js

@@ -1,33 +1,14 @@
 import {
   QueueError2,
-  invalid
-} from "./chunks/index-p4k4rjb7.js";
+  invalid,
+  hasControl,
+  replaceControls,
+  cleanText,
+  asciiText,
+  checkOwner
+} from "./chunks/index-vg971acr.js";
 // src/queue/envelope.ts
 import { isMailbox } from "@bumail/smtp/client";
-
-// src/text.ts
-var isControl = (code) => code < 32 || code >= 127 && code <= 159;
-function hasControl(text) {
-  for (let i = 0;i < text.length; i++) {
-    if (isControl(text.charCodeAt(i)))
-      return true;
-  }
-  return false;
-}
-function replaceControls(text, by) {
-  let out = "";
-  for (let i = 0;i < text.length; i++) {
-    out += isControl(text.charCodeAt(i)) ? by : text[i];
-  }
-  return out;
-}
-function cleanText(text, max) {
-  const clean = replaceControls(text, " ").replace(/ {2,}/g, " ").trim();
-  return clean.length > max ? `${clean.slice(0, max - 3)}...` : clean;
-}
-var asciiText = (text, max) => cleanText(text, max).replace(/[^ -~]/g, "?");
-
-// src/queue/envelope.ts
 var ADDRESS = /^[^\s<>]{1,64}@[^\s<>@]{1,253}$/u;
 function checkAddress(name, address) {
   if (typeof address !== "string" || address.length > 254 || hasControl(address) || !ADDRESS.test(address) || !isMailbox(address)) {
@@ -280,10 +261,7 @@ function settingsOf(options) {
   }
   checkRoutes(options);
   checkSessions(options);
-  const owner = options.owner ?? crypto.randomUUID();
-  if (typeof owner !== "string" || owner === "") {
-    throw invalid("owner must be a non-empty string");
-  }
+  const owner = checkOwner(options.owner ?? crypto.randomUUID());
   const clock = options.clock;
   return {
     options,
@@ -619,7 +597,7 @@ function diagnosticOfError(error, temporary, max, host) {
   return {
     status: `${temporary ? 4 : 5}.${detail}`,
     text: cleanText(text, max),
-    ...host ? { host } : {}
+    ...host ? { host: cleanText(host, 255) } : {}
   };
 }
 function outcomesOf(result, group, max) {
@@ -642,7 +620,10 @@ function outcomesOf(result, group, max) {
   return group.map((address) => updates.get(address) ?? {
     address,
     status: "deferred",
-    reply: { text: "The delivery said nothing of this recipient", host }
+    reply: {
+      text: "The delivery said nothing of this recipient",
+      ...host ? { host: cleanText(host, 255) } : {}
+    }
   });
 }
 function outcomesOfError(error, group, max, host) {
@@ -733,6 +714,7 @@ function settle(item, updates, skipped, now, settings) {
 }
 
 // src/queue/deliver.ts
+var goneAfter = (lapse, id) => new QueueError2("LEASE_LOST", lapse === "taken" ? `The lease on ${id} was lost while it was delivered, and the item is gone: finished by the worker that took it, the message then sent twice, or cancelled` : `The lease on ${id} expired before its outcome was recorded, and the item is gone: lost to another worker that finished it, the message then sent twice, or cancelled`);
 function groupsOf(item) {
   const groups = new Map;
   for (const r of item.recipients) {
@@ -825,6 +807,11 @@ async function deliverItem(ctx, item) {
   const after = await store.complete(item.id, settings.owner, settled.result);
   ctx.recorded();
   if (!after && await store.get(item.id) === undefined) {
+    const lapse = await ctx.leaseLapsed(now);
+    if (lapse) {
+      events.emit("error", { error: goneAfter(lapse, item.id), id: item.id });
+      return;
+    }
     emitOutcomes(events, item, settled);
     return;
   }
@@ -840,6 +827,57 @@ async function deliverItem(ctx, item) {
   }
 }
 
+// src/queue/lease.ts
+function leaseOf(ctx, item) {
+  const { settings } = ctx;
+  return {
+    item,
+    done: false,
+    expiresAt: item.lease?.expiresAt ?? settings.now() + settings.leaseMs,
+    taken: false,
+    looking: Promise.resolve()
+  };
+}
+async function lookAfterRefusal(ctx, lease) {
+  const { id } = lease.item;
+  if (await ctx.store.get(id) === undefined)
+    return;
+  lease.taken = true;
+  const error = new QueueError2("LEASE_LOST", `The lease on ${id} was lost while it was delivered`);
+  ctx.events.emit("error", { error, id });
+}
+async function renew(ctx, lease) {
+  const { settings, store, events } = ctx;
+  const { id } = lease.item;
+  const next = settings.now() + settings.leaseMs;
+  let held;
+  try {
+    held = await store.renew(id, settings.owner, next);
+  } catch (error) {
+    if (!lease.done)
+      events.emit("error", { error, id });
+    return !lease.done;
+  }
+  if (held)
+    lease.expiresAt = Math.max(lease.expiresAt, next);
+  if (lease.done)
+    return false;
+  if (held)
+    return true;
+  lease.done = true;
+  lease.looking = lookAfterRefusal(ctx, lease).catch((error) => {
+    events.emit("error", { error, id });
+  });
+  return false;
+}
+async function lapsed(lease, now) {
+  await lease.looking;
+  if (lease.taken)
+    return "taken";
+  return lease.expiresAt <= now ? "expired" : undefined;
+}
+var settled = (lease) => lease.looking;
+
 // src/queue/limiter.ts
 class Limiter {
   #size;
@@ -907,42 +945,35 @@ class Worker {
     this.#slots = new Limiter(ctx.settings.concurrency);
     this.#domains = new KeyedLimiter(ctx.settings.perDomain);
   }
-  #renewing(item) {
-    const { settings, store, events } = this.#ctx;
-    let done = false;
-    const stop = () => {
-      done = true;
-      clearInterval(timer);
-    };
+  #renewing(lease) {
     const timer = setInterval(() => {
-      const expiresAt = settings.now() + settings.leaseMs;
-      store.renew(item.id, settings.owner, expiresAt).then((held) => {
-        if (held || done)
-          return;
-        stop();
-        const error = new QueueError2("LEASE_LOST", `The lease on ${item.id} was lost while it was delivered`);
-        events.emit("error", { error, id: item.id });
-      }, (error) => {
-        if (!done)
-          events.emit("error", { error, id: item.id });
+      renew(this.#ctx, lease).then((more) => {
+        if (!more)
+          clearInterval(timer);
       });
-    }, settings.leaseMs / 3);
+    }, this.#ctx.settings.leaseMs / 3);
     timer.unref?.();
-    return stop;
+    return () => {
+      lease.done = true;
+      clearInterval(timer);
+    };
   }
   async#deliver(item) {
-    const stopRenewing = this.#renewing(item);
+    const lease = leaseOf(this.#ctx, item);
+    const stop = this.#renewing(lease);
     try {
       await deliverItem({
         ...this.#ctx,
         domains: this.#domains,
         stopping: () => this.#stopping,
-        recorded: stopRenewing
+        recorded: stop,
+        leaseLapsed: (now) => lapsed(lease, now)
       }, item);
     } catch (error) {
       this.#ctx.events.emit("error", { error, id: item.id });
     } finally {
-      stopRenewing();
+      stop();
+      await settled(lease);
     }
   }
   #claim() {
@@ -1085,5 +1116,5 @@ export {
   createQueue
 };
 
-//# debugId=06C900A54468AF5364756E2164756E21
+//# debugId=FF4E5F691337408064756E2164756E21
 //# sourceMappingURL=index.js.map