@fullstackhouse/open-mercato-durable-work 0.1.0

package/src/om/progress-mirror.ts

@@ -0,0 +1,80 @@
+// One-way mirror onto core's `progress_jobs`, so the existing progress UI keeps working.
+//
+// The direction matters and is the whole design (ADR 0002): the durable job row is the
+// authority for liveness, and `progress_jobs` is presentation. Nothing here is ever read back
+// to make a decision. A progress row can lag, or be briefly wrong, without any consequence
+// beyond what a user sees for a moment.
+
+import type { DurableJob, Scope } from '../core/types'
+
+/** The subset of core's ProgressService this bridge uses. Structural rather than imported so
+ *  the package does not take a hard dependency on a service it only writes to. */
+export type ProgressServiceLike = {
+  startJob?(id: string, ctx: unknown): Promise<unknown>
+  updateProgress?(id: string, patch: Record<string, unknown>, ctx: unknown): Promise<unknown>
+  touchJobHeartbeat?(id: string, ctx: unknown): Promise<unknown>
+  completeJob?(id: string, input: Record<string, unknown>, ctx: unknown): Promise<unknown>
+  failJob?(id: string, input: Record<string, unknown>, ctx: unknown): Promise<unknown>
+  markCancelled?(id: string, ctx: unknown): Promise<unknown>
+}
+
+export type ProgressMirror = {
+  onStarted(job: DurableJob, scope: Scope): Promise<void>
+  onProgress(job: DurableJob, scope: Scope): Promise<void>
+  onTerminal(job: DurableJob, scope: Scope): Promise<void>
+}
+
+/**
+ * Every call is best-effort.
+ *
+ * A mirror that could fail a job would make the presentation layer able to stop the work,
+ * which is exactly backwards. The cost of swallowing is a stale progress card; the cost of
+ * not swallowing is a sync run failed by a UI table.
+ */
+export function createProgressMirror(progress: ProgressServiceLike): ProgressMirror {
+  const quietly = async (fn: () => Promise<unknown> | undefined) => {
+    try {
+      await fn()
+    } catch {
+      /* presentation only — never allowed to affect the job */
+    }
+  }
+
+  return {
+    async onStarted(job, scope) {
+      if (!job.progressJobId) return
+      await quietly(() => progress.startJob?.(job.progressJobId!, scope))
+    },
+    async onProgress(job, scope) {
+      if (!job.progressJobId) return
+      await quietly(() =>
+        progress.updateProgress?.(
+          job.progressJobId!,
+          {
+            processedCount: job.processedCount,
+            totalCount: job.totalCount ?? undefined,
+            // Says why a healthy job looks idle. Core's read path fails a progress row whose
+            // heartbeat is older than a minute, and a durable job waiting out a retry backoff
+            // legitimately trips that; without this the UI's only story is "it broke".
+            message: job.nextRunAt && job.nextRunAt.getTime() > Date.now() ? 'waiting for redelivery' : undefined,
+          },
+          scope,
+        ),
+      )
+    },
+    async onTerminal(job, scope) {
+      if (!job.progressJobId) return
+      if (job.status === 'completed') {
+        await quietly(() => progress.completeJob?.(job.progressJobId!, { processedCount: job.processedCount }, scope))
+        return
+      }
+      if (job.status === 'cancelled') {
+        await quietly(() => progress.markCancelled?.(job.progressJobId!, scope))
+        return
+      }
+      await quietly(() =>
+        progress.failJob?.(job.progressJobId!, { errorMessage: job.errorMessage ?? job.errorCode ?? 'failed' }, scope),
+      )
+    },
+  }
+}

package/src/om/sql-executor-mikro.ts

@@ -0,0 +1,104 @@
+// Bridges the mechanism's `SqlExecutor` onto a MikroORM EntityManager.
+//
+// The mechanism talks SQL, not ORM, because every statement it issues is a compare-and-set
+// whose predicate is the guarantee. But a host's transaction is a MikroORM one, and a job row
+// that has to commit with a domain row has to be inside it. This adapter is how both are true
+// at once: the caller keeps their EntityManager, the mechanism keeps its statements.
+
+import type { EntityManager } from '@mikro-orm/postgresql'
+
+import type { SqlExecutor, SqlTransactor } from '../core/types'
+
+type Connection = {
+  execute(sql: string, params?: unknown[], method?: 'all' | 'get' | 'run', ctx?: unknown): Promise<unknown>
+}
+
+type EntityManagerLike = EntityManager & { getTransactionContext?(): unknown }
+
+/** True when the statement returns rows the caller will read. */
+const RETURNS_ROWS = /\breturning\b|^\s*(select|with)\b/i
+
+type RunResult = { affectedRows?: number; rowCount?: number }
+
+/**
+ * Rewrites Postgres's numbered placeholders into the positional ones MikroORM binds with.
+ *
+ * The statements are written in `$n` form because that is Postgres's own, and because the
+ * failure harness runs them through node-postgres unchanged — the SQL that CI exercises is
+ * character-for-character the SQL a host runs. MikroORM goes through Knex, which binds `?`
+ * positionally, so the translation happens here rather than by writing the statements twice.
+ *
+ * A placeholder may legitimately appear more than once — the scope predicate reads `$3` twice,
+ * to compare an organization and to test it for null — so the parameter list is rebuilt in
+ * order of occurrence rather than reused as given.
+ */
+export function toPositional(text: string, params: readonly unknown[]): { text: string; params: unknown[] } {
+  const ordered: unknown[] = []
+  const rewritten = text.replace(/\$(\d+)/g, (_match, index: string) => {
+    const position = Number(index)
+    if (position < 1 || position > params.length) {
+      throw new Error(`SQL references $${position} but ${params.length} parameter(s) were supplied`)
+    }
+    ordered.push(params[position - 1])
+    return '?'
+  })
+  return { text: rewritten, params: ordered }
+}
+
+function executorFor(em: EntityManager): SqlExecutor {
+  return {
+    async query<R = Record<string, unknown>>(text: string, params: readonly unknown[] = []) {
+      const manager = em as EntityManagerLike
+      const connection = manager.getConnection() as unknown as Connection
+      const bound = toPositional(text, params)
+
+      // The transaction this EntityManager is inside, if any.
+      //
+      // Without it every statement runs on a pooled connection *outside* the transaction, and
+      // the guarantees built on top quietly stop holding: `fencedWrite` no longer rolls back a
+      // stale worker's writes, and a terminal transition no longer moves the job row and the
+      // domain row together. Nothing fails — it just is not atomic any more, which is the
+      // worst possible way for this to be wrong.
+      const ctx = manager.getTransactionContext?.()
+
+      if (RETURNS_ROWS.test(bound.text)) {
+        const rows = (await connection.execute(bound.text, bound.params, 'all', ctx)) as R[]
+        return { rows, rowCount: rows.length }
+      }
+
+      // A statement with no RETURNING has no rows to count, and counting them anyway reports
+      // zero for an UPDATE that matched. That number is not cosmetic: a domain mirror returns
+      // it as `matched`, and `matched: 0` is treated exactly like a throw — so every mirror
+      // would look like it had failed while the write it made had already landed.
+      const result = (await connection.execute(bound.text, bound.params, 'run', ctx)) as RunResult
+      return { rows: [] as R[], rowCount: result?.affectedRows ?? result?.rowCount ?? 0 }
+    },
+  }
+}
+
+/**
+ * Wraps an EntityManager as a transactor.
+ *
+ * Each transaction runs on a *forked* EntityManager. The mechanism's statements must not share
+ * an identity map or a flush cycle with whatever the caller is doing — a heartbeat that
+ * accidentally flushed a half-built domain entity would be a spectacular way to lose data.
+ */
+export function mikroExecutor(em: EntityManager): SqlTransactor {
+  const base = executorFor(em)
+  return {
+    query: base.query,
+    async transaction<T>(fn: (tx: SqlExecutor) => Promise<T>): Promise<T> {
+      const forked = em.fork()
+      // `transactional` gives the callback an EntityManager carrying the transaction context,
+      // which `executorFor` then passes to every statement. Using the outer `em` here instead
+      // would silently run them outside the transaction.
+      return forked.transactional(async (trx) => fn(executorFor(trx as EntityManager)))
+    },
+  }
+}
+
+/** Wraps an EntityManager the caller has already opened a transaction on, so the mechanism's
+ *  statements join it rather than opening a second one. */
+export function mikroTx(em: EntityManager): SqlExecutor {
+  return executorFor(em)
+}

package/src/transport/bullmq.ts

@@ -0,0 +1,213 @@
+// The BullMQ adapter: the production default wherever an Open Mercato app already runs Redis.
+//
+// `bullmq` and `ioredis` are optional peers and are imported lazily, so an app that only uses
+// the pg-boss adapter never has to install them.
+//
+// Supports BullMQ 5 and 6. Both carry everything the mechanism needs — a caller-supplied job
+// id, the three-argument processor (so a real AbortSignal), `moveToDelayed` for a hand-back
+// that spends no attempt, and job schedulers for the tick. The range matches
+// `@open-mercato/queue`'s own peer range deliberately: a host on 5 must be able to install
+// this package, because two BullMQ majors against one Redis is not a thing to arrange by
+// accident.
+
+import { deliveryId } from '../core/ids'
+import type { Delivery, RetrySettings } from '../core/types'
+import type {
+  BindOptions,
+  BoundWorker,
+  DeliveryHandler,
+  DeliveryState,
+  EnqueueOptions,
+  TransportAdapter,
+} from './types'
+
+type BullMQModule = typeof import('bullmq')
+type BullQueue = InstanceType<BullMQModule['Queue']>
+type BullJob = InstanceType<BullMQModule['Job']>
+// Structural rather than `InstanceType<Worker>`: the concrete worker type is parameterised by
+// the processor's return type and by a backend generic that differs between BullMQ 5 and 6,
+// and nothing here needs more of it than shutdown.
+type ClosableWorker = { close(force?: boolean): Promise<void>; on(event: 'error', listener: () => void): unknown }
+
+export type BullMQTransportOptions = {
+  /** An ioredis connection or the options to build one. Passed through untouched. */
+  connection: unknown
+  prefix?: string
+}
+
+let cached: BullMQModule | null = null
+async function bullmq(): Promise<BullMQModule> {
+  if (cached) return cached
+  try {
+    cached = await import('bullmq')
+    return cached
+  } catch (error) {
+    throw new Error(
+      'The bullmq transport requires the optional peer dependencies `bullmq` and `ioredis`. Install them, or use DURABLE_WORK_TRANSPORT=pgboss.',
+      { cause: error },
+    )
+  }
+}
+
+function backoffFor(retry: RetrySettings) {
+  return retry.backoff.type === 'fixed'
+    ? { type: 'fixed' as const, delay: retry.backoff.delayMs }
+    : { type: 'exponential' as const, delay: retry.backoff.delayMs }
+}
+
+export class BullMQTransport implements TransportAdapter {
+  readonly name = 'bullmq' as const
+  /** BullMQ writes to Redis, so it cannot join a Postgres transaction. Callers that need a
+   *  job row and its delivery to commit together must enqueue after commit — and accept the
+   *  gap the reconciler exists to close. */
+  readonly supportsTransactionalEnqueue = false
+
+  private readonly queues = new Map<string, BullQueue>()
+  private readonly workers: ClosableWorker[] = []
+  private readonly shutdown = new AbortController()
+
+  constructor(private readonly options: BullMQTransportOptions) {}
+
+  private async queue(name: string): Promise<BullQueue> {
+    const existing = this.queues.get(name)
+    if (existing) return existing
+    const { Queue } = await bullmq()
+    const queue = new Queue(name, { connection: this.options.connection as never, prefix: this.options.prefix })
+    this.queues.set(name, queue)
+    return queue
+  }
+
+  async enqueue(queueName: string, delivery: Delivery, opts: EnqueueOptions): Promise<{ transportJobId: string }> {
+    const queue = await this.queue(queueName)
+    const jobId = deliveryId(delivery)
+    // A caller-supplied job id makes the broker deduplicate a re-enqueue of the same delivery.
+    // It is a convenience, not the guarantee: the lease refuses a duplicate regardless, which
+    // is the version of this that survives a Redis flush.
+    await queue.add('delivery', delivery, {
+      jobId,
+      delay: opts.delayMs && opts.delayMs > 0 ? opts.delayMs : undefined,
+      attempts: opts.retry.attempts,
+      backoff: backoffFor(opts.retry),
+      removeOnComplete: { age: 3_600, count: 1_000 },
+      removeOnFail: { age: 86_400 },
+    })
+    return { transportJobId: jobId }
+  }
+
+  async remove(queueName: string, transportJobId: string): Promise<void> {
+    const queue = await this.queue(queueName)
+    // A job that is currently active cannot be removed; that is fine — the lease is what stops
+    // it, and this is only an optimisation to keep a cancelled job from being delivered.
+    await queue.remove(transportJobId).catch(() => undefined)
+  }
+
+  async getState(queueName: string, transportJobId: string): Promise<DeliveryState> {
+    const queue = await this.queue(queueName)
+    const job = await queue.getJob(transportJobId)
+    if (!job) return 'unknown'
+    const state = await job.getState()
+    switch (state) {
+      case 'waiting':
+      case 'waiting-children':
+      case 'prioritized':
+        return 'waiting'
+      case 'delayed':
+        return 'delayed'
+      case 'active':
+        return 'active'
+      case 'completed':
+        return 'completed'
+      case 'failed':
+        return 'failed'
+      default:
+        return 'unknown'
+    }
+  }
+
+  async upsertTick(opts: { id: string; queue: string; everyMs: number }): Promise<void> {
+    const queue = await this.queue(opts.queue)
+    // A job scheduler rather than a self-re-enqueueing job: the schedule lives in Redis, so it
+    // survives every worker restarting at once, and one missed tick does not end the loop.
+    await queue.upsertJobScheduler(
+      opts.id,
+      { every: opts.everyMs },
+      // Delivery-shaped like every other payload, so a bound handler never has to tell a tick
+      // from a delivery — and no adapter has to inspect a payload to decide.
+      { name: 'tick', data: { jobId: opts.id, seq: 0, redrives: 0 } },
+    )
+  }
+
+  async bind(queueName: string, handler: DeliveryHandler, opts: BindOptions): Promise<BoundWorker> {
+    const { Worker, DelayedError, UnrecoverableError } = await bullmq()
+
+    const worker = new Worker(
+      queueName,
+      async (job: BullJob, token?: string, signal?: AbortSignal) => {
+        const delivery = job.data as Delivery
+        let handedBack = false
+
+        // BullMQ's signal aborts when the job's lock is lost; ours aborts on shutdown. A slice
+        // needs to stop for either reason, so it watches both.
+        const combined = new AbortController()
+        const relay = () => combined.abort()
+        signal?.addEventListener('abort', relay, { once: true })
+        this.shutdown.signal.addEventListener('abort', relay, { once: true })
+
+        try {
+          await handler(delivery, {
+            transportJobId: job.id ?? deliveryId(delivery),
+            attempt: job.attemptsMade + 1,
+            maxAttempts: job.opts.attempts ?? 1,
+            signal: combined.signal,
+            handBack: async (next, handBackOpts) => {
+              handedBack = true
+              // Native hand-back: the job keeps its id and its attempt count, and only its
+              // payload moves on. That is what makes yielding free — a re-enqueue would
+              // start a new job, and a retry would spend an attempt.
+              await job.updateData(next as unknown as never)
+              await job.moveToDelayed(Date.now() + (handBackOpts?.delayMs ?? 0), token)
+            },
+          })
+        } catch (error) {
+          // BullMQ retries on any throw, so "there is nothing left to attempt" has to be said
+          // in its own vocabulary. Without this translation a job that has already reached a
+          // terminal state is redelivered for every remaining attempt — each one refused by
+          // the claim, each one a wasted slice and a misleading log line.
+          if ((error as { name?: string })?.name === 'NoFurtherAttempts') {
+            throw new UnrecoverableError((error as Error).message)
+          }
+          throw error
+        } finally {
+          signal?.removeEventListener('abort', relay)
+          this.shutdown.signal.removeEventListener('abort', relay)
+        }
+
+        // BullMQ requires this to propagate out of the processor for the move to take effect.
+        if (handedBack) throw new DelayedError()
+      },
+      {
+        connection: this.options.connection as never,
+        prefix: this.options.prefix,
+        concurrency: opts.concurrency,
+        // Must exceed a whole slice, or BullMQ redelivers work that is still running — which
+        // the lease then refuses, wasting the slice and inflating the stall counter.
+        lockDuration: opts.activeTimeoutMs,
+      },
+    )
+
+    // Errors here are the broker's, not a job's; swallowing them would make a broken Redis
+    // look like an idle queue.
+    worker.on('error', () => undefined)
+    this.workers.push(worker as unknown as ClosableWorker)
+    return { queue: queueName, close: async (o) => void (await worker.close(o?.timeoutMs === 0)) }
+  }
+
+  async close(opts: { timeoutMs?: number } = {}): Promise<void> {
+    // Abort first: in-flight slices see the signal and hand back at their next boundary,
+    // rather than being cut off wherever they happen to be.
+    this.shutdown.abort()
+    const deadline = new Promise<void>((resolve) => setTimeout(resolve, opts.timeoutMs ?? 30_000).unref?.())
+    await Promise.race([Promise.allSettled(this.workers.map((w) => w.close())).then(() => undefined), deadline])
+    await Promise.allSettled([...this.queues.values()].map((q) => q.close()))
+  }
+}

package/src/transport/conformance.ts

@@ -0,0 +1,218 @@
+// One suite, three adapters.
+//
+// Shipped from the package rather than written in the harness so that anyone adding a fourth
+// adapter runs exactly the checks the existing three pass. A scenario that passes on one
+// transport and not another is a bug, not a caveat — and the only way to keep that true is for
+// there to be a single definition of what passing means.
+//
+// Framework-agnostic: the caller supplies `it` and `expect`, so the same suite runs under
+// vitest here and under whatever a downstream host uses.
+
+import type { Delivery, RetrySettings } from '../core/types'
+import type { TransportAdapter } from './types'
+
+export type ConformanceHooks = {
+  it: (name: string, fn: () => Promise<void>, timeoutMs?: number) => void
+  expect: (actual: unknown) => {
+    toBe(expected: unknown): void
+    toEqual(expected: unknown): void
+    toBeGreaterThan(expected: number): void
+    toBeGreaterThanOrEqual(expected: number): void
+    toBeLessThan(expected: number): void
+  }
+  /** A fresh adapter and a queue name nothing else uses. */
+  make: () => Promise<{ transport: TransportAdapter; queue: string; close: () => Promise<void> }>
+}
+
+const RETRY: RetrySettings = { attempts: 3, backoff: { type: 'fixed', delayMs: 200, maxDelayMs: 200 } }
+const ONCE: RetrySettings = { attempts: 1, backoff: { type: 'fixed', delayMs: 0, maxDelayMs: 0 } }
+
+const delivery = (jobId: string, seq = 0, redrives = 0): Delivery => ({ jobId, seq, redrives })
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
+
+/** Waits for a condition rather than for a duration, so a slow CI runner makes the suite
+ *  slower rather than flaky. */
+async function until(predicate: () => boolean, timeoutMs = 15_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    if (predicate()) return
+    await sleep(25)
+  }
+  throw new Error('condition was never met')
+}
+
+export function transportConformance(hooks: ConformanceHooks): void {
+  const { it, expect, make } = hooks
+
+  it('delivers an enqueued job to a bound handler', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      const seen: Delivery[] = []
+      await transport.bind(queue, async (d) => void seen.push(d), { concurrency: 1, activeTimeoutMs: 30_000 })
+      await transport.enqueue(queue, delivery('job-1'), { retry: ONCE })
+      await until(() => seen.length === 1)
+      expect(seen[0]).toEqual(delivery('job-1'))
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('honours a delay before making the delivery available', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      let firstSeenAt = 0
+      const start = Date.now()
+      await transport.bind(queue, async () => void (firstSeenAt = Date.now()), { concurrency: 1, activeTimeoutMs: 30_000 })
+      await transport.enqueue(queue, delivery('job-delay'), { retry: ONCE, delayMs: 1_500 })
+      await until(() => firstSeenAt > 0)
+      expect(firstSeenAt - start).toBeGreaterThanOrEqual(1_000)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('retries a handler that throws, up to the attempt limit', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      let attempts = 0
+      await transport.bind(
+        queue,
+        async () => {
+          attempts += 1
+          throw new Error('nope')
+        },
+        { concurrency: 1, activeTimeoutMs: 30_000 },
+      )
+      await transport.enqueue(queue, delivery('job-retry'), { retry: RETRY })
+      await until(() => attempts >= 2, 20_000)
+      expect(attempts).toBeGreaterThanOrEqual(2)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('stops retrying when the handler signals there is nothing left to attempt', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      let attempts = 0
+      await transport.bind(
+        queue,
+        async () => {
+          attempts += 1
+          const error = new Error('settled')
+          error.name = 'NoFurtherAttempts'
+          throw error
+        },
+        { concurrency: 1, activeTimeoutMs: 30_000 },
+      )
+      await transport.enqueue(queue, delivery('job-final'), { retry: RETRY })
+      await until(() => attempts >= 1)
+      await sleep(1_500) // long enough for a retry to have landed if one were coming
+      expect(attempts).toBe(1)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('hands work back as a new delivery without spending an attempt', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      const seen: Delivery[] = []
+      const attemptsSeen: number[] = []
+      await transport.bind(
+        queue,
+        async (d, ctx) => {
+          seen.push(d)
+          attemptsSeen.push(ctx.attempt)
+          if (d.seq < 2) await ctx.handBack({ ...d, seq: d.seq + 1 })
+        },
+        { concurrency: 1, activeTimeoutMs: 30_000 },
+      )
+      await transport.enqueue(queue, delivery('job-yield'), { retry: RETRY })
+
+      await until(() => seen.length === 3, 20_000)
+      expect(seen.map((d) => d.seq)).toEqual([0, 1, 2])
+      // The point of a hand-back: three slices, none of them a retry.
+      expect(Math.max(...attemptsSeen)).toBe(1)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('collapses a re-enqueue of the same delivery instead of delivering it twice', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      const seen: Delivery[] = []
+      await transport.bind(queue, async (d) => void seen.push(d), { concurrency: 1, activeTimeoutMs: 30_000 })
+      const d = delivery('job-dedupe')
+      // Enqueued before binding drains it, so both land while the job is still waiting.
+      await Promise.all([
+        transport.enqueue(queue, d, { retry: ONCE, delayMs: 800 }),
+        transport.enqueue(queue, d, { retry: ONCE, delayMs: 800 }),
+      ])
+      await until(() => seen.length >= 1)
+      await sleep(1_000)
+      expect(seen.length).toBe(1)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('reports a delivery it does not hold as unknown, and removes one it does', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      expect(await transport.getState(queue, 'nothing-here')).toBe('unknown')
+      const { transportJobId } = await transport.enqueue(queue, delivery('job-remove'), { retry: ONCE, delayMs: 60_000 })
+      await transport.remove(queue, transportJobId)
+      expect(await transport.getState(queue, transportJobId)).toBe('unknown')
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('fires a tick repeatedly', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      let ticks = 0
+      await transport.bind(queue, async () => void (ticks += 1), { concurrency: 1, activeTimeoutMs: 30_000 })
+      await transport.upsertTick({ id: 'conformance-tick', queue, everyMs: 1_000 })
+      await until(() => ticks >= 2, 20_000)
+      expect(ticks).toBeGreaterThanOrEqual(2)
+    } finally {
+      await close()
+    }
+  }, 60_000)
+
+  it('aborts in-flight work on close, and returns within its timeout', async () => {
+    const { transport, queue, close } = await make()
+    try {
+      let aborted = false
+      let started = false
+      await transport.bind(
+        queue,
+        async (_d, ctx) => {
+          started = true
+          await new Promise<void>((resolve) => {
+            if (ctx.signal.aborted) return resolve()
+            ctx.signal.addEventListener('abort', () => {
+              aborted = true
+              resolve()
+            })
+            // Long enough that only the abort can end it inside the close timeout.
+            setTimeout(resolve, 60_000).unref?.()
+          })
+        },
+        { concurrency: 1, activeTimeoutMs: 120_000 },
+      )
+      await transport.enqueue(queue, delivery('job-drain'), { retry: ONCE })
+      await until(() => started)
+
+      const startedAt = Date.now()
+      await transport.close({ timeoutMs: 10_000 })
+      expect(Date.now() - startedAt).toBeLessThan(15_000)
+      expect(aborted).toBe(true)
+    } finally {
+      await close()
+    }
+  }, 90_000)
+}