@lostgradient/weft 0.23.1 → 0.24.0

package/dist/core/outbox-contract.d.ts

@@ -0,0 +1,346 @@
+/**
+ * The public input, result, option, and adapter types for the durable
+ * application delivery outbox (WFT-85).
+ *
+ * Two rules shape every signature here, as they do the mailbox's. Expected
+ * outcomes are discriminated results, never exceptions: an idempotency
+ * conflict, a full backlog, a stale attempt token, and an already-terminal
+ * delivery are ordinary control flow. Exceptions are reserved for caller
+ * mistakes (`ApplicationDeliveryValidationError`) and corrupt persisted state
+ * (`PersistedDataCorruptError`). And every read is non-consuming: `receipt`,
+ * `list`, `capacity`, and `cleanupState` never claim, start, or advance work.
+ *
+ * @module core/outbox-contract
+ */
+import type { Storage } from '../storage/interface.ts';
+import type { ApplicationEventSink } from './application-primitive-commit.ts';
+import type { JSONValue } from './json.ts';
+import type { ApplicationDeliveryClaimedPayload } from './outbox-claims.ts';
+import type { ApplicationDeliveryCausation, ApplicationDeliveryFailure, ApplicationDeliveryPayload, ApplicationDeliveryRecord, ApplicationDeliveryState, ApplicationDeliveryUnknownOutcomePolicy } from './outbox-types.ts';
+/**
+ * The transaction-composable append contract the outbox needs from a durable
+ * event feed (WFT-83). Structurally identical to the mailbox's; a real
+ * `FleetEventFeed` satisfies it as-is.
+ *
+ * @example
+ * ```ts
+ * import { MemoryStorage } from '@lostgradient/weft';
+ * import type { OutboxEventSink } from '@lostgradient/weft';
+ * import { createFleetEventFeed } from '@lostgradient/weft/server/handler';
+ *
+ * const events: OutboxEventSink = createFleetEventFeed(new MemoryStorage());
+ * void events;
+ * ```
+ */
+export type OutboxEventSink = ApplicationEventSink;
+/**
+ * What a transport adapter reports for one send.
+ *
+ * `acknowledged` means the remote system confirmed the effect; `evidence` is
+ * bounded acknowledgement evidence persisted on the terminal receipt.
+ * `retryable` means nothing was confirmed and a retry is safe. `rejected`
+ * means the remote system refused permanently. `unknown` means the adapter
+ * cannot say whether the effect happened — the outbox never retries that
+ * without the policy and evidence to do so safely.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliveryOutcome } from '@lostgradient/weft';
+ *
+ * const outcome: ApplicationDeliveryOutcome = { status: 'acknowledged', evidence: { id: 'msg-1' } };
+ * console.log(outcome.status); // 'acknowledged'
+ * ```
+ */
+export type ApplicationDeliveryOutcome = {
+    readonly status: 'acknowledged';
+    readonly evidence?: JSONValue | undefined;
+} | {
+    readonly status: 'retryable';
+    readonly message?: string | undefined;
+    readonly details?: JSONValue | undefined;
+    /** A transport-suggested delay; the outbox uses the larger of this and its own backoff. */
+    readonly retryAfterMs?: number | undefined;
+} | {
+    readonly status: 'rejected';
+    readonly message?: string | undefined;
+    readonly details?: JSONValue | undefined;
+} | {
+    readonly status: 'unknown';
+    readonly message?: string | undefined;
+};
+/**
+ * One send request handed to a transport adapter.
+ *
+ * `attemptToken` is unique per attempt: a per-attempt request id or fence the
+ * adapter may present, never a cross-attempt idempotency key — a retry mints a
+ * new one. Deduplication across attempts needs
+ * `delivery.externalIdempotencyKey`. `signal` aborts when
+ * cancellation is requested in this process, when the runner stops waiting
+ * at the attempt deadline and releases the attempt, or when the outbox is
+ * disposed. `credentialRef`
+ * is the opaque credential reference the delivery was enqueued with; only the
+ * adapter ever sees it.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliverySendRequest } from '@lostgradient/weft';
+ *
+ * declare const request: ApplicationDeliverySendRequest;
+ * console.log(request.delivery.destinationRef, request.attemptToken);
+ * ```
+ */
+export type ApplicationDeliverySendRequest = Readonly<{
+    delivery: ApplicationDeliveryReceipt;
+    payload: ApplicationDeliveryClaimedPayload;
+    credentialRef?: string | undefined;
+    attemptToken: string;
+    signal: AbortSignal;
+}>;
+/**
+ * A caller-supplied transport. Weft ships no connector; the adapter owns the
+ * wire, credential resolution, and how the attempt token reaches the remote
+ * system.
+ *
+ * Returning is transport evidence, not settlement: the outbox commits the
+ * matching durable disposition, fenced on the attempt, and only that commit
+ * moves the record. A thrown error is treated as `unknown`, because the
+ * request may already have left the process.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliveryAdapter } from '@lostgradient/weft';
+ *
+ * const adapter: ApplicationDeliveryAdapter = {
+ *   async send(request) {
+ *     void request;
+ *     return { status: 'acknowledged' };
+ *   },
+ * };
+ * console.log(typeof adapter.send); // 'function'
+ * ```
+ */
+export type ApplicationDeliveryAdapter = {
+    send(request: ApplicationDeliverySendRequest): Promise<ApplicationDeliveryOutcome>;
+};
+/**
+ * Construction options for one `(namespace, ownerId)` outbox.
+ *
+ * @example
+ * ```ts
+ * import { MemoryStorage, type OutboxOptions } from '@lostgradient/weft';
+ *
+ * const options: OutboxOptions = {
+ *   storage: new MemoryStorage(),
+ *   namespace: 'bureau',
+ *   ownerId: 'agent-7',
+ * };
+ * console.log(options.namespace); // 'bureau'
+ * ```
+ */
+export type OutboxOptions = {
+    /** Durable backend. Must report `conditionalBatch` support and snapshot scans. */
+    readonly storage: Storage;
+    /** Opaque application namespace. Weft never interprets it. */
+    readonly namespace: string;
+    /** Opaque owner identifier. One outbox per owner. */
+    readonly ownerId: string;
+    /**
+     * The transport `deliverNext()` and `drain()` run. Optional: a host that
+     * drives claims itself through `claim()`, `beginAttempt()`, and the settle
+     * methods needs none.
+     */
+    readonly adapter?: ApplicationDeliveryAdapter | undefined;
+    /** Optional durable event feed; every transition commits atomically with its event. */
+    readonly events?: OutboxEventSink | undefined;
+    /** Maximum open (non-terminal) deliveries. Enqueue past it is rejected before any write. Default 1000. */
+    readonly maxBacklog?: number | undefined;
+    /** Default lease renewal window in milliseconds. Default 30000. */
+    readonly visibilityTimeoutMs?: number | undefined;
+    /** Default ceiling on one attempt in milliseconds from its claim. Default 300000. */
+    readonly attemptTimeoutMs?: number | undefined;
+    /** Default maximum claims per delivery before dead-lettering. Default 3. */
+    readonly maxAttempts?: number | undefined;
+    /** Retry backoff base in milliseconds. Default 1000. */
+    readonly retryBackoffMs?: number | undefined;
+    /** Ceiling on retry backoff in milliseconds. Default 60000. */
+    readonly maxRetryBackoffMs?: number | undefined;
+    /** How long a terminal receipt is retained before a maintenance sweep may delete it. Default 86400000. */
+    readonly terminalRetentionMs?: number | undefined;
+    /** Maximum bytes an inline payload may encode to. Default 262144. */
+    readonly maxInlinePayloadBytes?: number | undefined;
+    /** How many delivery records one maintenance scan page reads. Default 500. */
+    readonly maintenanceBatchSize?: number | undefined;
+    /** Default disposition for a lost transport result. Default `'park'`. */
+    readonly unknownOutcomePolicy?: ApplicationDeliveryUnknownOutcomePolicy | undefined;
+    /**
+     * Whether the outbox runs its own maintenance interval. Default `'manual'`:
+     * the host calls `runMaintenance()` and nothing runs on a hidden timer. With
+     * `'automatic'` one interval runs a maintenance pass every
+     * `maintenanceIntervalMs`; `dispose()` clears it. Delivery is never driven
+     * by the interval — `deliverNext()` and `drain()` remain the host's call.
+     */
+    readonly backgroundTasks?: 'automatic' | 'manual' | undefined;
+    /** Interval between automatic maintenance passes in milliseconds. Default 1000. */
+    readonly maintenanceIntervalMs?: number | undefined;
+    /** Where an automatic maintenance pass reports a failure. Default `console.error`. */
+    readonly onMaintenanceError?: ((error: unknown) => void) | undefined;
+    /** Injected clock. Defaults to `Date.now`. */
+    readonly now?: (() => number) | undefined;
+    /** Injected identifier source, for deterministic tests. Defaults to `crypto.randomUUID`. */
+    readonly generateId?: (() => string) | undefined;
+};
+/**
+ * A delivery offered to the outbox.
+ *
+ * `deliveryId` is minted by the outbox; `idempotencyKey` is the caller's retry
+ * handle and binds to `(destinationRef, kind, payloadDigest)`.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliveryInput } from '@lostgradient/weft';
+ *
+ * const input: ApplicationDeliveryInput = {
+ *   destinationRef: 'webhook:orders',
+ *   kind: 'order.shipped',
+ *   payload: { form: 'inline', value: { orderId: 42 } },
+ *   idempotencyKey: 'order-42-shipped',
+ * };
+ * console.log(input.kind); // 'order.shipped'
+ * ```
+ */
+export type ApplicationDeliveryInput = {
+    /** Opaque destination reference. Part of the idempotency binding. */
+    readonly destinationRef: string;
+    /** Opaque credential reference. Never part of any binding, receipt, or event. */
+    readonly credentialRef?: string | undefined;
+    /** Opaque delivery kind. Part of the idempotency binding. */
+    readonly kind: string;
+    readonly payload: ApplicationDeliveryPayload;
+    readonly idempotencyKey?: string | undefined;
+    readonly payloadMediaType?: string | undefined;
+    readonly payloadSchema?: string | undefined;
+    readonly causation?: ApplicationDeliveryCausation | undefined;
+    /** Stable external idempotency evidence. Required for `retry-with-idempotency`. */
+    readonly externalIdempotencyKey?: string | undefined;
+    readonly unknownOutcomePolicy?: ApplicationDeliveryUnknownOutcomePolicy | undefined;
+    /** Delay before the delivery is due. Default 0. */
+    readonly availableAfterMs?: number | undefined;
+    readonly maxAttempts?: number | undefined;
+    readonly visibilityTimeoutMs?: number | undefined;
+    readonly attemptTimeoutMs?: number | undefined;
+};
+/**
+ * The outcome of offering a delivery.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliveryAdmission } from '@lostgradient/weft';
+ *
+ * declare const admission: ApplicationDeliveryAdmission;
+ * if (admission.status === 'enqueued') console.log(admission.receipt.deliveryId);
+ * ```
+ */
+export type ApplicationDeliveryAdmission = {
+    readonly status: 'enqueued';
+    readonly receipt: ApplicationDeliveryReceipt;
+} | {
+    readonly status: 'duplicate';
+    readonly receipt: ApplicationDeliveryReceipt;
+} | {
+    readonly status: 'conflict';
+    readonly receipt: ApplicationDeliveryReceipt;
+    readonly reason: 'idempotency-identity-mismatch';
+} | {
+    readonly status: 'rejected';
+    readonly reason: 'backlog-full';
+    readonly capacity: OutboxCapacity;
+};
+/**
+ * An immutable point-in-time view of a delivery. Safe to share across
+ * observers: reading one never claims, starts, or advances work.
+ *
+ * The attempt token and the credential reference are deliberately absent. The
+ * token is a fencing credential and the reference is a secret locator; a
+ * receipt is readable by any observer.
+ *
+ * @example
+ * ```ts
+ * import type { ApplicationDeliveryReceipt } from '@lostgradient/weft';
+ *
+ * declare const receipt: ApplicationDeliveryReceipt;
+ * console.log(receipt.state, receipt.attempt);
+ * ```
+ */
+export type ApplicationDeliveryReceipt = Readonly<{
+    deliveryId: string;
+    namespace: string;
+    ownerId: string;
+    sequence: number;
+    state: ApplicationDeliveryState;
+    destinationRef: string;
+    kind: string;
+    payloadDigest: string;
+    payloadForm: ApplicationDeliveryPayload['form'];
+    payloadMediaType?: string | undefined;
+    payloadSchema?: string | undefined;
+    idempotencyKey?: string | undefined;
+    externalIdempotencyKey?: string | undefined;
+    unknownOutcomePolicy: ApplicationDeliveryUnknownOutcomePolicy;
+    causation?: ApplicationDeliveryCausation | undefined;
+    enqueuedAt: number;
+    availableAt: number;
+    attempt: number;
+    retryCount: number;
+    maxAttempts: number;
+    generation: number;
+    claimedAt?: number | undefined;
+    visibilityExpiresAt?: number | undefined;
+    attemptDeadlineAt?: number | undefined;
+    lastActivityAt?: number | undefined;
+    transportActivity?: JSONValue | undefined;
+    attemptStartedAt?: number | undefined;
+    lastFailure?: ApplicationDeliveryFailure | undefined;
+    cancellationRequestedAt?: number | undefined;
+    cancellationReason?: string | undefined;
+    terminalAt?: number | undefined;
+    evidence?: JSONValue | undefined;
+    failure?: ApplicationDeliveryFailure | undefined;
+    /** True when the delivery terminalized while an attempt still held it and never settled. */
+    cleanupPending?: boolean | undefined;
+}>;
+/** Bounded backlog accounting. Counts only.
+ *
+ * @example
+ * ```ts
+ * import type { OutboxCapacity } from '@lostgradient/weft';
+ *
+ * declare const capacity: OutboxCapacity;
+ * console.log(capacity.open, capacity.remaining, capacity.limit);
+ * ```
+ */
+export type OutboxCapacity = Readonly<{
+    open: number;
+    limit: number;
+    remaining: number;
+    enqueued: number;
+}>;
+/** Bounded listing options. `limit` is clamped to 1000.
+ *
+ * @example
+ * ```ts
+ * import type { OutboxListOptions } from '@lostgradient/weft';
+ *
+ * const options: OutboxListOptions = { limit: 50, states: ['unknown-outcome'] };
+ * console.log(options.limit); // 50
+ * ```
+ */
+export type OutboxListOptions = {
+    readonly limit?: number | undefined;
+    readonly states?: readonly ApplicationDeliveryState[] | undefined;
+};
+export type { ApplicationDeliveryCancellationResult, ApplicationDeliveryClaim, ApplicationDeliveryClaimedPayload, ApplicationDeliveryCleanupResult, ApplicationDeliveryHeartbeatResult, ApplicationDeliveryOperatorResult, ApplicationDeliverySettleResult, OutboxClaimResult, OutboxDeliverResult, OutboxDrainReport, OutboxMaintenanceReport, OutboxWaitOptions, } from './outbox-claims.ts';
+/** Internal helper alias: the decoded record plus the exact bytes it was read as. */
+export type LoadedDeliveryRecord = {
+    readonly record: ApplicationDeliveryRecord;
+    readonly bytes: Uint8Array;
+};

package/dist/core/outbox-delivery.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Claims for the application delivery outbox (WFT-85): leasing the earliest
+ * due delivery to one attempt and handing that attempt a digest-verified
+ * payload, the credential reference, and an attempt-scoped abort signal.
+ *
+ * The due index is time-keyed, so a claim considers the earliest entries and
+ * takes the first one that is due now. A delivery in retry backoff never holds
+ * back one that is due, which is the deliberate difference from the mailbox's
+ * strict FIFO.
+ *
+ * @module core/outbox-delivery
+ */
+import type { ApplicationDeliveryClaimedPayload, OutboxClaimResult } from './outbox-contract.ts';
+import { type OutboxRuntime } from './outbox-internals.ts';
+import { type ApplicationDeliveryRecord } from './outbox-types.ts';
+/** How many due-index entries a non-mutating due-work observation looks past. */
+export declare const DUE_HEAD_LOOKAHEAD = 8;
+/**
+ * Recompute an inline payload's digest and fail closed on a mismatch. A
+ * reference payload is handed over unverified, with the stored digest.
+ *
+ * @throws {PersistedDataCorruptError} When a stored inline payload no longer
+ * matches the digest enqueue recorded for it.
+ */
+export declare function verifyClaimedPayload(runtime: OutboxRuntime, record: ApplicationDeliveryRecord): Promise<ApplicationDeliveryClaimedPayload>;
+/**
+ * Lease the earliest due delivery to one attempt.
+ *
+ * Only a lost compare-and-swap counts toward contention; housekeeping that
+ * discarded an orphaned entry is progress.
+ */
+export declare function claimNextDelivery(runtime: OutboxRuntime, options?: {
+    readonly signal?: AbortSignal | undefined;
+}): Promise<OutboxClaimResult>;

package/dist/core/outbox-delivery.js

@@ -0,0 +1,149 @@
+import { storageConditionalBatch } from "../storage/interface.js";
+import { computePayloadDigest } from "./application-payload-digest.js";
+import { raceAbort } from "./application-primitive-abort.js";
+import {
+  nextLeaseCommitSerial
+} from "./application-primitive-attempt-registry.js";
+import { requireClockInstant, requireGeneratedIdentifier } from "./outbox-guards.js";
+import {
+  commitDeliveryTransition,
+  MAX_OUTBOX_TRANSITION_ATTEMPTS,
+  OutboxContentionError,
+  toApplicationDeliveryReceipt
+} from "./outbox-internals.js";
+import { loadDelivery, loadDueHead } from "./outbox-storage.js";
+import { claimWaitingDelivery } from "./outbox-transitions.js";
+import { isApplicationDeliveryWaiting } from "./outbox-types.js";
+import { PersistedDataCorruptError } from "./persisted-data-incompatible-error.js";
+export const DUE_HEAD_LOOKAHEAD = 8;
+let localClaimSerial = 0;
+export async function verifyClaimedPayload(runtime, record) {
+  if (record.payload.form === "reference")
+    return {
+      form: "reference",
+      reference: record.payload.reference,
+      digest: record.payload.digest,
+      byteLength: record.payload.byteLength,
+      verified: !1
+    };
+  const digest = await computePayloadDigest(record.payload.value);
+  if (digest !== record.payloadDigest)
+    throw new PersistedDataCorruptError(runtime.keys.delivery(record.deliveryId));
+  return { form: "inline", value: record.payload.value, digest, verified: !0 };
+}
+function isOrphanedEntry(runtime, entry, loaded) {
+  return !isApplicationDeliveryWaiting(loaded.record) || entry.key !== runtime.keys.due(loaded.record.availableAt, loaded.record.deliveryId);
+}
+async function discardOrphanedEntry(runtime, entry, observed) {
+  return storageConditionalBatch(runtime.storage, [
+    { key: entry.key, expectedValue: entry.bytes },
+    {
+      key: runtime.keys.delivery(entry.deliveryId),
+      expectedValue: observed === null ? null : observed.bytes
+    }
+  ], [{ type: "delete", key: entry.key }]);
+}
+async function resolveDeliverableHead(runtime, now) {
+  const [entry] = await loadDueHead(runtime.storage, runtime.keys, 1);
+  if (entry === void 0)
+    return { status: "empty" };
+  const loaded = await loadDelivery(runtime.storage, runtime.keys, entry.deliveryId);
+  if (loaded === null || isOrphanedEntry(runtime, entry, loaded))
+    return { status: "retry", progressed: await discardOrphanedEntry(runtime, entry, loaded) };
+  if (now < loaded.record.availableAt)
+    return { status: "held", availableAt: loaded.record.availableAt };
+  return { status: "claimable", loaded };
+}
+function registerAttemptController(runtime, attemptToken, deliveryId) {
+  const controller = new AbortController, release = runtime.adoptAttempt(attemptToken);
+  if (release === null) {
+    controller.abort(Error("The application outbox was disposed while this claim committed."));
+    return { controller, registration: null };
+  }
+  const registration = {
+    controller,
+    release,
+    subjectId: deliveryId,
+    committedSerial: null
+  };
+  runtime.attemptControllers.set(attemptToken, registration);
+  return { controller, registration };
+}
+function releaseOwnRegistration(runtime, attemptToken, registration, reason) {
+  if (registration === null)
+    return;
+  if (runtime.attemptControllers.get(attemptToken) === registration)
+    runtime.attemptControllers.delete(attemptToken);
+  registration.release();
+  if (!registration.controller.signal.aborted)
+    registration.controller.abort(Error(reason));
+}
+export async function claimNextDelivery(runtime, options) {
+  let losses = 0;
+  while (losses < MAX_OUTBOX_TRANSITION_ATTEMPTS) {
+    options?.signal?.throwIfAborted();
+    const outcome = await attemptClaim(runtime, options?.signal);
+    if ("status" in outcome)
+      return outcome;
+    if (outcome.lost)
+      losses += 1;
+  }
+  throw new OutboxContentionError("claim", null);
+}
+async function attemptClaim(runtime, signal) {
+  const now = runtime.now(), observed = await raceAbort(() => resolveDeliverableHead(runtime, now), signal);
+  if (observed.aborted)
+    throw observed.reason;
+  signal?.throwIfAborted();
+  const head = observed.value;
+  if (head.status === "empty")
+    return { status: "empty" };
+  if (head.status === "held")
+    return { status: "held", availableAt: head.availableAt };
+  if (head.status === "retry")
+    return { lost: !head.progressed };
+  return await leaseDelivery(runtime, head.loaded, signal) ?? { lost: !0 };
+}
+async function leaseDelivery(runtime, loaded, requestSignal) {
+  const payload = await verifyClaimedPayload(runtime, loaded.record), committedAt = requireClockInstant(runtime.now());
+  requestSignal?.throwIfAborted();
+  const generated = requireGeneratedIdentifier(runtime.generateId(), "attemptToken");
+  localClaimSerial += 1;
+  const attemptToken = `${loaded.record.sequence}.${loaded.record.attempt + 1}.${localClaimSerial}.${generated}`, transition = claimWaitingDelivery(loaded.record, { now: committedAt, attemptToken });
+  if (!transition.ok)
+    return null;
+  const { controller, registration } = registerAttemptController(runtime, attemptToken, loaded.record.deliveryId);
+  let committed;
+  try {
+    committed = await commitDeliveryTransition(runtime, {
+      previous: loaded.record,
+      expectedBytes: loaded.bytes,
+      next: transition.next,
+      now: committedAt
+    });
+  } catch (error) {
+    releaseOwnRegistration(runtime, attemptToken, registration, "The claim commit failed.");
+    throw error;
+  }
+  if (!committed) {
+    releaseOwnRegistration(runtime, attemptToken, registration, "The claim lost its compare-and-swap.");
+    return null;
+  }
+  if (registration !== null)
+    registration.committedSerial = nextLeaseCommitSerial();
+  if (requestSignal?.aborted === !0 && !controller.signal.aborted)
+    controller.abort(Error("The claim request was aborted while this claim committed."));
+  return {
+    status: "claimed",
+    claim: {
+      receipt: toApplicationDeliveryReceipt(transition.next),
+      payload,
+      credentialRef: transition.next.credentialRef,
+      attemptToken,
+      attempt: transition.next.attempt,
+      visibilityExpiresAt: transition.next.visibilityExpiresAt,
+      attemptDeadlineAt: transition.next.attemptDeadlineAt,
+      signal: controller.signal
+    }
+  };
+}

package/dist/core/outbox-drain.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The bounded drain for the application delivery outbox (WFT-85): deliver
+ * everything that is due, then everything that becomes due within the budget,
+ * running a maintenance pass between rounds so lapsed leases are recovered,
+ * and report counts only.
+ *
+ * Split from `outbox-runner.ts` to keep both files under this
+ * repository's file-size ceiling.
+ *
+ * @module core/outbox-drain
+ */
+import type { OutboxDrainReport } from './outbox-contract.ts';
+import type { OutboxRuntime } from './outbox-internals.ts';
+/**
+ * Deliver everything that is due, then everything that becomes due within the
+ * budget, running a maintenance pass before the first round and whenever a
+ * round finds nothing due, so lapsed leases are recovered without rescanning
+ * the outbox before every send. Reports counts only, and `pending` from the
+ * durable header, so a forced stop never claims anything it did not commit.
+ *
+ * The budget is one stop signal for the whole drain: it ends the sleeps, the
+ * maintenance passes, and an in-flight send alike, so a drain asked to stop at
+ * a deadline stops there rather than after the current delivery.
+ */
+export declare function drainOutbox(runtime: OutboxRuntime, options: {
+    readonly timeoutMs: number;
+    readonly signal?: AbortSignal | undefined;
+    readonly pollIntervalMs?: number | undefined;
+}): Promise<OutboxDrainReport>;