@orkestrel/worker 0.0.4 → 0.0.6

package/README.md

@@ -10,8 +10,14 @@ observable (a typed `emitter` re-exposes the underlying queue's job lifecycle
 — `enqueue` / `start` / `retry` / `success` / `failure` / `abort` / `drain`).
 For CPU-parallel work, the server surface's `createNodeWorker` specializes the
 core `createWorker` over a pool of `node:worker_threads`, crossing the
-structured-clone boundary with zero `as` via `input` / `result` guards. Part
-of the `@orkestrel` line.
+structured-clone boundary with zero `as` via `input` / `result` guards. Each
+thread handler receives `{ id, signal }`: `id` is the Queue's stable idempotency
+key across retries and crash restore, while `signal` is per attempt. The wire
+protocol separately mints a fresh correlation id for each dispatch so a stale
+reply cannot settle a later retry. The stable id identifies work, not a caller,
+and is not authentication or authorization evidence; per-job consumer context
+remains explicit structured-cloneable input rather than ambient thread state.
+Part of the `@orkestrel` line.
 
 ## Install
 
@@ -21,7 +27,7 @@ npm install @orkestrel/worker
 
 ## Requirements
 
-- Node.js >= 24
+- Node.js >= 22.12.0
 - ESM and CommonJS builds ship for both the core and server entry points
 
 ## Usage
@@ -37,7 +43,7 @@ const worker = createWorker<Query, Connection, Rows>({
 })
 
 const rows = await worker.enqueue(query)
-worker.destroy() // tears down the queue, then the pool
+await worker.destroy() // awaits queue cleanup, then pool cleanup, then emitter teardown
 ```
 
 CPU-parallel jobs over `node:worker_threads`:
@@ -55,6 +61,7 @@ const worker = createNodeWorker({
 })
 
 const doubled = await worker.enqueue(21) // 42, computed on a worker thread
+await worker.destroy()
 ```
 
 ## Guide

package/dist/src/core/index.cjs

@@ -12,16 +12,23 @@ let _orkestrel_queue = require("@orkestrel/queue");
 *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the
 *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,
 *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.
-* - **Resource ↔ concurrency.** The pool's `max` defaults to the worker's
-*   `concurrency` (default `1`), so at most one resource exists per in-flight job and
-*   idle resources are reused across jobs.
+* - **Resource ↔ concurrency.** The queue strictly validates `concurrency` as a positive
+*   safe integer after caller options are captured once. Only `undefined` defaults
+*   `concurrency` to `1` or pool `max` to that value; runtime `null` reaches the owning
+*   validator. The queue validates before the pool option is read; every declared pool member
+*   is then captured once by direct access, preserving inherited and non-enumerable structural
+*   options. At most one resource exists per in-flight job by default, and idle resources are
+*   reused across jobs.
 * - **Acquire over the attempt signal.** Each job acquires using the attempt's
 *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects
 *   the acquire — the Queue then handles retry / rejection, and there is no token to
 *   release (the resource was never leased).
 * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /
 *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`
-*   read it. `destroy` destroys the queue then tears the pool down, idempotently.
+*   read it. `stop` / `abort` / `clear` return the queue's own cleanup barriers.
+*   `destroy` returns one stable barrier while it tears down the queue, then the pool,
+*   and destroys the worker emitter last. A sole cleanup failure is preserved by
+*   identity; failures from both layers become an ordered `AggregateError`.
 * - **Durability.** An optional `store` is passed straight through to the queue, so the
 *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).
 * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the
@@ -40,24 +47,30 @@ var Worker = class {
 	#pool;
 	#emitter;
 	#handler;
-	#destroyed = false;
+	#ending;
 	constructor(options) {
-		const concurrency = Math.max(1, options.concurrency ?? 1);
-		this.#handler = options.handler;
+		const { concurrency: capturedConcurrency, handler, on, error, retries, timeout, store } = options;
+		const concurrency = capturedConcurrency === void 0 ? 1 : capturedConcurrency;
+		this.#handler = handler;
 		this.#emitter = new _orkestrel_emitter.Emitter({
-			...options.on !== void 0 ? { on: options.on } : {},
-			...options.error !== void 0 ? { error: options.error } : {}
-		});
-		this.#pool = new _orkestrel_pool.Pool({
-			...options.pool,
-			max: options.pool.max ?? concurrency
+			...on !== void 0 ? { on } : {},
+			...error !== void 0 ? { error } : {}
 		});
 		this.#queue = new _orkestrel_queue.Queue({
 			handler: this.#handle.bind(this),
 			concurrency,
-			...options.retries !== void 0 ? { retries: options.retries } : {},
-			...options.timeout !== void 0 ? { timeout: options.timeout } : {},
-			...options.store !== void 0 ? { store: options.store } : {}
+			...retries !== void 0 ? { retries } : {},
+			...timeout !== void 0 ? { timeout } : {},
+			...store !== void 0 ? { store } : {}
+		});
+		const { max, on: poolOn, error: poolError, create, destroy, validate } = options.pool;
+		this.#pool = new _orkestrel_pool.Pool({
+			create,
+			max: max === void 0 ? concurrency : max,
+			...poolOn !== void 0 ? { on: poolOn } : {},
+			...poolError !== void 0 ? { error: poolError } : {},
+			...destroy !== void 0 ? { destroy } : {},
+			...validate !== void 0 ? { validate } : {}
 		});
 		this.#bridge();
 	}
@@ -86,7 +99,7 @@ var Worker = class {
 		this.#queue.start();
 	}
 	stop() {
-		this.#queue.stop();
+		return this.#queue.stop();
 	}
 	pause() {
 		this.#queue.pause();
@@ -95,16 +108,17 @@ var Worker = class {
 		this.#queue.resume();
 	}
 	abort(reason) {
-		this.#queue.abort(reason);
+		return this.#queue.abort(reason);
 	}
 	clear() {
-		this.#queue.clear();
+		return this.#queue.clear();
 	}
 	destroy() {
-		if (this.#destroyed) return;
-		this.#destroyed = true;
-		this.#queue.destroy();
-		this.#pool.destroy();
+		if (this.#ending !== void 0) return this.#ending.promise;
+		const ending = Promise.withResolvers();
+		this.#ending = ending;
+		this.#teardown(ending);
+		return ending.promise;
 	}
 	async #handle(input, execution) {
 		const token = await this.#pool.acquire(execution.signal);
@@ -114,6 +128,23 @@ var Worker = class {
 			token.release();
 		}
 	}
+	async #teardown(ending) {
+		const failures = [];
+		try {
+			await this.#queue.destroy();
+		} catch (error) {
+			failures.push(error);
+		}
+		try {
+			await this.#pool.destroy();
+		} catch (error) {
+			failures.push(error);
+		}
+		this.#emitter.destroy();
+		if (failures.length === 0) ending.resolve();
+		else if (failures.length === 1) ending.reject(failures[0]);
+		else ending.reject(new AggregateError(failures, "worker destroy cleanup failed"));
+	}
 	#bridge() {
 		const queue = this.#queue.emitter;
 		queue.on("enqueue", (id) => this.#emitter.emit("enqueue", id));
@@ -150,7 +181,7 @@ var Worker = class {
 *
 * @example
 * ```ts
-* import { createWorker } from '@src/core'
+* import { createWorker } from '@orkestrel/worker'
 *
 * const worker = createWorker<Query, Connection, Rows>({
 * 	pool: { create: () => connect(), destroy: (connection) => connection.close() },

package/dist/src/core/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["#queue","#pool","#emitter","#handler","#handle","#bridge","#destroyed"],"sources":["../../../src/core/Worker.ts","../../../src/core/factories.ts"],"sourcesContent":["import type { EmitterInterface } from '@orkestrel/emitter'\nimport type { QueueEntryOptions, QueueExecution } from '@orkestrel/queue'\nimport type { WorkerEventMap, WorkerHandler, WorkerInterface, WorkerOptions } from './types.js'\nimport { Emitter } from '@orkestrel/emitter'\nimport { Pool } from '@orkestrel/pool'\nimport { Queue } from '@orkestrel/queue'\n\n/**\n * A resource-backed job worker — a thin facade composing a `Queue` (`@orkestrel/queue`)\n * with a `Pool` (`@orkestrel/pool`).\n *\n * @remarks\n * - **Composition, not reimplementation.** The Worker owns a `Pool` (built from\n *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the\n *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,\n *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.\n * - **Resource ↔ concurrency.** The pool's `max` defaults to the worker's\n *   `concurrency` (default `1`), so at most one resource exists per in-flight job and\n *   idle resources are reused across jobs.\n * - **Acquire over the attempt signal.** Each job acquires using the attempt's\n *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects\n *   the acquire — the Queue then handles retry / rejection, and there is no token to\n *   release (the resource was never leased).\n * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /\n *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`\n *   read it. `destroy` destroys the queue then tears the pool down, idempotently.\n * - **Durability.** An optional `store` is passed straight through to the queue, so the\n *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).\n * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the\n *   underlying queue's job lifecycle (`enqueue` / `start` / `retry` / `success` / `failure` /\n *   `abort` / `drain`) as the worker's OWN events — bridged from the inner queue's emitter at\n *   construction — so a consumer observes the worker without reaching through to internals.\n *   The bridge re-emits directly on the worker's own emitter; the worker emitter isolates a\n *   listener throw and routes it to its `error` handler (the `error` option), so a buggy\n *   worker observer can never corrupt the inner queue or pool — the bridge listener never\n *   throws, so the inner queue's own emit stays balanced. The pool's create / acquire /\n *   release events stay the pool's internal concern (a Worker manages its own resources);\n *   observe a `Pool` directly for those.\n */\nexport class Worker<TInput, TResource, TResult> implements WorkerInterface<TInput, TResult> {\n\treadonly #queue: Queue<TInput, TResult>\n\treadonly #pool: Pool<TResource>\n\t// The PUSH observation surface (§13) — the worker's OWN emitter, fed by the queue→worker\n\t// bridge. The emitter isolates a worker observer's throw (routing it to the `error`\n\t// handler), so it never escapes into queue or pool.\n\treadonly #emitter: Emitter<WorkerEventMap<TResult>>\n\treadonly #handler: WorkerHandler<TInput, TResource, TResult>\n\t#destroyed = false\n\n\tconstructor(options: WorkerOptions<TInput, TResource, TResult>) {\n\t\tconst concurrency = Math.max(1, options.concurrency ?? 1)\n\t\tthis.#handler = options.handler\n\t\tthis.#emitter = new Emitter<WorkerEventMap<TResult>>({\n\t\t\t...(options.on !== undefined ? { on: options.on } : {}),\n\t\t\t...(options.error !== undefined ? { error: options.error } : {}),\n\t\t})\n\t\tthis.#pool = new Pool<TResource>({\n\t\t\t...options.pool,\n\t\t\tmax: options.pool.max ?? concurrency,\n\t\t})\n\t\tthis.#queue = new Queue<TInput, TResult>({\n\t\t\thandler: this.#handle.bind(this),\n\t\t\tconcurrency,\n\t\t\t...(options.retries !== undefined ? { retries: options.retries } : {}),\n\t\t\t...(options.timeout !== undefined ? { timeout: options.timeout } : {}),\n\t\t\t...(options.store !== undefined ? { store: options.store } : {}),\n\t\t})\n\t\tthis.#bridge()\n\t}\n\n\tget emitter(): EmitterInterface<WorkerEventMap<TResult>> {\n\t\treturn this.#emitter\n\t}\n\n\tget count(): number {\n\t\treturn this.#queue.count\n\t}\n\n\tget active(): number {\n\t\treturn this.#queue.active\n\t}\n\n\tget paused(): boolean {\n\t\treturn this.#queue.paused\n\t}\n\n\tget stopped(): boolean {\n\t\treturn this.#queue.stopped\n\t}\n\n\tenqueue(input: TInput, options?: QueueEntryOptions): Promise<TResult> {\n\t\treturn this.#queue.enqueue(input, options)\n\t}\n\n\trestore(): Promise<void> {\n\t\treturn this.#queue.restore()\n\t}\n\n\tstart(): void {\n\t\tthis.#queue.start()\n\t}\n\n\tstop(): void {\n\t\tthis.#queue.stop()\n\t}\n\n\tpause(): void {\n\t\tthis.#queue.pause()\n\t}\n\n\tresume(): void {\n\t\tthis.#queue.resume()\n\t}\n\n\tabort(reason?: unknown): void {\n\t\tthis.#queue.abort(reason)\n\t}\n\n\tclear(): void {\n\t\tthis.#queue.clear()\n\t}\n\n\tdestroy(): void {\n\t\tif (this.#destroyed) return\n\t\tthis.#destroyed = true\n\t\tthis.#queue.destroy()\n\t\tvoid this.#pool.destroy()\n\t}\n\n\tasync #handle(input: TInput, execution: QueueExecution): Promise<TResult> {\n\t\tconst token = await this.#pool.acquire(execution.signal)\n\t\ttry {\n\t\t\treturn await this.#handler(input, token.value, execution)\n\t\t} finally {\n\t\t\ttoken.release()\n\t\t}\n\t}\n\n\t// Bridge the inner queue's lifecycle onto the worker's OWN emitter, once at construction.\n\t// Each listener re-emits the queue event directly on the worker's emitter, which isolates a\n\t// worker observer's throw (routing it to the worker's `error` handler). Because the bridge\n\t// listener itself never throws, the queue's own `#emitter.emit` — which invoked this\n\t// listener — sees no throw, so the inner queue's engine stays balanced regardless of what a\n\t// worker observer does. The events are already post-transition (they fire from the queue's\n\t// own post-settle / post-wake emits), so this stays observation.\n\t#bridge(): void {\n\t\tconst queue = this.#queue.emitter\n\t\tqueue.on('enqueue', (id) => this.#emitter.emit('enqueue', id))\n\t\tqueue.on('start', (id) => this.#emitter.emit('start', id))\n\t\tqueue.on('retry', (id, attempt) => this.#emitter.emit('retry', id, attempt))\n\t\tqueue.on('success', (id, result) => this.#emitter.emit('success', id, result))\n\t\tqueue.on('failure', (id, error) => this.#emitter.emit('failure', id, error))\n\t\tqueue.on('abort', (reason) => this.#emitter.emit('abort', reason))\n\t\tqueue.on('drain', () => this.#emitter.emit('drain'))\n\t}\n}\n","import type { WorkerInterface, WorkerOptions } from './types.js'\nimport { Worker } from './Worker.js'\n\n/**\n * Create a resource-backed job worker — a `Queue` (`@orkestrel/queue`) marrying a `Pool`\n * (`@orkestrel/pool`). Each enqueued input runs through the handler against an\n * automatically acquired pooled resource (released when the job settles), with the\n * queue's bounded concurrency, retries, and per-attempt timeout / abort.\n *\n * @remarks\n * The pool's `max` defaults to `concurrency`, so resources match the jobs in flight and\n * are reused across jobs. A handler that throws still releases its resource (the\n * acquire/release pair brackets the call in a `finally`), so a later job reuses it. The\n * lifecycle (`start` / `stop` / `pause` / `resume` / `abort` / `clear` / `destroy`)\n * delegates to the queue; `destroy` also tears the pool down. Observable (§13): a typed\n * `emitter` surfaces the queue lifecycle (`enqueue` / `start` / `success` / `failure` / …).\n *\n * @typeParam TInput - The work input each job carries\n * @typeParam TResource - The pooled resource each job runs against\n * @typeParam TResult - The value the handler resolves for a job\n * @param options - The `handler` and `pool` plus optional `concurrency` (default `1`),\n *   `retries` (default `0`), and a default per-attempt `timeout` in milliseconds\n * @returns A working {@link WorkerInterface}\n *\n * @example\n * ```ts\n * import { createWorker } from '@src/core'\n *\n * const worker = createWorker<Query, Connection, Rows>({\n * \tpool: { create: () => connect(), destroy: (connection) => connection.close() },\n * \thandler: (query, connection, { signal }) => connection.run(query, signal),\n * \tconcurrency: 4,\n * \tretries: 1,\n * })\n *\n * const rows = await worker.enqueue(query)\n * ```\n */\nexport function createWorker<TInput, TResource, TResult>(\n\toptions: WorkerOptions<TInput, TResource, TResult>,\n): WorkerInterface<TInput, TResult> {\n\treturn new Worker(options)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAa,SAAb,MAA4F;CAC3F;CACA;CAIA;CACA;CACA,aAAa;CAEb,YAAY,SAAoD;EAC/D,MAAM,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,CAAC;EACxD,KAAKG,WAAW,QAAQ;EACxB,KAAKD,WAAW,IAAI,mBAAA,QAAiC;GACpD,GAAI,QAAQ,OAAO,KAAA,IAAY,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC;GACrD,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EAC/D,CAAC;EACD,KAAKD,QAAQ,IAAI,gBAAA,KAAgB;GAChC,GAAG,QAAQ;GACX,KAAK,QAAQ,KAAK,OAAO;EAC1B,CAAC;EACD,KAAKD,SAAS,IAAI,iBAAA,MAAuB;GACxC,SAAS,KAAKI,QAAQ,KAAK,IAAI;GAC/B;GACA,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;GACpE,GAAI,QAAQ,YAAY,KAAA,IAAY,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;GACpE,GAAI,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EAC/D,CAAC;EACD,KAAKC,QAAQ;CACd;CAEA,IAAI,UAAqD;EACxD,OAAO,KAAKH;CACb;CAEA,IAAI,QAAgB;EACnB,OAAO,KAAKF,OAAO;CACpB;CAEA,IAAI,SAAiB;EACpB,OAAO,KAAKA,OAAO;CACpB;CAEA,IAAI,SAAkB;EACrB,OAAO,KAAKA,OAAO;CACpB;CAEA,IAAI,UAAmB;EACtB,OAAO,KAAKA,OAAO;CACpB;CAEA,QAAQ,OAAe,SAA+C;EACrE,OAAO,KAAKA,OAAO,QAAQ,OAAO,OAAO;CAC1C;CAEA,UAAyB;EACxB,OAAO,KAAKA,OAAO,QAAQ;CAC5B;CAEA,QAAc;EACb,KAAKA,OAAO,MAAM;CACnB;CAEA,OAAa;EACZ,KAAKA,OAAO,KAAK;CAClB;CAEA,QAAc;EACb,KAAKA,OAAO,MAAM;CACnB;CAEA,SAAe;EACd,KAAKA,OAAO,OAAO;CACpB;CAEA,MAAM,QAAwB;EAC7B,KAAKA,OAAO,MAAM,MAAM;CACzB;CAEA,QAAc;EACb,KAAKA,OAAO,MAAM;CACnB;CAEA,UAAgB;EACf,IAAI,KAAKM,YAAY;EACrB,KAAKA,aAAa;EAClB,KAAKN,OAAO,QAAQ;EACpB,KAAUC,MAAM,QAAQ;CACzB;CAEA,MAAMG,QAAQ,OAAe,WAA6C;EACzE,MAAM,QAAQ,MAAM,KAAKH,MAAM,QAAQ,UAAU,MAAM;EACvD,IAAI;GACH,OAAO,MAAM,KAAKE,SAAS,OAAO,MAAM,OAAO,SAAS;EACzD,UAAU;GACT,MAAM,QAAQ;EACf;CACD;CASA,UAAgB;EACf,MAAM,QAAQ,KAAKH,OAAO;EAC1B,MAAM,GAAG,YAAY,OAAO,KAAKE,SAAS,KAAK,WAAW,EAAE,CAAC;EAC7D,MAAM,GAAG,UAAU,OAAO,KAAKA,SAAS,KAAK,SAAS,EAAE,CAAC;EACzD,MAAM,GAAG,UAAU,IAAI,YAAY,KAAKA,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC;EAC3E,MAAM,GAAG,YAAY,IAAI,WAAW,KAAKA,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC;EAC7E,MAAM,GAAG,YAAY,IAAI,UAAU,KAAKA,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC;EAC3E,MAAM,GAAG,UAAU,WAAW,KAAKA,SAAS,KAAK,SAAS,MAAM,CAAC;EACjE,MAAM,GAAG,eAAe,KAAKA,SAAS,KAAK,OAAO,CAAC;CACpD;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrHA,SAAgB,aACf,SACmC;CACnC,OAAO,IAAI,OAAO,OAAO;AAC1B"}
+{"version":3,"file":"index.cjs","names":["#queue","#pool","#emitter","#handler","#handle","#bridge","#ending","#teardown"],"sources":["../../../src/core/Worker.ts","../../../src/core/factories.ts"],"sourcesContent":["import type { EmitterInterface } from '@orkestrel/emitter'\nimport type { QueueEntryOptions, QueueExecution } from '@orkestrel/queue'\nimport type { WorkerEventMap, WorkerHandler, WorkerInterface, WorkerOptions } from './types.js'\nimport { Emitter } from '@orkestrel/emitter'\nimport { Pool } from '@orkestrel/pool'\nimport { Queue } from '@orkestrel/queue'\n\n/**\n * A resource-backed job worker — a thin facade composing a `Queue` (`@orkestrel/queue`)\n * with a `Pool` (`@orkestrel/pool`).\n *\n * @remarks\n * - **Composition, not reimplementation.** The Worker owns a `Pool` (built from\n *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the\n *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,\n *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.\n * - **Resource ↔ concurrency.** The queue strictly validates `concurrency` as a positive\n *   safe integer after caller options are captured once. Only `undefined` defaults\n *   `concurrency` to `1` or pool `max` to that value; runtime `null` reaches the owning\n *   validator. The queue validates before the pool option is read; every declared pool member\n *   is then captured once by direct access, preserving inherited and non-enumerable structural\n *   options. At most one resource exists per in-flight job by default, and idle resources are\n *   reused across jobs.\n * - **Acquire over the attempt signal.** Each job acquires using the attempt's\n *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects\n *   the acquire — the Queue then handles retry / rejection, and there is no token to\n *   release (the resource was never leased).\n * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /\n *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`\n *   read it. `stop` / `abort` / `clear` return the queue's own cleanup barriers.\n *   `destroy` returns one stable barrier while it tears down the queue, then the pool,\n *   and destroys the worker emitter last. A sole cleanup failure is preserved by\n *   identity; failures from both layers become an ordered `AggregateError`.\n * - **Durability.** An optional `store` is passed straight through to the queue, so the\n *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).\n * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the\n *   underlying queue's job lifecycle (`enqueue` / `start` / `retry` / `success` / `failure` /\n *   `abort` / `drain`) as the worker's OWN events — bridged from the inner queue's emitter at\n *   construction — so a consumer observes the worker without reaching through to internals.\n *   The bridge re-emits directly on the worker's own emitter; the worker emitter isolates a\n *   listener throw and routes it to its `error` handler (the `error` option), so a buggy\n *   worker observer can never corrupt the inner queue or pool — the bridge listener never\n *   throws, so the inner queue's own emit stays balanced. The pool's create / acquire /\n *   release events stay the pool's internal concern (a Worker manages its own resources);\n *   observe a `Pool` directly for those.\n */\nexport class Worker<TInput, TResource, TResult> implements WorkerInterface<TInput, TResult> {\n\treadonly #queue: Queue<TInput, TResult>\n\treadonly #pool: Pool<TResource>\n\t// The PUSH observation surface (§13) — the worker's OWN emitter, fed by the queue→worker\n\t// bridge. The emitter isolates a worker observer's throw (routing it to the `error`\n\t// handler), so it never escapes into queue or pool.\n\treadonly #emitter: Emitter<WorkerEventMap<TResult>>\n\treadonly #handler: WorkerHandler<TInput, TResource, TResult>\n\t#ending: PromiseWithResolvers<void> | undefined\n\n\tconstructor(options: WorkerOptions<TInput, TResource, TResult>) {\n\t\tconst {\n\t\t\tconcurrency: capturedConcurrency,\n\t\t\thandler,\n\t\t\ton,\n\t\t\terror,\n\t\t\tretries,\n\t\t\ttimeout,\n\t\t\tstore,\n\t\t} = options\n\t\tconst concurrency = capturedConcurrency === undefined ? 1 : capturedConcurrency\n\t\tthis.#handler = handler\n\t\tthis.#emitter = new Emitter<WorkerEventMap<TResult>>({\n\t\t\t...(on !== undefined ? { on } : {}),\n\t\t\t...(error !== undefined ? { error } : {}),\n\t\t})\n\t\tthis.#queue = new Queue<TInput, TResult>({\n\t\t\thandler: this.#handle.bind(this),\n\t\t\tconcurrency,\n\t\t\t...(retries !== undefined ? { retries } : {}),\n\t\t\t...(timeout !== undefined ? { timeout } : {}),\n\t\t\t...(store !== undefined ? { store } : {}),\n\t\t})\n\t\tconst pool = options.pool\n\t\tconst { max, on: poolOn, error: poolError, create, destroy, validate } = pool\n\t\tthis.#pool = new Pool<TResource>({\n\t\t\tcreate,\n\t\t\tmax: max === undefined ? concurrency : max,\n\t\t\t...(poolOn !== undefined ? { on: poolOn } : {}),\n\t\t\t...(poolError !== undefined ? { error: poolError } : {}),\n\t\t\t...(destroy !== undefined ? { destroy } : {}),\n\t\t\t...(validate !== undefined ? { validate } : {}),\n\t\t})\n\t\tthis.#bridge()\n\t}\n\n\tget emitter(): EmitterInterface<WorkerEventMap<TResult>> {\n\t\treturn this.#emitter\n\t}\n\n\tget count(): number {\n\t\treturn this.#queue.count\n\t}\n\n\tget active(): number {\n\t\treturn this.#queue.active\n\t}\n\n\tget paused(): boolean {\n\t\treturn this.#queue.paused\n\t}\n\n\tget stopped(): boolean {\n\t\treturn this.#queue.stopped\n\t}\n\n\tenqueue(input: TInput, options?: QueueEntryOptions): Promise<TResult> {\n\t\treturn this.#queue.enqueue(input, options)\n\t}\n\n\trestore(): Promise<void> {\n\t\treturn this.#queue.restore()\n\t}\n\n\tstart(): void {\n\t\tthis.#queue.start()\n\t}\n\n\tstop(): Promise<void> {\n\t\treturn this.#queue.stop()\n\t}\n\n\tpause(): void {\n\t\tthis.#queue.pause()\n\t}\n\n\tresume(): void {\n\t\tthis.#queue.resume()\n\t}\n\n\tabort(reason?: unknown): Promise<void> {\n\t\treturn this.#queue.abort(reason)\n\t}\n\n\tclear(): Promise<void> {\n\t\treturn this.#queue.clear()\n\t}\n\n\tdestroy(): Promise<void> {\n\t\tif (this.#ending !== undefined) return this.#ending.promise\n\t\tconst ending = Promise.withResolvers<void>()\n\t\tthis.#ending = ending\n\t\tvoid this.#teardown(ending)\n\t\treturn ending.promise\n\t}\n\n\tasync #handle(input: TInput, execution: QueueExecution): Promise<TResult> {\n\t\tconst token = await this.#pool.acquire(execution.signal)\n\t\ttry {\n\t\t\treturn await this.#handler(input, token.value, execution)\n\t\t} finally {\n\t\t\ttoken.release()\n\t\t}\n\t}\n\n\tasync #teardown(ending: PromiseWithResolvers<void>): Promise<void> {\n\t\tconst failures: unknown[] = []\n\t\ttry {\n\t\t\tawait this.#queue.destroy()\n\t\t} catch (error) {\n\t\t\tfailures.push(error)\n\t\t}\n\t\ttry {\n\t\t\tawait this.#pool.destroy()\n\t\t} catch (error) {\n\t\t\tfailures.push(error)\n\t\t}\n\t\tthis.#emitter.destroy()\n\t\tif (failures.length === 0) ending.resolve()\n\t\telse if (failures.length === 1) ending.reject(failures[0])\n\t\telse ending.reject(new AggregateError(failures, 'worker destroy cleanup failed'))\n\t}\n\n\t// Bridge the inner queue's lifecycle onto the worker's OWN emitter, once at construction.\n\t// Each listener re-emits the queue event directly on the worker's emitter, which isolates a\n\t// worker observer's throw (routing it to the worker's `error` handler). Because the bridge\n\t// listener itself never throws, the queue's own `#emitter.emit` — which invoked this\n\t// listener — sees no throw, so the inner queue's engine stays balanced regardless of what a\n\t// worker observer does. The events are already post-transition (they fire from the queue's\n\t// own post-settle / post-wake emits), so this stays observation.\n\t#bridge(): void {\n\t\tconst queue = this.#queue.emitter\n\t\tqueue.on('enqueue', (id) => this.#emitter.emit('enqueue', id))\n\t\tqueue.on('start', (id) => this.#emitter.emit('start', id))\n\t\tqueue.on('retry', (id, attempt) => this.#emitter.emit('retry', id, attempt))\n\t\tqueue.on('success', (id, result) => this.#emitter.emit('success', id, result))\n\t\tqueue.on('failure', (id, error) => this.#emitter.emit('failure', id, error))\n\t\tqueue.on('abort', (reason) => this.#emitter.emit('abort', reason))\n\t\tqueue.on('drain', () => this.#emitter.emit('drain'))\n\t}\n}\n","import type { WorkerInterface, WorkerOptions } from './types.js'\nimport { Worker } from './Worker.js'\n\n/**\n * Create a resource-backed job worker — a `Queue` (`@orkestrel/queue`) marrying a `Pool`\n * (`@orkestrel/pool`). Each enqueued input runs through the handler against an\n * automatically acquired pooled resource (released when the job settles), with the\n * queue's bounded concurrency, retries, and per-attempt timeout / abort.\n *\n * @remarks\n * The pool's `max` defaults to `concurrency`, so resources match the jobs in flight and\n * are reused across jobs. A handler that throws still releases its resource (the\n * acquire/release pair brackets the call in a `finally`), so a later job reuses it. The\n * lifecycle (`start` / `stop` / `pause` / `resume` / `abort` / `clear` / `destroy`)\n * delegates to the queue; `destroy` also tears the pool down. Observable (§13): a typed\n * `emitter` surfaces the queue lifecycle (`enqueue` / `start` / `success` / `failure` / …).\n *\n * @typeParam TInput - The work input each job carries\n * @typeParam TResource - The pooled resource each job runs against\n * @typeParam TResult - The value the handler resolves for a job\n * @param options - The `handler` and `pool` plus optional `concurrency` (default `1`),\n *   `retries` (default `0`), and a default per-attempt `timeout` in milliseconds\n * @returns A working {@link WorkerInterface}\n *\n * @example\n * ```ts\n * import { createWorker } from '@orkestrel/worker'\n *\n * const worker = createWorker<Query, Connection, Rows>({\n * \tpool: { create: () => connect(), destroy: (connection) => connection.close() },\n * \thandler: (query, connection, { signal }) => connection.run(query, signal),\n * \tconcurrency: 4,\n * \tretries: 1,\n * })\n *\n * const rows = await worker.enqueue(query)\n * ```\n */\nexport function createWorker<TInput, TResource, TResult>(\n\toptions: WorkerOptions<TInput, TResource, TResult>,\n): WorkerInterface<TInput, TResult> {\n\treturn new Worker(options)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,IAAa,SAAb,MAA4F;CAC3F;CACA;CAIA;CACA;CACA;CAEA,YAAY,SAAoD;EAC/D,MAAM,EACL,aAAa,qBACb,SACA,IACA,OACA,SACA,SACA,UACG;EACJ,MAAM,cAAc,wBAAwB,KAAA,IAAY,IAAI;EAC5D,KAAKG,WAAW;EAChB,KAAKD,WAAW,IAAI,mBAAA,QAAiC;GACpD,GAAI,OAAO,KAAA,IAAY,EAAE,GAAG,IAAI,CAAC;GACjC,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;EACxC,CAAC;EACD,KAAKF,SAAS,IAAI,iBAAA,MAAuB;GACxC,SAAS,KAAKI,QAAQ,KAAK,IAAI;GAC/B;GACA,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;GAC3C,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;GAC3C,GAAI,UAAU,KAAA,IAAY,EAAE,MAAM,IAAI,CAAC;EACxC,CAAC;EAED,MAAM,EAAE,KAAK,IAAI,QAAQ,OAAO,WAAW,QAAQ,SAAS,aAD/C,QAAQ;EAErB,KAAKH,QAAQ,IAAI,gBAAA,KAAgB;GAChC;GACA,KAAK,QAAQ,KAAA,IAAY,cAAc;GACvC,GAAI,WAAW,KAAA,IAAY,EAAE,IAAI,OAAO,IAAI,CAAC;GAC7C,GAAI,cAAc,KAAA,IAAY,EAAE,OAAO,UAAU,IAAI,CAAC;GACtD,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;GAC3C,GAAI,aAAa,KAAA,IAAY,EAAE,SAAS,IAAI,CAAC;EAC9C,CAAC;EACD,KAAKI,QAAQ;CACd;CAEA,IAAI,UAAqD;EACxD,OAAO,KAAKH;CACb;CAEA,IAAI,QAAgB;EACnB,OAAO,KAAKF,OAAO;CACpB;CAEA,IAAI,SAAiB;EACpB,OAAO,KAAKA,OAAO;CACpB;CAEA,IAAI,SAAkB;EACrB,OAAO,KAAKA,OAAO;CACpB;CAEA,IAAI,UAAmB;EACtB,OAAO,KAAKA,OAAO;CACpB;CAEA,QAAQ,OAAe,SAA+C;EACrE,OAAO,KAAKA,OAAO,QAAQ,OAAO,OAAO;CAC1C;CAEA,UAAyB;EACxB,OAAO,KAAKA,OAAO,QAAQ;CAC5B;CAEA,QAAc;EACb,KAAKA,OAAO,MAAM;CACnB;CAEA,OAAsB;EACrB,OAAO,KAAKA,OAAO,KAAK;CACzB;CAEA,QAAc;EACb,KAAKA,OAAO,MAAM;CACnB;CAEA,SAAe;EACd,KAAKA,OAAO,OAAO;CACpB;CAEA,MAAM,QAAiC;EACtC,OAAO,KAAKA,OAAO,MAAM,MAAM;CAChC;CAEA,QAAuB;EACtB,OAAO,KAAKA,OAAO,MAAM;CAC1B;CAEA,UAAyB;EACxB,IAAI,KAAKM,YAAY,KAAA,GAAW,OAAO,KAAKA,QAAQ;EACpD,MAAM,SAAS,QAAQ,cAAoB;EAC3C,KAAKA,UAAU;EACf,KAAUC,UAAU,MAAM;EAC1B,OAAO,OAAO;CACf;CAEA,MAAMH,QAAQ,OAAe,WAA6C;EACzE,MAAM,QAAQ,MAAM,KAAKH,MAAM,QAAQ,UAAU,MAAM;EACvD,IAAI;GACH,OAAO,MAAM,KAAKE,SAAS,OAAO,MAAM,OAAO,SAAS;EACzD,UAAU;GACT,MAAM,QAAQ;EACf;CACD;CAEA,MAAMI,UAAU,QAAmD;EAClE,MAAM,WAAsB,CAAC;EAC7B,IAAI;GACH,MAAM,KAAKP,OAAO,QAAQ;EAC3B,SAAS,OAAO;GACf,SAAS,KAAK,KAAK;EACpB;EACA,IAAI;GACH,MAAM,KAAKC,MAAM,QAAQ;EAC1B,SAAS,OAAO;GACf,SAAS,KAAK,KAAK;EACpB;EACA,KAAKC,SAAS,QAAQ;EACtB,IAAI,SAAS,WAAW,GAAG,OAAO,QAAQ;OACrC,IAAI,SAAS,WAAW,GAAG,OAAO,OAAO,SAAS,EAAE;OACpD,OAAO,OAAO,IAAI,eAAe,UAAU,+BAA+B,CAAC;CACjF;CASA,UAAgB;EACf,MAAM,QAAQ,KAAKF,OAAO;EAC1B,MAAM,GAAG,YAAY,OAAO,KAAKE,SAAS,KAAK,WAAW,EAAE,CAAC;EAC7D,MAAM,GAAG,UAAU,OAAO,KAAKA,SAAS,KAAK,SAAS,EAAE,CAAC;EACzD,MAAM,GAAG,UAAU,IAAI,YAAY,KAAKA,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC;EAC3E,MAAM,GAAG,YAAY,IAAI,WAAW,KAAKA,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC;EAC7E,MAAM,GAAG,YAAY,IAAI,UAAU,KAAKA,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC;EAC3E,MAAM,GAAG,UAAU,WAAW,KAAKA,SAAS,KAAK,SAAS,MAAM,CAAC;EACjE,MAAM,GAAG,eAAe,KAAKA,SAAS,KAAK,OAAO,CAAC;CACpD;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC9JA,SAAgB,aACf,SACmC;CACnC,OAAO,IAAI,OAAO,OAAO;AAC1B"}

package/dist/src/core/index.d.cts

@@ -29,7 +29,7 @@ import { QueueStoreInterface } from '@orkestrel/queue';
  *
  * @example
  * ```ts
- * import { createWorker } from '@src/core'
+ * import { createWorker } from '@orkestrel/worker'
  *
  * const worker = createWorker<Query, Connection, Rows>({
  * 	pool: { create: () => connect(), destroy: (connection) => connection.close() },
@@ -52,16 +52,23 @@ export declare function createWorker<TInput, TResource, TResult>(options: Worker
  *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the
  *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,
  *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.
- * - **Resource ↔ concurrency.** The pool's `max` defaults to the worker's
- *   `concurrency` (default `1`), so at most one resource exists per in-flight job and
- *   idle resources are reused across jobs.
+ * - **Resource ↔ concurrency.** The queue strictly validates `concurrency` as a positive
+ *   safe integer after caller options are captured once. Only `undefined` defaults
+ *   `concurrency` to `1` or pool `max` to that value; runtime `null` reaches the owning
+ *   validator. The queue validates before the pool option is read; every declared pool member
+ *   is then captured once by direct access, preserving inherited and non-enumerable structural
+ *   options. At most one resource exists per in-flight job by default, and idle resources are
+ *   reused across jobs.
  * - **Acquire over the attempt signal.** Each job acquires using the attempt's
  *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects
  *   the acquire — the Queue then handles retry / rejection, and there is no token to
  *   release (the resource was never leased).
  * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /
  *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`
- *   read it. `destroy` destroys the queue then tears the pool down, idempotently.
+ *   read it. `stop` / `abort` / `clear` return the queue's own cleanup barriers.
+ *   `destroy` returns one stable barrier while it tears down the queue, then the pool,
+ *   and destroys the worker emitter last. A sole cleanup failure is preserved by
+ *   identity; failures from both layers become an ordered `AggregateError`.
  * - **Durability.** An optional `store` is passed straight through to the queue, so the
  *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).
  * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the
@@ -86,12 +93,12 @@ declare class Worker_2<TInput, TResource, TResult> implements WorkerInterface<TI
     enqueue(input: TInput, options?: QueueEntryOptions): Promise<TResult>;
     restore(): Promise<void>;
     start(): void;
-    stop(): void;
+    stop(): Promise<void>;
     pause(): void;
     resume(): void;
-    abort(reason?: unknown): void;
-    clear(): void;
-    destroy(): void;
+    abort(reason?: unknown): Promise<void>;
+    clear(): Promise<void>;
+    destroy(): Promise<void>;
 }
 export { Worker_2 as Worker }
 
@@ -124,7 +131,7 @@ declare type WorkerEventMap_2<TResult> = {
     readonly success: readonly [id: string, result: TResult];
     /** A job settled with a terminal failure — its id + the error. */
     readonly failure: readonly [id: string, error: unknown];
-    /** The worker was aborted — the cancel reason. */
+    /** The worker was aborted — the queue's coded abort error retaining the caller reason. */
     readonly abort: readonly [reason: unknown];
     /** The worker went idle — no pending jobs and none in flight. */
     readonly drain: readonly [];
@@ -154,12 +161,26 @@ export declare interface WorkerInterface<TInput, TResult> {
     /** Re-enqueue outstanding entries loaded from the store; no-op without a store. */
     restore(): Promise<void>;
     start(): void;
-    stop(): void;
+    /** Stop the queue and await current-loop and durable cleanup quiescence. */
+    stop(): Promise<void>;
     pause(): void;
     resume(): void;
-    abort(reason?: unknown): void;
-    clear(): void;
-    destroy(): void;
+    /**
+     * Cancel in-flight work, reject pending work, and await queue-owned cleanup.
+     *
+     * @param reason - Optional cause retained by the queue's coded abort error
+     * @returns The underlying queue's stable abort barrier
+     */
+    abort(reason?: unknown): Promise<void>;
+    /** Drop pending work and await its durable cleanup. */
+    clear(): Promise<void>;
+    /**
+     * Tear down the queue, then the pool, and finally the worker emitter.
+     *
+     * @returns One stable barrier shared by every call; it rejects with the original sole
+     *   cleanup failure or an ordered `AggregateError` when both queue and pool fail
+     */
+    destroy(): Promise<void>;
 }
 
 /**
@@ -170,7 +191,8 @@ export declare interface WorkerInterface<TInput, TResult> {
  *   retry while attempts remain (delegated to the underlying queue).
  * - `pool` — the {@link PoolOptions} for the resource the handler runs against; its
  *   `max` defaults to `concurrency` so resources match the jobs in flight.
- * - `concurrency` — the maximum jobs in flight at once; defaults to `1`. Floored at `1`.
+ * - `concurrency` — the maximum jobs in flight at once; defaults to `1` and must be a
+ *   positive safe integer, as validated by the underlying queue.
  * - `retries` — the default extra attempts per job on failure; defaults to `0`.
  * - `timeout` — the default per-attempt deadline in milliseconds; defaults to none.
  * - `store` — durable backing; outstanding entries survive a restart; call
@@ -187,6 +209,7 @@ declare interface WorkerOptions_2<TInput, TResource, TResult> {
     readonly pool: PoolOptions<TResource>;
     readonly concurrency?: number;
     readonly retries?: number;
+    /** Integer milliseconds in `0..2_147_483_647`; `0` disables the per-attempt deadline. */
     readonly timeout?: number;
     readonly store?: QueueStoreInterface<TInput>;
 }

package/dist/src/core/index.d.ts

@@ -29,7 +29,7 @@ import { QueueStoreInterface } from '@orkestrel/queue';
  *
  * @example
  * ```ts
- * import { createWorker } from '@src/core'
+ * import { createWorker } from '@orkestrel/worker'
  *
  * const worker = createWorker<Query, Connection, Rows>({
  * 	pool: { create: () => connect(), destroy: (connection) => connection.close() },
@@ -52,16 +52,23 @@ export declare function createWorker<TInput, TResource, TResult>(options: Worker
  *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the
  *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,
  *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.
- * - **Resource ↔ concurrency.** The pool's `max` defaults to the worker's
- *   `concurrency` (default `1`), so at most one resource exists per in-flight job and
- *   idle resources are reused across jobs.
+ * - **Resource ↔ concurrency.** The queue strictly validates `concurrency` as a positive
+ *   safe integer after caller options are captured once. Only `undefined` defaults
+ *   `concurrency` to `1` or pool `max` to that value; runtime `null` reaches the owning
+ *   validator. The queue validates before the pool option is read; every declared pool member
+ *   is then captured once by direct access, preserving inherited and non-enumerable structural
+ *   options. At most one resource exists per in-flight job by default, and idle resources are
+ *   reused across jobs.
  * - **Acquire over the attempt signal.** Each job acquires using the attempt's
  *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects
  *   the acquire — the Queue then handles retry / rejection, and there is no token to
  *   release (the resource was never leased).
  * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /
  *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`
- *   read it. `destroy` destroys the queue then tears the pool down, idempotently.
+ *   read it. `stop` / `abort` / `clear` return the queue's own cleanup barriers.
+ *   `destroy` returns one stable barrier while it tears down the queue, then the pool,
+ *   and destroys the worker emitter last. A sole cleanup failure is preserved by
+ *   identity; failures from both layers become an ordered `AggregateError`.
  * - **Durability.** An optional `store` is passed straight through to the queue, so the
  *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).
  * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the
@@ -86,12 +93,12 @@ declare class Worker_2<TInput, TResource, TResult> implements WorkerInterface<TI
     enqueue(input: TInput, options?: QueueEntryOptions): Promise<TResult>;
     restore(): Promise<void>;
     start(): void;
-    stop(): void;
+    stop(): Promise<void>;
     pause(): void;
     resume(): void;
-    abort(reason?: unknown): void;
-    clear(): void;
-    destroy(): void;
+    abort(reason?: unknown): Promise<void>;
+    clear(): Promise<void>;
+    destroy(): Promise<void>;
 }
 export { Worker_2 as Worker }
 
@@ -124,7 +131,7 @@ declare type WorkerEventMap_2<TResult> = {
     readonly success: readonly [id: string, result: TResult];
     /** A job settled with a terminal failure — its id + the error. */
     readonly failure: readonly [id: string, error: unknown];
-    /** The worker was aborted — the cancel reason. */
+    /** The worker was aborted — the queue's coded abort error retaining the caller reason. */
     readonly abort: readonly [reason: unknown];
     /** The worker went idle — no pending jobs and none in flight. */
     readonly drain: readonly [];
@@ -154,12 +161,26 @@ export declare interface WorkerInterface<TInput, TResult> {
     /** Re-enqueue outstanding entries loaded from the store; no-op without a store. */
     restore(): Promise<void>;
     start(): void;
-    stop(): void;
+    /** Stop the queue and await current-loop and durable cleanup quiescence. */
+    stop(): Promise<void>;
     pause(): void;
     resume(): void;
-    abort(reason?: unknown): void;
-    clear(): void;
-    destroy(): void;
+    /**
+     * Cancel in-flight work, reject pending work, and await queue-owned cleanup.
+     *
+     * @param reason - Optional cause retained by the queue's coded abort error
+     * @returns The underlying queue's stable abort barrier
+     */
+    abort(reason?: unknown): Promise<void>;
+    /** Drop pending work and await its durable cleanup. */
+    clear(): Promise<void>;
+    /**
+     * Tear down the queue, then the pool, and finally the worker emitter.
+     *
+     * @returns One stable barrier shared by every call; it rejects with the original sole
+     *   cleanup failure or an ordered `AggregateError` when both queue and pool fail
+     */
+    destroy(): Promise<void>;
 }
 
 /**
@@ -170,7 +191,8 @@ export declare interface WorkerInterface<TInput, TResult> {
  *   retry while attempts remain (delegated to the underlying queue).
  * - `pool` — the {@link PoolOptions} for the resource the handler runs against; its
  *   `max` defaults to `concurrency` so resources match the jobs in flight.
- * - `concurrency` — the maximum jobs in flight at once; defaults to `1`. Floored at `1`.
+ * - `concurrency` — the maximum jobs in flight at once; defaults to `1` and must be a
+ *   positive safe integer, as validated by the underlying queue.
  * - `retries` — the default extra attempts per job on failure; defaults to `0`.
  * - `timeout` — the default per-attempt deadline in milliseconds; defaults to none.
  * - `store` — durable backing; outstanding entries survive a restart; call
@@ -187,6 +209,7 @@ declare interface WorkerOptions_2<TInput, TResource, TResult> {
     readonly pool: PoolOptions<TResource>;
     readonly concurrency?: number;
     readonly retries?: number;
+    /** Integer milliseconds in `0..2_147_483_647`; `0` disables the per-attempt deadline. */
     readonly timeout?: number;
     readonly store?: QueueStoreInterface<TInput>;
 }

package/dist/src/core/index.js

@@ -11,16 +11,23 @@ import { Queue } from "@orkestrel/queue";
 *   `options.pool`) and a `Queue` whose handler ACQUIRES a pooled resource, runs the
 *   user handler against it, and RELEASES it in a `finally`. All concurrency, retries,
 *   timeout, and lifecycle are the Queue's — the Worker adds only the resource pairing.
-* - **Resource ↔ concurrency.** The pool's `max` defaults to the worker's
-*   `concurrency` (default `1`), so at most one resource exists per in-flight job and
-*   idle resources are reused across jobs.
+* - **Resource ↔ concurrency.** The queue strictly validates `concurrency` as a positive
+*   safe integer after caller options are captured once. Only `undefined` defaults
+*   `concurrency` to `1` or pool `max` to that value; runtime `null` reaches the owning
+*   validator. The queue validates before the pool option is read; every declared pool member
+*   is then captured once by direct access, preserving inherited and non-enumerable structural
+*   options. At most one resource exists per in-flight job by default, and idle resources are
+*   reused across jobs.
 * - **Acquire over the attempt signal.** Each job acquires using the attempt's
 *   `execution.signal`, so an `abort` / `timeout` while waiting for a resource rejects
 *   the acquire — the Queue then handles retry / rejection, and there is no token to
 *   release (the resource was never leased).
 * - **Lifecycle (§10).** `enqueue` / `restore` / `start` / `stop` / `pause` / `resume` /
 *   `abort` / `clear` delegate to the queue; `count` / `active` / `paused` / `stopped`
-*   read it. `destroy` destroys the queue then tears the pool down, idempotently.
+*   read it. `stop` / `abort` / `clear` return the queue's own cleanup barriers.
+*   `destroy` returns one stable barrier while it tears down the queue, then the pool,
+*   and destroys the worker emitter last. A sole cleanup failure is preserved by
+*   identity; failures from both layers become an ordered `AggregateError`.
 * - **Durability.** An optional `store` is passed straight through to the queue, so the
 *   worker's outstanding jobs persist; `restore` re-runs them (delegated to the queue).
 * - **Observable (§13).** The owned {@link emitter} ({@link WorkerEventMap}) RE-EXPOSES the
@@ -39,24 +46,30 @@ var Worker = class {
 	#pool;
 	#emitter;
 	#handler;
-	#destroyed = false;
+	#ending;
 	constructor(options) {
-		const concurrency = Math.max(1, options.concurrency ?? 1);
-		this.#handler = options.handler;
+		const { concurrency: capturedConcurrency, handler, on, error, retries, timeout, store } = options;
+		const concurrency = capturedConcurrency === void 0 ? 1 : capturedConcurrency;
+		this.#handler = handler;
 		this.#emitter = new Emitter({
-			...options.on !== void 0 ? { on: options.on } : {},
-			...options.error !== void 0 ? { error: options.error } : {}
-		});
-		this.#pool = new Pool({
-			...options.pool,
-			max: options.pool.max ?? concurrency
+			...on !== void 0 ? { on } : {},
+			...error !== void 0 ? { error } : {}
 		});
 		this.#queue = new Queue({
 			handler: this.#handle.bind(this),
 			concurrency,
-			...options.retries !== void 0 ? { retries: options.retries } : {},
-			...options.timeout !== void 0 ? { timeout: options.timeout } : {},
-			...options.store !== void 0 ? { store: options.store } : {}
+			...retries !== void 0 ? { retries } : {},
+			...timeout !== void 0 ? { timeout } : {},
+			...store !== void 0 ? { store } : {}
+		});
+		const { max, on: poolOn, error: poolError, create, destroy, validate } = options.pool;
+		this.#pool = new Pool({
+			create,
+			max: max === void 0 ? concurrency : max,
+			...poolOn !== void 0 ? { on: poolOn } : {},
+			...poolError !== void 0 ? { error: poolError } : {},
+			...destroy !== void 0 ? { destroy } : {},
+			...validate !== void 0 ? { validate } : {}
 		});
 		this.#bridge();
 	}
@@ -85,7 +98,7 @@ var Worker = class {
 		this.#queue.start();
 	}
 	stop() {
-		this.#queue.stop();
+		return this.#queue.stop();
 	}
 	pause() {
 		this.#queue.pause();
@@ -94,16 +107,17 @@ var Worker = class {
 		this.#queue.resume();
 	}
 	abort(reason) {
-		this.#queue.abort(reason);
+		return this.#queue.abort(reason);
 	}
 	clear() {
-		this.#queue.clear();
+		return this.#queue.clear();
 	}
 	destroy() {
-		if (this.#destroyed) return;
-		this.#destroyed = true;
-		this.#queue.destroy();
-		this.#pool.destroy();
+		if (this.#ending !== void 0) return this.#ending.promise;
+		const ending = Promise.withResolvers();
+		this.#ending = ending;
+		this.#teardown(ending);
+		return ending.promise;
 	}
 	async #handle(input, execution) {
 		const token = await this.#pool.acquire(execution.signal);
@@ -113,6 +127,23 @@ var Worker = class {
 			token.release();
 		}
 	}
+	async #teardown(ending) {
+		const failures = [];
+		try {
+			await this.#queue.destroy();
+		} catch (error) {
+			failures.push(error);
+		}
+		try {
+			await this.#pool.destroy();
+		} catch (error) {
+			failures.push(error);
+		}
+		this.#emitter.destroy();
+		if (failures.length === 0) ending.resolve();
+		else if (failures.length === 1) ending.reject(failures[0]);
+		else ending.reject(new AggregateError(failures, "worker destroy cleanup failed"));
+	}
 	#bridge() {
 		const queue = this.#queue.emitter;
 		queue.on("enqueue", (id) => this.#emitter.emit("enqueue", id));
@@ -149,7 +180,7 @@ var Worker = class {
 *
 * @example
 * ```ts
-* import { createWorker } from '@src/core'
+* import { createWorker } from '@orkestrel/worker'
 *
 * const worker = createWorker<Query, Connection, Rows>({
 * 	pool: { create: () => connect(), destroy: (connection) => connection.close() },