@relaybus/core 0.1.0 → 0.3.0

package/dist/index.d.cts

@@ -1,8 +1,5 @@
-/** Source of the current time. Replace it in tests to control retries and leases. */
-interface Clock {
-    now(): Date;
-}
-declare const systemClock: Clock;
+import { E as EventEnvelope, D as DomainEvent, S as StandardSchemaV1, P as PayloadOf, a as EventHeaders, b as EventReference, C as Clock, c as EventClass } from './event-DCRTuYKI.cjs';
+export { d as DefineEventKeyOptions, e as DefineEventOptions, f as EventKeyFunction, g as assertEventType, h as defineEvent, s as systemClock, v as validatePayload } from './event-DCRTuYKI.cjs';
 
 /**
  * A duration in milliseconds, or a string such as `'250ms'`, `'30s'`, `'5m'`,
@@ -14,15 +11,369 @@ declare function toMilliseconds(value: Duration, name: string): number;
 /** Largest delay Node.js timers support. Longer values fire after 1ms instead. */
 declare const MAX_TIMER_DELAY_MS = 2147483647;
 
+/**
+ * How the delay between attempts is randomized.
+ * - `full`: uniform in [0, delay]. Spreads retries the most (AWS recommendation).
+ * - `equal`: uniform in [delay / 2, delay].
+ * - `none`: exactly `delay`. Synchronized retries can stampede a recovering dependency.
+ */
+type JitterStrategy = 'full' | 'equal' | 'none';
+interface RetryPolicyOptions {
+    /**
+     * Total attempts including the first one. Default 10 for handlers, which
+     * gives up after roughly 17 minutes of failures with the default delays.
+     * `Infinity` retries until the delivery succeeds.
+     */
+    readonly attempts?: number;
+    /** Delay before the second attempt. Default `'1s'`. */
+    readonly initialDelay?: Duration;
+    /** Growth factor of the delay per attempt. Default 2. */
+    readonly factor?: number;
+    /** Upper bound of a single delay. Default `'10m'`. */
+    readonly maxDelay?: Duration;
+    /** Default `'full'`. */
+    readonly jitter?: JitterStrategy;
+    /** Return false to dead-letter an error without retrying it. */
+    readonly retryIf?: (error: unknown) => boolean;
+}
+interface RetryPolicy {
+    readonly attempts: number;
+    readonly initialDelayMs: number;
+    readonly factor: number;
+    readonly maxDelayMs: number;
+    readonly jitter: JitterStrategy;
+    readonly retryIf: ((error: unknown) => boolean) | undefined;
+}
+/** Default policy of handlers. */
+declare const DEFAULT_RETRY_POLICY: RetryPolicy;
+/**
+ * Default policy of routes to transports: a broker outage must only delay
+ * events, so routes retry until the broker accepts them, at most every 5 minutes.
+ */
+declare const DEFAULT_ROUTE_RETRY_POLICY: RetryPolicy;
+declare function createRetryPolicy(options: RetryPolicyOptions | undefined, base?: RetryPolicy): RetryPolicy;
+/**
+ * Delay before the next attempt after `failedAttempts` failures (1-based):
+ * capped exponential backoff with the policy's jitter.
+ */
+declare function computeRetryDelay(policy: RetryPolicy, failedAttempts: number, random?: () => number): number;
+declare function isRetryableError(policy: RetryPolicy, error: unknown): boolean;
+
+/** Passed to every handler call. */
+interface HandlerContext<TTransaction = unknown> {
+    readonly deliveryId: string;
+    readonly handler: string;
+    /** Attempt number, starting at 1. */
+    readonly attempt: number;
+    readonly maxAttempts: number;
+    /** Aborted when the handler times out, the lease is lost or the bus stops. */
+    readonly signal: AbortSignal;
+    /**
+     * Transaction the delivery completes in, for handlers subscribed with
+     * `transactional: true`. Write through it to make the handler's effects and
+     * the completion atomic. Undefined otherwise.
+     */
+    readonly transaction: TTransaction | undefined;
+}
+type EventHandler<TPayload = unknown, TTransaction = unknown> = (event: EventEnvelope<TPayload>, context: HandlerContext<TTransaction>) => unknown;
+interface SubscribeOptions {
+    /**
+     * Stable id of the handler. Deliveries are recorded under it, so renaming it
+     * orphans pending deliveries. Letters, digits and `._:/-`.
+     */
+    readonly id: string;
+    /** Overrides the bus retry policy field by field. */
+    readonly retry?: RetryPolicyOptions;
+    /** Abort and retry when a call takes longer. `false` disables the bus default. */
+    readonly timeout?: Duration | false;
+    /** Maximum concurrent deliveries of this handler in this process. */
+    readonly concurrency?: number;
+    /**
+     * Run the handler inside a store transaction that also completes the
+     * delivery: its writes and the completion commit or roll back together,
+     * so a handler that writes only through `context.transaction` (or through
+     * events it publishes) takes effect exactly once.
+     *
+     * The lease is not renewed while the transaction is open. A transactional
+     * handler must finish within the lease duration (default 30s), or within its
+     * `timeout`, which extends the lease once to cover it; otherwise it is aborted.
+     */
+    readonly transactional?: boolean;
+}
+/** Public description of a registered handler or route. */
+interface HandlerDescriptor {
+    readonly id: string;
+    readonly eventType: string;
+    readonly retry: RetryPolicy;
+    readonly timeoutMs: number | null;
+    readonly concurrency: number | null;
+    readonly transactional: boolean;
+    /** True for routes that forward events to a transport. */
+    readonly forwardsToTransport: boolean;
+}
+
+/**
+ * An event class as a catalog stores it: any class created with `defineEvent`,
+ * whatever its payload type. Use {@link PayloadOf} to recover the payload.
+ */
+interface CatalogEventClass {
+    new (payload: never): DomainEvent;
+    readonly type: string;
+    readonly schema: StandardSchemaV1 | undefined;
+}
+/**
+ * The shape of a catalog: event classes by name. Create one with
+ * {@link defineCatalog}; the name of each entry becomes part of the handler
+ * method that consumes it (`OrderPlaced` is consumed by `onOrderPlaced`).
+ */
+interface Catalog {
+    readonly [eventName: string]: CatalogEventClass;
+}
+/** Names of the events of a catalog, as string literals. */
+type CatalogEventName<TCatalog extends Catalog> = Extract<keyof TCatalog, string>;
+/**
+ * Union of the event instances a catalog can publish, for example
+ * `OrderPlaced | OrderShipped`; with `TName`, only those of the named events.
+ */
+type CatalogEvents<TCatalog extends Catalog, TName extends keyof TCatalog = keyof TCatalog> = InstanceType<TCatalog[TName & CatalogEventName<TCatalog>]>;
+/**
+ * Envelope a handler receives for an event class:
+ * `EventOf<typeof OrderPlaced>` is `EventEnvelope<{ orderId: string }>`.
+ */
+type EventOf<TEvent> = EventEnvelope<PayloadOf<TEvent>>;
+/**
+ * Same as {@link HandlersOf} with a required list of events:
+ * `PartialHandlersOf<typeof OrderEvents, 'OrderPlaced'>` equals
+ * `HandlersOf<typeof OrderEvents, 'OrderPlaced'>`.
+ *
+ * ```ts
+ * class AuditHandlers implements PartialHandlersOf<typeof OrderEvents, 'OrderPlaced'> {
+ *   onOrderPlaced(event: EventOf<typeof OrderPlaced>) {}
+ * }
+ * ```
+ */
+type PartialHandlersOf<TCatalog extends Catalog, TName extends keyof TCatalog, TTransaction = unknown> = {
+    readonly [TKey in TName & string as `on${TKey}`]: (event: EventOf<TCatalog[TKey]>, context: HandlerContext<TTransaction>) => unknown;
+};
+/**
+ * Handler methods for the events of a catalog: one `on${EventName}` method per
+ * event, taking that event's envelope. A class that
+ * `implements HandlersOf<typeof OrderEvents>` fails to compile until it has a
+ * method with the right payload type for each event. `TName` narrows it to the
+ * events a service consumes, which is how a service handles part of a catalog
+ * shared between services:
+ *
+ * ```ts
+ * class BillingHandlers implements HandlersOf<typeof OrderEvents, 'OrderPlaced'> {
+ *   onOrderPlaced(event: EventOf<typeof OrderPlaced>) {}
+ * }
+ * ```
+ *
+ * `TTransaction` types `context.transaction` for transactional handlers.
+ */
+type HandlersOf<TCatalog extends Catalog, TName extends keyof TCatalog = keyof TCatalog, TTransaction = unknown> = PartialHandlersOf<TCatalog, TName, TTransaction>;
+/**
+ * Names of catalog events that an API call is limited to. Every name must be a
+ * key of the catalog, which the compiler checks; duplicates and an empty list
+ * are rejected at runtime with a {@link ConfigurationError}. Omitting the list
+ * means every event of the catalog.
+ */
+interface CatalogEventSelection<TName> {
+    readonly events?: readonly TName[];
+}
+/** Options of {@link defineCatalog}. */
+interface DefineCatalogOptions {
+    /**
+     * Name of the catalog, used in boot-check messages and as the default prefix
+     * of the handler ids that `subscribeCatalog` registers.
+     */
+    readonly name?: string;
+}
+/**
+ * Options of `RelayBus.subscribeCatalog`: {@link SubscribeOptions} for every
+ * handler of the catalog, and optionally the events to subscribe to. The plain
+ * `SubscribeCatalogOptions`, without a catalog, names no events, so it fits
+ * every catalog.
+ */
+type SubscribeCatalogOptions<TCatalog extends Catalog = Catalog, TName extends keyof TCatalog = string extends keyof TCatalog ? never : keyof TCatalog> = Omit<SubscribeOptions, 'id'> & CatalogEventSelection<TName> & {
+    /**
+     * Prefix of the handler ids, which become `${idPrefix}.on${EventName}`.
+     * Default: the catalog name, then the class name of the handlers object.
+     * Deliveries are recorded under these ids, so renaming them orphans pending
+     * deliveries.
+     */
+    readonly idPrefix?: string;
+};
+/** One event of a catalog together with the handler method that consumes it. */
+interface CatalogEntry {
+    /** Name under which the class was registered, for example `OrderPlaced`. */
+    readonly name: string;
+    readonly eventClass: CatalogEventClass;
+    /** Event type string, for example `order.placed.v1`. */
+    readonly type: string;
+    /** Expected handler method, for example `onOrderPlaced`. */
+    readonly handlerName: string;
+}
+/** What {@link describeCatalog} knows about a catalog. */
+interface CatalogDescription {
+    readonly name: string | undefined;
+    readonly entries: readonly CatalogEntry[];
+}
+/**
+ * Groups event classes into a catalog: the complete set of events one service
+ * or domain owns. The catalog is frozen and keeps its keys and classes in its
+ * type, which enables compile-time checks:
+ *
+ * ```ts
+ * export const OrderEvents = defineCatalog({ OrderPlaced, OrderShipped }, { name: 'OrderEvents' });
+ *
+ * class ShippingHandlers implements HandlersOf<typeof OrderEvents> {
+ *   onOrderPlaced(event: EventOf<typeof OrderPlaced>) {}
+ *   // Compile error until onOrderShipped is added.
+ * }
+ * ```
+ *
+ * Throws {@link ConfigurationError} for an empty catalog, an entry that is not
+ * an event class, a name that is not made of letters, digits and underscores,
+ * or two entries with the same event type.
+ */
+declare function defineCatalog<const TCatalog extends Catalog>(events: TCatalog, options?: DefineCatalogOptions): Readonly<TCatalog>;
+/**
+ * Describes a catalog created by {@link defineCatalog}. The description and its
+ * entries are frozen. Throws {@link ConfigurationError} for any other object,
+ * so a hand-written record cannot slip past the checks that rely on it.
+ */
+declare function describeCatalog(catalog: Catalog): CatalogDescription;
+/**
+ * The handler signature of one catalog event, written as a method so that its
+ * parameters are compared bivariantly: a handler may annotate its context as
+ * `HandlerContext<PoolClient>` and still satisfy it. {@link MatchingHandlers}
+ * restores the strict check of the event parameter.
+ */
+type BivariantHandler<TEvent> = {
+    handle(event: EventOf<TEvent>, context: HandlerContext): unknown;
+}['handle'];
+/**
+ * The shape {@link defineHandlers} constrains its handlers to: one method per
+ * selected event, with the context typed loosely enough for any transaction type.
+ */
+type HandlerShapeOf<TCatalog extends Catalog, TName extends keyof TCatalog> = {
+    readonly [TKey in TName & string as `on${TKey}`]: BivariantHandler<TCatalog[TKey]>;
+};
+/**
+ * Checks every key of `THandlers` against the selected events of a catalog:
+ * keys that are no handler of a selected event become `never`, and a handler
+ * whose event parameter does not accept the event's envelope becomes the
+ * expected signature, so the compiler reports the mismatch at that key.
+ */
+type MatchingHandlers<TCatalog extends Catalog, TName extends keyof TCatalog, THandlers> = {
+    readonly [TKey in keyof THandlers]: TKey extends `on${infer TEventName extends TName & string}` ? THandlers[TKey] extends (event: infer TEvent, ...rest: never[]) => unknown ? EventOf<TCatalog[TEventName]> extends TEvent ? THandlers[TKey] : (event: EventOf<TCatalog[TEventName]>, context: HandlerContext) => unknown : (event: EventOf<TCatalog[TEventName]>, context: HandlerContext) => unknown : never;
+};
+/**
+ * Declares the handlers of a catalog as an object: every event, or the events
+ * named in `options.events`. Compilation fails when a handler is missing,
+ * misnamed, extra (including a handler of an event that is not selected) or
+ * takes the wrong payload; the same checks run at runtime for callers without
+ * type checking. A handler may type its context with a transaction type, for
+ * example `HandlerContext<PoolClient>`.
+ *
+ * ```ts
+ * const handlers = defineHandlers(OrderEvents, {
+ *   onOrderPlaced: (event) => reserveStock(event.payload.orderId),
+ *   onOrderShipped: (event) => notify(event.payload.orderId),
+ * });
+ * bus.subscribeCatalog(OrderEvents, handlers, { idPrefix: 'fulfilment' });
+ *
+ * const billing = defineHandlers(
+ *   OrderEvents,
+ *   { onOrderPlaced: (event) => charge(event.payload.orderId) },
+ *   { events: ['OrderPlaced'] },
+ * );
+ * bus.subscribeCatalog(OrderEvents, billing, { events: ['OrderPlaced'] });
+ * ```
+ */
+declare function defineHandlers<TCatalog extends Catalog, THandlers extends HandlerShapeOf<TCatalog, TName>, const TName extends keyof TCatalog>(catalog: TCatalog, handlers: THandlers & MatchingHandlers<TCatalog, TName, THandlers>, options: {
+    readonly events: readonly TName[];
+}): THandlers;
+/** Without `events`, every handler of the catalog is required. */
+declare function defineHandlers<TCatalog extends Catalog, THandlers extends HandlerShapeOf<TCatalog, keyof TCatalog>>(catalog: TCatalog, handlers: THandlers & MatchingHandlers<TCatalog, keyof TCatalog, THandlers>, options?: {
+    readonly events?: undefined;
+}): THandlers;
+/**
+ * Maps every key of `THandlers` that is not a handler of the selected events
+ * of the catalog (default: all of them) to `never`.
+ */
+type NoExtraHandlers<TCatalog extends Catalog, THandlers, TName extends keyof TCatalog = keyof TCatalog> = {
+    readonly [TKey in Exclude<keyof THandlers, keyof HandlersOf<TCatalog, TName>>]: never;
+};
+
+/**
+ * What a service does with the events of a catalog:
+ * - `consume`: it handles them, so each needs a local handler.
+ * - `produce`: it publishes them for other services, so each needs a route to a transport.
+ */
+type CatalogRole = 'consume' | 'produce';
+/**
+ * The part of a catalog that one service consumes or produces, created with
+ * {@link consume} or {@link produce} and passed to the `catalogs` option of the
+ * bus (or `bus.registerCatalog`). `start()` then verifies the role for each
+ * declared event.
+ */
+interface CatalogDeclaration<TCatalog extends Catalog = Catalog, TName extends keyof TCatalog = keyof TCatalog> {
+    readonly catalog: TCatalog;
+    readonly role: CatalogRole;
+    /** Names of the declared events, in catalog order. */
+    readonly events: readonly Extract<TName, string>[];
+    /** The declared events with their types and handler methods, in catalog order. */
+    readonly entries: readonly CatalogEntry[];
+}
+/**
+ * Declares that this service consumes events of a catalog, typically one
+ * shared between services through a contracts package. `start()` fails unless
+ * every declared event has a local handler (`subscribeCatalog`, `subscribe`,
+ * `@RelayBusCatalogConsumer`, `@RelayBusConsumer`); a route to a transport does not count.
+ * Without `events`, every event of the catalog is declared. Unknown names do
+ * not compile and are rejected at runtime with a {@link ConfigurationError}.
+ *
+ * ```ts
+ * new RelayBus({ store, catalogs: [consume(OrderEvents, { events: ['OrderPlaced'] })] });
+ * ```
+ */
+declare function consume<TCatalog extends Catalog, const TName extends keyof TCatalog = keyof TCatalog>(catalog: TCatalog, options?: CatalogEventSelection<TName>): CatalogDeclaration<TCatalog, TName>;
+/**
+ * Declares that this service publishes events of a catalog for other services.
+ * `start()` fails unless every declared event has a route to a transport, so
+ * nothing is published without a destination; a local handler does not count.
+ * Combine it with {@link consume} for events the service also handles itself.
+ * Without `events`, every event of the catalog is declared.
+ *
+ * ```ts
+ * new RelayBus({
+ *   store,
+ *   transports: [kafka],
+ *   routes: [{ event: OrderPlaced, transport: 'kafka', destination: 'orders' }],
+ *   catalogs: [produce(OrderEvents, { events: ['OrderPlaced'] })],
+ * });
+ * ```
+ */
+declare function produce<TCatalog extends Catalog, const TName extends keyof TCatalog = keyof TCatalog>(catalog: TCatalog, options?: CatalogEventSelection<TName>): CatalogDeclaration<TCatalog, TName>;
+
 /**
  * Base class of every error thrown by relaybus.
  */
 declare class RelayBusError extends Error {
     name: string;
+    /**
+     * Stable, machine-readable identifier of the error class, such as `RELAYBUS_LEASE_LOST`.
+     * Unlike `name` and `message`, a code is never renamed once released; branch on it in
+     * alerts and dashboards. Subclasses declared outside relaybus inherit `RELAYBUS_ERROR`.
+     */
+    readonly code: string;
 }
 /** Invalid options passed to a relaybus component. */
 declare class ConfigurationError extends RelayBusError {
     name: string;
+    readonly code: string;
 }
 /**
  * Thrown by `publish` when no transaction can be found and the bus runs with
@@ -31,6 +382,16 @@ declare class ConfigurationError extends RelayBusError {
  */
 declare class TransactionRequiredError extends RelayBusError {
     name: string;
+    readonly code: string;
+}
+/**
+ * A `bus.transaction` (or `@RelayBusTransaction()` method) ran past its `transactionTimeout` and
+ * was rolled back. Its `cause` is the error the database raised when it ended the transaction,
+ * when there was one. Usually a slow call to another service made inside the transaction.
+ */
+declare class TransactionTimeoutError extends RelayBusError {
+    name: string;
+    readonly code: string;
 }
 /**
  * Throw from a handler to dead-letter the delivery immediately, skipping the
@@ -38,11 +399,13 @@ declare class TransactionRequiredError extends RelayBusError {
  */
 declare class NonRetryableError extends RelayBusError {
     name: string;
+    readonly code: string;
 }
 /** A payload failed its event schema. Never retried: the payload will not change. */
 declare class EventValidationError extends NonRetryableError {
     readonly issues: readonly ValidationIssue[];
     name: string;
+    readonly code: string;
     constructor(message: string, issues: readonly ValidationIssue[]);
 }
 /**
@@ -51,14 +414,25 @@ declare class EventValidationError extends NonRetryableError {
  */
 declare class InvalidEnvelopeError extends NonRetryableError {
     name: string;
+    readonly code: string;
 }
 /** The worker no longer owns the delivery it was processing. */
 declare class LeaseLostError extends RelayBusError {
     name: string;
+    readonly code: string;
+    /**
+     * Whether the store said so (a fenced write returned false). A worker that only noticed
+     * locally that its lease ran out may still own the delivery in the store and has to give it back.
+     */
+    readonly storeConfirmed: boolean;
+    constructor(message: string, options?: {
+        readonly storeConfirmed?: boolean;
+    });
 }
 /** A handler did not settle within its configured timeout. Retried like any failure. */
 declare class HandlerTimeoutError extends RelayBusError {
     name: string;
+    readonly code: string;
 }
 /**
  * Reason of a handler's abort signal when the bus stops before the handler
@@ -66,6 +440,25 @@ declare class HandlerTimeoutError extends RelayBusError {
  */
 declare class DispatcherStoppedError extends RelayBusError {
     name: string;
+    readonly code: string;
+}
+/**
+ * A delivery came back after its lease expired on its last attempt, so it is
+ * dead-lettered without running its handler again.
+ */
+declare class AttemptsExhaustedError extends RelayBusError {
+    name: string;
+    readonly code: string;
+}
+/** A lifecycle method was called in a state that does not allow it, such as starting a bus twice. */
+declare class LifecycleError extends RelayBusError {
+    name: string;
+    readonly code: string;
+}
+/** `drain` still found due deliveries after its maximum number of batches. */
+declare class DrainIncompleteError extends RelayBusError {
+    name: string;
+    readonly code: string;
 }
 interface ValidationIssue {
     readonly message: string;
@@ -76,110 +469,20 @@ interface ErrorInfo {
     readonly name: string;
     readonly message: string;
     readonly stack?: string | undefined;
+    /** The {@link RelayBusError.code} of a relaybus error; absent for any other error. */
+    readonly code?: string | undefined;
 }
 declare function toErrorInfo(error: unknown): ErrorInfo;
 
-/**
- * The Standard Schema interface (https://standardschema.dev), copied as the
- * specification recommends so relaybus needs no runtime dependency. Zod,
- * Valibot, ArkType and other libraries implement it.
- */
-interface StandardSchemaV1<Input = unknown, Output = Input> {
-    readonly '~standard': StandardSchemaV1.Props<Input, Output>;
-}
-declare namespace StandardSchemaV1 {
-    interface Props<Input = unknown, Output = Input> {
-        readonly version: 1;
-        readonly vendor: string;
-        readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
-        readonly types?: Types<Input, Output> | undefined;
-    }
-    type Result<Output> = SuccessResult<Output> | FailureResult;
-    interface SuccessResult<Output> {
-        readonly value: Output;
-        readonly issues?: undefined;
-    }
-    interface FailureResult {
-        readonly issues: ReadonlyArray<Issue>;
-    }
-    interface Issue {
-        readonly message: string;
-        readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
-    }
-    interface PathSegment {
-        readonly key: PropertyKey;
-    }
-    interface Types<Input = unknown, Output = Input> {
-        readonly input: Input;
-        readonly output: Output;
-    }
-    type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['input'];
-    type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['output'];
-}
-
-/** String metadata carried with an event, such as `traceparent`. */
-type EventHeaders = Readonly<Record<string, string>>;
-/**
- * An event as stored and delivered. Field names follow CloudEvents where they
- * overlap (`id`, `type`, `source`, `time` as `occurredAt`, `subject` as `key`).
- */
-interface EventEnvelope<TPayload = unknown> {
-    /** Globally unique id. Handlers and transports deduplicate on it. */
-    readonly id: string;
-    /** Event type, for example `order.created.v1`. */
-    readonly type: string;
-    /** Logical name of the publishing service. */
-    readonly source: string;
-    /** Ordering and partition key. Events sharing a key are handled in publish order. */
-    readonly key: string | null;
-    readonly payload: TPayload;
-    readonly headers: EventHeaders;
-    /** Id shared by every event of one business flow. */
-    readonly correlationId: string | null;
-    /** Id of the event whose handler published this one. */
-    readonly causationId: string | null;
-    readonly occurredAt: Date;
-}
-/** An instance of a class created with {@link defineEvent}. */
-interface DomainEvent<TPayload = unknown> {
-    readonly type: string;
-    readonly payload: TPayload;
-}
-/** A class created with {@link defineEvent}. */
-interface EventClass<TPayload = unknown> {
-    new (payload: TPayload): DomainEvent<TPayload>;
-    readonly type: string;
-    readonly schema: StandardSchemaV1<unknown, TPayload> | undefined;
-}
-/** Payload type of an event class: `PayloadOf<typeof OrderPlaced>`. */
-type PayloadOf<TEvent> = TEvent extends EventClass<infer TPayload> ? TPayload : never;
-/** Anything that names an event type: an event class or the type string itself. */
-type EventReference = {
-    readonly type: string;
-} | string;
-interface DefineEventOptions<TSchema extends StandardSchemaV1> {
-    /** Validates the payload on publish and before every handler call. */
-    readonly schema: TSchema;
-}
-declare function assertEventType(type: string): void;
-/**
- * Defines an event type. Extend the returned class to name it:
- *
- * ```ts
- * export class OrderPlaced extends defineEvent<{ orderId: string }>('order.placed.v1') {}
- * export class OrderShipped extends defineEvent('order.shipped.v1', { schema: orderShippedSchema }) {}
- * ```
- */
-declare function defineEvent<TSchema extends StandardSchemaV1>(type: string, options: DefineEventOptions<TSchema>): EventClass<StandardSchemaV1.InferOutput<TSchema>>;
-declare function defineEvent<TPayload>(type: string): EventClass<TPayload>;
-/** Runs a Standard Schema and returns its output, or throws {@link EventValidationError}. */
-declare function validatePayload<TPayload>(type: string, schema: StandardSchemaV1<unknown, TPayload> | undefined, payload: unknown): Promise<TPayload>;
-
 /**
  * Lifecycle of one handler's delivery of one event.
  * `pending` (waiting or scheduled for retry) -> `processing` (leased by a worker)
  * -> `completed` | `pending` (retry) | `dead` (exhausted or non-retryable).
  * `dead` -> `pending` only through an explicit requeue.
+ *
+ * A completed delivery is deleted. `completed` records exist only in stores
+ * configured to keep a completion history (`retainCompleted` /
+ * `completionHistory`), where they are listed, counted and purged like before.
  */
 type DeliveryStatus = 'pending' | 'processing' | 'completed' | 'dead';
 declare const DELIVERY_STATUSES: readonly DeliveryStatus[];
@@ -205,6 +508,11 @@ interface AppendResult {
  * Lease expiry is compared with the `now` the caller passes, taken from the
  * bus clock. Keep worker clocks synchronized (NTP): a skew larger than a third
  * of the lease duration lets another worker reclaim a delivery that is still running.
+ *
+ * Stores may grant the lease on a group of deliveries (a lane) instead of on
+ * each delivery. The group is exclusive to `leaseOwner` while the lease is
+ * live, so other owners do not see its pending deliveries until it expires or
+ * is relinquished; every delivery of the group carries the group's fencing token.
  */
 interface ClaimRequest {
     /** Only deliveries of these handlers are claimed. */
@@ -271,6 +579,26 @@ interface EventStoreStatistics {
     /** `availableAt` of the oldest delivery that is due but not yet processed. */
     readonly oldestDueAt: Date | null;
 }
+/** How `stop` closes a transport or a store. */
+interface CloseOptions {
+    /**
+     * Aborted when the shutdown deadline passes (`bus.stop({ timeout })`), possibly before `close` is
+     * called. From then on, close what you opened yourself at once (destroy connections, cancel
+     * running queries) instead of waiting for it to finish; the bus no longer waits for `close`.
+     * Leave alone what the application passed in.
+     */
+    readonly signal?: AbortSignal;
+}
+/** How a store runs one transaction of `bus.transaction`. */
+interface EventStoreTransactionOptions {
+    /**
+     * Time budget of the whole transaction, in milliseconds. A store makes the database enforce it
+     * where it can (for example a statement or idle-in-transaction timeout), so a transaction that
+     * waits on something slow is ended by the server and its locks are released. The bus rolls back
+     * a transaction that still ran past the budget, so a store may also ignore it.
+     */
+    readonly timeoutMs: number;
+}
 /**
  * Storage port. Implementations persist events and deliveries in the same
  * database as the application's business data so that both commit atomically.
@@ -280,8 +608,11 @@ interface EventStoreStatistics {
 interface EventStore<TTransaction = unknown> {
     /** Creates tables, collections and indexes when they do not exist. */
     setup?(): Promise<void>;
-    /** Runs `work` inside a new database transaction and commits when it resolves. */
-    transaction<T>(work: (transaction: TTransaction) => Promise<T>): Promise<T>;
+    /**
+     * Runs `work` inside a new database transaction and commits when it resolves. `options` come
+     * from `bus.transaction`; the store's own transactions and the dispatcher's pass none.
+     */
+    transaction<T>(work: (transaction: TTransaction) => Promise<T>, options?: EventStoreTransactionOptions): Promise<T>;
     /**
      * Writes events and their deliveries inside `transaction`. Idempotent on
      * event id and on (event id, handler). Assigns a per-key sequence to keyed
@@ -292,14 +623,18 @@ interface EventStore<TTransaction = unknown> {
      * Leases up to `limit` deliveries that are due: pending with `availableAt <= now`,
      * or processing with an expired lease. A keyed delivery is only claimable when
      * no earlier delivery of the same handler and key is pending or processing.
-     * Increments the attempt count. Safe to call from many processes at once.
+     * Counts the attempt (`attempt` of the result; a store may persist the count
+     * only when the attempt fails or its lease is lost). Safe to call from many
+     * processes at once.
      */
     claim(request: ClaimRequest): Promise<ClaimedDelivery[]>;
     /** Extends a lease the caller still holds. Returns false when the lease was lost. */
     extendLease(lease: LeaseReference, leaseExpiresAt: Date, now: Date): Promise<boolean>;
     /**
-     * Marks a leased delivery completed. With `transaction` the change commits
-     * together with the handler's own writes. Returns false when the lease was lost.
+     * Marks a leased delivery completed by deleting it (or moving it to the
+     * completion history, when the store keeps one). With `transaction` the change
+     * commits together with the handler's own writes. Returns false when the lease
+     * was lost.
      */
     complete(lease: LeaseReference, now: Date, transaction?: TTransaction): Promise<boolean>;
     /** Returns a leased delivery to pending, due at `availableAt`. */
@@ -309,6 +644,14 @@ interface EventStore<TTransaction = unknown> {
      * now, attempts decremented. Used when a handler is aborted at shutdown.
      */
     release(lease: LeaseReference, now: Date): Promise<boolean>;
+    /**
+     * Marks many leased deliveries completed with one round trip. Returns, for
+     * every lease in the same order, whether it was completed (false: lease lost
+     * or already finished). Each lease is fenced individually, exactly as in
+     * {@link EventStore.complete}. Optional: the dispatcher falls back to
+     * `complete` when a store does not implement it.
+     */
+    completeMany?(leases: readonly LeaseReference[], now: Date): Promise<boolean[]>;
     /** Moves a leased delivery to dead. */
     bury(lease: LeaseReference, error: ErrorInfo, now: Date): Promise<boolean>;
     listDeliveries(query: DeliveryQuery): Promise<DeliveryRecord[]>;
@@ -316,159 +659,195 @@ interface EventStore<TTransaction = unknown> {
     requeue(deliveryIds: readonly string[], now: Date): Promise<number>;
     purge(request: PurgeRequest): Promise<PurgeResult>;
     statistics(now: Date): Promise<EventStoreStatistics>;
-    /** Releases connections the store opened itself. */
-    close?(): Promise<void>;
+    /**
+     * Hands back every lease group that `leaseOwner` holds without running work,
+     * so other workers can take them at once instead of after lease expiry.
+     * Called at graceful shutdown after the owner's deliveries settled. Groups
+     * with running deliveries stay leased. Optional.
+     */
+    relinquish?(leaseOwner: string, now: Date): Promise<void>;
+    /**
+     * Calls `listener` soon after a transaction that added deliveries due at once has committed, in this
+     * process or in any other one, so an idle dispatcher claims them without waiting for its next poll.
+     * A hint, never a guarantee: a report may be late, merged with others, or lost (while a connection
+     * is re-established, for instance), and polling still finds every delivery. Resolves with a function
+     * that stops listening, or with `undefined` when this store cannot listen. Optional.
+     */
+    watchNewDeliveries?(listener: () => void): Promise<(() => Promise<void>) | undefined>;
+    /** Releases connections the store opened itself; forced once `options.signal` aborts. */
+    close?(options?: CloseOptions): Promise<void>;
 }
 
 /**
- * How the delay between attempts is randomized.
- * - `full`: uniform in [0, delay]. Spreads retries the most (AWS recommendation).
- * - `equal`: uniform in [delay / 2, delay].
- * - `none`: exactly `delay`. Synchronized retries can stampede a recovering dependency.
+ * RFC 9562 UUID version 7: 48-bit Unix millisecond timestamp followed by random
+ * bits. Time-ordered, so it keeps B-tree indexes compact, and globally unique,
+ * so it is safe as an idempotency key across services.
  */
-type JitterStrategy = 'full' | 'equal' | 'none';
-interface RetryPolicyOptions {
-    /**
-     * Total attempts including the first one. Default 10 for handlers, which
-     * gives up after roughly 17 minutes of failures with the default delays.
-     * `Infinity` retries until the delivery succeeds.
-     */
-    readonly attempts?: number;
-    /** Delay before the second attempt. Default `'1s'`. */
-    readonly initialDelay?: Duration;
-    /** Growth factor of the delay per attempt. Default 2. */
-    readonly factor?: number;
-    /** Upper bound of a single delay. Default `'10m'`. */
-    readonly maxDelay?: Duration;
-    /** Default `'full'`. */
-    readonly jitter?: JitterStrategy;
-    /** Return false to dead-letter an error without retrying it. */
-    readonly retryIf?: (error: unknown) => boolean;
-}
-interface RetryPolicy {
-    readonly attempts: number;
-    readonly initialDelayMs: number;
-    readonly factor: number;
-    readonly maxDelayMs: number;
-    readonly jitter: JitterStrategy;
-    readonly retryIf: ((error: unknown) => boolean) | undefined;
+declare function createUuidV7(timestamp?: number): string;
+/** Produces unique identifiers for events, deliveries and lease tokens. */
+type IdentifierGenerator = () => string;
+
+/** Event header that carries the W3C trace context (`version-traceid-parentid-flags`). */
+declare const TRACEPARENT_HEADER = "traceparent";
+/** Event header that carries the vendor part of the W3C trace context. */
+declare const TRACESTATE_HEADER = "tracestate";
+/** A W3C Trace Context as it travels in event headers. */
+interface TraceContext {
+    readonly traceparent: string;
+    readonly tracestate?: string;
 }
-/** Default policy of handlers. */
-declare const DEFAULT_RETRY_POLICY: RetryPolicy;
 /**
- * Default policy of routes to transports: a broker outage must only delay
- * events, so routes retry until the broker accepts them, at most every 5 minutes.
+ * The W3C trace context an event carries in its headers, or undefined when it has none or a
+ * malformed one. A handler or a consumer span continues the publisher's trace from it.
+ *
+ * ```ts
+ * bus.subscribe(OrderPlaced, (event) => startSpan({ parent: traceContextOf(event.headers) }), ...)
+ * ```
  */
-declare const DEFAULT_ROUTE_RETRY_POLICY: RetryPolicy;
-declare function createRetryPolicy(options: RetryPolicyOptions | undefined, base?: RetryPolicy): RetryPolicy;
+declare function traceContextOf(headers: EventHeaders): TraceContext | undefined;
+/** A `publish` or `publishAll` call. */
+interface PublishTraceInput {
+    /** The type of every event of the call, in order. */
+    readonly eventTypes: readonly string[];
+}
+/** A route sending one event to its transport. */
+interface SendTraceInput {
+    readonly envelope: EventEnvelope;
+    readonly transport: string;
+    /** The messaging system of the transport (`kafka`, `rabbitmq`), else its name. */
+    readonly system: string;
+    readonly destination: string;
+}
+/** A local handler running for one claimed delivery. */
+interface ProcessTraceInput {
+    readonly delivery: ClaimedDelivery;
+}
 /**
- * Delay before the next attempt after `failedAttempts` failures (1-based):
- * capped exponential backoff with the policy's jitter.
+ * Tracing hooks, for example from `@relaybus/otel`. Each one wraps an operation: it starts a span,
+ * calls `run` inside it and ends the span when the returned promise settles, passing its result or
+ * error through unchanged. relaybus itself depends on no tracing library.
  */
-declare function computeRetryDelay(policy: RetryPolicy, failedAttempts: number, random?: () => number): number;
-declare function isRetryableError(policy: RetryPolicy, error: unknown): boolean;
-
-/** Passed to every handler call. */
-interface HandlerContext<TTransaction = unknown> {
-    readonly deliveryId: string;
-    readonly handler: string;
-    /** Attempt number, starting at 1. */
-    readonly attempt: number;
-    readonly maxAttempts: number;
-    /** Aborted when the handler times out, the lease is lost or the bus stops. */
-    readonly signal: AbortSignal;
+interface RelayBusTracer {
     /**
-     * Transaction the delivery completes in, for handlers subscribed with
-     * `transactional: true`. Write through it to make the handler's effects and
-     * the completion atomic. Undefined otherwise.
+     * Wraps one publish call. `run` takes the trace headers (`traceparent`, `tracestate`) to write
+     * into every event of the call, so its consumers continue the trace; headers passed to
+     * `publish` explicitly win.
      */
-    readonly transaction: TTransaction | undefined;
-}
-type EventHandler<TPayload = unknown, TTransaction = unknown> = (event: EventEnvelope<TPayload>, context: HandlerContext<TTransaction>) => unknown;
-interface SubscribeOptions {
+    publish?<T>(input: PublishTraceInput, run: (headers: EventHeaders) => Promise<T>): Promise<T>;
     /**
-     * Stable id of the handler. Deliveries are recorded under it, so renaming it
-     * orphans pending deliveries. Letters, digits and `._:/-`.
+     * Wraps one send of a route. `run` takes the trace headers to send the event with, in place of
+     * the ones it was stored with, so the consumer's trace continues from this send.
      */
-    readonly id: string;
-    /** Overrides the bus retry policy field by field. */
-    readonly retry?: RetryPolicyOptions;
-    /** Abort and retry when a call takes longer. `false` disables the bus default. */
-    readonly timeout?: Duration | false;
-    /** Maximum concurrent deliveries of this handler in this process. */
-    readonly concurrency?: number;
+    send?<T>(input: SendTraceInput, run: (headers: EventHeaders) => Promise<T>): Promise<T>;
     /**
-     * Run the handler inside a store transaction that also completes the
-     * delivery: its writes and the completion commit or roll back together,
-     * so a handler that writes only through `context.transaction` (or through
-     * events it publishes) takes effect exactly once.
-     *
-     * The lease is not renewed while the transaction is open. A transactional
-     * handler must finish within the lease duration (default 30s), or within its
-     * `timeout`, which extends the lease once to cover it; otherwise it is aborted.
+     * Wraps one run of a local handler; the handler runs inside `run`, so what it publishes or calls
+     * joins the span. The event's own trace context is in `traceContextOf(delivery.event.headers)`.
      */
-    readonly transactional?: boolean;
-}
-/** Public description of a registered handler or route. */
-interface HandlerDescriptor {
-    readonly id: string;
-    readonly eventType: string;
-    readonly retry: RetryPolicy;
-    readonly timeoutMs: number | null;
-    readonly concurrency: number | null;
-    readonly transactional: boolean;
-    /** True for routes that forward events to a transport. */
-    readonly forwardsToTransport: boolean;
+    process?<T>(input: ProcessTraceInput, run: () => Promise<T>): Promise<T>;
 }
 
+type FailureStage = 'claim' | 'dispatch' | 'complete' | 'reschedule' | 'bury' | 'release' | 'relinquish' | 'extend-lease' | 'purge' | 'watch' | 'backlog' | 'observer';
+/** How a timed operation ended. On `error` the event carries the error. */
+type OperationOutcome = 'success' | 'error';
+/** Whether a delivery runs a local handler or forwards its event to a transport (a route). */
+type DeliveryKind = 'handler' | 'route';
+/** A `publish` or `publishAll` call returned or threw. */
+interface PublishFinishedEvent {
+    /** The type of every event of the call, in order. */
+    readonly eventTypes: readonly string[];
+    readonly durationMs: number;
+    readonly outcome: OperationOutcome;
+    readonly error?: ErrorInfo;
+}
+/** One claim query of the dispatcher answered or failed. */
+interface ClaimFinishedEvent {
+    /** Handler ids the claim asked for. */
+    readonly handlers: readonly string[];
+    /** Most deliveries the claim asked for (the batch size of this query). */
+    readonly requested: number;
+    readonly claimed: number;
+    /** Distinct leases among the claimed deliveries: a store that leases lanes counts each lane once. */
+    readonly lanes: number;
+    readonly durationMs: number;
+    readonly outcome: OperationOutcome;
+    readonly error?: ErrorInfo;
+}
+/** A handler (or a route's send) is about to run for a claimed delivery. */
+interface HandlerStartedEvent {
+    readonly delivery: ClaimedDelivery;
+    readonly kind: DeliveryKind;
+    /** From the event's `occurredAt` to this start, across services for a received event. */
+    readonly endToEndLatencyMs: number;
+}
 /**
- * RFC 9562 UUID version 7: 48-bit Unix millisecond timestamp followed by random
- * bits. Time-ordered, so it keeps B-tree indexes compact, and globally unique,
- * so it is safe as an idempotency key across services.
+ * A handler run ended: it resolved (`success`) or threw, timed out, lost its lease or was
+ * stopped (`error`). What happens to the delivery next is reported by the delivery hooks.
  */
-declare function createUuidV7(timestamp?: number): string;
-/** Produces unique identifiers for events, deliveries and lease tokens. */
-type IdentifierGenerator = () => string;
-
-interface InMemoryEventStoreOptions {
-    /** Allow use when `NODE_ENV` is `production`. Data is lost on restart. Default false. */
-    readonly allowInProduction?: boolean;
-    readonly generateIdentifier?: IdentifierGenerator;
+interface HandlerFinishedEvent {
+    readonly delivery: ClaimedDelivery;
+    readonly kind: DeliveryKind;
+    readonly durationMs: number;
+    readonly outcome: OperationOutcome;
+    readonly error?: ErrorInfo;
 }
-/** Transaction handle of {@link InMemoryEventStore}. Writes apply on commit only. */
-declare class InMemoryTransaction {
-    #private;
-    get state(): 'open' | 'committed' | 'rolled-back';
-    enqueue(operation: () => void): void;
-    /** Runs `finisher` once the transaction commits or rolls back, like a lock release. */
-    onFinish(finisher: () => void): void;
-    commit(): void;
-    rollback(): void;
+/** A route handed an event to its transport, which acknowledged it or failed. */
+interface TransportSentEvent {
+    readonly envelope: EventEnvelope;
+    /** Name of the transport. */
+    readonly transport: string;
+    /** The messaging system of the transport (`kafka`, `rabbitmq`), else its name. */
+    readonly system: string;
+    readonly destination: string;
+    readonly durationMs: number;
+    readonly outcome: OperationOutcome;
+    readonly error?: ErrorInfo;
 }
 /**
- * Event store kept in process memory, with the same semantics as the database
- * stores: transactional appends, leases, fencing and per-key ordering. Payloads
- * are round-tripped through JSON exactly like a database would store them.
- * Meant for tests and local development.
+ * What `receive` did with an event from a broker: stored it (`accepted`), found it stored already
+ * (`duplicate`), had no handler for it (`ignored`), rejected it as malformed (`invalid`) or failed
+ * (`error`, the broker redelivers it).
  */
-declare class InMemoryEventStore implements EventStore<InMemoryTransaction> {
-    #private;
-    constructor(options?: InMemoryEventStoreOptions);
-    transaction<T>(work: (transaction: InMemoryTransaction) => Promise<T>): Promise<T>;
-    append(transaction: InMemoryTransaction, entries: readonly AppendEntry[], now: Date): Promise<AppendResult>;
-    claim(request: ClaimRequest): Promise<ClaimedDelivery[]>;
-    extendLease(lease: LeaseReference, leaseExpiresAt: Date, now: Date): Promise<boolean>;
-    complete(lease: LeaseReference, now: Date, transaction?: InMemoryTransaction): Promise<boolean>;
-    reschedule(lease: LeaseReference, availableAt: Date, error: ErrorInfo, now: Date): Promise<boolean>;
-    release(lease: LeaseReference, now: Date): Promise<boolean>;
-    bury(lease: LeaseReference, error: ErrorInfo, now: Date): Promise<boolean>;
-    listDeliveries(query: DeliveryQuery): Promise<DeliveryRecord[]>;
-    requeue(deliveryIds: readonly string[], now: Date): Promise<number>;
-    purge(request: PurgeRequest): Promise<PurgeResult>;
-    statistics(now: Date): Promise<EventStoreStatistics>;
+type ReceiveOutcome = 'accepted' | 'duplicate' | 'ignored' | 'invalid' | 'error';
+/** One event from a broker went through `receive`. */
+interface ReceiveFinishedEvent {
+    /** Name of the transport that delivered it; undefined when `bus.receive` was called directly. */
+    readonly transport: string | undefined;
+    /** Messaging system of that transport (`kafka`, `rabbitmq`), else its name. */
+    readonly system: string | undefined;
+    /** Topic, routing key or queue it arrived on, when the transport tells. */
+    readonly destination: string | undefined;
+    /** The event's type and source as received; undefined when missing or not text. */
+    readonly eventType: string | undefined;
+    readonly source: string | undefined;
+    /** W3C trace context the event carries, to continue the trace of its publisher. */
+    readonly traceContext: TraceContext | undefined;
+    readonly outcome: ReceiveOutcome;
+    readonly durationMs: number;
+    readonly error?: ErrorInfo;
+}
+/**
+ * A transport could not decode an inbound message (codec failure, malformed record) and
+ * dead-lettered or skipped it. It never reached the bus, so `onReceiveFinished` does not see it.
+ */
+interface InvalidMessageEvent {
+    /** Name of the transport. */
+    readonly transport: string;
+    /** The messaging system of the transport (`kafka`, `rabbitmq`), else its name. */
+    readonly system: string;
+    /** Topic, routing key or queue the message arrived on. */
+    readonly destination: string;
+    /** Why the message was rejected. */
+    readonly reason: string;
+    readonly error: ErrorInfo;
+}
+/** A periodic reading of the store's backlog (`RelayBusOptions.backlogInterval`). */
+interface BacklogEvent {
+    /** Deliveries waiting to run, due or not. */
+    readonly pending: number;
+    /** How long the oldest due delivery has waited; 0 when none is due. */
+    readonly oldestPendingAgeMs: number;
+    readonly statistics: EventStoreStatistics;
 }
-
-type FailureStage = 'claim' | 'dispatch' | 'complete' | 'reschedule' | 'bury' | 'release' | 'extend-lease' | 'purge' | 'observer';
 /**
  * Hooks for logging, metrics and tracing. Every method is optional, runs
  * synchronously on the hot path and must not throw; errors it throws are
@@ -517,6 +896,17 @@ interface RelayBusObserver {
         readonly stage: FailureStage;
         readonly error: ErrorInfo;
     }): void;
+    /** A publish call ended; called before the publishing transaction commits. */
+    onPublishFinished?(event: PublishFinishedEvent): void;
+    onClaimFinished?(event: ClaimFinishedEvent): void;
+    onHandlerStarted?(event: HandlerStartedEvent): void;
+    onHandlerFinished?(event: HandlerFinishedEvent): void;
+    onTransportSent?(event: TransportSentEvent): void;
+    onReceiveFinished?(event: ReceiveFinishedEvent): void;
+    /** A transport rejected an inbound message it could not decode. */
+    onInvalidMessage?(event: InvalidMessageEvent): void;
+    /** Called every `backlogInterval` while the bus runs, when that option is set. */
+    onBacklog?(event: BacklogEvent): void;
 }
 /** Minimal logger. Nest's `Logger` and `console` both satisfy it. */
 interface RelayBusLogger {
@@ -525,8 +915,35 @@ interface RelayBusLogger {
     error(message: string): void;
 }
 
-/** Receives an event from a broker. Resolve only after it is durably stored. */
-type TransportMessageHandler = (envelope: EventEnvelope) => Promise<void>;
+/** Where an incoming message came from, for observers and traces. */
+interface TransportMessage {
+    /** Topic, routing key or queue the message arrived on. */
+    readonly destination: string;
+}
+/** A message the transport could not turn into an event, so it never reaches the bus. */
+interface InvalidTransportMessage {
+    /** Topic, routing key or queue the message arrived on. */
+    readonly destination: string;
+    /** What the codec or decoder threw. */
+    readonly error: unknown;
+}
+/**
+ * What the bus offers a transport at `subscribe`, beyond the message handler. Present only when
+ * an observer implements the matching hook, so a transport can skip the work otherwise.
+ */
+interface TransportSubscriptionHooks {
+    /**
+     * Call once for each inbound message the transport rejected as undecodable (dead-lettered or
+     * skipped) before it reached `onMessage`. Messages the bus rejected itself are reported by
+     * `onReceiveFinished` and must not be reported here. Never throws.
+     */
+    readonly onInvalidMessage: (message: InvalidTransportMessage) => void;
+}
+/**
+ * Receives an event from a broker. Resolve only after it is durably stored. Transports pass
+ * `message` to tell where the event arrived; it is optional for transports written before it.
+ */
+type TransportMessageHandler = (envelope: EventEnvelope, message?: TransportMessage) => Promise<void>;
 /**
  * Broker port used to exchange events between services.
  *
@@ -540,17 +957,25 @@ type TransportMessageHandler = (envelope: EventEnvelope) => Promise<void>;
 interface Transport {
     /** Unique name referenced by routes and subscriptions. */
     readonly name: string;
+    /**
+     * The messaging system, as OpenTelemetry names it (`kafka`, `rabbitmq`), reported to observers
+     * and traces. Default: the transport's name.
+     */
+    readonly system?: string;
     connect?(): Promise<void>;
     publish(envelope: EventEnvelope, destination: string): Promise<void>;
-    subscribe?(destinations: readonly string[], onMessage: TransportMessageHandler): Promise<void>;
+    subscribe?(destinations: readonly string[], onMessage: TransportMessageHandler, hooks?: TransportSubscriptionHooks): Promise<void>;
     /**
      * Whether the transport can currently publish and, when subscribed, is
      * consuming. Health checks use it to report a dead consumer or a lost
      * connection. Transports without it count as ready.
      */
     isReady?(): boolean;
-    /** Releases connections. A closed transport is not reopened. */
-    close(): Promise<void>;
+    /**
+     * Releases connections. A closed transport is not reopened. Once `options.signal` aborts (the
+     * shutdown deadline passed), stop waiting and drop the connections it opened itself.
+     */
+    close(options?: CloseOptions): Promise<void>;
 }
 
 /**
@@ -578,8 +1003,21 @@ interface DispatcherOptions {
     readonly pollInterval?: Duration;
     /** Lease length; renewed every third of it while the handler runs. Default `'30s'`. */
     readonly leaseDuration?: Duration;
-    /** How long `stop` waits for running handlers before aborting them. Default `'30s'`. */
+    /**
+     * Longest `stop` takes in all, and its default `timeout`: waiting for running handlers, handing
+     * back leases, closing transports and the store. Past it, `stop` aborts the handlers still
+     * running, force-closes what relaybus opened itself and resolves. Default `'30s'`.
+     */
     readonly shutdownTimeout?: Duration;
+    /**
+     * Longest a finished delivery waits so that deliveries finishing around the
+     * same time are completed with one store call (when the store supports it).
+     * A delivery that finishes while nothing else runs is completed at once.
+     * `0` completes every delivery on its own. Default `'2ms'`.
+     */
+    readonly completionBatchWindow?: Duration;
+    /** Most deliveries completed in one store call. Default 200. */
+    readonly completionBatchSize?: number;
 }
 interface RetentionOptions {
     /**
@@ -594,6 +1032,11 @@ interface RetentionOptions {
     /** How often the cleanup runs. Default `'1h'`. */
     readonly interval?: Duration;
 }
+/**
+ * Every route to one destination of one transport is one handler,
+ * `relaybus.transport:<transport>:<destination>`: its events of one key are sent in commit
+ * order whatever their types. Such routes must resolve to the same `retry` and `timeout`.
+ */
 interface RouteOptions {
     /** Event class or type forwarded to the transport. */
     readonly event: EventReference;
@@ -616,6 +1059,15 @@ interface RelayBusOptions<TTransaction = unknown> {
     readonly source?: string;
     /** Default `'required'`. */
     readonly transactionMode?: TransactionMode;
+    /**
+     * Time budget of every `bus.transaction` (and `@RelayBusTransaction()` method). The store makes
+     * the database enforce it where it can (PostgreSQL: `statement_timeout`, plus
+     * `idle_in_transaction_session_timeout` and on PostgreSQL 17+ `transaction_timeout`; MongoDB:
+     * `maxCommitTimeMS`), and a transaction that still runs past
+     * it is rolled back with a {@link TransactionTimeoutError}. Keep calls to other services out of
+     * transactions instead of raising it. Default `'5s'`.
+     */
+    readonly transactionTimeout?: Duration;
     /**
      * Finds the caller's active transaction when none is passed to `publish`
      * and none was opened with `bus.transaction`, for example from
@@ -637,12 +1089,38 @@ interface RelayBusOptions<TTransaction = unknown> {
     readonly subscriptions?: readonly InboundSubscriptionOptions[];
     /** Create tables and indexes on start. Default true. */
     readonly setupStore?: boolean;
+    /**
+     * Hooks for logging and metrics. The hooks an observer implements are read when the bus is
+     * created; the newer ones (`onPublishFinished` and the other timed hooks) are skipped entirely,
+     * clock reads included, when no observer implements them.
+     */
     readonly observers?: readonly RelayBusObserver[];
+    /**
+     * Spans around publish, send and handler runs, and the W3C trace context written into published
+     * events (`traceparent`, `tracestate` headers). `@relaybus/otel` provides one. Default: none.
+     */
+    readonly tracer?: RelayBusTracer;
+    /**
+     * Reads `statistics()` this often while the bus runs and reports the backlog (pending deliveries,
+     * age of the oldest due one) to the observers' `onBacklog`. Each reading is a store query, so it
+     * is off unless set; `'15s'` to `'1m'` suits metrics scraped every minute. Default: off.
+     */
+    readonly backlogInterval?: Duration;
     /** Default: `console`. */
     readonly logger?: RelayBusLogger;
     readonly clock?: Clock;
     readonly generateIdentifier?: IdentifierGenerator;
     readonly random?: () => number;
+    /**
+     * Catalogs this process is checked against when it starts. `start()` throws a
+     * {@link ConfigurationError} listing every event that is not covered:
+     * - a catalog: every event needs a handler or a route;
+     * - `consume(catalog, { events })`: each declared event needs a local handler;
+     * - `produce(catalog, { events })`: each declared event needs a route to a transport.
+     *
+     * See `registerCatalog`.
+     */
+    readonly catalogs?: readonly (Catalog | CatalogDeclaration)[];
 }
 interface PublishOptions<TTransaction = unknown> {
     /** Transaction to write into. Default: the current scope, then `transactionResolver`. */
@@ -650,7 +1128,9 @@ interface PublishOptions<TTransaction = unknown> {
     /**
      * Ordering and partition key. Events with the same key are handled one at a
      * time per handler, in commit order. A delayed or retrying event holds back
-     * later events of its key.
+     * later events of its key. Default: the `key` of the event's definition
+     * (`defineEvent(type, { key })`), else none. An explicit key wins over the definition's, and in
+     * `publishAll` applies to every event of the call.
      */
     readonly key?: string;
     /** Deliver no earlier than this delay from now. */
@@ -671,6 +1151,27 @@ interface PublishOneOptions<TTransaction = unknown> extends PublishOptions<TTran
     readonly id?: string;
 }
 type ReceiveStatus = 'accepted' | 'duplicate' | 'ignored';
+
+interface StopOptions {
+    /**
+     * Longest the whole `stop` may take. Default: `dispatcher.shutdownTimeout`. Keep it below the time
+     * the platform waits before killing the process (Kubernetes `terminationGracePeriodSeconds`).
+     */
+    readonly timeout?: Duration;
+}
+/** How a `stop` went. */
+interface StopResult {
+    /** False when the deadline passed and `stop` aborted handlers or force-closed connections. */
+    readonly graceful: boolean;
+    /**
+     * Deliveries whose handlers still ran at the deadline. Their leases expire after
+     * `dispatcher.leaseDuration` and another process runs them again (at-least-once).
+     */
+    readonly abandonedDeliveries: number;
+    /** Time `stop` took, on the bus clock. */
+    readonly durationMs: number;
+}
+
 /**
  * Reliable event bus: events are stored with business data in one transaction,
  * then dispatched to every subscribed handler and route with independent
@@ -690,6 +1191,38 @@ declare class RelayBus<TTransaction = unknown> {
      */
     subscribe<TPayload>(event: EventClass<TPayload>, handler: EventHandler<TPayload, TTransaction>, options: SubscribeOptions): void;
     subscribe(eventType: string, handler: EventHandler<unknown, TTransaction>, options: SubscribeOptions): void;
+    /**
+     * Subscribes the `on${EventName}` methods of `handlers` to the events of
+     * `catalog`, or to the events named in `options.events`, with the stable
+     * handler ids `${prefix}.on${EventName}`. The prefix is `options.idPrefix`,
+     * else the catalog name, else the class name of `handlers`. Methods run with
+     * `this` bound to `handlers`; methods of events that are not selected are
+     * ignored. A missing handler of a selected event fails to compile, and
+     * throws {@link ConfigurationError} at runtime, as does an invalid or taken
+     * id; handlers registered before the failure stay registered.
+     *
+     * ```ts
+     * bus.subscribeCatalog(OrderEvents, new BillingHandlers(), { events: ['OrderPlaced'] });
+     * ```
+     */
+    subscribeCatalog<TCatalog extends Catalog, const TName extends keyof TCatalog>(catalog: TCatalog, handlers: NoInfer<HandlersOf<TCatalog, TName, TTransaction>>, options: SubscribeCatalogOptions<NoInfer<TCatalog>, TName> & {
+        readonly events: readonly TName[];
+    }): void;
+    /** Without a statically known `events` list, every handler of the catalog is required. */
+    subscribeCatalog<TCatalog extends Catalog>(catalog: TCatalog, handlers: HandlersOf<TCatalog, keyof TCatalog, TTransaction>, options?: SubscribeCatalogOptions<NoInfer<TCatalog>>): void;
+    /**
+     * Adds a catalog, or a `consume` / `produce` declaration, to the checks
+     * `start()` runs; `start()` throws a {@link ConfigurationError} naming each
+     * event that is not covered and what it lacks. Equivalent to the `catalogs`
+     * option.
+     */
+    registerCatalog(catalog: Catalog | CatalogDeclaration): void;
+    /**
+     * A view of this bus that publishes only the events of `catalog`, or only
+     * the events named in `options.events` (for example the events this service
+     * produces). Other events fail to compile and are rejected at runtime.
+     */
+    forCatalog<TCatalog extends Catalog, const TName extends keyof TCatalog = keyof TCatalog>(catalog: TCatalog, options?: CatalogEventSelection<TName>): CatalogPublisher<TCatalog, TTransaction, TName>;
     /** Registered handlers and routes, for diagnostics. */
     handlers(): readonly HandlerDescriptor[];
     /**
@@ -702,9 +1235,16 @@ declare class RelayBus<TTransaction = unknown> {
     publishAll(events: readonly DomainEvent[], options?: PublishOptions<TTransaction>): Promise<EventEnvelope[]>;
     /**
      * Runs `work` in a new store transaction. `publish` calls inside it join the
-     * transaction without passing it explicitly.
+     * transaction without passing it explicitly. The transaction is held to `transactionTimeout`
+     * and rolled back with a {@link TransactionTimeoutError} when it runs past it.
      */
     transaction<T>(work: (transaction: TTransaction) => Promise<T>): Promise<T>;
+    /**
+     * The transaction `publish` would join right now: the one of the enclosing `bus.transaction`
+     * (or `@RelayBusTransaction()` method, or transactional handler), else the one
+     * `transactionResolver` finds. Repositories use it to write in the same transaction.
+     */
+    currentTransaction(): TTransaction | undefined;
     /**
      * Stores an event received from a broker and schedules it for local handlers.
      * Idempotent on the event id. Transports call it and acknowledge the message
@@ -719,10 +1259,15 @@ declare class RelayBus<TTransaction = unknown> {
      */
     start(): Promise<void>;
     /**
-     * Stops dispatching, waits for running handlers, closes transports and the
-     * store. Waits for a start in progress first. Safe to call more than once.
+     * Stops claiming, waits for running handlers, hands back leases, closes transports and the store,
+     * all within `options.timeout` (default `dispatcher.shutdownTimeout`). When the deadline passes it
+     * aborts the handlers still running, force-closes what relaybus opened itself (never pools or
+     * clients the application passed in) and resolves anyway: it never rejects because of the
+     * deadline. Abandoned deliveries stay leased until their lease expires and then run again
+     * (at-least-once). Waits for a start in progress first. Safe to call more than once: later calls
+     * get the result of the first.
      */
-    stop(): Promise<void>;
+    stop(options?: StopOptions): Promise<StopResult>;
     /**
      * Claims and runs one batch of due deliveries, resolving when they settle.
      * Returns how many ran. Intended for tests and scripts.
@@ -741,4 +1286,83 @@ declare class RelayBus<TTransaction = unknown> {
     purgeExpired(): Promise<PurgeResult>;
 }
 
-export { type AppendEntry, type AppendResult, type ClaimRequest, type ClaimedDelivery, type Clock, ConfigurationError, DEFAULT_RETRY_POLICY, DEFAULT_ROUTE_RETRY_POLICY, DELIVERY_STATUSES, type DefineEventOptions, type DeliveryQuery, type DeliveryRecord, type DeliveryStatus, type DispatcherOptions, DispatcherStoppedError, type DomainEvent, type Duration, type ErrorInfo, type EventClass, type EventEnvelope, type EventHandler, type EventHeaders, type EventReference, type EventStore, type EventStoreStatistics, EventValidationError, type FailureStage, type HandlerContext, type HandlerDescriptor, HandlerTimeoutError, type IdentifierGenerator, InMemoryEventStore, type InMemoryEventStoreOptions, InMemoryTransaction, type InboundSubscriptionOptions, InvalidEnvelopeError, type JitterStrategy, LeaseLostError, type LeaseReference, MAX_TIMER_DELAY_MS, type NewDelivery, NonRetryableError, type PayloadOf, type PublishOneOptions, type PublishOptions, type PurgeRequest, type PurgeResult, type ReceiveStatus, RelayBus, RelayBusError, type RelayBusLogger, type RelayBusObserver, type RelayBusOptions, type RetentionOptions, type RetryPolicy, type RetryPolicyOptions, type RouteOptions, StandardSchemaV1, type SubscribeOptions, type TransactionMode, TransactionRequiredError, type Transport, type TransportMessageHandler, type UnroutedEventPolicy, type ValidationIssue, assertEventType, computeRetryDelay, createRetryPolicy, createUuidV7, defineEvent, isRetryableError, systemClock, toErrorInfo, toMilliseconds, validatePayload };
+/** The publishing half of a bus, which a {@link CatalogPublisher} delegates to. */
+interface PublishTarget<TTransaction> {
+    publish<TPayload>(event: DomainEvent<TPayload>, options?: PublishOneOptions<TTransaction>): Promise<EventEnvelope<TPayload>>;
+    publishAll(events: readonly DomainEvent[], options?: PublishOptions<TTransaction>): Promise<EventEnvelope[]>;
+}
+/**
+ * A view of a bus that publishes only the events of one catalog, or only the
+ * events a service produces from it. Obtain it with `bus.forCatalog(catalog)`
+ * or `bus.forCatalog(catalog, { events: ['OrderPlaced'] })`. Publishing an
+ * event outside the view fails to compile; a mistyped event that gets past the
+ * compiler (a cast, plain JavaScript, or a class with a structurally identical
+ * payload) is rejected with a {@link ConfigurationError} before anything is stored.
+ *
+ * ```ts
+ * const orders = bus.forCatalog(OrderEvents);
+ * await orders.publish(new OrderPlaced({ orderId }));
+ * await orders.publish(new UserRegistered({ userId })); // compile error
+ * ```
+ */
+declare class CatalogPublisher<TCatalog extends Catalog, TTransaction = unknown, TName extends keyof TCatalog = keyof TCatalog> {
+    #private;
+    /**
+     * Throws {@link ConfigurationError} when `catalog` was not created with
+     * `defineCatalog` or `options.events` names no event, an unknown event or
+     * the same event twice.
+     */
+    constructor(catalog: TCatalog, target: PublishTarget<TTransaction>, options?: CatalogEventSelection<TName>);
+    /** Same as `bus.publish`, limited to the events of the view. */
+    publish<TEvent extends CatalogEvents<TCatalog, TName>>(event: TEvent, options?: PublishOneOptions<TTransaction>): Promise<EventEnvelope<TEvent['payload']>>;
+    /** Same as `bus.publishAll`, limited to the events of the view. Nothing is stored unless every event belongs to it. */
+    publishAll(events: readonly CatalogEvents<TCatalog, TName>[], options?: PublishOptions<TTransaction>): Promise<EventEnvelope[]>;
+}
+
+/** Transaction handle of {@link InMemoryEventStore}. Writes apply on commit only. */
+declare class InMemoryTransaction {
+    #private;
+    get state(): 'open' | 'committed' | 'rolled-back';
+    enqueue(operation: () => void): void;
+    /** Runs `finisher` once the transaction commits or rolls back, like a lock release. */
+    onFinish(finisher: () => void): void;
+    commit(): void;
+    rollback(): void;
+}
+
+interface InMemoryEventStoreOptions {
+    /** Allow use when `NODE_ENV` is `production`. Data is lost on restart. Default false. */
+    readonly allowInProduction?: boolean;
+    readonly generateIdentifier?: IdentifierGenerator;
+    /**
+     * Keep a record of completed deliveries (status `completed`, listed, counted
+     * and purged by `retention.completed`). Default false: a completed delivery
+     * is deleted, like in the database stores.
+     */
+    readonly retainCompleted?: boolean;
+}
+/**
+ * Event store kept in process memory, with the same semantics as the database
+ * stores: transactional appends, leases, fencing and per-key ordering. Payloads
+ * are round-tripped through JSON exactly like a database would store them.
+ * Meant for tests and local development.
+ */
+declare class InMemoryEventStore implements EventStore<InMemoryTransaction> {
+    #private;
+    constructor(options?: InMemoryEventStoreOptions);
+    transaction<T>(work: (transaction: InMemoryTransaction) => Promise<T>): Promise<T>;
+    append(transaction: InMemoryTransaction, entries: readonly AppendEntry[], now: Date): Promise<AppendResult>;
+    claim(request: ClaimRequest): Promise<ClaimedDelivery[]>;
+    extendLease(lease: LeaseReference, leaseExpiresAt: Date, now: Date): Promise<boolean>;
+    complete(lease: LeaseReference, now: Date, transaction?: InMemoryTransaction): Promise<boolean>;
+    completeMany(leases: readonly LeaseReference[], now: Date): Promise<boolean[]>;
+    reschedule(lease: LeaseReference, availableAt: Date, error: ErrorInfo, now: Date): Promise<boolean>;
+    release(lease: LeaseReference, now: Date): Promise<boolean>;
+    bury(lease: LeaseReference, error: ErrorInfo, now: Date): Promise<boolean>;
+    listDeliveries(query: DeliveryQuery): Promise<DeliveryRecord[]>;
+    requeue(deliveryIds: readonly string[], now: Date): Promise<number>;
+    purge(request: PurgeRequest): Promise<PurgeResult>;
+    statistics(now: Date): Promise<EventStoreStatistics>;
+}
+
+export { type AppendEntry, type AppendResult, AttemptsExhaustedError, type BacklogEvent, type Catalog, type CatalogDeclaration, type CatalogDescription, type CatalogEntry, type CatalogEventClass, type CatalogEventName, type CatalogEventSelection, type CatalogEvents, CatalogPublisher, type CatalogRole, type ClaimFinishedEvent, type ClaimRequest, type ClaimedDelivery, Clock, type CloseOptions, ConfigurationError, DEFAULT_RETRY_POLICY, DEFAULT_ROUTE_RETRY_POLICY, DELIVERY_STATUSES, type DefineCatalogOptions, type DeliveryKind, type DeliveryQuery, type DeliveryRecord, type DeliveryStatus, type DispatcherOptions, DispatcherStoppedError, DomainEvent, DrainIncompleteError, type Duration, type ErrorInfo, EventClass, EventEnvelope, type EventHandler, EventHeaders, type EventOf, EventReference, type EventStore, type EventStoreStatistics, type EventStoreTransactionOptions, EventValidationError, type FailureStage, type HandlerContext, type HandlerDescriptor, type HandlerFinishedEvent, type HandlerShapeOf, type HandlerStartedEvent, HandlerTimeoutError, type HandlersOf, type IdentifierGenerator, InMemoryEventStore, type InMemoryEventStoreOptions, InMemoryTransaction, type InboundSubscriptionOptions, InvalidEnvelopeError, type InvalidMessageEvent, type InvalidTransportMessage, type JitterStrategy, LeaseLostError, type LeaseReference, LifecycleError, MAX_TIMER_DELAY_MS, type MatchingHandlers, type NewDelivery, type NoExtraHandlers, NonRetryableError, type OperationOutcome, type PartialHandlersOf, PayloadOf, type ProcessTraceInput, type PublishFinishedEvent, type PublishOneOptions, type PublishOptions, type PublishTarget, type PublishTraceInput, type PurgeRequest, type PurgeResult, type ReceiveFinishedEvent, type ReceiveOutcome, type ReceiveStatus, RelayBus, RelayBusError, type RelayBusLogger, type RelayBusObserver, type RelayBusOptions, type RelayBusTracer, type RetentionOptions, type RetryPolicy, type RetryPolicyOptions, type RouteOptions, type SendTraceInput, StandardSchemaV1, type StopOptions, type StopResult, type SubscribeCatalogOptions, type SubscribeOptions, TRACEPARENT_HEADER, TRACESTATE_HEADER, type TraceContext, type TransactionMode, TransactionRequiredError, TransactionTimeoutError, type Transport, type TransportMessage, type TransportMessageHandler, type TransportSentEvent, type TransportSubscriptionHooks, type UnroutedEventPolicy, type ValidationIssue, computeRetryDelay, consume, createRetryPolicy, createUuidV7, defineCatalog, defineHandlers, describeCatalog, isRetryableError, produce, toErrorInfo, toMilliseconds, traceContextOf };