@worker-protocol/cloudflare 0.0.0-stage → 0.6.0

package/dist/logs.js

@@ -0,0 +1,120 @@
+import { LEVELS } from "@worker-protocol/hono";
+import { migrate } from "./schema.js";
+/** `migrate` applies these; a new step goes at the end, and a published one is never edited. */
+const SCHEMA = {
+    piece: "worker-protocol.logs",
+    steps: [
+        // 1. The tables as first released, `IF NOT EXISTS` so an object that already has them adopts them.
+        [
+            `CREATE TABLE IF NOT EXISTS wp_log (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        at INTEGER NOT NULL,
+        level TEXT NOT NULL,
+        rank INTEGER NOT NULL,
+        message TEXT NOT NULL,
+        fields TEXT
+      )`,
+        ],
+    ],
+};
+export function withLogs(Base, options) {
+    class WithLogs extends Base {
+        /** One write per call, whatever the line count — per line it would be a write per record. */
+        record(rows) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            for (const row of rows) {
+                sql.exec("INSERT INTO wp_log (at, level, rank, message, fields) VALUES (?, ?, ?, ?, ?)", row.at, row.level, 
+                // LOG-5's ladder as a number, so that LOG-7's floor is a comparison the store can make.
+                LEVELS.indexOf(row.level), row.message, row.fields === undefined ? null : JSON.stringify(row.fields));
+            }
+            // A window rather than an archive, which is what makes the end of the collection mean *the
+            // end of what this Worker still holds*.
+            sql.exec("DELETE FROM wp_log WHERE seq <= (SELECT MAX(seq) FROM wp_log) - ?", options.keep);
+        }
+        /** LOG-3, LOG-7, LOG-8, ENDP-33 — one page, most recent first, in one query. */
+        logs(query) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            const found = sql
+                .exec(`SELECT seq, at, level, message, fields FROM wp_log
+            WHERE rank >= ?1
+              AND (?2 IS NULL OR seq < ?2)
+              AND (?3 IS NULL OR at >= ?3)
+              AND (?4 IS NULL OR at < ?4)
+            ORDER BY seq DESC
+            LIMIT ?5`, query.minRank, query.before, query.from, query.to, 
+            // One more than asked for, which is how the cursor knows whether there IS a next page.
+            query.limit + 1)
+                .toArray();
+            const page = found.slice(0, query.limit);
+            const rows = page.map((row) => ({
+                at: row.at,
+                level: row.level,
+                message: row.message,
+                ...(row.fields === null ? {} : { fields: JSON.parse(row.fields) }),
+            }));
+            // ENDP-20: the cursor exists exactly when the query found a row beyond the cap.
+            const last = found.length > query.limit ? page.at(-1) : undefined;
+            return last === undefined ? { rows } : { rows, nextCursor: String(last.seq) };
+        }
+    }
+    return WithLogs;
+}
+/** `logs` for `mount()`, over the object with `withLogs`. `mount()` decodes the query. */
+export const durableLogs = (stub, options) => ({
+    pageSize: options.pageSize,
+    read: async ({ levels, from, to, cursor, limit }) => {
+        const page = await stub.logs({
+            // LOG-7's floor: the levels arrive in order, so the first is the lowest asked for.
+            minRank: LEVELS.indexOf(levels[0] ?? "debug"),
+            before: cursor === undefined ? null : Number(cursor),
+            from: from?.getTime() ?? null,
+            to: to?.getTime() ?? null,
+            limit,
+        });
+        return {
+            records: page.rows.map((row) => ({
+                at: new Date(row.at),
+                level: row.level,
+                message: row.message,
+                ...(row.fields === undefined ? {} : { fields: row.fields }),
+            })),
+            ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),
+        };
+    },
+});
+/**
+ * What a Tail Worker records of the invocations it is handed: an exception nobody caught, and an
+ * invocation that ended badly — the two things a Worker cannot record about itself, because by
+ * then it has stopped running.
+ *
+ * **It throws `event.logs` away**, which is every `console` call the producer made: forwarding it
+ * would be the capture `spec/logs.md` argues against. That filter is also what stops a tail from
+ * feeding itself — its own write to the object is traced, comes back as `ok` with no exceptions,
+ * and records nothing.
+ */
+export function tailRecords(events) {
+    const lines = [];
+    for (const event of events) {
+        const at = event.eventTimestamp ?? Date.now();
+        const fields = { script: event.scriptName ?? "unknown", outcome: event.outcome };
+        for (const thrown of event.exceptions) {
+            lines.push({
+                at: thrown.timestamp ?? at,
+                level: "error",
+                message: `uncaught ${thrown.name}: ${String(thrown.message)}`,
+                fields,
+            });
+        }
+        // `ok` says nothing an operator needs; `canceled` is a client that hung up, worth knowing when
+        // it happens a hundred times an hour; `exceededCpu` is what nothing inside a Worker can report.
+        if (event.outcome !== "ok" && event.exceptions.length === 0) {
+            lines.push({
+                at,
+                level: event.outcome === "canceled" ? "warn" : "error",
+                message: `the invocation ended \`${event.outcome}\``,
+                fields,
+            });
+        }
+    }
+    return lines;
+}

package/dist/outbox.d.ts

@@ -0,0 +1,52 @@
+import type { Publishable } from "@worker-protocol/hono";
+import { type DurableObjectClass, type EnvOf, type Mixed } from "./durable.ts";
+/**
+ * An outbox, in every Durable Object whose changes raise events.
+ *
+ * **The row is written in the same operation as the change it reports.** `enqueue` is synchronous
+ * SQL, so called from a domain method between the domain's own writes it lands in the same
+ * transaction: there is no moment at which a Fact changed and its event was not yet owed. That is
+ * what makes it an outbox rather than a send that might not happen.
+ *
+ * **It holds the whole event**, as `Publishable` JSON with its id, until it is sent. A Worker's own
+ * retention then need not wait for what is pending — the copy lives for the seconds it takes to
+ * leave. An id still waiting is not enqueued twice; once sent, the same id enqueued again is sent
+ * again, which is a republication under the same `source` and `id` that a consumer remembering them
+ * discards (EVT-8). A domain that writes `INSERT OR IGNORE` and enqueues only what it inserted
+ * raises nothing twice at all.
+ *
+ * **It drains when the call ends, and retries by the one alarm.** The domain calls `flush()` at the
+ * end of a method; what does not reach the events Queue stays, in order, and the alarm tries again
+ * with a backoff. A Durable Object has one alarm, so the domain does not set its own: it asks with
+ * `wakeAt(at)` and is called back at `wake()`, and the alarm fires at the earlier of the two. A base
+ * class that sets the alarm itself does not compose with this one.
+ */
+/** One event on the events Queue: what was enqueued, with the id and instant the row kept. */
+export type OutboxEvent = Publishable & {
+    id: string;
+    time: number;
+};
+/** What a `flush()` did: how many events left, and how many are still waiting. */
+export type Flushed = {
+    sent: number;
+    pending: number;
+};
+/** What `withOutbox` adds to a Durable Object. */
+export interface OutboxMethods {
+    enqueue(at: number, events: Publishable[]): void;
+    outbox(): {
+        depth: number;
+        oldestAt: number | null;
+    };
+    flush(): Promise<Flushed>;
+    wakeAt(at: number | null): Promise<void>;
+    wake(): void | Promise<void>;
+    alarm(): Promise<void>;
+}
+export declare function withOutbox<B extends DurableObjectClass>(Base: B, options: {
+    /**
+     * The events Queue `flush()` sends to, whose consumer fans each event out (`consumeQueues`).
+     * Resolved on every flush rather than once, so it reads whatever `env` the object holds then.
+     */
+    events: (env: EnvOf<B>) => Queue<OutboxEvent>;
+}): Mixed<B, OutboxMethods>;

package/dist/outbox.js

@@ -0,0 +1,173 @@
+import { asJson, BATCH, first, } from "./durable.js";
+import { migrate } from "./schema.js";
+/** `migrate` applies these; a new step goes at the end, and a published one is never edited. */
+const SCHEMA = {
+    piece: "worker-protocol.outbox",
+    steps: [
+        // 1. The tables as first released, `IF NOT EXISTS` so an object that already has them adopts them.
+        [
+            `CREATE TABLE IF NOT EXISTS wp_outbox (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        id TEXT NOT NULL UNIQUE,
+        at INTEGER NOT NULL,
+        event TEXT NOT NULL
+      )`,
+            // The instants the one alarm is shared between: `wake` is the domain's, `retry` the outbox's.
+            `CREATE TABLE IF NOT EXISTS wp_alarm (
+        name TEXT PRIMARY KEY,
+        at INTEGER NOT NULL,
+        attempts INTEGER NOT NULL
+      )`,
+        ],
+    ],
+};
+/** The first retry of an outbox that could not be sent, and the longest wait between two. */
+const RETRY_FIRST_MS = 5_000;
+const RETRY_MOST_MS = 300_000;
+/** The send in flight per object, so a call and the alarm never send the same rows at once. */
+const inFlight = new WeakMap();
+const depthOf = (sql) => sql.exec("SELECT COUNT(*) AS n FROM wp_outbox").one().n;
+/** Whether a table exists, asked without creating it: after `deleteAll()` nothing should come back. */
+const exists = (sql, table) => first(sql.exec("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", table)) !==
+    undefined;
+/** Points the one alarm at the earliest instant anybody asked for, or clears it. */
+async function settle(storage) {
+    if (!exists(storage.sql, "wp_alarm"))
+        return;
+    const next = storage.sql
+        .exec("SELECT MIN(at) AS at FROM wp_alarm")
+        .one().at;
+    const current = await storage.getAlarm();
+    if (next === null) {
+        if (current !== null)
+            await storage.deleteAlarm();
+        return;
+    }
+    if (current !== next)
+        await storage.setAlarm(next);
+}
+async function drain(given) {
+    const { storage, queue } = given;
+    const sql = storage.sql;
+    const retrying = () => first(sql.exec("SELECT 1 FROM wp_alarm WHERE name = 'retry'")) !== undefined;
+    // The common case: a call that raised nothing ends in a flush with nothing to send, and the
+    // alarm has nothing to change. It is every write of every object, so it touches nothing else.
+    if (depthOf(sql) === 0 && !retrying())
+        return { sent: 0, pending: 0 };
+    let sent = 0;
+    try {
+        for (;;) {
+            const rows = sql
+                .exec("SELECT seq, id, at, event FROM wp_outbox ORDER BY seq LIMIT ?", BATCH)
+                .toArray();
+            const last = rows.at(-1);
+            if (last === undefined)
+                break;
+            await queue.sendBatch(asJson(rows.map((row) => ({
+                ...JSON.parse(row.event),
+                id: row.id,
+                time: row.at,
+            }))));
+            // Up to the last row sent and no further: a row enqueued during the send has a later `seq`.
+            sql.exec("DELETE FROM wp_outbox WHERE seq <= ?", last.seq);
+            sent += rows.length;
+        }
+        sql.exec("DELETE FROM wp_alarm WHERE name = 'retry'");
+        await settle(storage);
+        return { sent, pending: 0 };
+    }
+    catch {
+        // What did not go stays, in order, and the alarm tries again: sooner the first time, never
+        // more often than every five minutes, so a Queue that is down for an hour is not woken
+        // thousands of times by thousands of objects.
+        if (!exists(sql, "wp_alarm"))
+            return { sent, pending: 0 };
+        const held = first(sql.exec("SELECT attempts FROM wp_alarm WHERE name = 'retry'"));
+        const attempts = held?.attempts ?? 0;
+        const wait = Math.min(RETRY_FIRST_MS * 2 ** attempts, RETRY_MOST_MS);
+        sql.exec("INSERT OR REPLACE INTO wp_alarm (name, at, attempts) VALUES ('retry', ?, ?)", Date.now() + wait, attempts + 1);
+        await settle(storage);
+        return { sent, pending: depthOf(sql) };
+    }
+}
+export function withOutbox(Base, options) {
+    class WithOutbox extends Base {
+        /**
+         * Owes each event, in the transaction the calling method is already in.
+         *
+         * `at` is when the Fact changed, for an event that does not carry its own `time`. An event
+         * whose `id` is still waiting is not enqueued again. Public only because TypeScript cannot
+         * emit a mixin's protected members; over RPC it would lose the transaction that is its point.
+         */
+        enqueue(at, events) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            for (const one of events) {
+                const { id, time, ...rest } = one;
+                const when = time === undefined ? at : typeof time === "number" ? time : time.getTime();
+                sql.exec("INSERT OR IGNORE INTO wp_outbox (id, at, event) VALUES (?, ?, ?)", id ?? crypto.randomUUID(), when, JSON.stringify(rest));
+            }
+        }
+        /** How deep the outbox is and when its oldest event was raised, which `health` may report. */
+        outbox() {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            const row = sql
+                .exec("SELECT COUNT(*) AS n, MIN(at) AS oldest FROM wp_outbox")
+                .one();
+            return { depth: row.n, oldestAt: row.oldest };
+        }
+        /**
+         * Sends what is waiting to the events Queue, in order, a hundred at a time. Never rejects: what
+         * could not be sent stays and the alarm is pointed at a retry. A send already in flight is
+         * joined rather than repeated.
+         */
+        flush() {
+            const storage = this.ctx.storage;
+            migrate(storage, SCHEMA);
+            const running = inFlight.get(storage) ??
+                drain({ storage, queue: options.events(this.env) }).finally(() => inFlight.delete(storage));
+            inFlight.set(storage, running);
+            return running;
+        }
+        /** The domain's own alarm, sharing the one this object has. `null` withdraws it. */
+        async wakeAt(at) {
+            const storage = this.ctx.storage;
+            migrate(storage, SCHEMA);
+            if (at === null)
+                storage.sql.exec("DELETE FROM wp_alarm WHERE name = 'wake'");
+            else {
+                storage.sql.exec("INSERT OR REPLACE INTO wp_alarm (name, at, attempts) VALUES ('wake', ?, 0)", at);
+            }
+            await settle(storage);
+        }
+        /** What the domain does when the instant it asked for with `wakeAt` comes. Nothing, unless overridden. */
+        wake() { }
+        /**
+         * The one alarm: the outbox first, then the domain's `wake()` if its instant has come. The
+         * domain overrides `wake()`, never this. `wake()` may empty the object with `deleteAll()`, and
+         * nothing here writes to it afterwards; if it throws, its instant stays and the platform's own
+         * retry of the alarm calls it again.
+         */
+        async alarm() {
+            const storage = this.ctx.storage;
+            const sql = storage.sql;
+            // Asked, never created. Every alarm this mixin sets is written in `wp_alarm` first, so without
+            // the table there is nothing it owes: the object emptied itself, and an alarm delivered again
+            // — at least once is the platform's promise — must not bring its tables back.
+            if (!exists(sql, "wp_alarm"))
+                return;
+            const now = Date.now();
+            if (depthOf(sql) > 0)
+                await this.flush();
+            const wake = first(sql.exec("SELECT at FROM wp_alarm WHERE name = 'wake'"));
+            if (wake !== undefined && wake.at <= now) {
+                await this.wake();
+                // Only the instant that fired: a `wake()` that asked again with `wakeAt` keeps its answer.
+                if (exists(sql, "wp_alarm")) {
+                    sql.exec("DELETE FROM wp_alarm WHERE name = 'wake' AND at = ?", wake.at);
+                }
+            }
+            await settle(storage);
+        }
+    }
+    return WithOutbox;
+}

package/dist/outcomes.d.ts

@@ -0,0 +1,13 @@
+import type { OutcomeStore, Recorded, Reservation } from "@worker-protocol/hono";
+import { type DurableObjectClass, type Mixed, type Rpc } from "./durable.ts";
+/** What `withOutcomes` adds to a Durable Object. */
+export interface OutcomeMethods {
+    beginOutcome(key: string, until: number): Reservation;
+    completeOutcome(key: string, answer: Recorded): void;
+    releaseOutcome(key: string): void;
+}
+export declare function withOutcomes<B extends DurableObjectClass>(Base: B): Mixed<B, OutcomeMethods>;
+/** What `durableOutcomes` needs of a stub: the three methods `withOutcomes` adds, over RPC. */
+export type OutcomesRpc = Rpc<OutcomeMethods>;
+/** `actions.outcomes` for `mount()`, over the object that carries `withOutcomes`. */
+export declare const durableOutcomes: (stub: OutcomesRpc) => OutcomeStore;

package/dist/outcomes.js

@@ -0,0 +1,62 @@
+import { first } from "./durable.js";
+import { migrate } from "./schema.js";
+/**
+ * ENDP-16's store, in whichever Durable Object a Worker keeps its outcomes in.
+ *
+ * `beginOutcome` is the reason it is a Durable Object at all rather than a KV namespace: finding a
+ * key free and taking it are one method, and a method is synchronous from its first statement to
+ * its last, so no other request interleaves between the two. Two callers under one key meet a
+ * reservation, and only one of them performs.
+ */
+/** `migrate` applies these; a new step goes at the end, and a published one is never edited. */
+const SCHEMA = {
+    piece: "worker-protocol.outcomes",
+    steps: [
+        // 1. The tables as first released, `IF NOT EXISTS` so an object that already has them adopts them.
+        [
+            `CREATE TABLE IF NOT EXISTS wp_outcome (
+        key TEXT PRIMARY KEY,
+        until INTEGER NOT NULL,
+        answer TEXT
+      )`,
+            "CREATE INDEX IF NOT EXISTS wp_outcome_until ON wp_outcome (until)",
+        ],
+    ],
+};
+export function withOutcomes(Base) {
+    class WithOutcomes extends Base {
+        /**
+         * `OutcomeStore.begin`. The return type is `Reservation` by name: a stub's types are mapped,
+         * and the mapping once accepted a shape `OutcomeStore` does not take when it was spelled out.
+         */
+        beginOutcome(key, until) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            const now = Date.now();
+            // What has expired is nobody's any more, so it goes as soon as anybody asks: a window rather
+            // than an archive, without a schedule of its own.
+            sql.exec("DELETE FROM wp_outcome WHERE until <= ?", now);
+            const row = first(sql.exec("SELECT answer FROM wp_outcome WHERE key = ?", key));
+            if (row?.answer != null)
+                return { held: JSON.parse(row.answer) };
+            if (row !== undefined)
+                return "in-flight";
+            sql.exec("INSERT INTO wp_outcome (key, until, answer) VALUES (?, ?, NULL)", key, until);
+            return "reserved";
+        }
+        completeOutcome(key, answer) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            sql.exec("INSERT OR REPLACE INTO wp_outcome (key, until, answer) VALUES (?, ?, ?)", key, answer.until, JSON.stringify(answer));
+        }
+        releaseOutcome(key) {
+            const sql = migrate(this.ctx.storage, SCHEMA);
+            sql.exec("DELETE FROM wp_outcome WHERE key = ?", key);
+        }
+    }
+    return WithOutcomes;
+}
+/** `actions.outcomes` for `mount()`, over the object that carries `withOutcomes`. */
+export const durableOutcomes = (stub) => ({
+    begin: (key, until) => stub.beginOutcome(key, until),
+    complete: (key, held) => stub.completeOutcome(key, held),
+    release: (key) => stub.releaseOutcome(key),
+});

package/dist/queues.d.ts

@@ -0,0 +1,68 @@
+import type { CloudEvent, Delivery, DeliveryQueue, eventHub, GaveUp } from "@worker-protocol/hono";
+import type { LogRow } from "./logs.ts";
+import type { OutboxEvent } from "./outbox.ts";
+/**
+ * The two Queues between an outbox and a sink, and the one handler that consumes both.
+ *
+ * **Events, then deliveries.** Every object's `flush()` sends its events to the events Queue. Its
+ * consumer publishes each batch through the hub — the subscriptions are read once per type for the
+ * whole batch, from the one object that holds them — and leaves one delivery per matching
+ * subscription on the deliveries Queue, whose consumer makes the attempt. Fanning out from each
+ * object instead would make a run that touches thousands of them thousands of calls to that one
+ * object, and an outage of it would leave every outbox retrying; here the events wait in a Queue.
+ *
+ * **What is given up stays visible.** A delivery `deliver()` gives up on, and an event of a type the
+ * Worker does not declare, go to the dead-letter queue with the reason, to be inspected and never
+ * redriven, and — where the Worker keeps logs — a record names each for an operator who reads the
+ * Worker through the protocol rather than through the Cloudflare account. A message the platform
+ * drops after `max_retries` reaches the same queue, as it was sent and untagged, when
+ * `wrangler.jsonc` names it as each consumer's `dead_letter_queue`: the only thing that sees those.
+ */
+type Hub = ReturnType<typeof eventHub>;
+/**
+ * `subscriptions.queue` for `mount()` and `eventHub()`: the deliveries Queue, in batches where the
+ * hub has several. The chunks are independent — the Queue promises no order — so they go together.
+ */
+export declare const deliveryQueue: (queue: Queue<Delivery>) => DeliveryQueue;
+/**
+ * What the consumer sets aside in the dead-letter queue, tagged by what it is: a delivery given up,
+ * with why, or an event of a type the Worker does not declare (EVT-12) — a mistake in the Worker's
+ * own code, which no retry would mend.
+ */
+export type GivenUp = {
+    kind: "delivery";
+    delivery: Delivery;
+    gaveUp: GaveUp;
+} | {
+    kind: "event";
+    event: OutboxEvent;
+    reason: "undeclared";
+};
+export type QueuesConfig<E> = {
+    /** The Queue names, as `wrangler.jsonc` gives them: how the handler tells the two batches apart. */
+    queues: {
+        events: string;
+        deliveries: string;
+    };
+    /** The hub, built from the same declaration `mount()` serves. */
+    hub: (env: E) => Hub;
+    /** Where what is given up is kept for somebody to inspect. */
+    deadLetter: (env: E) => Queue<GivenUp>;
+    /**
+     * EVT-13: one attempt at the broker, where the Worker declares one; `false` is a broker that did
+     * not take the event. Called after the subscribers, so a broker that is down costs them a repeat
+     * under the same id, which they discard, and never a loss.
+     */
+    broker?: (asked: {
+        event: CloudEvent;
+        env: E;
+    }) => Promise<boolean>;
+    /** LOG-2: where the records of what was given up are written, where the Worker keeps logs. */
+    record?: (asked: {
+        rows: LogRow[];
+        env: E;
+    }) => Promise<void>;
+};
+/** The `queue` handler of a Worker's default export, for both Queues. */
+export declare function consumeQueues<E>(config: QueuesConfig<E>): (batch: MessageBatch<unknown>, env: E) => Promise<void>;
+export {};

package/dist/queues.js

@@ -0,0 +1,148 @@
+import { asJson, BATCH } from "./durable.js";
+/** A Queue's own retry when nothing more specific was decided: ten seconds, doubling to an hour. */
+const backoff = (attempts) => Math.min(10 * 2 ** Math.max(attempts - 1, 0), 3600);
+/**
+ * `subscriptions.queue` for `mount()` and `eventHub()`: the deliveries Queue, in batches where the
+ * hub has several. The chunks are independent — the Queue promises no order — so they go together.
+ */
+export const deliveryQueue = (queue) => ({
+    send: async (delivery) => {
+        await queue.send(delivery, { contentType: "json" });
+    },
+    sendBatch: async (deliveries) => {
+        const chunks = [];
+        for (let at = 0; at < deliveries.length; at += BATCH) {
+            chunks.push(deliveries.slice(at, at + BATCH));
+        }
+        await Promise.all(chunks.map((chunk) => queue.sendBatch(asJson(chunk))));
+    },
+});
+/** The `queue` handler of a Worker's default export, for both Queues. */
+export function consumeQueues(config) {
+    /** Sets one message's body aside, notes why, and settles it; retried if the queue refuses. */
+    const setAside = async (given) => {
+        try {
+            await given.deadLetter.send(given.kept, { contentType: "json" });
+            given.rows.push(given.row);
+            given.message.ack();
+        }
+        catch {
+            given.message.retry({ delaySeconds: backoff(given.message.attempts) });
+        }
+    };
+    /** The records of one batch, in one write. The dead-letter queue already holds every one. */
+    const record = async (rows, env) => {
+        if (rows.length === 0 || config.record === undefined)
+            return;
+        try {
+            await config.record({ rows, env });
+        }
+        catch {
+            // The record is the courtesy copy; the dead-letter queue is the one that is kept.
+        }
+    };
+    async function events(batch, env) {
+        const hub = config.hub(env);
+        const deadLetter = config.deadLetter(env);
+        const rows = [];
+        // EVT-12, asked first: an event the Worker does not declare can never be published, so it is
+        // set aside at once rather than failing the batch beside it a hundred times over.
+        const declared = batch.messages.filter((message) => hub.declares(message.body.type));
+        const undeclared = batch.messages.filter((message) => !hub.declares(message.body.type));
+        await Promise.all(undeclared.map((message) => setAside({
+            message,
+            kept: { kind: "event", event: message.body, reason: "undeclared" },
+            deadLetter,
+            rows,
+            row: {
+                at: Date.now(),
+                level: "error",
+                message: "an event of a type this Worker does not declare was set aside",
+                fields: { event: message.body.id, type: message.body.type },
+            },
+        })));
+        let published;
+        try {
+            published =
+                declared.length === 0 ? [] : await hub.publishAll(declared.map((message) => message.body));
+        }
+        catch {
+            // The store or the deliveries Queue could not be reached. The batch is retried whole, once,
+            // rather than event by event against the object that is already struggling; a delivery the
+            // first attempt did queue is queued again under the same id, which a sink discards.
+            for (const message of declared)
+                message.retry({ delaySeconds: backoff(message.attempts) });
+        }
+        if (published !== undefined) {
+            const sent = published;
+            // Each event is settled on its own and the Queue promises no order, so the broker is asked
+            // for all of them at once rather than one after another.
+            await Promise.all(declared.map(async (message, at) => {
+                const event = sent[at];
+                const taken = event !== undefined &&
+                    (await (config.broker?.({ event, env }).catch(() => false) ?? true));
+                if (taken)
+                    message.ack();
+                else
+                    message.retry({ delaySeconds: backoff(message.attempts) });
+            }));
+        }
+        await record(rows, env);
+    }
+    async function deliveries(batch, env) {
+        const hub = config.hub(env);
+        const deadLetter = config.deadLetter(env);
+        const rows = [];
+        await Promise.all(batch.messages.map(async (message) => {
+            const delivery = message.body;
+            try {
+                // `attempts` is the Queue's own count, and the one `deliver` backs off by.
+                const outcome = await hub.deliver({ ...delivery, attempt: message.attempts });
+                if ("retryAfterSeconds" in outcome) {
+                    message.retry({ delaySeconds: outcome.retryAfterSeconds });
+                    return;
+                }
+                if (outcome.gaveUp === undefined) {
+                    message.ack();
+                    return;
+                }
+                const { reason, status } = outcome.gaveUp;
+                await setAside({
+                    message,
+                    kept: { kind: "delivery", delivery, gaveUp: outcome.gaveUp },
+                    deadLetter,
+                    rows,
+                    row: {
+                        at: Date.now(),
+                        level: "warn",
+                        message: "a delivery was given up",
+                        fields: {
+                            subscription: delivery.subscription,
+                            event: delivery.event.id,
+                            type: delivery.event.type,
+                            reason,
+                            ...(status === null ? {} : { status }),
+                        },
+                    },
+                });
+            }
+            catch {
+                // The store could not be reached: nothing was settled.
+                message.retry({ delaySeconds: backoff(message.attempts) });
+            }
+        }));
+        await record(rows, env);
+    }
+    return async (batch, env) => {
+        // The two bodies differ, and the Queue's name is what says which this batch carries.
+        if (batch.queue === config.queues.events) {
+            await events(batch, env);
+        }
+        else if (batch.queue === config.queues.deliveries) {
+            await deliveries(batch, env);
+        }
+        else {
+            throw new Error(`consumeQueues: ${batch.queue} is neither of the Queues it was given.`);
+        }
+    };
+}