@blamejs/core 0.6.34 → 0.6.35

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.35** (2026-05-02) — `cluster-provider-db` MySQL dialect. **`b.cluster.create({ provider: clusterProviderDb.create({ dialect: "mysql", ... }) })`** — operators on MySQL no longer have to supply their own provider; the framework's default DB-row leader-election provider now speaks all three of postgres / sqlite / mysql. The MySQL acquireLease shape uses `INSERT INTO _blamejs_leader (...) VALUES (...) ON DUPLICATE KEY UPDATE col = IF(expiresAt < ?, VALUES(col), col), ..., expiresAt = IF(expiresAt < ?, VALUES(expiresAt), expiresAt)` so a still-valid lease is preserved untouched and an expired one is overwritten — atomic at the row level — followed by a `SELECT FROM _blamejs_leader WHERE scope='leader'` to read who holds (MySQL has no `RETURNING`). The expiresAt assignment runs LAST so per-column IF() predicates evaluate against pre-update row state. Renew uses `UPDATE ... SET expiresAt=?, endpoint=? WHERE scope='leader' AND nodeId=? AND leaseId=?` followed by a check-SELECT to surface takeover races as `LEASE_LOST`. Schema generation: `BIGINT` int columns (was `INTEGER` for SQLite), `VARCHAR(64)` for primary-key text columns and `VARCHAR(255)` for body text (MySQL needs explicit lengths on PRIMARY KEY columns), `CHECK (scope = 'leader' / 'state')` constraint dropped on MySQL because some MariaDB / MySQL 5.x versions parse-then-silently-drop CHECK clauses (would surface as version drift); the constant-scope invariant is enforced by application code anyway. Placeholder style auto-flips to `?` for MySQL (Postgres / SQLite continue to use `$1..$N`). **Tests**: 16 layer-1 assertions exercising the MySQL dialect path against a fake mysql-shaped driver (`_makeFakeMysqlDriver` in `test/helpers/drivers.js`) that emulates `INSERT ... ON DUPLICATE KEY UPDATE` with the per-column `IF()` semantics; covers acquire-empty, blocked-while-held, renew-no-fencing-bump, takeover-with-fencing-bump, old-leader-renew-throws-LEASE_LOST, currentLeader, releaseLease — plus a SQL-shape audit (validates VARCHAR primary keys, ON DUPLICATE KEY syntax, ?-placeholders, IF() gating). 14 live integration assertions against the docker MySQL 8.4 container via a docker-exec-based external-db driver shim (no npm mysql client; the framework already requires operator-supplied driver wiring, the shim demonstrates one path) covering ensureSchema, acquireLease, blocked-second-node, currentLeader, renewLease, release, takeover-after-expiry, fencingToken bump, old-leader LEASE_LOST. Smoke 6833 / wiki e2e 178 / per-primitive integration 16 files / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.34** (2026-05-02) — distributed pub/sub primitive. **`b.pubsub`** — single API for cross-node fan-out across the framework, with three backends. `local` dispatches in-process to registered handlers (zero coordination overhead for single-node deploys); `cluster` polls a shared `_blamejs_pubsub_messages` table at `pollIntervalMs` (default 100ms) and dispatches new rows past `lastSeenId` from other nodes (publishedBy=self filter prevents loopback); `redis` opens a SUBSCRIBE-mode connection on `lib/redis-client.js` (now with new push-message demultiplexing — server-pushed `["message", channel, payload]` and `["pmessage", pattern, channel, payload]` arrays route through `setOnPushMessage` instead of consuming a pending request slot, while SUBSCRIBE / UNSUBSCRIBE acks still flow through the normal command pipeline). Per-instance nonce stamped on outgoing redis payloads so the SUBSCRIBE socket recognizes its own publishes and skips the loopback (without it every same-instance publish would fire local handlers twice). Operator API: `ps.subscribe(channel, handler) → token`, `ps.subscribePattern(pattern, handler) → token` (glob-style on local + cluster, native PSUBSCRIBE on redis), `ps.unsubscribe(token)`, `await ps.publish(channel, payload) → { local, remote }`, `await ps.close()`. `topicPrefix` opt scopes channel names so independent pubsub instances sharing a backend (cache invalidation + websocket channels + custom) don't collide. Handler errors are caught + logged via the framework's boot logger; they never abort dispatch to other handlers on the same channel. **`lib/websocket-channels.js`** — replaces the inline cluster-poll-and-fan-out logic with `b.pubsub` consumption. The hub now owns one pubsub instance per primitive; cross-node delivery is `pubsub.subscribe` per channel the hub joins, with the hub's `_localDispatch` as the handler. Per-channel pubsub subscription is refcounted by local conn count (subscribe on first conn, unsubscribe on last). The `_blamejs_ws_messages` table is renamed to `_blamejs_pubsub_messages` (column `channel` → `topic`) reflecting the generalization; pre-v1, no compat shim — operators upgrading wipe the previous table (which carried only ephemeral fan-out rows with default 60s retention). **`b.cache.create({ invalidationPubsub })`** — passing a `b.pubsub.create()` instance auto-publishes on every successful `del` / `clear` / `invalidateTag`, and subscribes for the same events so other cache instances on other nodes (or processes sharing the pubsub backend) react locally — primarily useful for the memory backend so stale per-node entries don't survive a global tag wipe. Re-entrancy guard prevents inbound invalidation events from re-publishing (no fan-out loops). Tests: 29 layer-0 assertions covering local + cluster behavior, topicPrefix isolation, pattern subscribe, handler error isolation, post-close error path, end-to-end cache invalidationPubsub fan-out via local pubsub. 10 live integration assertions against the docker redis container covering single-instance round-trip, PSUBSCRIBE pattern, cross-instance fan-out, and cache invalidation through redis PUB/SUB. Smoke 6817 / wiki e2e 178 / per-primitive integration 15 files / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.33** (2026-05-02) — log-stream sinks parity sweep. **`b.logStream` syslog sink (RFC 5424)** — first-class `protocol: "syslog"` for `b.logStream.init({ sinks: { ... } })`; new module `lib/log-stream-syslog.js`. URL-driven transport selection: `udp://host:514` / `tcp://host:514` / `tls://host:6514`. UDP is best-effort one-datagram-per-record; TCP / TLS use RFC 6587 octet-counting framing (`<length> <message>`) so collectors that prefer it over the older non-transparent newline framing parse cleanly. TLS is TLS 1.3 minimum; operators with private CAs pass `ca` (PEM string or array) for trust pinning, `servername` for SNI override (auto-suppressed on IP literals per the v0.6.28 redis-client convention). Outgoing records are formatted with PRI = `(facility << 3) | severity`, default facility `local0` (16), severity mapped from the framework's level field (debug=7 / info=6 / warn=4 / error=3); operators override via `facility`, `appName` (default `blamejs`), `procId` (default `process.pid`), `hostname` (default `os.hostname()`), `structuredData` (default `-`). Meta is JSON-encoded into the MSG body so the structured payload survives the wire as a single token. TCP / TLS reconnect with exponential backoff (default 250ms→30s); records buffer during the down window with `bufferLimit`-bounded oldest-drop semantics, replay on reconnect. `close()` waits up to 3s for an in-flight (re)connect to drain the buffer before tearing down — without this the slower TLS handshake raced fire-and-forget shutdown emits and silently dropped records. Operator-supplied `onDrop({reason, batch, error})` surfaces every drop class (`overflow` / `udp-send-error` / `write-error` / `sink-closed`). Removed `syslog` from `DEFERRED_PROTOCOLS`. **`b.logStream` cloudwatch sink: `autoCreate`** — pass `{ autoCreate: true }` to have the framework issue `CreateLogGroup` + `CreateLogStream` on first emit so operators provisioning collectors via env vars / runbooks don't need a separate aws-cli step. Idempotent: AWS's `ResourceAlreadyExistsException` is treated as success on both calls. Hard failures (5xx, AccessDenied, etc.) drop the batch with `onDrop` reason `autocreate-failed`. Default remains `autoCreate: false` so the AWS posture (operator pre-creates via aws / CDK / Terraform) stays the recommended path; `autoCreate` exists for ephemeral / dynamic-stream deployments where pre-provisioning is impractical. **Test suite**: 19 new framework-level cloudwatch assertions cover autoCreate fires both Create calls in order before PutLogEvents, ResourceAlreadyExists doesn't abort the post-create PutLogEvents, hard 5xx during CreateLogGroup drops the batch via `onDrop`, autoCreate=false skips Create calls entirely. Live syslog integration covers UDP / TCP wire delivery against the docker syslog-ng container (`/var/log/blamejs-test.log`) plus an in-process `tls.createServer` receiver that asserts the on-the-wire RFC 6587 octet-counting framing + RFC 5424 PRI / timestamp / structured-data slot the framework emits over TLS. **Test infrastructure fix**: `docker/init/generate-certs.sh` was overwriting an existing CA when re-run with `.complete` removed, invalidating every previously-issued leaf cert; now reuses an existing `(ca.crt, ca.key)` pair across `.complete`-only resets and only generates a fresh CA when neither file is present. Smoke 6790 / wiki e2e 178 / per-primitive integration 14 files (log-stream up from 16→18 checks, cloudwatch suite up from 39→58 assertions) / wiki integration 32 / shellcheck clean / eslint clean.
 - **0.6.32** (2026-05-02) — E1 from the v0.6.x scope plan. **`b.cache` Redis backend** — first-class `backend: "redis"` for `b.cache.create({...})`, no operator-supplied glue needed. New module `lib/cache-redis.js` consumes `lib/redis-client.js` directly; storage layout: `<namespace>:e:<key>` (STRING, JSON-encoded value, PEXPIREAT-bounded), `<namespace>:t:<tag>` (SET, cacheKeys carrying that tag — powers `invalidateTag` fan-out), `<namespace>:k:<key>:tags` (SET, tags this key carries — powers per-key tag cleanup on `del`/`set`-overwrite, expires alongside the entry). TTL is enforced by Redis itself (PEXPIREAT) so the framework's sweeper is a no-op for this backend; sliding TTL bumps the entry's expiry on every read when `slidingTtl: true` AND `ttlMs` is finite. New opts on `cache.create`: `redisUrl` (required when `backend: "redis"`), `redisPassword`, `redisUsername`, `redisTls`, `redisCa` (private-CA trust pinning per v0.6.28), `redisServername`, `redisConnectTimeoutMs`, `redisCommandTimeoutMs`, `redisMaxReconnectAttempts`. Concurrency: invalidateTag filters out ghost entries (key already PEXPIRE'd from the keyspace but lingering in a tag SET) by EXISTS-checking before del. Lazy connect — `cache.create({backend:"redis"})` stays sync-safe; first op opens the socket. Tests: 10 new live integration assertions on top of the existing memory + custom-backend coverage (set+get round-trip, has, del, complex JSON value round-trip, short-TTL Redis-side expiry, multi-tag invalidateTag fan-out + preservation of untagged entries, wrap() single-flight memoization through Redis). Smoke 6780 / wiki e2e 178 / per-primitive integration 14 files (cache up from 15→25 checks) / wiki integration green.

package/lib/cluster-provider-db.js

@@ -14,11 +14,14 @@
  * which fences out a partitioned old leader even if its application-
  * layer `_requireLeader()` gate somehow allowed the call through.
  *
- * Dialects: Postgres and SQLite use identical surface SQL. MySQL's
- * `ON DUPLICATE KEY UPDATE` doesn't support a WHERE clause; a MySQL
- * fallback (SELECT ... FOR UPDATE inside an explicit transaction) is
- * not yet implemented and operators on MySQL must supply their own
- * provider until it lands.
+ * Dialects: Postgres / SQLite use `INSERT ... ON CONFLICT ... DO
+ * UPDATE WHERE ... RETURNING` (atomic acquire-or-steal in one
+ * statement). MySQL takes a different shape because its
+ * `ON DUPLICATE KEY UPDATE` doesn't support a WHERE clause: each
+ * column update is gated by `IF(expiresAt < <nowMs>, VALUES(col), col)`
+ * so a non-expired lease is preserved untouched, and the followup
+ * SELECT reveals who currently holds the row. Both shapes are
+ * row-level atomic at the database — no client-side locking required.
  *
  * Public API:
  *   create({ externalDbBackend, dialect? }) → provider instance
@@ -55,57 +58,67 @@ function create(config) {
   }
   var backendName = config.externalDbBackend;
   var dialect = (config.dialect || "postgres").toLowerCase();
-  if (dialect !== "postgres" && dialect !== "sqlite") {
+  if (dialect !== "postgres" && dialect !== "sqlite" && dialect !== "mysql") {
     throw _err("UNSUPPORTED_DIALECT",
-      "cluster-provider-db dialect must be 'postgres' or 'sqlite' (got: " + dialect + ")",
+      "cluster-provider-db dialect must be 'postgres', 'sqlite', or 'mysql' (got: " + dialect + ")",
       true);
   }
 
-  // Postgres uses $1/$2 placeholders; SQLite accepts the same so we use
-  // them uniformly. If a future dialect needs ?-placeholders, swap here.
-  function _placeholder(n) { return "$" + n; }
+  // Postgres + SQLite use $1/$2 placeholders; MySQL uses ?. Keeping a
+  // single helper means the SQL builder doesn't have to care.
+  function _placeholder(n) {
+    return dialect === "mysql" ? "?" : "$" + n;
+  }
 
   function _q(sql, params) {
     return externalDb.query(sql, params || [], { backend: backendName });
   }
 
   async function ensureSchema() {
-    // Postgres: BIGINT for ms-precision timestamps. SQLite: INTEGER works
-    // for either; pick INTEGER so the same DDL parses on both.
-    var intType = dialect === "postgres" ? "BIGINT" : "INTEGER";
+    // Postgres + MySQL: BIGINT for ms-precision timestamps. SQLite:
+    // INTEGER (which is wide enough to hold a 64-bit value).
+    var intType = dialect === "sqlite" ? "INTEGER" : "BIGINT";
+    // MySQL needs explicit lengths on TEXT columns when used as a
+    // PRIMARY KEY; VARCHAR(64) covers our scope/nodeId/leaseId values
+    // with room to spare. Postgres and SQLite happily PRIMARY-KEY a
+    // plain TEXT column.
+    var pkText = dialect === "mysql" ? "VARCHAR(64)" : "TEXT";
+    var bodyText = dialect === "mysql" ? "VARCHAR(255)" : "TEXT";
+    // MySQL doesn't enforce CHECK constraints in some MariaDB / older
+    // MySQL versions; the constant-scope invariant is a documentation
+    // belt-and-braces — application code only ever writes 'leader' /
+    // 'state' so the check is informational. Skip on MySQL to avoid
+    // CREATE TABLE failures on installations where CHECK is parsed
+    // but then dropped silently (which would cause version drift).
+    var leaderCheck = dialect === "mysql" ? "" : ", CHECK (scope = 'leader')";
+    var stateCheck  = dialect === "mysql" ? "" : ", CHECK (scope = 'state')";
 
     await _q(
       "CREATE TABLE IF NOT EXISTS _blamejs_leader (" +
-      "  scope         TEXT PRIMARY KEY," +
-      "  nodeId        TEXT NOT NULL," +
-      "  leaseId       TEXT NOT NULL," +
+      "  scope         " + pkText + " PRIMARY KEY," +
+      "  nodeId        " + bodyText + " NOT NULL," +
+      "  leaseId       " + bodyText + " NOT NULL," +
       "  acquiredAt    " + intType + " NOT NULL," +
       "  expiresAt     " + intType + " NOT NULL," +
       "  fencingToken  " + intType + " NOT NULL," +
-      "  endpoint      TEXT," +
-      "  CHECK (scope = 'leader')" +
+      "  endpoint      " + bodyText + leaderCheck +
       ")"
     );
     // Migration for installs that pre-date the endpoint column. Both
     // Postgres (≥9.6) and SQLite (≥3.35, March 2021) support ADD COLUMN
-    // IF NOT EXISTS, but we go through try/catch to keep the path
-    // dialect-version-agnostic — the only "expected" failure here is
-    // "column already exists," which we swallow.
+    // IF NOT EXISTS; MySQL 8.0.29+ does as well. We go through try/catch
+    // to keep the path version-agnostic — the only "expected" failure
+    // here is "column already exists," which we swallow.
     try {
-      await _q("ALTER TABLE _blamejs_leader ADD COLUMN endpoint TEXT");
+      await _q("ALTER TABLE _blamejs_leader ADD COLUMN endpoint " + bodyText);
     } catch (_e) { /* column already exists — fine */ }
 
-    // _blamejs_cluster_state — single-row consistency check used to
-    // detect vault-key drift across cluster nodes. Same single-row
-    // invariant pattern as _blamejs_leader (PRIMARY KEY on a
-    // constant-valued scope column + CHECK).
     await _q(
       "CREATE TABLE IF NOT EXISTS _blamejs_cluster_state (" +
-      "  scope           TEXT PRIMARY KEY," +
-      "  vaultKeyFp      TEXT NOT NULL," +
+      "  scope           " + pkText + " PRIMARY KEY," +
+      "  vaultKeyFp      " + bodyText + " NOT NULL," +
       "  recordedAt      " + intType + " NOT NULL," +
-      "  recordedByNode  TEXT NOT NULL," +
-      "  CHECK (scope = 'state')" +
+      "  recordedByNode  " + bodyText + " NOT NULL" + stateCheck +
       ")"
     );
   }
@@ -120,35 +133,65 @@ function create(config) {
     var nowMs = Date.now();
     var expiresAt = nowMs + leaseTtlMs;
 
-    // Atomic acquire: insert if no row, OR steal if existing row's
-    // expiresAt has passed. Bump fencingToken on every successful
-    // mutation. RETURNING gives us the post-write state — which we
-    // compare to our nodeId to know whether we won.
-    var sql =
-      "INSERT INTO _blamejs_leader " +
-      "  (scope, nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint) " +
-      "VALUES " +
-      "  ('leader', " + _placeholder(1) + ", " + _placeholder(2) + ", " +
-      "   " + _placeholder(3) + ", " + _placeholder(4) + ", 1, " + _placeholder(5) + ") " +
-      "ON CONFLICT (scope) DO UPDATE SET " +
-      "  nodeId       = EXCLUDED.nodeId," +
-      "  leaseId      = EXCLUDED.leaseId," +
-      "  acquiredAt   = EXCLUDED.acquiredAt," +
-      "  expiresAt    = EXCLUDED.expiresAt," +
-      "  fencingToken = _blamejs_leader.fencingToken + 1," +
-      "  endpoint     = EXCLUDED.endpoint " +
-      "WHERE _blamejs_leader.expiresAt < " + _placeholder(6) + " " +
-      "RETURNING nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint";
-
-    var result = await _q(sql, [nodeId, leaseId, nowMs, expiresAt, endpoint, nowMs]);
-
-    if (!result.rows || result.rows.length === 0) {
-      // The WHERE clause excluded the row — someone else still holds.
-      return null;
+    var row;
+    if (dialect === "mysql") {
+      // MySQL has no `ON CONFLICT ... DO UPDATE WHERE` and no
+      // `RETURNING`. Atomicity comes from `INSERT ... ON DUPLICATE
+      // KEY UPDATE` evaluated as one statement; the WHERE-clause
+      // semantics are implemented per-column with `IF(expiresAt <
+      // nowMs, VALUES(col), col)` so a still-valid lease is preserved
+      // and an expired one is overwritten. The follow-up SELECT
+      // reveals who currently holds the row — same as Postgres'
+      // RETURNING but as a separate statement.
+      var insertSql =
+        "INSERT INTO _blamejs_leader " +
+        "  (scope, nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint) " +
+        "VALUES " +
+        "  ('leader', ?, ?, ?, ?, 1, ?) " +
+        "ON DUPLICATE KEY UPDATE " +
+        "  nodeId       = IF(expiresAt < ?, VALUES(nodeId), nodeId)," +
+        "  leaseId      = IF(expiresAt < ?, VALUES(leaseId), leaseId)," +
+        "  acquiredAt   = IF(expiresAt < ?, VALUES(acquiredAt), acquiredAt)," +
+        "  fencingToken = IF(expiresAt < ?, fencingToken + 1, fencingToken)," +
+        "  endpoint     = IF(expiresAt < ?, VALUES(endpoint), endpoint)," +
+        // expiresAt MUST be the last assignment — IF() evaluates each
+        // column against the row state BEFORE that column's update is
+        // applied, so checking expiresAt for the other columns first
+        // and overwriting it last keeps the predicate consistent.
+        "  expiresAt    = IF(expiresAt < ?, VALUES(expiresAt), expiresAt)";
+      await _q(insertSql, [
+        nodeId, leaseId, nowMs, expiresAt, endpoint,
+        nowMs, nowMs, nowMs, nowMs, nowMs, nowMs,
+      ]);
+      var sel = await _q(
+        "SELECT nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint " +
+        "FROM _blamejs_leader WHERE scope = 'leader'"
+      );
+      if (!sel.rows || sel.rows.length === 0) return null;
+      row = sel.rows[0];
+    } else {
+      // Postgres / SQLite — single-statement RETURNING.
+      var sql =
+        "INSERT INTO _blamejs_leader " +
+        "  (scope, nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint) " +
+        "VALUES " +
+        "  ('leader', " + _placeholder(1) + ", " + _placeholder(2) + ", " +
+        "   " + _placeholder(3) + ", " + _placeholder(4) + ", 1, " + _placeholder(5) + ") " +
+        "ON CONFLICT (scope) DO UPDATE SET " +
+        "  nodeId       = EXCLUDED.nodeId," +
+        "  leaseId      = EXCLUDED.leaseId," +
+        "  acquiredAt   = EXCLUDED.acquiredAt," +
+        "  expiresAt    = EXCLUDED.expiresAt," +
+        "  fencingToken = _blamejs_leader.fencingToken + 1," +
+        "  endpoint     = EXCLUDED.endpoint " +
+        "WHERE _blamejs_leader.expiresAt < " + _placeholder(6) + " " +
+        "RETURNING nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint";
+      var result = await _q(sql, [nodeId, leaseId, nowMs, expiresAt, endpoint, nowMs]);
+      if (!result.rows || result.rows.length === 0) return null;
+      row = result.rows[0];
     }
-    var row = result.rows[0];
     if (row.nodeId !== nodeId || row.leaseId !== leaseId) {
-      // Another node won the race (RETURNING showed their values, not ours).
+      // Another node won the race (the row reflects their values, not ours).
       return null;
     }
     return {
@@ -171,24 +214,52 @@ function create(config) {
     var endpoint = (opts && opts.endpoint !== undefined) ? opts.endpoint : lease.endpoint || null;
 
     // Match on (nodeId, leaseId) so a takeover is detectable: if our
-    // leaseId is no longer in the row, 0 rows update and we throw
-    // NotLeader. Don't bump fencingToken on renewal — only on a fresh
-    // acquire.
-    var sql =
-      "UPDATE _blamejs_leader SET " +
-      "  expiresAt = " + _placeholder(1) + "," +
-      "  endpoint  = " + _placeholder(2) + " " +
-      "WHERE scope = 'leader' AND nodeId = " + _placeholder(3) +
-      "  AND leaseId = " + _placeholder(4) + " " +
-      "RETURNING nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint";
-
-    var result = await _q(sql, [newExpiresAt, endpoint, lease.nodeId, lease.leaseId]);
-    if (!result.rows || result.rows.length === 0) {
-      throw _err("LEASE_LOST",
-        "lease for node '" + lease.nodeId + "' was taken over (renewal rejected)",
-        false);
+    // leaseId is no longer in the row, the SELECT-after-UPDATE
+    // returns either no row OR a row with a different leaseId, and
+    // we throw LEASE_LOST. Don't bump fencingToken on renewal — only
+    // on a fresh acquire.
+    var row;
+    if (dialect === "mysql") {
+      var rv = await _q(
+        "UPDATE _blamejs_leader SET " +
+        "  expiresAt = ?, endpoint = ? " +
+        "WHERE scope = 'leader' AND nodeId = ? AND leaseId = ?",
+        [newExpiresAt, endpoint, lease.nodeId, lease.leaseId]
+      );
+      var affected = rv && (rv.affectedRows || rv.rowCount || 0);
+      if (!affected) {
+        throw _err("LEASE_LOST",
+          "lease for node '" + lease.nodeId + "' was taken over (renewal rejected)",
+          false);
+      }
+      var sel = await _q(
+        "SELECT nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint " +
+        "FROM _blamejs_leader WHERE scope = 'leader'"
+      );
+      if (!sel.rows || sel.rows.length === 0 ||
+          sel.rows[0].nodeId !== lease.nodeId ||
+          sel.rows[0].leaseId !== lease.leaseId) {
+        throw _err("LEASE_LOST",
+          "lease for node '" + lease.nodeId + "' was taken over after renewal",
+          false);
+      }
+      row = sel.rows[0];
+    } else {
+      var sql =
+        "UPDATE _blamejs_leader SET " +
+        "  expiresAt = " + _placeholder(1) + "," +
+        "  endpoint  = " + _placeholder(2) + " " +
+        "WHERE scope = 'leader' AND nodeId = " + _placeholder(3) +
+        "  AND leaseId = " + _placeholder(4) + " " +
+        "RETURNING nodeId, leaseId, acquiredAt, expiresAt, fencingToken, endpoint";
+      var result = await _q(sql, [newExpiresAt, endpoint, lease.nodeId, lease.leaseId]);
+      if (!result.rows || result.rows.length === 0) {
+        throw _err("LEASE_LOST",
+          "lease for node '" + lease.nodeId + "' was taken over (renewal rejected)",
+          false);
+      }
+      row = result.rows[0];
     }
-    var row = result.rows[0];
     return {
       nodeId:        row.nodeId,
       leaseId:       row.leaseId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.34",
+  "version": "0.6.35",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:731bee30-9e20-4cc1-87e9-2ca1cf7a6e31",
+  "serialNumber": "urn:uuid:e7b125dc-2b9c-460b-8b32-6ae1b9da3dac",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-02T20:14:03.424Z",
+    "timestamp": "2026-05-02T20:25:21.814Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.34",
+      "bom-ref": "@blamejs/core@0.6.35",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.34",
+      "version": "0.6.35",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.34",
+      "purl": "pkg:npm/%40blamejs/core@0.6.35",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.34",
+      "ref": "@blamejs/core@0.6.35",
       "dependsOn": []
     }
   ]