@harperfast/harper 5.3.0-alpha.1 → 5.3.0-beta.2

package/dist/dataLayer/restoreMarker.js

@@ -41,17 +41,26 @@ const rocksdb_js_1 = require("@harperfast/rocksdb-js");
  *   duration of a restore, and briefly by `dropDatabase` so the two serialize on the same primitive.
  *   Known limitation: the lock is owned by the process, so if the restore job's worker *thread*
  *   dies without the process exiting, the lock stays held (restores 409) until Harper restarts.
- * - `<meta-dir>/<key>.restoring` — the completion marker. Written (and fsynced) after the lock is
- *   acquired and before the destructive restore begins; deleted only after the restore completes
- *   successfully, while still holding the lock. Its *existence* means "a restore started and has
- *   not finished successfully". Its first line records the database directory name so the startup
- *   scan can map a marker back to the database it blocks without decoding the hashed key.
+ * - `<meta-dir>/<key>.restoring` — the completion marker. Published (temp → fsync → rename → parent
+ *   fsync) after the lock is acquired and before the destructive restore begins; deleted only after
+ *   the restore completes successfully, while still holding the lock. Its *existence* means "a
+ *   restore started and has not finished successfully". Its first line records the database
+ *   directory name as a fallback so the startup scan can map a marker whose database directory is
+ *   missing without decoding the hashed key.
+ *
+ *   The rename is what makes the marker trustworthy: the marker path only ever holds the previous
+ *   content or the complete new content, so a torn write can never replace a valid marker with one
+ *   the scan reads as empty (and therefore honors as no block). An intact marker is also never
+ *   rewritten at all — see `beginRestore`.
  */
 // The backtick makes this an illegal database name (schemaRegex rejects `/` and backtick only), so
 // it can never collide with a real database directory — see the module header.
 exports.RESTORE_META_DIR = '`restore`';
 exports.RESTORE_LOCK_SUFFIX = '.lock';
 exports.RESTORING_MARKER_SUFFIX = '.restoring';
+// Deliberately not a `.restoring` suffix: `scanBlockedRestores` selects markers by that suffix, and
+// a half-written temp must never be mistaken for one.
+const MARKER_TEMP_SUFFIX = '.tmp';
 /**
  * Directory holding the restore metadata for a database — the reserved `` `restore` `` sibling of
  * the database directory (see the module header for why the name contains a backtick). Shared by
@@ -159,17 +168,29 @@ function releaseRestoreLock(lock) {
     (0, rocksdb_js_1.fileLockRelease)(lock.token);
 }
 /**
- * Acquire the per-database restore lock and write the restoring marker. Call before any
- * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
- * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
- * already holds the lock.
+ * Whether a marker on disk still blocks the database it belongs to. `scanBlockedRestores` maps a
+ * marker to a database by its first line, so the line has to be the whole name: a torn write that
+ * left a prefix of it ("ord" for "orders") is non-empty and reads as valid, but blocks a database
+ * that does not exist while the real one loads.
  */
-function beginRestore(dbPath) {
-    const markerPath = restoringMarkerPath(dbPath);
-    const preexisting = (0, node_fs_1.existsSync)(markerPath);
-    const lock = acquireRestoreLock(dbPath);
+function markerIsIntact(markerPath, dbPath) {
     try {
-        const fd = (0, node_fs_1.openSync)(markerPath, 'w');
+        return (0, node_fs_1.readFileSync)(markerPath, 'utf8').split('\n', 1)[0] === (0, node_path_1.basename)(dbPath);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Publish the restoring marker atomically. The caller must already hold the restore lock, which is
+ * what makes the fixed temp name safe: only one writer per database can exist at a time, so a temp
+ * left by an earlier crash is this database's own debris and is simply overwritten.
+ */
+function publishRestoringMarker(dbPath) {
+    const metaDir = restoreMetaDir(dbPath);
+    const tempPath = (0, node_path_1.join)(metaDir, restoreMetaKey(dbPath) + MARKER_TEMP_SUFFIX);
+    try {
+        const fd = (0, node_fs_1.openSync)(tempPath, 'w');
         try {
             // first line is the database directory name so the startup scan can map this marker back to
             // the database it blocks without reversing the hashed key
@@ -179,9 +200,47 @@ function beginRestore(dbPath) {
         finally {
             (0, node_fs_1.closeSync)(fd);
         }
-        // fsync the metadata directory so the marker's directory entry is durable — without this a
-        // power loss can lose the entry, and a half-purged database would load as healthy
-        fsyncDir(restoreMetaDir(dbPath));
+        (0, node_fs_1.renameSync)(tempPath, restoringMarkerPath(dbPath));
+    }
+    catch (error) {
+        try {
+            (0, node_fs_1.unlinkSync)(tempPath);
+        }
+        catch {
+            // debris either way; the write failure is the error worth reporting
+        }
+        throw error;
+    }
+    // fsync the metadata directory so the marker's directory entry is durable — without this a
+    // power loss can lose the entry, and a half-purged database would load as healthy
+    fsyncDir(metaDir);
+}
+/**
+ * Acquire the per-database restore lock and ensure the restoring marker is in place. Call before any
+ * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
+ * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
+ * already holds the lock.
+ *
+ * An intact marker is left exactly as it is. A recovery attempt runs over a directory an earlier
+ * restore may have half-purged, so the marker it finds is the only thing keeping that directory
+ * from loading as healthy; rewriting it buys nothing (the content it would write is the content
+ * already there) and risks everything.
+ */
+function beginRestore(dbPath) {
+    const markerPath = restoringMarkerPath(dbPath);
+    const lock = acquireRestoreLock(dbPath);
+    // Sampled while holding the lock, not before it: a restore that waited out an earlier one would
+    // otherwise carry the earlier run's "no marker" reading, and on its own pre-destruction failure
+    // clear the marker protecting a directory that run had already half-purged.
+    const preexisting = (0, node_fs_1.existsSync)(markerPath);
+    try {
+        if (!preexisting || !markerIsIntact(markerPath, dbPath))
+            publishRestoringMarker(dbPath);
+        // An intact marker is kept, but its durability is not assumed: the publisher that wrote it may
+        // have been interrupted between the rename and this flush, which would leave the directory
+        // entry — the thing the startup scan reads — still only in the page cache.
+        else
+            fsyncDir(restoreMetaDir(dbPath));
     }
     catch (error) {
         (0, rocksdb_js_1.fileLockRelease)(lock.token);
@@ -230,8 +289,10 @@ function clearRestoreMarker(lock) {
     }
 }
 /**
- * Scan a databases root's reserved `` `restore` `` metadata directory and report every database currently blocked from
- * loading, mapping each surviving marker back to its database name via the marker's first line.
+ * Scan a databases root's reserved `` `restore` `` metadata directory and report every database
+ * currently blocked from loading. Existing database entries are mapped to markers by their hashed
+ * keys, so corrupt marker contents cannot unblock them; the first line remains the fallback for a
+ * marker whose database directory is missing.
  * Returns `[dbName, state]` pairs for markers whose state is `in-progress` or `incomplete`
  * (a `clear` result means the marker was removed concurrently and the database is loadable).
  */
@@ -239,19 +300,25 @@ function scanBlockedRestores(databasesRoot) {
     const metaDir = (0, node_path_1.join)(databasesRoot, exports.RESTORE_META_DIR);
     if (!(0, node_fs_1.existsSync)(metaDir))
         return [];
+    const databaseNamesByMarker = new Map((0, node_fs_1.readdirSync)(databasesRoot, { withFileTypes: true })
+        .filter((entry) => entry.name !== exports.RESTORE_META_DIR)
+        .map((entry) => [restoreMetaKey((0, node_path_1.join)(databasesRoot, entry.name)) + exports.RESTORING_MARKER_SUFFIX, entry.name]));
     const blocked = [];
     for (const entry of (0, node_fs_1.readdirSync)(metaDir, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(exports.RESTORING_MARKER_SUFFIX))
             continue;
-        let dbName;
-        try {
-            dbName = (0, node_fs_1.readFileSync)((0, node_path_1.join)(metaDir, entry.name), 'utf8').split('\n', 1)[0];
-        }
-        catch {
-            continue; // marker removed concurrently
+        const markerPath = (0, node_path_1.join)(metaDir, entry.name);
+        let dbName = databaseNamesByMarker.get(entry.name);
+        if (!dbName) {
+            try {
+                dbName = (0, node_fs_1.readFileSync)(markerPath, 'utf8').split('\n', 1)[0];
+            }
+            catch {
+                continue; // marker removed concurrently
+            }
+            if (!dbName || restoringMarkerPath((0, node_path_1.join)(databasesRoot, dbName)) !== markerPath)
+                continue;
         }
-        if (!dbName)
-            continue;
         const state = checkRestoreState((0, node_path_1.join)(databasesRoot, dbName));
         if (state !== 'clear')
             blocked.push([dbName, state]);

package/dist/dataLayer/restoreMarker.js.map

@@ -1 +1 @@
-{"version":3,"file":"restoreMarker.js","sourceRoot":"","sources":["../../dataLayer/restoreMarker.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;AA4Db,wCAEC;AAaD,0CAEC;AAED,kDAEC;AAWD,oDAEC;AAiCD,8CASC;AA2BD,gDASC;AAKD,gDAEC;AAQD,oCAsBC;AAMD,0CAUC;AAMD,wCAEC;AAOD,gDAUC;AAQD,kDAiBC;AAjRD,qCAUiB;AACjB,yCAAoD;AACpD,6CAAyC;AACzC,uDAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mGAAmG;AACnG,+EAA+E;AAClE,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAC9B,QAAA,uBAAuB,GAAG,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC5C,OAAO,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,wBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC7C,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,2BAAmB,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAc;IACjD,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,+BAAuB,CAAC,CAAC;AACvF,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC/C,IAAI,CAAC,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC;QACtC,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QAC1F,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAChD,IAAA,mBAAS,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAQ,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACJ,4FAA4F;YAC5F,0DAA0D;YAC1D,IAAA,mBAAS,EAAC,EAAE,EAAE,GAAG,IAAA,oBAAQ,EAAC,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,IAAiB;IAChD,IAAI,CAAC;QACJ,IAAA,oBAAU,EAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,yFAAyF;QACzF,wFAAwF;QACxF,2EAA2E;QAC3E,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,IAAiB;IAC/C,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;YACvB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,aAAqB;IACxD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,wBAAgB,CAAC,CAAC;IACtD,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,IAAA,qBAAW,EAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,+BAAuB,CAAC;YAAE,SAAS;QAC/E,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACR,SAAS,CAAC,8BAA8B;QACzC,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"restoreMarker.js","sourceRoot":"","sources":["../../dataLayer/restoreMarker.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;AAsEb,wCAEC;AAaD,0CAEC;AAED,kDAEC;AAWD,oDAEC;AAiCD,8CASC;AA2BD,gDASC;AAKD,gDAEC;AA2DD,oCAkBC;AAMD,0CAUC;AAMD,wCAEC;AAOD,gDAUC;AAUD,kDAyBC;AApVD,qCAWiB;AACjB,yCAAoD;AACpD,6CAAyC;AACzC,uDAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,mGAAmG;AACnG,+EAA+E;AAClE,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAC9B,QAAA,uBAAuB,GAAG,YAAY,CAAC;AACpD,oGAAoG;AACpG,sDAAsD;AACtD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC5C,OAAO,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,wBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC7C,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,2BAAmB,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAc;IACjD,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,+BAAuB,CAAC,CAAC;AACvF,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC/C,IAAI,CAAC,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC;QACtC,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QAC1F,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAChD,IAAA,mBAAS,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAQ,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,MAAc;IACzD,IAAI,CAAC;QACJ,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACJ,4FAA4F;YAC5F,0DAA0D;YAC1D,IAAA,mBAAS,EAAC,EAAE,EAAE,GAAG,IAAA,oBAAQ,EAAC,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAA,oBAAU,EAAC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACJ,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;QACrE,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,2FAA2F;IAC3F,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,gGAAgG;IAChG,gGAAgG;IAChG,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC;YAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxF,+FAA+F;QAC/F,2FAA2F;QAC3F,2EAA2E;;YACtE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,IAAiB;IAChD,IAAI,CAAC;QACJ,IAAA,oBAAU,EAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,yFAAyF;QACzF,wFAAwF;QACxF,2EAA2E;QAC3E,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,IAAiB;IAC/C,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;YACvB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,aAAqB;IACxD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,wBAAgB,CAAC,CAAC;IACtD,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACpC,IAAA,qBAAW,EAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,wBAAgB,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,+BAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACzG,CAAC;IACF,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,IAAA,qBAAW,EAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,+BAAuB,CAAC;YAAE,SAAS;QAC/E,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,CAAC,8BAA8B;YACzC,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU;gBAAE,SAAS;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { RequestTarget } from './resources/RequestTarget.ts';
 export { flushDatabases } from './resources/databases.ts';
+export { registerReplicatedApplyFailureListener, unregisterReplicatedApplyFailureListener, type ReplicatedApplyFailure, type ReplicatedApplyFailureListener, } from './resources/replicatedApplyFailure.ts';
 export { getContext, getResponse, getUser } from './security/jsLoader.ts';
+export { markCredentialRejection, credentialRejectionError } from './security/credentialRejection.ts';
 export { defineTable, types } from './resources/defineTable.ts';
 export { defineResource, t, schemaOf, projectTableFragment } from './resources/defineResource.ts';
 export type { Query, Context, Session, SourceContext, SubscriptionRequest, RecordLockOptions, RequestTargetOrId, ResourceInterface, WritableRecord, } from './resources/ResourceInterface.ts';

package/dist/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.projectTableFragment = exports.schemaOf = exports.t = exports.defineResource = exports.types = exports.defineTable = exports.getUser = exports.getResponse = exports.getContext = exports.flushDatabases = exports.RequestTarget = void 0;
+exports.projectTableFragment = exports.schemaOf = exports.t = exports.defineResource = exports.types = exports.defineTable = exports.credentialRejectionError = exports.markCredentialRejection = exports.getUser = exports.getResponse = exports.getContext = exports.unregisterReplicatedApplyFailureListener = exports.registerReplicatedApplyFailureListener = exports.flushDatabases = exports.RequestTarget = void 0;
 // Prevents server from starting in worker threads if this was directly imported from a non-server user thread
 const node_worker_threads_1 = __importDefault(require("node:worker_threads"));
 if (!node_worker_threads_1.default.isMainThread) {
@@ -17,10 +17,18 @@ var RequestTarget_ts_1 = require("./resources/RequestTarget.js");
 Object.defineProperty(exports, "RequestTarget", { enumerable: true, get: function () { return RequestTarget_ts_1.RequestTarget; } });
 var databases_ts_1 = require("./resources/databases.js");
 Object.defineProperty(exports, "flushDatabases", { enumerable: true, get: function () { return databases_ts_1.flushDatabases; } });
+var replicatedApplyFailure_ts_1 = require("./resources/replicatedApplyFailure.js");
+Object.defineProperty(exports, "registerReplicatedApplyFailureListener", { enumerable: true, get: function () { return replicatedApplyFailure_ts_1.registerReplicatedApplyFailureListener; } });
+Object.defineProperty(exports, "unregisterReplicatedApplyFailureListener", { enumerable: true, get: function () { return replicatedApplyFailure_ts_1.unregisterReplicatedApplyFailureListener; } });
 var jsLoader_ts_1 = require("./security/jsLoader.js");
 Object.defineProperty(exports, "getContext", { enumerable: true, get: function () { return jsLoader_ts_1.getContext; } });
 Object.defineProperty(exports, "getResponse", { enumerable: true, get: function () { return jsLoader_ts_1.getResponse; } });
 Object.defineProperty(exports, "getUser", { enumerable: true, get: function () { return jsLoader_ts_1.getUser; } });
+// An untagged error from a `server.getUser` override is treated as an internal fault; these tag one
+// as a rejected credential, which authentication defers to the route owner instead (#2703).
+var credentialRejection_ts_1 = require("./security/credentialRejection.js");
+Object.defineProperty(exports, "markCredentialRejection", { enumerable: true, get: function () { return credentialRejection_ts_1.markCredentialRejection; } });
+Object.defineProperty(exports, "credentialRejectionError", { enumerable: true, get: function () { return credentialRejection_ts_1.credentialRejectionError; } });
 // Code-first schema authoring: declare a table as a TypeScript value; the returned
 // handle is the live, registered table class with per-verb shapes inferred from the definition.
 var defineTable_ts_1 = require("./resources/defineTable.js");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";;;;;;AAAA,8GAA8G;AAC9G,8EAAgD;AAChD,IAAI,CAAC,6BAAa,CAAC,YAAY,EAAE,CAAC;IACjC,4GAA4G;IAC5G,IAAI,CAAC,6BAAa,CAAC,UAAU;QAAE,6BAAa,CAAC,UAAU,GAAG,EAAE,CAAC;IAC7D,6BAAa,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,iEAA6D;AAApD,iHAAA,aAAa,OAAA;AACtB,yDAA0D;AAAjD,8GAAA,cAAc,OAAA;AACvB,sDAA0E;AAAjE,yGAAA,UAAU,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,sGAAA,OAAO,OAAA;AACzC,mFAAmF;AACnF,gGAAgG;AAChG,6DAAgE;AAAvD,6GAAA,WAAW,OAAA;AAAE,uGAAA,KAAK,OAAA;AAE3B,+EAA+E;AAC/E,qGAAqG;AACrG,2FAA2F;AAC3F,mEAAkG;AAAzF,mHAAA,cAAc,OAAA;AAAE,sGAAA,CAAC,OAAA;AAAE,6GAAA,QAAQ,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAyJ1D,oEAAoE;AACpE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;AAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;AAC/B,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;AACvB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;AAC3B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;AAC7B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC5B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC;AACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AAEhC,yCAAyC;AACzC,gGAAgG;AAChG,oDAAoD;AACpD,sEAA2D;AAE3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAO,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";;;;;;AAAA,8GAA8G;AAC9G,8EAAgD;AAChD,IAAI,CAAC,6BAAa,CAAC,YAAY,EAAE,CAAC;IACjC,4GAA4G;IAC5G,IAAI,CAAC,6BAAa,CAAC,UAAU;QAAE,6BAAa,CAAC,UAAU,GAAG,EAAE,CAAC;IAC7D,6BAAa,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,iEAA6D;AAApD,iHAAA,aAAa,OAAA;AACtB,yDAA0D;AAAjD,8GAAA,cAAc,OAAA;AACvB,mFAK+C;AAJ9C,mJAAA,sCAAsC,OAAA;AACtC,qJAAA,wCAAwC,OAAA;AAIzC,sDAA0E;AAAjE,yGAAA,UAAU,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,sGAAA,OAAO,OAAA;AACzC,oGAAoG;AACpG,4FAA4F;AAC5F,4EAAsG;AAA7F,iIAAA,uBAAuB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AAC1D,mFAAmF;AACnF,gGAAgG;AAChG,6DAAgE;AAAvD,6GAAA,WAAW,OAAA;AAAE,uGAAA,KAAK,OAAA;AAE3B,+EAA+E;AAC/E,qGAAqG;AACrG,2FAA2F;AAC3F,mEAAkG;AAAzF,mHAAA,cAAc,OAAA;AAAE,sGAAA,CAAC,OAAA;AAAE,6GAAA,QAAQ,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAyJ1D,oEAAoE;AACpE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;AAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;AAC/B,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;AACvB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;AAC3B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;AAC7B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC5B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC;AACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AAEhC,yCAAyC;AACzC,gGAAgG;AAChG,oDAAoD;AACpD,sEAA2D;AAE3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAO,CAAC,CAAC"}

package/dist/json/systemSchema.json

@@ -424,6 +424,9 @@
             {
                 "attribute": "rollback_of"
             },
+            {
+                "attribute": "activated_from"
+            },
             {
                 "attribute": "error"
             },

package/dist/resources/DatabaseTransaction.d.ts

@@ -48,6 +48,8 @@ declare class StartedTransaction extends Error {
  * transactions, while core keeps the consistency guarantee.
  */
 export declare function transactionOpenTooLongError(): ServerError;
+export declare function getReadTransactionGuard(transaction: ReadTransaction): (() => void) | undefined;
+export declare function trackReadRange(transaction: ReadTransaction, createRange: () => any): any;
 type MaybePromise<T> = T | Promise<T>;
 export type CommitOptions = {
     doneWriting?: boolean;
@@ -62,6 +64,10 @@ type ReadTransaction = (LMDBTransaction | RocksTransaction) & {
     isDone?: boolean;
     isCommitted?: boolean;
 };
+export type WriteGeneration = {
+    closed: boolean;
+    internalWrites: number;
+};
 export type TransactionWrite = {
     key: Id;
     store: any;
@@ -96,7 +102,12 @@ export type TransactionWrite = {
     trackRecordVersion?: boolean;
     recordVersionApplied?: boolean;
     innerCommit?: MaybePromise<CommitResolution>;
+    reloadCommitBase?: boolean;
+    writeGeneration?: WriteGeneration;
+    instanceClosed?: boolean;
 };
+export declare function closeWriteInstance(operation: TransactionWrite | null | undefined): void;
+export declare function validateWrite(operation: TransactionWrite, txnTime: number, transaction: DatabaseTransaction): any;
 export declare function getAppliedWriteVersion(recordVersion: number | undefined, txnLogKey: number): number;
 /**
  * The state a preceding write in this transaction left for `operation`'s key, or undefined if this
@@ -128,6 +139,7 @@ export declare class DatabaseTransaction implements Transaction {
         scopeOwned?: boolean;
     });
     writes: TransactionWrite[];
+    ownedWrites?: WeakSet<TransactionWrite>;
     writesByKey?: Map<any, Map<unknown, TransactionWrite>>;
     completions: Promise<void>[];
     db: RootDatabaseKind;
@@ -169,8 +181,21 @@ export declare class DatabaseTransaction implements Transaction {
     commitPhaseTicks: number;
     commitChainHead?: DatabaseTransaction;
     recordLocks?: Map<any, Map<unknown, RecordLockHandle>>;
+    /**
+     * Whether any staged write was made through a record lock handle. The commit-time lease fence
+     * below is skipped entirely when this is false, which is every transaction in a core-only
+     * deployment: without it a bulk transaction of 100,000 plain writes pays 100,000 property checks
+     * before submission, on a path that is supposed to be untouched when no lock is involved. It
+     * latches rather than tracking a count, because a write whose handle was released or expired after
+     * staging is exactly what the fence exists to catch.
+     */
+    hasLeaseProtectedWrite?: boolean;
     pendingLocks?: Map<any, Map<unknown, Promise<RecordLockHandle>>>;
     setCommitPhase(committing: boolean): void;
+    rangeReadActive: boolean;
+    renewReadTimeout(): void;
+    renewIdleTimeout(): void;
+    renewChainForNativeCommit(): void;
     getReadTxn(disableSnapshot?: boolean): ReadTransaction;
     private attachOwnedTransaction;
     /**