@rulvar/store-sqlite 1.44.0 → 1.44.1

package/dist/index.d.ts

@@ -27,6 +27,17 @@ declare class SqliteStore implements MetaLookupStore, LeasableStore {
   private liveLease;
   /** Rejects unless `lease` is the CURRENT live lease for its run. */
   private assertFencing;
+  /**
+  * Runs the fence check and the guarded mutation as ONE immediate
+  * transaction, the same shape acquire already uses: BEGIN IMMEDIATE
+  * takes the write lock BEFORE the check reads the lease row, so a
+  * competing takeover cannot land between the check and the mutation
+  * (it serializes behind the commit and the loser sees the final rows).
+  * As two autocommit statements, a takeover in that window let a
+  * superseded holder mutate live state (fenced-run-state RFC, F3).
+  */
+  private fenced;
+  private insertEntry;
   append(runId: string, e: JournalEntry, lease?: Lease): Promise<void>;
   load(runId: string): Promise<JournalEntry[]>;
   putMeta(m: RunMeta): Promise<void>;

package/dist/index.js

@@ -14,7 +14,13 @@ import { ConfigError, JournalOrderViolation, LeaseHeldError, metaMatchesFilter }
 *   through untouched.
 * - Fencing: the epoch is monotonic per run for the store's lifetime;
 *   an append carrying a stale or released lease rejects with the typed
-*   LeaseHeldError and the entry never becomes visible.
+*   LeaseHeldError and the entry never becomes visible. The fence check
+*   and the guarded mutation (append's insert, renew's extension,
+*   release's deletion) commit as ONE immediate transaction: checking in
+*   one autocommit statement and mutating in the next left a
+*   cross-process window where a takeover landing between them let the
+*   superseded holder append a visible entry, extend the successor's
+*   lease, or delete it outright (the fenced-run-state RFC, finding F3).
 * - acquire on a held, unexpired lease rejects with LeaseHeldError; the
 *   holder MUST renew at an interval of at most ttl/3; an unrenewed
 *   lease is reclaimable after ttl and reclaiming advances the epoch.
@@ -77,14 +83,42 @@ var SqliteStore = class {
 		const live = this.liveLease(lease.runId);
 		if (live === void 0 || live.owner !== lease.owner || live.epoch !== lease.epoch) throw new LeaseHeldError(`stale fencing epoch for run '${lease.runId}': lease (owner ${lease.owner}, epoch ${lease.epoch}) is not the current holder; the append or renew is rejected and nothing became visible`);
 	}
-	async append(runId, e, lease) {
-		if (lease !== void 0) this.assertFencing(lease);
+	/**
+	* Runs the fence check and the guarded mutation as ONE immediate
+	* transaction, the same shape acquire already uses: BEGIN IMMEDIATE
+	* takes the write lock BEFORE the check reads the lease row, so a
+	* competing takeover cannot land between the check and the mutation
+	* (it serializes behind the commit and the loser sees the final rows).
+	* As two autocommit statements, a takeover in that window let a
+	* superseded holder mutate live state (fenced-run-state RFC, F3).
+	*/
+	fenced(lease, mutate) {
+		this.db.exec("BEGIN IMMEDIATE");
+		try {
+			this.assertFencing(lease);
+			mutate();
+			this.db.exec("COMMIT");
+		} catch (thrown) {
+			this.db.exec("ROLLBACK");
+			throw thrown;
+		}
+	}
+	insertEntry(runId, e) {
 		if (!Number.isFinite(e.seq)) {
 			this.db.prepare("INSERT INTO entries (run_id, payload) VALUES (?, ?)").run(runId, JSON.stringify(e));
 			return;
 		}
 		if (this.db.prepare("INSERT INTO entries (run_id, payload) SELECT ?, ? WHERE NOT EXISTS (SELECT 1 FROM entries WHERE run_id = ? AND CAST(json_extract(payload, '$.seq') AS INTEGER) >= ?)").run(runId, JSON.stringify(e), runId, e.seq).changes === 0) throw new JournalOrderViolation(`SqliteStore: append of seq ${e.seq} to run '${runId}' is not after the stored tail seq; a concurrent writer raced this journal from a stale tail`);
 	}
+	async append(runId, e, lease) {
+		if (lease !== void 0) {
+			this.fenced(lease, () => {
+				this.insertEntry(runId, e);
+			});
+			return;
+		}
+		this.insertEntry(runId, e);
+	}
 	async load(runId) {
 		return this.db.prepare("SELECT payload FROM entries WHERE run_id = ? ORDER BY id").all(runId).map((row) => JSON.parse(row.payload));
 	}
@@ -154,12 +188,14 @@ var SqliteStore = class {
 		}
 	}
 	async renew(l) {
-		this.assertFencing(l);
-		this.db.prepare("UPDATE leases SET expires_at = ? WHERE run_id = ?").run(this.now() + this.ttlMs, l.runId);
+		this.fenced(l, () => {
+			this.db.prepare("UPDATE leases SET expires_at = ? WHERE run_id = ? AND owner = ? AND epoch = ?").run(this.now() + this.ttlMs, l.runId, l.owner, l.epoch);
+		});
 	}
 	async release(l) {
-		this.assertFencing(l);
-		this.db.prepare("DELETE FROM leases WHERE run_id = ?").run(l.runId);
+		this.fenced(l, () => {
+			this.db.prepare("DELETE FROM leases WHERE run_id = ? AND owner = ? AND epoch = ?").run(l.runId, l.owner, l.epoch);
+		});
 	}
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/store-sqlite",
-  "version": "1.44.0",
+  "version": "1.44.1",
   "description": "Rulvar SQLite store implementing JournalStore and LeasableStore with a fencing epoch.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,13 +22,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@rulvar/core": "1.44.0"
+    "@rulvar/core": "1.44.1"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",
     "tsdown": "^0.22.3",
     "typescript": "~6.0.3",
-    "@rulvar/store-conformance": "1.44.0"
+    "@rulvar/store-conformance": "1.44.1"
   },
   "repository": {
     "type": "git",