@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/internal/sqlite-worker/crossTabRuntime.js

@@ -0,0 +1,387 @@
+import { createLocalClient, dispatchCrashToLocalClient, dispatchResponseToLocalClient, failPendingRemoteRequests, releaseLocalClient, } from "./crossTabLocalClient.js";
+import { canUseCrossTabPrimitives, lockManager, } from "./crossTabLocks.js";
+import { CrossTabOwner } from "./crossTabOwner.js";
+import { isOwnerLockHeld, pollForOwner } from "./crossTabOwnership.js";
+import { errorResponse, isCrossTabEnvelope, requestId, requestMethod, } from "./crossTabProtocol.js";
+import { DatabaseWorkerCrashError } from "./workerCrash.js";
+const CROSS_TAB_CHANNEL_NAME = "tearleads-sqlite-worker";
+const CROSS_TAB_OWNER_LOCK_NAME = "tearleads-sqlite-worker-owner";
+const CROSS_TAB_REQUEST_TIMEOUT_MS = 10_000;
+function isTeardownRequest(request) {
+    const method = requestMethod(request);
+    return method === "close" || method === "delete";
+}
+class CrossTabCoordinator {
+    workerUrl;
+    workerConstructor;
+    channel = new BroadcastChannel(CROSS_TAB_CHANNEL_NAME);
+    hasCreatedClient = false;
+    localClientsById = new Map();
+    owner = null;
+    // Set if this tab won ownership but its owner worker failed to construct.
+    // Cleared if a later bid succeeds in installing an owner.
+    ownerError = null;
+    // Resolves when ownership is settled for the current owner generation (this tab
+    // won and installed/failed to construct an owner, or it observed another tab
+    // already owns), so routing never posts remotely while no owner exists.
+    ownershipBidActive = false;
+    ownershipGeneration = 0;
+    ownershipSettled = Promise.resolve();
+    retryOwnershipAfterBid = false;
+    settleOwnershipGate = () => { };
+    constructor(workerUrl, workerConstructor) {
+        this.workerUrl = workerUrl;
+        this.workerConstructor = workerConstructor;
+        this.resetOwnershipGate();
+        this.channel.addEventListener("message", (event) => {
+            this.handleChannelMessage(event);
+        });
+        // Start the first ownership bid; later clients can restart it after teardown.
+        this.contendForOwnership();
+    }
+    createWorker() {
+        const clientId = crypto.randomUUID();
+        const events = new EventTarget();
+        if (this.ownerError && this.hasCreatedClient) {
+            this.ownerError = null;
+            this.retryOwnershipAfterBid = this.ownershipBidActive;
+            this.resetOwnershipGate();
+        }
+        this.localClientsById.set(clientId, createLocalClient(clientId, events));
+        this.hasCreatedClient = true;
+        this.contendForOwnership();
+        return {
+            postMessage: (message) => {
+                this.route(clientId, message);
+            },
+            addEventListener(type, listener) {
+                events.addEventListener(type, listener);
+            },
+            removeEventListener(type, listener) {
+                events.removeEventListener(type, listener);
+            },
+            close: () => {
+                this.unregisterLocalClient(clientId);
+            },
+            forceStopOwner: () => {
+                this.forceStopOwnerFor(clientId);
+            },
+        };
+    }
+    /**
+     * Tear down a possibly-wedged owner on abrupt runtime teardown.
+     *
+     * `this.owner` is normally cleared only when the dedicated worker answers a
+     * `close`/`delete` (→ {@link CrossTabOwner.stop} via `handleWorkerResponse`). A
+     * worker hung inside OPFS never answers, so that path never runs and the plain
+     * client `close()` (just {@link unregisterLocalClient}) leaves `this.owner`
+     * pinned to the dead worker — every later boot then routes its `init` straight
+     * into it over the untimed local path and hangs. Because the coordinator is a
+     * per-URL module singleton, that pins EVERY database, not just the one that
+     * wedged.
+     *
+     * So on abrupt teardown, after unregistering the client, stop the owner —
+     * `stop()` terminates the worker, releases the owner lock, and (via the release
+     * callback) nulls `this.owner` + resets the gate, so the next `createWorker()`
+     * re-contends and constructs a fresh owner. Gated to stay multi-tab-safe: only
+     * when this tab has no other open local client AND the owner serves no other
+     * (remote) client, so it can never strand a sibling tab still routing here.
+     *
+     * The remote-client half of the gate reads the owner's `activeClientIds`, which
+     * is coarse: a wedged local client that was force-torn-down without a close
+     * response leaves a *stale* id there (only a close-response or the liveness sweep
+     * removes it). So if TWO local clients on one coordinator were wedged and torn
+     * down in the same tick, the second would see the first's stale id and decline to
+     * stop — leaving the wedge unhealed. That cannot happen here: the app drives a
+     * single runtime at a time (`useManagedSQLiteRuntime` holds one runtimeRef and
+     * defers each spawn on the prior release), so a coordinator never has two live
+     * local clients. The gate therefore errs, at worst, toward NOT stopping — which
+     * only ever risks a missed heal, never wrongly stranding a real remote tab.
+     */
+    forceStopOwnerFor(clientId) {
+        this.unregisterLocalClient(clientId);
+        if (this.hasOpenLocalClients()) {
+            return;
+        }
+        const owner = this.owner;
+        if (owner && !owner.hasActiveClientsExcept(clientId)) {
+            owner.stop();
+        }
+    }
+    route(clientId, request) {
+        void this.routeAsync(clientId, request);
+    }
+    async routeAsync(clientId, request) {
+        const id = requestId(request);
+        try {
+            const localClient = this.localClientsById.get(clientId);
+            if (localClient && isTeardownRequest(request)) {
+                localClient.closing = true;
+            }
+            const hasClientLock = await this.waitForLocalClientLock(clientId);
+            if (!this.localClientsById.has(clientId)) {
+                return;
+            }
+            // Wait for ownership so this request is not posted into the void.
+            if (!this.owner && !this.ownerError) {
+                this.contendForOwnership();
+            }
+            await this.ownershipSettled;
+            if (!this.localClientsById.has(clientId)) {
+                return;
+            }
+            if (this.owner) {
+                this.owner.route(clientId, request, { hasClientLock });
+                return;
+            }
+            // This tab won ownership earlier but its owner worker failed to construct.
+            // If another tab has since become a healthy owner, fall back to it; only
+            // surface the construction error when no owner exists anywhere, so a single
+            // tab whose worker cannot start fails fast instead of hanging on the timeout.
+            if (this.ownerError && !(await this.anotherTabOwns())) {
+                throw this.ownerError;
+            }
+            this.postRemoteRequest(clientId, request, hasClientLock);
+        }
+        catch (error) {
+            if (id !== null) {
+                this.dispatchLocalResponse(clientId, errorResponse(id, error instanceof Error
+                    ? error.message
+                    : "Failed to route database request."));
+            }
+        }
+    }
+    async waitForLocalClientLock(clientId) {
+        const localClient = this.localClientsById.get(clientId);
+        if (!localClient) {
+            return false;
+        }
+        return localClient.liveness.ready;
+    }
+    postRemoteRequest(clientId, request, hasClientLock) {
+        const id = requestId(request);
+        if (id !== null) {
+            const localClient = this.localClientsById.get(clientId);
+            localClient?.pendingRemoteRequestIds.add(id);
+            const timeoutId = setTimeout(() => {
+                localClient?.timeoutsByRequestId.delete(id);
+                localClient?.pendingRemoteRequestIds.delete(id);
+                this.dispatchLocalResponse(clientId, errorResponse(id, "Timed out waiting for the database owner tab."));
+            }, CROSS_TAB_REQUEST_TIMEOUT_MS);
+            localClient?.timeoutsByRequestId.set(id, timeoutId);
+        }
+        this.channel.postMessage({
+            type: "request",
+            clientId,
+            hasClientLock,
+            request,
+        });
+    }
+    dispatchLocalResponse(clientId, response) {
+        const localClient = this.localClientsById.get(clientId);
+        if (localClient) {
+            dispatchResponseToLocalClient(localClient, response);
+        }
+    }
+    dispatchLocalError(clientId, error) {
+        const localClient = this.localClientsById.get(clientId);
+        if (localClient) {
+            dispatchCrashToLocalClient(localClient, error);
+        }
+    }
+    // A crashed owner worker is the same failure class as one that never
+    // constructed: record it so routing fails fast instead of rebuilding the
+    // crashed worker on the next bid (`contendForOwnership` and the post-release
+    // retry both stop on `ownerError`), and fail every local client — including
+    // one whose first request has not been routed yet, which is exactly where a
+    // script-load failure lands. The next `createWorker()` (a fresh runtime boot)
+    // clears the error and re-contends.
+    handleOwnerCrash(error) {
+        this.ownerError = error;
+        for (const localClient of this.localClientsById.values()) {
+            dispatchCrashToLocalClient(localClient, error);
+        }
+    }
+    unregisterLocalClient(clientId) {
+        const localClient = this.localClientsById.get(clientId);
+        if (localClient) {
+            releaseLocalClient(localClient);
+        }
+        this.localClientsById.delete(clientId);
+    }
+    handleChannelMessage(event) {
+        const envelope = event.data;
+        if (!isCrossTabEnvelope(envelope)) {
+            return;
+        }
+        if (envelope.type === "request") {
+            this.owner?.route(envelope.clientId, envelope.request, {
+                hasClientLock: envelope.hasClientLock === true,
+            });
+            return;
+        }
+        if (envelope.type === "error") {
+            this.dispatchLocalError(envelope.clientId, new DatabaseWorkerCrashError(envelope.detail));
+            return;
+        }
+        this.dispatchLocalResponse(envelope.clientId, envelope.response);
+    }
+    /**
+     * Hold one blocking owner-lock bid. The current holder owns until it releases;
+     * queued bidders are promoted when the holder disappears.
+     */
+    contendForOwnership() {
+        if (this.owner || this.ownershipBidActive || this.ownerError) {
+            return;
+        }
+        const locks = lockManager();
+        if (!locks) {
+            // No Web Locks: unblock routing and rely on the request timeout.
+            this.settleOwnership();
+            return;
+        }
+        this.ownershipBidActive = true;
+        const generation = this.ownershipGeneration;
+        // A non-owner tab's blocking bid stays queued (never enters its callback)
+        // until the current owner dies, so it cannot settle the routing gate on its
+        // own. Settle it from here as soon as ownership is known either way.
+        this.observeExistingOwner(locks, generation);
+        let releasedNormally = false;
+        void locks
+            .request(CROSS_TAB_OWNER_LOCK_NAME, null, async () => {
+            let releaseOwner = null;
+            const ownerReleased = new Promise((resolve) => {
+                releaseOwner = resolve;
+            });
+            try {
+                const owner = new CrossTabOwner(this.workerUrl, this.workerConstructor, this.channel, (clientId, response) => this.dispatchLocalResponse(clientId, response), (error) => this.handleOwnerCrash(error), () => {
+                    if (this.owner === owner) {
+                        this.owner = null;
+                        // After a crash the gate stays settled: routing fails fast on
+                        // the recorded error instead of waiting for a bid that must
+                        // not run until a fresh client asks for one.
+                        if (!this.ownerError) {
+                            this.resetOwnershipGate();
+                        }
+                    }
+                    releaseOwner?.();
+                });
+                this.owner = owner;
+                this.ownerError = null;
+                // Requests posted to the previous owner are orphaned; fail them with a
+                // retryable error instead of waiting out the timeout.
+                this.failPendingRemoteRequests();
+                this.settleOwnership(generation);
+                await ownerReleased;
+                releasedNormally = true;
+            }
+            catch (error) {
+                // This tab won ownership but could not stand up the owner worker. Record
+                // the failure so its own clients see the error instead of hanging, then
+                // rethrow to release the lock so another tab can try to own.
+                this.owner = null;
+                this.ownerError =
+                    error instanceof Error ? error : new Error(String(error));
+                this.failPendingRemoteRequests();
+                this.settleOwnership(generation);
+                throw error;
+            }
+        })
+            .catch(() => {
+            // The bid itself failed (e.g. the lock manager rejected). Unblock routing
+            // so requests fall back to the remote path instead of hanging forever.
+            this.settleOwnership(generation);
+        })
+            .finally(() => {
+            this.ownershipBidActive = false;
+            const shouldRetryOwnership = releasedNormally || this.retryOwnershipAfterBid;
+            this.retryOwnershipAfterBid = false;
+            if (!shouldRetryOwnership) {
+                return;
+            }
+            queueMicrotask(() => {
+                if (this.hasOpenLocalClients() && !this.owner && !this.ownerError) {
+                    this.contendForOwnership();
+                }
+            });
+        });
+    }
+    hasOpenLocalClients() {
+        for (const localClient of this.localClientsById.values()) {
+            if (!localClient.closing) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Settle the initial routing gate on a tab that did NOT win ownership. Runs
+     * concurrently with the blocking bid above; whichever resolves first settles the
+     * gate (the bid settles it on the tab that becomes owner, this settles it on
+     * every other tab). See {@link pollForOwner} for why this polls.
+     *
+     * Falls back to settling immediately when the lock manager cannot be queried, so
+     * routing is never blocked indefinitely.
+     */
+    observeExistingOwner(locks, generation) {
+        if (!locks.query) {
+            // No query support: cannot observe another tab's owner without contending
+            // for the lock (which would steal it). Settle so routing proceeds remotely.
+            this.settleOwnership(generation);
+            return;
+        }
+        void pollForOwner({
+            locks,
+            lockName: CROSS_TAB_OWNER_LOCK_NAME,
+            hasOwner: () => this.owner !== null,
+            settle: () => this.settleOwnership(generation),
+        });
+    }
+    resetOwnershipGate() {
+        this.ownershipGeneration += 1;
+        this.ownershipSettled = new Promise((resolve) => {
+            this.settleOwnershipGate = resolve;
+        });
+    }
+    settleOwnership(generation = this.ownershipGeneration) {
+        if (generation !== this.ownershipGeneration) {
+            return;
+        }
+        this.settleOwnershipGate();
+    }
+    /**
+     * Whether some other tab currently holds the owner lock. Used by routing to
+     * decide, when this tab's own owner failed to construct, between surfacing that
+     * error (no owner anywhere) and falling back to a healthy remote owner. Returns
+     * false when the lock cannot be queried, so routing posts remotely and lets the
+     * request/timeout path decide rather than throwing a possibly-stale error.
+     */
+    async anotherTabOwns() {
+        if (this.owner) {
+            return false;
+        }
+        const locks = lockManager();
+        return locks ? isOwnerLockHeld(locks, CROSS_TAB_OWNER_LOCK_NAME) : false;
+    }
+    // Called when this tab is promoted to owner: the owner its clients had posted
+    // their remote requests to is gone, so fail them fast rather than time out.
+    failPendingRemoteRequests() {
+        for (const localClient of this.localClientsById.values()) {
+            failPendingRemoteRequests(localClient);
+        }
+    }
+}
+const coordinatorsByWorkerUrl = new Map();
+export function createCrossTabDatabaseWorker(workerUrl, workerConstructor) {
+    if (!canUseCrossTabPrimitives()) {
+        return null;
+    }
+    const key = String(workerUrl);
+    let coordinator = coordinatorsByWorkerUrl.get(key);
+    if (!coordinator) {
+        coordinator = new CrossTabCoordinator(workerUrl, workerConstructor);
+        coordinatorsByWorkerUrl.set(key, coordinator);
+    }
+    return coordinator.createWorker();
+}
+//# sourceMappingURL=crossTabRuntime.js.map

package/internal/sqlite-worker/crossTabRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossTabRuntime.js","sourceRoot":"","sources":["crossTabRuntime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,EAEzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EAExB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAgC,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,SAAS,EACT,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AACzD,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAClE,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAc5C,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,MAAM,mBAAmB;IAkBJ;IACA;IAlBF,OAAO,GAAG,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAChE,gBAAgB,GAAG,KAAK,CAAC;IAChB,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3D,KAAK,GAAyB,IAAI,CAAC;IAC3C,0EAA0E;IAC1E,0DAA0D;IAClD,UAAU,GAAiB,IAAI,CAAC;IACxC,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IAChE,kBAAkB,GAAG,KAAK,CAAC;IAC3B,mBAAmB,GAAG,CAAC,CAAC;IACxB,gBAAgB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACpD,sBAAsB,GAAG,KAAK,CAAC;IAC/B,mBAAmB,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IAEnD,YACmB,SAAuB,EACvB,iBAA0C;QAD1C,cAAS,GAAT,SAAS,CAAc;QACvB,sBAAiB,GAAjB,iBAAiB,CAAyB;QAE3D,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACjD,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,8EAA8E;QAC9E,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAED,YAAY;QACV,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE3B,OAAO;YACL,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;gBACvB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,gBAAgB,CAAC,IAAI,EAAE,QAAQ;gBAC7B,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,mBAAmB,CAAC,IAAI,EAAE,QAAQ;gBAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,EAAE,GAAG,EAAE;gBACV,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,cAAc,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,iBAAiB,CAAC,QAAgB;QACxC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAgB,EAAE,OAAgB;QAC9C,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,OAAgB;QACzD,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,WAAW,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;YAC7B,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,yEAAyE;YACzE,4EAA4E;YAC5E,8EAA8E;YAC9E,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,UAAU,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC,qBAAqB,CACxB,QAAQ,EACR,aAAa,CACX,EAAE,EACF,KAAK,YAAY,KAAK;oBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,mCAAmC,CACxC,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;IACpC,CAAC;IAEO,iBAAiB,CACvB,QAAgB,EAChB,OAAgB,EAChB,aAAsB;QAEtB,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxD,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5C,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,qBAAqB,CACxB,QAAQ,EACR,aAAa,CAAC,EAAE,EAAE,+CAA+C,CAAC,CACnE,CAAC;YACJ,CAAC,EAAE,4BAA4B,CAAC,CAAC;YACjC,WAAW,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ;YACR,aAAa;YACb,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,qBAAqB,CAAC,QAAgB,EAAE,QAAiB;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,kBAAkB,CACxB,QAAgB,EAChB,KAA+B;QAE/B,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,0BAA0B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,oCAAoC;IAC5B,gBAAgB,CAAC,KAA+B;QACtD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACzD,0BAA0B,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,oBAAoB,CAAC,KAAmB;QAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACrD,aAAa,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI;aAC/C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,kBAAkB,CACrB,QAAQ,CAAC,QAAQ,EACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC9C,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACK,mBAAmB;QACzB,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iEAAiE;YACjE,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC5C,0EAA0E;QAC1E,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE7C,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAE7B,KAAK,KAAK;aACP,OAAO,CAAC,yBAAyB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YACnD,IAAI,YAAY,GAAwB,IAAI,CAAC;YAC7C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClD,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,aAAa,CAC7B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,OAAO,EACZ,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACrB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChD,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EACvC,GAAG,EAAE;oBACH,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;wBACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;wBAClB,8DAA8D;wBAC9D,4DAA4D;wBAC5D,6CAA6C;wBAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;4BACrB,IAAI,CAAC,kBAAkB,EAAE,CAAC;wBAC5B,CAAC;oBACH,CAAC;oBACD,YAAY,EAAE,EAAE,CAAC;gBACnB,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,uEAAuE;gBACvE,sDAAsD;gBACtD,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBACjC,MAAM,aAAa,CAAC;gBACpB,gBAAgB,GAAG,IAAI,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yEAAyE;gBACzE,wEAAwE;gBACxE,6DAA6D;gBAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,IAAI,CAAC,UAAU;oBACb,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5D,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;YAChC,MAAM,oBAAoB,GACxB,gBAAgB,IAAI,IAAI,CAAC,sBAAsB,CAAC;YAClD,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC;YACpC,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YAED,cAAc,CAAC,GAAG,EAAE;gBAClB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAClE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,mBAAmB;QACzB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAC1B,KAAsB,EACtB,UAAkB;QAElB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,0EAA0E;YAC1E,4EAA4E;YAC5E,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,KAAK,YAAY,CAAC;YAChB,KAAK;YACL,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAU,GAAG,IAAI,CAAC,mBAAmB;QAC3D,IAAI,UAAU,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IACpE,yBAAyB;QAC/B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACzD,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEvE,MAAM,UAAU,4BAA4B,CAC1C,SAAuB,EACvB,iBAA0C;IAE1C,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QACpE,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,WAAW,CAAC,YAAY,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import type { WorkerLike } from \"./client\";\nimport {\n  createLocalClient,\n  dispatchCrashToLocalClient,\n  dispatchResponseToLocalClient,\n  failPendingRemoteRequests,\n  type LocalClient,\n  releaseLocalClient,\n} from \"./crossTabLocalClient\";\nimport {\n  canUseCrossTabPrimitives,\n  type LockManagerLike,\n  lockManager,\n} from \"./crossTabLocks\";\nimport { CrossTabOwner, type ModuleWorkerConstructor } from \"./crossTabOwner\";\nimport { isOwnerLockHeld, pollForOwner } from \"./crossTabOwnership\";\nimport {\n  errorResponse,\n  isCrossTabEnvelope,\n  requestId,\n  requestMethod,\n} from \"./crossTabProtocol\";\nimport { DatabaseWorkerCrashError } from \"./workerCrash\";\n\nconst CROSS_TAB_CHANNEL_NAME = \"tearleads-sqlite-worker\";\nconst CROSS_TAB_OWNER_LOCK_NAME = \"tearleads-sqlite-worker-owner\";\nconst CROSS_TAB_REQUEST_TIMEOUT_MS = 10_000;\n\ninterface CrossTabDatabaseWorker extends WorkerLike {\n  close(): void;\n  /**\n   * Abrupt teardown for a runtime that could not close gracefully — its worker\n   * went silent, so the `close` round-trip never came back to stop the owner via\n   * {@link CrossTabOwner.stop}. Unregisters this client and, when safe, force-stops\n   * the owner so the next boot re-contends and builds a fresh owner instead of\n   * routing into the dead one. See {@link CrossTabCoordinator.forceStopOwnerFor}.\n   */\n  forceStopOwner(): void;\n}\n\nfunction isTeardownRequest(request: unknown): boolean {\n  const method = requestMethod(request);\n  return method === \"close\" || method === \"delete\";\n}\n\nclass CrossTabCoordinator {\n  private readonly channel = new BroadcastChannel(CROSS_TAB_CHANNEL_NAME);\n  private hasCreatedClient = false;\n  private readonly localClientsById = new Map<string, LocalClient>();\n  private owner: CrossTabOwner | null = null;\n  // Set if this tab won ownership but its owner worker failed to construct.\n  // Cleared if a later bid succeeds in installing an owner.\n  private ownerError: Error | null = null;\n  // Resolves when ownership is settled for the current owner generation (this tab\n  // won and installed/failed to construct an owner, or it observed another tab\n  // already owns), so routing never posts remotely while no owner exists.\n  private ownershipBidActive = false;\n  private ownershipGeneration = 0;\n  private ownershipSettled: Promise<void> = Promise.resolve();\n  private retryOwnershipAfterBid = false;\n  private settleOwnershipGate: () => void = () => {};\n\n  constructor(\n    private readonly workerUrl: string | URL,\n    private readonly workerConstructor: ModuleWorkerConstructor,\n  ) {\n    this.resetOwnershipGate();\n    this.channel.addEventListener(\"message\", (event) => {\n      this.handleChannelMessage(event);\n    });\n    // Start the first ownership bid; later clients can restart it after teardown.\n    this.contendForOwnership();\n  }\n\n  createWorker(): CrossTabDatabaseWorker {\n    const clientId = crypto.randomUUID();\n    const events = new EventTarget();\n    if (this.ownerError && this.hasCreatedClient) {\n      this.ownerError = null;\n      this.retryOwnershipAfterBid = this.ownershipBidActive;\n      this.resetOwnershipGate();\n    }\n    this.localClientsById.set(clientId, createLocalClient(clientId, events));\n    this.hasCreatedClient = true;\n    this.contendForOwnership();\n\n    return {\n      postMessage: (message) => {\n        this.route(clientId, message);\n      },\n      addEventListener(type, listener) {\n        events.addEventListener(type, listener);\n      },\n      removeEventListener(type, listener) {\n        events.removeEventListener(type, listener);\n      },\n      close: () => {\n        this.unregisterLocalClient(clientId);\n      },\n      forceStopOwner: () => {\n        this.forceStopOwnerFor(clientId);\n      },\n    };\n  }\n\n  /**\n   * Tear down a possibly-wedged owner on abrupt runtime teardown.\n   *\n   * `this.owner` is normally cleared only when the dedicated worker answers a\n   * `close`/`delete` (→ {@link CrossTabOwner.stop} via `handleWorkerResponse`). A\n   * worker hung inside OPFS never answers, so that path never runs and the plain\n   * client `close()` (just {@link unregisterLocalClient}) leaves `this.owner`\n   * pinned to the dead worker — every later boot then routes its `init` straight\n   * into it over the untimed local path and hangs. Because the coordinator is a\n   * per-URL module singleton, that pins EVERY database, not just the one that\n   * wedged.\n   *\n   * So on abrupt teardown, after unregistering the client, stop the owner —\n   * `stop()` terminates the worker, releases the owner lock, and (via the release\n   * callback) nulls `this.owner` + resets the gate, so the next `createWorker()`\n   * re-contends and constructs a fresh owner. Gated to stay multi-tab-safe: only\n   * when this tab has no other open local client AND the owner serves no other\n   * (remote) client, so it can never strand a sibling tab still routing here.\n   *\n   * The remote-client half of the gate reads the owner's `activeClientIds`, which\n   * is coarse: a wedged local client that was force-torn-down without a close\n   * response leaves a *stale* id there (only a close-response or the liveness sweep\n   * removes it). So if TWO local clients on one coordinator were wedged and torn\n   * down in the same tick, the second would see the first's stale id and decline to\n   * stop — leaving the wedge unhealed. That cannot happen here: the app drives a\n   * single runtime at a time (`useManagedSQLiteRuntime` holds one runtimeRef and\n   * defers each spawn on the prior release), so a coordinator never has two live\n   * local clients. The gate therefore errs, at worst, toward NOT stopping — which\n   * only ever risks a missed heal, never wrongly stranding a real remote tab.\n   */\n  private forceStopOwnerFor(clientId: string): void {\n    this.unregisterLocalClient(clientId);\n    if (this.hasOpenLocalClients()) {\n      return;\n    }\n\n    const owner = this.owner;\n    if (owner && !owner.hasActiveClientsExcept(clientId)) {\n      owner.stop();\n    }\n  }\n\n  private route(clientId: string, request: unknown): void {\n    void this.routeAsync(clientId, request);\n  }\n\n  private async routeAsync(clientId: string, request: unknown): Promise<void> {\n    const id = requestId(request);\n    try {\n      const localClient = this.localClientsById.get(clientId);\n      if (localClient && isTeardownRequest(request)) {\n        localClient.closing = true;\n      }\n\n      const hasClientLock = await this.waitForLocalClientLock(clientId);\n      if (!this.localClientsById.has(clientId)) {\n        return;\n      }\n\n      // Wait for ownership so this request is not posted into the void.\n      if (!this.owner && !this.ownerError) {\n        this.contendForOwnership();\n      }\n      await this.ownershipSettled;\n      if (!this.localClientsById.has(clientId)) {\n        return;\n      }\n\n      if (this.owner) {\n        this.owner.route(clientId, request, { hasClientLock });\n        return;\n      }\n\n      // This tab won ownership earlier but its owner worker failed to construct.\n      // If another tab has since become a healthy owner, fall back to it; only\n      // surface the construction error when no owner exists anywhere, so a single\n      // tab whose worker cannot start fails fast instead of hanging on the timeout.\n      if (this.ownerError && !(await this.anotherTabOwns())) {\n        throw this.ownerError;\n      }\n\n      this.postRemoteRequest(clientId, request, hasClientLock);\n    } catch (error: unknown) {\n      if (id !== null) {\n        this.dispatchLocalResponse(\n          clientId,\n          errorResponse(\n            id,\n            error instanceof Error\n              ? error.message\n              : \"Failed to route database request.\",\n          ),\n        );\n      }\n    }\n  }\n\n  private async waitForLocalClientLock(clientId: string): Promise<boolean> {\n    const localClient = this.localClientsById.get(clientId);\n    if (!localClient) {\n      return false;\n    }\n\n    return localClient.liveness.ready;\n  }\n\n  private postRemoteRequest(\n    clientId: string,\n    request: unknown,\n    hasClientLock: boolean,\n  ): void {\n    const id = requestId(request);\n    if (id !== null) {\n      const localClient = this.localClientsById.get(clientId);\n      localClient?.pendingRemoteRequestIds.add(id);\n      const timeoutId = setTimeout(() => {\n        localClient?.timeoutsByRequestId.delete(id);\n        localClient?.pendingRemoteRequestIds.delete(id);\n        this.dispatchLocalResponse(\n          clientId,\n          errorResponse(id, \"Timed out waiting for the database owner tab.\"),\n        );\n      }, CROSS_TAB_REQUEST_TIMEOUT_MS);\n      localClient?.timeoutsByRequestId.set(id, timeoutId);\n    }\n\n    this.channel.postMessage({\n      type: \"request\",\n      clientId,\n      hasClientLock,\n      request,\n    });\n  }\n\n  private dispatchLocalResponse(clientId: string, response: unknown): void {\n    const localClient = this.localClientsById.get(clientId);\n    if (localClient) {\n      dispatchResponseToLocalClient(localClient, response);\n    }\n  }\n\n  private dispatchLocalError(\n    clientId: string,\n    error: DatabaseWorkerCrashError,\n  ): void {\n    const localClient = this.localClientsById.get(clientId);\n    if (localClient) {\n      dispatchCrashToLocalClient(localClient, error);\n    }\n  }\n\n  // A crashed owner worker is the same failure class as one that never\n  // constructed: record it so routing fails fast instead of rebuilding the\n  // crashed worker on the next bid (`contendForOwnership` and the post-release\n  // retry both stop on `ownerError`), and fail every local client — including\n  // one whose first request has not been routed yet, which is exactly where a\n  // script-load failure lands. The next `createWorker()` (a fresh runtime boot)\n  // clears the error and re-contends.\n  private handleOwnerCrash(error: DatabaseWorkerCrashError): void {\n    this.ownerError = error;\n    for (const localClient of this.localClientsById.values()) {\n      dispatchCrashToLocalClient(localClient, error);\n    }\n  }\n\n  private unregisterLocalClient(clientId: string): void {\n    const localClient = this.localClientsById.get(clientId);\n    if (localClient) {\n      releaseLocalClient(localClient);\n    }\n\n    this.localClientsById.delete(clientId);\n  }\n\n  private handleChannelMessage(event: MessageEvent): void {\n    const envelope = event.data;\n    if (!isCrossTabEnvelope(envelope)) {\n      return;\n    }\n\n    if (envelope.type === \"request\") {\n      this.owner?.route(envelope.clientId, envelope.request, {\n        hasClientLock: envelope.hasClientLock === true,\n      });\n      return;\n    }\n\n    if (envelope.type === \"error\") {\n      this.dispatchLocalError(\n        envelope.clientId,\n        new DatabaseWorkerCrashError(envelope.detail),\n      );\n      return;\n    }\n\n    this.dispatchLocalResponse(envelope.clientId, envelope.response);\n  }\n\n  /**\n   * Hold one blocking owner-lock bid. The current holder owns until it releases;\n   * queued bidders are promoted when the holder disappears.\n   */\n  private contendForOwnership(): void {\n    if (this.owner || this.ownershipBidActive || this.ownerError) {\n      return;\n    }\n\n    const locks = lockManager();\n    if (!locks) {\n      // No Web Locks: unblock routing and rely on the request timeout.\n      this.settleOwnership();\n      return;\n    }\n\n    this.ownershipBidActive = true;\n    const generation = this.ownershipGeneration;\n    // A non-owner tab's blocking bid stays queued (never enters its callback)\n    // until the current owner dies, so it cannot settle the routing gate on its\n    // own. Settle it from here as soon as ownership is known either way.\n    this.observeExistingOwner(locks, generation);\n\n    let releasedNormally = false;\n\n    void locks\n      .request(CROSS_TAB_OWNER_LOCK_NAME, null, async () => {\n        let releaseOwner: (() => void) | null = null;\n        const ownerReleased = new Promise<void>((resolve) => {\n          releaseOwner = resolve;\n        });\n        try {\n          const owner = new CrossTabOwner(\n            this.workerUrl,\n            this.workerConstructor,\n            this.channel,\n            (clientId, response) =>\n              this.dispatchLocalResponse(clientId, response),\n            (error) => this.handleOwnerCrash(error),\n            () => {\n              if (this.owner === owner) {\n                this.owner = null;\n                // After a crash the gate stays settled: routing fails fast on\n                // the recorded error instead of waiting for a bid that must\n                // not run until a fresh client asks for one.\n                if (!this.ownerError) {\n                  this.resetOwnershipGate();\n                }\n              }\n              releaseOwner?.();\n            },\n          );\n          this.owner = owner;\n          this.ownerError = null;\n          // Requests posted to the previous owner are orphaned; fail them with a\n          // retryable error instead of waiting out the timeout.\n          this.failPendingRemoteRequests();\n          this.settleOwnership(generation);\n          await ownerReleased;\n          releasedNormally = true;\n        } catch (error) {\n          // This tab won ownership but could not stand up the owner worker. Record\n          // the failure so its own clients see the error instead of hanging, then\n          // rethrow to release the lock so another tab can try to own.\n          this.owner = null;\n          this.ownerError =\n            error instanceof Error ? error : new Error(String(error));\n          this.failPendingRemoteRequests();\n          this.settleOwnership(generation);\n          throw error;\n        }\n      })\n      .catch(() => {\n        // The bid itself failed (e.g. the lock manager rejected). Unblock routing\n        // so requests fall back to the remote path instead of hanging forever.\n        this.settleOwnership(generation);\n      })\n      .finally(() => {\n        this.ownershipBidActive = false;\n        const shouldRetryOwnership =\n          releasedNormally || this.retryOwnershipAfterBid;\n        this.retryOwnershipAfterBid = false;\n        if (!shouldRetryOwnership) {\n          return;\n        }\n\n        queueMicrotask(() => {\n          if (this.hasOpenLocalClients() && !this.owner && !this.ownerError) {\n            this.contendForOwnership();\n          }\n        });\n      });\n  }\n\n  private hasOpenLocalClients(): boolean {\n    for (const localClient of this.localClientsById.values()) {\n      if (!localClient.closing) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Settle the initial routing gate on a tab that did NOT win ownership. Runs\n   * concurrently with the blocking bid above; whichever resolves first settles the\n   * gate (the bid settles it on the tab that becomes owner, this settles it on\n   * every other tab). See {@link pollForOwner} for why this polls.\n   *\n   * Falls back to settling immediately when the lock manager cannot be queried, so\n   * routing is never blocked indefinitely.\n   */\n  private observeExistingOwner(\n    locks: LockManagerLike,\n    generation: number,\n  ): void {\n    if (!locks.query) {\n      // No query support: cannot observe another tab's owner without contending\n      // for the lock (which would steal it). Settle so routing proceeds remotely.\n      this.settleOwnership(generation);\n      return;\n    }\n\n    void pollForOwner({\n      locks,\n      lockName: CROSS_TAB_OWNER_LOCK_NAME,\n      hasOwner: () => this.owner !== null,\n      settle: () => this.settleOwnership(generation),\n    });\n  }\n\n  private resetOwnershipGate(): void {\n    this.ownershipGeneration += 1;\n    this.ownershipSettled = new Promise((resolve) => {\n      this.settleOwnershipGate = resolve;\n    });\n  }\n\n  private settleOwnership(generation = this.ownershipGeneration): void {\n    if (generation !== this.ownershipGeneration) {\n      return;\n    }\n\n    this.settleOwnershipGate();\n  }\n\n  /**\n   * Whether some other tab currently holds the owner lock. Used by routing to\n   * decide, when this tab's own owner failed to construct, between surfacing that\n   * error (no owner anywhere) and falling back to a healthy remote owner. Returns\n   * false when the lock cannot be queried, so routing posts remotely and lets the\n   * request/timeout path decide rather than throwing a possibly-stale error.\n   */\n  private async anotherTabOwns(): Promise<boolean> {\n    if (this.owner) {\n      return false;\n    }\n\n    const locks = lockManager();\n    return locks ? isOwnerLockHeld(locks, CROSS_TAB_OWNER_LOCK_NAME) : false;\n  }\n\n  // Called when this tab is promoted to owner: the owner its clients had posted\n  // their remote requests to is gone, so fail them fast rather than time out.\n  private failPendingRemoteRequests(): void {\n    for (const localClient of this.localClientsById.values()) {\n      failPendingRemoteRequests(localClient);\n    }\n  }\n}\n\nconst coordinatorsByWorkerUrl = new Map<string, CrossTabCoordinator>();\n\nexport function createCrossTabDatabaseWorker(\n  workerUrl: string | URL,\n  workerConstructor: ModuleWorkerConstructor,\n): CrossTabDatabaseWorker | null {\n  if (!canUseCrossTabPrimitives()) {\n    return null;\n  }\n\n  const key = String(workerUrl);\n  let coordinator = coordinatorsByWorkerUrl.get(key);\n  if (!coordinator) {\n    coordinator = new CrossTabCoordinator(workerUrl, workerConstructor);\n    coordinatorsByWorkerUrl.set(key, coordinator);\n  }\n\n  return coordinator.createWorker();\n}\n"]}

package/internal/sqlite-worker/purgeOpfsDatabase.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Main-thread fallback that deletes the OPFS directory backing a persistent
+ * database's SAHPool VFS, by database name. Use when no worker is alive to run
+ * the in-worker `delete` op (worker cleared/killed/failed to boot) but the
+ * persisted SQLite files must still be wiped — e.g. logging out and discarding
+ * local data. No-op when OPFS is unavailable or the directory was never
+ * created; never throws on a missing directory.
+ *
+ * This removes the whole SAHPool directory (all of its access-handle files), so
+ * it must not run while a worker still holds those handles — call it only after
+ * the runtime has been torn down.
+ */
+export declare function purgeOpfsSqliteDatabase(dbName: string): Promise<void>;

package/internal/sqlite-worker/purgeOpfsDatabase.js

@@ -0,0 +1,53 @@
+import { persistentSahPoolStorageForDbName } from "./sahPoolStorage.js";
+function hasStorageDirectory(storage) {
+    return (storage !== undefined &&
+        "getDirectory" in storage &&
+        typeof storage.getDirectory === "function");
+}
+function isNotFound(error) {
+    return error instanceof DOMException && error.name === "NotFoundError";
+}
+/**
+ * Main-thread fallback that deletes the OPFS directory backing a persistent
+ * database's SAHPool VFS, by database name. Use when no worker is alive to run
+ * the in-worker `delete` op (worker cleared/killed/failed to boot) but the
+ * persisted SQLite files must still be wiped — e.g. logging out and discarding
+ * local data. No-op when OPFS is unavailable or the directory was never
+ * created; never throws on a missing directory.
+ *
+ * This removes the whole SAHPool directory (all of its access-handle files), so
+ * it must not run while a worker still holds those handles — call it only after
+ * the runtime has been torn down.
+ */
+export async function purgeOpfsSqliteDatabase(dbName) {
+    if (typeof navigator !== "object" ||
+        !hasStorageDirectory(navigator.storage)) {
+        return;
+    }
+    // `directory` is an OPFS-absolute path like `/tearleads-sqlite/<segment>`;
+    // navigate it segment-by-segment from the OPFS root.
+    const { directory } = persistentSahPoolStorageForDbName(dbName);
+    const segments = directory.split("/").filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+        return;
+    }
+    const leaf = segments[segments.length - 1];
+    if (leaf === undefined) {
+        return;
+    }
+    const parents = segments.slice(0, -1);
+    let dir = await navigator.storage.getDirectory();
+    try {
+        for (const parent of parents) {
+            dir = await dir.getDirectoryHandle(parent);
+        }
+        await dir.removeEntry(leaf, { recursive: true });
+    }
+    catch (error) {
+        if (isNotFound(error)) {
+            return;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=purgeOpfsDatabase.js.map

package/internal/sqlite-worker/purgeOpfsDatabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeOpfsDatabase.js","sourceRoot":"","sources":["purgeOpfsDatabase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AAMrE,SAAS,mBAAmB,CAC1B,OAAmC;IAEnC,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,cAAc,IAAI,OAAO;QACzB,OAAO,OAAO,CAAC,YAAY,KAAK,UAAU,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,EACvC,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,EAAE,SAAS,EAAE,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,GAAG,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { persistentSahPoolStorageForDbName } from \"./sahPoolStorage\";\n\ninterface StorageDirectoryProvider {\n  getDirectory: () => Promise<FileSystemDirectoryHandle>;\n}\n\nfunction hasStorageDirectory(\n  storage: StorageManager | undefined,\n): storage is StorageManager & StorageDirectoryProvider {\n  return (\n    storage !== undefined &&\n    \"getDirectory\" in storage &&\n    typeof storage.getDirectory === \"function\"\n  );\n}\n\nfunction isNotFound(error: unknown): boolean {\n  return error instanceof DOMException && error.name === \"NotFoundError\";\n}\n\n/**\n * Main-thread fallback that deletes the OPFS directory backing a persistent\n * database's SAHPool VFS, by database name. Use when no worker is alive to run\n * the in-worker `delete` op (worker cleared/killed/failed to boot) but the\n * persisted SQLite files must still be wiped — e.g. logging out and discarding\n * local data. No-op when OPFS is unavailable or the directory was never\n * created; never throws on a missing directory.\n *\n * This removes the whole SAHPool directory (all of its access-handle files), so\n * it must not run while a worker still holds those handles — call it only after\n * the runtime has been torn down.\n */\nexport async function purgeOpfsSqliteDatabase(dbName: string): Promise<void> {\n  if (\n    typeof navigator !== \"object\" ||\n    !hasStorageDirectory(navigator.storage)\n  ) {\n    return;\n  }\n\n  // `directory` is an OPFS-absolute path like `/tearleads-sqlite/<segment>`;\n  // navigate it segment-by-segment from the OPFS root.\n  const { directory } = persistentSahPoolStorageForDbName(dbName);\n  const segments = directory.split(\"/\").filter((segment) => segment.length > 0);\n  if (segments.length === 0) {\n    return;\n  }\n\n  const leaf = segments[segments.length - 1];\n  if (leaf === undefined) {\n    return;\n  }\n  const parents = segments.slice(0, -1);\n\n  let dir = await navigator.storage.getDirectory();\n  try {\n    for (const parent of parents) {\n      dir = await dir.getDirectoryHandle(parent);\n    }\n    await dir.removeEntry(leaf, { recursive: true });\n  } catch (error) {\n    if (isNotFound(error)) {\n      return;\n    }\n    throw error;\n  }\n}\n"]}

package/internal/sqlite-worker/renewedClientTransport.d.ts

@@ -0,0 +1,19 @@
+import { type DatabaseWorkerClient, type WorkerLike } from "./client.js";
+export type DatabaseRuntimeMessagePort = MessagePort;
+export interface DatabaseRuntimeMessageChannelConstructor {
+    new (): MessageChannel;
+}
+export declare function availableMessageChannelConstructor(configured?: DatabaseRuntimeMessageChannelConstructor | null): DatabaseRuntimeMessageChannelConstructor | null;
+export declare function closeMessagePort(port: DatabaseRuntimeMessagePort | null): void;
+export declare function disconnectMessagePort(port: DatabaseRuntimeMessagePort | null): void;
+export declare function createRenewedDatabaseClient(params: {
+    readonly messageChannelConstructor: DatabaseRuntimeMessageChannelConstructor;
+    readonly requestIdSequence: {
+        current: number;
+    };
+    readonly worker: WorkerLike;
+}): {
+    readonly client: DatabaseWorkerClient;
+    readonly id: string;
+    readonly port: DatabaseRuntimeMessagePort;
+};

package/internal/sqlite-worker/renewedClientTransport.js

@@ -0,0 +1,102 @@
+import { createDatabaseWorkerClient, } from "./client.js";
+import { WORKER_CONNECT_PORT_MESSAGE_TYPE, WORKER_DISCONNECT_PORT_MESSAGE_TYPE, WORKER_PORT_DISCONNECTED_MESSAGE_TYPE, } from "./types.js";
+export function availableMessageChannelConstructor(configured) {
+    if (configured === null) {
+        return null;
+    }
+    if (configured) {
+        return configured;
+    }
+    return typeof MessageChannel === "undefined" ? null : MessageChannel;
+}
+export function closeMessagePort(port) {
+    try {
+        port?.close();
+    }
+    catch {
+        // Closing a transferred or already-closed port is best-effort teardown.
+    }
+}
+const PORT_DISCONNECT_TIMEOUT_MS = 1_000;
+export function disconnectMessagePort(port) {
+    if (!port) {
+        return;
+    }
+    let settled = false;
+    let timeoutId;
+    const finish = () => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        if (timeoutId !== undefined) {
+            clearTimeout(timeoutId);
+        }
+        port.removeEventListener("message", handleMessage);
+        closeMessagePort(port);
+    };
+    const handleMessage = (event) => {
+        const data = event.data;
+        if (typeof data === "object" &&
+            data !== null &&
+            Reflect.get(data, "type") === WORKER_PORT_DISCONNECTED_MESSAGE_TYPE) {
+            finish();
+        }
+    };
+    port.addEventListener("message", handleMessage);
+    timeoutId = setTimeout(finish, PORT_DISCONNECT_TIMEOUT_MS);
+    try {
+        port.postMessage({ type: WORKER_DISCONNECT_PORT_MESSAGE_TYPE });
+    }
+    catch {
+        finish();
+    }
+}
+function clientTransportForMessagePort(worker, port) {
+    return {
+        addEventListener(type, listener) {
+            if (type === "error") {
+                worker.addEventListener(type, listener);
+            }
+            else {
+                port.addEventListener(type, listener);
+            }
+        },
+        postMessage(message, transfer) {
+            if (transfer) {
+                port.postMessage(message, transfer);
+            }
+            else {
+                port.postMessage(message);
+            }
+        },
+        removeEventListener(type, listener) {
+            if (type === "error") {
+                worker.removeEventListener(type, listener);
+            }
+            else {
+                port.removeEventListener(type, listener);
+            }
+        },
+    };
+}
+export function createRenewedDatabaseClient(params) {
+    const channel = new params.messageChannelConstructor();
+    try {
+        channel.port1.start();
+        params.worker.postMessage({ type: WORKER_CONNECT_PORT_MESSAGE_TYPE }, [
+            channel.port2,
+        ]);
+        return {
+            client: createDatabaseWorkerClient(clientTransportForMessagePort(params.worker, channel.port1), params.requestIdSequence),
+            id: crypto.randomUUID(),
+            port: channel.port1,
+        };
+    }
+    catch (error) {
+        closeMessagePort(channel.port1);
+        closeMessagePort(channel.port2);
+        throw error;
+    }
+}
+//# sourceMappingURL=renewedClientTransport.js.map