@tinycloud/replica 0.2.4-beta.1 → 0.2.4-beta.3

package/dist/sqlite.cjs

@@ -228,6 +228,29 @@ async function loadSqlite() {
 
 // src/sqlite/store.ts
 var SCHEMA_VERSION = 1;
+var sqliteOpenQueue = Promise.resolve();
+async function acquireSqliteOpen() {
+  const previous = sqliteOpenQueue;
+  let release;
+  sqliteOpenQueue = new Promise((resolve2) => {
+    release = resolve2;
+  });
+  await previous;
+  return release;
+}
+async function captureNamedPath(path) {
+  const names = [];
+  for (let current = (0, import_node_path.resolve)(path); ; current = (0, import_node_path.dirname)(current)) {
+    names.push(current);
+    if ((0, import_node_path.dirname)(current) === current) break;
+  }
+  const identities = [];
+  for (const name of names.reverse()) {
+    const stats = await (0, import_promises.lstat)(name, { bigint: true });
+    identities.push({ path: name, dev: stats.dev, ino: stats.ino });
+  }
+  return identities;
+}
 var DURABILITY = "sqlite-wal-synchronous-full+fsynced-blobs";
 var SCHEMA = `
 CREATE TABLE IF NOT EXISTS replica (
@@ -326,22 +349,78 @@ async function entriesOf(path) {
   }
 }
 var FAULTS = /* @__PURE__ */ Symbol("tinycloud.replica.faults");
+var pinnedDirectories = new FinalizationRegistry((fd) => {
+  try {
+    (0, import_node_fs.closeSync)(fd);
+  } catch {
+  }
+});
+var writableStores = /* @__PURE__ */ new Map();
+function releaseWritable(shared) {
+  if (shared.references === 0 || --shared.references !== 0) return;
+  if (writableStores.get(shared.key) === shared) writableStores.delete(shared.key);
+  try {
+    shared.db.close();
+  } finally {
+    if (shared.directoryFd !== void 0) (0, import_node_fs.closeSync)(shared.directoryFd);
+  }
+}
+var sharedStores = new FinalizationRegistry((shared) => {
+  try {
+    releaseWritable(shared);
+  } catch {
+  }
+});
+async function acquireWritableMutation(shared) {
+  const previous = shared.mutationTail;
+  let release;
+  shared.mutationTail = new Promise((resolve2) => {
+    release = resolve2;
+  });
+  await previous;
+  return release;
+}
 var SqliteReplicaStore = class _SqliteReplicaStore {
   dir;
-  #db;
+  #database;
+  get #db() {
+    if (this.#closed) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica store is closed.");
+    return this.#database;
+  }
+  #closed = false;
+  #closing = false;
+  #closePromise;
+  #activeMutations = 0;
+  #drained;
+  #shared;
+  #pinnedDir;
+  #directoryFd;
   #holder = `${process.pid}-${(0, import_node_crypto.randomBytes)(6).toString("hex")}`;
   #now;
   #faults;
   #guard;
   /** Identity of the database file this store opened: a deleted-and-recreated replica is a different file. */
   #ino;
-  constructor(dir, db, ino, options) {
+  #dev;
+  #namedAncestors;
+  constructor(dir, db, identity, options, directoryFd, namedAncestors = [], shared) {
     this.dir = dir;
-    this.#db = db;
-    this.#ino = ino;
+    this.#pinnedDir = shared?.pinnedDir ?? (directoryFd !== void 0 && process.platform === "linux" ? `/proc/self/fd/${directoryFd}` : dir);
+    this.#directoryFd = directoryFd;
+    this.#shared = shared;
+    if (shared) {
+      shared.references++;
+      sharedStores.register(this, shared, this);
+    } else if (directoryFd !== void 0) {
+      pinnedDirectories.register(this, directoryFd, this);
+    }
+    this.#database = db;
+    this.#ino = identity.ino;
+    this.#dev = identity.dev;
     this.#now = options.now ?? Date.now;
     this.#faults = options[FAULTS] ?? {};
     this.#guard = options.guard ?? ((section) => section());
+    this.#namedAncestors = namedAncestors;
   }
   /**
    * Read-only status snapshot; does not create a replica, migrate, recover
@@ -354,9 +433,10 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     };
     checkAbort();
     const dbPath = (0, import_node_path.join)(dir, "replica.db");
-    let ino;
+    let identity;
     try {
-      ino = (await (0, import_promises.stat)(dbPath)).ino;
+      identity = await (0, import_promises.lstat)(dbPath);
+      if (!identity.isFile()) return null;
     } catch (error) {
       if (errnoOf(error) === "ENOENT") return null;
       throw storageError(error, "Inspecting the replica");
@@ -369,14 +449,14 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       db = opener(dbPath, { readonly: true });
       db.exec("PRAGMA busy_timeout = 0");
       checkAbort();
-      const store = new _SqliteReplicaStore(dir, db, ino, { create: false, ...options.now ? { now: options.now } : {} });
+      const store = new _SqliteReplicaStore(dir, db, identity, { create: false, ...options.now ? { now: options.now } : {} });
       for (let attempt = 0; attempt < 2; attempt++) {
         const before = db.get("PRAGMA data_version").data_version;
         const state = await store.open();
         checkAbort();
         if (state === null) return null;
         const status = await store.status();
-        await new Promise((resolve) => setImmediate(resolve));
+        await new Promise((resolve2) => setImmediate(resolve2));
         checkAbort();
         const after = db.get("PRAGMA data_version").data_version;
         if (before === after) return { state, status };
@@ -396,95 +476,233 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
    * REPLICA_NOT_FOUND and nothing is written to disk.
    */
   static async open(dir, options) {
-    const dbPath = (0, import_node_path.join)(dir, "replica.db");
+    const namedDbPath = (0, import_node_path.join)(dir, "replica.db");
     if (!options.create) {
-      const exists = await (0, import_promises.stat)(dbPath).then(
-        () => true,
+      const exists = await (0, import_promises.lstat)(namedDbPath).then(
+        (stats) => stats.isFile(),
         () => false
       );
-      if (!exists) throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, `No replica at ${dir}.`);
+      if (!exists) throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, `No regular replica database at ${dir}.`);
     }
-    const opener = options.sqlite ?? await loadSqlite();
+    const releaseOpen = await acquireSqliteOpen();
     let store;
+    let directoryFd;
     try {
-      if (options.create) {
-        await (0, import_promises.mkdir)((0, import_node_path.join)(dir, "blobs", ".tmp"), { recursive: true, mode: 448 });
-        await Promise.all([(0, import_promises.chmod)(dir, 448), (0, import_promises.chmod)((0, import_node_path.join)(dir, "blobs"), 448), (0, import_promises.chmod)((0, import_node_path.join)(dir, "blobs", ".tmp"), 448)]);
-        const handle = await (0, import_promises.open)(dbPath, import_node_fs.constants.O_CREAT | import_node_fs.constants.O_RDWR, 384);
-        await handle.close();
-        await (0, import_promises.chmod)(dbPath, 384);
+      if (options.create) await (0, import_promises.mkdir)(dir, { recursive: true, mode: 448 });
+      if (process.platform === "linux") {
+        directoryFd = (0, import_node_fs.openSync)(dir, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_DIRECTORY | import_node_fs.constants.O_NOFOLLOW);
       }
-      const ino = (await (0, import_promises.stat)(dbPath)).ino;
-      const db = opener(dbPath);
-      db.exec("PRAGMA busy_timeout = 5000");
-      db.exec("PRAGMA journal_mode = WAL");
-      db.exec("PRAGMA synchronous = FULL");
-      db.exec("PRAGMA secure_delete = ON");
-      db.exec("PRAGMA foreign_keys = ON");
-      const version = db.get("PRAGMA user_version")?.user_version ?? 0;
-      if (version > SCHEMA_VERSION) {
-        db.close();
-        throw new ReplicaError(
-          ReplicaErrorCode.STORAGE_ERROR,
-          `The replica at ${dir} was written by a newer tc (schema ${version}); upgrade tc to read it.`
-        );
+      const opened = directoryFd === void 0 ? (0, import_node_fs.lstatSync)(dir, { bigint: true }) : (0, import_node_fs.fstatSync)(directoryFd, { bigint: true });
+      if (!opened.isDirectory() || opened.isSymbolicLink() || options.expectedDirectory && (opened.dev !== BigInt(options.expectedDirectory.dev) || opened.ino !== BigInt(options.expectedDirectory.ino))) {
+        throw new Error("The replica directory changed before SQLite opened it.");
       }
-      if (version < SCHEMA_VERSION) {
-        db.exec("BEGIN IMMEDIATE");
-        db.exec(SCHEMA);
-        db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
-        db.exec("COMMIT");
+      const namedAncestors = process.platform === "linux" ? [] : await captureNamedPath(dir);
+      if (namedAncestors.length && (namedAncestors[namedAncestors.length - 1].dev !== opened.dev || namedAncestors[namedAncestors.length - 1].ino !== opened.ino)) {
+        throw new Error("The replica directory changed while checking its ancestry.");
+      }
+      const pinnedDir = directoryFd === void 0 ? dir : `/proc/self/fd/${directoryFd}`;
+      const dbPath = (0, import_node_path.join)(pinnedDir, "replica.db");
+      if (options.create) {
+        await (0, import_promises.mkdir)((0, import_node_path.join)(pinnedDir, "blobs", ".tmp"), { recursive: true, mode: 448 });
+        await Promise.all([(0, import_promises.chmod)(pinnedDir, 448), (0, import_promises.chmod)((0, import_node_path.join)(pinnedDir, "blobs"), 448), (0, import_promises.chmod)((0, import_node_path.join)(pinnedDir, "blobs", ".tmp"), 448)]);
+        const handle = await (0, import_promises.open)(dbPath, import_node_fs.constants.O_CREAT | import_node_fs.constants.O_EXCL | import_node_fs.constants.O_RDWR | import_node_fs.constants.O_NOFOLLOW, 384).catch((error) => {
+          if (errnoOf(error) === "EEXIST") return null;
+          throw error;
+        });
+        if (handle) {
+          try {
+            await handle.chmod(384);
+          } finally {
+            await handle.close();
+          }
+        }
+      }
+      const leaf = await (0, import_promises.open)(dbPath, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW);
+      let db;
+      try {
+        const identity = await leaf.stat();
+        const named = await (0, import_promises.lstat)(dbPath);
+        if (!identity.isFile() || !named.isFile() || named.dev !== identity.dev || named.ino !== identity.ino) {
+          throw new Error("The replica database changed before SQLite opened it.");
+        }
+        const key = `${opened.dev}:${opened.ino}`;
+        const active = writableStores.get(key);
+        if (active && (active.dev !== identity.dev || active.ino !== identity.ino)) {
+          throw new Error("The replica database changed while another controller holds it open.");
+        }
+        if (active && !options.sqlite) {
+          const namedDirectory = (0, import_node_fs.lstatSync)(dir, { bigint: true });
+          if (!namedDirectory.isDirectory() || namedDirectory.dev !== opened.dev || namedDirectory.ino !== opened.ino) {
+            throw new Error("The replica directory changed before its checked SQLite handle could be shared.");
+          }
+          const pinned = active.directoryFd === void 0 ? (0, import_node_fs.lstatSync)(active.pinnedDir, { bigint: true }) : (0, import_node_fs.fstatSync)(active.directoryFd, { bigint: true });
+          const activeLeaf = (0, import_node_fs.lstatSync)((0, import_node_path.join)(active.pinnedDir, "replica.db"));
+          if (!pinned.isDirectory() || pinned.dev !== opened.dev || pinned.ino !== opened.ino || !activeLeaf.isFile() || activeLeaf.dev !== identity.dev || activeLeaf.ino !== identity.ino || active.directoryFd === void 0 && active.namedPath !== dir) {
+            throw new Error("The live replica changed before its checked SQLite handle could be shared.");
+          }
+          if (directoryFd !== void 0) {
+            (0, import_node_fs.closeSync)(directoryFd);
+            directoryFd = void 0;
+          }
+          store = new _SqliteReplicaStore(dir, active.db, identity, options, active.directoryFd, namedAncestors, active);
+        }
+        if (!store) {
+          const opener = options.sqlite ?? await loadSqlite();
+          const previousFds = process.platform === "linux" && !options.sqlite ? new Map((0, import_node_fs.readdirSync)("/proc/self/fd").map((fd) => {
+            try {
+              return [fd, (0, import_node_fs.readlinkSync)(`/proc/self/fd/${fd}`)];
+            } catch {
+              return [fd, ""];
+            }
+          })) : null;
+          db = opener(dbPath);
+          const afterOpen = (0, import_node_fs.lstatSync)(dbPath);
+          if (!afterOpen.isFile() || afterOpen.dev !== identity.dev || afterOpen.ino !== identity.ino) {
+            throw new Error("The replica database changed while SQLite opened it.");
+          }
+          if (previousFds) db.get("SELECT count(*) FROM sqlite_master");
+          if (previousFds) {
+            const databases = (0, import_node_fs.readdirSync)("/proc/self/fd").filter((fd) => {
+              try {
+                const target = (0, import_node_fs.readlinkSync)(`/proc/self/fd/${fd}`);
+                return target.endsWith("/replica.db") && previousFds.get(fd) !== target;
+              } catch {
+                return false;
+              }
+            });
+            if (databases.length === 0 || databases.some((fd) => {
+              try {
+                const actual = (0, import_node_fs.fstatSync)(Number(fd));
+                return actual.dev !== identity.dev || actual.ino !== identity.ino;
+              } catch {
+                return true;
+              }
+            })) {
+              throw new Error("SQLite opened a different replica database.");
+            }
+          }
+          const after = (0, import_node_fs.lstatSync)(dbPath);
+          if (!after.isFile() || after.dev !== identity.dev || after.ino !== identity.ino) {
+            throw new Error("The replica database changed while SQLite opened it.");
+          }
+          db.exec("PRAGMA busy_timeout = 5000");
+          db.exec("PRAGMA journal_mode = WAL");
+          db.exec("PRAGMA synchronous = FULL");
+          db.exec("PRAGMA secure_delete = ON");
+          db.exec("PRAGMA foreign_keys = ON");
+          const version = db.get("PRAGMA user_version")?.user_version ?? 0;
+          if (version > SCHEMA_VERSION) {
+            throw new ReplicaError(
+              ReplicaErrorCode.STORAGE_ERROR,
+              `The replica at ${dir} was written by a newer tc (schema ${version}); upgrade tc to read it.`
+            );
+          }
+          if (version < SCHEMA_VERSION) {
+            db.exec("BEGIN IMMEDIATE");
+            db.exec(SCHEMA);
+            db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+            db.exec("COMMIT");
+          }
+          const shared = options.sqlite ? void 0 : {
+            key,
+            db,
+            directoryFd,
+            pinnedDir,
+            namedPath: dir,
+            dev: identity.dev,
+            ino: identity.ino,
+            references: 0,
+            mutationTail: Promise.resolve()
+          };
+          store = new _SqliteReplicaStore(dir, db, identity, options, directoryFd, namedAncestors, shared);
+          if (shared) writableStores.set(key, shared);
+          db = void 0;
+        }
+      } finally {
+        try {
+          db?.close();
+        } finally {
+          await leaf.close();
+        }
       }
-      store = new _SqliteReplicaStore(dir, db, ino, options);
     } catch (error) {
+      if (store) await store.close().catch(() => void 0);
+      else if (directoryFd !== void 0) (0, import_node_fs.closeSync)(directoryFd);
       throw storageError(error, `Opening the replica at ${dir}`);
+    } finally {
+      releaseOpen();
     }
-    const row = store.#row();
-    if (row?.revoked_detail != null && (row.purge_pending === 1 || await store.#holdsContentFiles().catch(() => true))) {
-      await store.#finishRevocationPurge().catch(() => void 0);
+    try {
+      const row = store.#row();
+      if (row?.revoked_detail != null && (row.purge_pending === 1 || await store.#holdsContentFiles().catch(() => true))) {
+        await store.#finishRevocationPurge().catch(() => void 0);
+      }
+      return store;
+    } catch (error) {
+      await store.close().catch(() => void 0);
+      throw error;
     }
-    return store;
   }
   #row() {
     return this.#db.get("SELECT * FROM replica WHERE id = 1");
   }
   /** Refuse to touch the filesystem for a replica that was deleted (or replaced) under us. */
   async #assertPresent() {
-    const ino = await (0, import_promises.stat)((0, import_node_path.join)(this.dir, "replica.db")).then(
-      (stats) => stats.ino,
-      () => void 0
-    );
-    if (ino !== this.#ino) {
+    const identity = await (0, import_promises.lstat)((0, import_node_path.join)(this.#pinnedDir, "replica.db")).catch(() => null);
+    if (!identity?.isFile() || identity.dev !== this.#dev || identity.ino !== this.#ino) {
       throw new ReplicaError(
         ReplicaErrorCode.NOT_FOUND,
         `The replica at ${this.dir} was deleted while this command ran (its profile was deleted or the replica purged); nothing more was written.`
       );
     }
   }
+  /** New calls stop at close; accepted mutation sections may still finish their transactions. */
+  #assertAccepting() {
+    if (this.#closing || this.#closed) {
+      throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica store is closed.");
+    }
+  }
   /** A short mutation section: guarded (profile lock) and checked against the database this store opened. */
   #mutate(section) {
-    return this.#guard(async () => {
-      await this.#assertPresent();
-      return section();
-    });
+    this.#assertAccepting();
+    this.#activeMutations++;
+    return (async () => {
+      try {
+        return await this.#guard(async () => {
+          await this.#assertPresent();
+          return section();
+        });
+      } finally {
+        if (--this.#activeMutations === 0) {
+          const drained = this.#drained;
+          this.#drained = void 0;
+          drained?.();
+        }
+      }
+    })();
   }
   /** Run `body` in a write transaction (BEGIN IMMEDIATE). Callers outside a mutation section use `#guardedWrite`. */
-  #write(action, body) {
-    try {
-      this.#db.exec("BEGIN IMMEDIATE");
-    } catch (error) {
-      throw storageError(error, action);
-    }
+  async #write(action, body) {
+    const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
     try {
-      const result = body();
-      this.#db.exec("COMMIT");
-      return result;
-    } catch (error) {
       try {
-        this.#db.exec("ROLLBACK");
-      } catch {
+        this.#db.exec("BEGIN IMMEDIATE");
+      } catch (error) {
+        throw storageError(error, action);
+      }
+      try {
+        const result = body();
+        this.#db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          this.#db.exec("ROLLBACK");
+        } catch {
+        }
+        throw storageError(error, action);
       }
-      throw storageError(error, action);
+    } finally {
+      release?.();
     }
   }
   /** One write transaction as its own mutation section. */
@@ -511,6 +729,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     }
   }
   async open() {
+    this.#assertAccepting();
     let row;
     try {
       row = this.#row();
@@ -672,6 +891,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     });
   }
   async hasContent(hashes) {
+    this.#assertAccepting();
     const held = /* @__PURE__ */ new Set();
     for (let start = 0; start < hashes.length; start += 500) {
       const chunk = hashes.slice(start, start + 500);
@@ -684,7 +904,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     return held;
   }
   #blobPath(hash) {
-    return (0, import_node_path.join)(this.dir, "blobs", hash.slice(0, 2), hash);
+    return (0, import_node_path.join)(this.#pinnedDir, "blobs", hash.slice(0, 2), hash);
   }
   /**
    * Make every blob durable before any row references it: write to a fresh
@@ -701,11 +921,11 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         () => false
       );
       if (exists) continue;
-      const shard = (0, import_node_path.join)(this.dir, "blobs", hash.slice(0, 2));
+      const shard = (0, import_node_path.join)(this.#pinnedDir, "blobs", hash.slice(0, 2));
       await (0, import_promises.mkdir)(shard, { mode: 448 }).catch((error) => {
         if (errnoOf(error) !== "EEXIST") throw error;
       });
-      const temp = (0, import_node_path.join)(this.dir, "blobs", ".tmp", `${hash}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}`);
+      const temp = (0, import_node_path.join)(this.#pinnedDir, "blobs", ".tmp", `${hash}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}`);
       const handle = await (0, import_promises.open)(temp, import_node_fs.constants.O_CREAT | import_node_fs.constants.O_EXCL | import_node_fs.constants.O_WRONLY, 384);
       try {
         await handle.writeFile(bytes);
@@ -721,7 +941,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         await (0, import_promises.unlink)(temp);
       }
       dirs.add(shard);
-      dirs.add((0, import_node_path.join)(this.dir, "blobs"));
+      dirs.add((0, import_node_path.join)(this.#pinnedDir, "blobs"));
     }
     for (const dir of dirs) {
       const handle = await (0, import_promises.open)(dir, import_node_fs.constants.O_RDONLY);
@@ -754,7 +974,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       }
       await this.#faults.afterBlobs?.();
       try {
-        this.#write("Committing a sync page", () => {
+        await this.#write("Committing a sync page", () => {
           this.#checkLease(t);
           const now = this.#now();
           if (p.window.notBefore !== null && now < Date.parse(p.window.notBefore)) {
@@ -829,7 +1049,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   /** Unlink every blob not in `keep`, and every temp file. Only a missing directory counts as empty. */
   async #unlinkBlobs(keep) {
     let removed = 0;
-    const root = (0, import_node_path.join)(this.dir, "blobs");
+    const root = (0, import_node_path.join)(this.#pinnedDir, "blobs");
     for (const shard of await entriesOf(root)) {
       const shardPath = (0, import_node_path.join)(root, shard);
       if (shard === ".tmp") {
@@ -854,7 +1074,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   }
   /** Whether any content file (a blob or a temp file) is on disk. */
   async #holdsContentFiles() {
-    const root = (0, import_node_path.join)(this.dir, "blobs");
+    const root = (0, import_node_path.join)(this.#pinnedDir, "blobs");
     for (const shard of await entriesOf(root)) {
       if ((await entriesOf((0, import_node_path.join)(root, shard))).length > 0) return true;
     }
@@ -862,13 +1082,16 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   }
   async collectGarbage(t) {
     return this.#mutate(async () => {
+      const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
       try {
         this.#db.exec("BEGIN IMMEDIATE");
       } catch (error) {
+        release?.();
         throw storageError(error, "Collecting unused content");
       }
       try {
         this.#checkLease(t);
+        await this.#faults.afterGarbageCollectionBegin?.();
         const keep = new Set(
           this.#db.all("SELECT DISTINCT hash FROM entry WHERE content = 1").map((row) => row.hash)
         );
@@ -881,12 +1104,14 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         } catch {
         }
         throw storageError(error, "Collecting unused content");
+      } finally {
+        release?.();
       }
     });
   }
   async reset(t, reason, options = {}) {
     await this.#mutate(async () => {
-      this.#write("Resetting the replica", () => {
+      await this.#write("Resetting the replica", () => {
         this.#checkLease(t);
         this.#db.run("DELETE FROM entry");
         this.#db.run(
@@ -913,15 +1138,102 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
    */
   async destroy(t) {
     await this.#mutate(async () => {
+      const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
       try {
         this.#db.exec("BEGIN IMMEDIATE");
       } catch (error) {
+        release?.();
         throw storageError(error, "Removing the replica");
       }
       try {
         this.#checkLease(t, { allowRevoked: true });
+        const expected = this.#directoryFd === void 0 ? this.#namedAncestors.at(-1) : (0, import_node_fs.fstatSync)(this.#directoryFd, { bigint: true });
+        if (!expected) {
+          throw new ReplicaError(ReplicaErrorCode.RUNTIME_UNSUPPORTED, "Replica removal requires an opened or identity-checked directory.");
+        }
+        const assertDirectory = async () => {
+          const current = await (0, import_promises.lstat)(this.dir, { bigint: true });
+          if (!current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
+            throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica directory changed during removal.");
+          }
+          return current;
+        };
+        const pinned = await assertDirectory();
         await this.#assertPresent();
-        await (0, import_promises.rm)(this.dir, { recursive: true, force: true });
+        if (process.platform === "linux") {
+          for (const entry of await (0, import_promises.readdir)(this.#pinnedDir)) {
+            await (0, import_promises.rm)((0, import_node_path.join)(this.#pinnedDir, entry), { recursive: true, force: true });
+          }
+          await assertDirectory();
+          await (0, import_promises.rmdir)(this.dir);
+        } else {
+          const ancestors = this.#namedAncestors;
+          const checkAncestors = async () => {
+            for (const expected2 of ancestors) {
+              const current = await (0, import_promises.lstat)(expected2.path, { bigint: true });
+              if (current.dev !== expected2.dev || current.ino !== expected2.ino) {
+                throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica ancestry changed during removal.");
+              }
+            }
+          };
+          const directories = /* @__PURE__ */ new Map([[this.dir, pinned]]);
+          const files = /* @__PURE__ */ new Map();
+          const check = async (path, expected2, directory) => {
+            if (path !== this.dir) {
+              const parent = (0, import_node_path.dirname)(path);
+              await check(parent, directories.get(parent), true);
+            }
+            await checkAncestors();
+            const current = await (0, import_promises.lstat)(path, { bigint: true });
+            if ((directory ? !current.isDirectory() : !current.isFile()) || current.dev !== expected2.dev || current.ino !== expected2.ino) {
+              throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica layout changed during removal.");
+            }
+          };
+          const record = async (path, directory) => {
+            const parent = (0, import_node_path.dirname)(path);
+            await check(parent, directories.get(parent), true);
+            const current = await (0, import_promises.lstat)(path, { bigint: true });
+            if (!(directory ? current.isDirectory() : current.isFile())) {
+              throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica layout during removal.");
+            }
+            (directory ? directories : files).set(path, current);
+          };
+          const blobs = (0, import_node_path.join)(this.dir, "blobs");
+          for (const name of await (0, import_promises.readdir)(this.dir)) {
+            if (name === "blobs") await record(blobs, true);
+            else if (["replica.db", "replica.db-wal", "replica.db-shm"].includes(name)) await record((0, import_node_path.join)(this.dir, name), false);
+            else throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica layout during removal.");
+          }
+          if (directories.has(blobs)) {
+            await check(blobs, directories.get(blobs), true);
+            for (const shard of await (0, import_promises.readdir)(blobs)) {
+              if (shard !== ".tmp" && !/^[0-9a-f]{2}$/.test(shard)) {
+                throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica blob shard during removal.");
+              }
+              const shardPath = (0, import_node_path.join)(blobs, shard);
+              await record(shardPath, true);
+              await check(shardPath, directories.get(shardPath), true);
+              for (const name of await (0, import_promises.readdir)(shardPath)) {
+                if (shard === ".tmp" ? !/^[0-9a-f]{64}\.[0-9a-f]{12}$/.test(name) : !isHash(name) || !name.startsWith(shard)) {
+                  throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica blob file during removal.");
+                }
+                await record((0, import_node_path.join)(shardPath, name), false);
+              }
+            }
+          }
+          for (const [path, identity] of files) {
+            await check(path, identity, false);
+            await (0, import_promises.unlink)(path);
+          }
+          for (const [path, identity] of [...directories].reverse()) {
+            if (path === this.dir) continue;
+            await check(path, identity, true);
+            await (0, import_promises.rmdir)(path);
+          }
+          await assertDirectory();
+          await checkAncestors();
+          await (0, import_promises.rmdir)(this.dir);
+        }
       } catch (error) {
         throw storageError(error, "Removing the replica");
       } finally {
@@ -929,6 +1241,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
           this.#db.exec("ROLLBACK");
         } catch {
         }
+        release?.();
       }
     });
   }
@@ -972,7 +1285,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
    * when both are done.
    */
   async #purgeContent() {
-    this.#write("Starting the revocation purge", () => {
+    await this.#write("Starting the revocation purge", () => {
       this.#db.run("UPDATE replica SET purge_pending = 1 WHERE id = 1 AND revoked_detail IS NOT NULL");
     });
     try {
@@ -983,7 +1296,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     if (!this.#checkpoint()) {
       throw new ReplicaError(ReplicaErrorCode.BUSY, "A reader holds the replica's write-ahead log; the purge finishes on the next open.");
     }
-    this.#write("Finishing the revocation purge", () => {
+    await this.#write("Finishing the revocation purge", () => {
       this.#db.run("UPDATE replica SET purge_pending = 0 WHERE id = 1 AND revoked_detail IS NOT NULL");
     });
   }
@@ -993,6 +1306,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     });
   }
   async get(key) {
+    this.#assertAccepting();
     try {
       const row = this.#db.get("SELECT key, deleted, etag, hash, metadata, content FROM entry WHERE key = ?", key);
       return row === void 0 ? void 0 : entryOf(row);
@@ -1001,6 +1315,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     }
   }
   async list(o) {
+    this.#assertAccepting();
     const where = ["deleted = 0"];
     const params = [];
     if (o.prefix !== void 0 && o.prefix !== "") {
@@ -1086,8 +1401,31 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       lastReset: state.lastReset
     };
   }
-  async close() {
-    this.#db.close();
+  close() {
+    if (this.#closePromise) return this.#closePromise;
+    this.#closing = true;
+    this.#closePromise = (async () => {
+      if (this.#activeMutations !== 0) {
+        await new Promise((resolve2) => {
+          this.#drained = resolve2;
+        });
+      }
+      this.#closed = true;
+      const fd = this.#directoryFd;
+      this.#directoryFd = void 0;
+      if (this.#shared) {
+        sharedStores.unregister(this);
+        releaseWritable(this.#shared);
+      } else {
+        if (fd !== void 0) pinnedDirectories.unregister(this);
+        try {
+          this.#database.close();
+        } finally {
+          if (fd !== void 0) (0, import_node_fs.closeSync)(fd);
+        }
+      }
+    })();
+    return this.#closePromise;
   }
 };
 // Annotate the CommonJS export names for ESM import in node: