@tinycloud/replica 0.2.4-beta.2 → 0.3.0-beta.10

package/dist/sqlite.cjs

@@ -22,16 +22,19 @@ var sqlite_exports = {};
 __export(sqlite_exports, {
   DURABILITY: () => DURABILITY,
   SqliteReplicaStore: () => SqliteReplicaStore,
+  inspectSqliteReplicaLayout: () => inspectSqliteReplicaLayout,
   loadSqlite: () => loadSqlite,
-  nodeSqliteSupported: () => nodeSqliteSupported
+  nodeSqliteSupported: () => nodeSqliteSupported,
+  removeSqliteReplicaLayout: () => removeSqliteReplicaLayout
 });
 module.exports = __toCommonJS(sqlite_exports);
 
 // src/sqlite/store.ts
+var import_node_async_hooks = require("async_hooks");
 var import_node_crypto = require("crypto");
-var import_node_fs = require("fs");
-var import_promises = require("fs/promises");
-var import_node_path = require("path");
+var import_node_fs2 = require("fs");
+var import_promises2 = require("fs/promises");
+var import_node_path2 = require("path");
 
 // src/errors.ts
 var ReplicaErrorCode = {
@@ -89,7 +92,13 @@ var ReplicaErrorCode = {
   /** A stored blob no longer hashes to its name. */
   INTEGRITY_ERROR: "INTEGRITY_ERROR",
   /** The replica handle was closed; in-flight calls settle with this code. */
-  CLOSED: "REPLICA_CLOSED"
+  CLOSED: "REPLICA_CLOSED",
+  /** The lifecycle gate refused the operation (shared contract `REPLICA_GATED`); `detail.gate` says why. */
+  GATED: "REPLICA_GATED",
+  /** Quota admission refused a page (`maxBytes` or the free-space floor); nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The consent deadline passed: the grant is not served until the user consents again. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED"
 };
 var REPLICA_ERROR = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
 var ReplicaError = class extends Error {
@@ -226,32 +235,13 @@ async function loadSqlite() {
   return (path, options) => wrap(options?.readonly ? new DatabaseSync(path, { readOnly: true }) : new DatabaseSync(path));
 }
 
-// src/sqlite/store.ts
-var SCHEMA_VERSION = 1;
-var sqliteOpenQueue = Promise.resolve();
-async function acquireSqliteOpen() {
-  const previous = sqliteOpenQueue;
-  let release;
-  sqliteOpenQueue = new Promise((resolve2) => {
-    release = resolve2;
-  });
-  await previous;
-  return release;
-}
-async function captureNamedPath(path) {
-  const names = [];
-  for (let current = (0, import_node_path.resolve)(path); ; current = (0, import_node_path.dirname)(current)) {
-    names.push(current);
-    if ((0, import_node_path.dirname)(current) === current) break;
-  }
-  const identities = [];
-  for (const name of names.reverse()) {
-    const stats = await (0, import_promises.lstat)(name, { bigint: true });
-    identities.push({ path: name, dev: stats.dev, ino: stats.ino });
-  }
-  return identities;
-}
-var DURABILITY = "sqlite-wal-synchronous-full+fsynced-blobs";
+// src/sqlite/layout.ts
+var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+
+// src/sqlite/schema.ts
+var SCHEMA_VERSION = 2;
 var SCHEMA = `
 CREATE TABLE IF NOT EXISTS replica (
   id INTEGER PRIMARY KEY CHECK (id = 1),
@@ -311,7 +301,403 @@ CREATE TABLE IF NOT EXISTS entry (
   )
 ) STRICT, WITHOUT ROWID;
 CREATE INDEX IF NOT EXISTS entry_hash ON entry (hash) WHERE hash IS NOT NULL;
+CREATE TABLE IF NOT EXISTS grant_install (
+  cid TEXT PRIMARY KEY,
+  installed_at INTEGER NOT NULL,
+  effective_expires_at INTEGER NOT NULL,
+  consent_deadline INTEGER NOT NULL,
+  consent_anchor_at INTEGER NOT NULL,
+  consent_anchor_source TEXT NOT NULL
+) STRICT, WITHOUT ROWID;
 `;
+
+// src/sqlite/layout.ts
+var POLICY_COLUMNS = [
+  "grant_installed_at REAL",
+  "grant_effective_expires_at REAL",
+  "grant_consent_deadline REAL",
+  "grant_consent_anchor_at REAL",
+  "grant_consent_anchor_source TEXT",
+  "pending_grant_installed_at REAL",
+  "pending_grant_effective_expires_at REAL",
+  "pending_grant_consent_deadline REAL",
+  "pending_grant_consent_anchor_at REAL",
+  "pending_grant_consent_anchor_source TEXT"
+];
+var normalizeSchema = (sql) => sql.replace(" IF NOT EXISTS", "").replace(/\s+/g, " ").trim();
+var SOURCE_SCHEMA = SCHEMA.trim().split(";").map((sql) => sql.trim()).filter(Boolean).map((sql) => {
+  const match = /^CREATE (TABLE|INDEX) IF NOT EXISTS ([a-z_]+)/.exec(sql);
+  if (match === null) throw new Error("Invalid source replica schema.");
+  return { type: match[1].toLowerCase(), name: match[2], sql: normalizeSchema(sql) };
+});
+var V1_SCHEMA = SOURCE_SCHEMA.filter((entry) => entry.name !== "grant_install");
+var POLICY_REPLICA = V1_SCHEMA.find((entry) => entry.name === "replica").sql.replace(/\) STRICT$/, `, ${POLICY_COLUMNS.join(", ")}) STRICT`);
+var POLICY_SCHEMA = V1_SCHEMA.map((entry) => entry.name === "replica" ? { ...entry, sql: POLICY_REPLICA } : entry);
+async function sourceMirrorSchema(path) {
+  let db;
+  try {
+    db = (await loadSqlite())(path, { readonly: true });
+    db.exec("BEGIN");
+    const version = db.get("PRAGMA user_version")?.user_version;
+    if (version !== 1 && version !== SCHEMA_VERSION) return false;
+    const rows = db.all(
+      "SELECT type, name, sql FROM sqlite_schema WHERE sql IS NOT NULL ORDER BY name"
+    );
+    const expected = version === 1 ? V1_SCHEMA : SOURCE_SCHEMA;
+    const matches = (schema) => rows.length === schema.length && rows.every((row) => {
+      const source = schema.find((entry) => entry.name === row.name);
+      return source?.type === row.type && source.sql === normalizeSchema(row.sql);
+    });
+    if (matches(expected)) return true;
+    if (version !== 2) return false;
+    return matches(POLICY_SCHEMA);
+  } catch {
+    return false;
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+var SQLITE_FILE = /^(?:replica\.db|replica\.db-(?:wal|shm|journal))$/;
+var SHARD = /^[0-9a-f]{2}$/;
+var HASH = /^[0-9a-f]{64}$/;
+var TEMP = /^[0-9a-f]{64}\.[0-9a-f]{12}$/;
+function sourceKind(parent, name, allowAdapterFence) {
+  if (parent === "") {
+    if (SQLITE_FILE.test(name) || allowAdapterFence && (name === "fence.json" || /^fence[.]json[.][0-9a-f]{12}[.]tmp$/.test(name))) return "file";
+    return name === "blobs" ? "directory" : "unknown";
+  }
+  if (parent === "blobs") return name === ".tmp" || SHARD.test(name) ? "directory" : "unknown";
+  if (parent === "blobs/.tmp") return TEMP.test(name) ? "file" : "unknown";
+  if (parent.startsWith("blobs/") && SHARD.test(parent.slice(6))) {
+    return HASH.test(name) && name.startsWith(parent.slice(6)) ? "file" : "unknown";
+  }
+  return "unknown";
+}
+function sameFile(a, b) {
+  return a.dev === b.dev && a.ino === b.ino;
+}
+function identityOf(path, kind, details) {
+  return { path, kind, dev: details.dev.toString(), ino: details.ino.toString() };
+}
+function fileKind(details) {
+  if (details.isFile()) return "file";
+  if (details.isDirectory()) return "directory";
+  if (details.isSymbolicLink()) return "symlink";
+  throw new Error("Unsupported replica entry type.");
+}
+async function pathComponents(path) {
+  const absolute = (0, import_node_path.resolve)(path);
+  const parts = absolute.slice((0, import_node_path.parse)(absolute).root.length).split(import_node_path.sep).filter(Boolean);
+  let current = (0, import_node_path.parse)(absolute).root;
+  const components = [];
+  for (const part of ["", ...parts]) {
+    if (part) current = (0, import_node_path.join)(current, part);
+    const details = await (0, import_promises.lstat)(current, { bigint: true });
+    if (details.isSymbolicLink()) throw new Error(`Symlink in replica path: ${current}`);
+    if (!details.isDirectory()) throw new Error(`Replica path component is not a directory: ${current}`);
+    components.push({ path: current, identity: details });
+  }
+  return components;
+}
+async function pinnedDirectory(path, parent, relative = "") {
+  const components = process.platform === "linux" ? void 0 : parent?.components ?? await pathComponents(path);
+  const before = await (0, import_promises.lstat)(path, { bigint: true });
+  if (before.isSymbolicLink()) throw new Error(`Symlink in replica path: ${path}`);
+  if (!before.isDirectory()) throw new Error("Replica directory is not a real directory.");
+  const handle = await (0, import_promises.open)(path, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_DIRECTORY | import_node_fs.constants.O_NOFOLLOW);
+  try {
+    if (!sameFile(before, await handle.stat({ bigint: true }))) {
+      throw new Error("Replica directory changed during inspection.");
+    }
+    return {
+      handle,
+      identity: before,
+      parent,
+      components,
+      children: [],
+      relative,
+      name: path,
+      path: process.platform === "linux" ? `/proc/self/fd/${handle.fd}` : path
+    };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function checkDirectory(directory) {
+  const details = await (0, import_promises.lstat)(directory.name, { bigint: true });
+  if (!details.isDirectory() || !sameFile(directory.identity, details)) {
+    throw new Error(`Replica directory changed: ${directory.relative || directory.name}`);
+  }
+  if (directory.parent) await checkDirectory(directory.parent);
+  else if (directory.components) {
+    for (const component of directory.components) {
+      const current = await (0, import_promises.lstat)(component.path, { bigint: true });
+      if (current.isSymbolicLink() || !current.isDirectory() || !sameFile(component.identity, current)) {
+        throw new Error(`Replica path component changed: ${component.path}`);
+      }
+    }
+  }
+}
+async function inspect(dir, allowAdapterFence) {
+  const root = await pinnedDirectory(dir);
+  const directories = [root];
+  const unknownPaths = [];
+  const knownEntries = [];
+  const unknownEntries = [];
+  let hasDatabase = false;
+  try {
+    async function walk(parent) {
+      await checkDirectory(parent);
+      for (const name of (await (0, import_promises.readdir)(parent.path)).sort()) {
+        await checkDirectory(parent);
+        const relative = parent.relative ? `${parent.relative}/${name}` : name;
+        const path = (0, import_node_path.join)(parent.path, name);
+        const details = await (0, import_promises.lstat)(path, { bigint: true });
+        if (process.platform !== "linux" && details.isSymbolicLink()) {
+          throw new Error(`Symlink in replica path: ${relative}`);
+        }
+        const kind = fileKind(details);
+        const child = { path, relative, kind, identity: details, parent };
+        parent.children.push(child);
+        if (parent.relative === "" && name === "replica.db" && kind === "file") hasDatabase = true;
+        if (sourceKind(parent.relative, name, allowAdapterFence) !== kind) {
+          unknownPaths.push(relative);
+          unknownEntries.push(identityOf(relative, kind, details));
+        } else {
+          knownEntries.push(identityOf(relative, kind, details));
+        }
+        if (kind === "directory") {
+          const directory = await pinnedDirectory(path, parent, relative);
+          if (!sameFile(details, directory.identity)) {
+            await directory.handle.close();
+            throw new Error(`Replica directory changed during inspection: ${relative}`);
+          }
+          child.directory = directory;
+          directories.push(directory);
+          await walk(directory);
+        }
+      }
+    }
+    await walk(root);
+    if (!hasDatabase) {
+      unknownPaths.push("replica.db");
+    } else if (!await sourceMirrorSchema((0, import_node_path.join)(root.path, "replica.db"))) {
+      const index = knownEntries.findIndex((entry) => entry.path === "replica.db");
+      if (index >= 0) unknownEntries.push(knownEntries.splice(index, 1)[0]);
+      unknownPaths.push("replica.db");
+    }
+    await checkDirectory(root);
+    const names = new Set(await (0, import_promises.readdir)(root.path));
+    for (let index = root.children.length - 1; index >= 0; index--) {
+      const child = root.children[index];
+      if (!names.has(child.relative)) {
+        if (child.directory) throw new Error(`Replica directory vanished: ${child.relative}`);
+        root.children.splice(index, 1);
+        for (const list of [knownEntries, unknownEntries]) {
+          const entryIndex = list.findIndex((entry) => entry.path === child.relative);
+          if (entryIndex >= 0) list.splice(entryIndex, 1);
+        }
+        const pathIndex = unknownPaths.indexOf(child.relative);
+        if (pathIndex >= 0) unknownPaths.splice(pathIndex, 1);
+        continue;
+      }
+      const current = await (0, import_promises.lstat)(child.path, { bigint: true });
+      if (!sameFile(child.identity, current) || fileKind(current) !== child.kind) {
+        throw new Error(`Replica child changed during schema inspection: ${child.relative}`);
+      }
+    }
+    for (const name of names) {
+      if (root.children.some((child) => child.relative === name)) continue;
+      const path = (0, import_node_path.join)(root.path, name);
+      const details = await (0, import_promises.lstat)(path, { bigint: true });
+      if (!/^replica\.db-(?:wal|shm|journal)$/.test(name) || !details.isFile()) {
+        throw new Error(`Unexpected replica child during schema inspection: ${name}`);
+      }
+      root.children.push({ path, relative: name, kind: "file", identity: details, parent: root });
+      knownEntries.push(identityOf(name, "file", details));
+    }
+    return { root, directories, knownEntries, unknownPaths, unknownEntries };
+  } catch (error) {
+    await closeDirectories(directories);
+    throw error;
+  }
+}
+async function closeDirectories(directories) {
+  for (const directory of directories.reverse()) await directory.handle.close();
+}
+async function inspectSqliteReplicaLayout(dir, options = {}) {
+  const inventory = await inspect(dir, options.allowAdapterFence === true);
+  try {
+    return {
+      knownEntries: inventory.knownEntries,
+      unknownPaths: inventory.unknownPaths,
+      unknownEntries: inventory.unknownEntries,
+      rootIdentity: { dev: inventory.root.identity.dev.toString(), ino: inventory.root.identity.ino.toString() }
+    };
+  } finally {
+    await closeDirectories(inventory.directories);
+  }
+}
+function approvedEntries(entries) {
+  const approved = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (typeof entry !== "object" || entry === null || Object.keys(entry).sort().join(",") !== "dev,ino,kind,path" || typeof entry.path !== "string" || !entry.path || entry.path.split("/").some((part) => !part || part === "." || part === ".." || part.includes("\\")) || !["file", "directory", "symlink"].includes(entry.kind) || typeof entry.dev !== "string" || !/^(0|[1-9][0-9]*)$/.test(entry.dev) || typeof entry.ino !== "string" || !/^(0|[1-9][0-9]*)$/.test(entry.ino) || approved.has(entry.path)) {
+      throw new Error("Invalid or duplicate replica approval.");
+    }
+    approved.set(entry.path, entry);
+  }
+  return approved;
+}
+var LAYOUT_FAULTS = /* @__PURE__ */ Symbol("tinycloud.replica.layout-faults");
+async function removeSqliteReplicaLayout(dir, options = {}) {
+  const inventory = await inspect(dir, options.allowAdapterFence === true);
+  try {
+    if (options.expectedRoot && (options.expectedRoot.dev !== inventory.root.identity.dev.toString() || options.expectedRoot.ino !== inventory.root.identity.ino.toString())) {
+      throw new Error("Replica root identity changed since approval.");
+    }
+    const approved = approvedEntries(options.approvedUnknown ?? []);
+    for (const entry of inventory.unknownEntries) {
+      const match = approved.get(entry.path);
+      if (!match || match.kind !== entry.kind || match.dev !== entry.dev || match.ino !== entry.ino) {
+        throw new Error(`Unknown replica child or approval identity mismatch: ${entry.path}`);
+      }
+    }
+    if (options.expectedKnown) {
+      const expected = approvedEntries(options.expectedKnown);
+      for (const entry of inventory.knownEntries) {
+        const match = expected.get(entry.path);
+        if (!match || match.kind !== entry.kind || match.dev !== entry.dev || match.ino !== entry.ino) {
+          throw new Error(`Known replica child changed since preflight: ${entry.path}`);
+        }
+      }
+    }
+    if (options.allowMissingDatabase && inventory.knownEntries.some((entry) => entry.path === "replica.db")) {
+      throw new Error("Replica database appeared after approval of its absence.");
+    }
+    if (inventory.unknownPaths.length !== inventory.unknownEntries.length && inventory.root.children.length > 0 && !options.allowMissingDatabase) {
+      throw new Error("Replica database is missing; cannot approve removal.");
+    }
+    async function removeDirectory(directory) {
+      for (const child of directory.children.sort((a, b) => a.relative === "replica.db" ? 1 : b.relative === "replica.db" ? -1 : 0)) {
+        if (child.directory) {
+          await removeDirectory(child.directory);
+        }
+        await options[LAYOUT_FAULTS]?.beforeUnlink?.(child.relative);
+        await checkDirectory(directory);
+        const details = await (0, import_promises.lstat)(child.path, { bigint: true });
+        if (process.platform !== "linux" && details.isSymbolicLink()) {
+          throw new Error(`Symlink in replica path: ${child.relative}`);
+        }
+        if (fileKind(details) !== child.kind || !sameFile(child.identity, details)) {
+          throw new Error(`Replica child identity changed: ${child.relative}`);
+        }
+        if (child.directory) await (0, import_promises.rmdir)(child.path);
+        else await (0, import_promises.unlink)(child.path);
+      }
+    }
+    await removeDirectory(inventory.root);
+    await checkDirectory(inventory.root);
+    await (0, import_promises.rmdir)(inventory.root.name);
+  } finally {
+    await closeDirectories(inventory.directories);
+  }
+}
+
+// src/sqlite/store.ts
+var sqliteOpenQueue = Promise.resolve();
+async function acquireSqliteOpen() {
+  const previous = sqliteOpenQueue;
+  let release;
+  sqliteOpenQueue = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  await previous;
+  return release;
+}
+async function captureNamedPath(path) {
+  const names = [];
+  for (let current = (0, import_node_path2.resolve)(path); ; current = (0, import_node_path2.dirname)(current)) {
+    names.push(current);
+    if ((0, import_node_path2.dirname)(current) === current) break;
+  }
+  const identities = [];
+  for (const name of names.reverse()) {
+    const stats = await (0, import_promises2.lstat)(name, { bigint: true });
+    identities.push({ path: name, dev: stats.dev, ino: stats.ino });
+  }
+  return identities;
+}
+async function openVerifiedDatabase(path, opener, options = {}) {
+  const leaf = await (0, import_promises2.open)(path, import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_NOFOLLOW);
+  let db;
+  try {
+    const identity = await leaf.stat();
+    const named = await (0, import_promises2.lstat)(path);
+    if (!identity.isFile() || !named.isFile() || named.dev !== identity.dev || named.ino !== identity.ino || options.expected !== void 0 && (options.expected.dev !== identity.dev || options.expected.ino !== identity.ino)) {
+      throw new Error("The replica database changed before SQLite opened it.");
+    }
+    const previousFds = process.platform === "linux" && options.discoverDescriptors !== false ? new Map((0, import_node_fs2.readdirSync)("/proc/self/fd").map((fd) => {
+      try {
+        return [fd, (0, import_node_fs2.readlinkSync)(`/proc/self/fd/${fd}`)];
+      } catch {
+        return [fd, ""];
+      }
+    })) : null;
+    db = options.readonly ? opener(path, { readonly: true }) : opener(path);
+    const afterOpen = (0, import_node_fs2.lstatSync)(path);
+    if (!afterOpen.isFile() || afterOpen.dev !== identity.dev || afterOpen.ino !== identity.ino) {
+      throw new Error("The replica database changed while SQLite opened it.");
+    }
+    if (previousFds) db.get("SELECT count(*) FROM sqlite_master");
+    if (previousFds) {
+      const databases = (0, import_node_fs2.readdirSync)("/proc/self/fd").filter((fd) => {
+        try {
+          const target = (0, import_node_fs2.readlinkSync)(`/proc/self/fd/${fd}`);
+          return target.endsWith("/replica.db") && previousFds.get(fd) !== target;
+        } catch {
+          return false;
+        }
+      });
+      const sharedPager = options.readonly && databases.length === 0 && [...previousFds].some(([fd, target]) => {
+        if (Number(fd) === leaf.fd || !target.endsWith("/replica.db")) return false;
+        try {
+          const actual = (0, import_node_fs2.fstatSync)(Number(fd));
+          return actual.dev === identity.dev && actual.ino === identity.ino;
+        } catch {
+          return false;
+        }
+      });
+      if (!databases.length && !sharedPager || databases.some((fd) => {
+        try {
+          const actual = (0, import_node_fs2.fstatSync)(Number(fd));
+          return actual.dev !== identity.dev || actual.ino !== identity.ino;
+        } catch {
+          return true;
+        }
+      })) {
+        throw new Error("SQLite opened a different replica database.");
+      }
+    }
+    const after = (0, import_node_fs2.lstatSync)(path);
+    if (!after.isFile() || after.dev !== identity.dev || after.ino !== identity.ino) {
+      throw new Error("The replica database changed while SQLite opened it.");
+    }
+    const checked = db;
+    db = void 0;
+    return { db: checked, identity };
+  } finally {
+    try {
+      db?.close();
+    } finally {
+      await leaf.close();
+    }
+  }
+}
+var DURABILITY = "sqlite-wal-synchronous-full+fsynced-blobs";
 function grantOf(cid, bytes, audience, issuer, nbf, exp) {
   if (cid === null || bytes === null || audience === null || issuer === null) return null;
   return { cid, bytes: new Uint8Array(bytes), audience, issuer, notBefore: nbf, expiresAt: exp };
@@ -340,9 +726,79 @@ var isHash = (name) => /^[0-9a-f]{64}$/.test(name);
 function errnoOf(error) {
   return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
 }
+var isShard = (name) => /^[0-9a-f]{2}$/.test(name);
+var isTempName = (name) => /^[0-9a-f]{64}\.[0-9a-f]{12}$/.test(name);
+async function writerBlobFiles(root) {
+  const out = [];
+  let shards;
+  try {
+    shards = await (0, import_promises2.readdir)(root, { withFileTypes: true });
+  } catch (error) {
+    if (errnoOf(error) === "ENOENT" || errnoOf(error) === "ENOTDIR") return out;
+    throw error;
+  }
+  for (const shard of shards) {
+    const temp = shard.name === ".tmp";
+    if (!shard.isDirectory() || !(temp || isShard(shard.name))) continue;
+    const shardPath = (0, import_node_path2.join)(root, shard.name);
+    let files;
+    try {
+      files = await (0, import_promises2.readdir)(shardPath, { withFileTypes: true });
+    } catch (error) {
+      if (errnoOf(error) === "ENOENT" || errnoOf(error) === "ENOTDIR") continue;
+      throw error;
+    }
+    for (const file of files) {
+      if (!file.isFile()) continue;
+      const ok = temp ? isTempName(file.name) : isHash(file.name) && file.name.startsWith(shard.name);
+      if (!ok) continue;
+      const path = (0, import_node_path2.join)(shardPath, file.name);
+      const info = await (0, import_promises2.lstat)(path).catch(() => void 0);
+      if (!info?.isFile()) continue;
+      out.push({ path, hash: temp ? null : file.name, size: info.size });
+    }
+  }
+  return out;
+}
+async function unlinkWriterOrphans(root, keep) {
+  let removed = 0;
+  const touched = /* @__PURE__ */ new Set();
+  for (const file of await writerBlobFiles(root)) {
+    if (file.hash !== null && keep.has(file.hash)) continue;
+    await (0, import_promises2.rm)(file.path, { force: true });
+    touched.add((0, import_node_path2.dirname)(file.path));
+    removed += 1;
+  }
+  for (const dir of touched) if (!dir.endsWith(".tmp")) await (0, import_promises2.rmdir)(dir).catch(() => void 0);
+  return removed;
+}
+async function unlinkBlobsIn(root, keep) {
+  let removed = 0;
+  for (const shard of await entriesOf(root)) {
+    const shardPath = (0, import_node_path2.join)(root, shard);
+    if (shard === ".tmp") {
+      for (const name of await entriesOf(shardPath)) {
+        await (0, import_promises2.rm)((0, import_node_path2.join)(shardPath, name), { force: true });
+        removed += 1;
+      }
+      continue;
+    }
+    let kept = 0;
+    for (const name of await entriesOf(shardPath)) {
+      if (isHash(name) && keep.has(name)) {
+        kept += 1;
+        continue;
+      }
+      await (0, import_promises2.rm)((0, import_node_path2.join)(shardPath, name), { force: true });
+      removed += 1;
+    }
+    if (kept === 0) await (0, import_promises2.rmdir)(shardPath).catch(() => void 0);
+  }
+  return removed;
+}
 async function entriesOf(path) {
   try {
-    return await (0, import_promises.readdir)(path);
+    return await (0, import_promises2.readdir)(path);
   } catch (error) {
     if (errnoOf(error) === "ENOENT") return [];
     throw error;
@@ -351,33 +807,81 @@ async function entriesOf(path) {
 var FAULTS = /* @__PURE__ */ Symbol("tinycloud.replica.faults");
 var pinnedDirectories = new FinalizationRegistry((fd) => {
   try {
-    (0, import_node_fs.closeSync)(fd);
+    (0, import_node_fs2.closeSync)(fd);
   } catch {
   }
 });
+var writableStores = /* @__PURE__ */ new Map();
+function releaseWritable(shared) {
+  if (shared.references === 0 || --shared.references !== 0) return;
+  if (writableStores.get(shared.key) === shared) writableStores.delete(shared.key);
+  try {
+    shared.db.close();
+  } finally {
+    if (shared.directoryFd !== void 0) (0, import_node_fs2.closeSync)(shared.directoryFd);
+  }
+}
+var sharedStores = new FinalizationRegistry((shared) => {
+  try {
+    releaseWritable(shared);
+  } catch {
+  }
+});
+async function acquireWritableMutation(shared) {
+  const previous = shared.mutationTail;
+  let release;
+  shared.mutationTail = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  await previous;
+  return release;
+}
+var activeReadSection = new import_node_async_hooks.AsyncLocalStorage();
 var SqliteReplicaStore = class _SqliteReplicaStore {
   dir;
-  #db;
+  #database;
+  get #db() {
+    if (this.#closed) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica store is closed.");
+    return this.#database;
+  }
+  #closed = false;
+  #closing = false;
+  #closePromise;
+  #activeMutations = 0;
+  #drained;
+  #shared;
+  #readonlySnapshot;
   #pinnedDir;
   #directoryFd;
-  #holder = `${process.pid}-${(0, import_node_crypto.randomBytes)(6).toString("hex")}`;
+  #holder;
   #now;
   #faults;
   #guard;
   /** Identity of the database file this store opened: a deleted-and-recreated replica is a different file. */
   #ino;
+  #admit;
+  #partitionId;
   #dev;
   #namedAncestors;
-  constructor(dir, db, identity, options, directoryFd, namedAncestors = []) {
+  constructor(dir, db, identity, options, directoryFd, namedAncestors = [], shared, readonlySnapshot = false) {
     this.dir = dir;
-    this.#pinnedDir = directoryFd !== void 0 && process.platform === "linux" ? `/proc/self/fd/${directoryFd}` : dir;
+    this.#pinnedDir = shared?.pinnedDir ?? (directoryFd !== void 0 && process.platform === "linux" ? `/proc/self/fd/${directoryFd}` : dir);
     this.#directoryFd = directoryFd;
-    if (directoryFd !== void 0) pinnedDirectories.register(this, directoryFd, this);
-    this.#db = db;
+    this.#shared = shared;
+    this.#readonlySnapshot = readonlySnapshot;
+    if (shared) {
+      shared.references++;
+      sharedStores.register(this, shared, this);
+    } else if (directoryFd !== void 0) {
+      pinnedDirectories.register(this, directoryFd, this);
+    }
+    this.#database = db;
     this.#ino = identity.ino;
     this.#dev = identity.dev;
     this.#now = options.now ?? Date.now;
     this.#faults = options[FAULTS] ?? {};
+    this.#admit = options.admit;
+    this.#partitionId = options.partitionId ?? "";
     this.#guard = options.guard ?? ((section) => section());
     this.#namedAncestors = namedAncestors;
   }
@@ -391,10 +895,10 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       if (options.signal?.aborted) throw options.signal.reason ?? new ReplicaError(ReplicaErrorCode.CLOSED, "Replica status inspection was cancelled.");
     };
     checkAbort();
-    const dbPath = (0, import_node_path.join)(dir, "replica.db");
+    const dbPath = (0, import_node_path2.join)(dir, "replica.db");
     let identity;
     try {
-      identity = await (0, import_promises.lstat)(dbPath);
+      identity = await (0, import_promises2.lstat)(dbPath);
       if (!identity.isFile()) return null;
     } catch (error) {
       if (errnoOf(error) === "ENOENT") return null;
@@ -404,21 +908,30 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     const opener = await loadSqlite();
     checkAbort();
     let db;
+    let releaseOpen;
     try {
-      db = opener(dbPath, { readonly: true });
+      releaseOpen = await acquireSqliteOpen();
+      const checked = await openVerifiedDatabase(dbPath, opener, { readonly: true, expected: identity });
+      db = checked.db;
+      releaseOpen();
+      releaseOpen = void 0;
       db.exec("PRAGMA busy_timeout = 0");
       checkAbort();
-      const store = new _SqliteReplicaStore(dir, db, identity, { create: false, ...options.now ? { now: options.now } : {} });
+      const store = new _SqliteReplicaStore(dir, db, checked.identity, { create: false, ...options.now ? { now: options.now } : {} });
       for (let attempt = 0; attempt < 2; attempt++) {
         const before = db.get("PRAGMA data_version").data_version;
         const state = await store.open();
         checkAbort();
         if (state === null) return null;
         const status = await store.status();
-        await new Promise((resolve2) => setImmediate(resolve2));
+        const latest = state.pendingGrant ?? state.grant;
+        const version = db.get("PRAGMA user_version")?.user_version ?? 0;
+        const grantInstall = latest === null || version < 2 ? null : await store.getGrantInstall(latest.cid);
+        const activeGrantInstall = state.grant === null || version < 2 ? null : state.grant === latest ? grantInstall : await store.getGrantInstall(state.grant.cid);
+        await new Promise((resolve3) => setImmediate(resolve3));
         checkAbort();
         const after = db.get("PRAGMA data_version").data_version;
-        if (before === after) return { state, status };
+        if (before === after) return { state, status, grantInstall, activeGrantInstall };
       }
       throw new ReplicaError(ReplicaErrorCode.BUSY, "The replica changed during status inspection.");
     } catch (error) {
@@ -426,33 +939,89 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         throw new ReplicaError(ReplicaErrorCode.BUSY, "The replica is busy during status inspection.", void 0, { cause: error });
       }
       throw storageError(error, "Inspecting the replica");
+    } finally {
+      releaseOpen?.();
+      if (db) {
+        const releaseClose = await acquireSqliteOpen();
+        try {
+          db.close();
+        } finally {
+          releaseClose();
+        }
+      }
+    }
+  }
+  /**
+   * Blob content bytes on disk in the replica at `dir` (0 when absent): the writer's blob files under `blobs/`,
+   * including writer temp files and blobs no entry references any more, so garbage a failed sync
+   * left behind still counts. Counts exactly what `collectOrphans` may delete: foreign entries
+   * (stray files, symlinks, unknown names) are neither counted nor touched. Only blob content is counted: not the database, its WAL, rows or the
+   * pending store. Filesystem-only: it opens no
+   * database, so it can sum a profile's replicas under the caller's own mutation hold.
+   */
+  static async contentBytes(dir) {
+    try {
+      let bytes = 0;
+      for (const file of await writerBlobFiles((0, import_node_path2.join)(dir, "blobs"))) bytes += file.size;
+      return bytes;
+    } catch (error) {
+      throw storageError(error, "Measuring replica content");
+    }
+  }
+  /**
+   * Remove blobs and temp files in the replica at `dir` that no committed row references: what a
+   * crash between writing blobs and committing (or between committing and collecting) leaves.
+   * Returns the number of files removed; 0 when the replica is absent or unreadable.
+   *
+   * The caller MUST hold the profile mutation guard, which every writer of this replica holds
+   * across its blob write and commit; that is what makes an unreferenced blob safe to delete
+   * (it cannot belong to an in-flight write). Never call it without that hold. The database is
+   * read only, so nothing here can take a lease or change committed state.
+   */
+  static async collectOrphans(dir) {
+    const dbPath = (0, import_node_path2.join)(dir, "replica.db");
+    const identity = await (0, import_promises2.lstat)(dbPath).catch(() => void 0);
+    if (!identity?.isFile()) return 0;
+    const opener = await loadSqlite();
+    let keep;
+    let db;
+    try {
+      db = opener(dbPath, { readonly: true });
+      db.exec("PRAGMA busy_timeout = 0");
+      keep = new Set(db.all("SELECT DISTINCT hash FROM entry WHERE content = 1").map((row) => row.hash));
+    } catch {
+      return 0;
     } finally {
       db?.close();
     }
+    try {
+      return await unlinkWriterOrphans((0, import_node_path2.join)(dir, "blobs"), keep);
+    } catch (error) {
+      throw storageError(error, "Collecting orphaned content");
+    }
   }
   /**
    * Open the replica store in `dir`. With `create: false` a missing replica is
    * REPLICA_NOT_FOUND and nothing is written to disk.
    */
   static async open(dir, options) {
-    const namedDbPath = (0, import_node_path.join)(dir, "replica.db");
+    const namedDbPath = (0, import_node_path2.join)(dir, "replica.db");
     if (!options.create) {
-      const exists = await (0, import_promises.lstat)(namedDbPath).then(
+      const exists = await (0, import_promises2.lstat)(namedDbPath).then(
         (stats) => stats.isFile(),
         () => false
       );
       if (!exists) throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, `No regular replica database at ${dir}.`);
     }
-    const opener = options.sqlite ?? await loadSqlite();
     const releaseOpen = await acquireSqliteOpen();
     let store;
     let directoryFd;
     try {
-      if (options.create) await (0, import_promises.mkdir)(dir, { recursive: true, mode: 448 });
+      if (options.create) await (0, import_promises2.mkdir)(dir, { recursive: true, mode: 448 });
       if (process.platform === "linux") {
-        directoryFd = (0, import_node_fs.openSync)(dir, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_DIRECTORY | import_node_fs.constants.O_NOFOLLOW);
+        directoryFd = (0, import_node_fs2.openSync)(dir, import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_DIRECTORY | import_node_fs2.constants.O_NOFOLLOW);
       }
-      const opened = directoryFd === void 0 ? (0, import_node_fs.lstatSync)(dir, { bigint: true }) : (0, import_node_fs.fstatSync)(directoryFd, { bigint: true });
+      const opened = directoryFd === void 0 ? (0, import_node_fs2.lstatSync)(dir, { bigint: true }) : (0, import_node_fs2.fstatSync)(directoryFd, { bigint: true });
       if (!opened.isDirectory() || opened.isSymbolicLink() || options.expectedDirectory && (opened.dev !== BigInt(options.expectedDirectory.dev) || opened.ino !== BigInt(options.expectedDirectory.ino))) {
         throw new Error("The replica directory changed before SQLite opened it.");
       }
@@ -461,11 +1030,11 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         throw new Error("The replica directory changed while checking its ancestry.");
       }
       const pinnedDir = directoryFd === void 0 ? dir : `/proc/self/fd/${directoryFd}`;
-      const dbPath = (0, import_node_path.join)(pinnedDir, "replica.db");
+      const dbPath = (0, import_node_path2.join)(pinnedDir, "replica.db");
       if (options.create) {
-        await (0, import_promises.mkdir)((0, import_node_path.join)(pinnedDir, "blobs", ".tmp"), { recursive: true, mode: 448 });
-        await Promise.all([(0, import_promises.chmod)(pinnedDir, 448), (0, import_promises.chmod)((0, import_node_path.join)(pinnedDir, "blobs"), 448), (0, import_promises.chmod)((0, import_node_path.join)(pinnedDir, "blobs", ".tmp"), 448)]);
-        const handle = await (0, import_promises.open)(dbPath, import_node_fs.constants.O_CREAT | import_node_fs.constants.O_EXCL | import_node_fs.constants.O_RDWR | import_node_fs.constants.O_NOFOLLOW, 384).catch((error) => {
+        await (0, import_promises2.mkdir)((0, import_node_path2.join)(pinnedDir, "blobs", ".tmp"), { recursive: true, mode: 448 });
+        await Promise.all([(0, import_promises2.chmod)(pinnedDir, 448), (0, import_promises2.chmod)((0, import_node_path2.join)(pinnedDir, "blobs"), 448), (0, import_promises2.chmod)((0, import_node_path2.join)(pinnedDir, "blobs", ".tmp"), 448)]);
+        const handle = await (0, import_promises2.open)(dbPath, import_node_fs2.constants.O_CREAT | import_node_fs2.constants.O_EXCL | import_node_fs2.constants.O_RDWR | import_node_fs2.constants.O_NOFOLLOW, 384).catch((error) => {
           if (errnoOf(error) === "EEXIST") return null;
           throw error;
         });
@@ -477,71 +1046,107 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
           }
         }
       }
-      const leaf = await (0, import_promises.open)(dbPath, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW);
+      const leaf = await (0, import_promises2.open)(dbPath, import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_NOFOLLOW);
       let db;
       try {
         const identity = await leaf.stat();
-        const named = await (0, import_promises.lstat)(dbPath);
+        const named = await (0, import_promises2.lstat)(dbPath);
         if (!identity.isFile() || !named.isFile() || named.dev !== identity.dev || named.ino !== identity.ino) {
           throw new Error("The replica database changed before SQLite opened it.");
         }
-        const previousFds = process.platform === "linux" && !options.sqlite ? new Map((0, import_node_fs.readdirSync)("/proc/self/fd").map((fd) => {
-          try {
-            return [fd, (0, import_node_fs.readlinkSync)(`/proc/self/fd/${fd}`)];
-          } catch {
-            return [fd, ""];
+        const key = `${opened.dev}:${opened.ino}`;
+        const active = writableStores.get(key);
+        if (active && (active.dev !== identity.dev || active.ino !== identity.ino)) {
+          throw new Error("The replica database changed while another controller holds it open.");
+        }
+        if (active && !options.sqlite) {
+          const namedDirectory = (0, import_node_fs2.lstatSync)(dir, { bigint: true });
+          if (!namedDirectory.isDirectory() || namedDirectory.dev !== opened.dev || namedDirectory.ino !== opened.ino) {
+            throw new Error("The replica directory changed before its checked SQLite handle could be shared.");
+          }
+          const pinned = active.directoryFd === void 0 ? (0, import_node_fs2.lstatSync)(active.pinnedDir, { bigint: true }) : (0, import_node_fs2.fstatSync)(active.directoryFd, { bigint: true });
+          const activeLeaf = (0, import_node_fs2.lstatSync)((0, import_node_path2.join)(active.pinnedDir, "replica.db"));
+          if (!pinned.isDirectory() || pinned.dev !== opened.dev || pinned.ino !== opened.ino || !activeLeaf.isFile() || activeLeaf.dev !== identity.dev || activeLeaf.ino !== identity.ino || active.directoryFd === void 0 && active.namedPath !== dir) {
+            throw new Error("The live replica changed before its checked SQLite handle could be shared.");
           }
-        })) : null;
-        db = opener(dbPath);
-        const afterOpen = (0, import_node_fs.lstatSync)(dbPath);
-        if (!afterOpen.isFile() || afterOpen.dev !== identity.dev || afterOpen.ino !== identity.ino) {
-          throw new Error("The replica database changed while SQLite opened it.");
+          if (directoryFd !== void 0) {
+            (0, import_node_fs2.closeSync)(directoryFd);
+            directoryFd = void 0;
+          }
+          store = new _SqliteReplicaStore(dir, active.db, identity, options, active.directoryFd, namedAncestors, active);
         }
-        if (previousFds) db.get("SELECT count(*) FROM sqlite_master");
-        if (previousFds) {
-          const databases = (0, import_node_fs.readdirSync)("/proc/self/fd").filter((fd) => {
+        if (!store) {
+          const opener = options.sqlite ?? await loadSqlite();
+          const previousFds = process.platform === "linux" && !options.sqlite ? new Map((0, import_node_fs2.readdirSync)("/proc/self/fd").map((fd) => {
             try {
-              const target = (0, import_node_fs.readlinkSync)(`/proc/self/fd/${fd}`);
-              return target.endsWith("/replica.db") && previousFds.get(fd) !== target;
+              return [fd, (0, import_node_fs2.readlinkSync)(`/proc/self/fd/${fd}`)];
             } catch {
-              return false;
+              return [fd, ""];
             }
-          });
-          if (databases.length === 0 || databases.some((fd) => {
-            try {
-              const actual = (0, import_node_fs.fstatSync)(Number(fd));
-              return actual.dev !== identity.dev || actual.ino !== identity.ino;
-            } catch {
-              return true;
+          })) : null;
+          db = opener(dbPath);
+          const afterOpen = (0, import_node_fs2.lstatSync)(dbPath);
+          if (!afterOpen.isFile() || afterOpen.dev !== identity.dev || afterOpen.ino !== identity.ino) {
+            throw new Error("The replica database changed while SQLite opened it.");
+          }
+          if (previousFds) db.get("SELECT count(*) FROM sqlite_master");
+          if (previousFds) {
+            const databases = (0, import_node_fs2.readdirSync)("/proc/self/fd").filter((fd) => {
+              try {
+                const target = (0, import_node_fs2.readlinkSync)(`/proc/self/fd/${fd}`);
+                return target.endsWith("/replica.db") && previousFds.get(fd) !== target;
+              } catch {
+                return false;
+              }
+            });
+            if (databases.length === 0 || databases.some((fd) => {
+              try {
+                const actual = (0, import_node_fs2.fstatSync)(Number(fd));
+                return actual.dev !== identity.dev || actual.ino !== identity.ino;
+              } catch {
+                return true;
+              }
+            })) {
+              throw new Error("SQLite opened a different replica database.");
             }
-          })) {
-            throw new Error("SQLite opened a different replica database.");
           }
+          const after = (0, import_node_fs2.lstatSync)(dbPath);
+          if (!after.isFile() || after.dev !== identity.dev || after.ino !== identity.ino) {
+            throw new Error("The replica database changed while SQLite opened it.");
+          }
+          db.exec("PRAGMA busy_timeout = 5000");
+          db.exec("PRAGMA journal_mode = WAL");
+          db.exec("PRAGMA synchronous = FULL");
+          db.exec("PRAGMA secure_delete = ON");
+          db.exec("PRAGMA foreign_keys = ON");
+          const version = db.get("PRAGMA user_version")?.user_version ?? 0;
+          if (version > SCHEMA_VERSION) {
+            throw new ReplicaError(
+              ReplicaErrorCode.STORAGE_ERROR,
+              `The replica at ${dir} was written by a newer tc (schema ${version}); upgrade tc to read it.`
+            );
+          }
+          if (version < SCHEMA_VERSION) {
+            db.exec("BEGIN IMMEDIATE");
+            db.exec(SCHEMA);
+            db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+            db.exec("COMMIT");
+          }
+          const shared = {
+            key,
+            db,
+            directoryFd,
+            pinnedDir,
+            namedPath: dir,
+            dev: identity.dev,
+            ino: identity.ino,
+            references: 0,
+            mutationTail: Promise.resolve()
+          };
+          store = new _SqliteReplicaStore(dir, db, identity, options, directoryFd, namedAncestors, shared);
+          if (!options.sqlite) writableStores.set(key, shared);
+          db = void 0;
         }
-        const after = (0, import_node_fs.lstatSync)(dbPath);
-        if (!after.isFile() || after.dev !== identity.dev || after.ino !== identity.ino) {
-          throw new Error("The replica database changed while SQLite opened it.");
-        }
-        db.exec("PRAGMA busy_timeout = 5000");
-        db.exec("PRAGMA journal_mode = WAL");
-        db.exec("PRAGMA synchronous = FULL");
-        db.exec("PRAGMA secure_delete = ON");
-        db.exec("PRAGMA foreign_keys = ON");
-        const version = db.get("PRAGMA user_version")?.user_version ?? 0;
-        if (version > SCHEMA_VERSION) {
-          throw new ReplicaError(
-            ReplicaErrorCode.STORAGE_ERROR,
-            `The replica at ${dir} was written by a newer tc (schema ${version}); upgrade tc to read it.`
-          );
-        }
-        if (version < SCHEMA_VERSION) {
-          db.exec("BEGIN IMMEDIATE");
-          db.exec(SCHEMA);
-          db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
-          db.exec("COMMIT");
-        }
-        store = new _SqliteReplicaStore(dir, db, identity, options, directoryFd, namedAncestors);
-        db = void 0;
       } finally {
         try {
           db?.close();
@@ -551,7 +1156,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       }
     } catch (error) {
       if (store) await store.close().catch(() => void 0);
-      else if (directoryFd !== void 0) (0, import_node_fs.closeSync)(directoryFd);
+      else if (directoryFd !== void 0) (0, import_node_fs2.closeSync)(directoryFd);
       throw storageError(error, `Opening the replica at ${dir}`);
     } finally {
       releaseOpen();
@@ -567,12 +1172,109 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       throw error;
     }
   }
+  /**
+   * A gated read borrows this controller's already-verified writable handle.
+   * Borrow before the first await: the parent may close in the callback, but
+   * its pin and native handle remain live until the snapshot releases them.
+   * Serialize BEGIN through COMMIT/ROLLBACK with writes on the shared handle.
+   */
+  async readTransaction(generation, checkGate, section) {
+    this.#assertAccepting();
+    const shared = this.#shared;
+    if (!shared) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica handle is closed.");
+    const snapshot = new _SqliteReplicaStore(
+      this.dir,
+      shared.db,
+      { dev: this.#dev, ino: this.#ino },
+      { create: false, now: this.#now },
+      shared.directoryFd,
+      this.#namedAncestors,
+      shared,
+      true
+    );
+    let release;
+    let active = false;
+    let callbackFailed = false;
+    try {
+      release = await acquireWritableMutation(shared);
+      await snapshot.#assertReadIdentity();
+      snapshot.#db.exec("BEGIN");
+      active = true;
+      const tombstone = snapshot.#db.get("SELECT generation FROM replica WHERE id = 1");
+      try {
+        await checkGate();
+      } catch (error) {
+        callbackFailed = true;
+        throw error;
+      }
+      if (tombstone === void 0 || tombstone.generation !== generation) {
+        throw new ReplicaError(ReplicaErrorCode.RESET_REQUIRED, "The replica generation changed; reopen it to continue.");
+      }
+      let result;
+      const context = { controller: this, active: true };
+      try {
+        try {
+          result = await activeReadSection.run(context, () => section(snapshot));
+        } catch (error) {
+          callbackFailed = true;
+          throw error;
+        }
+      } finally {
+        context.active = false;
+      }
+      try {
+        await checkGate();
+      } catch (error) {
+        callbackFailed = true;
+        throw error;
+      }
+      await snapshot.#assertReadIdentity();
+      snapshot.#db.exec("COMMIT");
+      active = false;
+      return result;
+    } catch (error) {
+      if (callbackFailed) throw error;
+      if (isReplicaError(error) || typeof error === "object" && error !== null && "code" in error && error.code === "REPLICA_GATED") throw error;
+      if (["ENOENT", "ELOOP", "ENOTDIR"].includes(String(errnoOf(error))) || /replica database changed|SQLite opened a different replica database/i.test(error instanceof Error ? error.message : String(error))) {
+        throw new ReplicaError(ReplicaErrorCode.RESET_REQUIRED, "The replica was replaced; reopen it to continue.", void 0, { cause: error });
+      }
+      throw storageError(error, "Reading the replica snapshot");
+    } finally {
+      if (active) {
+        try {
+          snapshot.#db.exec("ROLLBACK");
+        } catch {
+        }
+      }
+      try {
+        await snapshot.close();
+      } finally {
+        release?.();
+      }
+    }
+  }
+  async #assertReadIdentity() {
+    const shared = this.#shared;
+    const pinned = shared.directoryFd === void 0 ? (0, import_node_fs2.lstatSync)(shared.pinnedDir) : (0, import_node_fs2.fstatSync)(shared.directoryFd);
+    const namedDir = (0, import_node_fs2.lstatSync)(this.dir);
+    const namedDb = (0, import_node_fs2.lstatSync)((0, import_node_path2.join)(this.dir, "replica.db"));
+    const pinnedDb = (0, import_node_fs2.lstatSync)((0, import_node_path2.join)(shared.pinnedDir, "replica.db"));
+    if (!pinned.isDirectory() || !namedDir.isDirectory() || pinned.dev !== namedDir.dev || pinned.ino !== namedDir.ino || !namedDb.isFile() || !pinnedDb.isFile() || namedDb.dev !== this.#dev || namedDb.ino !== this.#ino || pinnedDb.dev !== this.#dev || pinnedDb.ino !== this.#ino) {
+      throw new ReplicaError(ReplicaErrorCode.RESET_REQUIRED, "The replica was replaced during its read; reopen it to continue.");
+    }
+    if (this.#namedAncestors.length) {
+      const ancestors = await captureNamedPath(this.dir);
+      if (ancestors.length !== this.#namedAncestors.length || ancestors.some((entry, index) => entry.dev !== this.#namedAncestors[index].dev || entry.ino !== this.#namedAncestors[index].ino)) {
+        throw new ReplicaError(ReplicaErrorCode.RESET_REQUIRED, "The replica directory was replaced; reopen it to continue.");
+      }
+    }
+  }
   #row() {
     return this.#db.get("SELECT * FROM replica WHERE id = 1");
   }
   /** Refuse to touch the filesystem for a replica that was deleted (or replaced) under us. */
   async #assertPresent() {
-    const identity = await (0, import_promises.lstat)((0, import_node_path.join)(this.#pinnedDir, "replica.db")).catch(() => null);
+    const identity = await (0, import_promises2.lstat)((0, import_node_path2.join)(this.#pinnedDir, "replica.db")).catch(() => null);
     if (!identity?.isFile() || identity.dev !== this.#dev || identity.ino !== this.#ino) {
       throw new ReplicaError(
         ReplicaErrorCode.NOT_FOUND,
@@ -580,30 +1282,63 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       );
     }
   }
+  /** New calls stop at close; accepted mutation sections may still finish their transactions. */
+  #assertAccepting() {
+    if (this.#closing || this.#closed) {
+      throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica store is closed.");
+    }
+  }
   /** A short mutation section: guarded (profile lock) and checked against the database this store opened. */
   #mutate(section) {
-    return this.#guard(async () => {
-      await this.#assertPresent();
-      return section();
-    });
+    this.#assertAccepting();
+    if (this.#readonlySnapshot) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "A read-only replica snapshot cannot mutate the shared database.");
+    }
+    const read = activeReadSection.getStore();
+    if (read?.active && read.controller === this) {
+      throw new ReplicaError(
+        ReplicaErrorCode.STORAGE_ERROR,
+        "mutation attempted on the same controller while its readTransaction section is active; this would deadlock"
+      );
+    }
+    this.#activeMutations++;
+    return (async () => {
+      try {
+        return await this.#guard(async () => {
+          await this.#assertPresent();
+          return section();
+        });
+      } finally {
+        if (--this.#activeMutations === 0) {
+          const drained = this.#drained;
+          this.#drained = void 0;
+          drained?.();
+        }
+      }
+    })();
   }
   /** Run `body` in a write transaction (BEGIN IMMEDIATE). Callers outside a mutation section use `#guardedWrite`. */
-  #write(action, body) {
+  async #write(action, body) {
+    const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
     try {
-      this.#db.exec("BEGIN IMMEDIATE");
-    } catch (error) {
-      throw storageError(error, action);
-    }
-    try {
-      const result = body();
-      this.#db.exec("COMMIT");
-      return result;
-    } catch (error) {
       try {
-        this.#db.exec("ROLLBACK");
-      } catch {
+        this.#db.exec("BEGIN IMMEDIATE");
+      } catch (error) {
+        throw storageError(error, action);
+      }
+      try {
+        const result = body();
+        this.#db.exec("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          this.#db.exec("ROLLBACK");
+        } catch {
+        }
+        throw storageError(error, action);
       }
-      throw storageError(error, action);
+    } finally {
+      release?.();
     }
   }
   /** One write transaction as its own mutation section. */
@@ -630,6 +1365,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     }
   }
   async open() {
+    this.#assertAccepting();
     let row;
     try {
       row = this.#row();
@@ -708,6 +1444,110 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       );
     });
   }
+  /** Per-CID first-install anchor and policy bound share the pending-grant transaction. */
+  #grantInstall(cid) {
+    const row = this.#db.get(
+      "SELECT installed_at, effective_expires_at, consent_deadline, consent_anchor_at, consent_anchor_source FROM grant_install WHERE cid = ?",
+      cid
+    );
+    if (row === void 0) return null;
+    if (!(row.consent_anchor_source === "siwe" || row.consent_anchor_source === "delegation_iat" || row.consent_anchor_source === "delegation_nbf" || row.consent_anchor_source === "first_install") || !Number.isSafeInteger(row.installed_at) || row.installed_at < 0 || !Number.isSafeInteger(row.effective_expires_at) || row.effective_expires_at < 0 || !Number.isSafeInteger(row.consent_deadline) || row.consent_deadline < 0 || !Number.isSafeInteger(row.consent_anchor_at) || row.consent_anchor_at < 0) {
+      throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The stored grant expiry or consent anchor is invalid.");
+    }
+    return {
+      installedAt: row.installed_at,
+      effectiveExpiresAt: row.effective_expires_at,
+      consentDeadline: row.consent_deadline,
+      consentAnchor: { at: row.consent_anchor_at, source: row.consent_anchor_source }
+    };
+  }
+  async getGrantInstall(cid) {
+    return this.#grantInstall(cid);
+  }
+  /** Every installed CID, including superseded ones, for an origin-wide purge floor. */
+  async grantInstallTimes() {
+    const rows = this.#db.all(
+      "SELECT cid, installed_at FROM grant_install"
+    );
+    return rows.map((row) => {
+      if (typeof row.cid !== "string" || row.cid.length === 0 || !Number.isSafeInteger(row.installed_at) || row.installed_at < 0) {
+        throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The stored grant install time is invalid.");
+      }
+      return { cid: row.cid, installedAt: row.installed_at };
+    });
+  }
+  /** Phase 2 installed grants cannot commit a page after their shorter local TTL. */
+  #assertInstalledGrantTime() {
+    const row = this.#row();
+    const cid = row?.pending_grant_cid ?? row?.grant_cid;
+    if (cid === void 0 || cid === null) return;
+    const installed = this.#grantInstall(cid);
+    const now = this.#now();
+    if (installed !== null && (now >= installed.effectiveExpiresAt || now >= installed.consentDeadline)) {
+      throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The installed grant expired before this page committed.");
+    }
+  }
+  #storeGrantPolicy(g, policy, existing) {
+    const installedAt = existing?.installedAt ?? policy.at;
+    const keepExisting = existing !== null && existing.consentDeadline < policy.consentDeadline;
+    const consentDeadline = keepExisting ? existing.consentDeadline : policy.consentDeadline;
+    const consentAnchor = keepExisting ? existing.consentAnchor : policy.consentAnchor;
+    const effectiveExpiresAt = Math.min(
+      g.expiresAt === null ? Infinity : g.expiresAt * 1e3,
+      installedAt + policy.ttlMs,
+      consentDeadline
+    );
+    if (!Number.isSafeInteger(installedAt) || installedAt < 0 || !Number.isSafeInteger(effectiveExpiresAt) || effectiveExpiresAt < 0 || !Number.isSafeInteger(consentDeadline) || consentDeadline < 0 || !Number.isSafeInteger(consentAnchor.at) || consentAnchor.at < 0 || !Number.isSafeInteger(policy.ttlMs) || policy.ttlMs <= 0) {
+      throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The replica grant has no finite effective expiry.");
+    }
+    this.#db.run(
+      `INSERT INTO grant_install (cid, installed_at, effective_expires_at, consent_deadline, consent_anchor_at, consent_anchor_source)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT (cid) DO UPDATE SET effective_expires_at = excluded.effective_expires_at,
+         consent_deadline = excluded.consent_deadline, consent_anchor_at = excluded.consent_anchor_at,
+         consent_anchor_source = excluded.consent_anchor_source`,
+      g.cid,
+      installedAt,
+      effectiveExpiresAt,
+      consentDeadline,
+      consentAnchor.at,
+      consentAnchor.source
+    );
+    return { installedAt, effectiveExpiresAt, consentDeadline, consentAnchor };
+  }
+  async installGatedGrant(g, policy) {
+    return this.#guardedWrite("Installing the gated grant", () => {
+      const row = this.#row();
+      if (row === void 0) throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica has not been created.");
+      const previous = this.#grantInstall(g.cid);
+      if (previous === null && (row.grant_cid === g.cid || row.pending_grant_cid === g.cid)) {
+        throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The installed grant has no durable first-install time.");
+      }
+      const next = this.#storeGrantPolicy(g, policy, previous);
+      if (next.effectiveExpiresAt <= this.#now()) {
+        throw new ReplicaError(ReplicaErrorCode.GRANT_EXPIRED, "The replica grant expired under the current policy.");
+      }
+      if (row.grant_cid !== g.cid && row.pending_grant_cid !== g.cid) {
+        this.#db.run(
+          `UPDATE replica SET pending_grant_cid = ?, pending_grant_bytes = ?, pending_grant_audience = ?,
+             pending_grant_issuer = ?, pending_grant_nbf = ?, pending_grant_exp = ?, pending_grant_error = NULL WHERE id = 1`,
+          g.cid,
+          g.bytes,
+          g.audience,
+          g.issuer,
+          g.notBefore,
+          g.expiresAt
+        );
+      }
+      return next;
+    });
+  }
+  async recomputeGrantInstall(g, policy) {
+    return this.#guardedWrite("Recomputing the gated grant", () => {
+      const previous = this.#grantInstall(g.cid);
+      return previous === null ? null : this.#storeGrantPolicy(g, policy, previous);
+    });
+  }
   async installGrant(g) {
     await this.#guardedWrite("Installing the grant", () => {
       const row = this.#row();
@@ -766,13 +1606,14 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       const now = this.#now();
       if (row.lease_holder !== null && row.lease_expires_at !== null && row.lease_expires_at > now) return null;
       const token = row.lease_token + 1;
+      const holder = this.#holder ??= `${process.pid}-${(0, import_node_crypto.randomBytes)(6).toString("hex")}`;
       this.#db.run(
         "UPDATE replica SET lease_token = ?, lease_holder = ?, lease_expires_at = ? WHERE id = 1",
         token,
-        this.#holder,
+        holder,
         now + ttlMs
       );
-      return { token, holder: this.#holder };
+      return { token, holder };
     });
   }
   async renewLease(t, ttlMs) {
@@ -791,6 +1632,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     });
   }
   async hasContent(hashes) {
+    this.#assertAccepting();
     const held = /* @__PURE__ */ new Set();
     for (let start = 0; start < hashes.length; start += 500) {
       const chunk = hashes.slice(start, start + 500);
@@ -803,7 +1645,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     return held;
   }
   #blobPath(hash) {
-    return (0, import_node_path.join)(this.#pinnedDir, "blobs", hash.slice(0, 2), hash);
+    return (0, import_node_path2.join)(this.#pinnedDir, "blobs", hash.slice(0, 2), hash);
   }
   /**
    * Make every blob durable before any row references it: write to a fresh
@@ -815,17 +1657,17 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     const dirs = /* @__PURE__ */ new Set();
     for (const [hash, bytes] of blobs) {
       const final = this.#blobPath(hash);
-      const exists = await (0, import_promises.stat)(final).then(
+      const exists = await (0, import_promises2.stat)(final).then(
         () => true,
         () => false
       );
       if (exists) continue;
-      const shard = (0, import_node_path.join)(this.#pinnedDir, "blobs", hash.slice(0, 2));
-      await (0, import_promises.mkdir)(shard, { mode: 448 }).catch((error) => {
+      const shard = (0, import_node_path2.join)(this.#pinnedDir, "blobs", hash.slice(0, 2));
+      await (0, import_promises2.mkdir)(shard, { mode: 448 }).catch((error) => {
         if (errnoOf(error) !== "EEXIST") throw error;
       });
-      const temp = (0, import_node_path.join)(this.#pinnedDir, "blobs", ".tmp", `${hash}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}`);
-      const handle = await (0, import_promises.open)(temp, import_node_fs.constants.O_CREAT | import_node_fs.constants.O_EXCL | import_node_fs.constants.O_WRONLY, 384);
+      const temp = (0, import_node_path2.join)(this.#pinnedDir, "blobs", ".tmp", `${hash}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}`);
+      const handle = await (0, import_promises2.open)(temp, import_node_fs2.constants.O_CREAT | import_node_fs2.constants.O_EXCL | import_node_fs2.constants.O_WRONLY, 384);
       try {
         await handle.writeFile(bytes);
         await handle.sync();
@@ -833,17 +1675,17 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         await handle.close();
       }
       try {
-        await (0, import_promises.link)(temp, final);
+        await (0, import_promises2.link)(temp, final);
       } catch (error) {
         if (errnoOf(error) !== "EEXIST") throw error;
       } finally {
-        await (0, import_promises.unlink)(temp);
+        await (0, import_promises2.unlink)(temp);
       }
       dirs.add(shard);
-      dirs.add((0, import_node_path.join)(this.#pinnedDir, "blobs"));
+      dirs.add((0, import_node_path2.join)(this.#pinnedDir, "blobs"));
     }
     for (const dir of dirs) {
-      const handle = await (0, import_promises.open)(dir, import_node_fs.constants.O_RDONLY);
+      const handle = await (0, import_promises2.open)(dir, import_node_fs2.constants.O_RDONLY);
       try {
         await handle.sync();
       } finally {
@@ -854,6 +1696,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   async applyPage(t, p) {
     await this.#mutate(async () => {
       this.#checkLease(t);
+      this.#assertInstalledGrantTime();
       const reused = /* @__PURE__ */ new Map();
       for (const change of p.changes) {
         if (change.deleted || !change.content || p.blobs.has(change.hash) || reused.has(change.hash)) continue;
@@ -866,6 +1709,41 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         }
         reused.set(change.hash, size);
       }
+      if (this.#admit) {
+        await this.#collectLocked(t);
+        const changed = new Set(p.changes.map((change) => change.key));
+        const kept = /* @__PURE__ */ new Set();
+        for (const change of p.changes) if (!change.deleted && change.content) kept.add(change.hash);
+        let blobBytes = 0;
+        for (const [hash, bytes] of p.blobs) {
+          const stored = this.#db.get(
+            "SELECT 1 AS hit FROM entry WHERE hash = ? AND content = 1 AND deleted = 0 LIMIT 1",
+            hash
+          );
+          if (stored === void 0) blobBytes += bytes.byteLength;
+        }
+        const released = /* @__PURE__ */ new Map();
+        for (const key of changed) {
+          const old = this.#db.get(
+            "SELECT hash, size FROM entry WHERE key = ? AND deleted = 0 AND content = 1 AND hash IS NOT NULL AND size IS NOT NULL",
+            key
+          );
+          if (old === void 0 || kept.has(old.hash) || released.has(old.hash)) continue;
+          const holders = this.#db.all(
+            "SELECT key FROM entry WHERE hash = ? AND content = 1 AND deleted = 0",
+            old.hash
+          );
+          if (holders.every((holder) => changed.has(holder.key))) released.set(old.hash, old.size);
+        }
+        let freed = 0;
+        for (const size of released.values()) freed += size;
+        await this.#admit({
+          partitionId: this.#partitionId,
+          blobBytes: blobBytes - freed,
+          entries: p.changes.length,
+          freeBytes: null
+        });
+      }
       try {
         await this.#writeBlobs(p.blobs);
       } catch (error) {
@@ -873,8 +1751,9 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       }
       await this.#faults.afterBlobs?.();
       try {
-        this.#write("Committing a sync page", () => {
+        await this.#write("Committing a sync page", () => {
           this.#checkLease(t);
+          this.#assertInstalledGrantTime();
           const now = this.#now();
           if (p.window.notBefore !== null && now < Date.parse(p.window.notBefore)) {
             throw new ReplicaError(ReplicaErrorCode.GRANT_NOT_YET_VALID, `The grant is not valid before ${p.window.notBefore}; nothing was committed.`);
@@ -940,72 +1819,59 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
         });
       } catch (error) {
         if (isReplicaError(error, ReplicaErrorCode.GRANT_REVOKED)) await this.#purgeContent().catch(() => void 0);
+        else if (this.#admit) await this.#collectLocked(t).catch(() => void 0);
         throw error;
       }
       this.#faults.afterCommit?.();
+      if (this.#admit) await this.#collectLocked(t);
     });
   }
   /** Unlink every blob not in `keep`, and every temp file. Only a missing directory counts as empty. */
-  async #unlinkBlobs(keep) {
-    let removed = 0;
-    const root = (0, import_node_path.join)(this.#pinnedDir, "blobs");
-    for (const shard of await entriesOf(root)) {
-      const shardPath = (0, import_node_path.join)(root, shard);
-      if (shard === ".tmp") {
-        for (const name of await entriesOf(shardPath)) {
-          await (0, import_promises.rm)((0, import_node_path.join)(shardPath, name), { force: true });
-          removed += 1;
-        }
-        continue;
-      }
-      let kept = 0;
-      for (const name of await entriesOf(shardPath)) {
-        if (isHash(name) && keep.has(name)) {
-          kept += 1;
-          continue;
-        }
-        await (0, import_promises.rm)((0, import_node_path.join)(shardPath, name), { force: true });
-        removed += 1;
-      }
-      if (kept === 0) await (0, import_promises.rmdir)(shardPath).catch(() => void 0);
-    }
-    return removed;
+  #unlinkBlobs(keep) {
+    return unlinkBlobsIn((0, import_node_path2.join)(this.#pinnedDir, "blobs"), keep);
   }
   /** Whether any content file (a blob or a temp file) is on disk. */
   async #holdsContentFiles() {
-    const root = (0, import_node_path.join)(this.#pinnedDir, "blobs");
+    const root = (0, import_node_path2.join)(this.#pinnedDir, "blobs");
     for (const shard of await entriesOf(root)) {
-      if ((await entriesOf((0, import_node_path.join)(root, shard))).length > 0) return true;
+      if ((await entriesOf((0, import_node_path2.join)(root, shard))).length > 0) return true;
     }
     return false;
   }
   async collectGarbage(t) {
-    return this.#mutate(async () => {
-      try {
-        this.#db.exec("BEGIN IMMEDIATE");
-      } catch (error) {
-        throw storageError(error, "Collecting unused content");
-      }
+    return this.#mutate(() => this.#collectLocked(t));
+  }
+  /** `collectGarbage` for callers already inside the mutation hold (it cannot re-enter `#mutate`). */
+  async #collectLocked(t) {
+    const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
+    try {
+      this.#db.exec("BEGIN IMMEDIATE");
+    } catch (error) {
+      release?.();
+      throw storageError(error, "Collecting unused content");
+    }
+    try {
+      this.#checkLease(t);
+      await this.#faults.afterGarbageCollectionBegin?.();
+      const keep = new Set(
+        this.#db.all("SELECT DISTINCT hash FROM entry WHERE content = 1").map((row) => row.hash)
+      );
+      const removed = await this.#unlinkBlobs(keep);
+      this.#db.exec("COMMIT");
+      return removed;
+    } catch (error) {
       try {
-        this.#checkLease(t);
-        const keep = new Set(
-          this.#db.all("SELECT DISTINCT hash FROM entry WHERE content = 1").map((row) => row.hash)
-        );
-        const removed = await this.#unlinkBlobs(keep);
-        this.#db.exec("COMMIT");
-        return removed;
-      } catch (error) {
-        try {
-          this.#db.exec("ROLLBACK");
-        } catch {
-        }
-        throw storageError(error, "Collecting unused content");
+        this.#db.exec("ROLLBACK");
+      } catch {
       }
-    });
+      throw storageError(error, "Collecting unused content");
+    } finally {
+      release?.();
+    }
   }
   async reset(t, reason, options = {}) {
     await this.#mutate(async () => {
-      this.#write("Resetting the replica", () => {
+      await this.#write("Resetting the replica", () => {
         this.#checkLease(t);
         this.#db.run("DELETE FROM entry");
         this.#db.run(
@@ -1024,107 +1890,50 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     }
   }
   /**
-   * Remove this replica's directory for good (`tc replica reset --purge`).
-   * Fenced like a commit: `t` must still be a live lease on the database this
-   * store opened, checked under the write lock, so a paused process can
-   * never remove a replica another process took over or recreated. Allowed
-   * on a revoked replica. The store is unusable afterwards; close it.
+   * Remove the source-created mirror layout under a live lease. Unknown files
+   * are removed only when their exact preflight identities were approved.
    */
-  async destroy(t) {
+  async destroy(t, options = {}) {
     await this.#mutate(async () => {
+      const release = this.#shared ? await acquireWritableMutation(this.#shared) : void 0;
       try {
         this.#db.exec("BEGIN IMMEDIATE");
       } catch (error) {
+        release?.();
         throw storageError(error, "Removing the replica");
       }
       try {
         this.#checkLease(t, { allowRevoked: true });
-        const expected = this.#directoryFd === void 0 ? this.#namedAncestors.at(-1) : (0, import_node_fs.fstatSync)(this.#directoryFd, { bigint: true });
+        const expected = this.#directoryFd === void 0 ? this.#namedAncestors.at(-1) : (0, import_node_fs2.fstatSync)(this.#directoryFd, { bigint: true });
         if (!expected) {
           throw new ReplicaError(ReplicaErrorCode.RUNTIME_UNSUPPORTED, "Replica removal requires an opened or identity-checked directory.");
         }
         const assertDirectory = async () => {
-          const current = await (0, import_promises.lstat)(this.dir, { bigint: true });
+          const current = await (0, import_promises2.lstat)(this.dir, { bigint: true });
           if (!current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
             throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica directory changed during removal.");
           }
           return current;
         };
         const pinned = await assertDirectory();
-        await this.#assertPresent();
-        if (process.platform === "linux") {
-          for (const entry of await (0, import_promises.readdir)(this.#pinnedDir)) {
-            await (0, import_promises.rm)((0, import_node_path.join)(this.#pinnedDir, entry), { recursive: true, force: true });
-          }
-          await assertDirectory();
-          await (0, import_promises.rmdir)(this.dir);
-        } else {
-          const ancestors = this.#namedAncestors;
-          const checkAncestors = async () => {
-            for (const expected2 of ancestors) {
-              const current = await (0, import_promises.lstat)(expected2.path, { bigint: true });
-              if (current.dev !== expected2.dev || current.ino !== expected2.ino) {
-                throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica ancestry changed during removal.");
-              }
+        const assertNamedPath = async () => {
+          for (const ancestor of this.#namedAncestors) {
+            const current = await (0, import_promises2.lstat)(ancestor.path, { bigint: true });
+            if (current.dev !== ancestor.dev || current.ino !== ancestor.ino) {
+              throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica ancestry changed during removal.");
             }
-          };
-          const directories = /* @__PURE__ */ new Map([[this.dir, pinned]]);
-          const files = /* @__PURE__ */ new Map();
-          const check = async (path, expected2, directory) => {
-            if (path !== this.dir) {
-              const parent = (0, import_node_path.dirname)(path);
-              await check(parent, directories.get(parent), true);
-            }
-            await checkAncestors();
-            const current = await (0, import_promises.lstat)(path, { bigint: true });
-            if ((directory ? !current.isDirectory() : !current.isFile()) || current.dev !== expected2.dev || current.ino !== expected2.ino) {
-              throw new ReplicaError(ReplicaErrorCode.NOT_FOUND, "The replica layout changed during removal.");
-            }
-          };
-          const record = async (path, directory) => {
-            const parent = (0, import_node_path.dirname)(path);
-            await check(parent, directories.get(parent), true);
-            const current = await (0, import_promises.lstat)(path, { bigint: true });
-            if (!(directory ? current.isDirectory() : current.isFile())) {
-              throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica layout during removal.");
-            }
-            (directory ? directories : files).set(path, current);
-          };
-          const blobs = (0, import_node_path.join)(this.dir, "blobs");
-          for (const name of await (0, import_promises.readdir)(this.dir)) {
-            if (name === "blobs") await record(blobs, true);
-            else if (["replica.db", "replica.db-wal", "replica.db-shm"].includes(name)) await record((0, import_node_path.join)(this.dir, name), false);
-            else throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica layout during removal.");
-          }
-          if (directories.has(blobs)) {
-            await check(blobs, directories.get(blobs), true);
-            for (const shard of await (0, import_promises.readdir)(blobs)) {
-              if (shard !== ".tmp" && !/^[0-9a-f]{2}$/.test(shard)) {
-                throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica blob shard during removal.");
-              }
-              const shardPath = (0, import_node_path.join)(blobs, shard);
-              await record(shardPath, true);
-              await check(shardPath, directories.get(shardPath), true);
-              for (const name of await (0, import_promises.readdir)(shardPath)) {
-                if (shard === ".tmp" ? !/^[0-9a-f]{64}\.[0-9a-f]{12}$/.test(name) : !isHash(name) || !name.startsWith(shard)) {
-                  throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "Unexpected replica blob file during removal.");
-                }
-                await record((0, import_node_path.join)(shardPath, name), false);
-              }
-            }
-          }
-          for (const [path, identity] of files) {
-            await check(path, identity, false);
-            await (0, import_promises.unlink)(path);
-          }
-          for (const [path, identity] of [...directories].reverse()) {
-            if (path === this.dir) continue;
-            await check(path, identity, true);
-            await (0, import_promises.rmdir)(path);
           }
           await assertDirectory();
-          await checkAncestors();
-          await (0, import_promises.rmdir)(this.dir);
+        };
+        await this.#assertPresent();
+        try {
+          await removeSqliteReplicaLayout(this.dir, {
+            ...options,
+            expectedRoot: options.expectedRoot ?? { dev: pinned.dev.toString(), ino: pinned.ino.toString() }
+          });
+        } catch (error) {
+          await assertNamedPath();
+          throw error;
         }
       } catch (error) {
         throw storageError(error, "Removing the replica");
@@ -1133,6 +1942,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
           this.#db.exec("ROLLBACK");
         } catch {
         }
+        release?.();
       }
     });
   }
@@ -1176,7 +1986,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
    * when both are done.
    */
   async #purgeContent() {
-    this.#write("Starting the revocation purge", () => {
+    await this.#write("Starting the revocation purge", () => {
       this.#db.run("UPDATE replica SET purge_pending = 1 WHERE id = 1 AND revoked_detail IS NOT NULL");
     });
     try {
@@ -1187,7 +1997,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     if (!this.#checkpoint()) {
       throw new ReplicaError(ReplicaErrorCode.BUSY, "A reader holds the replica's write-ahead log; the purge finishes on the next open.");
     }
-    this.#write("Finishing the revocation purge", () => {
+    await this.#write("Finishing the revocation purge", () => {
       this.#db.run("UPDATE replica SET purge_pending = 0 WHERE id = 1 AND revoked_detail IS NOT NULL");
     });
   }
@@ -1197,6 +2007,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     });
   }
   async get(key) {
+    this.#assertAccepting();
     try {
       const row = this.#db.get("SELECT key, deleted, etag, hash, metadata, content FROM entry WHERE key = ?", key);
       return row === void 0 ? void 0 : entryOf(row);
@@ -1205,6 +2016,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
     }
   }
   async list(o) {
+    this.#assertAccepting();
     const where = ["deleted = 0"];
     const params = [];
     if (o.prefix !== void 0 && o.prefix !== "") {
@@ -1234,7 +2046,7 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
   async readContent(hash) {
     if (!isHash(hash)) return void 0;
     try {
-      return new Uint8Array(await (0, import_promises.readFile)(this.#blobPath(hash)));
+      return new Uint8Array(await (0, import_promises2.readFile)(this.#blobPath(hash)));
     } catch (error) {
       if (errnoOf(error) === "ENOENT") return void 0;
       throw storageError(error, "Reading replica content");
@@ -1290,22 +2102,40 @@ var SqliteReplicaStore = class _SqliteReplicaStore {
       lastReset: state.lastReset
     };
   }
-  async close() {
-    const fd = this.#directoryFd;
-    this.#directoryFd = void 0;
-    if (fd !== void 0) pinnedDirectories.unregister(this);
-    try {
-      this.#db.close();
-    } finally {
-      if (fd !== void 0) (0, import_node_fs.closeSync)(fd);
-    }
+  close() {
+    if (this.#closePromise) return this.#closePromise;
+    this.#closing = true;
+    this.#closePromise = (async () => {
+      if (this.#activeMutations !== 0) {
+        await new Promise((resolve3) => {
+          this.#drained = resolve3;
+        });
+      }
+      this.#closed = true;
+      const fd = this.#directoryFd;
+      this.#directoryFd = void 0;
+      if (this.#shared) {
+        sharedStores.unregister(this);
+        releaseWritable(this.#shared);
+      } else {
+        if (fd !== void 0) pinnedDirectories.unregister(this);
+        try {
+          this.#database.close();
+        } finally {
+          if (fd !== void 0) (0, import_node_fs2.closeSync)(fd);
+        }
+      }
+    })();
+    return this.#closePromise;
   }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DURABILITY,
   SqliteReplicaStore,
+  inspectSqliteReplicaLayout,
   loadSqlite,
-  nodeSqliteSupported
+  nodeSqliteSupported,
+  removeSqliteReplicaLayout
 });
 //# sourceMappingURL=sqlite.cjs.map