@zerotal/core 1.3.0 → 1.5.0

package/src/helpers/response.ts

@@ -6,6 +6,7 @@
 import { RequestContext } from "../context/RequestContext.ts";
 import { HttpError, NotFoundError } from "../errors/HttpError.ts";
 import { route } from "../router/Router.ts";
+import type { RouteParamValues, RouteParamsArg, RouteTarget } from "../router/registry.ts";
 import { safeRedirectPath } from "../pipeline/HttpContext.ts";
 import { DEFAULT_MD_OPTIONS, type BunMarkdownOptions } from "../helpers/markdown.ts";
 import type { ZerotalError } from "../errors/ZerotalError.ts";
@@ -107,13 +108,22 @@ export class RedirectBuilder {
     return new ResponseBuilder(this.#ctx);
   }
 
-  /** Redirect to a named route, resolving its URL from the route name and params. */
-  to(
-    name: string,
-    params: Record<string, string | number> = {},
+  /**
+   * Redirect to a named route, resolving its URL from the route name and params.
+   *
+   * Params are checked against the route's pattern once `types/routes.generated.ts`
+   * exists. For a query string, or a name only known at runtime, redirect to a
+   * built URL instead: `redirect().away(route.dynamic(name, params, query))`.
+   */
+  to<N extends RouteTarget>(
+    name: N,
+    params?: RouteParamsArg<N>,
     status: 301 | 302 | 303 | 307 | 308 = 302,
   ): ResponseBuilder {
-    this.#ctx.redirect(route(name, params), status);
+    // The values in `RouteParams<N>` are `RouteParamValue`s by construction, but
+    // `N` is still a type variable here, so the compiler cannot see through the
+    // conditional to say so.
+    this.#ctx.redirect(route.dynamic(name, params as RouteParamValues), status);
     return new ResponseBuilder(this.#ctx);
   }
 
@@ -253,9 +263,9 @@ export function redirect(
  * @param status - Optional HTTP status code (default: 302).
  * @returns
  */
-export function redirectTo(
-  name: string,
-  params: Record<string, string | number> = {},
+export function redirectTo<N extends RouteTarget>(
+  name: N,
+  params?: RouteParamsArg<N>,
   status: 301 | 302 | 303 | 307 | 308 = 302,
 ): ResponseBuilder {
   return redirect().to(name, params, status);

package/src/http/Uri.ts

@@ -15,6 +15,7 @@
  */
 import { RequestContext } from "../context/RequestContext.ts";
 import { route } from "../router/Router.ts";
+import type { RouteArgs, RouteParamValues, RouteQuery, RouteTarget } from "../router/registry.ts";
 import { safeRedirectPath } from "../pipeline/HttpContext.ts";
 import { ResponseBuilder } from "../helpers/response.ts";
 import { config } from "../helpers/config.ts";
@@ -185,11 +186,14 @@ export class Uri {
   }
 
   /**
-   * Build a Uri from a named route + params.
+   * Build a Uri from a named route + params (+ optional query values), with the
+   * same typing as the global {@link route} helper. For a name only known at
+   * runtime: `Uri.of(route.dynamic(name, params))`.
    * @category Construction
    */
-  static route(name: string, params: Record<string, string | number> = {}): Uri {
-    return Uri.of(route(name, params));
+  static route<N extends RouteTarget>(name: N, ...args: RouteArgs<N>): Uri {
+    const [params = {}, query = {}] = args as [RouteParamValues?, RouteQuery?];
+    return Uri.of(route.dynamic(name, params, query));
   }
 
   #clone(patch: Partial<UriParts>): Uri {

package/src/http/originGuard.ts

@@ -32,7 +32,7 @@
  *
  * @example
  * ```ts
- * if (!isAllowedOrigin(req, config('app.wsAllowedOrigins'))) {
+ * if (!isAllowedOrigin(req, config('app.allowedOrigins'))) {
  *   return new Response('Forbidden origin', { status: 403 });
  * }
  * ```

package/src/http/url.ts

@@ -27,6 +27,7 @@
  */
 import { RequestContext } from "../context/RequestContext.ts";
 import { route } from "../router/Router.ts";
+import type { RouteArgs, RouteParamValues, RouteQuery, RouteTarget } from "../router/registry.ts";
 import { ZerotalError } from "../errors/ZerotalError.ts";
 import { URLSigner } from "../crypt/URLSigner.ts";
 import { Uri, appBaseUrl, type QueryInput } from "./Uri.ts";
@@ -105,8 +106,12 @@ export interface UrlGenerator {
   secure(path: string, extra?: (string | number)[]): string;
   /** A fully-qualified URL with a query string appended. */
   query(path: string, query: QueryInput, extra?: (string | number)[]): string;
-  /** A fully-qualified URL for a named route. */
-  route(name: string, params?: Record<string, string | number>): string;
+  /**
+   * A fully-qualified URL for a named route. Same arguments as the global
+   * {@link route} helper — params are exact, query values go third. For a name
+   * only known at runtime: `url().to(route.dynamic(name, params))`.
+   */
+  route<N extends RouteTarget>(name: N, ...args: RouteArgs<N>): string;
   /**
    * The URL the user was heading to before authentication (the session's `intended_url`),
    * falling back to `fallback`. Cross-origin stored URLs are rejected (open-redirect guard).
@@ -167,8 +172,9 @@ const generator: UrlGenerator = {
   query(path, query, extra = []) {
     return Uri.of(toUrl(path, extra)).withQuery(query).value();
   },
-  route(name, params = {}) {
-    return toUrl(route(name, params));
+  route<N extends RouteTarget>(name: N, ...args: RouteArgs<N>) {
+    const [params = {}, query = {}] = args as [RouteParamValues?, RouteQuery?];
+    return toUrl(route.dynamic(name, params, query));
   },
   intended(fallback = "/") {
     // Uri.intended reads (and clears) the session's intended_url with an open-redirect guard.

package/src/index.ts

@@ -94,6 +94,20 @@ export { ServiceProvider } from "./provider/ServiceProvider.ts";
 export type { AppEnvironment } from "./provider/ServiceProvider.ts";
 export type { ConcernDescriptor, ConcernContext } from "./conventions/ConventionLoader.ts";
 
+// Doctor (`zt doctor`; providers contribute checks via doctorChecks() or app.registerDoctorCheck())
+export { runDoctor, builtinDoctorChecks } from "./doctor/AppDoctor.ts";
+export type { DoctorCheck, DoctorCheckResult, DoctorReportEntry } from "./doctor/AppDoctor.ts";
+
+// Dev processes (`zt dev`; providers contribute them via devProcesses()).
+// Types only: naming the return type of `devProcesses()` needs them, but
+// `collectDevProcesses` is the runner's own wiring and lives on `/dev`.
+export type {
+  DevProcessDefinition,
+  DevProcessColor,
+  ResolvedDevProcess,
+  DevConfigShape,
+} from "./dev/DevProcess.ts";
+
 // Errors
 export {
   ZerotalError,
@@ -147,6 +161,8 @@ export {
 export { config } from "./helpers/config.ts";
 export { pluralize, singularize, snakeCase, camelCase, tableNameFor } from "./support/str.ts";
 export { deepMerge } from "./support/deepMerge.ts";
+// The type every class-keyed registry uses — a class rather than an instance.
+export type { ClassRef } from "./support/classRef.ts";
 export { safeEqual, sha256Hex, hmacHex } from "./support/crypto.ts";
 export {
   buildCookie,
@@ -156,6 +172,15 @@ export {
   type SameSite,
 } from "./support/cookie.ts";
 export { isDevSurfaceAllowed, devSurfacesEnabled } from "./support/env.ts";
+// The deployment name (`production`/`staging`/…) as opposed to the runtime mode.
+// Shared with first-party packages that gate behaviour on it — `APP_ENV` cannot be
+// read directly for this after `setAppEnv()`.
+export { isProdLike, deployEnv } from "./support/env.ts";
+// Development-error-page diagnoses. A package that owns an error class registers
+// a diagnoser so the overlay can say what to do about it — see `@zerotal/orm`,
+// which turns "no such table" into the list of migrations that have not run.
+export { registerErrorDiagnoser } from "./application/diagnostics.ts";
+export type { ErrorDiagnoser, ErrorDiagnosis, DiagnosisAction } from "./application/diagnostics.ts";
 export { fluent, Fluent } from "./helpers/fluent.ts";
 export { collect, Collection } from "./helpers/Collection.ts";
 export {
@@ -187,7 +212,25 @@ export type {
   ViewRegistration,
   GroupOptions,
   RouterMacros,
+  RouteBuilder,
 } from "./router/Router.ts";
+// Typed route names — `RouteRegistry` is the augmentation target that
+// `types/routes.generated.ts` fills in (see `bun zt route:types`).
+export type {
+  RouteRegistry,
+  RouteName,
+  RouteTarget,
+  RoutePattern,
+  RouteParams,
+  RouteParamsArg,
+  RouteParamValue,
+  RouteParamValues,
+  RouteQuery,
+  RouteArgs,
+  ParamsOf,
+} from "./router/registry.ts";
+// The generator itself stays off the kernel barrel — it is build-time tooling,
+// reached through `bun zt route:types` (and by `serve --dev-worker` internally).
 export type {
   RouteDefinition,
   HttpMethod,

package/src/lock/LockManager.ts

@@ -1,5 +1,37 @@
 import type { LockDriver } from "./drivers/LockDriver.ts";
-import { LockNotAcquiredError } from "./errors.ts";
+import { LockNotAcquiredError, LockLostError } from "./errors.ts";
+
+/**
+ * Keeping a lock alive across work that outlives its TTL.
+ *
+ * Shared by {@link TryOptions} and {@link BlockOptions} because the choice is
+ * about the critical section, not about how you got into it.
+ *
+ * @category Acquiring
+ */
+export interface RefreshOptions {
+  /**
+   * Extend the lock in the background for as long as the callback runs.
+   *
+   * With this on, the TTL stops being "how long the job might take" — a
+   * question nobody can answer — and becomes "how long after a crash before
+   * someone else may take over", which is a decision rather than a guess.
+   */
+  refresh?: boolean;
+
+  /**
+   * Seconds between refreshes. Defaults to a third of the TTL, so two
+   * consecutive failures still leave a full attempt before the lock lapses.
+   */
+  refreshEvery?: number;
+}
+
+/**
+ * Options for {@link LockManager.try | try}.
+ *
+ * @category Acquiring
+ */
+export type TryOptions = RefreshOptions;
 
 /**
  * Options controlling how {@link LockManager.block} and {@link Lock.block} wait
@@ -7,7 +39,7 @@ import { LockNotAcquiredError } from "./errors.ts";
  *
  * @category Acquiring
  */
-export interface BlockOptions {
+export interface BlockOptions extends RefreshOptions {
   /**
    * Maximum seconds to wait for the lock before throwing.
    * Defaults to the lock TTL.
@@ -21,6 +53,20 @@ export interface BlockOptions {
   retryDelay?: number;
 }
 
+/**
+ * The critical section run by {@link LockManager.try} and
+ * {@link LockManager.block}.
+ *
+ * Both arguments are additive — an existing zero-argument callback is still a
+ * valid one, and every call site written before refreshing existed keeps
+ * working untouched.
+ *
+ * @param lock - The held lock, for a manual {@link ManagedLock.refresh}.
+ * @param signal - Aborted if the lock is lost mid-run. Long work should watch it.
+ * @category Acquiring
+ */
+export type LockedCallback<T> = (lock: ManagedLock, signal: AbortSignal) => Promise<T> | T;
+
 /**
  * A single named lock instance.
  *
@@ -42,6 +88,7 @@ export interface BlockOptions {
 export class ManagedLock {
   private readonly _owner: string;
   private _acquired = false;
+  private _expiresAt: number | undefined = undefined;
 
   constructor(
     private readonly _key: string,
@@ -59,9 +106,53 @@ export class ManagedLock {
    */
   async acquire(): Promise<boolean> {
     this._acquired = await this._driver.acquire(this._key, this._owner, this._ttl);
+    if (this._acquired) this._expiresAt = Date.now() + this._ttl * 1000;
     return this._acquired;
   }
 
+  /**
+   * Push this lock's deadline out, so work that outlives its TTL can keep it.
+   *
+   * Without this a TTL has to be sized for the worst case: too short and the
+   * lock evaporates mid-job, too long and a crashed holder blocks the key for
+   * however long you guessed. Refreshing lets the TTL describe *how quickly a
+   * crash is noticed* instead, which is a much easier number to pick.
+   *
+   * Returns `false` when the lock is gone — expired, or now held by someone
+   * else — and clears {@link isAcquired} so it stops claiming otherwise. A
+   * caller that ignores the return value at least will not go on to release
+   * another holder's lock, because release is owner-guarded too.
+   *
+   * @param ttlSeconds - Seconds from now. Defaults to the lock's own TTL.
+   * @category Acquiring
+   *
+   * @example
+   * ```ts
+   * if (!(await lock.refresh())) throw new LockLostError(lock.key);
+   * ```
+   */
+  async refresh(ttlSeconds?: number): Promise<boolean> {
+    if (!this._acquired) return false;
+    const ttl = ttlSeconds ?? this._ttl;
+
+    // `extend` is optional on the contract so a driver written against 1.x still
+    // satisfies it. `acquire` is the fallback because on every built-in driver it
+    // is an owner-guarded refresh — which is exactly what this needs, and is the
+    // behaviour the memory driver had to be fixed to honour.
+    const extended = this._driver.extend
+      ? await this._driver.extend(this._key, this._owner, ttl)
+      : await this._driver.acquire(this._key, this._owner, ttl);
+
+    if (!extended) {
+      this._acquired = false;
+      this._expiresAt = undefined;
+      return false;
+    }
+
+    this._expiresAt = Date.now() + ttl * 1000;
+    return true;
+  }
+
   /**
    * Block until the lock can be acquired or `timeoutSeconds` elapses, polling
    * every `retryDelayMs`.
@@ -93,6 +184,7 @@ export class ManagedLock {
   async release(): Promise<void> {
     if (!this._acquired) return;
     this._acquired = false;
+    this._expiresAt = undefined;
     await this._driver.release(this._key, this._owner);
   }
 
@@ -104,6 +196,7 @@ export class ManagedLock {
    */
   async forceRelease(): Promise<void> {
     this._acquired = false;
+    this._expiresAt = undefined;
     await this._driver.forceRelease(this._key);
   }
 
@@ -115,6 +208,22 @@ export class ManagedLock {
   get isAcquired(): boolean {
     return this._acquired;
   }
+  /** The lock's TTL in seconds, as configured. */
+  get ttl(): number {
+    return this._ttl;
+  }
+  /**
+   * When this lock is expected to expire, or `undefined` when not held.
+   *
+   * A **client-side estimate**, computed from the last successful acquire or
+   * refresh — not read back from the driver. It is for deciding when to refresh
+   * next, not for deciding whether you still hold the lock; clock skew between
+   * this process and the lock store makes it approximate, and only the driver
+   * knows the truth. Ask {@link refresh} if you need an answer you can act on.
+   */
+  get expiresAt(): Date | undefined {
+    return this._expiresAt === undefined ? undefined : new Date(this._expiresAt);
+  }
 }
 
 /**
@@ -176,15 +285,16 @@ export class LockManager {
    * @throws {LockNotAcquiredError} Immediately, if the lock is already held.
    * @category Acquiring
    */
-  async try<T>(key: string, ttlSeconds: number, callback: () => Promise<T> | T): Promise<T> {
+  async try<T>(
+    key: string,
+    ttlSeconds: number,
+    callback: LockedCallback<T>,
+    options: TryOptions = {},
+  ): Promise<T> {
     const lock = this.lock(key, ttlSeconds);
     const acquired = await lock.acquire();
     if (!acquired) throw new LockNotAcquiredError(key);
-    try {
-      return await callback();
-    } finally {
-      await lock.release();
-    }
+    return _runHeld(lock, callback, options);
   }
 
   /**
@@ -204,16 +314,12 @@ export class LockManager {
   async block<T>(
     key: string,
     ttlSeconds: number,
-    callback: () => Promise<T> | T,
+    callback: LockedCallback<T>,
     options: BlockOptions = {},
   ): Promise<T> {
     const lock = this.lock(key, ttlSeconds);
     await lock.block(options.timeout ?? ttlSeconds, options.retryDelay);
-    try {
-      return await callback();
-    } finally {
-      await lock.release();
-    }
+    return _runHeld(lock, callback, options);
   }
 
   /**
@@ -226,3 +332,73 @@ export class LockManager {
     this._driver.dispose?.();
   }
 }
+
+/**
+ * Run the critical section with the lock held, optionally heartbeating it, and
+ * release on the way out whatever happened.
+ *
+ * Shared by `try` and `block`, which differ only in how they got the lock.
+ */
+async function _runHeld<T>(
+  lock: ManagedLock,
+  callback: LockedCallback<T>,
+  options: RefreshOptions,
+): Promise<T> {
+  const controller = new AbortController();
+
+  if (!options.refresh) {
+    try {
+      return await callback(lock, controller.signal);
+    } finally {
+      await lock.release();
+    }
+  }
+
+  const everySeconds = options.refreshEvery ?? lock.ttl / 3;
+  const everyMs = Math.max(1, Math.round(everySeconds * 1000));
+
+  // Assigned once, further down, but read by the `beat()` and `stop()` closures
+  // declared above that assignment — so it cannot be a `const` initialiser.
+  // eslint-disable-next-line prefer-const -- see above
+  let timer: ReturnType<typeof setInterval> | undefined;
+  let rejectLost: ((error: Error) => void) | undefined;
+  // Never resolves — it exists only to lose the race below, and only when the
+  // lock is gone. Its rejection is always handled, by that race.
+  const lost = new Promise<never>((_, reject) => {
+    rejectLost = reject;
+  });
+
+  const beat = async (): Promise<void> => {
+    if (await lock.refresh().catch(() => false)) return;
+
+    // Stop beating first: a lost lock stays lost, and retrying would only add
+    // driver round trips to a job that now has to stop.
+    if (timer) clearInterval(timer);
+    const error = new LockLostError(lock.key);
+    // The signal comes first so cooperative work sees the abort before the
+    // caller sees the throw — the callback may still be mid-await, and telling
+    // it to stop is the only leverage we have. It cannot be forced: work that
+    // ignores its signal runs on, outside the lock it believes it holds.
+    controller.abort(error);
+    rejectLost?.(error);
+  };
+
+  timer = setInterval(() => void beat(), everyMs);
+  // Without this the interval alone keeps the event loop alive, and a CLI or a
+  // dev-mode process quietly refuses to exit — a symptom with nothing pointing
+  // back to a lock helper.
+  timer.unref?.();
+
+  try {
+    const work = Promise.resolve().then(() => callback(lock, controller.signal));
+    // Losing the race leaves `work` rejecting with nobody listening; this marks
+    // it handled so a lost lock cannot also produce an unhandled rejection.
+    work.catch(() => {});
+    return await Promise.race([work, lost]);
+  } finally {
+    // Both exits, always: the success path, the throw path, and the lost-lock
+    // path that is a throw arriving from somewhere other than the callback.
+    clearInterval(timer);
+    await lock.release();
+  }
+}

package/src/lock/drivers/LockDriver.ts

@@ -27,6 +27,17 @@ export interface LockDriver {
   /** Returns `true` if the lock is currently held (not expired). */
   exists(key: string): Promise<boolean>;
 
+  /**
+   * Push a held lock's deadline out to `ttlSeconds` from now. Owner-guarded:
+   * returns `false` when the key is free or held by someone else, so a holder
+   * that lost the lock learns about it rather than extending a stranger's.
+   *
+   * **Optional** so a driver written against 1.x still satisfies this interface.
+   * {@link ManagedLock.refresh} falls back to `acquire(key, owner, ttl)`, which
+   * is an owner-guarded refresh on all three built-in drivers.
+   */
+  extend?(key: string, owner: string, ttlSeconds: number): Promise<boolean>;
+
   /** Release background resources (timers, DB connections). */
   dispose?(): void;
 }

package/src/lock/drivers/MemoryLockDriver.ts

@@ -22,13 +22,33 @@ export class MemoryLockDriver implements LockDriver {
     const existing = this._store.get(key);
 
     if (existing && now < existing.expiresAt) {
-      return existing.owner === owner; // re-entrant for same owner
+      if (existing.owner !== owner) return false;
+      // Re-acquiring by the same owner pushes the deadline out. This used to
+      // return `true` without touching `expiresAt`, so the default driver — the
+      // one every app gets until it configures another — was the only one of the
+      // three that did not honour what `ManagedLock.acquire()` documents. Redis
+      // re-`expire`s and SQLite `UPDATE`s; a caller re-acquiring to stay alive
+      // was silently refused an extension here, and found out when the lock
+      // expired underneath them.
+      existing.expiresAt = now + ttlSeconds * 1000;
+      return true;
     }
 
     this._store.set(key, { owner, expiresAt: now + ttlSeconds * 1000 });
     return true;
   }
 
+  async extend(key: string, owner: string, ttlSeconds: number): Promise<boolean> {
+    const now = Date.now();
+    const existing = this._store.get(key);
+    // An expired record is not extendable even by its own owner: the lock is
+    // free, and anyone may have taken it in between. Re-acquiring is the honest
+    // way back, and it is what the caller does when this returns false.
+    if (!existing || existing.owner !== owner || now >= existing.expiresAt) return false;
+    existing.expiresAt = now + ttlSeconds * 1000;
+    return true;
+  }
+
   async release(key: string, owner: string): Promise<boolean> {
     const existing = this._store.get(key);
     if (!existing || existing.owner !== owner) return false;

package/src/lock/drivers/RedisLockDriver.ts

@@ -1,6 +1,23 @@
-import { redis } from "bun";
+import { redis } from "bun";
 import type { LockDriver } from "./LockDriver.ts";
 
+/**
+ * The slice of Bun's Redis client this driver uses.
+ *
+ * Narrow on purpose: it is the seam a test substitutes, and every method on it
+ * is one this driver actually calls.
+ *
+ * @category Configuration
+ */
+export interface RedisLockClient {
+  set(key: string, value: string, ...args: string[]): Promise<string | null>;
+  get(key: string): Promise<string | null>;
+  expire(key: string, seconds: number): Promise<unknown>;
+  del(key: string): Promise<unknown>;
+  exists(key: string): Promise<boolean>;
+  send(command: string, args: string[]): Promise<unknown>;
+}
+
 // Lua script: delete the key only if the caller is still the owner.
 // Evaluated atomically by Redis — no race between GET and DEL.
 const RELEASE_SCRIPT = `
@@ -11,6 +28,19 @@ else
 end
 `;
 
+// The same compare-and-set shape as RELEASE_SCRIPT, for the deadline instead of
+// the key. It has to be one script for the same reason: between a GET and a
+// separate PEXPIRE the lock can lapse and be taken, and the PEXPIRE would then
+// extend a lock belonging to someone else. `pexpire` on a missing key returns 0,
+// so an expired lock reports failure without a second round trip.
+const EXTEND_SCRIPT = `
+if redis.call('get', KEYS[1]) == ARGV[1] then
+  return redis.call('pexpire', KEYS[1], ARGV[2])
+else
+  return 0
+end
+`;
+
 /**
  * Redis-backed distributed lock driver.
  *
@@ -23,36 +53,62 @@ end
  * @category Configuration
  */
 export class RedisLockDriver implements LockDriver {
-  constructor(private readonly _prefix: string = "zerotal_lock:") {}
+  private readonly _redis: RedisLockClient;
+
+  /**
+   * @param _prefix - Key namespace.
+   * @param client - The Redis client. Defaults to Bun's built-in one; passing a
+   *   fake is the only way to test this driver, because `mock.module` cannot
+   *   intercept a Bun builtin. The queue's Redis driver learned that the
+   *   expensive way — its suite reached a real Redis, found none, and timed out
+   *   fifteen times while appearing to be thorough.
+   */
+  constructor(
+    private readonly _prefix: string = "zerotal_lock:",
+    client: RedisLockClient = redis,
+  ) {
+    this._redis = client;
+  }
 
   private _key(key: string): string {
     return this._prefix + key;
   }
 
   async acquire(key: string, owner: string, ttlSeconds: number): Promise<boolean> {
-    const result = await redis.set(this._key(key), owner, "NX", "EX", String(ttlSeconds));
+    const result = await this._redis.set(this._key(key), owner, "NX", "EX", String(ttlSeconds));
     if (result !== null) return true;
 
     // Re-entrant: allow the same owner to refresh its own lock
-    const current = await redis.get(this._key(key));
+    const current = await this._redis.get(this._key(key));
     if (current === owner) {
-      await redis.expire(this._key(key), ttlSeconds);
+      await this._redis.expire(this._key(key), ttlSeconds);
       return true;
     }
 
     return false;
   }
 
+  async extend(key: string, owner: string, ttlSeconds: number): Promise<boolean> {
+    const extended = await this._redis.send("EVAL", [
+      EXTEND_SCRIPT,
+      "1",
+      this._key(key),
+      owner,
+      String(Math.max(1, Math.round(ttlSeconds * 1000))),
+    ]);
+    return extended === 1;
+  }
+
   async release(key: string, owner: string): Promise<boolean> {
-    const deleted = await redis.send("EVAL", [RELEASE_SCRIPT, "1", this._key(key), owner]);
+    const deleted = await this._redis.send("EVAL", [RELEASE_SCRIPT, "1", this._key(key), owner]);
     return deleted === 1;
   }
 
   async forceRelease(key: string): Promise<void> {
-    await redis.del(this._key(key));
+    await this._redis.del(this._key(key));
   }
 
   async exists(key: string): Promise<boolean> {
-    return redis.exists(this._key(key));
+    return this._redis.exists(this._key(key));
   }
 }

package/src/lock/drivers/SqliteLockDriver.ts

@@ -59,6 +59,19 @@ export class SqliteLockDriver implements LockDriver {
     }
   }
 
+  async extend(key: string, owner: string, ttlSeconds: number): Promise<boolean> {
+    const now = Date.now();
+    // One statement, so the owner check and the write cannot be separated by
+    // another process's acquire. `expires_at > ?` refuses to revive a lapsed
+    // record, which someone else may already have taken over.
+    const result = this._db
+      .prepare(
+        "UPDATE zerotal_locks SET expires_at = ? WHERE key = ? AND owner = ? AND expires_at > ?",
+      )
+      .run(now + ttlSeconds * 1000, key, owner, now);
+    return result.changes > 0;
+  }
+
   async release(key: string, owner: string): Promise<boolean> {
     const result = this._db
       .prepare("DELETE FROM zerotal_locks WHERE key = ? AND owner = ?")