indexeddbshim 17.3.2 → 17.3.3

package/dist/indexeddbshim-UnicodeIdentifiers-node.cjs

@@ -1,4 +1,4 @@
-/*! indexeddbshim - v17.3.2 - 8/24/2026 */
+/*! indexeddbshim - v17.3.3 - 8/25/2026 */
 
 'use strict';
 
@@ -5708,9 +5708,15 @@ IDBTransaction.prototype.__abortTransaction = function (err) {
   if (err !== null) {
     me.__error = err;
   }
-  if (me.__requestsFinished) {
+  if (me.__requestsFinished && err !== null) {
     // The transaction has already completed, so we can't call "onerror" or "onabort".
-    // So throw the error instead.
+    // So throw the error instead. `err` is only ever `null` here via
+    //   `IDBTransaction.prototype.abort`'s own `__abortTransaction(null)`
+    //   call, which now checks `__requestsFinished` itself first and
+    //   throws `InvalidStateError` synchronously before ever reaching
+    //   this point -- so this guard is just defense in depth against
+    //   `err` somehow being `null` some other way, not something this
+    //   path should see in practice.
     setTimeout(() => {
       throw err;
     }, 0);
@@ -5828,6 +5834,14 @@ IDBTransaction.prototype.abort = function () {
   if (me.__committed) {
     throw createDOMException('InvalidStateError', 'The transaction has already been committed');
   }
+  if (me.__requestsFinished) {
+    // All requests have already finished and the transaction is
+    //   auto-committing (the async SQL commit round trip just hasn't
+    //   resolved yet) -- too late to abort per spec, even though
+    //   `__committed` itself isn't set until that round trip actually
+    //   finishes.
+    throw createDOMException('InvalidStateError', 'The transaction is already committing');
+  }
   me.__abortTransaction(null);
 };
 
@@ -10063,7 +10077,29 @@ function triggerAnyVersionChangeAndBlockedEvents(openConnections, req, oldVersio
       return new SyncPromise(function (resolve) {
         setTimeout(() => {
           entry.dispatchEvent(e); // No need to catch errors
-          resolve(undefined);
+          // Unlike a native `Promise`, `SyncPromise#then` chains
+          //   synchronously off `resolve()` (verified directly:
+          //   `SyncPromise.resolve().then(cb)` runs `cb` before
+          //   even the calling code below it finishes) -- so
+          //   resolving immediately here would let the
+          //   `connectionsClosed()` check below run before a
+          //   same-task-but-microtask-later continuation of a
+          //   `versionchange` listener above (e.g. an `await`-
+          //   based one that then calls `db.close()`, as in
+          //   `transaction-lifetime.any.js`) ever gets a turn,
+          //   incorrectly firing `blocked` even though the
+          //   connection was about to close in time. Give real
+          //   microtask-deferred continuations a small, bounded
+          //   number of turns first -- same pattern as
+          //   `IDBTransaction.js`'s `checkQueueEntry`.
+          let attemptsLeft = 10;
+          (function wait() {
+            if (attemptsLeft-- <= 0) {
+              resolve(undefined);
+              return;
+            }
+            queueMicrotask(wait);
+          })();
         }, 0);
       });
     });
@@ -10123,6 +10159,23 @@ function triggerAnyVersionChangeAndBlockedEvents(openConnections, req, oldVersio
  */
 const websqlDBCache = {};
 
+/**
+ * Tracks databases with a creation/upgrade currently in flight but not yet
+ *   committed or aborted -- keyed by (unescaped) database name. The
+ *   `dbVersions` row in `sysdb` these entries shadow is written *before*
+ *   `upgradeneeded` is even dispatched to user code (as the success
+ *   callback of that very `INSERT`/`UPDATE`), on the same shared `sysdb`
+ *   connection `databases()` itself reads from -- so, absent this, a
+ *   `databases()` call made while an upgrade is still pending would see
+ *   the new row (or new version) immediately, rather than only once the
+ *   corresponding `versionchange` transaction has genuinely committed, as
+ *   required by `get-databases.any.js`'s "doesn't pick up changes that
+ *   haven't committed" test. `IDBFactory.prototype.databases` filters
+ *   its SQL results against this map.
+ * @type {Map<string, {oldVersion: Integer, newVersion: Integer}>}
+ */
+const pendingVersionChanges = new Map();
+
 /** @type {import('websql-configurable/lib/websql/WebSQLDatabase.js').default} */
 let sysdb;
 let nameCounter = 0;
@@ -10425,6 +10478,19 @@ IDBFactory.prototype.open = function (name /* , version */) {
     if (calledDbCreateError) {
       return false;
     }
+    // Defensive cleanup: `pendingVersionChanges.set(name, ...)` (see
+    //   below) runs *before* the `dbVersions` `INSERT`/`UPDATE` it
+    //   guards is even attempted, but only `versionSet`'s own
+    //   `on__beforecomplete`/`on__preabort` handlers ever clear it --
+    //   and `versionSet` never runs at all if that `INSERT`/`UPDATE`,
+    //   or an earlier step in this same `open()` flow, fails first.
+    //   Without this, such a failure would leave the entry orphaned
+    //   forever, silently corrupting `databases()` for any *other*,
+    //   unrelated later `open()` call that happens to reuse the same
+    //   database name (common in WPT tests, e.g. generic names like
+    //   "DB1"/"TestDatabase" reused across different test files in
+    //   the same process). A no-op if no entry was ever set.
+    pendingVersionChanges.delete(name);
     const er = err ? webSQLErrback(err) : (/** @type {Error} */tx);
     calledDbCreateError = true;
     // Re: why bubbling here (and how cancelable is only really relevant for `window.onerror`) see: https://github.com/w3c/IndexedDB/issues/86
@@ -10536,22 +10602,43 @@ IDBFactory.prototype.open = function (name /* , version */) {
                 //   open/close the transaction's active-handler window itself.
                 req.transaction.__handlerActive = true;
                 req.dispatchEvent(e);
-                // Give any same-tick microtask scheduled from within the
+                // Give any microtask-scheduled continuation of the
                 //   `upgradeneeded` handler (e.g. a plain
-                //   `Promise.resolve().then(...)`) a chance to run -- and still
-                //   observe the transaction as active -- before we deactivate it
-                //   again, per https://github.com/w3c/IndexedDB/issues/87. Only
-                //   the flag reset itself is deferred here -- unlike
-                //   `IDBTransaction.js`'s `advanceAfterDispatch`, `finished()`
-                //   (this transaction's own queue-advancement/completion signal)
-                //   still runs synchronously, at exactly its previous timing: an
-                //   earlier attempt at deferring `finished()` too raced against
-                //   unrelated test setup that assumed a freshly deleted/created
-                //   database's upgrade transaction had already fully completed by
-                //   the time this function returns.
-                queueMicrotask(() => {
-                  req.transaction.__handlerActive = false;
-                });
+                //   `Promise.resolve().then(...)`, or an `await`-based
+                //   continuation of a promise resolved from within the handler,
+                //   such as testharness.js's own `EventWatcher`) a chance to
+                //   run -- and still observe the transaction as active -- before
+                //   we deactivate it again, per
+                //   https://github.com/w3c/IndexedDB/issues/87. A single deferred
+                //   tick isn't always enough: an `await`-based continuation can
+                //   take more than one microtask turn to resume (e.g.
+                //   `transaction-lifetime.any.js`'s `EventWatcher`-based
+                //   `await eventWatcher.wait_for('upgradeneeded')`), so retry a
+                //   small, bounded number of times first -- same pattern as
+                //   `IDBTransaction.js`'s `checkQueueEntry` -- rather than
+                //   resetting after only one. Only the flag reset itself is
+                //   deferred here -- unlike `IDBTransaction.js`'s
+                //   `advanceAfterDispatch`, `finished()` (this transaction's own
+                //   queue-advancement/completion signal) still runs
+                //   synchronously, at exactly its previous timing: an earlier
+                //   attempt at deferring `finished()` too raced against unrelated
+                //   test setup that assumed a freshly deleted/created database's
+                //   upgrade transaction had already fully completed by the time
+                //   this function returns.
+                /**
+                 * @param {Integer} attemptsLeft
+                 * @returns {void}
+                 */
+                function deferHandlerActiveReset(attemptsLeft) {
+                  if (attemptsLeft <= 0) {
+                    req.transaction.__handlerActive = false;
+                    return;
+                  }
+                  queueMicrotask(() => {
+                    deferHandlerActiveReset(attemptsLeft - 1);
+                  });
+                }
+                deferHandlerActiveReset(10);
                 if (e.__legacyOutputDidListenersThrowError) {
                   logError('Error', 'An error occurred in an upgradeneeded handler attached to request chain', /** @type {Error} */e.__legacyOutputDidListenersThrowError); // We do nothing else with this error as per spec
                   req.transaction.__abortTransaction(createDOMException('AbortError', 'A request was aborted.'));
@@ -10567,6 +10654,7 @@ IDBFactory.prototype.open = function (name /* , version */) {
                * @returns {void}
                */
               function (ev) {
+                pendingVersionChanges.delete(name);
                 connection.__upgradeTransaction = null;
                 /** @type {import('./IDBDatabase.js').IDBDatabaseFull} */
                 req.__result.__versionTransaction = null;
@@ -10581,6 +10669,7 @@ IDBFactory.prototype.open = function (name /* , version */) {
 
               // eslint-disable-next-line camelcase -- Clear API
               req.transaction.on__preabort = function () {
+                pendingVersionChanges.delete(name);
                 connection.__upgradeTransaction = null;
                 // We ensure any cache is deleted before any request error events fire and try to reopen
                 if (useDatabaseCache) {
@@ -10643,6 +10732,10 @@ IDBFactory.prototype.open = function (name /* , version */) {
                 // });
               };
             }
+            pendingVersionChanges.set(name, {
+              oldVersion,
+              newVersion: version
+            });
             if (oldVersion === 0) {
               systx.executeSql('INSERT INTO dbVersions VALUES (?,?)', [sqlSafeName, version], versionSet, dbCreateError);
             } else {
@@ -10946,6 +11039,15 @@ IDBFactory.prototype.cmp = function (key1, key2) {
 IDBFactory.prototype.databases = function () {
   const me = this;
   let calledDbCreateError = false;
+  // Snapshotted *now*, synchronously, at call time -- not read later
+  // from inside the SQL query's callback below, which runs on a
+  //   deferred macrotask (see `nodeSQLiteDatabase.js`'s `exec`) and so
+  //   could otherwise race against (and lose to) an in-flight upgrade's
+  //   own commit/abort handler clearing its `pendingVersionChanges`
+  //   entry in the meantime -- which would make this method incorrectly
+  //   reflect a since-committed change that hadn't committed yet when
+  //   it was actually called.
+  const pendingVersionChangesSnapshot = new Map(pendingVersionChanges);
   return new Promise(function (resolve, reject) {
     // eslint-disable-line promise/avoid-new -- Own polyfill
     if (!(me instanceof IDBFactory)) {
@@ -10975,11 +11077,30 @@ IDBFactory.prototype.databases = function () {
           const dbNames = [];
           for (let i = 0; i < data.rows.length; i++) {
             const {
-              name,
+              name: encodedName,
               version
             } = /** @type {{name: string, version: Integer}} */data.rows.item(i);
+            const name = unescapeSQLiteResponse(encodedName);
+            // A row for a database whose creation/upgrade hasn't
+            //   committed yet (see `pendingVersionChanges`) must
+            //   not reflect that in-flight change: a brand new
+            //   database (`oldVersion === 0`) isn't reported at
+            //   all until its creation commits, and an existing
+            //   database being upgraded is still reported, but
+            //   with its pre-upgrade version.
+            const pending = pendingVersionChangesSnapshot.get(name);
+            if (pending) {
+              if (pending.oldVersion === 0) {
+                continue;
+              }
+              dbNames.push({
+                name,
+                version: pending.oldVersion
+              });
+              continue;
+            }
             dbNames.push({
-              name: unescapeSQLiteResponse(name),
+              name,
               version
             });
           }
@@ -11392,9 +11513,26 @@ IDBCursor.prototype.__findBasic = function (key, primaryKey, tx, success, error,
     // Key.convertValueToKey(key); // Already checked by `continue` or `continuePrimaryKey`
     sqlValues.push(/** @type {string} */encode$1(key));
   } else if (continueCall && me.__key !== undefined) {
-    sql.push('AND', quotedKeyColumnName, op + ' ?');
     // Key.convertValueToKey(me.__key); // Already checked when stored
-    sqlValues.push(/** @type {string} */encode$1(me.__key));
+    if (!me.__unique && me.__keyColumnName !== 'key' && me.__primaryKey !== undefined) {
+      // A plain `continue()` on a non-unique index cursor must find
+      //   the next record strictly after the (key, primaryKey) pair
+      //   this cursor last returned -- a scalar `key > lastKey` alone
+      //   would wrongly exclude a *different*, not-yet-visited record
+      //   that's still tied on key with the last one (e.g. another
+      //   record that always had that same indexed value), and would
+      //   also wrongly re-admit the *same* record forever if a
+      //   same-transaction `update()` bumped its own key back above
+      //   the threshold, since a scalar comparison can't distinguish
+      //   "some other record newly tied" from "this record moved
+      //   past its own last position." Comparing the full tuple (via
+      //   this OR) against both key and primary key resolves both.
+      sql.push('AND (', quotedKeyColumnName, op, '?', 'OR (', quotedKeyColumnName, '= ?', 'AND', quotedKey, op, '?))');
+      sqlValues.push(/** @type {string} */encode$1(me.__key), /** @type {string} */encode$1(me.__key), /** @type {string} */encode$1(me.__primaryKey));
+    } else {
+      sql.push('AND', quotedKeyColumnName, op + ' ?');
+      sqlValues.push(/** @type {string} */encode$1(me.__key));
+    }
   }
   if (!me.__count) {
     // 1. Sort by key
@@ -12008,9 +12146,15 @@ IDBCursor.prototype.update = function (valueToUpdate) {
    * @returns {void}
    */
   function addToQueue(clonedValue) {
-    // We set the `invalidateCache` argument to `false` since the old value shouldn't be accessed
+    // `invalidateCache: true` so any cursor on this store (including
+    //   this one) drops its prefetched row batch, forcing its next
+    //   `continue()` to re-query live rather than serve rows snapshotted
+    //   before this update -- needed for the compound-tuple
+    //   continuation logic in `__findBasic` to see this update's
+    //   effect on ordering (see "Modify records during cursor
+    //   iteration" in idbcursor_update_index.any.js).
     // @ts-ignore -- API (not erring in TS 6)
-    IDBObjectStore.__storingRecordObjectStore(request, me.__store, false, clonedValue, false, key);
+    IDBObjectStore.__storingRecordObjectStore(request, me.__store, true, clonedValue, false, key);
   }
   if (me.__store.keyPath !== null) {
     const [evaluatedKey, clonedValue] = me.__store.__validateKeyAndValueAndCloneValue(valueToUpdate, undefined, true);
@@ -13132,11 +13276,9 @@ function runBatch(self, batch) {
     self._running = false;
     runAllSql(self);
   }
-  const currentTask = /** @type {import('./WebSQLDatabase.js').TransactionTask} */
-  self._websqlDatabase._currentTask;
   const {
     readOnly
-  } = currentTask;
+  } = self._task;
   self._websqlDatabase._db.exec(batch, readOnly, function (err, results) {
     /* c8 ignore next */
     if (err || !results) {
@@ -13224,10 +13366,12 @@ function executeSql(self, sql, args, sqlCallback, sqlErrorCallback, executeDelay
 class WebSQLTransaction {
   /**
    * @param {import('./WebSQLDatabase.js').default} websqlDatabase
+   * @param {import('./WebSQLDatabase.js').TransactionTask} task
    * @param {import('../types.js').Delay} [executeDelay]
    */
-  constructor(websqlDatabase, executeDelay) {
+  constructor(websqlDatabase, task, executeDelay) {
     this._websqlDatabase = websqlDatabase;
+    this._task = task;
     /** @type {Error | null} */
     this._error = null;
     this._complete = false;
@@ -13236,11 +13380,14 @@ class WebSQLTransaction {
     this._executeDelay = executeDelay || immediate;
     /** @type {import('tiny-queue').default<SQLTask>} */
     this._sqlQueue = new Queue();
-    const currentTask = /** @type {import('./WebSQLDatabase.js').TransactionTask} */
-    websqlDatabase._currentTask;
-    if (!currentTask.readOnly) {
-      // Since we serialize all access to the database, there is no need to
-      // run read-only tasks in a transaction. This is a perf boost.
+    if (!task.readOnly) {
+      // A read-only task never needs a transaction wrapper for its own
+      // sake (reads don't need atomicity against each other) -- true
+      // whether or not `concurrentReaders` (see `WebSQLDatabase`) lets
+      // multiple read-only tasks actually run at once. This is a perf
+      // boost either way. A non-read-only task always still gets one, and
+      // always still runs with full exclusivity (see
+      // `WebSQLDatabase#runNextTransaction`).
       this._sqlQueue.push(new SQLTask('BEGIN;', [], noop, noop));
     }
   }
@@ -13321,39 +13468,68 @@ class WebSQLDatabase {
     this._db = db;
     /** @type {import('tiny-queue').default<TransactionTask>} */
     this._txnQueue = new Queue();
-    this._running = false;
+    // Off by default: queued transactions -- read or write alike -- run
+    // strictly one at a time, in the order requested, per the WebSQL spec
+    // (see `#runNextTransaction`). When true, any number of read-only
+    // tasks may instead run concurrently; a non-read-only task still
+    // always runs with full exclusivity either way.
+    this._concurrentReaders = Boolean(webSQLOverrides.concurrentReaders);
+    /** @type {Set<TransactionTask>} */
+    this._activeReaders = new Set();
     /** @type {TransactionTask | null} */
-    this._currentTask = null;
+    this._activeWriter = null;
     this._transactionDelay = webSQLOverrides.transactionDelay || immediate;
     this._executeDelay = webSQLOverrides.executeDelay || immediate;
   }
 
   /**
-   *
+   * @param {TransactionTask} task
    */
-  #runTransaction() {
-    const txn = new WebSQLTransaction(this, this._executeDelay);
+  #runTransaction(task) {
+    const txn = new WebSQLTransaction(this, task, this._executeDelay);
     this._transactionDelay(() => {
-      const currentTask = /** @type {TransactionTask} */this._currentTask;
-      currentTask.txnCallback(txn);
+      task.txnCallback(txn);
       txn._checkDone();
     });
   }
 
   /**
-   *
+   * Starts as many queued tasks as the current lock state allows. With
+   * `concurrentReaders` off (the default), a task only starts once
+   * nothing else is active at all -- full mutual exclusion, matching the
+   * WebSQL spec's strict one-at-a-time, in-request-order guarantee (see
+   * this file's own test suite, "callback order 2"). With it on, any
+   * leading run of read-only tasks can all start together instead
+   * (concurrent reads are always fine); a non-read-only task still needs
+   * exclusivity regardless, so nothing past it may start until it
+   * finishes. Not starvation-proof in the `concurrentReaders` case -- a
+   * steady stream of arriving readers could in principle keep a waiting
+   * writer waiting indefinitely -- but that's an acceptable tradeoff over
+   * the added complexity of tracking arrival order across reader/writer
+   * kinds.
    */
   #runNextTransaction() {
-    if (this._running) {
-      return;
-    }
-    const task = this._txnQueue.shift();
-    if (!task) {
-      return;
+    for (;;) {
+      const [nextTask] = this._txnQueue.slice(0, 1);
+      if (!nextTask) {
+        return;
+      }
+      const readerMayShare = this._concurrentReaders && nextTask.readOnly;
+      if (readerMayShare) {
+        if (this._activeWriter) {
+          return;
+        }
+      } else if (this._activeWriter || this._activeReaders.size) {
+        return;
+      }
+      this._txnQueue.shift();
+      if (nextTask.readOnly) {
+        this._activeReaders.add(nextTask);
+      } else {
+        this._activeWriter = nextTask;
+      }
+      this.#runTransaction(nextTask);
     }
-    this._currentTask = task;
-    this._running = true;
-    this.#runTransaction();
   }
 
   /**
@@ -13381,6 +13557,7 @@ class WebSQLDatabase {
    */
   // eslint-disable-next-line unicorn/prefer-private-class-fields -- see above
   _onTransactionComplete(err, transaction) {
+    const task = transaction._task;
     /**
      * @param {Error | boolean | null} [er]
      */
@@ -13395,14 +13572,15 @@ class WebSQLDatabase {
         transaction._complete = true;
       }
       if (er) {
-        if (this._currentTask) {
-          this._currentTask.errorCallback(/** @type {Error} */er);
-        }
-      } else if (this._currentTask) {
-        this._currentTask.successCallback();
+        task.errorCallback(/** @type {Error} */er);
+      } else {
+        task.successCallback();
+      }
+      if (task.readOnly) {
+        this._activeReaders.delete(task);
+      } else if (this._activeWriter === task) {
+        this._activeWriter = null;
       }
-      this._running = false;
-      this._currentTask = null;
       this.#runNextTransaction();
     };
     /**
@@ -13428,13 +13606,13 @@ class WebSQLDatabase {
         }
       });
     };
-    if (this._currentTask && this._currentTask.nonstandardTransCb) {
-      const cont = this._currentTask.nonstandardTransCb.call(this, this._currentTask, err, done, rollback, commit);
+    if (task.nonstandardTransCb) {
+      const cont = task.nonstandardTransCb.call(this, task, err, done, rollback, commit);
       if (!cont) {
         return;
       }
     }
-    if (this._currentTask && this._currentTask.readOnly) {
+    if (task.readOnly) {
       done(err); // read-only doesn't require a transaction
     } else if (err) {
       rollback(err);
@@ -14392,16 +14570,28 @@ const READ_ONLY_ERROR = new Error('could not prepare statement (23 not authorize
 //   connection and a newly-opened one during an upgrade. `PRAGMA
 //   busy_timeout` can't safely arbitrate between them here: it blocks the
 //   single JS thread synchronously while it retries, but the lock holder's
-//   own release is itself scheduled via `setTimeout` below, which can never
-//   fire while that retry loop is blocking the same thread -- so instead of
-//   waiting, the second connection's write just fails with "database is
-//   locked". Serialize writes per file path instead, so a second
-//   connection's `BEGIN` waits for the first connection's transaction to
-//   actually finish rather than colliding with it.
+//   own release is itself scheduled via `setImmediate` below, which can
+//   never fire while that retry loop is blocking the same thread -- so
+//   instead of waiting, a second connection's write just fails with
+//   "database is locked".
+//
+// `fileReaders`/`fileWriter` implement a simple (not starvation-proof --
+//   see the release loop below) reader/writer lock per file path instead:
+//   any number of `readonly` transactions may hold the file concurrently,
+//   matching what SQLite itself already natively supports (multiple
+//   readers never need to exclude each other, only a writer needs
+//   exclusivity), while a non-`readonly` transaction still waits for
+//   exclusive access -- no concurrent readers, no concurrent writer. A
+//   simple single-owner mutex (this file's prior implementation) would
+//   otherwise serialize even purely-concurrent-reader scenarios that
+//   never touch a writer at all, for no reason `better-sqlite3`/SQLite
+//   itself requires.
+/** @type {Map<string, Set<{_db: any, _qFilePath: string}>>} */
+const fileReaders = new Map();
 /** @type {Map<string, {_db: any, _qFilePath: string}>} */
-const fileLockOwners = new Map();
-/** @type {Map<string, (() => void)[]>} */
-const fileLockWaiters = new Map();
+const fileWriter = new Map();
+/** @type {Map<string, {isReader: boolean, resume: () => void}[]>} */
+const fileWaiters = new Map();
 const beginRe = /^\s*BEGIN\b/iu;
 const endRe = /^\s*(END|COMMIT|ROLLBACK)\b/iu;
 
@@ -14513,14 +14703,29 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
   //   already fully independent -- so there is nothing to serialize.
   const filePath = this._qFilePath === ':memory:' ? null : this._qFilePath;
   if (filePath && queries[0] && beginRe.test(queries[0].sql)) {
-    const owner = fileLockOwners.get(filePath);
-    if (owner && owner !== this) {
-      const waiters = fileLockWaiters.get(filePath) || [];
-      waiters.push(() => this.exec(queries, readOnly, callback));
-      fileLockWaiters.set(filePath, waiters);
+    const activeReaders = fileReaders.get(filePath);
+    const hasActiveReaders = Boolean(activeReaders && activeReaders.size);
+    const activeWriter = fileWriter.get(filePath);
+    const blockedByWriter = Boolean(activeWriter && activeWriter !== this);
+    const blocked = blockedByWriter || !readOnly && hasActiveReaders;
+    if (blocked) {
+      const waiters = fileWaiters.get(filePath) || [];
+      waiters.push({
+        isReader: readOnly,
+        resume: () => this.exec(queries, readOnly, callback)
+      });
+      fileWaiters.set(filePath, waiters);
       return;
     }
-    fileLockOwners.set(filePath, this);
+    if (readOnly) {
+      if (activeReaders) {
+        activeReaders.add(this);
+      } else {
+        fileReaders.set(filePath, new Set([this]));
+      }
+    } else {
+      fileWriter.set(filePath, this);
+    }
   }
   const db = this._db._db;
   const len = queries.length;
@@ -14562,13 +14767,15 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
       }
     }
   }
-  // A real timer (not `queueMicrotask`) so this yields to the macrotask
-  //   queue: code that synchronously issues a new request from within
-  //   each request's callback (e.g. to keep a transaction alive) would
+  // A real macrotask (not `queueMicrotask`) so this yields properly:
+  //   code that synchronously issues a new request from within each
+  //   request's callback (e.g. to keep a transaction alive) would
   //   otherwise chain microtask to microtask forever, starving out any
   //   `setTimeout`-based code (including IndexedDB's own internal request
-  //   scheduling) that never gets a turn to run.
-  setTimeout(() => {
+  //   scheduling) that never gets a turn to run. `setImmediate` (Node's
+  //   "check" phase) still yields the same way `setTimeout(..., 0)` did,
+  //   but runs sooner in Node's event loop.
+  setImmediate(() => {
     // Release the file lock (if held) and hand it to the next waiting
     //   connection, if any, only once this transaction has genuinely
     //   finished -- and only here, on its own turn, so a resumed
@@ -14583,15 +14790,52 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
     //   and never see the matching release, deadlocking every later
     //   connection to the same file.
     if (filePath && queries.some(q => endRe.test(q.sql))) {
-      fileLockOwners.delete(filePath);
-      const waiters = fileLockWaiters.get(filePath);
-      const nextWaitingExec = waiters && waiters.shift();
-      if (nextWaitingExec) {
-        nextWaitingExec();
+      const activeReaders = fileReaders.get(filePath);
+      if (activeReaders) {
+        activeReaders.delete(this);
+        if (!activeReaders.size) {
+          fileReaders.delete(filePath);
+        }
+      }
+      if (fileWriter.get(filePath) === this) {
+        fileWriter.delete(filePath);
+      }
+      // Resume as many waiters as the lock now genuinely allows:
+      //   any leading run of readers (concurrent reads are always
+      //   fine), then at most one writer, since a writer needs
+      //   exclusivity -- stop there rather than looking past it.
+      //   Not starvation-proof: a steady stream of arriving readers
+      //   could in principle keep a waiting writer waiting
+      //   indefinitely, but that's an acceptable tradeoff here over
+      //   the added complexity of tracking arrival order across
+      //   reader/writer kinds.
+      const waiters = fileWaiters.get(filePath);
+      if (waiters) {
+        while (waiters.length) {
+          if (fileWriter.has(filePath)) {
+            break;
+          }
+          const next = waiters[0];
+          const stillHasReaders = fileReaders.get(filePath);
+          if (!next.isReader && stillHasReaders && stillHasReaders.size) {
+            break;
+          }
+          waiters.shift();
+          next.resume();
+          if (!next.isReader) {
+            // A writer just took exclusive ownership (inside
+            //   `resume()`, synchronously, via the acquire
+            //   logic above) -- nothing else may proceed now.
+            break;
+          }
+        }
+        if (!waiters.length) {
+          fileWaiters.delete(filePath);
+        }
       }
     }
     callback(null, results);
-  }, 0);
+  });
 };
 
 /**
@@ -14631,7 +14875,19 @@ function wrappedSQLiteDatabase(name) {
   }
   return db;
 }
-const nodeWebSQL = customOpenDatabase(/** @type {SQLiteDatabaseConstructor} */ /** @type {unknown} */wrappedSQLiteDatabase, {});
+
+// `concurrentReaders` is off by default in `websql-configurable` itself (to
+//   preserve the WebSQL spec's strict, one-at-a-time transaction ordering
+//   that library's own test suite depends on), but IndexedDBShim only ever
+//   uses it as an internal SQL execution engine -- it doesn't need or expose
+//   that ordering guarantee itself -- so it's safe, and needed, to opt in
+//   here: without it, two same-scope `readonly` IDBTransactions can deadlock
+//   waiting on each other (see `transaction-scheduling-within-database.any.js`).
+const nodeWebSQL = customOpenDatabase(/** @type {SQLiteDatabaseConstructor} */ /** @type {unknown} */wrappedSQLiteDatabase, {
+  websql: {
+    concurrentReaders: true
+  }
+});
 
 // ID_Start (includes Other_ID_Start)
 const UnicodeIDStart = String.raw`(?:[$A-Z_a-z\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0561-\u0587\u05D0-\u05EA\u05F0-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5\u06E5\u06E6\u06EE\u06EF\u06FA-\u06FC\u06FF\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07CA-\u07EA\u07F4\u07F5\u07FA\u0800-\u0815\u081A\u0824\u0828\u0840-\u0858\u08A0-\u08B4\u08B6-\u08BD\u0904-\u0939\u093D\u0950\u0958-\u0961\u0971-\u0980\u0985-\u098C\u098F\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2\u09B6-\u09B9\u09BD\u09CE\u09DC\u09DD\u09DF-\u09E1\u09F0\u09F1\u0A05-\u0A0A\u0A0F\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32\u0A33\u0A35\u0A36\u0A38\u0A39\u0A59-\u0A5C\u0A5E\u0A72-\u0A74\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8\u0AAA-\u0AB0\u0AB2\u0AB3\u0AB5-\u0AB9\u0ABD\u0AD0\u0AE0\u0AE1\u0AF9\u0B05-\u0B0C\u0B0F\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32\u0B33\u0B35-\u0B39\u0B3D\u0B5C\u0B5D\u0B5F-\u0B61\u0B71\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99\u0B9A\u0B9C\u0B9E\u0B9F\u0BA3\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0BD0\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C39\u0C3D\u0C58-\u0C5A\u0C60\u0C61\u0C80\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3\u0CB5-\u0CB9\u0CBD\u0CDE\u0CE0\u0CE1\u0CF1\u0CF2\u0D05-\u0D0C\u0D0E-\u0D10\u0D12-\u0D3A\u0D3D\u0D4E\u0D54-\u0D56\u0D5F-\u0D61\u0D7A-\u0D7F\u0D85-\u0D96\u0D9A-\u0DB1\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0E01-\u0E30\u0E32\u0E33\u0E40-\u0E46\u0E81\u0E82\u0E84\u0E87\u0E88\u0E8A\u0E8D\u0E94-\u0E97\u0E99-\u0E9F\u0EA1-\u0EA3\u0EA5\u0EA7\u0EAA\u0EAB\u0EAD-\u0EB0\u0EB2\u0EB3\u0EBD\u0EC0-\u0EC4\u0EC6\u0EDC-\u0EDF\u0F00\u0F40-\u0F47\u0F49-\u0F6C\u0F88-\u0F8C\u1000-\u102A\u103F\u1050-\u1055\u105A-\u105D\u1061\u1065\u1066\u106E-\u1070\u1075-\u1081\u108E\u10A0-\u10C5\u10C7\u10CD\u10D0-\u10FA\u10FC-\u1248\u124A-\u124D\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310\u1312-\u1315\u1318-\u135A\u1380-\u138F\u13A0-\u13F5\u13F8-\u13FD\u1401-\u166C\u166F-\u167F\u1681-\u169A\u16A0-\u16EA\u16EE-\u16F8\u1700-\u170C\u170E-\u1711\u1720-\u1731\u1740-\u1751\u1760-\u176C\u176E-\u1770\u1780-\u17B3\u17D7\u17DC\u1820-\u1877\u1880-\u18A8\u18AA\u18B0-\u18F5\u1900-\u191E\u1950-\u196D\u1970-\u1974\u1980-\u19AB\u19B0-\u19C9\u1A00-\u1A16\u1A20-\u1A54\u1AA7\u1B05-\u1B33\u1B45-\u1B4B\u1B83-\u1BA0\u1BAE\u1BAF\u1BBA-\u1BE5\u1C00-\u1C23\u1C4D-\u1C4F\u1C5A-\u1C7D\u1C80-\u1C88\u1CE9-\u1CEC\u1CEE-\u1CF1\u1CF5\u1CF6\u1D00-\u1DBF\u1E00-\u1F15\u1F18-\u1F1D\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u2071\u207F\u2090-\u209C\u2102\u2107\u210A-\u2113\u2115\u2118-\u211D\u2124\u2126\u2128\u212A-\u2139\u213C-\u213F\u2145-\u2149\u214E\u2160-\u2188\u2C00-\u2C2E\u2C30-\u2C5E\u2C60-\u2CE4\u2CEB-\u2CEE\u2CF2\u2CF3\u2D00-\u2D25\u2D27\u2D2D\u2D30-\u2D67\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE\u2DD0-\u2DD6\u2DD8-\u2DDE\u3005-\u3007\u3021-\u3029\u3031-\u3035\u3038-\u303C\u3041-\u3096\u309B-\u309F\u30A1-\u30FA\u30FC-\u30FF\u3105-\u312D\u3131-\u318E\u31A0-\u31BA\u31F0-\u31FF\u3400-\u4DB5\u4E00-\u9FD5\uA000-\uA48C\uA4D0-\uA4FD\uA500-\uA60C\uA610-\uA61F\uA62A\uA62B\uA640-\uA66E\uA67F-\uA69D\uA6A0-\uA6EF\uA717-\uA71F\uA722-\uA788\uA78B-\uA7AE\uA7B0-\uA7B7\uA7F7-\uA801\uA803-\uA805\uA807-\uA80A\uA80C-\uA822\uA840-\uA873\uA882-\uA8B3\uA8F2-\uA8F7\uA8FB\uA8FD\uA90A-\uA925\uA930-\uA946\uA960-\uA97C\uA984-\uA9B2\uA9CF\uA9E0-\uA9E4\uA9E6-\uA9EF\uA9FA-\uA9FE\uAA00-\uAA28\uAA40-\uAA42\uAA44-\uAA4B\uAA60-\uAA76\uAA7A\uAA7E-\uAAAF\uAAB1\uAAB5\uAAB6\uAAB9-\uAABD\uAAC0\uAAC2\uAADB-\uAADD\uAAE0-\uAAEA\uAAF2-\uAAF4\uAB01-\uAB06\uAB09-\uAB0E\uAB11-\uAB16\uAB20-\uAB26\uAB28-\uAB2E\uAB30-\uAB5A\uAB5C-\uAB65\uAB70-\uABE2\uAC00-\uD7A3\uD7B0-\uD7C6\uD7CB-\uD7FB\uF900-\uFA6D\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1F-\uFB28\uFB2A-\uFB36\uFB38-\uFB3C\uFB3E\uFB40\uFB41\uFB43\uFB44\uFB46-\uFBB1\uFBD3-\uFD3D\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDFB\uFE70-\uFE74\uFE76-\uFEFC\uFF21-\uFF3A\uFF41-\uFF5A\uFF66-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF\uFFD2-\uFFD7\uFFDA-\uFFDC]|\uD800[\uDC00-\uDC0B\uDC0D-\uDC26\uDC28-\uDC3A\uDC3C\uDC3D\uDC3F-\uDC4D\uDC50-\uDC5D\uDC80-\uDCFA\uDD40-\uDD74\uDE80-\uDE9C\uDEA0-\uDED0\uDF00-\uDF1F\uDF30-\uDF4A\uDF50-\uDF75\uDF80-\uDF9D\uDFA0-\uDFC3\uDFC8-\uDFCF\uDFD1-\uDFD5]|\uD801[\uDC00-\uDC9D\uDCB0-\uDCD3\uDCD8-\uDCFB\uDD00-\uDD27\uDD30-\uDD63\uDE00-\uDF36\uDF40-\uDF55\uDF60-\uDF67]|\uD802[\uDC00-\uDC05\uDC08\uDC0A-\uDC35\uDC37\uDC38\uDC3C\uDC3F-\uDC55\uDC60-\uDC76\uDC80-\uDC9E\uDCE0-\uDCF2\uDCF4\uDCF5\uDD00-\uDD15\uDD20-\uDD39\uDD80-\uDDB7\uDDBE\uDDBF\uDE00\uDE10-\uDE13\uDE15-\uDE17\uDE19-\uDE33\uDE60-\uDE7C\uDE80-\uDE9C\uDEC0-\uDEC7\uDEC9-\uDEE4\uDF00-\uDF35\uDF40-\uDF55\uDF60-\uDF72\uDF80-\uDF91]|\uD803[\uDC00-\uDC48\uDC80-\uDCB2\uDCC0-\uDCF2]|\uD804[\uDC03-\uDC37\uDC83-\uDCAF\uDCD0-\uDCE8\uDD03-\uDD26\uDD50-\uDD72\uDD76\uDD83-\uDDB2\uDDC1-\uDDC4\uDDDA\uDDDC\uDE00-\uDE11\uDE13-\uDE2B\uDE80-\uDE86\uDE88\uDE8A-\uDE8D\uDE8F-\uDE9D\uDE9F-\uDEA8\uDEB0-\uDEDE\uDF05-\uDF0C\uDF0F\uDF10\uDF13-\uDF28\uDF2A-\uDF30\uDF32\uDF33\uDF35-\uDF39\uDF3D\uDF50\uDF5D-\uDF61]|\uD805[\uDC00-\uDC34\uDC47-\uDC4A\uDC80-\uDCAF\uDCC4\uDCC5\uDCC7\uDD80-\uDDAE\uDDD8-\uDDDB\uDE00-\uDE2F\uDE44\uDE80-\uDEAA\uDF00-\uDF19]|\uD806[\uDCA0-\uDCDF\uDCFF\uDEC0-\uDEF8]|\uD807[\uDC00-\uDC08\uDC0A-\uDC2E\uDC40\uDC72-\uDC8F]|\uD808[\uDC00-\uDF99]|\uD809[\uDC00-\uDC6E\uDC80-\uDD43]|[\uD80C\uD81C-\uD820\uD840-\uD868\uD86A-\uD86C\uD86F-\uD872][\uDC00-\uDFFF]|\uD80D[\uDC00-\uDC2E]|\uD811[\uDC00-\uDE46]|\uD81A[\uDC00-\uDE38\uDE40-\uDE5E\uDED0-\uDEED\uDF00-\uDF2F\uDF40-\uDF43\uDF63-\uDF77\uDF7D-\uDF8F]|\uD81B[\uDF00-\uDF44\uDF50\uDF93-\uDF9F\uDFE0]|\uD821[\uDC00-\uDFEC]|\uD822[\uDC00-\uDEF2]|\uD82C[\uDC00\uDC01]|\uD82F[\uDC00-\uDC6A\uDC70-\uDC7C\uDC80-\uDC88\uDC90-\uDC99]|\uD835[\uDC00-\uDC54\uDC56-\uDC9C\uDC9E\uDC9F\uDCA2\uDCA5\uDCA6\uDCA9-\uDCAC\uDCAE-\uDCB9\uDCBB\uDCBD-\uDCC3\uDCC5-\uDD05\uDD07-\uDD0A\uDD0D-\uDD14\uDD16-\uDD1C\uDD1E-\uDD39\uDD3B-\uDD3E\uDD40-\uDD44\uDD46\uDD4A-\uDD50\uDD52-\uDEA5\uDEA8-\uDEC0\uDEC2-\uDEDA\uDEDC-\uDEFA\uDEFC-\uDF14\uDF16-\uDF34\uDF36-\uDF4E\uDF50-\uDF6E\uDF70-\uDF88\uDF8A-\uDFA8\uDFAA-\uDFC2\uDFC4-\uDFCB]|\uD83A[\uDC00-\uDCC4\uDD00-\uDD43]|\uD83B[\uDE00-\uDE03\uDE05-\uDE1F\uDE21\uDE22\uDE24\uDE27\uDE29-\uDE32\uDE34-\uDE37\uDE39\uDE3B\uDE42\uDE47\uDE49\uDE4B\uDE4D-\uDE4F\uDE51\uDE52\uDE54\uDE57\uDE59\uDE5B\uDE5D\uDE5F\uDE61\uDE62\uDE64\uDE67-\uDE6A\uDE6C-\uDE72\uDE74-\uDE77\uDE79-\uDE7C\uDE7E\uDE80-\uDE89\uDE8B-\uDE9B\uDEA1-\uDEA3\uDEA5-\uDEA9\uDEAB-\uDEBB]|\uD869[\uDC00-\uDED6\uDF00-\uDFFF]|\uD86D[\uDC00-\uDF34\uDF40-\uDFFF]|\uD86E[\uDC00-\uDC1D\uDC20-\uDFFF]|\uD873[\uDC00-\uDEA1]|\uD87E[\uDC00-\uDE1D])`;