indexeddbshim 17.3.2 → 17.3.3

package/dist/indexeddbshim-node.cjs

@@ -1,4 +1,4 @@
-/*! indexeddbshim - v17.3.2 - 8/24/2026 */
+/*! indexeddbshim - v17.3.3 - 8/25/2026 */
 
 'use strict';
 
@@ -5708,9 +5708,15 @@ IDBTransaction.prototype.__abortTransaction = function (err) {
   if (err !== null) {
     me.__error = err;
   }
-  if (me.__requestsFinished) {
+  if (me.__requestsFinished && err !== null) {
     // The transaction has already completed, so we can't call "onerror" or "onabort".
-    // So throw the error instead.
+    // So throw the error instead. `err` is only ever `null` here via
+    //   `IDBTransaction.prototype.abort`'s own `__abortTransaction(null)`
+    //   call, which now checks `__requestsFinished` itself first and
+    //   throws `InvalidStateError` synchronously before ever reaching
+    //   this point -- so this guard is just defense in depth against
+    //   `err` somehow being `null` some other way, not something this
+    //   path should see in practice.
     setTimeout(() => {
       throw err;
     }, 0);
@@ -5828,6 +5834,14 @@ IDBTransaction.prototype.abort = function () {
   if (me.__committed) {
     throw createDOMException('InvalidStateError', 'The transaction has already been committed');
   }
+  if (me.__requestsFinished) {
+    // All requests have already finished and the transaction is
+    //   auto-committing (the async SQL commit round trip just hasn't
+    //   resolved yet) -- too late to abort per spec, even though
+    //   `__committed` itself isn't set until that round trip actually
+    //   finishes.
+    throw createDOMException('InvalidStateError', 'The transaction is already committing');
+  }
   me.__abortTransaction(null);
 };
 
@@ -10063,7 +10077,29 @@ function triggerAnyVersionChangeAndBlockedEvents(openConnections, req, oldVersio
       return new SyncPromise(function (resolve) {
         setTimeout(() => {
           entry.dispatchEvent(e); // No need to catch errors
-          resolve(undefined);
+          // Unlike a native `Promise`, `SyncPromise#then` chains
+          //   synchronously off `resolve()` (verified directly:
+          //   `SyncPromise.resolve().then(cb)` runs `cb` before
+          //   even the calling code below it finishes) -- so
+          //   resolving immediately here would let the
+          //   `connectionsClosed()` check below run before a
+          //   same-task-but-microtask-later continuation of a
+          //   `versionchange` listener above (e.g. an `await`-
+          //   based one that then calls `db.close()`, as in
+          //   `transaction-lifetime.any.js`) ever gets a turn,
+          //   incorrectly firing `blocked` even though the
+          //   connection was about to close in time. Give real
+          //   microtask-deferred continuations a small, bounded
+          //   number of turns first -- same pattern as
+          //   `IDBTransaction.js`'s `checkQueueEntry`.
+          let attemptsLeft = 10;
+          (function wait() {
+            if (attemptsLeft-- <= 0) {
+              resolve(undefined);
+              return;
+            }
+            queueMicrotask(wait);
+          })();
         }, 0);
       });
     });
@@ -10123,6 +10159,23 @@ function triggerAnyVersionChangeAndBlockedEvents(openConnections, req, oldVersio
  */
 const websqlDBCache = {};
 
+/**
+ * Tracks databases with a creation/upgrade currently in flight but not yet
+ *   committed or aborted -- keyed by (unescaped) database name. The
+ *   `dbVersions` row in `sysdb` these entries shadow is written *before*
+ *   `upgradeneeded` is even dispatched to user code (as the success
+ *   callback of that very `INSERT`/`UPDATE`), on the same shared `sysdb`
+ *   connection `databases()` itself reads from -- so, absent this, a
+ *   `databases()` call made while an upgrade is still pending would see
+ *   the new row (or new version) immediately, rather than only once the
+ *   corresponding `versionchange` transaction has genuinely committed, as
+ *   required by `get-databases.any.js`'s "doesn't pick up changes that
+ *   haven't committed" test. `IDBFactory.prototype.databases` filters
+ *   its SQL results against this map.
+ * @type {Map<string, {oldVersion: Integer, newVersion: Integer}>}
+ */
+const pendingVersionChanges = new Map();
+
 /** @type {import('websql-configurable/lib/websql/WebSQLDatabase.js').default} */
 let sysdb;
 let nameCounter = 0;
@@ -10425,6 +10478,19 @@ IDBFactory.prototype.open = function (name /* , version */) {
     if (calledDbCreateError) {
       return false;
     }
+    // Defensive cleanup: `pendingVersionChanges.set(name, ...)` (see
+    //   below) runs *before* the `dbVersions` `INSERT`/`UPDATE` it
+    //   guards is even attempted, but only `versionSet`'s own
+    //   `on__beforecomplete`/`on__preabort` handlers ever clear it --
+    //   and `versionSet` never runs at all if that `INSERT`/`UPDATE`,
+    //   or an earlier step in this same `open()` flow, fails first.
+    //   Without this, such a failure would leave the entry orphaned
+    //   forever, silently corrupting `databases()` for any *other*,
+    //   unrelated later `open()` call that happens to reuse the same
+    //   database name (common in WPT tests, e.g. generic names like
+    //   "DB1"/"TestDatabase" reused across different test files in
+    //   the same process). A no-op if no entry was ever set.
+    pendingVersionChanges.delete(name);
     const er = err ? webSQLErrback(err) : (/** @type {Error} */tx);
     calledDbCreateError = true;
     // Re: why bubbling here (and how cancelable is only really relevant for `window.onerror`) see: https://github.com/w3c/IndexedDB/issues/86
@@ -10536,22 +10602,43 @@ IDBFactory.prototype.open = function (name /* , version */) {
                 //   open/close the transaction's active-handler window itself.
                 req.transaction.__handlerActive = true;
                 req.dispatchEvent(e);
-                // Give any same-tick microtask scheduled from within the
+                // Give any microtask-scheduled continuation of the
                 //   `upgradeneeded` handler (e.g. a plain
-                //   `Promise.resolve().then(...)`) a chance to run -- and still
-                //   observe the transaction as active -- before we deactivate it
-                //   again, per https://github.com/w3c/IndexedDB/issues/87. Only
-                //   the flag reset itself is deferred here -- unlike
-                //   `IDBTransaction.js`'s `advanceAfterDispatch`, `finished()`
-                //   (this transaction's own queue-advancement/completion signal)
-                //   still runs synchronously, at exactly its previous timing: an
-                //   earlier attempt at deferring `finished()` too raced against
-                //   unrelated test setup that assumed a freshly deleted/created
-                //   database's upgrade transaction had already fully completed by
-                //   the time this function returns.
-                queueMicrotask(() => {
-                  req.transaction.__handlerActive = false;
-                });
+                //   `Promise.resolve().then(...)`, or an `await`-based
+                //   continuation of a promise resolved from within the handler,
+                //   such as testharness.js's own `EventWatcher`) a chance to
+                //   run -- and still observe the transaction as active -- before
+                //   we deactivate it again, per
+                //   https://github.com/w3c/IndexedDB/issues/87. A single deferred
+                //   tick isn't always enough: an `await`-based continuation can
+                //   take more than one microtask turn to resume (e.g.
+                //   `transaction-lifetime.any.js`'s `EventWatcher`-based
+                //   `await eventWatcher.wait_for('upgradeneeded')`), so retry a
+                //   small, bounded number of times first -- same pattern as
+                //   `IDBTransaction.js`'s `checkQueueEntry` -- rather than
+                //   resetting after only one. Only the flag reset itself is
+                //   deferred here -- unlike `IDBTransaction.js`'s
+                //   `advanceAfterDispatch`, `finished()` (this transaction's own
+                //   queue-advancement/completion signal) still runs
+                //   synchronously, at exactly its previous timing: an earlier
+                //   attempt at deferring `finished()` too raced against unrelated
+                //   test setup that assumed a freshly deleted/created database's
+                //   upgrade transaction had already fully completed by the time
+                //   this function returns.
+                /**
+                 * @param {Integer} attemptsLeft
+                 * @returns {void}
+                 */
+                function deferHandlerActiveReset(attemptsLeft) {
+                  if (attemptsLeft <= 0) {
+                    req.transaction.__handlerActive = false;
+                    return;
+                  }
+                  queueMicrotask(() => {
+                    deferHandlerActiveReset(attemptsLeft - 1);
+                  });
+                }
+                deferHandlerActiveReset(10);
                 if (e.__legacyOutputDidListenersThrowError) {
                   logError('Error', 'An error occurred in an upgradeneeded handler attached to request chain', /** @type {Error} */e.__legacyOutputDidListenersThrowError); // We do nothing else with this error as per spec
                   req.transaction.__abortTransaction(createDOMException('AbortError', 'A request was aborted.'));
@@ -10567,6 +10654,7 @@ IDBFactory.prototype.open = function (name /* , version */) {
                * @returns {void}
                */
               function (ev) {
+                pendingVersionChanges.delete(name);
                 connection.__upgradeTransaction = null;
                 /** @type {import('./IDBDatabase.js').IDBDatabaseFull} */
                 req.__result.__versionTransaction = null;
@@ -10581,6 +10669,7 @@ IDBFactory.prototype.open = function (name /* , version */) {
 
               // eslint-disable-next-line camelcase -- Clear API
               req.transaction.on__preabort = function () {
+                pendingVersionChanges.delete(name);
                 connection.__upgradeTransaction = null;
                 // We ensure any cache is deleted before any request error events fire and try to reopen
                 if (useDatabaseCache) {
@@ -10643,6 +10732,10 @@ IDBFactory.prototype.open = function (name /* , version */) {
                 // });
               };
             }
+            pendingVersionChanges.set(name, {
+              oldVersion,
+              newVersion: version
+            });
             if (oldVersion === 0) {
               systx.executeSql('INSERT INTO dbVersions VALUES (?,?)', [sqlSafeName, version], versionSet, dbCreateError);
             } else {
@@ -10946,6 +11039,15 @@ IDBFactory.prototype.cmp = function (key1, key2) {
 IDBFactory.prototype.databases = function () {
   const me = this;
   let calledDbCreateError = false;
+  // Snapshotted *now*, synchronously, at call time -- not read later
+  // from inside the SQL query's callback below, which runs on a
+  //   deferred macrotask (see `nodeSQLiteDatabase.js`'s `exec`) and so
+  //   could otherwise race against (and lose to) an in-flight upgrade's
+  //   own commit/abort handler clearing its `pendingVersionChanges`
+  //   entry in the meantime -- which would make this method incorrectly
+  //   reflect a since-committed change that hadn't committed yet when
+  //   it was actually called.
+  const pendingVersionChangesSnapshot = new Map(pendingVersionChanges);
   return new Promise(function (resolve, reject) {
     // eslint-disable-line promise/avoid-new -- Own polyfill
     if (!(me instanceof IDBFactory)) {
@@ -10975,11 +11077,30 @@ IDBFactory.prototype.databases = function () {
           const dbNames = [];
           for (let i = 0; i < data.rows.length; i++) {
             const {
-              name,
+              name: encodedName,
               version
             } = /** @type {{name: string, version: Integer}} */data.rows.item(i);
+            const name = unescapeSQLiteResponse(encodedName);
+            // A row for a database whose creation/upgrade hasn't
+            //   committed yet (see `pendingVersionChanges`) must
+            //   not reflect that in-flight change: a brand new
+            //   database (`oldVersion === 0`) isn't reported at
+            //   all until its creation commits, and an existing
+            //   database being upgraded is still reported, but
+            //   with its pre-upgrade version.
+            const pending = pendingVersionChangesSnapshot.get(name);
+            if (pending) {
+              if (pending.oldVersion === 0) {
+                continue;
+              }
+              dbNames.push({
+                name,
+                version: pending.oldVersion
+              });
+              continue;
+            }
             dbNames.push({
-              name: unescapeSQLiteResponse(name),
+              name,
               version
             });
           }
@@ -11392,9 +11513,26 @@ IDBCursor.prototype.__findBasic = function (key, primaryKey, tx, success, error,
     // Key.convertValueToKey(key); // Already checked by `continue` or `continuePrimaryKey`
     sqlValues.push(/** @type {string} */encode$1(key));
   } else if (continueCall && me.__key !== undefined) {
-    sql.push('AND', quotedKeyColumnName, op + ' ?');
     // Key.convertValueToKey(me.__key); // Already checked when stored
-    sqlValues.push(/** @type {string} */encode$1(me.__key));
+    if (!me.__unique && me.__keyColumnName !== 'key' && me.__primaryKey !== undefined) {
+      // A plain `continue()` on a non-unique index cursor must find
+      //   the next record strictly after the (key, primaryKey) pair
+      //   this cursor last returned -- a scalar `key > lastKey` alone
+      //   would wrongly exclude a *different*, not-yet-visited record
+      //   that's still tied on key with the last one (e.g. another
+      //   record that always had that same indexed value), and would
+      //   also wrongly re-admit the *same* record forever if a
+      //   same-transaction `update()` bumped its own key back above
+      //   the threshold, since a scalar comparison can't distinguish
+      //   "some other record newly tied" from "this record moved
+      //   past its own last position." Comparing the full tuple (via
+      //   this OR) against both key and primary key resolves both.
+      sql.push('AND (', quotedKeyColumnName, op, '?', 'OR (', quotedKeyColumnName, '= ?', 'AND', quotedKey, op, '?))');
+      sqlValues.push(/** @type {string} */encode$1(me.__key), /** @type {string} */encode$1(me.__key), /** @type {string} */encode$1(me.__primaryKey));
+    } else {
+      sql.push('AND', quotedKeyColumnName, op + ' ?');
+      sqlValues.push(/** @type {string} */encode$1(me.__key));
+    }
   }
   if (!me.__count) {
     // 1. Sort by key
@@ -12008,9 +12146,15 @@ IDBCursor.prototype.update = function (valueToUpdate) {
    * @returns {void}
    */
   function addToQueue(clonedValue) {
-    // We set the `invalidateCache` argument to `false` since the old value shouldn't be accessed
+    // `invalidateCache: true` so any cursor on this store (including
+    //   this one) drops its prefetched row batch, forcing its next
+    //   `continue()` to re-query live rather than serve rows snapshotted
+    //   before this update -- needed for the compound-tuple
+    //   continuation logic in `__findBasic` to see this update's
+    //   effect on ordering (see "Modify records during cursor
+    //   iteration" in idbcursor_update_index.any.js).
     // @ts-ignore -- API (not erring in TS 6)
-    IDBObjectStore.__storingRecordObjectStore(request, me.__store, false, clonedValue, false, key);
+    IDBObjectStore.__storingRecordObjectStore(request, me.__store, true, clonedValue, false, key);
   }
   if (me.__store.keyPath !== null) {
     const [evaluatedKey, clonedValue] = me.__store.__validateKeyAndValueAndCloneValue(valueToUpdate, undefined, true);
@@ -13132,11 +13276,9 @@ function runBatch(self, batch) {
     self._running = false;
     runAllSql(self);
   }
-  const currentTask = /** @type {import('./WebSQLDatabase.js').TransactionTask} */
-  self._websqlDatabase._currentTask;
   const {
     readOnly
-  } = currentTask;
+  } = self._task;
   self._websqlDatabase._db.exec(batch, readOnly, function (err, results) {
     /* c8 ignore next */
     if (err || !results) {
@@ -13224,10 +13366,12 @@ function executeSql(self, sql, args, sqlCallback, sqlErrorCallback, executeDelay
 class WebSQLTransaction {
   /**
    * @param {import('./WebSQLDatabase.js').default} websqlDatabase
+   * @param {import('./WebSQLDatabase.js').TransactionTask} task
    * @param {import('../types.js').Delay} [executeDelay]
    */
-  constructor(websqlDatabase, executeDelay) {
+  constructor(websqlDatabase, task, executeDelay) {
     this._websqlDatabase = websqlDatabase;
+    this._task = task;
     /** @type {Error | null} */
     this._error = null;
     this._complete = false;
@@ -13236,11 +13380,14 @@ class WebSQLTransaction {
     this._executeDelay = executeDelay || immediate;
     /** @type {import('tiny-queue').default<SQLTask>} */
     this._sqlQueue = new Queue();
-    const currentTask = /** @type {import('./WebSQLDatabase.js').TransactionTask} */
-    websqlDatabase._currentTask;
-    if (!currentTask.readOnly) {
-      // Since we serialize all access to the database, there is no need to
-      // run read-only tasks in a transaction. This is a perf boost.
+    if (!task.readOnly) {
+      // A read-only task never needs a transaction wrapper for its own
+      // sake (reads don't need atomicity against each other) -- true
+      // whether or not `concurrentReaders` (see `WebSQLDatabase`) lets
+      // multiple read-only tasks actually run at once. This is a perf
+      // boost either way. A non-read-only task always still gets one, and
+      // always still runs with full exclusivity (see
+      // `WebSQLDatabase#runNextTransaction`).
       this._sqlQueue.push(new SQLTask('BEGIN;', [], noop, noop));
     }
   }
@@ -13321,39 +13468,68 @@ class WebSQLDatabase {
     this._db = db;
     /** @type {import('tiny-queue').default<TransactionTask>} */
     this._txnQueue = new Queue();
-    this._running = false;
+    // Off by default: queued transactions -- read or write alike -- run
+    // strictly one at a time, in the order requested, per the WebSQL spec
+    // (see `#runNextTransaction`). When true, any number of read-only
+    // tasks may instead run concurrently; a non-read-only task still
+    // always runs with full exclusivity either way.
+    this._concurrentReaders = Boolean(webSQLOverrides.concurrentReaders);
+    /** @type {Set<TransactionTask>} */
+    this._activeReaders = new Set();
     /** @type {TransactionTask | null} */
-    this._currentTask = null;
+    this._activeWriter = null;
     this._transactionDelay = webSQLOverrides.transactionDelay || immediate;
     this._executeDelay = webSQLOverrides.executeDelay || immediate;
   }
 
   /**
-   *
+   * @param {TransactionTask} task
    */
-  #runTransaction() {
-    const txn = new WebSQLTransaction(this, this._executeDelay);
+  #runTransaction(task) {
+    const txn = new WebSQLTransaction(this, task, this._executeDelay);
     this._transactionDelay(() => {
-      const currentTask = /** @type {TransactionTask} */this._currentTask;
-      currentTask.txnCallback(txn);
+      task.txnCallback(txn);
       txn._checkDone();
     });
   }
 
   /**
-   *
+   * Starts as many queued tasks as the current lock state allows. With
+   * `concurrentReaders` off (the default), a task only starts once
+   * nothing else is active at all -- full mutual exclusion, matching the
+   * WebSQL spec's strict one-at-a-time, in-request-order guarantee (see
+   * this file's own test suite, "callback order 2"). With it on, any
+   * leading run of read-only tasks can all start together instead
+   * (concurrent reads are always fine); a non-read-only task still needs
+   * exclusivity regardless, so nothing past it may start until it
+   * finishes. Not starvation-proof in the `concurrentReaders` case -- a
+   * steady stream of arriving readers could in principle keep a waiting
+   * writer waiting indefinitely -- but that's an acceptable tradeoff over
+   * the added complexity of tracking arrival order across reader/writer
+   * kinds.
    */
   #runNextTransaction() {
-    if (this._running) {
-      return;
-    }
-    const task = this._txnQueue.shift();
-    if (!task) {
-      return;
+    for (;;) {
+      const [nextTask] = this._txnQueue.slice(0, 1);
+      if (!nextTask) {
+        return;
+      }
+      const readerMayShare = this._concurrentReaders && nextTask.readOnly;
+      if (readerMayShare) {
+        if (this._activeWriter) {
+          return;
+        }
+      } else if (this._activeWriter || this._activeReaders.size) {
+        return;
+      }
+      this._txnQueue.shift();
+      if (nextTask.readOnly) {
+        this._activeReaders.add(nextTask);
+      } else {
+        this._activeWriter = nextTask;
+      }
+      this.#runTransaction(nextTask);
     }
-    this._currentTask = task;
-    this._running = true;
-    this.#runTransaction();
   }
 
   /**
@@ -13381,6 +13557,7 @@ class WebSQLDatabase {
    */
   // eslint-disable-next-line unicorn/prefer-private-class-fields -- see above
   _onTransactionComplete(err, transaction) {
+    const task = transaction._task;
     /**
      * @param {Error | boolean | null} [er]
      */
@@ -13395,14 +13572,15 @@ class WebSQLDatabase {
         transaction._complete = true;
       }
       if (er) {
-        if (this._currentTask) {
-          this._currentTask.errorCallback(/** @type {Error} */er);
-        }
-      } else if (this._currentTask) {
-        this._currentTask.successCallback();
+        task.errorCallback(/** @type {Error} */er);
+      } else {
+        task.successCallback();
+      }
+      if (task.readOnly) {
+        this._activeReaders.delete(task);
+      } else if (this._activeWriter === task) {
+        this._activeWriter = null;
       }
-      this._running = false;
-      this._currentTask = null;
       this.#runNextTransaction();
     };
     /**
@@ -13428,13 +13606,13 @@ class WebSQLDatabase {
         }
       });
     };
-    if (this._currentTask && this._currentTask.nonstandardTransCb) {
-      const cont = this._currentTask.nonstandardTransCb.call(this, this._currentTask, err, done, rollback, commit);
+    if (task.nonstandardTransCb) {
+      const cont = task.nonstandardTransCb.call(this, task, err, done, rollback, commit);
       if (!cont) {
         return;
       }
     }
-    if (this._currentTask && this._currentTask.readOnly) {
+    if (task.readOnly) {
       done(err); // read-only doesn't require a transaction
     } else if (err) {
       rollback(err);
@@ -14392,16 +14570,28 @@ const READ_ONLY_ERROR = new Error('could not prepare statement (23 not authorize
 //   connection and a newly-opened one during an upgrade. `PRAGMA
 //   busy_timeout` can't safely arbitrate between them here: it blocks the
 //   single JS thread synchronously while it retries, but the lock holder's
-//   own release is itself scheduled via `setTimeout` below, which can never
-//   fire while that retry loop is blocking the same thread -- so instead of
-//   waiting, the second connection's write just fails with "database is
-//   locked". Serialize writes per file path instead, so a second
-//   connection's `BEGIN` waits for the first connection's transaction to
-//   actually finish rather than colliding with it.
+//   own release is itself scheduled via `setImmediate` below, which can
+//   never fire while that retry loop is blocking the same thread -- so
+//   instead of waiting, a second connection's write just fails with
+//   "database is locked".
+//
+// `fileReaders`/`fileWriter` implement a simple (not starvation-proof --
+//   see the release loop below) reader/writer lock per file path instead:
+//   any number of `readonly` transactions may hold the file concurrently,
+//   matching what SQLite itself already natively supports (multiple
+//   readers never need to exclude each other, only a writer needs
+//   exclusivity), while a non-`readonly` transaction still waits for
+//   exclusive access -- no concurrent readers, no concurrent writer. A
+//   simple single-owner mutex (this file's prior implementation) would
+//   otherwise serialize even purely-concurrent-reader scenarios that
+//   never touch a writer at all, for no reason `better-sqlite3`/SQLite
+//   itself requires.
+/** @type {Map<string, Set<{_db: any, _qFilePath: string}>>} */
+const fileReaders = new Map();
 /** @type {Map<string, {_db: any, _qFilePath: string}>} */
-const fileLockOwners = new Map();
-/** @type {Map<string, (() => void)[]>} */
-const fileLockWaiters = new Map();
+const fileWriter = new Map();
+/** @type {Map<string, {isReader: boolean, resume: () => void}[]>} */
+const fileWaiters = new Map();
 const beginRe = /^\s*BEGIN\b/iu;
 const endRe = /^\s*(END|COMMIT|ROLLBACK)\b/iu;
 
@@ -14513,14 +14703,29 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
   //   already fully independent -- so there is nothing to serialize.
   const filePath = this._qFilePath === ':memory:' ? null : this._qFilePath;
   if (filePath && queries[0] && beginRe.test(queries[0].sql)) {
-    const owner = fileLockOwners.get(filePath);
-    if (owner && owner !== this) {
-      const waiters = fileLockWaiters.get(filePath) || [];
-      waiters.push(() => this.exec(queries, readOnly, callback));
-      fileLockWaiters.set(filePath, waiters);
+    const activeReaders = fileReaders.get(filePath);
+    const hasActiveReaders = Boolean(activeReaders && activeReaders.size);
+    const activeWriter = fileWriter.get(filePath);
+    const blockedByWriter = Boolean(activeWriter && activeWriter !== this);
+    const blocked = blockedByWriter || !readOnly && hasActiveReaders;
+    if (blocked) {
+      const waiters = fileWaiters.get(filePath) || [];
+      waiters.push({
+        isReader: readOnly,
+        resume: () => this.exec(queries, readOnly, callback)
+      });
+      fileWaiters.set(filePath, waiters);
       return;
     }
-    fileLockOwners.set(filePath, this);
+    if (readOnly) {
+      if (activeReaders) {
+        activeReaders.add(this);
+      } else {
+        fileReaders.set(filePath, new Set([this]));
+      }
+    } else {
+      fileWriter.set(filePath, this);
+    }
   }
   const db = this._db._db;
   const len = queries.length;
@@ -14562,13 +14767,15 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
       }
     }
   }
-  // A real timer (not `queueMicrotask`) so this yields to the macrotask
-  //   queue: code that synchronously issues a new request from within
-  //   each request's callback (e.g. to keep a transaction alive) would
+  // A real macrotask (not `queueMicrotask`) so this yields properly:
+  //   code that synchronously issues a new request from within each
+  //   request's callback (e.g. to keep a transaction alive) would
   //   otherwise chain microtask to microtask forever, starving out any
   //   `setTimeout`-based code (including IndexedDB's own internal request
-  //   scheduling) that never gets a turn to run.
-  setTimeout(() => {
+  //   scheduling) that never gets a turn to run. `setImmediate` (Node's
+  //   "check" phase) still yields the same way `setTimeout(..., 0)` did,
+  //   but runs sooner in Node's event loop.
+  setImmediate(() => {
     // Release the file lock (if held) and hand it to the next waiting
     //   connection, if any, only once this transaction has genuinely
     //   finished -- and only here, on its own turn, so a resumed
@@ -14583,15 +14790,52 @@ SQLiteDatabase.prototype.exec = function exec(queries, readOnly, callback) {
     //   and never see the matching release, deadlocking every later
     //   connection to the same file.
     if (filePath && queries.some(q => endRe.test(q.sql))) {
-      fileLockOwners.delete(filePath);
-      const waiters = fileLockWaiters.get(filePath);
-      const nextWaitingExec = waiters && waiters.shift();
-      if (nextWaitingExec) {
-        nextWaitingExec();
+      const activeReaders = fileReaders.get(filePath);
+      if (activeReaders) {
+        activeReaders.delete(this);
+        if (!activeReaders.size) {
+          fileReaders.delete(filePath);
+        }
+      }
+      if (fileWriter.get(filePath) === this) {
+        fileWriter.delete(filePath);
+      }
+      // Resume as many waiters as the lock now genuinely allows:
+      //   any leading run of readers (concurrent reads are always
+      //   fine), then at most one writer, since a writer needs
+      //   exclusivity -- stop there rather than looking past it.
+      //   Not starvation-proof: a steady stream of arriving readers
+      //   could in principle keep a waiting writer waiting
+      //   indefinitely, but that's an acceptable tradeoff here over
+      //   the added complexity of tracking arrival order across
+      //   reader/writer kinds.
+      const waiters = fileWaiters.get(filePath);
+      if (waiters) {
+        while (waiters.length) {
+          if (fileWriter.has(filePath)) {
+            break;
+          }
+          const next = waiters[0];
+          const stillHasReaders = fileReaders.get(filePath);
+          if (!next.isReader && stillHasReaders && stillHasReaders.size) {
+            break;
+          }
+          waiters.shift();
+          next.resume();
+          if (!next.isReader) {
+            // A writer just took exclusive ownership (inside
+            //   `resume()`, synchronously, via the acquire
+            //   logic above) -- nothing else may proceed now.
+            break;
+          }
+        }
+        if (!waiters.length) {
+          fileWaiters.delete(filePath);
+        }
       }
     }
     callback(null, results);
-  }, 0);
+  });
 };
 
 /**
@@ -14631,7 +14875,19 @@ function wrappedSQLiteDatabase(name) {
   }
   return db;
 }
-const nodeWebSQL = customOpenDatabase(/** @type {SQLiteDatabaseConstructor} */ /** @type {unknown} */wrappedSQLiteDatabase, {});
+
+// `concurrentReaders` is off by default in `websql-configurable` itself (to
+//   preserve the WebSQL spec's strict, one-at-a-time transaction ordering
+//   that library's own test suite depends on), but IndexedDBShim only ever
+//   uses it as an internal SQL execution engine -- it doesn't need or expose
+//   that ordering guarantee itself -- so it's safe, and needed, to opt in
+//   here: without it, two same-scope `readonly` IDBTransactions can deadlock
+//   waiting on each other (see `transaction-scheduling-within-database.any.js`).
+const nodeWebSQL = customOpenDatabase(/** @type {SQLiteDatabaseConstructor} */ /** @type {unknown} */wrappedSQLiteDatabase, {
+  websql: {
+    concurrentReaders: true
+  }
+});
 
 CFG.win = {
   openDatabase: nodeWebSQL