v1.4.3

Contains a correctness fix worth taking. Full notes: CHANGELOG.md [1.4.3].

Fixed — concurrency

Under contention, withFileLock and withFileLockSync could admit two processes to the critical section at once and lose a write.

The reclaim path treated "no holder could be read" as "this lock is stale" and unlinked whatever lockfile sat at the path. But a null holder usually means the file is simply gone — the previous holder released it between the failed acquire and the read — so the unlink deleted the lockfile of whichever process had acquired it in the meantime.

A missing lockfile is now treated as contention and retried, never reclaimed. Only an existing-but-unparseable lockfile is reclaimed, and every reclaim re-checks that the lockfile still matches the holder it judged.

This matters beyond tests: the lock guards the daily cost ledger, the result cache and the history database, so a lost update meant under-counted spend or a dropped run. Anyone on 1.4.2 or earlier is affected.

Changed — a third smaller package

	1.4.2	1.4.3
tarball	817 KB	551 KB
files	421	302
unpacked	4.6 MB	2.6 MB

• Source maps are no longer published. All 119 pointed at ../../src/*.ts, which the package has never shipped, and sourcesContent was empty — every one was unresolvable for consumers. They are still built locally for development.
• The emitted JavaScript no longer carries implementation comments. The build runs two passes so .d.ts documentation is untouched — verified byte-identical, because a single removeComments: true would have stripped JSDoc from the declarations and removed IDE hover docs for all 67 public exports.

CI

darwin-x64 coverage is back. The matrix had dropped Intel macOS after those jobs sat queued indefinitely; the cause turned out to be GitHub retiring the macos-13 image on 2025-12-04, and macos-15-intel is the supported replacement. This matters because better-sqlite3 and sharp ship distinct prebuilt binaries per architecture.

Published to npm with SLSA provenance. CycloneDX SBOM attached below.