@mdbase-dev/connect 0.1.0-beta.55 → 0.1.0-beta.57

package/dist/browser/mdbase-connect.min.js.sha384

@@ -1 +1 @@
-sha384-6M+exMhOm+JESB8xqgBNPFnykP6bx043yY1RbfIP4UidAlareN3dFvCVZDSd1/aj
+sha384-4Lyda0FLrTi1k549p7spkiOUvz9jT9v7sm+BUgVC4uwPVgyZgY8o6aJlDd+H45xY

package/dist/connect.d.ts

@@ -53,8 +53,6 @@ export declare class MdbaseConnectInternals<Frontmatter extends JsonObject> {
     removeToken(collectionId: string, keyHandle?: string, reason?: MdbaseUnavailableReason, discardPending?: boolean): void;
     tokenKey(collectionId: string): string;
     pendingMutationKey(collectionId: string): string;
-    private removePendingMutations;
-    private pendingMutationsUseKey;
     notificationKey(collectionId: string, transport?: "web_push" | "fcm"): string;
     directPreferenceKey(): string;
     defaultApplicationOrigin(): string;

package/dist/connect.js

@@ -8,6 +8,7 @@ import { IndexedDbGrantKeyStore, MemoryGrantKeyStore } from "./crypto.js";
 import { connectError, serverConnectError } from "./errors.js";
 import { DEFAULT_OPERATIONS } from "./internal-types.js";
 import { uniqueOperations } from "./operation-helpers.js";
+import { pendingMutationsUseKey, pendingRecoveryTransports, removePendingMutations } from "./pending-recovery-transports.js";
 import { resolveConnectTimeouts, withRequestBudget } from "./request-budget.js";
 import { MemoryStorage, apiError, applicationStorageOrigin, canonicalLoopbackUrl, collectionIdFromTokenKey, connectFetch, createPkce, defaultManifestSource, defaultRedirectUri, defaultStorage, decodeJsonResponse, isOpaquePortableManifest, manifestStorageFingerprint, oauthErrorCode, parseDeviceAuthorization, parseStored, stripTrailingSlash, validAuthorityTokenResponse } from "./runtime-utils.js";
 import { storedTokenFromResponse } from "./token-response.js";
@@ -211,7 +212,7 @@ export class MdbaseConnectInternals {
             redirect_uri: this.redirectUri,
             state,
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files),
+            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, targetCollectionId)),
             requested_operations: operations,
             ...(application.requirements?.files
                 ? { requested_files: application.requirements.files }
@@ -312,7 +313,7 @@ export class MdbaseConnectInternals {
             issued_at: issuedAt.toISOString(),
             expires_at: new Date(issuedAt.getTime() + 10 * 60 * 1_000).toISOString(),
             code_challenge: challenge,
-            contracts: authorizationContractRequirements(operations, application.requirements?.files),
+            contracts: authorizationContractRequirements(operations, application.requirements?.files, pendingRecoveryTransports(this.storage, this.storagePrefix(), operations, options.target?.kind === "collection" ? options.target.collectionId : undefined)),
             requested_operations: operations,
             ...(application.requirements?.files
                 ? { requested_files: application.requirements.files }
@@ -631,12 +632,14 @@ export class MdbaseConnectInternals {
     }
     removeToken(collectionId, keyHandle, reason = "authorization_lost", discardPending = false) {
         this.invalidatedConnections.set(collectionId, reason);
-        if (keyHandle && (discardPending || !this.pendingMutationsUseKey(collectionId, keyHandle))) {
+        if (keyHandle && (discardPending || !pendingMutationsUseKey(this.storage, this.pendingMutationKey(collectionId), keyHandle))) {
             void this.keyStore.delete(keyHandle).catch(() => undefined);
         }
         this.storage.removeItem(this.tokenKey(collectionId));
         if (discardPending)
-            this.removePendingMutations(collectionId);
+            removePendingMutations(this.storage, this.pendingMutationKey(collectionId), (pendingKeyHandle) => {
+                void this.keyStore.delete(pendingKeyHandle).catch(() => undefined);
+            });
         for (const transport of ["web_push", "fcm"]) {
             this.storage.removeItem(this.notificationKey(collectionId, transport));
         }
@@ -653,33 +656,6 @@ export class MdbaseConnectInternals {
     pendingMutationKey(collectionId) {
         return `${this.storagePrefix()}:pending-mutation:${collectionId}`;
     }
-    removePendingMutations(collectionId) {
-        const baseKey = this.pendingMutationKey(collectionId);
-        const keys = [baseKey];
-        for (let index = 0; index < this.storage.length; index += 1) {
-            const key = this.storage.key(index);
-            if (key?.startsWith(`${baseKey}:`))
-                keys.push(key);
-        }
-        for (const key of keys) {
-            const pending = parseStored(this.storage.getItem(key));
-            if (pending?.keyHandle)
-                void this.keyStore.delete(pending.keyHandle).catch(() => undefined);
-            this.storage.removeItem(key);
-        }
-    }
-    pendingMutationsUseKey(collectionId, keyHandle) {
-        const baseKey = this.pendingMutationKey(collectionId);
-        for (let index = 0; index < this.storage.length; index += 1) {
-            const key = this.storage.key(index);
-            if (key !== baseKey && !key?.startsWith(`${baseKey}:`))
-                continue;
-            const pending = parseStored(this.storage.getItem(key));
-            if (pending?.keyHandle === keyHandle)
-                return true;
-        }
-        return false;
-    }
     notificationKey(collectionId, transport = "web_push") {
         return `${this.storagePrefix()}:notifications:${collectionId}:${transport}`;
     }

package/dist/connection-transport-internals.d.ts

@@ -0,0 +1,22 @@
+import type { GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+import type { ResolvedConnectTimeouts } from "./request-budget.js";
+export interface ConnectionTransportInternals {
+    readonly relayEncryption: "required" | "disabled";
+    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
+    storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
+    tokenKey(collectionId: string): string;
+    pendingMutationKey(collectionId: string): string;
+    directPreferenceKey(): string;
+}
+export interface ConnectionTransportOptions {
+    serverUrl: string;
+    storage: Storage;
+    keyStore: GrantKeyStore;
+    directAccessMode: "auto" | "disabled";
+    loopbackUrl: string;
+    collectionId: string;
+    internals: ConnectionTransportInternals;
+    onChange(): void;
+    timeouts: ResolvedConnectTimeouts;
+}

package/dist/connection-transport-internals.js

@@ -0,0 +1 @@
+export {};

package/dist/connection-transport.d.ts

@@ -1,29 +1,10 @@
 import type { CollectionOperation } from "@mdbase-dev/connect-protocol";
-import { type GrantKeyStore } from "./crypto.js";
 import type { StoredToken } from "./internal-types.js";
 import type { DirectAccessStatus, MdbaseConnectionRoute } from "./connection-types.js";
 import type { ConnectRequestOptions, PendingMutationSummary } from "./operation-types.js";
 import { ConnectionFileTransport } from "./connection-file-transport.js";
-import { type ResolvedConnectTimeouts } from "./request-budget.js";
-export interface ConnectionTransportInternals {
-    readonly relayEncryption: "required" | "disabled";
-    removeToken(collectionId: string, keyHandle?: string, reason?: "not_authorized" | "authorization_lost" | "invalid_stored_grant", discardPending?: boolean): void;
-    storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
-    tokenKey(collectionId: string): string;
-    pendingMutationKey(collectionId: string): string;
-    directPreferenceKey(): string;
-}
-export interface ConnectionTransportOptions {
-    serverUrl: string;
-    storage: Storage;
-    keyStore: GrantKeyStore;
-    directAccessMode: "auto" | "disabled";
-    loopbackUrl: string;
-    collectionId: string;
-    internals: ConnectionTransportInternals;
-    onChange(): void;
-    timeouts: ResolvedConnectTimeouts;
-}
+import type { ConnectionTransportOptions } from "./connection-transport-internals.js";
+export type { ConnectionTransportInternals, ConnectionTransportOptions } from "./connection-transport-internals.js";
 export declare class ConnectionTransport {
     private readonly serverUrl;
     private readonly storage;
@@ -62,7 +43,6 @@ export declare class ConnectionTransport {
     performOperation<Result>(operation: CollectionOperation, input: unknown, options?: ConnectRequestOptions): Promise<Result>;
     private performOperationWithinBudget;
     performAuthoritySyncRequest<Result>(collectionId: string, replicaId: string, method: "GET" | "POST", path: string, input?: unknown, options?: ConnectRequestOptions): Promise<Result>;
-    private sendAuthoritySyncRequest;
     private sendOperation;
     private directCapable;
     hasResumableMutationTransport(): boolean;

package/dist/connection-transport.js

@@ -8,6 +8,8 @@ import { directFallbackStatus, isMutation, localNetworkPermission, loopbackReque
 import { apiError, decodeJsonResponse, oauthErrorCode, parseStored, } from "./runtime-utils.js";
 import { readStoredToken } from "./stored-token.js";
 import { withCooperativeRequestBudget, withRequestBudget } from "./request-budget.js";
+import { sendAuthoritySyncRequest } from "./authority-sync-request.js";
+import { freshEncryptedRequest } from "./fresh-encrypted-request.js";
 export class ConnectionTransport {
     serverUrl;
     storage;
@@ -134,7 +136,7 @@ export class ConnectionTransport {
             signal: budget.signal
         }));
     }
-    async performOperationWithinBudget(operation, input, options, storedPending) {
+    async performOperationWithinBudget(operation, input, options, storedPending, freshReadRetried = false) {
         throwIfCancelled(options.signal);
         let token = this.currentToken();
         if (!token)
@@ -199,6 +201,11 @@ export class ConnectionTransport {
         }
         if (!response.ok) {
             const error = apiError(body, "operation_failed", "Collection operation failed.", response.status);
+            if (error.code === "fresh_request_required"
+                && !attempt.pendingMutation
+                && !freshReadRetried) {
+                return this.performOperationWithinBudget(operation, input, options, undefined, true);
+            }
             if (attempt.pendingMutation
                 && (attempt.directDeliveryUncertain
                     || (attempt.encryptedRequest && attempt.resumingMutation))) {
@@ -230,6 +237,12 @@ export class ConnectionTransport {
                     applicationId: responseApplicationId,
                     encryption: responseEncryption
                 }, attempt.encryptedRequest, encryptedResponse);
+                if (!decrypted.ok
+                    && decrypted.problem.code === "fresh_request_required"
+                    && !attempt.pendingMutation
+                    && !freshReadRetried) {
+                    return this.performOperationWithinBudget(operation, input, options, undefined, true);
+                }
                 if (attempt.pendingMutation)
                     this.clearPendingMutation(attempt.requestId);
                 if (!decrypted.ok)
@@ -253,7 +266,9 @@ export class ConnectionTransport {
                 throw error;
             }
         }
-        if (body?.protocol_version !== OPERATION_TRANSPORT_PROTOCOL_VERSION
+        const expectedProtocol = attempt.pendingMutationRecord?.request?.protocol_version
+            ?? OPERATION_TRANSPORT_PROTOCOL_VERSION;
+        if (body?.protocol_version !== expectedProtocol
             || body?.request_id !== attempt.requestId) {
             if (attempt.pendingMutation)
                 throw unknownMutationOutcome(attempt.requestId, new Error("Operation response protocol or request ID did not match."));
@@ -287,7 +302,7 @@ export class ConnectionTransport {
                 throw connectError("authority_authorization_changed", "Reconnect this collection authority before synchronizing.");
             }
             try {
-                let response = await this.sendAuthoritySyncRequest(token, method, path, input, budget.signal);
+                let response = await sendAuthoritySyncRequest(this.keyStore, token, method, path, input, budget.signal);
                 if (response.status === 401 && token.refreshToken) {
                     token = await this.refreshAuthorization(budget.signal);
                     if (!token.authority
@@ -295,7 +310,7 @@ export class ConnectionTransport {
                         || token.authority.replicaId !== replicaId) {
                         throw connectError("authority_authorization_changed", "Reconnect this collection authority before synchronizing.");
                     }
-                    response = await this.sendAuthoritySyncRequest(token, method, path, input, budget.signal);
+                    response = await sendAuthoritySyncRequest(this.keyStore, token, method, path, input, budget.signal);
                 }
                 const body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned an invalid synchronization response.");
                 if (!response.ok) {
@@ -313,24 +328,6 @@ export class ConnectionTransport {
             }
         });
     }
-    async sendAuthoritySyncRequest(token, method, path, input, signal) {
-        if (!token.authority) {
-            throw connectError("not_remote_authority", "This authorization has no remote authority endpoint.");
-        }
-        const url = `${token.authority.syncUrl}/${path}`;
-        const body = input === undefined ? undefined : JSON.stringify(input);
-        const proof = await authorityProofHeaders(this.keyStore, token, method, url, body, token.authority.accessToken);
-        return fetch(url, {
-            method,
-            headers: {
-                authorization: `Bearer ${token.authority.accessToken}`,
-                ...(input === undefined ? {} : { "content-type": "application/json" }),
-                ...proof
-            },
-            ...(body === undefined ? {} : { body }),
-            signal
-        });
-    }
     async sendOperation(token, operation, input, tryDirect, options = {}, pendingRequestId) {
         let body = input ?? {};
         let encryptedRequest;
@@ -400,6 +397,7 @@ export class ConnectionTransport {
                     throw serverConnectError(error.code, error.message);
                 throw error;
             }
+            requestId = encryptedRequest.request_id;
             body = encryptedRequest;
         }
         else {
@@ -469,6 +467,10 @@ export class ConnectionTransport {
                 throw error;
             }
             let response;
+            if (!pendingMutation) {
+                encryptedRequest = await freshEncryptedRequest(this.keyStore, relayToken, operation, input);
+                requestId = encryptedRequest.request_id;
+            }
             try {
                 response = await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(relayToken.collectionId)}/operations/${operation}`, {
                     method: "POST",

package/dist/crypto.js

@@ -161,8 +161,14 @@ export async function encryptRelayRequest(store, handle, binding, operation, inp
     validateGrantEncryption(binding.encryption);
     const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
     const counter = await store.nextCounter(handle);
-    const metadata = { binding, requestId, operation, counter };
-    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "request");
+    const metadata = {
+        binding,
+        protocolVersion: OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        requestId,
+        operation,
+        counter
+    };
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, metadata.protocolVersion, "request");
     const plaintext = new TextEncoder().encode(JSON.stringify(input ?? {}));
     const ciphertext = await crypto.subtle.encrypt({
         name: "AES-GCM",
@@ -183,11 +189,12 @@ export async function decryptRelayResponse(store, handle, binding, request, resp
     const record = await requireAgreementKey(store, handle, binding.encryption.application_agreement_public_key);
     const metadata = {
         binding,
+        protocolVersion: request.protocol_version,
         requestId: request.request_id,
         operation: request.operation,
         counter: request.counter
     };
-    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, "response");
+    const key = await deriveDirectionalKey(record.agreementPrivateKey, binding, request.protocol_version, "response");
     try {
         const plaintext = await crypto.subtle.decrypt({
             name: "AES-GCM",
@@ -246,10 +253,10 @@ async function requireSigningKey(store, handle, expectedPublicKey) {
     }
     return record;
 }
-async function deriveDirectionalKey(privateKey, binding, direction) {
+async function deriveDirectionalKey(privateKey, binding, protocolVersion, direction) {
     const shared = await deriveP256SharedSecret(privateKey, binding.encryption.connector_agreement_public_key);
     const material = await crypto.subtle.importKey("raw", shared, "HKDF", false, ["deriveKey"]);
-    const contextBytes = new TextEncoder().encode(context(binding));
+    const contextBytes = new TextEncoder().encode(context(binding, protocolVersion));
     const salt = await crypto.subtle.digest("SHA-256", contextBytes);
     return crypto.subtle.deriveKey({
         name: "HKDF",
@@ -268,11 +275,11 @@ export async function deriveP256SharedSecret(privateKey, peerPublicKey) {
         throw new RelayCryptoError("invalid_public_key", "The connector relay public key is invalid.");
     }
 }
-function context(binding) {
+function context(binding, protocolVersion) {
     const value = binding.encryption;
     return [
         "mdbase-connect",
-        OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        protocolVersion,
         value.suite,
         binding.grantId,
         binding.applicationId,
@@ -283,12 +290,18 @@ function context(binding) {
     ].join("|");
 }
 function aad(metadata, direction) {
-    return [context(metadata.binding), metadata.requestId, direction, metadata.operation, metadata.counter].join("|");
+    return [
+        context(metadata.binding, metadata.protocolVersion),
+        metadata.requestId,
+        direction,
+        metadata.operation,
+        metadata.counter
+    ].join("|");
 }
 function envelopeMetadata(metadata) {
     const encryption = metadata.binding.encryption;
     return {
-        protocol_version: OPERATION_TRANSPORT_PROTOCOL_VERSION,
+        protocol_version: metadata.protocolVersion,
         suite: RELAY_ENCRYPTION_SUITE,
         request_id: metadata.requestId,
         grant_id: metadata.binding.grantId,

package/dist/fresh-encrypted-request.d.ts

@@ -0,0 +1,4 @@
+import type { CollectionOperation, EncryptedRelayOperationRequest } from "@mdbase-dev/connect-protocol";
+import { type GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+export declare function freshEncryptedRequest(keyStore: GrantKeyStore, token: StoredToken, operation: CollectionOperation, input: unknown): Promise<EncryptedRelayOperationRequest>;

package/dist/fresh-encrypted-request.js

@@ -0,0 +1,28 @@
+import { encryptRelayRequest, RelayCryptoError } from "./crypto.js";
+import { connectError, serverConnectError } from "./errors.js";
+export async function freshEncryptedRequest(keyStore, token, operation, input) {
+    if (!token.encryption || !token.grantId || !token.keyHandle) {
+        throw connectError("authorization_binding_incompatible", "The refreshed authorization no longer supports encrypted connector operations.", {
+            details: {
+                contract: "grant_encryption",
+                required: [1],
+                supported: token.encryption ? [token.encryption.protocol_version] : [],
+                peer: "connector",
+                operation
+            }
+        });
+    }
+    try {
+        return await encryptRelayRequest(keyStore, token.keyHandle, {
+            grantId: token.grantId,
+            applicationId: token.clientId,
+            encryption: token.encryption
+        }, operation, input);
+    }
+    catch (error) {
+        if (error instanceof RelayCryptoError) {
+            throw serverConnectError(error.code, error.message);
+        }
+        throw error;
+    }
+}

package/dist/local-file-transport.d.ts

@@ -17,6 +17,7 @@ export declare class LocalFileTransport {
     private readonly options;
     constructor(options: LocalFileTransportOptions);
     control<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal?: AbortSignal): Promise<Result>;
+    private controlAttempt;
     private decryptControlResponse;
     uploadChunk(session: FileTransferSession, chunkIndex: number, bytes: Uint8Array, signal?: AbortSignal): Promise<void>;
     downloadChunk(session: FileTransferSession, chunkIndex: number, signal?: AbortSignal): Promise<Uint8Array>;

package/dist/local-file-transport.js

@@ -11,11 +11,15 @@ export class LocalFileTransport {
         this.options = options;
     }
     async control(token, method, path, input, signal) {
+        return this.controlAttempt(token, method, path, input, signal, false);
+    }
+    async controlAttempt(token, method, path, input, signal, freshReadRetried) {
         requireEncryption(token);
         const controlInput = localFileControlInput(method, path, input);
         let encryptedRequest = await this.encryptControl(token, controlInput);
         let response;
-        if (await this.options.shouldAttemptDirect(token)) {
+        const triedDirect = await this.options.shouldAttemptDirect(token);
+        if (triedDirect) {
             try {
                 response = await fetch(`${this.options.loopbackUrl}/v1/files/control`, loopbackRequest({
                     method: "POST",
@@ -32,11 +36,18 @@ export class LocalFileTransport {
             if (response && !directFallbackStatus(response.status)) {
                 if (response.ok)
                     this.options.onDirectAvailable();
-                return this.decryptControlResponse(token, encryptedRequest, response);
+                return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried);
             }
             if (response)
                 this.options.onDirectUnavailable();
         }
+        if (triedDirect && method === "GET") {
+            token = token.expiresAt > Date.now() + 30_000
+                ? token
+                : await this.options.refreshAuthorization(signal);
+            requireLocalFileToken(token);
+            encryptedRequest = await this.encryptControl(token, controlInput);
+        }
         response = await this.sendRelayControl(token, encryptedRequest, signal);
         if (await refreshableBindingFailure(response, token)) {
             token = await this.options.refreshAuthorization(signal);
@@ -46,18 +57,30 @@ export class LocalFileTransport {
         }
         if (response.ok)
             this.options.onRelayAvailable();
-        return this.decryptControlResponse(token, encryptedRequest, response);
+        return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried);
     }
-    async decryptControlResponse(token, encryptedRequest, response) {
+    async decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried) {
         const body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned an invalid file control response.");
         if (!response.ok) {
-            throw apiError(body, "operation_failed", "Collection file request failed.", response.status);
+            const error = apiError(body, "operation_failed", "Collection file request failed.", response.status);
+            if (error.code === "fresh_request_required"
+                && method === "GET"
+                && !freshReadRetried) {
+                return this.controlAttempt(token, method, path, input, signal, true);
+            }
+            throw error;
         }
         const encryptedResponse = body?.envelope;
         if (!encryptedResponse) {
             throw connectError("invalid_encrypted_response", "The connector omitted its encrypted file response.");
         }
         const decrypted = await decryptRelayResponse(this.options.keyStore, token.keyHandle, relayBinding(token), encryptedRequest, encryptedResponse);
+        if (!decrypted.ok
+            && decrypted.problem.code === "fresh_request_required"
+            && method === "GET"
+            && !freshReadRetried) {
+            return this.controlAttempt(token, method, path, input, signal, true);
+        }
         if (!decrypted.ok)
             throwEncryptedProblem(decrypted.problem);
         return decrypted.result;

package/dist/pending-recovery-transports.d.ts

@@ -0,0 +1,4 @@
+import type { CollectionOperation, OperationTransportProtocolVersion } from "@mdbase-dev/connect-protocol";
+export declare function pendingRecoveryTransports(storage: Storage, storagePrefix: string, operations: readonly CollectionOperation[], collectionId?: string): OperationTransportProtocolVersion[];
+export declare function pendingMutationsUseKey(storage: Storage, baseKey: string, keyHandle: string): boolean;
+export declare function removePendingMutations(storage: Storage, baseKey: string, removeKey: (keyHandle: string) => void): void;

package/dist/pending-recovery-transports.js

@@ -0,0 +1,48 @@
+import { isSupportedOperationTransport, OPERATION_TRANSPORT_PROTOCOL_VERSION } from "@mdbase-dev/connect-protocol";
+import { parseStored } from "./runtime-utils.js";
+export function pendingRecoveryTransports(storage, storagePrefix, operations, collectionId) {
+    const prefix = `${storagePrefix}:pending-mutation:`;
+    const versions = new Set();
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (!key?.startsWith(prefix))
+            continue;
+        const pending = parseStored(storage.getItem(key));
+        if (!pending
+            || !operations.includes(pending.operation)
+            || (collectionId && pending.collectionId !== collectionId))
+            continue;
+        const version = pending.envelope?.protocol_version ?? pending.request?.protocol_version;
+        if (version !== undefined
+            && version !== OPERATION_TRANSPORT_PROTOCOL_VERSION
+            && isSupportedOperationTransport(version)) {
+            versions.add(version);
+        }
+    }
+    return [...versions].sort((left, right) => right - left);
+}
+export function pendingMutationsUseKey(storage, baseKey, keyHandle) {
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (key !== baseKey && !key?.startsWith(`${baseKey}:`))
+            continue;
+        const pending = parseStored(storage.getItem(key));
+        if (pending?.keyHandle === keyHandle)
+            return true;
+    }
+    return false;
+}
+export function removePendingMutations(storage, baseKey, removeKey) {
+    const keys = [baseKey];
+    for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index);
+        if (key?.startsWith(`${baseKey}:`))
+            keys.push(key);
+    }
+    for (const key of keys) {
+        const pending = parseStored(storage.getItem(key));
+        if (pending?.keyHandle)
+            removeKey(pending.keyHandle);
+        storage.removeItem(key);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mdbase-dev/connect",
-  "version": "0.1.0-beta.55",
+  "version": "0.1.0-beta.57",
   "private": false,
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mdbase-dev/connect-protocol": "0.1.0-beta.55"
+    "@mdbase-dev/connect-protocol": "0.1.0-beta.57"
   },
   "devDependencies": {
     "esbuild": "^0.28.1",