@mdbase-dev/connect 0.1.0-beta.83 → 0.1.0-beta.85

package/dist/grant-key-leases.js

@@ -0,0 +1,144 @@
+export class GrantKeyLeaseRegistry {
+    namespace;
+    onFinalRelease;
+    leases = new Map();
+    locks = webLockManager();
+    retainAutomaticallyRetiredKeys = this.locks === null;
+    constructor(namespace, onFinalRelease) {
+        this.namespace = namespace;
+        this.onFinalRelease = onFinalRelease;
+    }
+    async acquire(collectionId, keyHandle, signal) {
+        const releaseLocal = this.acquireLocal(collectionId, keyHandle);
+        if (!this.locks)
+            return releaseLocal;
+        try {
+            const releaseWeb = await acquireSharedWebLock(this.locks, this.lockName(collectionId, keyHandle), signal);
+            return once(() => {
+                releaseWeb();
+                releaseLocal();
+            });
+        }
+        catch (error) {
+            releaseLocal();
+            throw error;
+        }
+    }
+    deleteExclusive(collectionId, keyHandle, action) {
+        if (this.retainAutomaticallyRetiredKeys)
+            return;
+        if (this.locks) {
+            void this.locks.request(this.lockName(collectionId, keyHandle), { mode: "exclusive" }, action).catch(() => undefined);
+        }
+        else if (!this.has(collectionId, keyHandle)) {
+            void Promise.resolve().then(action).catch(() => undefined);
+        }
+    }
+    has(collectionId, keyHandle) {
+        return this.leases.get(collectionId)?.has(keyHandle) ?? false;
+    }
+    handles(collectionId) {
+        return this.leases.get(collectionId)?.keys() ?? [];
+    }
+    acquireLocal(collectionId, keyHandle) {
+        const collection = this.leases.get(collectionId) ?? new Map();
+        collection.set(keyHandle, (collection.get(keyHandle) ?? 0) + 1);
+        this.leases.set(collectionId, collection);
+        return once(() => {
+            const remaining = (collection.get(keyHandle) ?? 1) - 1;
+            if (remaining > 0)
+                collection.set(keyHandle, remaining);
+            else {
+                collection.delete(keyHandle);
+                if (collection.size === 0)
+                    this.leases.delete(collectionId);
+                this.onFinalRelease(collectionId, keyHandle);
+            }
+        });
+    }
+    lockName(collectionId, keyHandle) {
+        return `mdbase-connect:grant-key:${this.namespace}:${collectionId}:${keyHandle}`;
+    }
+}
+export class GrantKeyLeaseSet {
+    collectionId;
+    acquire;
+    releases = new Map();
+    constructor(collectionId, acquire) {
+        this.collectionId = collectionId;
+        this.acquire = acquire;
+    }
+    async retain(tokenOrHandle, signal) {
+        const handle = typeof tokenOrHandle === "string" ? tokenOrHandle : tokenOrHandle?.keyHandle;
+        if (!handle)
+            return;
+        let lease = this.releases.get(handle);
+        if (!lease) {
+            lease = this.acquire(this.collectionId, handle, signal);
+            this.releases.set(handle, lease);
+        }
+        try {
+            await lease;
+        }
+        catch (error) {
+            if (this.releases.get(handle) === lease)
+                this.releases.delete(handle);
+            this.release();
+            throw error;
+        }
+    }
+    release() {
+        for (const lease of this.releases.values())
+            void lease.then((release) => release());
+        this.releases.clear();
+    }
+}
+export async function retainCurrentGrantToken(readCurrent, leases, signal) {
+    while (true) {
+        const snapshot = readCurrent();
+        if (!snapshot)
+            return null;
+        await leases.retain(snapshot, signal);
+        const current = readCurrent();
+        if (!current)
+            return null;
+        if (current.keyHandle === snapshot.keyHandle)
+            return current;
+    }
+}
+function webLockManager() {
+    const locks = typeof navigator === "undefined"
+        ? undefined
+        : navigator.locks;
+    if (locks)
+        return locks;
+    const browser = typeof window !== "undefined"
+        || typeof globalThis.importScripts === "function";
+    return browser ? null : undefined;
+}
+async function acquireSharedWebLock(locks, name, signal) {
+    let acquired;
+    let rejectAcquisition;
+    let release;
+    const ready = new Promise((resolve, reject) => {
+        acquired = resolve;
+        rejectAcquisition = reject;
+    });
+    const held = new Promise((resolve) => { release = resolve; });
+    const request = locks.request(name, { mode: "shared", ...(signal ? { signal } : {}) }, async () => {
+        acquired();
+        await held;
+    });
+    void request.catch(rejectAcquisition);
+    await ready;
+    return once(release);
+}
+function once(action) {
+    let called = false;
+    return () => {
+        if (called)
+            return;
+        called = true;
+        action();
+    };
+}

package/dist/hosted-file-request.d.ts

@@ -1,6 +1,6 @@
 import type { StoredToken } from "./internal-types.js";
 type ProofHeaders = (token: StoredToken, method: "GET" | "POST" | "DELETE", url: string, body: string | undefined, credential: string) => Promise<Record<string, string>>;
 export declare function sendHostedFileRequest(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal: AbortSignal | undefined, proofHeaders: ProofHeaders): Promise<Response>;
-export declare function performHostedFileRequest<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal: AbortSignal | undefined, refresh: () => Promise<StoredToken>, proofHeaders: ProofHeaders): Promise<Result>;
-export declare function performHostedFilePartRequest(token: StoredToken, path: string, expectedLength: number, signal: AbortSignal | undefined, refresh: () => Promise<StoredToken>, proofHeaders: ProofHeaders): Promise<ReadableStream<Uint8Array>>;
+export declare function performHostedFileRequest<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal: AbortSignal | undefined, refresh: (signal?: AbortSignal) => Promise<StoredToken>, proofHeaders: ProofHeaders, retain?: (token: StoredToken) => Promise<StoredToken>): Promise<Result>;
+export declare function performHostedFilePartRequest(token: StoredToken, path: string, expectedLength: number, signal: AbortSignal | undefined, refresh: (signal?: AbortSignal) => Promise<StoredToken>, proofHeaders: ProofHeaders, retain?: (token: StoredToken) => Promise<StoredToken>): Promise<ReadableStream<Uint8Array>>;
 export {};

package/dist/hosted-file-request.js

@@ -20,11 +20,11 @@ export async function sendHostedFileRequest(token, method, path, input, signal,
         ...(signal ? { signal } : {})
     });
 }
-export async function performHostedFileRequest(token, method, path, input, signal, refresh, proofHeaders) {
+export async function performHostedFileRequest(token, method, path, input, signal, refresh, proofHeaders, retain = async (token) => token) {
     let active = token;
     let response = await sendHostedFileRequest(active, method, path, input, signal, proofHeaders);
     if (response.status === 401 && active.refreshToken) {
-        active = await refresh();
+        active = await retain(await refresh(signal));
         if (!active.authority || !active.fileCapability) {
             throw connectError("authority_authorization_changed", "Reconnect this collection before accessing its files.");
         }
@@ -36,11 +36,11 @@ export async function performHostedFileRequest(token, method, path, input, signa
     }
     return body;
 }
-export async function performHostedFilePartRequest(token, path, expectedLength, signal, refresh, proofHeaders) {
+export async function performHostedFilePartRequest(token, path, expectedLength, signal, refresh, proofHeaders, retain = async (token) => token) {
     let active = token;
     let response = await sendHostedFileRequest(active, "GET", path, undefined, signal, proofHeaders);
     if (response.status === 401 && active.refreshToken) {
-        active = await refresh();
+        active = await retain(await refresh(signal));
         if (!active.authority || !active.fileCapability) {
             throw connectError("authority_authorization_changed", "Reconnect this collection before accessing its files.");
         }

package/dist/hosted-operation-response.d.ts

@@ -0,0 +1,5 @@
+import { type MdbaseConnectError } from "./errors.js";
+export declare function decodeHostedOperationResponse(response: Response, hosted: boolean): Promise<{
+    body: any;
+    httpError?: MdbaseConnectError;
+}>;

package/dist/hosted-operation-response.js

@@ -0,0 +1,26 @@
+import { connectError, serverConnectError } from "./errors.js";
+import { decodeJsonResponse } from "./runtime-utils.js";
+export async function decodeHostedOperationResponse(response, hosted) {
+    try {
+        return {
+            body: await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned a response that is not valid JSON.")
+        };
+    }
+    catch (cause) {
+        if (!response.ok && hosted && isDefinitiveHostedHttpRejection(response.status)) {
+            return {
+                body: undefined,
+                httpError: serverConnectError("operation_failed", "Collection operation failed.", {
+                    status: response.status,
+                    operationOutcome: "rejected"
+                })
+            };
+        }
+        throw connectError("invalid_operation_response", "The collection authority returned a response that is not valid JSON.", { cause });
+    }
+}
+function isDefinitiveHostedHttpRejection(status) {
+    return status >= 400
+        && status < 500
+        && ![408, 425, 429].includes(status);
+}

package/dist/internal-types.d.ts

@@ -54,6 +54,8 @@ export interface StoredToken {
     fileCapability?: FileCapability;
     applicationOrigin?: string;
     keyHandle?: string;
+    /** Previous grant keys retained for durable pending-mutation recovery. */
+    retiredKeyHandles?: string[];
     savedAt: number;
     authority?: {
         operationsUrl: string;

package/dist/local-file-transport.d.ts

@@ -5,12 +5,14 @@ interface LocalFileTransportOptions {
     keyStore: GrantKeyStore;
     serverUrl: string;
     loopbackUrl: string;
+    currentToken?(): StoredToken | null;
     authorizedToken(signal?: AbortSignal): Promise<StoredToken | null>;
     refreshAuthorization(signal?: AbortSignal): Promise<StoredToken>;
     shouldAttemptDirect(token: StoredToken): Promise<boolean>;
     onDirectAvailable(): void;
     onDirectUnavailable(): void;
     onRelayAvailable(): void;
+    acquireGrantKeyLease?(collectionId: string, keyHandle: string, signal?: AbortSignal): Promise<() => void>;
 }
 /** Keeps grant-bound file crypto and loopback framing out of the operation transport. */
 export declare class LocalFileTransport {
@@ -19,13 +21,17 @@ export declare class LocalFileTransport {
     control<Result>(token: StoredToken, method: "GET" | "POST" | "DELETE", path: string, input: unknown, signal?: AbortSignal): Promise<Result>;
     private controlAttempt;
     private decryptControlResponse;
-    uploadChunk(session: FileTransferSession, chunkIndex: number, bytes: Uint8Array, signal?: AbortSignal): Promise<void>;
-    downloadChunk(session: FileTransferSession, chunkIndex: number, signal?: AbortSignal): Promise<Uint8Array>;
+    uploadChunk(session: FileTransferSession, chunkIndex: number, bytes: Uint8Array, signal?: AbortSignal, authorizedToken?: StoredToken): Promise<void>;
+    private uploadChunkWithLease;
+    downloadChunk(session: FileTransferSession, chunkIndex: number, signal?: AbortSignal, authorizedToken?: StoredToken): Promise<Uint8Array>;
+    private downloadChunkWithLease;
     private decryptDownloadResponse;
     private encryptControl;
     private sendRelayControl;
     private sendRelayUpload;
     private sendRelayDownload;
     private localFileToken;
+    private grantKeyLeases;
+    private retainEntryToken;
 }
 export {};

package/dist/local-file-transport.js

@@ -2,6 +2,7 @@ import { decodeFileFrame, FILE_PROTOCOL_VERSION, FILE_TRANSFER_PROTOCOL_VERSION
 import { decryptRelayResponse, encryptRelayRequest } from "./crypto.js";
 import { MdbaseConnectError, connectError, serverConnectError } from "./errors.js";
 import { GrantFileTransferCipher } from "./file-crypto.js";
+import { GrantKeyLeaseSet, retainCurrentGrantToken } from "./grant-key-leases.js";
 import { directFallbackStatus, loopbackRequest } from "./operation-helpers.js";
 import { apiError, decodeJsonResponse } from "./runtime-utils.js";
 import { isConnectorBusy, isExplicitConnectorBusyResponse, MAX_CONNECTOR_BUSY_RETRIES, waitForConnectorAvailability } from "./transient-retry.js";
@@ -12,9 +13,16 @@ export class LocalFileTransport {
         this.options = options;
     }
     async control(token, method, path, input, signal) {
-        return this.controlAttempt(token, method, path, input, signal, false, 0);
+        const leases = this.grantKeyLeases(token.collectionId);
+        try {
+            token = await this.retainEntryToken(token, leases, signal);
+            return await this.controlAttempt(token, method, path, input, signal, false, 0, leases);
+        }
+        finally {
+            leases.release();
+        }
     }
-    async controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries) {
+    async controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries, leases) {
         requireEncryption(token);
         const controlInput = localFileControlInput(method, path, input);
         let encryptedRequest = await this.encryptControl(token, controlInput);
@@ -38,7 +46,7 @@ export class LocalFileTransport {
                 || await isExplicitConnectorBusyResponse(response))) {
                 if (response.ok)
                     this.options.onDirectAvailable();
-                return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries);
+                return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries, leases);
             }
             if (response)
                 this.options.onDirectUnavailable();
@@ -47,33 +55,35 @@ export class LocalFileTransport {
             token = token.expiresAt > Date.now() + 30_000
                 ? token
                 : await this.options.refreshAuthorization(signal);
+            token = await this.retainEntryToken(token, leases, signal);
             requireLocalFileToken(token);
             encryptedRequest = await this.encryptControl(token, controlInput);
         }
         response = await this.sendRelayControl(token, encryptedRequest, signal);
         if (await refreshableBindingFailure(response, token)) {
             token = await this.options.refreshAuthorization(signal);
+            token = await this.retainEntryToken(token, leases, signal);
             requireLocalFileToken(token);
             encryptedRequest = await this.encryptControl(token, controlInput);
             response = await this.sendRelayControl(token, encryptedRequest, signal);
         }
         if (response.ok)
             this.options.onRelayAvailable();
-        return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries);
+        return this.decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries, leases);
     }
-    async decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries) {
+    async decryptControlResponse(token, method, path, input, signal, encryptedRequest, response, freshReadRetried, connectorBusyRetries, leases) {
         const body = await decodeJsonResponse(response, "invalid_operation_response", "The collection authority returned an invalid file control response.");
         if (!response.ok) {
             const error = apiError(body, "operation_failed", "Collection file request failed.", response.status);
             if (isConnectorBusy(error)
                 && connectorBusyRetries < MAX_CONNECTOR_BUSY_RETRIES) {
                 await waitForConnectorAvailability(connectorBusyRetries, signal);
-                return this.controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries + 1);
+                return this.controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries + 1, leases);
             }
             if (error.code === "fresh_request_required"
                 && method === "GET"
                 && !freshReadRetried) {
-                return this.controlAttempt(token, method, path, input, signal, true, connectorBusyRetries);
+                return this.controlAttempt(token, method, path, input, signal, true, connectorBusyRetries, leases);
             }
             throw error;
         }
@@ -86,21 +96,32 @@ export class LocalFileTransport {
             && decrypted.problem.code === "fresh_request_required"
             && method === "GET"
             && !freshReadRetried) {
-            return this.controlAttempt(token, method, path, input, signal, true, connectorBusyRetries);
+            return this.controlAttempt(token, method, path, input, signal, true, connectorBusyRetries, leases);
         }
         if (!decrypted.ok) {
             const error = encryptedProblem(decrypted.problem);
             if (isConnectorBusy(error)
                 && connectorBusyRetries < MAX_CONNECTOR_BUSY_RETRIES) {
                 await waitForConnectorAvailability(connectorBusyRetries, signal);
-                return this.controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries + 1);
+                return this.controlAttempt(token, method, path, input, signal, freshReadRetried, connectorBusyRetries + 1, leases);
             }
             throw error;
         }
         return decrypted.result;
     }
-    async uploadChunk(session, chunkIndex, bytes, signal) {
-        const token = await this.localFileToken(session, "upload", signal);
+    async uploadChunk(session, chunkIndex, bytes, signal, authorizedToken) {
+        const token = authorizedToken ?? await this.localFileToken(session, "upload", signal);
+        const leases = this.grantKeyLeases(token.collectionId);
+        try {
+            const current = await this.retainEntryToken(token, leases, signal);
+            validateLocalFileToken(current, session, "upload");
+            return await this.uploadChunkWithLease(current, leases, session, chunkIndex, bytes, signal);
+        }
+        finally {
+            leases.release();
+        }
+    }
+    async uploadChunkWithLease(token, leases, session, chunkIndex, bytes, signal) {
         let deliveryToken = token;
         let encoded = await encryptedUploadChunk(this.options.keyStore, deliveryToken, session, chunkIndex, bytes);
         let response;
@@ -125,6 +146,7 @@ export class LocalFileTransport {
         response = await this.sendRelayUpload(deliveryToken, encoded, signal);
         if (response.status === 401 && deliveryToken.refreshToken) {
             deliveryToken = await this.options.refreshAuthorization(signal);
+            deliveryToken = await this.retainEntryToken(deliveryToken, leases, signal);
             requireLocalFileToken(deliveryToken);
             encoded = await encryptedUploadChunk(this.options.keyStore, deliveryToken, session, chunkIndex, bytes);
             response = await this.sendRelayUpload(deliveryToken, encoded, signal);
@@ -135,8 +157,19 @@ export class LocalFileTransport {
         }
         this.options.onRelayAvailable();
     }
-    async downloadChunk(session, chunkIndex, signal) {
-        let token = await this.localFileToken(session, "download", signal);
+    async downloadChunk(session, chunkIndex, signal, authorizedToken) {
+        let token = authorizedToken ?? await this.localFileToken(session, "download", signal);
+        const leases = this.grantKeyLeases(token.collectionId);
+        try {
+            token = await this.retainEntryToken(token, leases, signal);
+            validateLocalFileToken(token, session, "download");
+            return await this.downloadChunkWithLease(token, leases, session, chunkIndex, signal);
+        }
+        finally {
+            leases.release();
+        }
+    }
+    async downloadChunkWithLease(token, leases, session, chunkIndex, signal) {
         let response;
         if (await this.options.shouldAttemptDirect(token)) {
             try {
@@ -159,6 +192,7 @@ export class LocalFileTransport {
         response = await this.sendRelayDownload(token, session, chunkIndex, signal);
         if (response.status === 401 && token.refreshToken) {
             token = await this.options.refreshAuthorization(signal);
+            token = await this.retainEntryToken(token, leases, signal);
             requireLocalFileToken(token);
             response = await this.sendRelayDownload(token, session, chunkIndex, signal);
         }
@@ -225,15 +259,32 @@ export class LocalFileTransport {
     }
     async localFileToken(session, direction, signal) {
         const token = await this.options.authorizedToken(signal);
-        if (!token || token.authority || !token.fileCapability || !token.encryption
-            || !token.grantId || !token.keyHandle
-            || session.direction !== direction
-            || session.protection !== "grant_aead_v1") {
-            throw connectError("not_authorized", "This connection cannot use encrypted local file delivery.");
-        }
-        framedChunkSize(session);
+        validateLocalFileToken(token, session, direction);
         return token;
     }
+    grantKeyLeases(collectionId) {
+        return new GrantKeyLeaseSet(collectionId, this.options.acquireGrantKeyLease
+            ?? (() => Promise.resolve(() => undefined)));
+    }
+    async retainEntryToken(snapshot, leases, signal) {
+        if (!this.options.currentToken) {
+            await leases.retain(snapshot, signal);
+            return snapshot;
+        }
+        const current = await retainCurrentGrantToken(this.options.currentToken, leases, signal);
+        if (current)
+            return current;
+        throw connectError("not_authorized", "Reconnect this application to continue.");
+    }
+}
+function validateLocalFileToken(token, session, direction) {
+    if (!token || token.authority || !token.fileCapability || !token.encryption
+        || !token.grantId || !token.keyHandle
+        || session.direction !== direction
+        || session.protection !== "grant_aead_v1") {
+        throw connectError("not_authorized", "This connection cannot use encrypted local file delivery.");
+    }
+    framedChunkSize(session);
 }
 function requireLocalFileToken(token) {
     if (token.authority || !token.fileCapability) {

package/dist/mdbase-connect.d.ts

@@ -20,6 +20,7 @@ export declare class MdbaseConnect<Frontmatter extends JsonObject = JsonObject>
     connections(): MdbaseConnectionInfo[];
     connection(collectionId: string): MdbaseConnection<Frontmatter> | null;
     unavailableReason(collectionId: string): MdbaseUnavailableReason | null;
+    connectionApplicationId(collectionId: string): string | null;
     onConnectionsChange(listener: (connections: MdbaseConnectionInfo[]) => void): () => void;
     forgetAll(): void;
     /** Forget a public TOFU pin after independently verifying a replaced connector. */

package/dist/mdbase-connect.js

@@ -35,6 +35,9 @@ export class MdbaseConnect {
     unavailableReason(collectionId) {
         return this.internals.unavailableReason(collectionId);
     }
+    connectionApplicationId(collectionId) {
+        return this.internals.connectionApplicationId(collectionId);
+    }
     onConnectionsChange(listener) {
         return this.internals.onConnectionsChange(listener);
     }

package/dist/outcomes.d.ts

@@ -13,19 +13,19 @@ export type ConnectFailure<Code extends ConnectProblemCode = ConnectProblemCode>
  * for programming errors and broken SDK invariants.
  */
 export type ConnectOutcome<Value, Code extends ConnectProblemCode = ConnectProblemCode> = ConnectSuccess<Value> | ConnectFailure<Code>;
-export type CommonOperationProblemCode = "access_denied" | "access_paused" | "authorization_binding_incompatible" | "authorization_expired" | "capability_contract_incompatible" | "collection_access_denied" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "direct_operation_rejected" | "durable_mutation_unsupported" | "operation_outcome_unknown" | "encryption_required" | "encrypted_relay_rejected" | "hosted_provider_unavailable" | "insufficient_access" | "invalid_encrypted_response" | "invalid_operation_response" | "invalid_request" | "missing_grant_key" | "mutation_recovery_expired" | "mutation_request_conflict" | "not_authorized" | "operation_cancelled" | "operation_failed" | "rate_limited" | "relay_authorization_expired" | "relay_unavailable" | "temporarily_unavailable" | "timeout" | "transport_protocol_incompatible" | "unsupported_operation";
-export declare const COMMON_OPERATION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation"];
+export type CommonOperationProblemCode = "access_denied" | "access_paused" | "application_declaration_mismatch" | "authorization_binding_incompatible" | "authorization_expired" | "capability_contract_incompatible" | "collection_access_denied" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "direct_operation_rejected" | "durable_mutation_unsupported" | "operation_outcome_unknown" | "encryption_required" | "encrypted_relay_rejected" | "hosted_provider_unavailable" | "insufficient_access" | "invalid_encrypted_response" | "invalid_operation_response" | "invalid_request" | "missing_grant_key" | "mutation_recovery_expired" | "mutation_request_conflict" | "not_authorized" | "operation_cancelled" | "operation_failed" | "rate_limited" | "relay_authorization_expired" | "relay_unavailable" | "temporarily_unavailable" | "timeout" | "transport_protocol_incompatible" | "unsupported_operation";
+export declare const COMMON_OPERATION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation"];
 export declare const ALL_CONNECT_PROBLEM_CODES: ConnectProblemCode[];
 export type RegistrationProblemCode = "discovery_failed" | "invalid_operation_response" | "invalid_application_manifest" | "invalid_request" | "manifest_load_failed" | "rate_limited" | "temporarily_unavailable" | "timeout";
 export declare const REGISTRATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout"];
-export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
-export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
+export type AuthorizationProblemCode = RegistrationProblemCode | "access_denied" | "application_declaration_mismatch" | "application_identity_unavailable" | "approval_window_blocked" | "authorization_binding_incompatible" | "authorization_cancelled" | "authorization_replayed" | "browser_required" | "capability_contract_incompatible" | "collection_access_denied" | "collection_configuration_invalid" | "collection_contracts_missing" | "collection_incompatible" | "collection_invalid" | "collection_kind_unsupported" | "collection_mismatch" | "collection_not_found" | "collection_type_registry_invalid" | "collection_version_unsupported" | "connector_identity_changed" | "connector_offline" | "connector_upgrade_required" | "device_authorization_failed" | "durable_mutation_unsupported" | "encryption_required" | "expired_token" | "invalid_application_authorization" | "invalid_callback" | "invalid_device_authorization_response" | "invalid_token_response" | "scope_denied" | "reconnect_required" | "token_exchange_failed" | "transport_protocol_incompatible";
+export declare const AUTHORIZATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible"];
 export type NotificationProblemCode = RegistrationProblemCode | "authorization_expired" | "invalid_operation_response" | "invalid_push_subscription" | "managed_fcm_not_declared" | "not_authorized" | "notification_criterion_not_declared" | "notification_reauthorization_required" | "notification_registration_failed" | "notification_unregistration_failed" | "notifications_not_declared" | "notifications_unavailable";
 export declare const NOTIFICATION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "authorization_expired", "invalid_operation_response", "invalid_push_subscription", "managed_fcm_not_declared", "not_authorized", "notification_criterion_not_declared", "notification_reauthorization_required", "notification_registration_failed", "notification_unregistration_failed", "notifications_not_declared", "notifications_unavailable"];
 export type DirectAccessProblemCode = "connector_offline" | "connector_upgrade_required" | "invalid_operation_response" | "not_authorized" | "operation_failed" | "temporarily_unavailable" | "timeout";
 export declare const DIRECT_ACCESS_PROBLEM_CODES: readonly ["connector_offline", "connector_upgrade_required", "invalid_operation_response", "not_authorized", "operation_failed", "temporarily_unavailable", "timeout"];
-export type SessionProblemCode = AuthorizationProblemCode | "collection_not_ready" | "collection_not_selected" | "unknown_collection";
-export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "unknown_collection"];
+export type SessionProblemCode = AuthorizationProblemCode | "collection_not_ready" | "collection_not_selected" | "operation_cancelled" | "session_destroyed" | "session_not_started" | "session_starting" | "unknown_collection";
+export declare const SESSION_PROBLEM_CODES: readonly ["discovery_failed", "invalid_operation_response", "invalid_application_manifest", "invalid_request", "manifest_load_failed", "rate_limited", "temporarily_unavailable", "timeout", "access_denied", "application_declaration_mismatch", "application_identity_unavailable", "approval_window_blocked", "authorization_binding_incompatible", "authorization_cancelled", "authorization_replayed", "browser_required", "capability_contract_incompatible", "collection_access_denied", "collection_configuration_invalid", "collection_contracts_missing", "collection_incompatible", "collection_invalid", "collection_kind_unsupported", "collection_mismatch", "collection_not_found", "collection_type_registry_invalid", "collection_version_unsupported", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "device_authorization_failed", "durable_mutation_unsupported", "encryption_required", "expired_token", "invalid_application_authorization", "invalid_callback", "invalid_device_authorization_response", "invalid_token_response", "scope_denied", "reconnect_required", "token_exchange_failed", "transport_protocol_incompatible", "collection_not_ready", "collection_not_selected", "operation_cancelled", "session_destroyed", "session_not_started", "session_starting", "unknown_collection"];
 export type CollectionSetupProblemCode = "collection_configuration_invalid" | "collection_invalid" | "collection_type_registry_invalid" | "collection_version_unsupported";
 export type CollectionDescriptionProblemCode = CommonOperationProblemCode | CollectionSetupProblemCode;
 export type CollectionReadProblemCode = CollectionDescriptionProblemCode | "invalid_path" | "operation_invalid";
@@ -34,12 +34,12 @@ export type CollectionMutationProblemCode = CollectionReadProblemCode | "concurr
 export type CollectionChangesProblemCode = CollectionDescriptionProblemCode | "change_cursor_reset";
 export type CollectionTypeProblemCode = CollectionMutationProblemCode | "type_pack_provision_failed";
 export declare const COLLECTION_SETUP_PROBLEM_CODES: readonly ["collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported"];
-export declare const COLLECTION_DESCRIPTION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported"];
-export declare const COLLECTION_READ_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid"];
-export declare const COLLECTION_QUERY_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "cursor_capacity_exhausted", "generation_expired", "invalid_read_cursor", "query_snapshot_changed", "sandbox_unsupported"];
-export declare const COLLECTION_MUTATION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "concurrent_modification", "invalid_preflight", "pending_mutation_unresolved"];
-export declare const COLLECTION_CHANGES_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "change_cursor_reset"];
-export declare const COLLECTION_TYPE_PROBLEM_CODES: readonly ["access_denied", "access_paused", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "concurrent_modification", "invalid_preflight", "pending_mutation_unresolved", "type_pack_provision_failed"];
+export declare const COLLECTION_DESCRIPTION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported"];
+export declare const COLLECTION_READ_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid"];
+export declare const COLLECTION_QUERY_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "cursor_capacity_exhausted", "generation_expired", "invalid_read_cursor", "query_snapshot_changed", "sandbox_unsupported"];
+export declare const COLLECTION_MUTATION_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "concurrent_modification", "invalid_preflight", "pending_mutation_unresolved"];
+export declare const COLLECTION_CHANGES_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "change_cursor_reset"];
+export declare const COLLECTION_TYPE_PROBLEM_CODES: readonly ["access_denied", "access_paused", "application_declaration_mismatch", "authorization_binding_incompatible", "authorization_expired", "capability_contract_incompatible", "collection_access_denied", "connector_identity_changed", "connector_offline", "connector_upgrade_required", "direct_operation_rejected", "durable_mutation_unsupported", "operation_outcome_unknown", "encryption_required", "encrypted_relay_rejected", "hosted_provider_unavailable", "insufficient_access", "invalid_encrypted_response", "invalid_operation_response", "invalid_request", "missing_grant_key", "mutation_recovery_expired", "mutation_request_conflict", "not_authorized", "operation_cancelled", "operation_failed", "rate_limited", "relay_authorization_expired", "relay_unavailable", "temporarily_unavailable", "timeout", "transport_protocol_incompatible", "unsupported_operation", "collection_configuration_invalid", "collection_invalid", "collection_type_registry_invalid", "collection_version_unsupported", "invalid_path", "operation_invalid", "concurrent_modification", "invalid_preflight", "pending_mutation_unresolved", "type_pack_provision_failed"];
 export declare function connectSuccess<Value>(value: Value, diagnostics?: MdbaseDiagnostic[]): ConnectSuccess<Value>;
 export declare function connectFailure<Code extends ConnectProblemCode>(problem: ConnectProblem<Code>): ConnectFailure<Code>;
 export declare function captureConnectOutcome<Value, Code extends ConnectProblemCode>(operation: () => Promise<Value>, allowedCodes: readonly Code[]): Promise<ConnectOutcome<Value, Code>>;

package/dist/outcomes.js

@@ -3,6 +3,7 @@ import { MdbaseConnectError, unknownConnectProblem } from "./errors.js";
 export const COMMON_OPERATION_PROBLEM_CODES = [
     "access_denied",
     "access_paused",
+    "application_declaration_mismatch",
     "authorization_binding_incompatible",
     "authorization_expired",
     "capability_contract_incompatible",
@@ -48,6 +49,7 @@ export const REGISTRATION_PROBLEM_CODES = [
 export const AUTHORIZATION_PROBLEM_CODES = [
     ...REGISTRATION_PROBLEM_CODES,
     "access_denied",
+    "application_declaration_mismatch",
     "application_identity_unavailable",
     "approval_window_blocked",
     "authorization_binding_incompatible",
@@ -108,6 +110,10 @@ export const SESSION_PROBLEM_CODES = [
     ...AUTHORIZATION_PROBLEM_CODES,
     "collection_not_ready",
     "collection_not_selected",
+    "operation_cancelled",
+    "session_destroyed",
+    "session_not_started",
+    "session_starting",
     "unknown_collection"
 ];
 export const COLLECTION_SETUP_PROBLEM_CODES = [

package/dist/pending-recovery-transports.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionOperation, OperationTransportProtocolVersion } from "@mdbase-dev/connect-protocol";
 export declare function pendingRecoveryTransports(storage: Storage, storagePrefix: string, operations: readonly CollectionOperation[], collectionId?: string): OperationTransportProtocolVersion[];
 export declare function pendingMutationsUseKey(storage: Storage, baseKey: string, keyHandle: string): boolean;
+export declare function pendingMutationKeyHandles(storage: Storage, baseKey: string): Set<string>;
 export declare function removePendingMutations(storage: Storage, baseKey: string, removeKey: (keyHandle: string) => void): void;