craft-native 0.0.385 → 0.0.390

package/README.md

@@ -666,12 +666,53 @@ values (including their `toJSON` representation). Invalid JSON input rejects
 without changing the previous checkpoint. Cancellation and account-scope checks
 still run before committing the captured value.
 
+Browser checkpoint calls use IndexedDB read/write transactions and acknowledge
+only transaction completion. Web Locks alone cannot make localStorage caches
+coherent across tabs (observed in WebKit). Web Locks still serialize admission
+and support queued cancellation; atomic capabilities require both APIs. Storage
+exceptions reject the call. Cancelling an active transaction aborts it; an
+already completed transaction cannot be undone.
+
+Existing account-scoped Storage values are migrated once, before the first
+transactional operation. localStorage remains a synchronous UI mirror and keeps
+its quota checks, but the committed database is authoritative after migration.
+A failed transaction attempts to restore the previous mirror; the next
+successful checkpoint call repairs it from the database. Direct localStorage
+edits and older Craft tabs cannot update the new checkpoint database: reload
+all tabs when upgrading. Snapshots, credentials and unrelated app keys are not
+migrated. This does not change browser security or promise power-loss durability.
+
 `craft.storage.setSync` updates the immediate UI cache and
 queues its write when Web Locks are available; it cannot acknowledge durability
 or propagate a later quota failure. Background events are an opportunity to
 checkpoint, but browsers can terminate a page before queued work finishes, so
 also save periodically during play.
 
+Real-browser checkpoint acceptance runs separately from the SDK's in-memory
+unit fixtures:
+
+```sh
+bunx --no-install playwright install chromium firefox webkit
+bun run test:browser-checkpoints
+CRAFT_TEST_BROWSER=firefox bun run test:browser-checkpoints
+CRAFT_TEST_BROWSER=webkit bun run test:browser-checkpoints
+```
+
+The suite bundles the maintained `createBrowserPlatform` source, serves it on
+loopback, and uses fresh, owned persistent profiles with real IndexedDB,
+localStorage and Web Locks. It verifies acknowledged saves across reload and a graceful browser
+restart, competing-tab create/CAS winners and retry loops, queued-write input
+capture, reload/abort/disposal before commit, and actual quota rejection with
+recovery, legacy migration, stale-cache recovery and account cleanup. Fault
+injection aborts real transactions after put succeeds to verify rollback and
+cancellation before commit. It never opens or modifies your personal browser
+profile. CI runs all three engines and retains browser versions, the bundle
+SHA-256, results and traces.
+Set `CRAFT_BROWSER_ARTIFACTS` to retain these in a chosen directory; locally the
+default is a printed temporary path. Profiles are removed after each test.
+This proves the tested browser boundaries, not sudden process termination,
+power-loss durability, storage eviction, shipping Safari/iOS versions or Android acceptance.
+
 Browser audio assigns one owner per sound ID. A newer play or stop invalidates
 pending media resolution for that ID; stopping all sounds, changing accounts,
 aborting a call or disposing the host also releases active audio. Superseded

package/dist/android/templates/CraftNativeCapabilities.kt.template

@@ -46,7 +46,9 @@ import kotlin.math.roundToInt
 
 private const val CRAFT_NATIVE_FETCH_MAX_RESPONSE_BYTES = 8 * 1024 * 1024
 private const val CRAFT_NATIVE_FETCH_TIMEOUT_MS = 30_000
-private const val CRAFT_NATIVE_FILE_PICK_REQUEST = 4101
+private const val CRAFT_NATIVE_FILE_PICK_FIRST = 0x4000
+private const val CRAFT_NATIVE_FILE_PICK_LAST = 0xffff
+private const val CRAFT_NATIVE_FILE_PICK_STATE = "craft.filePicker.nextCode"
 private const val CRAFT_NATIVE_NOTIFICATION_PERMISSION_REQUEST = 4102
 private const val CRAFT_NATIVE_FILE_DEFAULT_MAX_PIXELS = 2048
 private const val CRAFT_NATIVE_FILE_LARGEST_MAX_PIXELS = 8192
@@ -61,11 +63,41 @@ internal data class CraftNativeCapabilityResult(
     val message: String? = null,
 )
 
+/** Never recycle a code while an old Activity result could still arrive. */
+internal class CraftNativePickerCodes(private var next: Int = CRAFT_NATIVE_FILE_PICK_FIRST) {
+    @Synchronized fun allocate(): Int? = if (next <= CRAFT_NATIVE_FILE_PICK_LAST) next++ else null
+    @Synchronized fun snapshot(): Int = next
+    @Synchronized fun restore(value: Int) {
+        next = maxOf(next, value.coerceIn(CRAFT_NATIVE_FILE_PICK_FIRST, CRAFT_NATIVE_FILE_PICK_LAST + 1))
+    }
+}
+
+/** Injectable platform boundary; result matching and file IO stay in the host. */
+internal interface CraftNativePickerHost {
+    fun launch(intent: Intent, requestCode: Int)
+    fun dismiss(requestCode: Int)
+}
+
 /** Process-wide persistence and OS services shared by every native route. */
 internal class CraftNativeCapabilities(
     private val context: Context,
     private val config: JSONObject,
+    private val pickerHost: CraftNativePickerHost? = (context as? MainActivity)?.let { host ->
+        object : CraftNativePickerHost {
+            override fun launch(intent: Intent, requestCode: Int) { host.startActivityForResult(intent, requestCode) }
+            override fun dismiss(requestCode: Int) { host.finishActivity(requestCode) }
+        }
+    },
 ) {
+    companion object {
+        private val pickerCodes = CraftNativePickerCodes()
+    }
+
+    fun savePickerState(state: android.os.Bundle) { state.putInt(CRAFT_NATIVE_FILE_PICK_STATE, pickerCodes.snapshot()) }
+    fun restorePickerState(state: android.os.Bundle?) {
+        pickerCodes.restore(state?.getInt(CRAFT_NATIVE_FILE_PICK_STATE, CRAFT_NATIVE_FILE_PICK_FIRST) ?: CRAFT_NATIVE_FILE_PICK_FIRST)
+    }
+
     /** The screen's activity; null in a background refresh, where nothing can be shown. */
     private val activity: MainActivity? get() = context as? MainActivity
     private val bluetooth by lazy { CraftBluetooth(context) }
@@ -114,6 +146,7 @@ internal class CraftNativeCapabilities(
         val videoLimit: Long = 0,
         val selectionLimit: Int = 1,
         val fileLimit: Long = 0,
+        val requestCode: Int = -1,
     )
 
     private val connectivity = context.getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
@@ -234,7 +267,12 @@ internal class CraftNativeCapabilities(
     fun cancel(requestToken: String) {
         cancelled.add(requestToken)
         fetchConnections.remove(requestToken)?.disconnect()
-        if (pendingFilePick?.requestToken == requestToken) pendingFilePick = null
+        onMain {
+            if (pendingFilePick?.requestToken == requestToken) {
+                dismissFilePick()
+                cancelled.remove(requestToken)
+            }
+        }
         biometricPrompts.remove(requestToken)?.cancelAuthentication()
     }
 
@@ -247,13 +285,41 @@ internal class CraftNativeCapabilities(
         networkExecutor.shutdownNow()
         fetchConnections.values.forEach(HttpURLConnection::disconnect)
         fetchConnections.clear()
-        pendingFilePick = null
+        onMain { dismissFilePick() }
         database?.close()
         database = null
         biometricPrompts.values.forEach { it.cancelAuthentication() }
         biometricPrompts.clear()
     }
 
+    private fun onMain(work: () -> Unit) {
+        if (android.os.Looper.myLooper() == android.os.Looper.getMainLooper()) work()
+        else mainHandler.post { work() }
+    }
+
+    private fun dismissFilePick() {
+        val pending = pendingFilePick ?: return
+        pendingFilePick = null
+        // Clear ownership first: finishActivity may immediately return a result.
+        runCatching { pickerHost?.dismiss(pending.requestCode) }
+    }
+
+    private fun launchFilePick(host: CraftNativePickerHost, intent: Intent, pending: PendingFilePick) {
+        val code = pickerCodes.allocate()
+        if (code == null) {
+            complete(pending.requestToken, failure("PICKER_UNAVAILABLE", "Picker request codes exhausted; start a new Activity session"), pending.completion)
+            return
+        }
+        pendingFilePick = pending.copy(requestCode = code)
+        try { host.launch(intent, code) }
+        catch (error: Exception) {
+            if (pendingFilePick?.requestCode == code) {
+                pendingFilePick = null
+                complete(pending.requestToken, failure("PICKER_UNAVAILABLE", error.message ?: "Picker could not be opened"), pending.completion)
+            }
+        }
+    }
+
     /** The same bounded text-only fetch contract as the maintained iOS host. */
     private fun fetch(requestToken: String, args: JSONArray): CraftNativeCapabilityResult {
         val options = args.optJSONObject(0)
@@ -492,26 +558,22 @@ internal class CraftNativeCapabilities(
 
     private fun pickVideo(requestToken: String, args: JSONArray, completion: (CraftNativeCapabilityResult) -> Unit) {
         mainHandler.post {
-            if (fileRequestCancelled(requestToken)) return@post
-            val host = activity ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
+            if (fileRequestCancelled(requestToken)) { cancelled.remove(requestToken); return@post }
+            val host = pickerHost ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
             if (pendingFilePick != null) {
                 complete(requestToken, failure("BUSY", "Another file picker is already open"), completion)
                 return@post
             }
             val options = args.optJSONObject(0) ?: JSONObject()
             val limit = options.optLong("maxBytes", 512L * 1024 * 1024).coerceIn(1, 512L * 1024 * 1024)
-            pendingFilePick = PendingFilePick(requestToken, "video", 0, 1f, completion, limit)
+            val pending = PendingFilePick(requestToken, "video", 0, 1f, completion, limit)
             val photos = options.optString("source", "library") != "files" && Build.VERSION.SDK_INT >= 33
             val intent = Intent(if (photos) MediaStore.ACTION_PICK_IMAGES else Intent.ACTION_OPEN_DOCUMENT).apply {
                 type = "video/*"
                 if (!photos) addCategory(Intent.CATEGORY_OPENABLE)
                 addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
             }
-            try { host.startActivityForResult(intent, CRAFT_NATIVE_FILE_PICK_REQUEST) }
-            catch (error: Exception) {
-                pendingFilePick = null
-                complete(requestToken, failure("PICKER_UNAVAILABLE", error.message ?: "Video picker could not be opened"), completion)
-            }
+            launchFilePick(host, intent, pending)
         }
     }
 
@@ -559,8 +621,8 @@ internal class CraftNativeCapabilities(
         completion: (CraftNativeCapabilityResult) -> Unit,
     ) {
         mainHandler.post {
-            if (fileRequestCancelled(requestToken)) return@post
-            val host = activity ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
+            if (fileRequestCancelled(requestToken)) { cancelled.remove(requestToken); return@post }
+            val host = pickerHost ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
             if (pendingFilePick != null) {
                 complete(requestToken, failure("BUSY", "Another file picker is already open"), completion)
                 return@post
@@ -579,25 +641,20 @@ internal class CraftNativeCapabilities(
                 complete(requestToken, failure("CAPABILITY_DISABLED", "Camera is disabled"), completion)
                 return@post
             }
-            pendingFilePick = PendingFilePick(requestToken, source, maxPixels, quality, completion)
+            val pending = PendingFilePick(requestToken, source, maxPixels, quality, completion)
             val intent = if (source == "camera") Intent(MediaStore.ACTION_IMAGE_CAPTURE)
             else Intent(Intent.ACTION_OPEN_DOCUMENT).apply {
                 addCategory(Intent.CATEGORY_OPENABLE)
                 type = "image/*"
             }
-            try {
-                host.startActivityForResult(intent, CRAFT_NATIVE_FILE_PICK_REQUEST)
-            } catch (error: Exception) {
-                pendingFilePick = null
-                complete(requestToken, failure("PICKER_UNAVAILABLE", error.message ?: "Image picker could not be opened"), completion)
-            }
+            launchFilePick(host, intent, pending)
         }
     }
 
     private fun pickFile(requestToken: String, args: JSONArray, completion: (CraftNativeCapabilityResult) -> Unit) {
         mainHandler.post {
-            if (fileRequestCancelled(requestToken)) return@post
-            val host = activity ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
+            if (fileRequestCancelled(requestToken)) { cancelled.remove(requestToken); return@post }
+            val host = pickerHost ?: return@post complete(requestToken, failure("NEEDS_ACTIVITY", "No screen is showing to pick from"), completion)
             if (pendingFilePick != null) {
                 complete(requestToken, failure("BUSY", "Another file picker is already open"), completion)
                 return@post
@@ -610,7 +667,7 @@ internal class CraftNativeCapabilities(
             }
             val selections = options.optInt("maxSelections", 1).coerceIn(1, 20)
             val limit = options.optLong("maxBytes", 512L * 1024 * 1024).coerceIn(1, 512L * 1024 * 1024)
-            pendingFilePick = PendingFilePick(
+            val pending = PendingFilePick(
                 requestToken,
                 "file",
                 0,
@@ -626,11 +683,7 @@ internal class CraftNativeCapabilities(
                 putExtra(Intent.EXTRA_ALLOW_MULTIPLE, selections > 1)
                 addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
             }
-            try { host.startActivityForResult(intent, CRAFT_NATIVE_FILE_PICK_REQUEST) }
-            catch (error: Exception) {
-                pendingFilePick = null
-                complete(requestToken, failure("PICKER_UNAVAILABLE", error.message ?: "File picker could not be opened"), completion)
-            }
+            launchFilePick(host, intent, pending)
         }
     }
 
@@ -666,36 +719,39 @@ internal class CraftNativeCapabilities(
     }
 
     fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
-        if (requestCode != CRAFT_NATIVE_FILE_PICK_REQUEST) return false
+        if (requestCode !in CRAFT_NATIVE_FILE_PICK_FIRST..CRAFT_NATIVE_FILE_PICK_LAST) return false
         val pending = pendingFilePick ?: return true
+        if (pending.requestCode != requestCode) return true
         pendingFilePick = null
+        if (fileRequestCancelled(pending.requestToken)) {
+            cancelled.remove(pending.requestToken)
+            return true
+        }
         if (resultCode != android.app.Activity.RESULT_OK) {
-            complete(pending.requestToken, success(JSONObject.NULL), pending.completion)
+            complete(pending.requestToken, success(if (pending.source == "file") JSONArray() else JSONObject.NULL), pending.completion)
             return true
         }
         if (pending.source == "video") {
-            networkExecutor.execute {
-                val result = data?.data?.let { copyVideo(pending.requestToken, it, pending.videoLimit) }
+            importPickedFile(pending) {
+                data?.data?.let { copyVideo(pending.requestToken, it, pending.videoLimit) }
                     ?: failure("PICKER_FAILED", "The selected video could not be read")
-                completeFile(pending.requestToken, result, pending.completion)
             }
             return true
         }
         if (pending.source == "file") {
-            networkExecutor.execute {
+            importPickedFile(pending) {
                 val uris = buildList {
                     data?.clipData?.let { clips ->
                         for (index in 0 until clips.itemCount) add(clips.getItemAt(index).uri)
                     }
                     data?.data?.let { add(it) }
                 }.distinct().take(pending.selectionLimit)
-                val result = copyDocuments(pending.requestToken, uris, pending.fileLimit)
-                completeFile(pending.requestToken, result, pending.completion)
+                copyDocuments(pending.requestToken, uris, pending.fileLimit)
             }
             return true
         }
-        networkExecutor.execute {
-            val result = runCatching {
+        importPickedFile(pending) {
+            runCatching {
                 val descriptor = if (pending.source == "camera") {
                     val bitmap = data?.extras?.get("data") as? Bitmap
                     bitmap?.let { writeImage(it, pending.maxPixels, pending.quality, "photo.jpg", pending.requestToken) }
@@ -705,11 +761,23 @@ internal class CraftNativeCapabilities(
                 descriptor?.let(::success) ?: if (fileRequestCancelled(pending.requestToken)) failure("CANCELLED", "Image selection was cancelled")
                 else failure("PICKER_FAILED", "The selected image could not be read")
             }.getOrElse { failure("READ_ERROR", it.message ?: "The selected image could not be read") }
-            completeFile(pending.requestToken, result, pending.completion)
         }
         return true
     }
 
+    private fun importPickedFile(pending: PendingFilePick, work: () -> CraftNativeCapabilityResult) {
+        try {
+            networkExecutor.execute {
+                val result = if (fileRequestCancelled(pending.requestToken)) failure("CANCELLED", "File selection was cancelled") else work()
+                completeFile(pending.requestToken, result, pending.completion)
+            }
+        } catch (_: java.util.concurrent.RejectedExecutionException) {
+            // close() can shut down the executor between result matching and
+            // submission. Its closed flag suppresses this abandoned reply.
+            complete(pending.requestToken, failure("CANCELLED", "File import host is closed"), pending.completion)
+        }
+    }
+
     private fun copyUri(requestToken: String, uri: Uri, maxPixels: Int, quality: Float): JSONObject? {
         if (fileRequestCancelled(requestToken)) return null
         val name = context.contentResolver.query(uri, arrayOf(android.provider.OpenableColumns.DISPLAY_NAME), null, null, null)?.use {

package/dist/android/templates/MainActivityNative.kt.template

@@ -4425,6 +4425,7 @@ class MainActivity : AppCompatActivity() {
             }
         }
         capabilities = CraftNativeCapabilities(this, config)
+        capabilities.restorePickerState(savedInstanceState)
         routes = CraftNativeRoutes(config)
         stores = CraftNativeStores.get(this, config)
         services = CraftNativeServices(this, config) { this }
@@ -5233,6 +5234,7 @@ class MainActivity : AppCompatActivity() {
     }
 
     override fun onSaveInstanceState(outState: Bundle) {
+        if (::capabilities.isInitialized) capabilities.savePickerState(outState)
         outState.putString("craft.initialDeepLink", initialDeepLink?.toString())
         outState.putBoolean("craft.initialDeepLinkClaimed", initialDeepLinkClaimed)
         outState.putBoolean("craft.deliveredInitialDeepLink", deliveredInitialDeepLink)

package/dist/browser/checkpoints.d.ts

@@ -0,0 +1,6 @@
+/**
+ * localStorage is a synchronous UI mirror, not an atomic cross-process store.
+ * WebKit can grant a Web Lock before another process's storage cache updates.
+ * Keep the acknowledged checkpoint in one IndexedDB read/write transaction.
+ */
+export declare function createCheckpointStore(mirror: Storage, namespace: string): <T>(operation: (storage: Storage) => T, signal?: AbortSignal) => Promise<T>;

package/dist/browser.js

@@ -62,6 +62,149 @@ function secureUUID() {
   throw new Error("[Craft] No Web Crypto available; cannot generate secure IDs");
 }
 
+// src/browser/checkpoints.ts
+function createCheckpointStore(mirror, namespace) {
+  const prefix = `${namespace}:account:`;
+  const owned = (key) => {
+    if (!key.startsWith(prefix))
+      return false;
+    const scoped = key.slice(prefix.length);
+    const separator = scoped.indexOf(":");
+    return separator !== -1 && scoped.slice(separator + 1).startsWith("storage:");
+  };
+  const mirrorKeys = () => Array.from({ length: mirror.length }, (_, i) => mirror.key(i)).filter((key) => key !== null && owned(key));
+  return async (operation, signal) => {
+    signal?.throwIfAborted();
+    const db = await new Promise((resolve, reject) => {
+      const request = indexedDB.open(`${namespace}:checkpoints`, 1);
+      let abandoned = false;
+      const abort = () => {
+        abandoned = true;
+        reject(signal?.reason);
+      };
+      signal?.addEventListener("abort", abort, { once: true });
+      request.onupgradeneeded = () => {
+        request.result.createObjectStore("checkpoints");
+      };
+      request.onerror = () => {
+        signal?.removeEventListener("abort", abort);
+        reject(request.error);
+      };
+      request.onblocked = () => {
+        abandoned = true;
+        signal?.removeEventListener("abort", abort);
+        reject(new DOMException("Checkpoint database upgrade is blocked", "InvalidStateError"));
+      };
+      request.onsuccess = () => {
+        signal?.removeEventListener("abort", abort);
+        if (abandoned || signal?.aborted) {
+          request.result.close();
+          reject(signal?.reason);
+          return;
+        }
+        resolve(request.result);
+      };
+    });
+    try {
+      await new Promise((resolve, reject) => {
+        const transaction = db.transaction("checkpoints", "readwrite");
+        const store = transaction.objectStore("checkpoints");
+        const request = store.get("state");
+        let failure;
+        request.onsuccess = () => {
+          if (request.result !== undefined)
+            return;
+          try {
+            store.put(mirrorKeys().map((key) => [key, mirror.getItem(key)]), "state");
+          } catch (error) {
+            failure = error;
+            transaction.abort();
+          }
+        };
+        transaction.oncomplete = () => resolve();
+        transaction.onabort = () => reject(failure ?? transaction.error);
+      });
+      signal?.throwIfAborted();
+      return await new Promise((resolve, reject) => {
+        const transaction = db.transaction("checkpoints", "readwrite");
+        const store = transaction.objectStore("checkpoints");
+        let result;
+        let failure;
+        const before = new Map;
+        const abort = () => {
+          failure = signal?.reason;
+          try {
+            transaction.abort();
+          } catch {}
+        };
+        signal?.addEventListener("abort", abort, { once: true });
+        transaction.oncomplete = () => {
+          signal?.removeEventListener("abort", abort);
+          resolve(result);
+        };
+        transaction.onabort = () => {
+          signal?.removeEventListener("abort", abort);
+          for (const [key, value] of before) {
+            try {
+              if (value === null)
+                mirror.removeItem(key);
+              else
+                mirror.setItem(key, value);
+            } catch {}
+          }
+          reject(failure ?? transaction.error ?? new DOMException("Checkpoint transaction aborted", "AbortError"));
+        };
+        const request = store.get("state");
+        request.onsuccess = () => {
+          try {
+            signal?.throwIfAborted();
+            const values = new Map(request.result);
+            let dirty = false;
+            const storage = {
+              get length() {
+                return values.size;
+              },
+              key: (index) => [...values.keys()][index] ?? null,
+              getItem: (key) => values.get(key) ?? null,
+              setItem(key, value) {
+                values.set(key, String(value));
+                dirty = true;
+              },
+              removeItem(key) {
+                dirty = values.delete(key) || dirty;
+              },
+              clear() {
+                dirty = values.size > 0 || dirty;
+                values.clear();
+              }
+            };
+            result = operation(storage);
+            signal?.throwIfAborted();
+            for (const key of new Set([...mirrorKeys(), ...values.keys()])) {
+              const previous = mirror.getItem(key);
+              const next = values.get(key) ?? null;
+              if (previous === next)
+                continue;
+              before.set(key, previous);
+              if (next === null)
+                mirror.removeItem(key);
+              else
+                mirror.setItem(key, next);
+            }
+            if (dirty)
+              store.put([...values], "state");
+          } catch (error) {
+            failure = error;
+            transaction.abort();
+          }
+        };
+      });
+    } finally {
+      db.close();
+    }
+  };
+}
+
 // src/browser/storage.ts
 async function waitForAccount(operation, signal) {
   if (!signal)
@@ -83,7 +226,13 @@ async function createBrowserStorage(options) {
   const { storage, namespace, tokenKey, changed } = options;
   const sessionTokenKey = options.sessionTokenKey || "auth.token";
   const prefix = `${namespace}:`;
-  const lock = options.lock === null ? undefined : options.lock ?? (typeof navigator !== "undefined" && typeof navigator.locks?.request === "function" ? (name, operation, settings) => navigator.locks.request(name, settings ?? {}, operation) : undefined);
+  const lock = options.lock === null ? undefined : options.lock ?? (typeof navigator !== "undefined" && typeof navigator.locks?.request === "function" ? (name, operation, settings) => navigator.locks.request(name, settings ?? {}, async () => {
+    try {
+      return await operation();
+    } finally {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+  }) : undefined);
   const exclusive = (operation, signal) => {
     const guarded = () => {
       signal?.throwIfAborted();
@@ -92,6 +241,12 @@ async function createBrowserStorage(options) {
     signal?.throwIfAborted();
     return lock ? lock(`${namespace}:storage`, guarded, { signal }) : Promise.resolve().then(guarded);
   };
+  const checkpoints = options.lock === undefined && lock && typeof indexedDB !== "undefined" ? createCheckpointStore(storage, namespace) : null;
+  const atomicStorage = !!lock && (!!checkpoints || typeof options.lock === "function");
+  const checkpoint = (operation, signal) => checkpoints ? checkpoints(operation, signal) : Promise.resolve().then(() => {
+    signal?.throwIfAborted();
+    return operation(storage);
+  });
   const scopeChanged = () => Object.assign(new Error("The storage account changed"), { code: "STORAGE_SCOPE_CHANGED" });
   const pending = new Map;
   let token = storage.getItem(tokenKey);
@@ -103,7 +258,7 @@ async function createBrowserStorage(options) {
   const available = () => !transitioning && storage.getItem(tokenKey) === token;
   const key = (name) => `${prefix}account:${scope}:${name}`;
   const snapshotKey = (name) => name === "app" ? `${prefix}app` : key(`snapshot:${name}`);
-  const keys = (base) => Array.from({ length: storage.length }, (_, index) => storage.key(index)).filter((value) => value !== null && value.startsWith(base));
+  const keys = (base, source = storage) => Array.from({ length: source.length }, (_, index) => source.key(index)).filter((value) => value !== null && value.startsWith(base));
   const parse = (value) => {
     if (value === null)
       return null;
@@ -137,22 +292,22 @@ async function createBrowserStorage(options) {
     const captured = capture();
     const address = key(`storage:${name}`);
     const json = value === null || value === undefined ? null : encode(value);
-    const write = () => {
+    const write = (source) => {
       if (json === null)
-        storage.removeItem(address);
+        source.removeItem(address);
       else
-        storage.setItem(address, json);
+        source.setItem(address, json);
     };
     if (!lock) {
-      write();
+      write(storage);
       return;
     }
     const entry = { json };
     pending.set(address, entry);
-    exclusive(() => {
+    exclusive(() => checkpoint((source) => {
       requireScope(captured);
-      write();
-    }).catch((error) => {
+      write(source);
+    })).catch((error) => {
       if (error.code !== "STORAGE_SCOPE_CHANGED")
         console.error("Browser storage write failed", error);
     }).finally(() => {
@@ -172,7 +327,12 @@ async function createBrowserStorage(options) {
     token = next;
     pending.clear();
     transition = (async () => {
-      await exclusive(() => {
+      await exclusive(async () => {
+        if (checkpoints)
+          await checkpoint((source) => {
+            for (const name of keys(`${prefix}account:${previous}:`, source))
+              source.removeItem(name);
+          });
         for (const name of keys(`${prefix}account:${previous}:`))
           storage.removeItem(name);
         for (const name of options.accountKeys ?? []) {
@@ -195,7 +355,7 @@ async function createBrowserStorage(options) {
   };
   const secureKey = (name) => name === sessionTokenKey ? tokenKey : key(`credential:${name}`);
   return {
-    atomicStorage: lock !== undefined,
+    atomicStorage,
     scope: () => scope,
     accountChanged,
     craft: {
@@ -246,9 +406,9 @@ async function createBrowserStorage(options) {
       let json;
       let expected;
       if (wasAvailable && module === "Storage") {
-        if (method === "set" || method === "setIfAbsent" && lock)
+        if (method === "set" || method === "setIfAbsent" && atomicStorage)
           json = encode(args[1]);
-        if (method === "compareAndSet" && lock) {
+        if (method === "compareAndSet" && atomicStorage) {
           expected = parse(encode(args[1]));
           json = encode(args[2]);
         }
@@ -257,43 +417,43 @@ async function createBrowserStorage(options) {
       if (module === "Storage") {
         if (!wasAvailable)
           throw scopeChanged();
-        return exclusive(() => {
+        return exclusive(() => checkpoint((source) => {
           requireScope(captured);
           const address = `${prefix}account:${captured.scope}:storage:${name}`;
           if (method === "get")
-            return parse(storage.getItem(address));
+            return parse(source.getItem(address));
           if (method === "set") {
-            storage.setItem(address, json);
+            source.setItem(address, json);
             return true;
           }
           if (method === "remove") {
-            storage.removeItem(address);
+            source.removeItem(address);
             return true;
           }
           if (method === "keys")
-            return keys(key("storage:")).map((item) => item.slice(key("storage:").length));
+            return keys(key("storage:"), source).map((item) => item.slice(key("storage:").length));
           if (method === "clear") {
-            for (const item of keys(key("storage:")))
-              storage.removeItem(item);
+            for (const item of keys(key("storage:"), source))
+              source.removeItem(item);
             return true;
           }
           if (method === "compareAndSet" || method === "setIfAbsent") {
-            if (!lock)
-              throw Object.assign(new Error("Atomic browser storage requires Web Locks"), { code: method === "setIfAbsent" ? "STORAGE_SET_IF_ABSENT_UNSUPPORTED" : "STORAGE_COMPARE_AND_SET_UNSUPPORTED" });
-            const raw = storage.getItem(address);
+            if (!atomicStorage)
+              throw Object.assign(new Error("Atomic browser storage requires transactional persistence and Web Locks"), { code: method === "setIfAbsent" ? "STORAGE_SET_IF_ABSENT_UNSUPPORTED" : "STORAGE_COMPARE_AND_SET_UNSUPPORTED" });
+            const raw = source.getItem(address);
             if (method === "setIfAbsent") {
               if (raw !== null)
                 return false;
-              storage.setItem(address, json);
+              source.setItem(address, json);
               return true;
             }
             if (raw === null || !jsonEqual(parse(raw), expected))
               return false;
-            storage.setItem(address, json);
+            source.setItem(address, json);
             return true;
           }
           throw Object.assign(new Error(`Unsupported browser storage operation ${method}`), { code: "UNSUPPORTED" });
-        }, signal);
+        }, signal), signal);
       }
       if (module === "SecureStorage") {
         if (!wasAvailable)