react-native-nitro-storage 0.8.0 → 0.10.0

package/lib/module/storage-core.js

@@ -3,7 +3,7 @@
 import { createDurabilityCoordinator } from "./core/durability";
 import { createMetricsRegistry } from "./core/metrics";
 import { MIGRATION_VERSION_KEY, isStoredEnvelope, assertBatchScope, assertValidScope, toVersionToken, prefixKey, isNamespaced, escapeCollidingRawValue, unescapeCollidingRawValue } from "./internal";
-import { assertAccessControlLevel, assertBiometricLevel, canUseRawBatchPath, canUseSecureRawBatchPath, createKeyChange, defaultDeserialize, defaultSerialize, isKeychainLockedError, isUpdater, notifyAllListeners, notifyKeyListeners, redactSecureKeyChange, typedKeys } from "./shared";
+import { assertAccessControlLevel, assertBiometricLevel, canUseRawBatchPath, canUseSecureRawBatchPath, createStorageCompositeError, createKeyChange, defaultDeserialize, defaultSerialize, isKeychainLockedError, isUpdater, normalizeStorageError, notifyAllListeners, notifyKeyListeners, redactSecureKeyChange, typedKeys } from "./shared";
 import { StorageEventRegistry } from "./storage-events";
 import { StorageScope, AccessControl, BiometricLevel } from "./Storage.types";
 const EMPTY_KEYS = Object.freeze([]);
@@ -15,6 +15,8 @@ export function createStorageCore(buildAdapter) {
   const itemGroups = new Map();
   const registeredKeyCounts = new Map();
   const memoryStore = new Map();
+  const memoryExpirationDeadlines = new Map();
+  const memoryItemsByKey = new Map();
   const memoryListeners = new Map();
   const scopedListeners = {
     [StorageScope.Disk]: new Map(),
@@ -49,15 +51,33 @@ export function createStorageCore(buildAdapter) {
   function getScopeRawCache(scope) {
     return scopedRawCache[scope];
   }
-  function cacheRawValue(scope, key, value) {
-    getScopeRawCache(scope).set(key, value);
+  function getCachedRawValueEntry(scope, key, create = false) {
+    const scopeCache = getScopeRawCache(scope);
+    const existing = scopeCache.get(key);
+    if (existing || !create) {
+      return existing;
+    }
+    const entry = new Map();
+    scopeCache.set(key, entry);
+    return entry;
+  }
+  function cacheRawValue(scope, key, value, representation = "plain") {
+    getCachedRawValueEntry(scope, key, true)?.set(representation, value);
+  }
+  function readCachedRawValue(scope, key, representation = "plain") {
+    return getCachedRawValueEntry(scope, key)?.get(representation);
   }
-  function readCachedRawValue(scope, key) {
-    return getScopeRawCache(scope).get(key);
+  function invalidateRawCache(scope, key) {
+    getScopeRawCache(scope).delete(key);
   }
   function clearScopeRawCache(scope) {
     getScopeRawCache(scope).clear();
   }
+  function invalidateMemoryItemCaches(key) {
+    memoryItemsByKey.get(key)?.forEach(item => {
+      item._invalidateParsedCacheOnly();
+    });
+  }
   function addKeyListener(registry, key, listener) {
     let listeners = registry.get(key);
     if (!listeners) {
@@ -83,6 +103,13 @@ export function createStorageCore(buildAdapter) {
     }
     return getRawValue(key, scope);
   }
+  function getEventRawValueForRepresentation(scope, key, representation) {
+    if (representation === "plain") {
+      return getEventRawValue(scope, key);
+    }
+    const raw = adapter.backend.getSecureBiometric(key);
+    return raw === undefined ? undefined : unescapeCollidingRawValue(raw);
+  }
   function shouldReadPreviousEventValues(scope) {
     if (storageEvents.hasListeners(scope)) {
       return true;
@@ -155,11 +182,14 @@ export function createStorageCore(buildAdapter) {
   function flushSecureWrites() {
     durability.flushSecureWrites();
   }
+  function runSecurePromotion(key, promotion) {
+    return durability.runSecurePromotion(key, promotion);
+  }
   function scheduleDiskWrite(key, value) {
-    durability.scheduleDiskWrite(key, value);
+    return durability.scheduleDiskWrite(key, value);
   }
   function scheduleSecureWrite(key, value, accessControl) {
-    durability.scheduleSecureWrite(key, value, accessControl);
+    return durability.scheduleSecureWrite(key, value, accessControl);
   }
   function setDiskWritesAsyncMode(enabled) {
     durability.setDiskWritesAsync(enabled);
@@ -180,6 +210,12 @@ export function createStorageCore(buildAdapter) {
     }
     return adapter.backend.get(key, scope);
   }
+  function getStoredRawValueForRepresentation(key, scope, representation) {
+    if (representation === "plain") {
+      return getStoredRawValue(key, scope);
+    }
+    return adapter.backend.getSecureBiometric(key);
+  }
   function getRawValue(key, scope) {
     assertValidScope(scope);
     if (scope === StorageScope.Memory) {
@@ -218,6 +254,7 @@ export function createStorageCore(buildAdapter) {
       clearPendingDiskWrite(key);
     }
     if (scope === StorageScope.Secure) {
+      invalidateRawCache(scope, key);
       flushSecureWrites();
       clearPendingSecureWrite(key);
       if (adapter.applyAccessControlOnSecureRawWrite) {
@@ -248,6 +285,7 @@ export function createStorageCore(buildAdapter) {
       clearPendingDiskWrite(key);
     }
     if (scope === StorageScope.Secure) {
+      invalidateRawCache(scope, key);
       flushSecureWrites();
       clearPendingSecureWrite(key);
     }
@@ -267,6 +305,7 @@ export function createStorageCore(buildAdapter) {
     getScopedListeners,
     cacheRawValue,
     readCachedRawValue,
+    invalidateRawCache,
     clearScopeRawCache,
     clearPendingDiskWrite,
     clearPendingSecureWrite,
@@ -320,6 +359,11 @@ export function createStorageCore(buildAdapter) {
         return;
       }
       const previousValues = shouldReadPreviousEventValues(scope) ? adapter.backend.getBatch(removeKeys, scope).map(value => value === undefined ? undefined : unescapeCollidingRawValue(value)) : [];
+      if (scope === StorageScope.Secure) {
+        removeKeys.forEach(key => {
+          invalidateRawCache(scope, key);
+        });
+      }
       adapter.backend.removeBatch(removeKeys, scope);
       removeKeys.forEach(key => {
         cacheRawValue(scope, key, undefined);
@@ -387,6 +431,7 @@ export function createStorageCore(buildAdapter) {
         const previousValues = shouldReadPreviousEventValues(scope) ? storage.getAll(scope) : {};
         if (scope === StorageScope.Memory) {
           memoryStore.clear();
+          memoryExpirationDeadlines.clear();
           notifyAllListeners(memoryListeners);
           emitBatchChange(scope, "clear", "memory", Object.keys(previousValues).map(key => createKeyChange(scope, key, previousValues[key], undefined, "clear", "memory")));
           return;
@@ -490,6 +535,7 @@ export function createStorageCore(buildAdapter) {
           }
           affectedKeys.forEach(key => {
             memoryStore.delete(key);
+            memoryExpirationDeadlines.delete(key);
           });
           affectedKeys.forEach(key => {
             notifyKeyListeners(memoryListeners, key);
@@ -520,7 +566,21 @@ export function createStorageCore(buildAdapter) {
     },
     clearBiometric: () => {
       measureOperation("storage:clearBiometric", StorageScope.Secure, () => {
-        adapter.backend.clearSecureBiometric();
+        flushSecureWrites();
+        const readEventValues = shouldReadPreviousEventValues(StorageScope.Secure);
+        const shouldEmitChanges = storageEvents.hasListeners(StorageScope.Secure) || eventObserver !== undefined;
+        const biometricKeys = shouldEmitChanges ? adapter.backend.getAllKeys(StorageScope.Secure).filter(key => adapter.backend.hasSecureBiometric(key)) : [];
+        const previousValues = readEventValues ? biometricKeys.map(key => {
+          const raw = adapter.backend.getSecureBiometric(key);
+          return raw === undefined ? undefined : unescapeCollidingRawValue(raw);
+        }) : [];
+        clearScopeRawCache(StorageScope.Secure);
+        try {
+          adapter.backend.clearSecureBiometric();
+        } finally {
+          clearScopeRawCache(StorageScope.Secure);
+        }
+        emitBatchChange(StorageScope.Secure, "clear", adapter.changeSource, biometricKeys.map((key, index) => createKeyChange(StorageScope.Secure, key, readEventValues ? previousValues[index] : undefined, undefined, "clear", adapter.changeSource)));
       });
     },
     has: (key, scope) => {
@@ -745,6 +805,9 @@ export function createStorageCore(buildAdapter) {
         if (scope === StorageScope.Secure) {
           flushSecureWrites();
           adapter.backend.setSecureAccessControl(secureDefaultAccessControl);
+          keys.forEach(key => {
+            invalidateRawCache(scope, key);
+          });
         }
         if (scope === StorageScope.Disk) {
           flushDiskWrites();
@@ -770,8 +833,9 @@ export function createStorageCore(buildAdapter) {
     const expiration = config.expiration;
     const onExpired = config.onExpired;
     const expirationTtlMs = expiration?.ttlMs;
-    const memoryExpiration = expiration && isMemory ? new Map() : null;
+    const memoryExpiration = expiration && isMemory ? memoryExpirationDeadlines : null;
     const readCache = !isMemory && config.readCache === true;
+    const rawCacheRepresentation = isBiometric ? "biometric" : "plain";
     const coalesceDiskWrites = config.scope === StorageScope.Disk && config.coalesceDiskWrites === true;
     const coalesceSecureWrites = config.scope === StorageScope.Secure && config.coalesceSecureWrites === true && !isBiometric;
     const defaultValue = config.defaultValue;
@@ -841,28 +905,40 @@ export function createStorageCore(buildAdapter) {
         const memoryStored = memoryStore.get(storageKey);
         return typeof memoryStored === "string" ? unescapeCollidingRawValue(memoryStored) : memoryStored;
       }
+      if (nonMemoryScope === StorageScope.Disk) {
+        if (durability.hasPendingDiskWrite(storageKey)) {
+          return durability.readPendingDiskWrite(storageKey);
+        }
+      }
+      if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
+        if (durability.hasPendingSecureWrite(storageKey)) {
+          return durability.readPendingSecureWrite(storageKey);
+        }
+      }
       migrateRenamesIfNeeded();
       if (nonMemoryScope === StorageScope.Disk) {
-        const pending = durability.readPendingDiskWrite(storageKey);
-        if (pending !== undefined) {
-          return pending;
+        if (durability.hasPendingDiskWrite(storageKey)) {
+          return durability.readPendingDiskWrite(storageKey);
         }
       }
       if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
-        const pending = durability.readPendingSecureWrite(storageKey);
-        if (pending !== undefined) {
-          return pending;
+        if (durability.hasPendingSecureWrite(storageKey)) {
+          return durability.readPendingSecureWrite(storageKey);
         }
       }
       if (readCache) {
-        const cache = getScopeRawCache(resolveNonMemoryScope());
-        const cached = cache.get(storageKey);
-        if (cached !== undefined || cache.has(storageKey)) {
-          return cached;
+        const scope = resolveNonMemoryScope();
+        const cachedEntry = getCachedRawValueEntry(scope, storageKey);
+        if (cachedEntry?.has(rawCacheRepresentation)) {
+          return cachedEntry.get(rawCacheRepresentation);
         }
       }
       if (isBiometric) {
-        return readBackendRaw(() => adapter.backend.getSecureBiometric(storageKey));
+        const raw = readBackendRaw(() => adapter.backend.getSecureBiometric(storageKey));
+        if (readCache) {
+          cacheRawValue(resolveNonMemoryScope(), storageKey, raw, rawCacheRepresentation);
+        }
+        return raw;
       }
       const raw = readBackendRaw(() => adapter.backend.get(storageKey, config.scope));
       cacheRawValue(resolveNonMemoryScope(), storageKey, raw);
@@ -874,7 +950,8 @@ export function createStorageCore(buildAdapter) {
       } catch (error) {
         onReadError?.(error);
         if (fallbackToCacheOnReadError) {
-          const cached = getScopeRawCache(resolveNonMemoryScope()).get(storageKey);
+          const scope = resolveNonMemoryScope();
+          const cached = readCachedRawValue(scope, storageKey, rawCacheRepresentation);
           if (cached !== undefined) {
             return cached;
           }
@@ -883,26 +960,375 @@ export function createStorageCore(buildAdapter) {
         throw error;
       }
     };
-    const writeStoredRaw = rawValue => {
+    function getRenameSourceKeys() {
+      return renameFromKeys.filter(key => key !== storageKey);
+    }
+    function getRenameSourceRaw(key) {
+      return isBiometric ? adapter.backend.getSecureBiometric(key) : adapter.backend.get(key, config.scope);
+    }
+    function invalidateRenameSourceCache(key) {
+      if (nonMemoryScope !== null) {
+        invalidateRawCache(nonMemoryScope, key);
+      }
+    }
+    function removeRenameSource(key) {
+      invalidateRenameSourceCache(key);
+      if (isBiometric) {
+        adapter.backend.deleteSecureBiometric(key);
+        invalidateRenameSourceCache(key);
+        return;
+      }
+      adapter.backend.remove(key, config.scope);
+      invalidateRenameSourceCache(key);
+    }
+    function restoreRenameSource(snapshot) {
+      invalidateRenameSourceCache(snapshot.key);
+      if (nonMemoryScope === StorageScope.Secure) {
+        if (snapshot.biometricValue !== undefined) {
+          adapter.backend.setSecureBiometricWithLevel(snapshot.key, snapshot.biometricValue, resolvedBiometricLevel === BiometricLevel.None ? BiometricLevel.BiometryOnly : resolvedBiometricLevel);
+        } else {
+          adapter.backend.deleteSecureBiometric(snapshot.key);
+        }
+        if (snapshot.plainValue !== undefined) {
+          if (adapter.applyAccessControlOnSecureRawWrite) {
+            adapter.backend.setSecureAccessControl(secureAccessControl ?? secureDefaultAccessControl);
+          }
+          adapter.backend.set(snapshot.key, snapshot.plainValue, config.scope);
+        } else if (snapshot.biometricValue === undefined) {
+          adapter.backend.remove(snapshot.key, config.scope);
+        }
+        invalidateRenameSourceCache(snapshot.key);
+        return;
+      }
+      if (snapshot.plainValue !== undefined) {
+        adapter.backend.set(snapshot.key, snapshot.plainValue, config.scope);
+      } else {
+        adapter.backend.remove(snapshot.key, config.scope);
+      }
+      invalidateRenameSourceCache(snapshot.key);
+    }
+    function readRenameSnapshots() {
+      return getRenameSourceKeys().flatMap(key => {
+        const plainValue = nonMemoryScope === StorageScope.Secure ? adapter.backend.get(key, config.scope) : getRenameSourceRaw(key);
+        const biometricValue = nonMemoryScope === StorageScope.Secure ? adapter.backend.getSecureBiometric(key) : undefined;
+        if (plainValue === undefined && biometricValue === undefined) {
+          return [];
+        }
+        return [{
+          key,
+          ...(plainValue === undefined ? {} : {
+            plainValue
+          }),
+          ...(biometricValue === undefined ? {} : {
+            biometricValue
+          })
+        }];
+      });
+    }
+    function selectedRenameValue(snapshot) {
+      return isBiometric ? snapshot.biometricValue : snapshot.plainValue;
+    }
+    function hasPendingCurrentWrite() {
+      if (nonMemoryScope === StorageScope.Disk) {
+        return durability.hasPendingDiskWrite(storageKey);
+      }
+      if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
+        return durability.hasPendingSecureWrite(storageKey);
+      }
+      return false;
+    }
+    function hasPendingRenameSourceWrite() {
+      if (isBiometric || nonMemoryScope === null) {
+        return false;
+      }
+      return getRenameSourceKeys().some(key => nonMemoryScope === StorageScope.Disk ? durability.hasPendingDiskWrite(key) : durability.hasPendingSecureWrite(key));
+    }
+    function flushPendingRenameSourceWrites() {
+      if (!hasPendingRenameSourceWrite()) {
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Disk) {
+        flushDiskWrites();
+        return;
+      }
+      flushSecureWrites();
+    }
+    function clearPendingCurrentWriteIf(write) {
+      if (write === undefined) {
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Disk && "generation" in write) {
+        durability.clearPendingDiskWriteIf(write);
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
+        durability.clearPendingSecureWriteIf(write);
+      }
+    }
+    function flushPendingCurrentWrite() {
+      if (nonMemoryScope === StorageScope.Disk) {
+        flushDiskWrites();
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
+        flushSecureWrites();
+      }
+    }
+    function removeCurrentBackendValue() {
+      invalidateRawCache(resolveNonMemoryScope(), storageKey);
+      if (isBiometric) {
+        adapter.backend.deleteSecureBiometric(storageKey);
+        return;
+      }
+      adapter.backend.remove(storageKey, config.scope);
+    }
+    function scheduleRenameSourceCleanup() {
+      const sourceKeys = getRenameSourceKeys();
+      sourceKeys.forEach(invalidateRenameSourceCache);
+      if (isBiometric) {
+        sourceKeys.forEach(removeRenameSource);
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Disk && (coalesceDiskWrites || isDiskWritesAsync())) {
+        sourceKeys.forEach(key => {
+          scheduleDiskWrite(key, undefined);
+        });
+        return;
+      }
+      if (nonMemoryScope === StorageScope.Secure && coalesceSecureWrites) {
+        sourceKeys.forEach(key => {
+          scheduleSecureWrite(key, undefined, secureAccessControl ?? secureDefaultAccessControl);
+        });
+        return;
+      }
+      sourceKeys.forEach(removeRenameSource);
+    }
+    let atomicMutationDepth = 0;
+    function getItemStateKeys() {
+      return Array.from(new Set([storageKey, ...getRenameSourceKeys()]));
+    }
+    function captureItemState() {
+      const records = getItemStateKeys().map(key => {
+        let pending;
+        if (nonMemoryScope === StorageScope.Disk) {
+          if (durability.hasPendingDiskWrite(key)) {
+            pending = {
+              value: durability.readPendingDiskWrite(key)
+            };
+          }
+        } else if (nonMemoryScope === StorageScope.Secure && !isBiometric && durability.hasPendingSecureWrite(key)) {
+          const accessControl = durability.readPendingSecureAccessControl(key);
+          pending = {
+            value: durability.readPendingSecureWrite(key),
+            ...(accessControl === undefined ? {} : {
+              accessControl
+            })
+          };
+        }
+        return {
+          key,
+          plainValue: nonMemoryScope === null ? undefined : adapter.backend.get(key, config.scope),
+          biometricValue: nonMemoryScope === StorageScope.Secure ? adapter.backend.getSecureBiometric(key) : undefined,
+          ...(pending === undefined ? {} : {
+            pending
+          })
+        };
+      });
+      return {
+        records,
+        renamesMigrated
+      };
+    }
+    function clearPendingItemWrite(key) {
+      if (nonMemoryScope === StorageScope.Disk) {
+        durability.clearPendingDiskWrite(key);
+      } else if (nonMemoryScope === StorageScope.Secure && !isBiometric) {
+        durability.clearPendingSecureWrite(key);
+      }
+    }
+    function restoreItemState(snapshot) {
+      const rollbackErrors = [];
+      const recordsByKey = new Map(snapshot.records.map(record => [record.key, record]));
+      snapshot.records.forEach(({
+        key
+      }) => {
+        clearPendingItemWrite(key);
+        if (nonMemoryScope !== null) {
+          invalidateRawCache(nonMemoryScope, key);
+        }
+      });
+      const biometricRecords = snapshot.records.filter(({
+        biometricValue
+      }) => biometricValue !== undefined);
+      if (nonMemoryScope === StorageScope.Secure) {
+        biometricRecords.forEach(({
+          key,
+          biometricValue
+        }) => {
+          try {
+            adapter.backend.setSecureBiometricWithLevel(key, biometricValue, resolvedBiometricLevel === BiometricLevel.None ? BiometricLevel.BiometryOnly : resolvedBiometricLevel);
+            cacheRawValue(StorageScope.Secure, key, biometricValue, "biometric");
+          } catch (error) {
+            rollbackErrors.push({
+              label: "rollback biometric",
+              error
+            });
+          }
+        });
+      }
+      const plainSets = new Map();
+      const plainRemoves = [];
+      snapshot.records.forEach(({
+        key,
+        plainValue,
+        biometricValue
+      }) => {
+        if (plainValue === undefined) {
+          if (biometricValue === undefined) {
+            plainRemoves.push(key);
+          }
+          return;
+        }
+        const accessControl = secureAccessControl ?? secureDefaultAccessControl;
+        const group = plainSets.get(accessControl) ?? {
+          keys: [],
+          values: []
+        };
+        group.keys.push(key);
+        group.values.push(plainValue);
+        plainSets.set(accessControl, group);
+      });
+      plainSets.forEach((group, accessControl) => {
+        try {
+          if (nonMemoryScope === StorageScope.Secure) {
+            adapter.backend.setSecureAccessControl(accessControl);
+          }
+          adapter.backend.setBatch(group.keys, group.values, config.scope);
+          group.keys.forEach((key, index) => {
+            cacheRawValue(resolveNonMemoryScope(), key, group.values[index], "plain");
+          });
+        } catch (error) {
+          rollbackErrors.push({
+            label: "rollback plain set",
+            error
+          });
+        }
+      });
+      if (plainRemoves.length > 0) {
+        try {
+          adapter.backend.removeBatch(plainRemoves, config.scope);
+          plainRemoves.forEach(key => {
+            cacheRawValue(resolveNonMemoryScope(), key, undefined, "plain");
+          });
+        } catch (error) {
+          rollbackErrors.push({
+            label: "rollback plain remove",
+            error
+          });
+        }
+      }
+      if (nonMemoryScope === StorageScope.Secure) {
+        snapshot.records.forEach(({
+          key,
+          biometricValue
+        }) => {
+          if (biometricValue !== undefined) {
+            return;
+          }
+          try {
+            adapter.backend.deleteSecureBiometric(key);
+            cacheRawValue(StorageScope.Secure, key, undefined, "biometric");
+          } catch (error) {
+            rollbackErrors.push({
+              label: "rollback biometric remove",
+              error
+            });
+          }
+        });
+      }
+      snapshot.records.forEach(({
+        key,
+        pending
+      }) => {
+        if (pending === undefined || nonMemoryScope === null) {
+          return;
+        }
+        if (nonMemoryScope === StorageScope.Disk) {
+          scheduleDiskWrite(key, pending.value);
+        } else if (!isBiometric) {
+          scheduleSecureWrite(key, pending.value, pending.accessControl ?? secureAccessControl ?? secureDefaultAccessControl);
+        }
+      });
+      recordsByKey.forEach(({
+        key
+      }) => {
+        if (nonMemoryScope !== null) {
+          invalidateRawCache(nonMemoryScope, key);
+        }
+      });
+      renamesMigrated = snapshot.renamesMigrated;
+      invalidateParsedCache();
+      return rollbackErrors;
+    }
+    function runAtomicItemMutation(mutation) {
+      if (isMemory || renameFromKeys.length === 0 || atomicMutationDepth > 0) {
+        mutation();
+        return;
+      }
+      const snapshot = captureItemState();
+      atomicMutationDepth += 1;
+      try {
+        mutation();
+      } catch (primaryError) {
+        const rollbackErrors = restoreItemState(snapshot);
+        if (rollbackErrors.length > 0) {
+          throw createStorageCompositeError("item mutation rollback", primaryError, rollbackErrors);
+        }
+        throw primaryError;
+      } finally {
+        atomicMutationDepth -= 1;
+      }
+    }
+    const writeStoredRaw = (rawValue, options = {}) => {
+      const cleanupRenameSources = options.cleanupRenameSources !== false;
       const oldValue = undefined;
       if (isBiometric) {
-        adapter.backend.setSecureBiometricWithLevel(storageKey, rawValue, resolvedBiometricLevel);
+        invalidateRawCache(StorageScope.Secure, storageKey);
+        runSecurePromotion(storageKey, () => {
+          try {
+            adapter.backend.setSecureBiometricWithLevel(storageKey, rawValue, resolvedBiometricLevel);
+          } catch (error) {
+            throw normalizeStorageError(error);
+          }
+        });
+        if (cleanupRenameSources) {
+          scheduleRenameSourceCleanup();
+        }
         emitKeyChange(config.scope, storageKey, oldValue, rawValue, "set", adapter.changeSource);
-        return;
+        return undefined;
+      }
+      if (nonMemoryScope === StorageScope.Secure) {
+        invalidateRawCache(StorageScope.Secure, storageKey);
       }
       cacheRawValue(resolveNonMemoryScope(), storageKey, rawValue);
       if (nonMemoryScope === StorageScope.Disk) {
         if (coalesceDiskWrites || isDiskWritesAsync()) {
-          scheduleDiskWrite(storageKey, rawValue);
+          const pendingWrite = scheduleDiskWrite(storageKey, rawValue);
+          if (cleanupRenameSources) {
+            scheduleRenameSourceCleanup();
+          }
           emitKeyChange(config.scope, storageKey, oldValue, rawValue, "set", adapter.changeSource);
-          return;
+          return pendingWrite;
         }
         clearPendingDiskWrite(storageKey);
       }
       if (coalesceSecureWrites) {
-        scheduleSecureWrite(storageKey, rawValue, secureAccessControl ?? secureDefaultAccessControl);
+        const pendingWrite = scheduleSecureWrite(storageKey, rawValue, secureAccessControl ?? secureDefaultAccessControl);
+        if (cleanupRenameSources) {
+          scheduleRenameSourceCleanup();
+        }
         emitKeyChange(config.scope, storageKey, oldValue, rawValue, "set", adapter.changeSource);
-        return;
+        return pendingWrite;
       }
       if (nonMemoryScope === StorageScope.Secure) {
         clearPendingSecureWrite(storageKey);
@@ -911,41 +1337,102 @@ export function createStorageCore(buildAdapter) {
         }
       }
       adapter.backend.set(storageKey, rawValue, config.scope);
+      if (cleanupRenameSources) {
+        scheduleRenameSourceCleanup();
+      }
       emitKeyChange(config.scope, storageKey, oldValue, rawValue, "set", adapter.changeSource);
+      return undefined;
     };
     const migrateRenamesIfNeeded = () => {
       if (renamesMigrated) {
         return;
       }
       try {
+        flushPendingRenameSourceWrites();
         const hasCurrent = isBiometric ? adapter.backend.hasSecureBiometric(storageKey) : adapter.backend.has(storageKey, config.scope);
+        const snapshots = readRenameSnapshots();
         if (hasCurrent) {
-          for (const legacyKey of renameFromKeys) {
-            if (isBiometric) {
-              if (adapter.backend.hasSecureBiometric(legacyKey)) {
-                adapter.backend.deleteSecureBiometric(legacyKey);
+          try {
+            snapshots.forEach(({
+              key
+            }) => {
+              removeRenameSource(key);
+            });
+          } catch (primaryError) {
+            const rollbackErrors = [];
+            snapshots.forEach(snapshot => {
+              try {
+                restoreRenameSource(snapshot);
+              } catch (error) {
+                rollbackErrors.push({
+                  label: "rollback rename source",
+                  error
+                });
               }
-            } else if (adapter.backend.has(legacyKey, config.scope)) {
-              adapter.backend.remove(legacyKey, config.scope);
+            });
+            if (rollbackErrors.length > 0) {
+              throw createStorageCompositeError("rename cleanup", primaryError, rollbackErrors);
             }
+            throw primaryError;
           }
           renamesMigrated = true;
           return;
         }
-        for (const legacyKey of renameFromKeys) {
-          const legacyRaw = isBiometric ? adapter.backend.getSecureBiometric(legacyKey) : adapter.backend.get(legacyKey, config.scope);
-          if (legacyRaw === undefined) {
-            continue;
+        const snapshot = snapshots.find(candidate => selectedRenameValue(candidate) !== undefined);
+        if (snapshot === undefined) {
+          renamesMigrated = true;
+          return;
+        }
+        let writeAttempted = false;
+        let pendingCurrentWrite;
+        try {
+          writeAttempted = true;
+          pendingCurrentWrite = writeStoredRaw(selectedRenameValue(snapshot), {
+            cleanupRenameSources: false
+          });
+          if (hasPendingCurrentWrite()) {
+            flushPendingCurrentWrite();
           }
-          writeStoredRaw(legacyRaw);
-          if (isBiometric) {
-            adapter.backend.deleteSecureBiometric(legacyKey);
-          } else {
-            adapter.backend.remove(legacyKey, config.scope);
+          snapshots.forEach(({
+            key
+          }) => {
+            removeRenameSource(key);
+          });
+          renamesMigrated = true;
+        } catch (primaryError) {
+          const rollbackErrors = [];
+          clearPendingCurrentWriteIf(pendingCurrentWrite);
+          if (writeAttempted) {
+            try {
+              removeCurrentBackendValue();
+            } catch (error) {
+              rollbackErrors.push({
+                label: "rollback current value",
+                error
+              });
+            }
           }
-          break;
+          snapshots.forEach(renameSnapshot => {
+            try {
+              restoreRenameSource(renameSnapshot);
+            } catch (error) {
+              rollbackErrors.push({
+                label: "rollback rename source",
+                error
+              });
+            }
+          });
+          invalidateRawCache(resolveNonMemoryScope(), storageKey);
+          snapshots.forEach(({
+            key
+          }) => {
+            invalidateRenameSourceCache(key);
+          });
+          if (rollbackErrors.length > 0) {
+            throw createStorageCompositeError("rename migration", primaryError, rollbackErrors);
+          }
+          throw primaryError;
         }
-        renamesMigrated = true;
       } catch (error) {
         if (isKeychainLockedError(error)) {
           onReadError?.(error);
@@ -955,16 +1442,22 @@ export function createStorageCore(buildAdapter) {
       }
     };
     const removeStoredRaw = (operation = "remove") => {
-      const oldValue = getEventRawValue(config.scope, storageKey);
+      const oldValue = isBiometric ? getEventRawValueForRepresentation(config.scope, storageKey, "biometric") : getEventRawValue(config.scope, storageKey);
       if (isBiometric) {
+        invalidateRawCache(StorageScope.Secure, storageKey);
+        scheduleRenameSourceCleanup();
         adapter.backend.deleteSecureBiometric(storageKey);
         emitKeyChange(config.scope, storageKey, oldValue, undefined, operation, adapter.changeSource);
         return;
       }
+      if (nonMemoryScope === StorageScope.Secure) {
+        invalidateRawCache(StorageScope.Secure, storageKey);
+      }
       cacheRawValue(resolveNonMemoryScope(), storageKey, undefined);
       if (nonMemoryScope === StorageScope.Disk) {
         if (coalesceDiskWrites || isDiskWritesAsync()) {
           scheduleDiskWrite(storageKey, undefined);
+          scheduleRenameSourceCleanup();
           emitKeyChange(config.scope, storageKey, oldValue, undefined, operation, adapter.changeSource);
           return;
         }
@@ -972,12 +1465,14 @@ export function createStorageCore(buildAdapter) {
       }
       if (coalesceSecureWrites) {
         scheduleSecureWrite(storageKey, undefined, secureAccessControl ?? secureDefaultAccessControl);
+        scheduleRenameSourceCleanup();
         emitKeyChange(config.scope, storageKey, oldValue, undefined, operation, adapter.changeSource);
         return;
       }
       if (nonMemoryScope === StorageScope.Secure) {
         clearPendingSecureWrite(storageKey);
       }
+      scheduleRenameSourceCleanup();
       adapter.backend.remove(storageKey, config.scope);
       emitKeyChange(config.scope, storageKey, oldValue, undefined, operation, adapter.changeSource);
     };
@@ -986,6 +1481,8 @@ export function createStorageCore(buildAdapter) {
         const oldValue = getEventRawValue(config.scope, storageKey);
         if (memoryExpiration) {
           memoryExpiration.set(storageKey, Date.now() + (expirationTtlMs ?? 0));
+        } else {
+          memoryExpirationDeadlines.delete(storageKey);
         }
         const storedValue = typeof value === "string" ? escapeCollidingRawValue(value) : value;
         memoryStore.set(storageKey, storedValue);
@@ -1034,7 +1531,9 @@ export function createStorageCore(buildAdapter) {
           if (lastExpiresAt > Date.now()) {
             return lastValue;
           }
-          removeStoredRaw("expire");
+          runAtomicItemMutation(() => {
+            removeStoredRaw("expire");
+          });
           invalidateParsedCache();
           onExpired?.(storageKey);
           lastValue = ensureValidatedValue(defaultValue, false);
@@ -1072,7 +1571,9 @@ export function createStorageCore(buildAdapter) {
           if (isStoredEnvelope(parsed)) {
             envelopeExpiresAt = parsed.expiresAt;
             if (parsed.expiresAt <= Date.now()) {
-              removeStoredRaw("expire");
+              runAtomicItemMutation(() => {
+                removeStoredRaw("expire");
+              });
               invalidateParsedCache();
               onExpired?.(storageKey);
               lastValue = ensureValidatedValue(defaultValue, false);
@@ -1109,36 +1610,45 @@ export function createStorageCore(buildAdapter) {
     }));
     const set = valueOrFn => {
       measureOperation("item:set", config.scope, () => {
-        const newValue = isUpdater(valueOrFn) ? valueOrFn(getInternal()) : valueOrFn;
-        if (validate && !validate(newValue)) {
-          throw new Error(`Validation failed for key "${storageKey}" in scope "${StorageScope[config.scope]}".`);
-        }
-        invalidateParsedCache();
-        writeValueWithoutValidation(newValue);
+        runAtomicItemMutation(() => {
+          const newValue = isUpdater(valueOrFn) ? valueOrFn(getInternal()) : valueOrFn;
+          if (validate && !validate(newValue)) {
+            throw new Error(`Validation failed for key "${storageKey}" in scope "${StorageScope[config.scope]}".`);
+          }
+          invalidateParsedCache();
+          writeValueWithoutValidation(newValue);
+        });
       });
     };
     const setIfVersion = (version, valueOrFn) => measureOperation("item:setIfVersion", config.scope, () => {
-      const currentVersion = getCurrentVersion();
-      if (currentVersion !== version) {
-        return false;
-      }
-      set(valueOrFn);
-      return true;
+      let didSet = false;
+      runAtomicItemMutation(() => {
+        const currentVersion = getCurrentVersion();
+        if (currentVersion !== version) {
+          return;
+        }
+        set(valueOrFn);
+        didSet = true;
+      });
+      return didSet;
     });
     const deleteItem = () => {
       measureOperation("item:delete", config.scope, () => {
-        invalidateParsedCache();
-        if (isMemory) {
-          const oldValue = getEventRawValue(config.scope, storageKey);
-          if (memoryExpiration) {
-            memoryExpiration.delete(storageKey);
+        runAtomicItemMutation(() => {
+          invalidateParsedCache();
+          if (isMemory) {
+            const oldValue = getEventRawValue(config.scope, storageKey);
+            if (memoryExpiration) {
+              memoryExpiration.delete(storageKey);
+            }
+            memoryExpirationDeadlines.delete(storageKey);
+            memoryStore.delete(storageKey);
+            notifyKeyListeners(memoryListeners, storageKey);
+            emitKeyChange(config.scope, storageKey, oldValue, undefined, "remove", "memory");
+            return;
           }
-          memoryStore.delete(storageKey);
-          notifyKeyListeners(memoryListeners, storageKey);
-          emitKeyChange(config.scope, storageKey, oldValue, undefined, "remove", "memory");
-          return;
-        }
-        removeStoredRaw();
+          removeStoredRaw();
+        });
       });
     };
     const merge = partial => {
@@ -1231,14 +1741,18 @@ export function createStorageCore(buildAdapter) {
         invalidateParsedCache();
       },
       _deleteMemoryEntry: () => {
-        if (memoryExpiration) {
-          memoryExpiration.delete(storageKey);
-        }
+        memoryExpirationDeadlines.delete(storageKey);
         memoryStore.delete(storageKey);
         invalidateParsedCache();
       },
       _hasValidation: validate !== undefined,
       _hasExpiration: expiration !== undefined,
+      _hasRenameFrom: renameFromKeys.length > 0,
+      _renameFromKeys: renameFromKeys,
+      _getRenameMigrationState: () => renamesMigrated,
+      _setRenameMigrationState: migrated => {
+        renamesMigrated = migrated;
+      },
       _readCacheEnabled: readCache,
       _isBiometric: isBiometric,
       _biometricLevel: resolvedBiometricLevel,
@@ -1260,6 +1774,14 @@ export function createStorageCore(buildAdapter) {
       }
       groupSet.add(storageItem);
     }
+    if (isMemory) {
+      let items = memoryItemsByKey.get(storageKey);
+      if (!items) {
+        items = new Set();
+        memoryItemsByKey.set(storageKey, items);
+      }
+      items.add(storageItem);
+    }
     const registryKey = `${config.scope}:${storageKey}`;
     registeredKeyCounts.set(registryKey, (registeredKeyCounts.get(registryKey) ?? 0) + 1);
     return storageItem;
@@ -1279,24 +1801,21 @@ export function createStorageCore(buildAdapter) {
       const keyIndexes = [];
       items.forEach((item, index) => {
         if (scope === StorageScope.Disk) {
-          const pending = durability.readPendingDiskWrite(item.key);
-          if (pending !== undefined) {
-            rawValues[index] = pending;
+          if (durability.hasPendingDiskWrite(item.key)) {
+            rawValues[index] = durability.readPendingDiskWrite(item.key);
             return;
           }
         }
         if (scope === StorageScope.Secure) {
-          const pending = durability.readPendingSecureWrite(item.key);
-          if (pending !== undefined) {
-            rawValues[index] = pending;
+          if (durability.hasPendingSecureWrite(item.key)) {
+            rawValues[index] = durability.readPendingSecureWrite(item.key);
             return;
           }
         }
         if (item._readCacheEnabled === true) {
-          const cache = getScopeRawCache(scope);
-          const cached = cache.get(item.key);
-          if (cached !== undefined || cache.has(item.key)) {
-            rawValues[index] = cached;
+          const cachedEntry = getCachedRawValueEntry(scope, item.key);
+          if (cachedEntry?.has("plain")) {
+            rawValues[index] = cachedEntry.get("plain");
             return;
           }
         }
@@ -1391,6 +1910,10 @@ export function createStorageCore(buildAdapter) {
         const keys = secureEntries.map(({
           item
         }) => item.key);
+        keys.forEach(key => {
+          invalidateRawCache(scope, key);
+        });
+        const serializedValues = [];
         const oldValues = shouldReadPreviousEventValues(scope) ? adapter.backend.getBatch(keys, scope).map(value => value === undefined ? undefined : unescapeCollidingRawValue(value)) : [];
         const groupedByAccessControl = new Map();
         secureEntries.forEach(({
@@ -1398,6 +1921,8 @@ export function createStorageCore(buildAdapter) {
           value,
           internal
         }) => {
+          const serialized = item.serialize(value);
+          serializedValues.push(serialized);
           const accessControl = internal._secureAccessControl ?? secureDefaultAccessControl;
           const existingGroup = groupedByAccessControl.get(accessControl);
           const group = existingGroup ?? {
@@ -1405,7 +1930,7 @@ export function createStorageCore(buildAdapter) {
             values: []
           };
           group.keys.push(item.key);
-          group.values.push(item.serialize(value));
+          group.values.push(serialized);
           if (!existingGroup) {
             groupedByAccessControl.set(accessControl, group);
           }
@@ -1417,10 +1942,8 @@ export function createStorageCore(buildAdapter) {
             cacheRawValue(scope, key, group.values[index]);
           });
         });
-        emitBatchChange(scope, "setBatch", adapter.changeSource, secureEntries.map(({
-          item,
-          value
-        }, index) => createKeyChange(scope, item.key, oldValues[index], item.serialize(value), "setBatch", adapter.changeSource)));
+        const willEmitChanges = storageEvents.hasListeners(scope) || eventObserver !== undefined;
+        emitBatchChange(scope, "setBatch", adapter.changeSource, willEmitChanges ? keys.map((key, index) => createKeyChange(scope, key, oldValues[index], serializedValues[index], "setBatch", adapter.changeSource)) : []);
         return;
       }
       flushDiskWrites();
@@ -1460,6 +1983,12 @@ export function createStorageCore(buildAdapter) {
         emitBatchChange(scope, "removeBatch", "memory", changes);
         return;
       }
+      if (items.some(item => asInternal(item)._hasRenameFrom)) {
+        items.forEach(item => {
+          asInternal(item).delete();
+        });
+        return;
+      }
       const keys = items.map(item => item.key);
       if (scope === StorageScope.Disk) {
         flushDiskWrites();
@@ -1467,7 +1996,25 @@ export function createStorageCore(buildAdapter) {
       if (scope === StorageScope.Secure) {
         flushSecureWrites();
       }
-      const oldValues = shouldReadPreviousEventValues(scope) ? adapter.backend.getBatch(keys, scope).map(value => value === undefined ? undefined : unescapeCollidingRawValue(value)) : [];
+      const oldValues = shouldReadPreviousEventValues(scope) ? (() => {
+        const plainItems = items.filter(item => asInternal(item)._isBiometric !== true);
+        const plainValues = plainItems.length === 0 ? [] : adapter.backend.getBatch(plainItems.map(item => item.key), scope).map(value => value === undefined ? undefined : unescapeCollidingRawValue(value));
+        let plainIndex = 0;
+        return items.map(item => {
+          const internal = asInternal(item);
+          if (internal._isBiometric === true) {
+            return getEventRawValueForRepresentation(scope, item.key, "biometric");
+          }
+          const value = plainValues[plainIndex];
+          plainIndex += 1;
+          return value;
+        });
+      })() : [];
+      if (scope === StorageScope.Secure) {
+        keys.forEach(key => {
+          invalidateRawCache(scope, key);
+        });
+      }
       adapter.backend.removeBatch(keys, scope);
       keys.forEach(key => {
         cacheRawValue(scope, key, undefined);
@@ -1515,33 +2062,74 @@ export function createStorageCore(buildAdapter) {
       }
       const NOT_SET = Symbol();
       const rollback = new Map();
-      const rememberRollback = (key, item) => {
-        if (rollback.has(key)) {
-          return;
-        }
-        if (scope === StorageScope.Memory) {
-          rollback.set(key, {
-            kind: "memory",
-            value: memoryStore.has(key) ? memoryStore.get(key) : NOT_SET
-          });
-        } else {
-          const internal = item ? item : undefined;
-          if (scope === StorageScope.Secure && internal?._isBiometric === true) {
-            rollback.set(key, {
-              kind: "biometric",
-              value: adapter.backend.getSecureBiometric(key),
-              level: internal._biometricLevel
+      const itemRenameStates = new Map();
+      const rememberRollback = (key, item, includeOtherSecureRepresentation = false) => {
+        const internal = item ? item : undefined;
+        const representation = scope === StorageScope.Secure && internal?._isBiometric === true ? "biometric" : "plain";
+        const rememberRepresentation = representationToRemember => {
+          const identity = JSON.stringify([scope, key, representationToRemember]);
+          if (rollback.has(identity)) {
+            return;
+          }
+          if (scope === StorageScope.Memory) {
+            const expiresAt = memoryExpirationDeadlines.get(key);
+            rollback.set(identity, {
+              key,
+              representation: representationToRemember,
+              record: {
+                kind: "memory",
+                value: memoryStore.has(key) ? memoryStore.get(key) : NOT_SET,
+                ...(expiresAt === undefined ? {} : {
+                  expiresAt
+                })
+              }
+            });
+            return;
+          }
+          if (representationToRemember === "biometric") {
+            rollback.set(identity, {
+              key,
+              representation: representationToRemember,
+              record: {
+                kind: "biometric",
+                value: getStoredRawValueForRepresentation(key, scope, representationToRemember),
+                level: internal?._biometricLevel !== undefined && internal._biometricLevel !== BiometricLevel.None ? internal._biometricLevel : BiometricLevel.BiometryOnly
+              }
             });
             return;
           }
-          rollback.set(key, {
-            kind: "raw",
-            value: getStoredRawValue(key, scope),
-            ...(scope === StorageScope.Secure && internal?._secureAccessControl !== undefined ? {
-              accessControl: internal._secureAccessControl
-            } : {})
+          rollback.set(identity, {
+            key,
+            representation: representationToRemember,
+            record: {
+              kind: "raw",
+              value: getStoredRawValueForRepresentation(key, scope, representationToRemember),
+              ...(scope === StorageScope.Secure && internal?._secureAccessControl !== undefined ? {
+                accessControl: internal._secureAccessControl
+              } : {})
+            }
           });
+        };
+        if (representation === "biometric" || includeOtherSecureRepresentation) {
+          rememberRepresentation("plain");
         }
+        rememberRepresentation(representation);
+        if (includeOtherSecureRepresentation) {
+          rememberRepresentation("biometric");
+        }
+      };
+      const rememberItemRollback = item => {
+        const internal = item;
+        const includeOtherSecureRepresentation = scope === StorageScope.Secure && (internal._isBiometric === true || internal._hasRenameFrom === true);
+        rememberRollback(item.key, item, includeOtherSecureRepresentation);
+        if (internal._getRenameMigrationState) {
+          if (!itemRenameStates.has(internal)) {
+            itemRenameStates.set(internal, internal._getRenameMigrationState());
+          }
+        }
+        (internal._renameFromKeys ?? EMPTY_KEYS).forEach(aliasKey => {
+          rememberRollback(aliasKey, item, true);
+        });
       };
       const tx = {
         scope,
@@ -1551,49 +2139,85 @@ export function createStorageCore(buildAdapter) {
           setRawValue(key, value, scope);
         },
         removeRaw: key => {
-          rememberRollback(key);
+          rememberRollback(key, undefined, scope === StorageScope.Secure);
           removeRawValue(key, scope);
         },
         getItem: item => {
           assertBatchScope([item], scope);
+          rememberItemRollback(item);
           return item.get();
         },
         setItem: (item, value) => {
           assertBatchScope([item], scope);
-          rememberRollback(item.key, item);
+          rememberItemRollback(item);
           item.set(value);
         },
         removeItem: item => {
           assertBatchScope([item], scope);
-          rememberRollback(item.key, item);
+          rememberItemRollback(item);
           item.delete();
         }
       };
       try {
         return transaction(tx);
       } catch (error) {
-        const rollbackEntries = Array.from(rollback.entries()).reverse();
+        itemRenameStates.forEach((migrated, item) => {
+          item._setRenameMigrationState(migrated);
+        });
+        const rollbackEntries = Array.from(rollback.values()).reverse();
         const rollbackSource = scope === StorageScope.Memory ? "memory" : adapter.changeSource;
-        const preRollbackValues = rollbackEntries.length > 0 ? rollbackEntries.map(([key]) => getEventRawValue(scope, key)) : [];
+        const rollbackErrors = [];
+        const readRollbackEventValue = entry => {
+          try {
+            return getEventRawValueForRepresentation(scope, entry.key, entry.representation);
+          } catch (readError) {
+            rollbackErrors.push({
+              label: `rollback read ${entry.representation}:${entry.key}`,
+              error: readError
+            });
+            return undefined;
+          }
+        };
+        const preRollbackValues = rollbackEntries.map(readRollbackEventValue);
         if (scope === StorageScope.Memory) {
-          rollbackEntries.forEach(([key, record]) => {
-            if (record.value === NOT_SET) {
-              memoryStore.delete(key);
-            } else {
-              memoryStore.set(key, record.value);
+          rollbackEntries.forEach(entry => {
+            try {
+              const record = entry.record;
+              if (record.kind !== "memory") {
+                return;
+              }
+              if (record.value === NOT_SET) {
+                memoryStore.delete(entry.key);
+              } else {
+                memoryStore.set(entry.key, record.value);
+              }
+              if (record.expiresAt === undefined) {
+                memoryExpirationDeadlines.delete(entry.key);
+              } else {
+                memoryExpirationDeadlines.set(entry.key, record.expiresAt);
+              }
+              invalidateMemoryItemCaches(entry.key);
+              notifyKeyListeners(memoryListeners, entry.key);
+            } catch (rollbackError) {
+              rollbackErrors.push({
+                label: `rollback ${entry.representation}:${entry.key}`,
+                error: rollbackError
+              });
             }
-            notifyKeyListeners(memoryListeners, key);
           });
         } else {
           const groupedKeysToSet = new Map();
           const keysToRemove = [];
-          rollbackEntries.forEach(([key, record]) => {
+          const biometricEntries = [];
+          const biometricValues = new Map();
+          rollbackEntries.forEach(entry => {
+            const {
+              key,
+              record
+            } = entry;
             if (record.kind === "biometric") {
-              if (record.value === undefined) {
-                adapter.backend.deleteSecureBiometric(key);
-              } else {
-                adapter.backend.setSecureBiometricWithLevel(key, record.value, record.level);
-              }
+              biometricEntries.push(entry);
+              biometricValues.set(key, record.value);
               return;
             }
             if (record.kind !== "raw") {
@@ -1616,29 +2240,108 @@ export function createStorageCore(buildAdapter) {
             }
           });
           if (scope === StorageScope.Disk) {
-            flushDiskWrites();
+            try {
+              flushDiskWrites();
+            } catch (flushError) {
+              rollbackErrors.push({
+                label: "rollback flush disk",
+                error: flushError
+              });
+            }
+          }
+          if (scope === StorageScope.Secure) {
+            try {
+              flushSecureWrites();
+            } catch (flushError) {
+              rollbackErrors.push({
+                label: "rollback flush secure",
+                error: flushError
+              });
+            }
           }
           if (scope === StorageScope.Secure) {
-            flushSecureWrites();
+            rollbackEntries.forEach(entry => {
+              invalidateRawCache(scope, entry.key);
+            });
           }
+          biometricEntries.forEach(entry => {
+            const {
+              key,
+              record
+            } = entry;
+            if (record.kind !== "biometric" || record.value === undefined) {
+              return;
+            }
+            try {
+              adapter.backend.setSecureBiometricWithLevel(key, record.value, record.level);
+              cacheRawValue(StorageScope.Secure, key, record.value, "biometric");
+            } catch (rollbackError) {
+              rollbackErrors.push({
+                label: "rollback biometric",
+                error: rollbackError
+              });
+            }
+          });
           groupedKeysToSet.forEach((group, accessControl) => {
-            if (scope === StorageScope.Secure) {
-              adapter.backend.setSecureAccessControl(accessControl);
+            try {
+              if (scope === StorageScope.Secure) {
+                adapter.backend.setSecureAccessControl(accessControl);
+              }
+              adapter.backend.setBatch(group.keys, group.values, scope);
+              group.keys.forEach((key, index) => {
+                cacheRawValue(scope, key, group.values[index], "plain");
+              });
+            } catch (rollbackError) {
+              rollbackErrors.push({
+                label: "rollback plain setBatch",
+                error: rollbackError
+              });
             }
-            adapter.backend.setBatch(group.keys, group.values, scope);
-            group.keys.forEach((key, index) => {
-              cacheRawValue(scope, key, group.values[index]);
-            });
           });
           if (keysToRemove.length > 0) {
-            adapter.backend.removeBatch(keysToRemove, scope);
-            keysToRemove.forEach(key => {
-              cacheRawValue(scope, key, undefined);
-            });
+            const keysToRemoveWithoutBiometric = keysToRemove.filter(key => biometricValues.get(key) === undefined);
+            try {
+              if (keysToRemoveWithoutBiometric.length > 0) {
+                adapter.backend.removeBatch(keysToRemoveWithoutBiometric, scope);
+              }
+              keysToRemove.forEach(key => {
+                cacheRawValue(scope, key, undefined, "plain");
+              });
+            } catch (rollbackError) {
+              rollbackErrors.push({
+                label: "rollback plain removeBatch",
+                error: rollbackError
+              });
+            }
           }
+          biometricEntries.forEach(entry => {
+            const {
+              key,
+              record
+            } = entry;
+            if (record.kind !== "biometric") {
+              return;
+            }
+            if (record.value !== undefined) {
+              return;
+            }
+            invalidateRawCache(StorageScope.Secure, key);
+            try {
+              adapter.backend.deleteSecureBiometric(key);
+              cacheRawValue(StorageScope.Secure, key, record.value, "biometric");
+            } catch (rollbackError) {
+              rollbackErrors.push({
+                label: "rollback biometric",
+                error: rollbackError
+              });
+            }
+          });
         }
         if (rollbackEntries.length > 0) {
-          emitBatchChange(scope, "rollback", rollbackSource, rollbackEntries.map(([key], index) => createKeyChange(scope, key, preRollbackValues[index], getEventRawValue(scope, key), "rollback", rollbackSource)));
+          emitBatchChange(scope, "rollback", rollbackSource, rollbackEntries.map((entry, index) => createKeyChange(scope, entry.key, preRollbackValues[index], readRollbackEventValue(entry), "rollback", rollbackSource)));
+        }
+        if (rollbackErrors.length > 0) {
+          throw createStorageCompositeError("transaction rollback", error, rollbackErrors);
         }
         throw error;
       }
@@ -1717,12 +2420,15 @@ export function createStorageCore(buildAdapter) {
     });
     const has = id => item.get()[id] === true;
     const add = id => {
-      if (item.get()[id] === true) {
+      const current = item.get();
+      if (current[id] === true) {
         return;
       }
-      item.merge({
-        [id]: true
-      });
+      const next = {
+        ...current
+      };
+      next[id] = true;
+      item.set(next);
     };
     const deleteId = id => {
       const current = item.get();
@@ -1743,8 +2449,16 @@ export function createStorageCore(buildAdapter) {
       add(id);
       return true;
     };
+    const getTyped = () => {
+      const typed = {};
+      for (const id of Object.keys(item.get())) {
+        typed[id] = true;
+      }
+      return typed;
+    };
     return {
       get: item.get,
+      getTyped,
       has,
       add,
       delete: deleteId,