@absolutejs/sync-capacitor 0.6.1 → 0.8.0

package/dist/index.js

@@ -7,9 +7,595 @@ import {
   createSyncLocalSchemaStatus,
   migrateSyncLocalCollectionRecord,
   migrateSyncLocalMutationRecord,
-  resolveSyncLocalSchemaComponents
+  resolveSyncLocalDataPolicy,
+  resolveSyncLocalSchemaComponents,
+  runSyncLocalPolicyTransaction
 } from "@absolutejs/sync/client";
 import { registerPlugin } from "@capacitor/core";
+import { createCapacitorSecureStorage } from "@absolutejs/devices-capacitor";
+
+// ../node_modules/.bun/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/utils.js
+/*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) */
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+var atitle = (title) => title ? `"${title}" ` : "";
+function abool(value, title = "") {
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle(title) + "expected boolean, got type=" + typeof value);
+  return value;
+}
+function anumber(n, title = "") {
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
+function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === undefined || value.length === length))
+    return value;
+  if (length !== undefined)
+    anumber(length, "length");
+  const bytes = isBytes(value);
+  const ofLen = length !== undefined ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("hash was destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("digest() was already called");
+}
+function aoutput(out, instance) {
+  abytes(out, undefined, "output");
+  const min = instance.outputLen;
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
+  }
+}
+function aoutput32(out, instance) {
+  aoutput(out, instance);
+  if (!isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+}
+function u8(arr) {
+  return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0;i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n) >>> 0;
+function byteSwap32(arr) {
+  for (let i = 0;i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function equalBytes(a, b) {
+  a = abytes(a);
+  b = abytes(b);
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function wrapMacConstructor(keyLen, macCons, fromMsg) {
+  const mac = macCons;
+  const getArgs = fromMsg || (() => []);
+  const macC = (msg, key) => mac(key, ...getArgs(msg)).update(msg).digest();
+  const tmp = mac(new Uint8Array(keyLen), ...getArgs(new Uint8Array(0)));
+  macC.outputLen = tmp.outputLen;
+  macC.blockLen = tmp.blockLen;
+  macC.create = (key, ...args) => mac(key, ...args);
+  return macC;
+}
+var wrapCipher = (params, constructor) => {
+  function wrappedCipher(key, ...args) {
+    abytes(key, undefined, "key");
+    if (params.nonceLength !== undefined) {
+      const nonce = args[0];
+      abytes(nonce, params.varSizeNonce ? undefined : params.nonceLength, "nonce");
+    }
+    const tagl = params.tagLength;
+    const aadStart = params.nonceLength !== undefined ? 1 : 0;
+    if (!params.withAAD) {
+      for (let i = aadStart;i < args.length; i++)
+        if (isBytes(args[i]))
+          throw new Error("AAD not supported");
+    }
+    if (params.withAAD && args[aadStart] !== undefined)
+      abytes(args[aadStart], undefined, "AAD");
+    const cipher = constructor(key, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== undefined) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes(output, undefined, "output");
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes(data, undefined, "data");
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes(data, undefined, "data");
+        if (tagl && data.length < tagl)
+          throw new Error('"ciphertext" expected length >= tagLength=' + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === undefined)
+    return new Uint8Array(expectedLength);
+  abytes(out, expectedLength, "output");
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  anumber(dataLength);
+  anumber(aadLength);
+  abool(isLE2);
+  const num = new Uint8Array(16);
+  const view = createView(num);
+  view.setBigUint64(0, BigInt(aadLength), isLE2);
+  view.setBigUint64(8, BigInt(dataLength), isLE2);
+  return num;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(abytes(bytes));
+}
+function randomBytes(bytesLength = 32) {
+  anumber(bytesLength, "bytesLength");
+  const cr = typeof globalThis === "object" ? globalThis.crypto : null;
+  if (typeof cr?.getRandomValues !== "function")
+    throw new Error("crypto.getRandomValues must be defined");
+  if (bytesLength > 65536)
+    throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+
+// ../node_modules/.bun/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/_polyval.js
+var BLOCK_SIZE = 16;
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var ZEROS32 = /* @__PURE__ */ u32(ZEROS16);
+var POLY = 225;
+var mul2 = (s0, s1, s2, s3) => {
+  const hiBit = s3 & 1;
+  return {
+    s3: s2 << 31 | s3 >>> 1,
+    s2: s1 << 31 | s2 >>> 1,
+    s1: s0 << 31 | s1 >>> 1,
+    s0: s0 >>> 1 ^ POLY << 24 & -(hiBit & 1)
+  };
+};
+var swapLE = (n) => (n >>> 0 & 255) << 24 | (n >>> 8 & 255) << 16 | (n >>> 16 & 255) << 8 | n >>> 24 & 255 | 0;
+var estimateWindow = (bytes) => {
+  if (bytes > 64 * 1024)
+    return 8;
+  if (bytes > 1024)
+    return 4;
+  return 2;
+};
+
+class GHASH {
+  blockLen = BLOCK_SIZE;
+  outputLen = BLOCK_SIZE;
+  s0 = 0;
+  s1 = 0;
+  s2 = 0;
+  s3 = 0;
+  finished = false;
+  destroyed = false;
+  t;
+  W;
+  windowSize;
+  constructor(key, expectedLength) {
+    abytes(key, 16, "key");
+    key = copyBytes(key);
+    const kView = createView(key);
+    let k0 = kView.getUint32(0, false);
+    let k1 = kView.getUint32(4, false);
+    let k2 = kView.getUint32(8, false);
+    let k3 = kView.getUint32(12, false);
+    const doubles = [];
+    for (let i = 0;i < 128; i++) {
+      doubles.push({ s0: swapLE(k0), s1: swapLE(k1), s2: swapLE(k2), s3: swapLE(k3) });
+      ({ s0: k0, s1: k1, s2: k2, s3: k3 } = mul2(k0, k1, k2, k3));
+    }
+    const W = estimateWindow(expectedLength || 1024);
+    if (![1, 2, 4, 8].includes(W))
+      throw new Error("ghash: invalid window size, expected 2, 4 or 8");
+    this.W = W;
+    const bits = 128;
+    const windows = bits / W;
+    const windowSize = this.windowSize = 2 ** W;
+    const items = [];
+    for (let w = 0;w < windows; w++) {
+      for (let byte = 0;byte < windowSize; byte++) {
+        let s0 = 0, s1 = 0, s2 = 0, s3 = 0;
+        for (let j = 0;j < W; j++) {
+          const bit = byte >>> W - j - 1 & 1;
+          if (!bit)
+            continue;
+          const { s0: d0, s1: d1, s2: d2, s3: d3 } = doubles[W * w + j];
+          s0 ^= d0, s1 ^= d1, s2 ^= d2, s3 ^= d3;
+        }
+        items.push({ s0, s1, s2, s3 });
+      }
+    }
+    this.t = items;
+  }
+  _updateBlock(s0, s1, s2, s3) {
+    s0 ^= this.s0, s1 ^= this.s1, s2 ^= this.s2, s3 ^= this.s3;
+    const { W, t, windowSize } = this;
+    let o0 = 0, o1 = 0, o2 = 0, o3 = 0;
+    const mask = (1 << W) - 1;
+    let w = 0;
+    for (const num of [s0, s1, s2, s3]) {
+      for (let bytePos = 0;bytePos < 4; bytePos++) {
+        const byte = num >>> 8 * bytePos & 255;
+        for (let bitPos = 8 / W - 1;bitPos >= 0; bitPos--) {
+          const bit = byte >>> W * bitPos & mask;
+          const { s0: e0, s1: e1, s2: e2, s3: e3 } = t[w * windowSize + bit];
+          o0 ^= e0, o1 ^= e1, o2 ^= e2, o3 ^= e3;
+          w += 1;
+        }
+      }
+    }
+    this.s0 = o0;
+    this.s1 = o1;
+    this.s2 = o2;
+    this.s3 = o3;
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    data = copyBytes(data);
+    const b32 = u32(data);
+    const blocks = Math.floor(data.length / BLOCK_SIZE);
+    const left = data.length % BLOCK_SIZE;
+    for (let i = 0;i < blocks; i++) {
+      this._updateBlock(swap8IfBE(b32[i * 4 + 0]), swap8IfBE(b32[i * 4 + 1]), swap8IfBE(b32[i * 4 + 2]), swap8IfBE(b32[i * 4 + 3]));
+    }
+    if (left) {
+      ZEROS16.set(data.subarray(blocks * BLOCK_SIZE));
+      this._updateBlock(swap8IfBE(ZEROS32[0]), swap8IfBE(ZEROS32[1]), swap8IfBE(ZEROS32[2]), swap8IfBE(ZEROS32[3]));
+      clean(ZEROS32);
+    }
+    return this;
+  }
+  destroy() {
+    this.destroyed = true;
+    const { t } = this;
+    for (const elm of t) {
+      elm.s0 = 0, elm.s1 = 0, elm.s2 = 0, elm.s3 = 0;
+    }
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput32(out, this);
+    this.finished = true;
+    const { s0, s1, s2, s3 } = this;
+    const o32 = u32(out);
+    o32[0] = s0;
+    o32[1] = s1;
+    o32[2] = s2;
+    o32[3] = s3;
+    if (!isLE)
+      swap32IfBE(o32.subarray(0, BLOCK_SIZE / 4));
+  }
+  digest() {
+    const res = new Uint8Array(BLOCK_SIZE);
+    this.digestInto(res);
+    this.destroy();
+    return res;
+  }
+}
+var ghash = /* @__PURE__ */ wrapMacConstructor(16, (key, expectedLength) => new GHASH(key, expectedLength), (msg) => [msg.length]);
+
+// ../node_modules/.bun/@noble+ciphers@2.3.0/node_modules/@noble/ciphers/aes.js
+var BLOCK_SIZE2 = 16;
+var BLOCK_SIZE32 = 4;
+var EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE2);
+var POLY2 = 283;
+function validateKeyLength(key) {
+  if (![16, 24, 32].includes(key.length))
+    throw new Error('"aes key" expected Uint8Array of length 16/24/32, got length=' + key.length);
+}
+function mul22(n) {
+  return n << 1 ^ POLY2 & -(n >> 7);
+}
+function mul(a, b) {
+  let res = 0;
+  for (;b > 0; b >>= 1) {
+    res ^= a & -(b & 1);
+    a = mul22(a);
+  }
+  return res;
+}
+var sbox = /* @__PURE__ */ (() => {
+  const t = new Uint8Array(256);
+  for (let i = 0, x = 1;i < 256; i++, x ^= mul22(x))
+    t[i] = x;
+  const box = new Uint8Array(256);
+  box[0] = 99;
+  for (let i = 0;i < 255; i++) {
+    let x = t[255 - i];
+    x |= x << 8;
+    box[t[i]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
+  }
+  clean(t);
+  return box;
+})();
+var rotr32_8 = (n) => n << 24 | n >>> 8;
+var rotl32_8 = (n) => n << 8 | n >>> 24;
+function genTtable(sbox2, fn) {
+  if (sbox2.length !== 256)
+    throw new Error("wrong sbox length");
+  const T0 = new Uint32Array(256).map((_, j) => fn(sbox2[j]));
+  const T1 = T0.map(rotl32_8);
+  const T2 = T1.map(rotl32_8);
+  const T3 = T2.map(rotl32_8);
+  const T01 = new Uint32Array(256 * 256);
+  const T23 = new Uint32Array(256 * 256);
+  const sbox22 = new Uint16Array(256 * 256);
+  for (let i = 0;i < 256; i++) {
+    for (let j = 0;j < 256; j++) {
+      const idx = i * 256 + j;
+      T01[idx] = T0[i] ^ T1[j];
+      T23[idx] = T2[i] ^ T3[j];
+      sbox22[idx] = sbox2[i] << 8 | sbox2[j];
+    }
+  }
+  return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
+}
+var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => mul(s, 3) << 24 | s << 16 | s << 8 | mul(s, 2));
+var xPowers = /* @__PURE__ */ (() => {
+  const p = new Uint8Array(16);
+  for (let i = 0, x = 1;i < 16; i++, x = mul22(x))
+    p[i] = x;
+  return p;
+})();
+function expandKeyLE(key) {
+  abytes(key);
+  const len = key.length;
+  validateKeyLength(key);
+  const { sbox2 } = tableEncoding;
+  const toClean = [];
+  if (!isLE || !isAligned32(key))
+    toClean.push(key = copyBytes(key));
+  const k32 = swap32IfBE(u32(key));
+  const Nk = k32.length;
+  const subByte = (n) => applySbox(sbox2, n, n, n, n);
+  const xk = new Uint32Array(len + 28);
+  xk.set(k32);
+  for (let i = Nk;i < xk.length; i++) {
+    let t = xk[i - 1];
+    if (i % Nk === 0)
+      t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
+    else if (Nk > 6 && i % Nk === 4)
+      t = subByte(t);
+    xk[i] = xk[i - Nk] ^ t;
+  }
+  clean(...toClean);
+  return xk;
+}
+function apply0123(T01, T23, s0, s1, s2, s3) {
+  return T01[s0 << 8 & 65280 | s1 >>> 8 & 255] ^ T23[s2 >>> 8 & 65280 | s3 >>> 24 & 255];
+}
+function applySbox(sbox2, s0, s1, s2, s3) {
+  return sbox2[s0 & 255 | s1 & 65280] | sbox2[s2 >>> 16 & 255 | s3 >>> 16 & 65280] << 16;
+}
+function encrypt(xk, s0, s1, s2, s3) {
+  const { sbox2, T01, T23 } = tableEncoding;
+  let k = 0;
+  s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
+  const rounds = xk.length / 4 - 2;
+  for (let i = 0;i < rounds; i++) {
+    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+  }
+  const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
+  const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
+  const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);
+  const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);
+  return { s0: t0, s1: t1, s2: t2, s3: t3 };
+}
+function ctr32(xk, isLE2, nonce, src, dst) {
+  abytes(nonce, BLOCK_SIZE2, "nonce");
+  abytes(src);
+  dst = getOutput(src.length, dst);
+  const ctr = nonce;
+  const c32 = u32(ctr);
+  const view = createView(ctr);
+  const src32 = u32(src);
+  const dst32 = u32(dst);
+  const ctrPos = isLE2 ? 0 : 12;
+  const srcLen = src.length;
+  let ctrNum = view.getUint32(ctrPos, isLE2);
+  for (let i = 0;i + 4 <= src32.length; i += 4) {
+    const { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));
+    dst32[i + 0] = src32[i + 0] ^ swap8IfBE(s0);
+    dst32[i + 1] = src32[i + 1] ^ swap8IfBE(s1);
+    dst32[i + 2] = src32[i + 2] ^ swap8IfBE(s2);
+    dst32[i + 3] = src32[i + 3] ^ swap8IfBE(s3);
+    ctrNum = ctrNum + 1 >>> 0;
+    view.setUint32(ctrPos, ctrNum, isLE2);
+  }
+  const start = BLOCK_SIZE2 * Math.floor(src32.length / BLOCK_SIZE32);
+  if (start < srcLen) {
+    const { s0, s1, s2, s3 } = encrypt(xk, swap8IfBE(c32[0]), swap8IfBE(c32[1]), swap8IfBE(c32[2]), swap8IfBE(c32[3]));
+    const b32 = new Uint32Array([s0, s1, s2, s3]);
+    swap32IfBE(b32);
+    const buf = u8(b32);
+    for (let i = start, pos = 0;i < srcLen; i++, pos++)
+      dst[i] = src[i] ^ buf[pos];
+    clean(b32);
+  }
+  return dst;
+}
+function computeTag(fn, isLE2, key, data, AAD) {
+  const aadLength = AAD ? AAD.length : 0;
+  const h = fn.create(key, data.length + aadLength);
+  if (AAD)
+    h.update(AAD);
+  const num = u64Lengths(8 * data.length, 8 * aadLength, isLE2);
+  h.update(data);
+  h.update(num);
+  const res = h.digest();
+  clean(num);
+  return res;
+}
+var gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, withAAD: true, varSizeNonce: true }, function aesgcm(key, nonce, AAD) {
+  if (nonce.length < 8)
+    throw new Error("aes/gcm: invalid nonce length");
+  const tagLength = 16;
+  function _computeTag(authKey, tagMask, data) {
+    const tag = computeTag(ghash, false, authKey, data, AAD);
+    for (let i = 0;i < tagMask.length; i++)
+      tag[i] ^= tagMask[i];
+    return tag;
+  }
+  function deriveKeys() {
+    const xk = expandKeyLE(key);
+    const authKey = EMPTY_BLOCK.slice();
+    const counter = EMPTY_BLOCK.slice();
+    ctr32(xk, false, counter, counter, authKey);
+    if (nonce.length === 12) {
+      counter.set(nonce);
+    } else {
+      const nonceLen = EMPTY_BLOCK.slice();
+      const view = createView(nonceLen);
+      view.setBigUint64(8, BigInt(nonce.length * 8), false);
+      const g = ghash.create(authKey).update(nonce).update(nonceLen);
+      g.digestInto(counter);
+      g.destroy();
+    }
+    const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);
+    return { xk, authKey, counter, tagMask };
+  }
+  return {
+    encrypt(plaintext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys();
+      const out = new Uint8Array(plaintext.length + tagLength);
+      const toClean = [xk, authKey, counter, tagMask];
+      if (!isAligned32(plaintext))
+        toClean.push(plaintext = copyBytes(plaintext));
+      ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));
+      const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));
+      toClean.push(tag);
+      out.set(tag, plaintext.length);
+      clean(...toClean);
+      return out;
+    },
+    decrypt(ciphertext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys();
+      const toClean = [xk, authKey, tagMask, counter];
+      if (!isAligned32(ciphertext))
+        toClean.push(ciphertext = copyBytes(ciphertext));
+      const data = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = _computeTag(authKey, tagMask, data);
+      toClean.push(tag);
+      if (!equalBytes(tag, passedTag)) {
+        clean(...toClean);
+        throw new Error("aes-gcm: invalid tag");
+      }
+      const out = ctr32(xk, false, counter, data);
+      clean(...toClean);
+      return out;
+    }
+  };
+});
+
+// src/index.ts
+var textEncoder = new TextEncoder;
+var textDecoder = new TextDecoder;
+var base64 = (value) => {
+  let binary = "";
+  for (const byte of value)
+    binary += String.fromCharCode(byte);
+  return btoa(binary);
+};
+var unbase64 = (value) => Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+var createCapacitorSyncProtection = (options = {}) => {
+  const storage = options.secureStorage ?? createCapacitorSecureStorage({ prefix: "absolutejs.sync." });
+  const keyName = "data-key.v1";
+  return {
+    prepare: async () => {
+      const capability = await storage.capability();
+      if (!capability.available)
+        throw new Error("Native Sync data protection requires persistent Keychain/Keystore storage.");
+      const load = async () => {
+        const existing = await storage.get(keyName);
+        if (existing)
+          return unbase64(existing);
+        const created = randomBytes(32);
+        await storage.set(keyName, base64(created));
+        return created;
+      };
+      const key = storage.withLock ? await storage.withLock(keyName, load) : await load();
+      if (key.byteLength !== 32)
+        throw new Error("Native Sync data-protection key is invalid.");
+      const additionalData = (context) => textEncoder.encode(`absolute-sync-v1\x00${context.kind}\x00${context.namespace}\x00${context.name}`);
+      return {
+        id: "aes-256-gcm-v1",
+        open: (value, context) => {
+          const bytes = unbase64(value);
+          const nonce = bytes.slice(0, 12);
+          return textDecoder.decode(gcm(key, nonce, additionalData(context)).decrypt(bytes.slice(12)));
+        },
+        seal: (value, context) => {
+          const nonce = randomBytes(12);
+          const encrypted = gcm(key, nonce, additionalData(context)).encrypt(textEncoder.encode(value));
+          const output = new Uint8Array(nonce.length + encrypted.length);
+          output.set(nonce);
+          output.set(encrypted, nonce.length);
+          return base64(output);
+        }
+      };
+    }
+  };
+};
 var AbsoluteBackgroundSync = registerPlugin("AbsoluteBackgroundSync");
 var configureCapacitorBackgroundSync = (options, plugin = AbsoluteBackgroundSync) => plugin.configure(options);
 var SCHEMA = `
@@ -45,19 +631,36 @@ var firstString = (rows, field) => {
   const value = rows?.[0]?.[field];
   return typeof value === "string" ? value : undefined;
 };
-var parseRecord = (value, label) => {
+var parseRecord = (value, label, context, protector) => {
   if (value === undefined)
     return;
   if (typeof value !== "string")
     throw new Error(`Capacitor Sync SQLite returned invalid ${label} JSON.`);
   try {
-    return JSON.parse(value);
+    const parsed = JSON.parse(value);
+    if (typeof parsed === "object" && parsed !== null && "__absoluteSyncProtected" in parsed) {
+      const envelope = parsed.__absoluteSyncProtected;
+      if (!context || !protector || protector.id !== envelope.protector)
+        throw new Error(`Capacitor Sync ${label} requires unavailable protection provider "${envelope.protector}".`);
+      return JSON.parse(protector.open(envelope.value, {
+        ...context,
+        name: envelope.name
+      }));
+    }
+    return parsed;
   } catch (cause) {
     throw new Error(`Capacitor Sync SQLite could not parse ${label} JSON.`, {
       cause
     });
   }
 };
+var serializeRecord = (value, context, protector) => protector ? JSON.stringify({
+  __absoluteSyncProtected: {
+    name: context.name,
+    protector: protector.id,
+    value: protector.seal(JSON.stringify(value), context)
+  }
+}) : JSON.stringify(value);
 var defaultConnection = async (databaseName) => {
   const sqlite = new SQLiteConnection(CapacitorSQLite);
   const existing = await sqlite.isConnection(databaseName, false);
@@ -72,12 +675,17 @@ var requireNamespace = (namespace) => {
 var createCapacitorSyncLocalStore = ({
   databaseName = "absolutejs-sync-local-v1",
   connection: createConnection = () => defaultConnection(databaseName),
-  storageSchema = { version: 1 }
+  storageSchema = { version: 1 },
+  protection,
+  now = Date.now
 } = {}) => {
   if (databaseName.length === 0)
     throw new TypeError("Capacitor Sync databaseName cannot be empty.");
+  const localData = resolveSyncLocalDataPolicy(storageSchema);
+  let protectorPromise;
+  const prepareProtector = () => protectorPromise ??= protection?.prepare();
   let schemaStatus;
-  const prepareSchema = async (database) => {
+  const prepareSchema = async (database, protector) => {
     await database.beginTransaction();
     try {
       const legacySaved = (await database.query("SELECT logical_version FROM absolute_sync_schema WHERE singleton_id = 1 LIMIT 1")).values?.[0]?.logical_version;
@@ -99,14 +707,22 @@ var createCapacitorSyncLocalStore = ({
           const key = row.collection_key;
           if (typeof namespace !== "string" || typeof key !== "string")
             throw new Error("Capacitor Sync SQLite returned an invalid collection identity.");
-          const record = parseRecord(row.record_json, "collection");
+          const record = parseRecord(row.record_json, "collection", { kind: "collection", namespace }, protector);
           if (record === undefined)
             throw new Error("Capacitor Sync SQLite returned a missing collection record.");
           const migrated = migrateSyncLocalCollectionRecord(record, { key, namespace }, steps);
           if (migrated === null)
             await database.run("DELETE FROM absolute_sync_collections WHERE namespace = ? AND collection_key = ?", [namespace, key], false);
           else
-            await database.run("UPDATE absolute_sync_collections SET record_json = ? WHERE namespace = ? AND collection_key = ?", [JSON.stringify(migrated), namespace, key], false);
+            await database.run("UPDATE absolute_sync_collections SET record_json = ? WHERE namespace = ? AND collection_key = ?", [
+              serializeRecord(migrated, {
+                kind: "collection",
+                name: migrated.collection ?? key,
+                namespace
+              }, protector),
+              namespace,
+              key
+            ], false);
         }
         const mutations = (await database.query("SELECT namespace, operation_id, record_json FROM absolute_sync_mutations ORDER BY namespace, operation_id")).values;
         for (const row of mutations ?? []) {
@@ -114,7 +730,7 @@ var createCapacitorSyncLocalStore = ({
           const operationId = row.operation_id;
           if (typeof namespace !== "string" || typeof operationId !== "string")
             throw new Error("Capacitor Sync SQLite returned an invalid mutation identity.");
-          const record = parseRecord(row.record_json, "mutation");
+          const record = parseRecord(row.record_json, "mutation", { kind: "mutation", namespace }, protector);
           if (record === undefined)
             throw new Error("Capacitor Sync SQLite returned a missing mutation record.");
           const migrated = migrateSyncLocalMutationRecord(record, { key: operationId, namespace }, steps);
@@ -123,7 +739,11 @@ var createCapacitorSyncLocalStore = ({
           else
             await database.run("UPDATE absolute_sync_mutations SET created_at = ?, record_json = ? WHERE namespace = ? AND operation_id = ?", [
               migrated.createdAt,
-              JSON.stringify(migrated),
+              serializeRecord(migrated, {
+                kind: "mutation",
+                name: migrated.name,
+                namespace
+              }, protector),
               namespace,
               operationId
             ], false);
@@ -147,9 +767,12 @@ var createCapacitorSyncLocalStore = ({
   };
   let connectionPromise;
   const connection = () => {
-    connectionPromise ??= Promise.resolve(createConnection()).then(async (database) => {
+    connectionPromise ??= Promise.all([
+      Promise.resolve(createConnection()),
+      prepareProtector()
+    ]).then(async ([database, protector]) => {
       await database.execute(SCHEMA);
-      await prepareSchema(database);
+      await prepareSchema(database, protector);
       return database;
     });
     return connectionPromise;
@@ -172,6 +795,7 @@ var createCapacitorSyncLocalStore = ({
     requireNamespace(namespace);
     return locked(async () => {
       const database = await connection();
+      const protector = await prepareProtector();
       await database.beginTransaction();
       const writable = () => {
         if (mode !== "readwrite")
@@ -185,18 +809,26 @@ var createCapacitorSyncLocalStore = ({
             throw new Error("Sync installation id must not be empty");
           await database.run("INSERT INTO absolute_sync_metadata (namespace, installation_id) VALUES (?, ?) ON CONFLICT(namespace) DO UPDATE SET installation_id = excluded.installation_id", [namespace, installationId], false);
         },
-        getCollection: async (key) => parseRecord((await database.query("SELECT record_json FROM absolute_sync_collections WHERE namespace = ? AND collection_key = ? LIMIT 1", [namespace, key])).values?.[0]?.record_json, "collection"),
+        getCollection: async (key) => parseRecord((await database.query("SELECT record_json FROM absolute_sync_collections WHERE namespace = ? AND collection_key = ? LIMIT 1", [namespace, key])).values?.[0]?.record_json, "collection", { kind: "collection", namespace }, protector),
         listCollections: async () => {
           const rows = (await database.query("SELECT collection_key, record_json FROM absolute_sync_collections WHERE namespace = ? ORDER BY collection_key ASC", [namespace])).values;
           return (rows ?? []).map((row) => {
             const key = row.collection_key;
-            const record = parseRecord(row.record_json, "collection");
+            const record = parseRecord(row.record_json, "collection", { kind: "collection", namespace }, protector);
             return typeof key === "string" && record ? { key, record } : undefined;
           }).filter((entry) => entry !== undefined);
         },
         putCollection: async (key, record) => {
           writable();
-          await database.run("INSERT INTO absolute_sync_collections (namespace, collection_key, record_json) VALUES (?, ?, ?) ON CONFLICT(namespace, collection_key) DO UPDATE SET record_json = excluded.record_json", [namespace, key, JSON.stringify(record)], false);
+          await database.run("INSERT INTO absolute_sync_collections (namespace, collection_key, record_json) VALUES (?, ?, ?) ON CONFLICT(namespace, collection_key) DO UPDATE SET record_json = excluded.record_json", [
+            namespace,
+            key,
+            serializeRecord(record, {
+              kind: "collection",
+              name: record.collection ?? key,
+              namespace
+            }, protector)
+          ], false);
         },
         deleteCollection: async (key) => {
           writable();
@@ -204,16 +836,20 @@ var createCapacitorSyncLocalStore = ({
         },
         listMutations: async () => {
           const rows = (await database.query("SELECT record_json FROM absolute_sync_mutations WHERE namespace = ? ORDER BY created_at ASC, operation_id ASC", [namespace])).values;
-          return (rows ?? []).map((row) => parseRecord(row.record_json, "mutation")).filter((record) => record !== undefined);
+          return (rows ?? []).map((row) => parseRecord(row.record_json, "mutation", { kind: "mutation", namespace }, protector)).filter((record) => record !== undefined);
         },
-        getMutation: async (operationId) => parseRecord((await database.query("SELECT record_json FROM absolute_sync_mutations WHERE namespace = ? AND operation_id = ? LIMIT 1", [namespace, operationId])).values?.[0]?.record_json, "mutation"),
+        getMutation: async (operationId) => parseRecord((await database.query("SELECT record_json FROM absolute_sync_mutations WHERE namespace = ? AND operation_id = ? LIMIT 1", [namespace, operationId])).values?.[0]?.record_json, "mutation", { kind: "mutation", namespace }, protector),
         putMutation: async (record) => {
           writable();
           await database.run("INSERT INTO absolute_sync_mutations (namespace, operation_id, created_at, record_json) VALUES (?, ?, ?, ?) ON CONFLICT(namespace, operation_id) DO UPDATE SET created_at = excluded.created_at, record_json = excluded.record_json", [
             namespace,
             record.operationId,
             record.createdAt,
-            JSON.stringify(record)
+            serializeRecord(record, {
+              kind: "mutation",
+              name: record.name,
+              namespace
+            }, protector)
           ], false);
         },
         deleteMutation: async (operationId) => {
@@ -222,7 +858,14 @@ var createCapacitorSyncLocalStore = ({
         }
       };
       try {
-        const result = await run(tx);
+        const result = await runSyncLocalPolicyTransaction({
+          mode,
+          now: now(),
+          policy: localData,
+          protected: protector !== undefined,
+          raw: tx,
+          run
+        });
         await database.commitTransaction();
         return result;
       } catch (error) {
@@ -296,10 +939,11 @@ var installCapacitorSyncLifecycle = async ({
 };
 export {
   installCapacitorSyncLifecycle,
+  createCapacitorSyncProtection,
   createCapacitorSyncLocalStore,
   configureCapacitorBackgroundSync,
   AbsoluteBackgroundSync
 };
 
-//# debugId=F21A450F9CF54D0C64756E2164756E21
+//# debugId=6ED4C90ACCDBBE6464756E2164756E21
 //# sourceMappingURL=index.js.map