@auxilium/datalynk-client 1.6.2 → 1.6.4

package/dist/index.mjs

@@ -189,6 +189,8 @@ class Database {
   constructor(database, tables, version2) {
     __publicField(this, "connection");
     __publicField(this, "tables");
+    /** Encrypts values at rest when set */
+    __publicField(this, "cipher");
     this.database = database;
     this.version = version2;
     this.tables = tables.map((table) => typeof table === "object" ? { ...table, name: table.name.toString() } : { name: table.toString() });
@@ -237,22 +239,46 @@ class Table {
   async tx(operation, readonly = false) {
     const db = await this.database.connection;
     return new Promise((resolve, reject) => {
-      const request = operation(db.transaction(this.name, readonly ? "readonly" : "readwrite").objectStore(this.name));
-      request.onsuccess = () => resolve(request.result);
-      request.onerror = () => reject(request.error);
+      const transaction = db.transaction(this.name, readonly ? "readonly" : "readwrite");
+      let result;
+      transaction.oncomplete = () => resolve(result);
+      transaction.onabort = () => reject(transaction.error || new Error("IndexedDB transaction aborted"));
+      transaction.onerror = () => reject(transaction.error || new Error("IndexedDB transaction failed"));
+      try {
+        const request = operation(transaction.objectStore(this.name));
+        request.onsuccess = () => {
+          result = request.result;
+        };
+        request.onerror = () => reject(request.error || new Error("IndexedDB request failed"));
+      } catch (error) {
+        transaction.abort();
+        reject(error);
+      }
     });
   }
-  add(value, key) {
-    return this.tx((store) => store.add(value, key));
+  seal(value) {
+    const cipher = this.database.cipher;
+    return (cipher == null ? void 0 : cipher.enabled) ? cipher.seal(value) : Promise.resolve(value);
+  }
+  open(value) {
+    const cipher = this.database.cipher;
+    return cipher ? cipher.open(value) : Promise.resolve(value);
   }
-  put(key, value) {
-    return this.tx((store) => store.put(value, key));
+  async add(value, key) {
+    const sealed = await this.seal(value);
+    return this.tx((store) => store.add(sealed, key));
   }
-  get(key) {
-    return this.tx((store) => store.get(key), true);
+  async put(key, value) {
+    const sealed = await this.seal(value);
+    return this.tx((store) => store.put(sealed, key));
   }
-  getAll() {
-    return this.tx((store) => store.getAll(), true);
+  async get(key) {
+    return await this.open(await this.tx((store) => store.get(key), true));
+  }
+  /** All readable values. Values sealed with another key are skipped. */
+  async getAll() {
+    const values = await Promise.all((await this.tx((store) => store.getAll(), true)).map((v) => this.open(v)));
+    return values.filter((v) => v !== void 0);
   }
   getAllKeys() {
     return this.tx((store) => store.getAllKeys(), true);
@@ -263,6 +289,20 @@ class Table {
   clear() {
     return this.tx((store) => store.clear());
   }
+  /** Replace the whole table in one transaction (values are sealed first, so nothing is lost while locked) */
+  async replace(entries) {
+    const sealed = await Promise.all(entries.map(async ([key, value]) => [key, await this.seal(value)]));
+    const db = await this.database.connection;
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(this.name, "readwrite");
+      const store = tx.objectStore(this.name);
+      store.clear();
+      sealed.forEach(([key, value]) => store.put(value, key));
+      tx.oncomplete = () => resolve();
+      tx.onerror = () => reject(tx.error);
+      tx.onabort = () => reject(tx.error);
+    });
+  }
   count() {
     return this.tx((store) => store.count(), true);
   }
@@ -1016,6 +1056,9 @@ var BehaviorSubject = function(_super) {
   };
   return BehaviorSubject2;
 }(Subject);
+var EMPTY = new Observable(function(subscriber) {
+  return subscriber.complete();
+});
 var EmptyError = createErrorClass(function(_super) {
   return function EmptyErrorImpl() {
     _super(this);
@@ -1043,6 +1086,23 @@ function lastValueFrom(source, config2) {
     });
   });
 }
+function firstValueFrom(source, config2) {
+  return new Promise(function(resolve, reject) {
+    var subscriber = new SafeSubscriber({
+      next: function(value) {
+        resolve(value);
+        subscriber.unsubscribe();
+      },
+      error: reject,
+      complete: function() {
+        {
+          reject(new EmptyError());
+        }
+      }
+    });
+    source.subscribe(subscriber);
+  });
+}
 function filter(predicate, thisArg) {
   return operate(function(source, subscriber) {
     var index = 0;
@@ -1051,6 +1111,21 @@ function filter(predicate, thisArg) {
     }));
   });
 }
+function take(count) {
+  return count <= 0 ? function() {
+    return EMPTY;
+  } : operate(function(source, subscriber) {
+    var seen = 0;
+    source.subscribe(createOperatorSubscriber(subscriber, function(value) {
+      if (++seen <= count) {
+        subscriber.next(value);
+        if (count <= seen) {
+          subscriber.complete();
+        }
+      }
+    }));
+  });
+}
 function distinctUntilChanged(comparator, keySelector) {
   if (keySelector === void 0) {
     keySelector = identity;
@@ -1532,52 +1607,304 @@ __publicField(_LoginPrompt, "template", (options) => {
 	`;
 });
 let LoginPrompt = _LoginPrompt;
-const KEY = "datalynk-offline-login";
+const RECORD_KEY = "datalynk-offline-login";
+const PROFILE_KEY = "datalynk-user";
+const VAULT_DB = "datalynk-vault";
+const VAULT_STORE = "keys";
+const DEVICE_KEY = "device";
 const ITERATIONS = 31e4;
-async function hash(password, salt) {
-  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
-  return Array.from(new Uint8Array(await crypto.subtle.deriveBits(
-    { name: "PBKDF2", salt: new Uint8Array(salt), iterations: ITERATIONS, hash: "SHA-256" },
-    key,
-    256
-  )));
-}
-async function rememberOfflineLogin(realm, login, uid, password) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const record = { realm, login: login.trim().toLowerCase(), uid, salt: Array.from(salt), hash: await hash(password, salt) };
-  localStorage.setItem(KEY, JSON.stringify(record));
-}
-async function verifyOfflineLogin(realm, login, uid, password) {
-  const saved = localStorage.getItem(KEY);
-  if (!saved) return false;
-  let record;
-  try {
-    record = JSON.parse(saved);
-  } catch {
-    return false;
-  }
-  if (record.realm !== realm || record.login !== login.trim().toLowerCase() || record.uid !== uid || !Array.isArray(record.salt) || !Array.isArray(record.hash)) return false;
-  const candidate = await hash(password, new Uint8Array(record.salt));
-  if (candidate.length !== record.hash.length) return false;
-  let difference = 0;
-  for (let i = 0; i < candidate.length; i++) difference |= candidate[i] ^ record.hash[i];
-  return difference === 0;
+const DAY = 864e5;
+const offlineLoginMessages = {
+  "none": "Offline login is not available on this device. Connect to the internet to sign in.",
+  "wrong-user": "Offline login is only available for the last user who signed in on this device.",
+  "expired": "Offline login has expired on this device. Connect to the internet to sign in.",
+  "locked": "Offline login is locked after too many attempts. Connect to the internet to sign in.",
+  "bad-password": "Incorrect password."
+};
+const toB64 = (bytes) => {
+  let out = "";
+  new Uint8Array(bytes).forEach((b) => out += String.fromCharCode(b));
+  return btoa(out);
+};
+const fromB64 = (text) => Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+const normalizeLogin = (login) => (login || "").trim().toLowerCase();
+function isSealed(value) {
+  return !!value && typeof value == "object" && value.__dlv === 1 && "iv" in value && "ct" in value;
 }
-function hasOfflineLogin(realm, uid) {
-  try {
-    const record = JSON.parse(localStorage.getItem(KEY) || "null");
-    return (record == null ? void 0 : record.realm) === realm && (record == null ? void 0 : record.uid) === uid;
-  } catch {
-    return false;
+class OfflineVault {
+  constructor(enabled, options = {}, startOffline) {
+    /** False when offline login is disabled or the environment lacks WebCrypto/IndexedDB/localStorage */
+    __publicField(this, "enabled");
+    /** True once the data key is available in memory */
+    __publicField(this, "unlocked$", new BehaviorSubject(false));
+    /** Resolves once startup key loading has finished */
+    __publicField(this, "ready");
+    __publicField(this, "dek", null);
+    __publicField(this, "days");
+    __publicField(this, "attempts");
+    this.enabled = enabled && typeof crypto != "undefined" && !!crypto.subtle && typeof indexedDB != "undefined" && typeof localStorage != "undefined";
+    this.days = options.days ?? 7;
+    this.attempts = options.attempts ?? 5;
+    if (startOffline === void 0) startOffline = typeof navigator != "undefined" && navigator.onLine === false;
+    this.ready = this.enabled ? this.init(startOffline).catch((error) => {
+      console.error("Unable to open the Datalynk offline vault", error);
+    }) : Promise.resolve();
+  }
+  get unlocked() {
+    return this.unlocked$.getValue();
+  }
+  /** A saved offline login exists, but this session has not unlocked it yet */
+  get needsPassword() {
+    return this.enabled && !this.unlocked && !!this.readRecord();
+  }
+  /** Wait until the data key is available (resolves immediately when the vault is disabled) */
+  whenUnlocked() {
+    if (!this.enabled || this.unlocked) return Promise.resolve(true);
+    return firstValueFrom(this.unlocked$.pipe(filter(Boolean)));
+  }
+  /** Saved offline login matches this user */
+  has(realm, uid) {
+    const record = this.readRecord();
+    return !!record && record.realm === realm && record.uid === uid;
+  }
+  /**
+   * Called after a successful online password login. Wraps the data key with the
+   * password so this user can sign in offline later.
+   */
+  async rememberLogin(realm, login, uid, password) {
+    if (!this.enabled) return;
+    await this.ready;
+    const record = this.readRecord();
+    let dek = null;
+    if (record && record.realm === realm && record.uid === uid) {
+      dek = await this.unwrapWithPassword(record, password).catch(() => null);
+      if (!dek) dek = this.dek;
+    } else if (!record) {
+      dek = this.dek;
+    }
+    if (!dek) dek = await this.newDataKey();
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const kek = await this.passwordKey(password, salt);
+    const wrapped = await crypto.subtle.wrapKey("raw", dek, kek, { name: "AES-GCM", iv });
+    this.writeRecord({
+      v: 2,
+      realm,
+      uid,
+      login: normalizeLogin(login),
+      salt: toB64(salt),
+      iv: toB64(iv),
+      wrapped: toB64(wrapped),
+      verifiedAt: Date.now(),
+      failures: 0
+    });
+    await this.setKey(dek);
+  }
+  /** Try to unlock offline with a password */
+  async unlockOffline(realm, login, uid, password) {
+    if (!this.enabled) return "none";
+    await this.ready;
+    const record = this.readRecord();
+    if (!record) return "none";
+    if (record.realm !== realm || record.login !== normalizeLogin(login) || uid != null && record.uid !== uid) return "wrong-user";
+    if (record.locked) return "locked";
+    if (Date.now() - record.verifiedAt > this.days * DAY) return "expired";
+    try {
+      const dek = await this.unwrapWithPassword(record, password);
+      this.writeRecord({ ...record, failures: 0 });
+      await this.setKey(dek);
+      return "ok";
+    } catch {
+      const failures = (record.failures || 0) + 1;
+      const locked = failures >= this.attempts;
+      this.writeRecord({ ...record, failures, locked });
+      return locked ? "locked" : "bad-password";
+    }
+  }
+  /** The server confirmed this user's session: restart the offline window */
+  touch(realm, uid) {
+    if (!this.enabled || realm == null || uid == null) return;
+    const record = this.readRecord();
+    if (record && record.realm === realm && record.uid === uid) this.writeRecord({ ...record, verifiedAt: Date.now() });
+  }
+  /** Drop the in-memory and device keys but keep the password copy (queued work stays recoverable) */
+  async lock() {
+    this.dek = null;
+    if (this.unlocked) this.unlocked$.next(false);
+    if (this.enabled) await this.deleteDevice();
+  }
+  /** Remove offline login completely; anything sealed becomes unreadable */
+  async forget() {
+    if (typeof localStorage != "undefined") {
+      localStorage.removeItem(RECORD_KEY);
+      localStorage.removeItem(PROFILE_KEY);
+    }
+    await this.lock();
+  }
+  /** Encrypt a value for IndexedDB (passes through when disabled) */
+  async seal(value) {
+    if (!this.enabled || value === void 0) return value;
+    await this.whenUnlocked();
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, this.dek, new TextEncoder().encode(JSON.stringify(value)));
+    return { __dlv: 1, iv, ct };
+  }
+  /** Decrypt a value from IndexedDB. Unreadable values (old key / other user) return undefined. */
+  async open(value) {
+    if (!isSealed(value)) return value;
+    if (!this.enabled) return void 0;
+    await this.whenUnlocked();
+    try {
+      const iv = typeof value.iv == "string" ? fromB64(value.iv) : value.iv;
+      const ct = typeof value.ct == "string" ? fromB64(value.ct) : value.ct;
+      const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, this.dek, ct);
+      return JSON.parse(new TextDecoder().decode(plain));
+    } catch {
+      return void 0;
+    }
+  }
+  /** Save the cached user profile (sealed when enabled) */
+  async setProfile(user) {
+    if (typeof localStorage == "undefined") return;
+    if (user == null) return localStorage.removeItem(PROFILE_KEY);
+    if (!this.enabled) return localStorage.setItem(PROFILE_KEY, JSON.stringify(user));
+    const sealed = await this.seal(user);
+    localStorage.setItem(PROFILE_KEY, JSON.stringify({ __dlv: 1, iv: toB64(sealed.iv), ct: toB64(sealed.ct) }));
+  }
+  /** Read the cached user profile; null while locked */
+  async getProfile() {
+    if (typeof localStorage == "undefined") return null;
+    let saved;
+    try {
+      saved = JSON.parse(localStorage.getItem(PROFILE_KEY) || "null");
+    } catch {
+      return null;
+    }
+    if (!isSealed(saved)) return this.enabled ? null : saved;
+    if (!this.unlocked) return null;
+    return await this.open(saved) ?? null;
+  }
+  // ----- internals -----
+  async init(startOffline) {
+    if (startOffline) {
+      await this.deleteDevice();
+      return;
+    }
+    const device = await this.readDevice();
+    if (device) {
+      try {
+        const dek = await crypto.subtle.unwrapKey(
+          "raw",
+          device.wrapped,
+          device.key,
+          { name: "AES-GCM", iv: device.iv },
+          { name: "AES-GCM" },
+          true,
+          ["encrypt", "decrypt"]
+        );
+        this.dek = dek;
+        this.unlocked$.next(true);
+        return;
+      } catch {
+        await this.deleteDevice();
+      }
+    }
+    if (!this.readRecord()) await this.setKey(await this.newDataKey());
+  }
+  async setKey(dek) {
+    this.dek = dek;
+    try {
+      await this.writeDevice(dek);
+    } catch (error) {
+      console.warn("Unable to store the Datalynk device key; offline data will need the password", error);
+    }
+    if (!this.unlocked) this.unlocked$.next(true);
+  }
+  newDataKey() {
+    return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+  }
+  async passwordKey(password, salt) {
+    const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey(
+      { name: "PBKDF2", salt, iterations: ITERATIONS, hash: "SHA-256" },
+      base,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["wrapKey", "unwrapKey"]
+    );
+  }
+  async unwrapWithPassword(record, password) {
+    const kek = await this.passwordKey(password, fromB64(record.salt));
+    return crypto.subtle.unwrapKey(
+      "raw",
+      fromB64(record.wrapped),
+      kek,
+      { name: "AES-GCM", iv: fromB64(record.iv) },
+      { name: "AES-GCM" },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  }
+  readRecord() {
+    if (typeof localStorage == "undefined") return null;
+    try {
+      const record = JSON.parse(localStorage.getItem(RECORD_KEY) || "null");
+      if ((record == null ? void 0 : record.v) === 2) return record;
+      if (record) localStorage.removeItem(RECORD_KEY);
+    } catch {
+      localStorage.removeItem(RECORD_KEY);
+    }
+    return null;
+  }
+  writeRecord(record) {
+    localStorage.setItem(RECORD_KEY, JSON.stringify(record));
+  }
+  vaultDb() {
+    return new Promise((resolve, reject) => {
+      const request = indexedDB.open(VAULT_DB, 1);
+      request.onupgradeneeded = () => request.result.createObjectStore(VAULT_STORE);
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  }
+  async vaultTx(mode, op) {
+    const db = await this.vaultDb();
+    try {
+      return await new Promise((resolve, reject) => {
+        const tx = db.transaction(VAULT_STORE, mode);
+        const request = op(tx.objectStore(VAULT_STORE));
+        tx.oncomplete = () => resolve(request.result);
+        tx.onerror = () => reject(tx.error);
+        tx.onabort = () => reject(tx.error);
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async readDevice() {
+    try {
+      return await this.vaultTx("readonly", (store) => store.get(DEVICE_KEY)) || null;
+    } catch {
+      return null;
+    }
+  }
+  async writeDevice(dek) {
+    const key = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["wrapKey", "unwrapKey"]);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const wrapped = await crypto.subtle.wrapKey("raw", dek, key, { name: "AES-GCM", iv });
+    await this.vaultTx("readwrite", (store) => store.put({ key, iv, wrapped }, DEVICE_KEY));
+  }
+  async deleteDevice() {
+    try {
+      await this.vaultTx("readwrite", (store) => store.delete(DEVICE_KEY));
+    } catch (error) {
+      console.warn("Unable to remove the Datalynk device key", error);
+    }
   }
-}
-function forgetOfflineLogin() {
-  localStorage.removeItem(KEY);
 }
 class Auth {
   constructor(api) {
     __publicField(this, "onlinePrompt");
-    __publicField(this, "offlineUnlocked", false);
     __publicField(this, "wasOffline", false);
     /** Current user as an observable */
     __publicField(this, "user$", new BehaviorSubject(void 0));
@@ -1587,21 +1914,12 @@ class Auth {
       if (status === "offline" || status === "unavailable") this.wasOffline = true;
       if (status !== "online" || !this.wasOffline) return;
       this.wasOffline = false;
-      const wasUnlocked = this.offlineUnlocked;
       const previousUser = this.user;
-      this.offlineUnlocked = false;
-      this.user = void 0;
       try {
-        const user = await this.current();
-        const identity2 = this.api.jwtPayload;
-        if (!user || user.guest || !identity2 || !hasOfflineLogin(identity2.realm, identity2.uid))
-          forgetOfflineLogin();
-        this.user = user;
+        this.user = await this.current(this.api.token, true);
       } catch (error) {
-        if (this.api.status === "unauthorized") forgetOfflineLogin();
-        else {
+        if (this.api.status !== "unauthorized") {
           this.wasOffline = true;
-          this.offlineUnlocked = wasUnlocked;
           this.user = previousUser;
         }
         console.error("Unable to recheck the Datalynk user", error);
@@ -1618,11 +1936,22 @@ class Auth {
     });
     if ((_a = this.api.options.offline) == null ? void 0 : _a.length)
       this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => {
-        if (u == null) {
-          if (this.api.online) localStorage.removeItem("datalynk-user");
-        } else localStorage.setItem("datalynk-user", JSON.stringify(u));
+        if (u == null && !this.api.online) return;
+        const vault = this.api.vault;
+        if (vault) vault.setProfile(u).catch((error) => console.warn("Unable to cache the Datalynk user", error));
+        else if (u == null) localStorage.removeItem("datalynk-user");
+        else localStorage.setItem("datalynk-user", JSON.stringify(u));
       });
   }
+  /** Offline login/encryption is active for this app */
+  get vault() {
+    var _a;
+    return ((_a = this.api.vault) == null ? void 0 : _a.enabled) ? this.api.vault : void 0;
+  }
+  /** This session may use offline data (always true when offline login is opted out) */
+  get offlineUnlocked() {
+    return !this.vault || this.vault.unlocked;
+  }
   /** Current user */
   get user() {
     return this.user$.getValue();
@@ -1640,14 +1969,18 @@ class Auth {
    *
    * @return {Promise<User | null>}
    */
-  async current(token = this.api.token) {
-    var _a;
+  async current(token = this.api.token, refresh = false) {
+    var _a, _b, _c;
     if (!token) return null;
-    else if (token == ((_a = this.user) == null ? void 0 : _a.token)) return this.user;
-    else if (!this.api.online && this.offlineUnlocked && typeof localStorage != "undefined" && localStorage.getItem("datalynk-user"))
-      return JSON.parse(localStorage.getItem("datalynk-user"));
-    else if (!this.api.online) return null;
-    return this.api.request([{ "$/auth/current": {} }, { "$/env/me": {} }], { token }).then((resp) => resp[0] || resp[1] ? { ...resp[0], ...resp[1] } : null);
+    else if (!refresh && token == ((_a = this.user) == null ? void 0 : _a.token)) return this.user;
+    else if (!this.api.online) {
+      if (!this.offlineUnlocked || !((_b = this.api.options.offline) == null ? void 0 : _b.length)) return null;
+      if (this.api.vault) return this.api.vault.getProfile();
+      return null;
+    }
+    const user = await this.api.request([{ "$/auth/current": {} }, { "$/env/me": {} }], { token }).then((resp) => resp[0] || resp[1] ? { ...resp[0], ...resp[1] } : null);
+    if (user && !user.guest && this.api.jwtPayload) (_c = this.vault) == null ? void 0 : _c.touch(this.api.jwtPayload.realm, this.api.jwtPayload.uid);
+    return user;
   }
   /**
    * Automatically handle sessions by checking localStorage & URL parameters for a token & prompting
@@ -1658,16 +1991,17 @@ class Auth {
    * @return {Promise<void>} Login complete
    */
   async handleLogin(spoke, options) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     if (this.onlinePrompt) window.removeEventListener("online", this.onlinePrompt);
     if ((_a = this.api.options.offline) == null ? void 0 : _a.length) window.removeEventListener("online", this.onlinePrompt = () => this.handleLogin(spoke, options));
+    await ((_b = this.api.vault) == null ? void 0 : _b.ready);
     const urlParams = new URLSearchParams(location.search);
     const urlToken = urlParams.getAll("datalynkToken").filter(Boolean).pop();
     if (urlToken) {
       this.api.token = urlToken;
       urlParams.delete("datalynkToken");
       location.href = location.pathname + (urlParams.toString() ? "?" + urlParams.toString() : "") + location.hash;
-    } else if (!this.api.online && ((_b = this.api.options.offline) == null ? void 0 : _b.length) && !this.offlineUnlocked) {
+    } else if (this.isOffline() && this.vault && !this.vault.unlocked) {
       await this.loginPrompt(spoke, options).done;
       return;
     } else if (this.api.reauthenticationPending && !this.api.online && ((_c = this.api.jwtPayload) == null ? void 0 : _c.realm) == spoke) {
@@ -1676,6 +2010,8 @@ class Auth {
       if (((_d = this.api.jwtPayload) == null ? void 0 : _d.realm) != spoke) {
         this.api.token = null;
         location.reload();
+      } else if ((_e = this.vault) == null ? void 0 : _e.needsPassword) {
+        await this.loginPrompt(spoke, options).done;
       }
     } else {
       this.api.token = null;
@@ -1683,6 +2019,9 @@ class Auth {
       location.reload();
     }
   }
+  isOffline() {
+    return !this.api.online || typeof navigator !== "undefined" && navigator.onLine === false;
+  }
   /**
    * Check whether user has a token
    *
@@ -1734,16 +2073,14 @@ class Auth {
    * @returns {Promise<User>} User account
    */
   async login(spoke, login, password, opts) {
-    var _a, _b, _c;
-    if (((_a = this.api.options.offline) == null ? void 0 : _a.length) && (!this.api.online || typeof navigator !== "undefined" && !navigator.onLine)) {
+    var _a;
+    if (this.vault && this.isOffline()) {
       const identity2 = this.api.jwtPayload;
-      const saved = localStorage.getItem("datalynk-user");
-      if (!identity2 || identity2.realm !== spoke || !saved || !await verifyOfflineLogin(spoke, login, identity2.uid, password.trim()))
-        throw new Error("Offline login is not available for this account on this device.");
-      const user = JSON.parse(saved);
-      if (![user.login, user.email].some((value) => (value == null ? void 0 : value.toLowerCase()) === login.trim().toLowerCase()))
-        throw new Error("Offline login is not available for this account on this device.");
-      this.offlineUnlocked = true;
+      if (!identity2 || identity2.realm !== spoke) throw new Error(offlineLoginMessages.none);
+      const result = await this.vault.unlockOffline(spoke, login, identity2.uid, password.trim());
+      if (result !== "ok") throw new Error(offlineLoginMessages[result]);
+      const user = await this.vault.getProfile();
+      if (!user) throw new Error(offlineLoginMessages.none);
       this.user = user;
       return user;
     }
@@ -1764,8 +2101,8 @@ class Auth {
     const data = await resp.json().catch(() => ({}));
     if (!resp.ok || data["error"]) throw Object.assign(errorFromCode(resp.status, data.error) || {}, data);
     this.api.token = data["token"];
-    if (((_b = this.api.options.offline) == null ? void 0 : _b.length) && this.api.options.saveSession && ((_c = this.api.jwtPayload) == null ? void 0 : _c.uid) != null)
-      await rememberOfflineLogin(spoke, login, this.api.jwtPayload.uid, password.trim());
+    if (this.vault && ((_a = this.api.jwtPayload) == null ? void 0 : _a.uid) != null)
+      await this.vault.rememberLogin(spoke, login, this.api.jwtPayload.uid, password.trim()).catch((error) => console.error("Unable to enable offline login", error));
     return data;
   }
   /**
@@ -1797,8 +2134,9 @@ class Auth {
    * @return {Promise<{closed: string, new: string}>}
    */
   logout(reload = true) {
+    var _a;
     localStorage.removeItem("datalynk-user");
-    forgetOfflineLogin();
+    void ((_a = this.api.vault) == null ? void 0 : _a.forget());
     return this.api.request({ "$/auth/logout": {} }).then((resp) => {
       if (reload) location.reload();
       this.api.token = null;
@@ -2746,15 +3084,17 @@ const _Slice = class _Slice {
         const lowest = resp.reduce((acc, r) => Math.min(acc, r.id), 0);
         if (lowest < _Slice.nextId) _Slice.nextId = lowest;
       }).finally(() => this.loaded = true);
-      this.cache$.pipe(skip(1)).subscribe(async (cache) => {
+      this.cache$.pipe(skip(1)).subscribe((cache) => {
+        const table = this.table;
+        if (!table) return;
+        const save = typeof table.replace == "function" ? table.replace(cache.map((c) => [c.id, c])) : table.clear().then(() => Promise.all(cache.map((c) => table.put(c.id, c))));
+        save.catch((error) => console.warn("Unable to save offline slice cache", error));
+      });
+      this.api.token$.pipe(filter((token) => !!token), take(1)).subscribe(async () => {
         var _a2;
-        await ((_a2 = this.table) == null ? void 0 : _a2.clear());
-        await Promise.all(cache.map((c) => {
-          var _a3;
-          return (_a3 = this.table) == null ? void 0 : _a3.put(c.id, c);
-        }));
+        await ((_a2 = this.api.vault) == null ? void 0 : _a2.whenUnlocked());
+        this.sync();
       });
-      this.sync();
       this.api.online$.pipe(distinctUntilChanged()).subscribe(async (online) => {
         if (!online) return;
         if (this.api.expired) await lastValueFrom(this.api.auth.user$.pipe(skip(1), takeWhile((u) => !u || this.api.expired, true)));
@@ -3406,7 +3746,7 @@ class Superuser {
     } });
   }
 }
-const version = "1.6.2";
+const version = "1.6.4";
 class WebRtc {
   constructor(api) {
     __publicField(this, "ice");
@@ -3996,6 +4336,8 @@ const _Api = class _Api {
     __publicField(this, "webrtc");
     /** Offline database */
     __publicField(this, "database");
+    /** Offline login + offline cache encryption */
+    __publicField(this, "vault");
     /** Options */
     __publicField(this, "options");
     /** Created slices */
@@ -4021,7 +4363,7 @@ const _Api = class _Api {
     __publicField(this, "online$", new BehaviorSubject(this.initialOnline));
     /** API Session token */
     __publicField(this, "token$", new BehaviorSubject(void 0));
-    var _a, _b;
+    var _a, _b, _c;
     this.origin = origin;
     this.url = `${new URL(origin).origin}/api/`;
     const development = this.isDevelopmentEnvironment(origin);
@@ -4045,6 +4387,11 @@ const _Api = class _Api {
       }
     };
     if (development) this.options.watchTokenExpiry = false;
+    const offlineLogin = this.options.offlineLogin ?? true;
+    this.vault = new OfflineVault(
+      !!((_a = this.options.offline) == null ? void 0 : _a.length) && !!this.options.saveSession && offlineLogin !== false,
+      typeof offlineLogin == "object" ? offlineLogin : {}
+    );
     if (this.options.saveSession && typeof localStorage != "undefined") {
       this.token = localStorage.getItem(this.localStorageKey) || null;
       this.token$.pipe(distinctUntilChanged()).subscribe((token) => {
@@ -4076,6 +4423,7 @@ const _Api = class _Api {
     this.webrtc = new WebRtc(this);
     if (typeof indexedDB != "undefined") {
       this.database = new Database("datalynk", ["pending", ...this.options.offline || []]);
+      this.database.cipher = this.vault;
       if (this.options.replayOfflineQueue !== false) this.online$.subscribe((online) => {
         if (online) void this.replayPendingQueue();
       });
@@ -4085,10 +4433,10 @@ const _Api = class _Api {
       window.addEventListener("offline", () => this.setConnectionStatus("offline"));
       this.startHeartbeat();
     }
-    if ((_a = this.options.offline) == null ? void 0 : _a.length) {
+    if ((_b = this.options.offline) == null ? void 0 : _b.length) {
       this.pwa.setup();
       if (typeof indexedDB == "undefined") throw new Error("Cannot enable offline support, indexedDB is not available in this environment");
-      (_b = this.options.offline) == null ? void 0 : _b.forEach((id) => this.slice(id));
+      (_c = this.options.offline) == null ? void 0 : _c.forEach((id) => this.slice(id));
       if (this.options.serviceWorker && typeof navigator["serviceWorker"] != "undefined") {
         (async () => {
           let initialized = false;
@@ -4400,7 +4748,7 @@ const _Api = class _Api {
     } catch {
       throw new UnexpectedApiResponseError(resp, body);
     }
-    if (resp.status === 401) this.markUnauthorized(token);
+    if (resp.status === 401 && token) this.markUnauthorized(token);
     if (!resp.ok || (data == null ? void 0 : data.error)) {
       const error = Object.assign(errorFromCode(resp.status, data == null ? void 0 : data.error), data);
       Object.defineProperty(error, "response", { value: resp, configurable: true });
@@ -4652,9 +5000,10 @@ const _Api = class _Api {
     }));
   }
   async finishUnauthorizedLogout(preservePending = false) {
-    var _a;
+    var _a, _b, _c;
     if (this.options.manageSession === false) return;
-    forgetOfflineLogin();
+    if (preservePending) await ((_a = this.vault) == null ? void 0 : _a.lock());
+    else await ((_b = this.vault) == null ? void 0 : _b.forget());
     if (typeof localStorage != "undefined") {
       localStorage.removeItem(this.localStorageKey);
       localStorage.removeItem("datalynk-user");
@@ -4675,7 +5024,7 @@ const _Api = class _Api {
         console.error("Unable to clear Datalynk service worker cache", error);
       }
     }
-    if (typeof navigator != "undefined" && ((_a = navigator.serviceWorker) == null ? void 0 : _a.controller)) {
+    if (typeof navigator != "undefined" && ((_c = navigator.serviceWorker) == null ? void 0 : _c.controller)) {
       navigator.serviceWorker.controller.postMessage({ token: null });
     }
     if (typeof location != "undefined" && typeof location.reload == "function")
@@ -4816,7 +5165,10 @@ const _Api = class _Api {
         if (!this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) break;
         if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) break;
         const request = await table.get(key);
-        if (request == null) continue;
+        if (request == null) {
+          await table.delete(key);
+          continue;
+        }
         try {
           await this.request(request);
           await table.delete(key);
@@ -4942,7 +5294,6 @@ const _Api = class _Api {
     });
   }
   request(data, options = {}) {
-    var _a, _b;
     data = typeof data == "string" ? { [data]: {} } : data;
     let key = JSON.stringify(data);
     if (this.offline && typeof navigator != "undefined") {
@@ -4950,8 +5301,8 @@ const _Api = class _Api {
       if (options.offline) {
         if (!this.ensureOfflineSessionOwner(this.token))
           return Promise.reject(errorFromCode(409, "Offline queue belongs to another authenticated user"));
-        (_b = (_a = this.database) == null ? void 0 : _a.table("pending")) == null ? void 0 : _b.add(data, key);
-        return Promise.resolve();
+        if (!this.database) return Promise.reject(new Error("Offline queue storage is unavailable"));
+        return this.database.table("pending").add(data, key).then(() => void 0);
       }
       return Promise.reject(errorFromCode(503, this.status === "unavailable" ? "Datalynk is unavailable" : "You are offline"));
     }