@auxilium/datalynk-client 1.6.3 → 1.6.4

package/dist/index.cjs

@@ -193,6 +193,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
     constructor(database, tables, version2) {
       __publicField(this, "connection");
       __publicField(this, "tables");
+      /** Encrypts values at rest when set */
+      __publicField(this, "cipher");
       this.database = database;
       this.version = version2;
       this.tables = tables.map((table) => typeof table === "object" ? { ...table, name: table.name.toString() } : { name: table.toString() });
@@ -258,17 +260,29 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         }
       });
     }
-    add(value, key) {
-      return this.tx((store) => store.add(value, key));
+    seal(value) {
+      const cipher = this.database.cipher;
+      return (cipher == null ? void 0 : cipher.enabled) ? cipher.seal(value) : Promise.resolve(value);
     }
-    put(key, value) {
-      return this.tx((store) => store.put(value, key));
+    open(value) {
+      const cipher = this.database.cipher;
+      return cipher ? cipher.open(value) : Promise.resolve(value);
     }
-    get(key) {
-      return this.tx((store) => store.get(key), true);
+    async add(value, key) {
+      const sealed = await this.seal(value);
+      return this.tx((store) => store.add(sealed, key));
     }
-    getAll() {
-      return this.tx((store) => store.getAll(), true);
+    async put(key, value) {
+      const sealed = await this.seal(value);
+      return this.tx((store) => store.put(sealed, key));
+    }
+    async get(key) {
+      return await this.open(await this.tx((store) => store.get(key), true));
+    }
+    /** All readable values. Values sealed with another key are skipped. */
+    async getAll() {
+      const values = await Promise.all((await this.tx((store) => store.getAll(), true)).map((v) => this.open(v)));
+      return values.filter((v) => v !== void 0);
     }
     getAllKeys() {
       return this.tx((store) => store.getAllKeys(), true);
@@ -279,6 +293,20 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
     clear() {
       return this.tx((store) => store.clear());
     }
+    /** Replace the whole table in one transaction (values are sealed first, so nothing is lost while locked) */
+    async replace(entries) {
+      const sealed = await Promise.all(entries.map(async ([key, value]) => [key, await this.seal(value)]));
+      const db = await this.database.connection;
+      await new Promise((resolve, reject) => {
+        const tx = db.transaction(this.name, "readwrite");
+        const store = tx.objectStore(this.name);
+        store.clear();
+        sealed.forEach(([key, value]) => store.put(value, key));
+        tx.oncomplete = () => resolve();
+        tx.onerror = () => reject(tx.error);
+        tx.onabort = () => reject(tx.error);
+      });
+    }
     count() {
       return this.tx((store) => store.count(), true);
     }
@@ -1032,6 +1060,9 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
     };
     return BehaviorSubject2;
   }(Subject);
+  var EMPTY = new Observable(function(subscriber) {
+    return subscriber.complete();
+  });
   var EmptyError = createErrorClass(function(_super) {
     return function EmptyErrorImpl() {
       _super(this);
@@ -1059,6 +1090,23 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       });
     });
   }
+  function firstValueFrom(source, config2) {
+    return new Promise(function(resolve, reject) {
+      var subscriber = new SafeSubscriber({
+        next: function(value) {
+          resolve(value);
+          subscriber.unsubscribe();
+        },
+        error: reject,
+        complete: function() {
+          {
+            reject(new EmptyError());
+          }
+        }
+      });
+      source.subscribe(subscriber);
+    });
+  }
   function filter(predicate, thisArg) {
     return operate(function(source, subscriber) {
       var index = 0;
@@ -1067,6 +1115,21 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       }));
     });
   }
+  function take(count) {
+    return count <= 0 ? function() {
+      return EMPTY;
+    } : operate(function(source, subscriber) {
+      var seen = 0;
+      source.subscribe(createOperatorSubscriber(subscriber, function(value) {
+        if (++seen <= count) {
+          subscriber.next(value);
+          if (count <= seen) {
+            subscriber.complete();
+          }
+        }
+      }));
+    });
+  }
   function distinctUntilChanged(comparator, keySelector) {
     if (keySelector === void 0) {
       keySelector = identity;
@@ -1548,52 +1611,304 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 	`;
   });
   let LoginPrompt = _LoginPrompt;
-  const KEY = "datalynk-offline-login";
+  const RECORD_KEY = "datalynk-offline-login";
+  const PROFILE_KEY = "datalynk-user";
+  const VAULT_DB = "datalynk-vault";
+  const VAULT_STORE = "keys";
+  const DEVICE_KEY = "device";
   const ITERATIONS = 31e4;
-  async function hash(password, salt) {
-    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
-    return Array.from(new Uint8Array(await crypto.subtle.deriveBits(
-      { name: "PBKDF2", salt: new Uint8Array(salt), iterations: ITERATIONS, hash: "SHA-256" },
-      key,
-      256
-    )));
-  }
-  async function rememberOfflineLogin(realm, login, uid, password) {
-    const salt = crypto.getRandomValues(new Uint8Array(16));
-    const record = { realm, login: login.trim().toLowerCase(), uid, salt: Array.from(salt), hash: await hash(password, salt) };
-    localStorage.setItem(KEY, JSON.stringify(record));
-  }
-  async function verifyOfflineLogin(realm, login, uid, password) {
-    const saved = localStorage.getItem(KEY);
-    if (!saved) return false;
-    let record;
-    try {
-      record = JSON.parse(saved);
-    } catch {
-      return false;
-    }
-    if (record.realm !== realm || record.login !== login.trim().toLowerCase() || record.uid !== uid || !Array.isArray(record.salt) || !Array.isArray(record.hash)) return false;
-    const candidate = await hash(password, new Uint8Array(record.salt));
-    if (candidate.length !== record.hash.length) return false;
-    let difference = 0;
-    for (let i = 0; i < candidate.length; i++) difference |= candidate[i] ^ record.hash[i];
-    return difference === 0;
+  const DAY = 864e5;
+  const offlineLoginMessages = {
+    "none": "Offline login is not available on this device. Connect to the internet to sign in.",
+    "wrong-user": "Offline login is only available for the last user who signed in on this device.",
+    "expired": "Offline login has expired on this device. Connect to the internet to sign in.",
+    "locked": "Offline login is locked after too many attempts. Connect to the internet to sign in.",
+    "bad-password": "Incorrect password."
+  };
+  const toB64 = (bytes) => {
+    let out = "";
+    new Uint8Array(bytes).forEach((b) => out += String.fromCharCode(b));
+    return btoa(out);
+  };
+  const fromB64 = (text) => Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+  const normalizeLogin = (login) => (login || "").trim().toLowerCase();
+  function isSealed(value) {
+    return !!value && typeof value == "object" && value.__dlv === 1 && "iv" in value && "ct" in value;
   }
-  function hasOfflineLogin(realm, uid) {
-    try {
-      const record = JSON.parse(localStorage.getItem(KEY) || "null");
-      return (record == null ? void 0 : record.realm) === realm && (record == null ? void 0 : record.uid) === uid;
-    } catch {
-      return false;
+  class OfflineVault {
+    constructor(enabled, options = {}, startOffline) {
+      /** False when offline login is disabled or the environment lacks WebCrypto/IndexedDB/localStorage */
+      __publicField(this, "enabled");
+      /** True once the data key is available in memory */
+      __publicField(this, "unlocked$", new BehaviorSubject(false));
+      /** Resolves once startup key loading has finished */
+      __publicField(this, "ready");
+      __publicField(this, "dek", null);
+      __publicField(this, "days");
+      __publicField(this, "attempts");
+      this.enabled = enabled && typeof crypto != "undefined" && !!crypto.subtle && typeof indexedDB != "undefined" && typeof localStorage != "undefined";
+      this.days = options.days ?? 7;
+      this.attempts = options.attempts ?? 5;
+      if (startOffline === void 0) startOffline = typeof navigator != "undefined" && navigator.onLine === false;
+      this.ready = this.enabled ? this.init(startOffline).catch((error) => {
+        console.error("Unable to open the Datalynk offline vault", error);
+      }) : Promise.resolve();
+    }
+    get unlocked() {
+      return this.unlocked$.getValue();
+    }
+    /** A saved offline login exists, but this session has not unlocked it yet */
+    get needsPassword() {
+      return this.enabled && !this.unlocked && !!this.readRecord();
+    }
+    /** Wait until the data key is available (resolves immediately when the vault is disabled) */
+    whenUnlocked() {
+      if (!this.enabled || this.unlocked) return Promise.resolve(true);
+      return firstValueFrom(this.unlocked$.pipe(filter(Boolean)));
+    }
+    /** Saved offline login matches this user */
+    has(realm, uid) {
+      const record = this.readRecord();
+      return !!record && record.realm === realm && record.uid === uid;
+    }
+    /**
+     * Called after a successful online password login. Wraps the data key with the
+     * password so this user can sign in offline later.
+     */
+    async rememberLogin(realm, login, uid, password) {
+      if (!this.enabled) return;
+      await this.ready;
+      const record = this.readRecord();
+      let dek = null;
+      if (record && record.realm === realm && record.uid === uid) {
+        dek = await this.unwrapWithPassword(record, password).catch(() => null);
+        if (!dek) dek = this.dek;
+      } else if (!record) {
+        dek = this.dek;
+      }
+      if (!dek) dek = await this.newDataKey();
+      const salt = crypto.getRandomValues(new Uint8Array(16));
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const kek = await this.passwordKey(password, salt);
+      const wrapped = await crypto.subtle.wrapKey("raw", dek, kek, { name: "AES-GCM", iv });
+      this.writeRecord({
+        v: 2,
+        realm,
+        uid,
+        login: normalizeLogin(login),
+        salt: toB64(salt),
+        iv: toB64(iv),
+        wrapped: toB64(wrapped),
+        verifiedAt: Date.now(),
+        failures: 0
+      });
+      await this.setKey(dek);
+    }
+    /** Try to unlock offline with a password */
+    async unlockOffline(realm, login, uid, password) {
+      if (!this.enabled) return "none";
+      await this.ready;
+      const record = this.readRecord();
+      if (!record) return "none";
+      if (record.realm !== realm || record.login !== normalizeLogin(login) || uid != null && record.uid !== uid) return "wrong-user";
+      if (record.locked) return "locked";
+      if (Date.now() - record.verifiedAt > this.days * DAY) return "expired";
+      try {
+        const dek = await this.unwrapWithPassword(record, password);
+        this.writeRecord({ ...record, failures: 0 });
+        await this.setKey(dek);
+        return "ok";
+      } catch {
+        const failures = (record.failures || 0) + 1;
+        const locked = failures >= this.attempts;
+        this.writeRecord({ ...record, failures, locked });
+        return locked ? "locked" : "bad-password";
+      }
+    }
+    /** The server confirmed this user's session: restart the offline window */
+    touch(realm, uid) {
+      if (!this.enabled || realm == null || uid == null) return;
+      const record = this.readRecord();
+      if (record && record.realm === realm && record.uid === uid) this.writeRecord({ ...record, verifiedAt: Date.now() });
+    }
+    /** Drop the in-memory and device keys but keep the password copy (queued work stays recoverable) */
+    async lock() {
+      this.dek = null;
+      if (this.unlocked) this.unlocked$.next(false);
+      if (this.enabled) await this.deleteDevice();
+    }
+    /** Remove offline login completely; anything sealed becomes unreadable */
+    async forget() {
+      if (typeof localStorage != "undefined") {
+        localStorage.removeItem(RECORD_KEY);
+        localStorage.removeItem(PROFILE_KEY);
+      }
+      await this.lock();
+    }
+    /** Encrypt a value for IndexedDB (passes through when disabled) */
+    async seal(value) {
+      if (!this.enabled || value === void 0) return value;
+      await this.whenUnlocked();
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, this.dek, new TextEncoder().encode(JSON.stringify(value)));
+      return { __dlv: 1, iv, ct };
+    }
+    /** Decrypt a value from IndexedDB. Unreadable values (old key / other user) return undefined. */
+    async open(value) {
+      if (!isSealed(value)) return value;
+      if (!this.enabled) return void 0;
+      await this.whenUnlocked();
+      try {
+        const iv = typeof value.iv == "string" ? fromB64(value.iv) : value.iv;
+        const ct = typeof value.ct == "string" ? fromB64(value.ct) : value.ct;
+        const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, this.dek, ct);
+        return JSON.parse(new TextDecoder().decode(plain));
+      } catch {
+        return void 0;
+      }
+    }
+    /** Save the cached user profile (sealed when enabled) */
+    async setProfile(user) {
+      if (typeof localStorage == "undefined") return;
+      if (user == null) return localStorage.removeItem(PROFILE_KEY);
+      if (!this.enabled) return localStorage.setItem(PROFILE_KEY, JSON.stringify(user));
+      const sealed = await this.seal(user);
+      localStorage.setItem(PROFILE_KEY, JSON.stringify({ __dlv: 1, iv: toB64(sealed.iv), ct: toB64(sealed.ct) }));
+    }
+    /** Read the cached user profile; null while locked */
+    async getProfile() {
+      if (typeof localStorage == "undefined") return null;
+      let saved;
+      try {
+        saved = JSON.parse(localStorage.getItem(PROFILE_KEY) || "null");
+      } catch {
+        return null;
+      }
+      if (!isSealed(saved)) return this.enabled ? null : saved;
+      if (!this.unlocked) return null;
+      return await this.open(saved) ?? null;
+    }
+    // ----- internals -----
+    async init(startOffline) {
+      if (startOffline) {
+        await this.deleteDevice();
+        return;
+      }
+      const device = await this.readDevice();
+      if (device) {
+        try {
+          const dek = await crypto.subtle.unwrapKey(
+            "raw",
+            device.wrapped,
+            device.key,
+            { name: "AES-GCM", iv: device.iv },
+            { name: "AES-GCM" },
+            true,
+            ["encrypt", "decrypt"]
+          );
+          this.dek = dek;
+          this.unlocked$.next(true);
+          return;
+        } catch {
+          await this.deleteDevice();
+        }
+      }
+      if (!this.readRecord()) await this.setKey(await this.newDataKey());
+    }
+    async setKey(dek) {
+      this.dek = dek;
+      try {
+        await this.writeDevice(dek);
+      } catch (error) {
+        console.warn("Unable to store the Datalynk device key; offline data will need the password", error);
+      }
+      if (!this.unlocked) this.unlocked$.next(true);
+    }
+    newDataKey() {
+      return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+    }
+    async passwordKey(password, salt) {
+      const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]);
+      return crypto.subtle.deriveKey(
+        { name: "PBKDF2", salt, iterations: ITERATIONS, hash: "SHA-256" },
+        base,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["wrapKey", "unwrapKey"]
+      );
+    }
+    async unwrapWithPassword(record, password) {
+      const kek = await this.passwordKey(password, fromB64(record.salt));
+      return crypto.subtle.unwrapKey(
+        "raw",
+        fromB64(record.wrapped),
+        kek,
+        { name: "AES-GCM", iv: fromB64(record.iv) },
+        { name: "AES-GCM" },
+        true,
+        ["encrypt", "decrypt"]
+      );
+    }
+    readRecord() {
+      if (typeof localStorage == "undefined") return null;
+      try {
+        const record = JSON.parse(localStorage.getItem(RECORD_KEY) || "null");
+        if ((record == null ? void 0 : record.v) === 2) return record;
+        if (record) localStorage.removeItem(RECORD_KEY);
+      } catch {
+        localStorage.removeItem(RECORD_KEY);
+      }
+      return null;
+    }
+    writeRecord(record) {
+      localStorage.setItem(RECORD_KEY, JSON.stringify(record));
+    }
+    vaultDb() {
+      return new Promise((resolve, reject) => {
+        const request = indexedDB.open(VAULT_DB, 1);
+        request.onupgradeneeded = () => request.result.createObjectStore(VAULT_STORE);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async vaultTx(mode, op) {
+      const db = await this.vaultDb();
+      try {
+        return await new Promise((resolve, reject) => {
+          const tx = db.transaction(VAULT_STORE, mode);
+          const request = op(tx.objectStore(VAULT_STORE));
+          tx.oncomplete = () => resolve(request.result);
+          tx.onerror = () => reject(tx.error);
+          tx.onabort = () => reject(tx.error);
+        });
+      } finally {
+        db.close();
+      }
+    }
+    async readDevice() {
+      try {
+        return await this.vaultTx("readonly", (store) => store.get(DEVICE_KEY)) || null;
+      } catch {
+        return null;
+      }
+    }
+    async writeDevice(dek) {
+      const key = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["wrapKey", "unwrapKey"]);
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const wrapped = await crypto.subtle.wrapKey("raw", dek, key, { name: "AES-GCM", iv });
+      await this.vaultTx("readwrite", (store) => store.put({ key, iv, wrapped }, DEVICE_KEY));
+    }
+    async deleteDevice() {
+      try {
+        await this.vaultTx("readwrite", (store) => store.delete(DEVICE_KEY));
+      } catch (error) {
+        console.warn("Unable to remove the Datalynk device key", error);
+      }
     }
-  }
-  function forgetOfflineLogin() {
-    localStorage.removeItem(KEY);
   }
   class Auth {
     constructor(api) {
       __publicField(this, "onlinePrompt");
-      __publicField(this, "offlineUnlocked", false);
       __publicField(this, "wasOffline", false);
       /** Current user as an observable */
       __publicField(this, "user$", new BehaviorSubject(void 0));
@@ -1603,21 +1918,12 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         if (status === "offline" || status === "unavailable") this.wasOffline = true;
         if (status !== "online" || !this.wasOffline) return;
         this.wasOffline = false;
-        const wasUnlocked = this.offlineUnlocked;
         const previousUser = this.user;
-        this.offlineUnlocked = false;
-        this.user = void 0;
         try {
-          const user = await this.current();
-          const identity2 = this.api.jwtPayload;
-          if (!user || user.guest || !identity2 || !hasOfflineLogin(identity2.realm, identity2.uid))
-            forgetOfflineLogin();
-          this.user = user;
+          this.user = await this.current(this.api.token, true);
         } catch (error) {
-          if (this.api.status === "unauthorized") forgetOfflineLogin();
-          else {
+          if (this.api.status !== "unauthorized") {
             this.wasOffline = true;
-            this.offlineUnlocked = wasUnlocked;
             this.user = previousUser;
           }
           console.error("Unable to recheck the Datalynk user", error);
@@ -1634,11 +1940,22 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       });
       if ((_a = this.api.options.offline) == null ? void 0 : _a.length)
         this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => {
-          if (u == null) {
-            if (this.api.online) localStorage.removeItem("datalynk-user");
-          } else localStorage.setItem("datalynk-user", JSON.stringify(u));
+          if (u == null && !this.api.online) return;
+          const vault = this.api.vault;
+          if (vault) vault.setProfile(u).catch((error) => console.warn("Unable to cache the Datalynk user", error));
+          else if (u == null) localStorage.removeItem("datalynk-user");
+          else localStorage.setItem("datalynk-user", JSON.stringify(u));
         });
     }
+    /** Offline login/encryption is active for this app */
+    get vault() {
+      var _a;
+      return ((_a = this.api.vault) == null ? void 0 : _a.enabled) ? this.api.vault : void 0;
+    }
+    /** This session may use offline data (always true when offline login is opted out) */
+    get offlineUnlocked() {
+      return !this.vault || this.vault.unlocked;
+    }
     /** Current user */
     get user() {
       return this.user$.getValue();
@@ -1656,14 +1973,18 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      *
      * @return {Promise<User | null>}
      */
-    async current(token = this.api.token) {
-      var _a;
+    async current(token = this.api.token, refresh = false) {
+      var _a, _b, _c;
       if (!token) return null;
-      else if (token == ((_a = this.user) == null ? void 0 : _a.token)) return this.user;
-      else if (!this.api.online && this.offlineUnlocked && typeof localStorage != "undefined" && localStorage.getItem("datalynk-user"))
-        return JSON.parse(localStorage.getItem("datalynk-user"));
-      else if (!this.api.online) return null;
-      return this.api.request([{ "$/auth/current": {} }, { "$/env/me": {} }], { token }).then((resp) => resp[0] || resp[1] ? { ...resp[0], ...resp[1] } : null);
+      else if (!refresh && token == ((_a = this.user) == null ? void 0 : _a.token)) return this.user;
+      else if (!this.api.online) {
+        if (!this.offlineUnlocked || !((_b = this.api.options.offline) == null ? void 0 : _b.length)) return null;
+        if (this.api.vault) return this.api.vault.getProfile();
+        return null;
+      }
+      const user = await this.api.request([{ "$/auth/current": {} }, { "$/env/me": {} }], { token }).then((resp) => resp[0] || resp[1] ? { ...resp[0], ...resp[1] } : null);
+      if (user && !user.guest && this.api.jwtPayload) (_c = this.vault) == null ? void 0 : _c.touch(this.api.jwtPayload.realm, this.api.jwtPayload.uid);
+      return user;
     }
     /**
      * Automatically handle sessions by checking localStorage & URL parameters for a token & prompting
@@ -1674,16 +1995,17 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      * @return {Promise<void>} Login complete
      */
     async handleLogin(spoke, options) {
-      var _a, _b, _c, _d;
+      var _a, _b, _c, _d, _e;
       if (this.onlinePrompt) window.removeEventListener("online", this.onlinePrompt);
       if ((_a = this.api.options.offline) == null ? void 0 : _a.length) window.removeEventListener("online", this.onlinePrompt = () => this.handleLogin(spoke, options));
+      await ((_b = this.api.vault) == null ? void 0 : _b.ready);
       const urlParams = new URLSearchParams(location.search);
       const urlToken = urlParams.getAll("datalynkToken").filter(Boolean).pop();
       if (urlToken) {
         this.api.token = urlToken;
         urlParams.delete("datalynkToken");
         location.href = location.pathname + (urlParams.toString() ? "?" + urlParams.toString() : "") + location.hash;
-      } else if (!this.api.online && ((_b = this.api.options.offline) == null ? void 0 : _b.length) && !this.offlineUnlocked) {
+      } else if (this.isOffline() && this.vault && !this.vault.unlocked) {
         await this.loginPrompt(spoke, options).done;
         return;
       } else if (this.api.reauthenticationPending && !this.api.online && ((_c = this.api.jwtPayload) == null ? void 0 : _c.realm) == spoke) {
@@ -1692,6 +2014,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         if (((_d = this.api.jwtPayload) == null ? void 0 : _d.realm) != spoke) {
           this.api.token = null;
           location.reload();
+        } else if ((_e = this.vault) == null ? void 0 : _e.needsPassword) {
+          await this.loginPrompt(spoke, options).done;
         }
       } else {
         this.api.token = null;
@@ -1699,6 +2023,9 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         location.reload();
       }
     }
+    isOffline() {
+      return !this.api.online || typeof navigator !== "undefined" && navigator.onLine === false;
+    }
     /**
      * Check whether user has a token
      *
@@ -1750,16 +2077,14 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      * @returns {Promise<User>} User account
      */
     async login(spoke, login, password, opts) {
-      var _a, _b, _c;
-      if (((_a = this.api.options.offline) == null ? void 0 : _a.length) && (!this.api.online || typeof navigator !== "undefined" && !navigator.onLine)) {
+      var _a;
+      if (this.vault && this.isOffline()) {
         const identity2 = this.api.jwtPayload;
-        const saved = localStorage.getItem("datalynk-user");
-        if (!identity2 || identity2.realm !== spoke || !saved || !await verifyOfflineLogin(spoke, login, identity2.uid, password.trim()))
-          throw new Error("Offline login is not available for this account on this device.");
-        const user = JSON.parse(saved);
-        if (![user.login, user.email].some((value) => (value == null ? void 0 : value.toLowerCase()) === login.trim().toLowerCase()))
-          throw new Error("Offline login is not available for this account on this device.");
-        this.offlineUnlocked = true;
+        if (!identity2 || identity2.realm !== spoke) throw new Error(offlineLoginMessages.none);
+        const result = await this.vault.unlockOffline(spoke, login, identity2.uid, password.trim());
+        if (result !== "ok") throw new Error(offlineLoginMessages[result]);
+        const user = await this.vault.getProfile();
+        if (!user) throw new Error(offlineLoginMessages.none);
         this.user = user;
         return user;
       }
@@ -1780,8 +2105,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       const data = await resp.json().catch(() => ({}));
       if (!resp.ok || data["error"]) throw Object.assign(errorFromCode(resp.status, data.error) || {}, data);
       this.api.token = data["token"];
-      if (((_b = this.api.options.offline) == null ? void 0 : _b.length) && this.api.options.saveSession && ((_c = this.api.jwtPayload) == null ? void 0 : _c.uid) != null)
-        await rememberOfflineLogin(spoke, login, this.api.jwtPayload.uid, password.trim());
+      if (this.vault && ((_a = this.api.jwtPayload) == null ? void 0 : _a.uid) != null)
+        await this.vault.rememberLogin(spoke, login, this.api.jwtPayload.uid, password.trim()).catch((error) => console.error("Unable to enable offline login", error));
       return data;
     }
     /**
@@ -1813,8 +2138,9 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      * @return {Promise<{closed: string, new: string}>}
      */
     logout(reload = true) {
+      var _a;
       localStorage.removeItem("datalynk-user");
-      forgetOfflineLogin();
+      void ((_a = this.api.vault) == null ? void 0 : _a.forget());
       return this.api.request({ "$/auth/logout": {} }).then((resp) => {
         if (reload) location.reload();
         this.api.token = null;
@@ -2762,15 +3088,17 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
           const lowest = resp.reduce((acc, r) => Math.min(acc, r.id), 0);
           if (lowest < _Slice.nextId) _Slice.nextId = lowest;
         }).finally(() => this.loaded = true);
-        this.cache$.pipe(skip(1)).subscribe(async (cache) => {
+        this.cache$.pipe(skip(1)).subscribe((cache) => {
+          const table = this.table;
+          if (!table) return;
+          const save = typeof table.replace == "function" ? table.replace(cache.map((c) => [c.id, c])) : table.clear().then(() => Promise.all(cache.map((c) => table.put(c.id, c))));
+          save.catch((error) => console.warn("Unable to save offline slice cache", error));
+        });
+        this.api.token$.pipe(filter((token) => !!token), take(1)).subscribe(async () => {
           var _a2;
-          await ((_a2 = this.table) == null ? void 0 : _a2.clear());
-          await Promise.all(cache.map((c) => {
-            var _a3;
-            return (_a3 = this.table) == null ? void 0 : _a3.put(c.id, c);
-          }));
+          await ((_a2 = this.api.vault) == null ? void 0 : _a2.whenUnlocked());
+          this.sync();
         });
-        this.sync();
         this.api.online$.pipe(distinctUntilChanged()).subscribe(async (online) => {
           if (!online) return;
           if (this.api.expired) await lastValueFrom(this.api.auth.user$.pipe(skip(1), takeWhile((u) => !u || this.api.expired, true)));
@@ -3422,7 +3750,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       } });
     }
   }
-  const version = "1.6.3";
+  const version = "1.6.4";
   class WebRtc {
     constructor(api) {
       __publicField(this, "ice");
@@ -4012,6 +4340,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       __publicField(this, "webrtc");
       /** Offline database */
       __publicField(this, "database");
+      /** Offline login + offline cache encryption */
+      __publicField(this, "vault");
       /** Options */
       __publicField(this, "options");
       /** Created slices */
@@ -4037,7 +4367,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       __publicField(this, "online$", new BehaviorSubject(this.initialOnline));
       /** API Session token */
       __publicField(this, "token$", new BehaviorSubject(void 0));
-      var _a, _b;
+      var _a, _b, _c;
       this.origin = origin;
       this.url = `${new URL(origin).origin}/api/`;
       const development = this.isDevelopmentEnvironment(origin);
@@ -4061,6 +4391,11 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         }
       };
       if (development) this.options.watchTokenExpiry = false;
+      const offlineLogin = this.options.offlineLogin ?? true;
+      this.vault = new OfflineVault(
+        !!((_a = this.options.offline) == null ? void 0 : _a.length) && !!this.options.saveSession && offlineLogin !== false,
+        typeof offlineLogin == "object" ? offlineLogin : {}
+      );
       if (this.options.saveSession && typeof localStorage != "undefined") {
         this.token = localStorage.getItem(this.localStorageKey) || null;
         this.token$.pipe(distinctUntilChanged()).subscribe((token) => {
@@ -4092,6 +4427,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       this.webrtc = new WebRtc(this);
       if (typeof indexedDB != "undefined") {
         this.database = new Database("datalynk", ["pending", ...this.options.offline || []]);
+        this.database.cipher = this.vault;
         if (this.options.replayOfflineQueue !== false) this.online$.subscribe((online) => {
           if (online) void this.replayPendingQueue();
         });
@@ -4101,10 +4437,10 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         window.addEventListener("offline", () => this.setConnectionStatus("offline"));
         this.startHeartbeat();
       }
-      if ((_a = this.options.offline) == null ? void 0 : _a.length) {
+      if ((_b = this.options.offline) == null ? void 0 : _b.length) {
         this.pwa.setup();
         if (typeof indexedDB == "undefined") throw new Error("Cannot enable offline support, indexedDB is not available in this environment");
-        (_b = this.options.offline) == null ? void 0 : _b.forEach((id) => this.slice(id));
+        (_c = this.options.offline) == null ? void 0 : _c.forEach((id) => this.slice(id));
         if (this.options.serviceWorker && typeof navigator["serviceWorker"] != "undefined") {
           (async () => {
             let initialized = false;
@@ -4416,7 +4752,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       } catch {
         throw new UnexpectedApiResponseError(resp, body);
       }
-      if (resp.status === 401) this.markUnauthorized(token);
+      if (resp.status === 401 && token) this.markUnauthorized(token);
       if (!resp.ok || (data == null ? void 0 : data.error)) {
         const error = Object.assign(errorFromCode(resp.status, data == null ? void 0 : data.error), data);
         Object.defineProperty(error, "response", { value: resp, configurable: true });
@@ -4668,9 +5004,10 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       }));
     }
     async finishUnauthorizedLogout(preservePending = false) {
-      var _a;
+      var _a, _b, _c;
       if (this.options.manageSession === false) return;
-      forgetOfflineLogin();
+      if (preservePending) await ((_a = this.vault) == null ? void 0 : _a.lock());
+      else await ((_b = this.vault) == null ? void 0 : _b.forget());
       if (typeof localStorage != "undefined") {
         localStorage.removeItem(this.localStorageKey);
         localStorage.removeItem("datalynk-user");
@@ -4691,7 +5028,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
           console.error("Unable to clear Datalynk service worker cache", error);
         }
       }
-      if (typeof navigator != "undefined" && ((_a = navigator.serviceWorker) == null ? void 0 : _a.controller)) {
+      if (typeof navigator != "undefined" && ((_c = navigator.serviceWorker) == null ? void 0 : _c.controller)) {
         navigator.serviceWorker.controller.postMessage({ token: null });
       }
       if (typeof location != "undefined" && typeof location.reload == "function")
@@ -4832,7 +5169,10 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
           if (!this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) break;
           if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) break;
           const request = await table.get(key);
-          if (request == null) continue;
+          if (request == null) {
+            await table.delete(key);
+            continue;
+          }
           try {
             await this.request(request);
             await table.delete(key);