@esportsplus/web-storage 0.5.0 → 0.5.1

package/build/drivers/localstorage.js

@@ -52,7 +52,13 @@ class LocalStorageDriver {
         }
     }
     async count() {
-        return this.getKeys().length;
+        let count = 0;
+        for (let i = 0, n = localStorage.length; i < n; i++) {
+            if (localStorage.key(i)?.startsWith(this.prefix)) {
+                count++;
+            }
+        }
+        return count;
     }
     async delete(keys) {
         for (let i = 0, n = keys.length; i < n; i++) {

package/build/drivers/sessionstorage.js

@@ -52,7 +52,13 @@ class SessionStorageDriver {
         }
     }
     async count() {
-        return this.getKeys().length;
+        let count = 0;
+        for (let i = 0, n = sessionStorage.length; i < n; i++) {
+            if (sessionStorage.key(i)?.startsWith(this.prefix)) {
+                count++;
+            }
+        }
+        return count;
     }
     async delete(keys) {
         for (let i = 0, n = keys.length; i < n; i++) {

package/build/index.d.ts

@@ -1,10 +1,10 @@
 import type { Filter, GlobalCallback, KeyCallback, Options, SetOptions } from './types.js';
 declare class Local<T> {
+    private cipher;
     private driver;
     private globals;
     private listeners;
     private ready;
-    private secret;
     private version;
     constructor(options: Options, secret?: string);
     all(): Promise<T>;

package/build/index.js

@@ -1,4 +1,4 @@
-import { decrypt, encrypt } from '@esportsplus/utilities';
+import { encryption } from '@esportsplus/utilities';
 import { DriverType } from './constants.js';
 import { IndexedDBDriver } from './drivers/indexeddb.js';
 import { LocalStorageDriver } from './drivers/localstorage.js';
@@ -11,14 +11,13 @@ function isEnvelope(value) {
         && '__e' in value
         && '__v' in value;
 }
-async function deserialize(value, secret) {
+async function deserialize(value, cipher) {
     if (value === undefined || value === null) {
         return undefined;
     }
-    if (secret && typeof value === 'string') {
+    if (cipher && typeof value === 'string') {
         try {
-            value = await decrypt(value, secret);
-            value = JSON.parse(value);
+            value = await cipher.decrypt(value);
         }
         catch {
             return undefined;
@@ -26,12 +25,12 @@ async function deserialize(value, secret) {
     }
     return value;
 }
-async function serialize(value, secret) {
+async function serialize(value, cipher) {
     if (value === undefined || value === null) {
         return value;
     }
-    if (secret) {
-        return encrypt(JSON.stringify(value), secret);
+    if (cipher) {
+        return cipher.encrypt(value);
     }
     return value;
 }
@@ -70,11 +69,11 @@ async function migrate(driver, migrations, version) {
             }
         }
         let transformed = await migrations[keys[i]]({ all: () => Promise.resolve(data) });
-        await driver.clear();
         let entries = [];
         for (let key in transformed) {
             entries.push([key, transformed[key]]);
         }
+        await driver.clear();
         if (entries.length > 0) {
             await driver.replace(entries);
         }
@@ -82,16 +81,16 @@ async function migrate(driver, migrations, version) {
     await driver.set(VERSION_KEY, version);
 }
 class Local {
+    cipher;
     driver;
     globals;
     listeners;
     ready;
-    secret;
     version;
     constructor(options, secret) {
+        this.cipher = null;
         this.globals = new Set();
         this.listeners = new Map();
-        this.secret = secret || null;
         let { migrations, name, version = 1 } = options;
         this.version = version;
         if (options.driver === DriverType.LocalStorage) {
@@ -106,11 +105,14 @@ class Local {
         else {
             this.driver = new IndexedDBDriver(name, version);
         }
+        let init = secret
+            ? encryption(secret).then((c) => { this.cipher = c; })
+            : Promise.resolve();
         if (migrations) {
-            this.ready = migrate(this.driver, migrations, version);
+            this.ready = init.then(() => migrate(this.driver, migrations, version));
         }
         else {
-            this.ready = Promise.resolve();
+            this.ready = init;
         }
     }
     async all() {
@@ -120,7 +122,7 @@ class Local {
             if (key === VERSION_KEY) {
                 continue;
             }
-            let deserialized = await deserialize(raw[key], this.secret), unwrapped = unwrap(deserialized);
+            let deserialized = await deserialize(raw[key], this.cipher), unwrapped = unwrap(deserialized);
             if (deserialized === undefined) {
                 continue;
             }
@@ -131,7 +133,7 @@ class Local {
             result[key] = unwrapped.value;
         }
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
         return result;
     }
@@ -151,7 +153,7 @@ class Local {
             if (key === VERSION_KEY) {
                 return;
             }
-            let deserialized = await deserialize(raw, this.secret), unwrapped = unwrap(deserialized);
+            let deserialized = await deserialize(raw, this.cipher), unwrapped = unwrap(deserialized);
             if (deserialized !== undefined && unwrapped.expired) {
                 expired.push(key);
                 oldValues.set(key, unwrapped.value);
@@ -166,15 +168,32 @@ class Local {
     }
     async count() {
         await this.ready;
-        let total = await this.driver.count(), raw = await this.driver.get(VERSION_KEY);
-        return raw !== undefined ? total - 1 : total;
+        let expired = [], total = 0;
+        await this.driver.map(async (raw, key) => {
+            if (key === VERSION_KEY) {
+                return;
+            }
+            let deserialized = await deserialize(raw, this.cipher), unwrapped = unwrap(deserialized);
+            if (deserialized === undefined) {
+                return;
+            }
+            if (unwrapped.expired) {
+                expired.push(key);
+                return;
+            }
+            total++;
+        });
+        if (expired.length > 0) {
+            await this.driver.delete(expired);
+        }
+        return total;
     }
     async delete(...keys) {
         await this.ready;
-        let oldValues = new Map();
-        for (let i = 0, n = keys.length; i < n; i++) {
-            let raw = await this.driver.get(keys[i]), deserialized = await deserialize(raw, this.secret), unwrapped = unwrap(deserialized);
-            oldValues.set(keys[i], deserialized === undefined ? undefined : unwrapped.value);
+        let oldValues = new Map(), raw = await this.driver.only(keys);
+        for (let [key, value] of raw) {
+            let deserialized = await deserialize(value, this.cipher), unwrapped = unwrap(deserialized);
+            oldValues.set(key, deserialized === undefined ? undefined : unwrapped.value);
         }
         await this.driver.delete(keys);
         for (let i = 0, n = keys.length; i < n; i++) {
@@ -188,7 +207,7 @@ class Local {
             if (stopped || key === VERSION_KEY) {
                 return;
             }
-            let deserialized = await deserialize(raw, this.secret), unwrapped = unwrap(deserialized);
+            let deserialized = await deserialize(raw, this.cipher), unwrapped = unwrap(deserialized);
             if (deserialized === undefined) {
                 return;
             }
@@ -201,18 +220,18 @@ class Local {
             }
         });
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
         return result;
     }
     async get(key, factory) {
         await this.ready;
-        let deserialized = await deserialize(await this.driver.get(key), this.secret), missing = false, unwrapped = unwrap(deserialized);
+        let deserialized = await deserialize(await this.driver.get(key), this.cipher), missing = false, unwrapped = unwrap(deserialized);
         if (deserialized === undefined) {
             missing = true;
         }
         else if (unwrapped.expired) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             missing = true;
         }
         if (missing) {
@@ -227,8 +246,25 @@ class Local {
     }
     async keys() {
         await this.ready;
-        let all = await this.driver.keys();
-        return all.filter((k) => k !== VERSION_KEY);
+        let expired = [], result = [];
+        await this.driver.map(async (raw, key) => {
+            if (key === VERSION_KEY) {
+                return;
+            }
+            let deserialized = await deserialize(raw, this.cipher), unwrapped = unwrap(deserialized);
+            if (deserialized === undefined) {
+                return;
+            }
+            if (unwrapped.expired) {
+                expired.push(key);
+                return;
+            }
+            result.push(key);
+        });
+        if (expired.length > 0) {
+            await this.driver.delete(expired);
+        }
+        return result;
     }
     async length() {
         await this.ready;
@@ -241,7 +277,7 @@ class Local {
             if (key === VERSION_KEY) {
                 return;
             }
-            let deserialized = await deserialize(raw, this.secret), unwrapped = unwrap(deserialized);
+            let deserialized = await deserialize(raw, this.cipher), unwrapped = unwrap(deserialized);
             if (deserialized === undefined) {
                 return;
             }
@@ -252,14 +288,14 @@ class Local {
             await fn(unwrapped.value, key, j++);
         });
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
     }
     async only(...keys) {
         await this.ready;
         let expired = [], raw = await this.driver.only(keys), result = {};
         for (let [key, value] of raw) {
-            let deserialized = await deserialize(value, this.secret), unwrapped = unwrap(deserialized);
+            let deserialized = await deserialize(value, this.cipher), unwrapped = unwrap(deserialized);
             if (deserialized === undefined) {
                 continue;
             }
@@ -270,36 +306,38 @@ class Local {
             result[key] = unwrapped.value;
         }
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
         return result;
     }
     async persist(key) {
         await this.ready;
-        let raw = await this.driver.get(key), deserialized = await deserialize(raw, this.secret);
+        let raw = await this.driver.get(key), deserialized = await deserialize(raw, this.cipher);
         if (deserialized === undefined) {
             return false;
         }
         let unwrapped = unwrap(deserialized);
         if (unwrapped.expired) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             return false;
         }
         if (!unwrapped.hasTTL) {
             return true;
         }
-        return this.driver.set(key, await serialize(unwrapped.value, this.secret));
+        return this.driver.set(key, await serialize(unwrapped.value, this.cipher));
     }
     async replace(values) {
         await this.ready;
-        let entries = [], failed = [], oldValues = new Map();
-        for (let key in values) {
-            let raw = await this.driver.get(key), deserialized = await deserialize(raw, this.secret), unwrapped = unwrap(deserialized);
+        let entries = [], failed = [], fetchKeys = Object.keys(values), oldValues = new Map(), raw = await this.driver.only(fetchKeys);
+        for (let key of fetchKeys) {
+            let value = raw.get(key), deserialized = value !== undefined
+                ? await deserialize(value, this.cipher)
+                : undefined, unwrapped = unwrap(deserialized);
             oldValues.set(key, deserialized === undefined ? undefined : unwrapped.value);
             try {
                 entries.push([
                     key,
-                    await serialize(values[key], this.secret)
+                    await serialize(values[key], this.cipher)
                 ]);
             }
             catch {
@@ -318,16 +356,16 @@ class Local {
     async set(key, value, options) {
         await this.ready;
         try {
-            let oldRaw = await this.driver.get(key), oldDeserialized = await deserialize(oldRaw, this.secret), oldUnwrapped = unwrap(oldDeserialized), oldValue = oldDeserialized === undefined ? undefined : oldUnwrapped.value, stored;
+            let oldRaw = await this.driver.get(key), oldDeserialized = await deserialize(oldRaw, this.cipher), oldUnwrapped = unwrap(oldDeserialized), oldValue = oldDeserialized === undefined ? undefined : oldUnwrapped.value, stored;
             if (options?.ttl != null && options.ttl > 0) {
                 let envelope = {
                     __e: Date.now() + options.ttl,
                     __v: value
                 };
-                stored = await serialize(envelope, this.secret);
+                stored = await serialize(envelope, this.cipher);
             }
             else {
-                stored = await serialize(value, this.secret);
+                stored = await serialize(value, this.cipher);
             }
             let result = await this.driver.set(key, stored);
             notify(this.globals, this.listeners, key, value, oldValue);
@@ -353,7 +391,7 @@ class Local {
     }
     async ttl(key) {
         await this.ready;
-        let raw = await this.driver.get(key), deserialized = await deserialize(raw, this.secret);
+        let raw = await this.driver.get(key), deserialized = await deserialize(raw, this.cipher);
         if (deserialized === undefined) {
             return -1;
         }
@@ -362,7 +400,7 @@ class Local {
         }
         let remaining = deserialized.__e - Date.now();
         if (remaining <= 0) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             return -1;
         }
         return remaining;

package/build/lz.js

@@ -1,3 +1,4 @@
+let MAX_DECOMPRESSED_SIZE = 10_485_760;
 function emitLiteral(ctx, ch) {
     let code = ch.charCodeAt(0);
     if (code < 256) {
@@ -13,6 +14,9 @@ function readBits(ctx, n) {
     let result = 0;
     for (let i = 0; i < n; i++) {
         if (ctx.bitPos > 15) {
+            if (ctx.pos >= ctx.compressed.length) {
+                throw new Error('LZ: unexpected end of compressed data');
+            }
             ctx.currentValue = ctx.compressed.charCodeAt(ctx.pos++) - 1;
             ctx.bitPos = 0;
         }
@@ -74,11 +78,7 @@ const compress = (input) => {
         ctx.output.push(((ctx.buffer << (16 - ctx.bitsInBuffer)) & 0xFFFF) + 1);
     }
     ctx.output.push((ctx.bitsInBuffer === 0 ? 16 : ctx.bitsInBuffer) + 1);
-    let chars = [];
-    for (let i = 0, n = ctx.output.length; i < n; i++) {
-        chars.push(String.fromCharCode(ctx.output[i]));
-    }
-    return chars.join('');
+    return String.fromCharCode(...ctx.output);
 };
 const decompress = (compressed) => {
     if (!compressed) {
@@ -96,7 +96,7 @@ const decompress = (compressed) => {
     else {
         return '';
     }
-    let result = [entry], w = entry;
+    let parts = [entry], totalLength = entry.length, w = entry;
     while (true) {
         let slotIdx = dictionary.length;
         dictionary.push('');
@@ -126,9 +126,13 @@ const decompress = (compressed) => {
             throw new Error('LZ: invalid decompression code');
         }
         dictionary[slotIdx] = w + entry[0];
-        result.push(entry);
+        parts.push(entry);
+        totalLength += entry.length;
+        if (totalLength > MAX_DECOMPRESSED_SIZE) {
+            throw new Error('LZ: decompressed output exceeds size limit');
+        }
         w = entry;
     }
-    return result.join('');
+    return parts.join('');
 };
 export { compress, decompress };

package/build/types.d.ts

@@ -36,4 +36,4 @@ type TTLEnvelope<V> = {
 };
 type GlobalCallback<T> = (key: keyof T, newValue: T[keyof T] | undefined, oldValue: T[keyof T] | undefined) => void;
 type KeyCallback<T, K extends keyof T = keyof T> = (newValue: T[K] | undefined, oldValue: T[K] | undefined) => void;
-export type { Driver, Filter, GlobalCallback, KeyCallback, MigrationContext, MigrationFn, Options, SetOptions, TTLEnvelope };
+export type { Driver, Filter, GlobalCallback, KeyCallback, MigrationFn, Options, SetOptions, TTLEnvelope };

package/package.json

@@ -1,14 +1,14 @@
 {
   "author": "ICJR",
   "dependencies": {
-    "@esportsplus/utilities": "^0.26.0"
+    "@esportsplus/utilities": "^0.28.0"
   },
   "description": "Web storage utility",
   "devDependencies": {
-    "@esportsplus/typescript": "^0.9.2",
+    "@esportsplus/typescript": "^0.29.1",
     "fake-indexeddb": "^6.2.5",
-    "happy-dom": "^20.8.8",
-    "vitest": "^4.1.1"
+    "happy-dom": "^20.8.9",
+    "vitest": "^4.1.4"
   },
   "main": "build/index.js",
   "name": "@esportsplus/web-storage",
@@ -19,7 +19,7 @@
   },
   "type": "module",
   "types": "build/index.d.ts",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "scripts": {
     "build": "tsc && tsc-alias",
     "test": "vitest run",

package/src/drivers/localstorage.ts

@@ -78,7 +78,15 @@ class LocalStorageDriver<T> implements Driver<T> {
     }
 
     async count(): Promise<number> {
-        return this.getKeys().length;
+        let count = 0;
+
+        for (let i = 0, n = localStorage.length; i < n; i++) {
+            if (localStorage.key(i)?.startsWith(this.prefix)) {
+                count++;
+            }
+        }
+
+        return count;
     }
 
     async delete(keys: (keyof T)[]): Promise<void> {

package/src/drivers/sessionstorage.ts

@@ -78,7 +78,15 @@ class SessionStorageDriver<T> implements Driver<T> {
     }
 
     async count(): Promise<number> {
-        return this.getKeys().length;
+        let count = 0;
+
+        for (let i = 0, n = sessionStorage.length; i < n; i++) {
+            if (sessionStorage.key(i)?.startsWith(this.prefix)) {
+                count++;
+            }
+        }
+
+        return count;
     }
 
     async delete(keys: (keyof T)[]): Promise<void> {

package/src/index.ts

@@ -1,11 +1,13 @@
-import { decrypt, encrypt } from '@esportsplus/utilities';
-import type { Driver, Filter, GlobalCallback, KeyCallback, MigrationFn, Options, SetOptions, TTLEnvelope } from './types';
+import { encryption } from '@esportsplus/utilities';
 import { DriverType } from './constants';
 import { IndexedDBDriver } from '~/drivers/indexeddb';
 import { LocalStorageDriver } from '~/drivers/localstorage';
 import { MemoryDriver } from '~/drivers/memory';
 import { SessionStorageDriver } from '~/drivers/sessionstorage';
 
+import type { Cipher } from '@esportsplus/utilities';
+import type { Driver, Filter, GlobalCallback, KeyCallback, MigrationFn, Options, SetOptions, TTLEnvelope } from './types';
+
 
 const VERSION_KEY = '__version__';
 
@@ -17,15 +19,14 @@ function isEnvelope<V>(value: unknown): value is TTLEnvelope<V> {
         && '__v' in (value as Record<string, unknown>);
 }
 
-async function deserialize<V>(value: unknown, secret: string | null): Promise<V | undefined> {
+async function deserialize<V>(value: unknown, cipher: Cipher | null): Promise<V | undefined> {
     if (value === undefined || value === null) {
         return undefined;
     }
 
-    if (secret && typeof value === 'string') {
+    if (cipher && typeof value === 'string') {
         try {
-            value = await decrypt(value, secret);
-            value = JSON.parse(value as string);
+            value = await cipher.decrypt(value);
         }
         catch {
             return undefined;
@@ -35,13 +36,13 @@ async function deserialize<V>(value: unknown, secret: string | null): Promise<V
     return value as V;
 }
 
-async function serialize<V>(value: V, secret: string | null): Promise<string | V> {
+async function serialize<V>(value: V, cipher: Cipher | null): Promise<string | V> {
     if (value === undefined || value === null) {
         return value;
     }
 
-    if (secret) {
-        return encrypt(JSON.stringify(value), secret);
+    if (cipher) {
+        return cipher.encrypt(value);
     }
 
     return value;
@@ -101,14 +102,14 @@ async function migrate<T>(driver: Driver<T>, migrations: Record<number, Migratio
 
         let transformed = await migrations[keys[i]]({ all: () => Promise.resolve(data) });
 
-        await driver.clear();
-
         let entries: [keyof T, T[keyof T]][] = [];
 
         for (let key in transformed) {
             entries.push([key as keyof T, transformed[key] as T[keyof T]]);
         }
 
+        await driver.clear();
+
         if (entries.length > 0) {
             await driver.replace(entries);
         }
@@ -120,6 +121,8 @@ async function migrate<T>(driver: Driver<T>, migrations: Record<number, Migratio
 
 class Local<T> {
 
+    private cipher: Cipher | null;
+
     private driver: Driver<T>;
 
     private globals: Set<GlobalCallback<T>>;
@@ -128,15 +131,13 @@ class Local<T> {
 
     private ready: Promise<void>;
 
-    private secret: string | null;
-
     private version: number;
 
 
     constructor(options: Options, secret?: string) {
+        this.cipher = null;
         this.globals = new Set();
         this.listeners = new Map();
-        this.secret = secret || null;
 
         let { migrations, name, version = 1 } = options;
 
@@ -155,11 +156,15 @@ class Local<T> {
             this.driver = new IndexedDBDriver<T>(name, version);
         }
 
+        let init = secret
+            ? encryption(secret).then((c) => { this.cipher = c; })
+            : Promise.resolve();
+
         if (migrations) {
-            this.ready = migrate(this.driver, migrations, version);
+            this.ready = init.then(() => migrate(this.driver, migrations, version));
         }
         else {
-            this.ready = Promise.resolve();
+            this.ready = init;
         }
     }
 
@@ -176,7 +181,7 @@ class Local<T> {
                 continue;
             }
 
-            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw[key], this.secret),
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw[key], this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             if (deserialized === undefined) {
@@ -192,7 +197,7 @@ class Local<T> {
         }
 
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
 
         return result;
@@ -223,7 +228,7 @@ class Local<T> {
                 return;
             }
 
-            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret),
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             if (deserialized !== undefined && unwrapped.expired) {
@@ -244,23 +249,47 @@ class Local<T> {
     async count(): Promise<number> {
         await this.ready;
 
-        let total = await this.driver.count(),
-            raw = await this.driver.get(VERSION_KEY as keyof T);
+        let expired: (keyof T)[] = [],
+            total = 0;
+
+        await this.driver.map(async (raw, key) => {
+            if (key as string === VERSION_KEY) {
+                return;
+            }
 
-        return raw !== undefined ? total - 1 : total;
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher),
+                unwrapped = unwrap<T[keyof T]>(deserialized);
+
+            if (deserialized === undefined) {
+                return;
+            }
+
+            if (unwrapped.expired) {
+                expired.push(key);
+                return;
+            }
+
+            total++;
+        });
+
+        if (expired.length > 0) {
+            await this.driver.delete(expired);
+        }
+
+        return total;
     }
 
     async delete(...keys: (keyof T)[]): Promise<void> {
         await this.ready;
 
-        let oldValues = new Map<keyof T, T[keyof T] | undefined>();
+        let oldValues = new Map<keyof T, T[keyof T] | undefined>(),
+            raw = await this.driver.only(keys);
 
-        for (let i = 0, n = keys.length; i < n; i++) {
-            let raw = await this.driver.get(keys[i]),
-                deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret),
+        for (let [key, value] of raw) {
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(value, this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
-            oldValues.set(keys[i], deserialized === undefined ? undefined : unwrapped.value);
+            oldValues.set(key, deserialized === undefined ? undefined : unwrapped.value);
         }
 
         await this.driver.delete(keys);
@@ -284,7 +313,7 @@ class Local<T> {
                 return;
             }
 
-            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret),
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             if (deserialized === undefined) {
@@ -302,7 +331,7 @@ class Local<T> {
         });
 
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
 
         return result;
@@ -315,7 +344,7 @@ class Local<T> {
 
         let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(
                 await this.driver.get(key),
-                this.secret
+                this.cipher
             ),
             missing = false,
             unwrapped = unwrap<T[keyof T]>(deserialized);
@@ -324,7 +353,7 @@ class Local<T> {
             missing = true;
         }
         else if (unwrapped.expired) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             missing = true;
         }
 
@@ -346,9 +375,34 @@ class Local<T> {
     async keys(): Promise<(keyof T)[]> {
         await this.ready;
 
-        let all = await this.driver.keys();
+        let expired: (keyof T)[] = [],
+            result: (keyof T)[] = [];
+
+        await this.driver.map(async (raw, key) => {
+            if (key as string === VERSION_KEY) {
+                return;
+            }
+
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher),
+                unwrapped = unwrap<T[keyof T]>(deserialized);
+
+            if (deserialized === undefined) {
+                return;
+            }
+
+            if (unwrapped.expired) {
+                expired.push(key);
+                return;
+            }
+
+            result.push(key);
+        });
+
+        if (expired.length > 0) {
+            await this.driver.delete(expired);
+        }
 
-        return all.filter((k) => k as string !== VERSION_KEY);
+        return result;
     }
 
     async length(): Promise<number> {
@@ -368,7 +422,7 @@ class Local<T> {
                 return;
             }
 
-            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret),
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             if (deserialized === undefined) {
@@ -384,7 +438,7 @@ class Local<T> {
         });
 
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
     }
 
@@ -396,7 +450,7 @@ class Local<T> {
             result = {} as T;
 
         for (let [key, value] of raw) {
-            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(value, this.secret),
+            let deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(value, this.cipher),
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             if (deserialized === undefined) {
@@ -412,7 +466,7 @@ class Local<T> {
         }
 
         if (expired.length > 0) {
-            this.driver.delete(expired);
+            await this.driver.delete(expired);
         }
 
         return result;
@@ -422,7 +476,7 @@ class Local<T> {
         await this.ready;
 
         let raw = await this.driver.get(key),
-            deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret);
+            deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher);
 
         if (deserialized === undefined) {
             return false;
@@ -431,7 +485,7 @@ class Local<T> {
         let unwrapped = unwrap<T[keyof T]>(deserialized);
 
         if (unwrapped.expired) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             return false;
         }
 
@@ -441,7 +495,7 @@ class Local<T> {
 
         return this.driver.set(
             key,
-            await serialize(unwrapped.value, this.secret) as T[keyof T]
+            await serialize(unwrapped.value, this.cipher) as T[keyof T]
         );
     }
 
@@ -450,11 +504,15 @@ class Local<T> {
 
         let entries: [keyof T, unknown][] = [],
             failed: string[] = [],
-            oldValues = new Map<keyof T, T[keyof T] | undefined>();
-
-        for (let key in values) {
-            let raw = await this.driver.get(key),
-                deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret),
+            fetchKeys = Object.keys(values) as (keyof T)[],
+            oldValues = new Map<keyof T, T[keyof T] | undefined>(),
+            raw = await this.driver.only(fetchKeys);
+
+        for (let key of fetchKeys) {
+            let value = raw.get(key),
+                deserialized = value !== undefined
+                    ? await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(value, this.cipher)
+                    : undefined,
                 unwrapped = unwrap<T[keyof T]>(deserialized);
 
             oldValues.set(key, deserialized === undefined ? undefined : unwrapped.value);
@@ -462,11 +520,11 @@ class Local<T> {
             try {
                 entries.push([
                     key,
-                    await serialize(values[key], this.secret)
+                    await serialize(values[key], this.cipher)
                 ]);
             }
             catch {
-                failed.push(key);
+                failed.push(key as string);
             }
         }
 
@@ -488,7 +546,7 @@ class Local<T> {
 
         try {
             let oldRaw = await this.driver.get(key),
-                oldDeserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(oldRaw, this.secret),
+                oldDeserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(oldRaw, this.cipher),
                 oldUnwrapped = unwrap<T[keyof T]>(oldDeserialized),
                 oldValue = oldDeserialized === undefined ? undefined : oldUnwrapped.value,
                 stored: T[keyof T] | string;
@@ -499,10 +557,10 @@ class Local<T> {
                     __v: value
                 };
 
-                stored = await serialize(envelope, this.secret) as T[keyof T];
+                stored = await serialize(envelope, this.cipher) as T[keyof T];
             }
             else {
-                stored = await serialize(value, this.secret) as T[keyof T];
+                stored = await serialize(value, this.cipher) as T[keyof T];
             }
 
             let result = await this.driver.set(key, stored as T[keyof T]);
@@ -545,7 +603,7 @@ class Local<T> {
         await this.ready;
 
         let raw = await this.driver.get(key),
-            deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.secret);
+            deserialized = await deserialize<T[keyof T] | TTLEnvelope<T[keyof T]>>(raw, this.cipher);
 
         if (deserialized === undefined) {
             return -1;
@@ -558,7 +616,7 @@ class Local<T> {
         let remaining = deserialized.__e - Date.now();
 
         if (remaining <= 0) {
-            this.driver.delete([key]);
+            await this.driver.delete([key]);
             return -1;
         }
 

package/src/lz.ts

@@ -2,6 +2,9 @@ type CompressCtx = { bitsInBuffer: number; buffer: number; numBits: number; outp
 type DecompressCtx = { bitPos: number; compressed: string; currentValue: number; pos: number };
 
 
+let MAX_DECOMPRESSED_SIZE = 10_485_760;
+
+
 function emitLiteral(ctx: CompressCtx, ch: string) {
     let code = ch.charCodeAt(0);
 
@@ -20,6 +23,10 @@ function readBits(ctx: DecompressCtx, n: number): number {
 
     for (let i = 0; i < n; i++) {
         if (ctx.bitPos > 15) {
+            if (ctx.pos >= ctx.compressed.length) {
+                throw new Error('LZ: unexpected end of compressed data');
+            }
+
             ctx.currentValue = ctx.compressed.charCodeAt(ctx.pos++) - 1;
             ctx.bitPos = 0;
         }
@@ -107,13 +114,7 @@ const compress = (input: string): string => {
 
     ctx.output.push((ctx.bitsInBuffer === 0 ? 16 : ctx.bitsInBuffer) + 1);
 
-    let chars: string[] = [];
-
-    for (let i = 0, n = ctx.output.length; i < n; i++) {
-        chars.push(String.fromCharCode(ctx.output[i]));
-    }
-
-    return chars.join('');
+    return String.fromCharCode(...ctx.output);
 };
 
 const decompress = (compressed: string): string => {
@@ -141,7 +142,8 @@ const decompress = (compressed: string): string => {
         return '';
     }
 
-    let result: string[] = [entry],
+    let parts: string[] = [entry],
+        totalLength = entry.length,
         w = entry;
 
     while (true) {
@@ -181,11 +183,17 @@ const decompress = (compressed: string): string => {
         }
 
         dictionary[slotIdx] = w + entry[0];
-        result.push(entry);
+        parts.push(entry);
+        totalLength += entry.length;
+
+        if (totalLength > MAX_DECOMPRESSED_SIZE) {
+            throw new Error('LZ: decompressed output exceeds size limit');
+        }
+
         w = entry;
     }
 
-    return result.join('');
+    return parts.join('');
 };
 
 

package/src/types.ts

@@ -44,4 +44,4 @@ type GlobalCallback<T> = (key: keyof T, newValue: T[keyof T] | undefined, oldVal
 type KeyCallback<T, K extends keyof T = keyof T> = (newValue: T[K] | undefined, oldValue: T[K] | undefined) => void;
 
 
-export type { Driver, Filter, GlobalCallback, KeyCallback, MigrationContext, MigrationFn, Options, SetOptions, TTLEnvelope };
+export type { Driver, Filter, GlobalCallback, KeyCallback, MigrationFn, Options, SetOptions, TTLEnvelope };

package/tests/index.ts

@@ -2,16 +2,22 @@ import 'fake-indexeddb/auto';
 
 import { vi } from 'vitest';
 
+let mockDecrypt = vi.fn(async (content: string) => {
+    return JSON.parse(atob(content));
+});
+
+let mockEncrypt = vi.fn(async (content: unknown) => {
+    return btoa(JSON.stringify(content));
+});
+
 vi.mock('@esportsplus/utilities', () => ({
-    decrypt: vi.fn(async (content: string, _password: string) => {
-        return atob(content);
-    }),
-    encrypt: vi.fn(async (content: unknown, _password: string) => {
-        return btoa(content as string);
-    })
+    encryption: vi.fn(async (_password: string) => ({
+        decrypt: (...args: unknown[]) => mockDecrypt(...args as [string]),
+        encrypt: (...args: unknown[]) => mockEncrypt(...args as [unknown])
+    }))
 }));
 
-import { decrypt, encrypt } from '@esportsplus/utilities';
+import { encryption } from '@esportsplus/utilities';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 
 import createLocal, { DriverType } from '~/index';
@@ -282,13 +288,13 @@ describe('Local (LocalStorage driver)', () => {
         it('get — returns undefined when decrypt fails', async () => {
             await encrypted.set('name', 'alice');
 
-            vi.mocked(decrypt).mockRejectedValueOnce(new Error('decrypt failed'));
+            mockDecrypt.mockRejectedValueOnce(new Error('decrypt failed'));
 
             expect(await encrypted.get('name')).toBeUndefined();
         });
 
         it('replace — returns failed keys when encrypt throws', async () => {
-            vi.mocked(encrypt).mockRejectedValueOnce(new Error('encrypt failed'));
+            mockEncrypt.mockRejectedValueOnce(new Error('encrypt failed'));
 
             let failed = await encrypted.replace({ age: 25, name: 'bob' });
 
@@ -298,7 +304,7 @@ describe('Local (LocalStorage driver)', () => {
         });
 
         it('set — returns false when encrypt throws', async () => {
-            vi.mocked(encrypt).mockRejectedValueOnce(new Error('encrypt failed'));
+            mockEncrypt.mockRejectedValueOnce(new Error('encrypt failed'));
 
             expect(await encrypted.set('name', 'alice')).toBe(false);
         });
@@ -1869,3 +1875,142 @@ describe('Compression + Encryption (LocalStorage)', () => {
         expect(await store.get('payload')).toBe(largeValue);
     });
 });
+
+
+describe('get(key, factory) — error handling', () => {
+
+    it('rejects when factory throws sync error', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'factory-err-1', version: 1 });
+
+        await expect(store.get('name', () => { throw new Error('factory boom'); }))
+            .rejects.toThrow('factory boom');
+    });
+
+    it('rejects when factory returns rejected promise', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'factory-err-2', version: 1 });
+
+        await expect(store.get('name', async () => { throw new Error('async boom'); }))
+            .rejects.toThrow('async boom');
+    });
+});
+
+
+describe('set() TTL boundary values', () => {
+    let now: number;
+
+    beforeEach(() => {
+        now = Date.now();
+        vi.spyOn(Date, 'now').mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+
+    it('ttl: 0 stores value without TTL envelope (treated as permanent)', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'ttl-zero', version: 1 });
+
+        await store.set('name', 'alice', { ttl: 0 });
+
+        now += 999999;
+
+        expect(await store.get('name')).toBe('alice');
+        expect(await store.ttl('name')).toBe(-1);
+    });
+
+    it('ttl: -1 stores value without TTL envelope (treated as permanent)', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'ttl-neg', version: 1 });
+
+        await store.set('name', 'alice', { ttl: -1 });
+
+        now += 999999;
+
+        expect(await store.get('name')).toBe('alice');
+        expect(await store.ttl('name')).toBe(-1);
+    });
+});
+
+
+describe('persist() on expired key', () => {
+    let now: number;
+
+    beforeEach(() => {
+        now = Date.now();
+        vi.spyOn(Date, 'now').mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+
+    it('returns false and deletes the expired entry', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'persist-expired', version: 1 });
+
+        await store.set('name', 'alice', { ttl: 10000 });
+
+        now += 10001;
+
+        expect(await store.persist('name')).toBe(false);
+        expect(await store.get('name')).toBeUndefined();
+    });
+});
+
+
+describe('ttl() on expired key', () => {
+    let now: number;
+
+    beforeEach(() => {
+        now = Date.now();
+        vi.spyOn(Date, 'now').mockImplementation(() => now);
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+
+    it('returns -1 and deletes the expired entry', async () => {
+        let store = createLocal<TestData>({ driver: DriverType.Memory, name: 'ttl-expired', version: 1 });
+
+        await store.set('name', 'alice', { ttl: 10000 });
+
+        now += 10001;
+
+        expect(await store.ttl('name')).toBe(-1);
+        expect(await store.get('name')).toBeUndefined();
+    });
+});
+
+
+describe('Migration error handling', () => {
+
+    let migrationErrId = 0;
+
+    function meuid() {
+        return `migration-err-${++migrationErrId}`;
+    }
+
+
+    it('throwing migration makes store methods reject', async () => {
+        type V2 = { name: string };
+
+        let name = meuid();
+
+        let v1 = createLocal<{ name: string }>({ driver: DriverType.Memory, name, version: 1 });
+
+        await v1.set('name', 'alice');
+
+        let v2 = createLocal<V2>({
+            driver: DriverType.Memory,
+            migrations: {
+                2: async () => { throw new Error('migration failed'); }
+            },
+            name,
+            version: 2
+        });
+
+        await expect(v2.get('name')).rejects.toThrow('migration failed');
+    });
+});

package/tests/lz.ts

@@ -321,4 +321,51 @@ describe('LZ Compression', () => {
             expect(decompress(compressed)).toBe(input);
         });
     });
+
+    describe('error handling', () => {
+        it('throws on truncated compressed input', () => {
+            let compressed = compress('hello world this is a test string'),
+                truncated = compressed.substring(0, Math.floor(compressed.length / 2));
+
+            expect(() => decompress(truncated)).toThrow('LZ: unexpected end of compressed data');
+        });
+
+        it('throws on invalid decompression code', () => {
+            // Craft a compressed string with a valid header followed by an invalid code:
+            // Start with a valid literal (code=0, 8-bit char 'a'=97), then inject a code
+            // value that exceeds the current dictionary size.
+            // At that point: dictSize=4, numBits=2, valid codes: 0,1,2,3
+            // We need a code >= 4 which is impossible in 2 bits, so we need to grow
+            // the dictionary first. Instead, use a real compressed stream and corrupt it.
+            let compressed = compress('abcdefghijklmnop'),
+                chars = [...compressed.slice(0, -1)];
+
+            // Corrupt a middle byte to inject invalid codes
+            if (chars.length > 3) {
+                chars[2] = String.fromCharCode(chars[2].charCodeAt(0) ^ 0x7F);
+            }
+
+            let corrupted = chars.join('') + compressed[compressed.length - 1];
+
+            expect(() => decompress(corrupted)).toThrow();
+        });
+
+        it('throws when decompressed output exceeds size limit', () => {
+            // Use a moderately sized repetitive input that compresses quickly
+            // but decompresses to >10MB by building a string just over the limit
+            let chunk = 'abcdef'.repeat(100),
+                input = chunk.repeat(Math.ceil(10_485_761 / chunk.length) + 1);
+
+            let compressed = compress(input);
+
+            expect(() => decompress(compressed)).toThrow('LZ: decompressed output exceeds size limit');
+        }, 60000);
+
+        it('100KB repeated data round-trips without triggering size limit', () => {
+            let input = 'a'.repeat(100_000),
+                compressed = compress(input);
+
+            expect(decompress(compressed)).toBe(input);
+        });
+    });
 });

package/storage/test-audit-web-storage.md

@@ -1,74 +0,0 @@
-# Test Audit: @esportsplus/web-storage
-
-## Summary
-- Source modules: 8
-- Tested modules: 8 (100%)
-- Benchmarked modules: 0 (0%)
-- Total tests: 253
-- Total gaps found: 23
-
-## Missing Tests (Priority Order)
-
-| Module | Export / Path | Type | Risk |
-|--------|-------------|------|------|
-| Local<T> + SessionStorage | All Local<T> methods with SS driver | integration | HIGH — only 1 factory test exists for SS; zero method coverage at Local<T> layer |
-| Local<T> + Memory | TTL methods (ttl, persist, cleanup) | integration | HIGH — TTL logic is driver-agnostic but untested against Memory driver |
-| Local<T> + Memory | get(key, factory) | integration | MED — factory tested for IDB/LS but not Memory |
-| Local<T> + Memory | encryption (with secret) | integration | MED — no encryption round-trip tests for Memory driver |
-| Local<T> + Memory | filter, only, map, length | integration | MED — bulk read operations untested at Local<T> layer for Memory |
-| Local<T> | persist() on non-existent key | edge case | MED — returns false by code inspection, no test |
-| Local<T> | persist() on already-permanent key | edge case | LOW — returns true, no test |
-| Local<T> | cleanup() subscription notifications | integration | MED — validator flagged: cleanup fires notify but no test covers it |
-| Local<T> | get() TTL expiry + subscription | edge case | MED — expired get does fire-and-forget delete but bypasses subscription-aware delete path; behavior unclear |
-| Local<T> | count() with VERSION_KEY present | edge case | MED — should return count-1 when migrations active; no test |
-| Local<T> | keys() with VERSION_KEY present | edge case | MED — should exclude __version__; no test |
-| Local<T> + encryption | get(key, factory) + encryption | integration | LOW — factory + encrypt combo untested |
-| Local<T> + LS | compression + encryption combined | integration | MED — encrypted ciphertext stored via driver which may attempt compression; round-trip untested |
-
-## Shallow Tests
-
-| Module | Export | Covered | Missing |
-|--------|--------|---------|---------|
-| Local<T>.persist() | IDB, LS | happy path (has TTL, removes it) | non-existent key, already-permanent key, expired key |
-| Local<T>.cleanup() | IDB, LS | removes expired entries | empty store, no expired entries, subscription notifications |
-| Local<T>.clear() | IDB, LS, Memory | clears all + notifies | VERSION_KEY preserved after clear (migration stores re-init) |
-| Local<T>.subscribe() | Memory | set, delete, replace, clear, unsubscribe | cleanup notifications, factory-triggered notifications, TTL expiry notifications |
-| Local<T>.map() | IDB, LS, Memory | iterates entries | TTL filtering + VERSION_KEY filtering combined |
-| LZ compress/decompress | round-trip | all string types | very large strings (>100KB), strings that produce larger output than input (random/high-entropy) |
-| LocalStorageDriver.parse() | error handling | corrupted compressed data | corrupted non-compressed JSON, null byte in stored data |
-
-## Missing Benchmarks
-
-No benchmark infrastructure exists. For a storage library, benchmarks would be useful for:
-
-| Module | Export | Reason |
-|--------|--------|--------|
-| LZ compress/decompress | compress() | Called on every localStorage write ≥100 bytes |
-| LZ compress/decompress | decompress() | Called on every localStorage read of compressed data |
-| LocalStorageDriver | set/get | Hot path for localStorage operations |
-| IndexedDBDriver | set/get/all | Async I/O operations, would reveal contention |
-| Local<T> | set with encryption | Encryption + serialization overhead |
-
-## Stale Tests
-
-None found. All test references match current exports.
-
-## Recommendations
-
-### Priority 1: SessionStorage Local<T> integration (HIGH)
-The sessionStorage driver has full driver-level tests (36) but almost zero Local<T> integration tests (just 1 factory test). Add at minimum: set/get, all, delete, clear, count, keys — mirroring the existing Memory driver block. Encryption and TTL should also be tested since the driver shares serialization logic with localStorage but includes compression.
-
-### Priority 2: Memory driver feature coverage (HIGH)
-TTL, persist, cleanup, get(key, factory), encryption, and bulk read operations are untested at the Local<T> layer for the Memory driver. Since Memory is the recommended driver for unit testing, these gaps are ironic — users testing their own code with Memory may hit untested paths.
-
-### Priority 3: Cross-feature edge cases (MED)
-- cleanup() + subscription notifications
-- get() TTL expiry + subscription side-effects
-- count()/keys() with VERSION_KEY present (migrations active)
-- Compression + encryption combined round-trip
-- persist() on non-existent and already-permanent keys
-
-### Priority 4: LZ compression boundaries (LOW)
-- Very large strings (100KB+)
-- High-entropy strings that don't compress
-- Explicit test that compression never increases size by more than a bounded amount