@evolu/web 1.0.1-preview.5 → 1.0.1-preview.7

package/dist/src/Evolu/Db.worker.js

@@ -1,15 +1,13 @@
-import { createConsole, createEnglishMnemonic, createNanoIdLib, createRandom, createRandomBytes, createTime, } from "@evolu/common";
-import { createDbWorkerForPlatform, createWebSocketSync, } from "@evolu/common/evolu";
+import { createConsole, createRandom, createRandomBytes, createTime, createWebSocket, } from "@evolu/common";
+import { createDbWorkerForPlatform } from "@evolu/common/evolu";
 import { createWasmSqliteDriver } from "../WasmSqliteDriver.js";
 import { wrapWebWorkerSelf } from "../WebWorker.js";
 const dbWorker = createDbWorkerForPlatform({
-    createSqliteDriver: createWasmSqliteDriver,
-    createSync: createWebSocketSync,
     console: createConsole(),
-    time: createTime(),
+    createSqliteDriver: createWasmSqliteDriver,
+    createWebSocket,
     random: createRandom(),
-    nanoIdLib: createNanoIdLib(),
-    createMnemonic: createEnglishMnemonic,
-    createRandomBytes,
+    randomBytes: createRandomBytes(),
+    time: createTime(),
 });
 wrapWebWorkerSelf(dbWorker);

package/dist/src/Evolu/LocalAuth.d.ts

@@ -0,0 +1,4 @@
+import type { SecureStorage, RandomBytesDep, SymmetricCryptoDep } from "@evolu/common";
+/** @experimental */
+export declare const createWebAuthnStore: (deps: RandomBytesDep & SymmetricCryptoDep) => SecureStorage;
+//# sourceMappingURL=LocalAuth.d.ts.map

package/dist/src/Evolu/LocalAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuth.d.ts","sourceRoot":"","sources":["../../../src/Evolu/LocalAuth.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAIV,aAAa,EACb,cAAc,EACd,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAGvB,oBAAoB;AACpB,eAAO,MAAM,mBAAmB,GAC9B,MAAM,cAAc,GAAG,kBAAkB,KACxC,aA4GD,CAAC"}

package/dist/src/Evolu/LocalAuth.js

@@ -0,0 +1,193 @@
+import { set, get, del, keys, clear, createStore } from "idb-keyval";
+import { createSlip21, utf8ToBytes, bytesToUtf8, base64UrlToUint8Array, uint8ArrayToBase64Url, EncryptionKey, Base64Url, } from "@evolu/common";
+/** @experimental */
+export const createWebAuthnStore = (deps) => ({
+    setItem: async (key, value, options) => {
+        if (options?.accessControl === "none") {
+            const metadata = createMetadata(false);
+            await set(key, { value, metadata }, getStore(options.service));
+            return { metadata };
+        }
+        const seed = generateSeed(deps)();
+        const authResult = JSON.parse(value);
+        const credential = await createCredential(deps)(options?.webAuthnUsername ?? "Evolu User", seed, options?.relyingPartyID, options?.relyingPartyName, options?.webAuthnUserVerification, options?.webAuthnAuthenticatorAttachment);
+        const encryptionKey = deriveEncryptionKey(seed);
+        const encryptedData = encryptAuthResult(deps)(authResult, encryptionKey);
+        const credentialId = uint8ArrayToBase64Url(new Uint8Array(credential.rawId));
+        const metadata = createMetadata();
+        await set(key, { credentialId, ...encryptedData, metadata }, getStore(options?.service));
+        return { metadata };
+    },
+    getItem: async (key, options) => {
+        if (options?.accessControl === "none") {
+            const data = await get(key, getStore(options.service));
+            return data
+                ? {
+                    key,
+                    value: data.value,
+                    service: options.service ?? "default",
+                    metadata: data.metadata,
+                }
+                : null;
+        }
+        const data = await get(key, getStore(options?.service));
+        if (!data) {
+            return null;
+        }
+        try {
+            const credential = await getCredential(deps)(data.credentialId, options?.relyingPartyID, options?.webAuthnUserVerification);
+            const credentialSeed = extractSeedFromCredential(credential);
+            const encryptionKey = deriveEncryptionKey(credentialSeed);
+            const authResultVal = decryptAuthResult(deps)(data, encryptionKey);
+            if (!authResultVal) {
+                return null;
+            }
+            return {
+                key,
+                service: options?.service ?? "default",
+                value: authResultVal,
+                metadata: data.metadata,
+            };
+        }
+        catch (_error) {
+            return null;
+        }
+    },
+    deleteItem: async (key, options) => {
+        await del(key, getStore(options?.service));
+        return true;
+    },
+    getAllItems: async (options) => {
+        const service = options?.service ?? "default";
+        const itemKeys = await keys(getStore(service));
+        const items = await Promise.all(itemKeys.map(async (key) => {
+            const data = await get(key, getStore(service));
+            return {
+                key,
+                service,
+                metadata: data?.metadata ?? createMetadata(),
+                ...(options?.includeValues && data?.value
+                    ? { value: data.value }
+                    : {}),
+            };
+        }));
+        return items;
+    },
+    clearService: async (options) => {
+        await clear(getStore(options?.service));
+    },
+});
+/**
+ * Create default metadata for backwards compatibility with items that don't
+ * have stored metadata.
+ */
+const createMetadata = (isSecure = true) => {
+    return {
+        backend: "keychain",
+        accessControl: isSecure ? "biometryCurrentSet" : "none",
+        securityLevel: isSecure ? "biometry" : "software",
+        timestamp: Date.now(),
+    };
+};
+/** Get storage key for owner ID. (supports namespaces via prefix) */
+const getStore = (prefix = "default") => {
+    return createStore(prefix, "evolu-auth");
+};
+const createCredential = (deps) => async (username, seed, relyingPartyID, relyingPartyName, userVerification, authenticatorAttachment) => {
+    const options = createCredentialCreationOptions(deps)(username, seed, relyingPartyID, relyingPartyName, userVerification, authenticatorAttachment);
+    const credential = (await navigator.credentials.create(options));
+    if (!credential) {
+        throw new Error("Failed to create WebAuthn credential");
+    }
+    return credential;
+};
+const getCredential = (deps) => async (credentialId, relyingPartyID, userVerification) => {
+    const options = createCredentialRequestOptions(deps)(credentialId, relyingPartyID, userVerification);
+    const credential = (await navigator.credentials.get(options));
+    if (!credential?.response) {
+        throw new Error("Failed to get WebAuthn credential");
+    }
+    return credential;
+};
+const extractSeedFromCredential = (credential) => {
+    const response = credential.response;
+    if (!response.userHandle) {
+        throw new Error("No userHandle in credential response");
+    }
+    return new Uint8Array(response.userHandle);
+};
+const createCredentialCreationOptions = (deps) => (username, seed, relyingPartyID, relyingPartyName, userVerification, authenticatorAttachment) => {
+    return {
+        publicKey: {
+            challenge: generateSeed(deps)(),
+            rp: {
+                id: relyingPartyID ?? document.location.hostname,
+                name: relyingPartyName ?? "Evolu",
+            },
+            user: {
+                id: seed,
+                name: username,
+                displayName: username,
+            },
+            pubKeyCredParams: [
+                { type: "public-key", alg: -8 }, // Ed25519
+                { type: "public-key", alg: -7 }, // ES256
+                { type: "public-key", alg: -257 }, // RS256
+            ],
+            attestation: "none",
+            authenticatorSelection: {
+                // - "platform": Uses the platform's built-in authenticator.
+                // - "cross-platform": Uses a device specific authenticator (yubikey, fido2, etc.)
+                authenticatorAttachment: authenticatorAttachment ?? "platform",
+                // - "discouraged": Only User Presence is needed.
+                // - "preferred": User Verification is preferred but not required. Falls back to User Presence.
+                // - "required": User Verification MUST occur (biometrics/PIN). Clients may silently downgrade to User Presence only.
+                userVerification: userVerification ?? "required",
+                // - "discouraged": Server-side credential is preferable, but will accept client-side discoverable credential.
+                // - "preferred": Relying Party strongly prefers client-side discoverable credential but will accept server-side credential.
+                // - "required": Client-side discoverable credential MUST be created, error if it can't be created.
+                residentKey: "required",
+                // Included for backwards compatibility. Deprecated in favor of residentKey (true = "required")
+                requireResidentKey: true,
+            },
+        },
+    };
+};
+const createCredentialRequestOptions = (deps) => (credentialId, relyingPartyID, userVerification) => {
+    return {
+        publicKey: {
+            challenge: generateSeed(deps)(),
+            rpId: relyingPartyID ?? document.location.hostname,
+            userVerification: userVerification ?? "preferred",
+            allowCredentials: [
+                {
+                    type: "public-key",
+                    id: base64UrlToUint8Array(Base64Url.orThrow(credentialId)),
+                },
+            ],
+        },
+    };
+};
+const deriveEncryptionKey = (seed) => {
+    const seed32 = seed.length === 32 ? seed : seed.slice(0, 32);
+    return EncryptionKey.orThrow(createSlip21(seed32, ["evolu", "auth"]));
+};
+const encryptAuthResult = (deps) => (authResult, encryptionKey) => {
+    const plaintext = utf8ToBytes(JSON.stringify(authResult));
+    const { nonce, ciphertext } = deps.symmetricCrypto.encrypt(plaintext, encryptionKey);
+    return {
+        nonce: uint8ArrayToBase64Url(nonce),
+        ciphertext: uint8ArrayToBase64Url(ciphertext),
+    };
+};
+const decryptAuthResult = (deps) => (encryptedData, encryptionKey) => {
+    const nonce = base64UrlToUint8Array(encryptedData.nonce);
+    const ciphertext = base64UrlToUint8Array(encryptedData.ciphertext);
+    const result = deps.symmetricCrypto.decrypt(ciphertext, encryptionKey, nonce);
+    if (!result.ok)
+        return null;
+    return bytesToUtf8(result.value);
+};
+const generateSeed = (deps) => () => {
+    return deps.randomBytes.create(32);
+};

package/dist/src/Evolu/Platform.d.ts

@@ -0,0 +1,3 @@
+import { ReloadApp } from "@evolu/common/evolu";
+export declare const reloadApp: ReloadApp;
+//# sourceMappingURL=Platform.d.ts.map

package/dist/src/Evolu/Platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Platform.d.ts","sourceRoot":"","sources":["../../../src/Evolu/Platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,eAAO,MAAM,SAAS,EAAE,SAMvB,CAAC"}

package/dist/src/Evolu/Platform.js

@@ -0,0 +1,6 @@
+export const reloadApp = (url) => {
+    if (typeof document === "undefined") {
+        return;
+    }
+    location.replace(url);
+};

package/dist/src/Evolu/index.d.ts

@@ -1,3 +1,4 @@
 import { EvoluDeps } from "@evolu/common/evolu";
+export declare const localAuth: import("@evolu/common").LocalAuth;
 export declare const evoluWebDeps: EvoluDeps;
 //# sourceMappingURL=index.d.ts.map

package/dist/src/Evolu/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Evolu/index.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,SAAS,EACV,MAAM,qBAAqB,CAAC;AAa7B,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/Evolu/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,SAAS,EACV,MAAM,qBAAqB,CAAC;AAiB7B,eAAO,MAAM,SAAS,mCAGpB,CAAC;AAEH,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAC"}

package/dist/src/Evolu/index.js

@@ -1,13 +1,20 @@
-import { createConsole, createNanoIdLib, createTime } from "@evolu/common";
+import { createConsole, createLocalAuth, createRandomBytes, createSymmetricCrypto, createTime, } from "@evolu/common";
 import { createSharedWebWorker } from "../SharedWebWorker.js";
-import { createAppState } from "./AppState.js";
+import { createWebAuthnStore } from "./LocalAuth.js";
+import { reloadApp } from "./Platform.js";
+const randomBytes = createRandomBytes();
+const symmetricCrypto = createSymmetricCrypto({ randomBytes });
 const createDbWorker = (name) => createSharedWebWorker(name, () => new Worker(new URL("Db.worker.js", import.meta.url), {
     type: "module",
 }));
+export const localAuth = createLocalAuth({
+    randomBytes,
+    secureStorage: createWebAuthnStore({ randomBytes, symmetricCrypto }),
+});
 export const evoluWebDeps = {
-    time: createTime(),
     console: createConsole(),
-    nanoIdLib: createNanoIdLib(),
-    createAppState,
     createDbWorker,
+    randomBytes: createRandomBytes(),
+    reloadApp,
+    time: createTime(),
 };

package/dist/src/WasmSqliteDriver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WasmSqliteDriver.d.ts","sourceRoot":"","sources":["../../src/WasmSqliteDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kBAAkB,EAGnB,MAAM,eAAe,CAAC;AAavB,eAAO,MAAM,sBAAsB,EAAE,kBAsEpC,CAAC"}
+{"version":3,"file":"WasmSqliteDriver.d.ts","sourceRoot":"","sources":["../../src/WasmSqliteDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kBAAkB,EAInB,MAAM,eAAe,CAAC;AAgBvB,eAAO,MAAM,sBAAsB,EAAE,kBAuFpC,CAAC"}

package/dist/src/WasmSqliteDriver.js

@@ -1,5 +1,5 @@
-import { constVoid, createPreparedStatementsCache, } from "@evolu/common";
-import sqlite3InitModule from "@sqlite.org/sqlite-wasm";
+import { constVoid, createPreparedStatementsCache, bytesToHex, } from "@evolu/common";
+import sqlite3InitModule from "@evolu/sqlite-wasm";
 // TODO: Do we still need that?
 // https://github.com/sqlite/sqlite-wasm/issues/62
 // @ts-expect-error Missing types.
@@ -10,9 +10,27 @@ globalThis.sqlite3ApiConfig = {
 const sqlite3Promise = sqlite3InitModule();
 export const createWasmSqliteDriver = async (name, options) => {
     const sqlite3 = await sqlite3Promise;
-    const db = options?.memory
-        ? new sqlite3.oo1.DB(":memory:")
-        : new (await sqlite3.installOpfsSAHPoolVfs({ name })).OpfsSAHPoolDb("/evolu1.db");
+    // This is used to make OPFS default vfs for multipleciphers
+    // @ts-expect-error Missing types (update @evolu/sqlite-wasm types)
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+    sqlite3.capi.sqlite3mc_vfs_create("opfs", 1);
+    let db;
+    if (options?.memory) {
+        db = new sqlite3.oo1.DB(":memory:");
+    }
+    else if (options?.encryptionKey) {
+        const pool = await sqlite3.installOpfsSAHPoolVfs({ directory: `.${name}` });
+        db = new pool.OpfsSAHPoolDb("file:evolu1.db?vfs=multipleciphers-opfs-sahpool");
+        db.exec(`
+      PRAGMA cipher = 'sqlcipher';
+      PRAGMA legacy = 4;
+      PRAGMA key = "x'${bytesToHex(options.encryptionKey)}'";
+    `);
+    }
+    else {
+        const pool = await sqlite3.installOpfsSAHPoolVfs({ name });
+        db = new pool.OpfsSAHPoolDb("file:evolu1.db");
+    }
     let isDisposed = false;
     const cache = createPreparedStatementsCache((sql) => db.prepare(sql), (statement) => {
         statement.finalize();

package/dist/test/SharedWebWorker.test.js

@@ -4,7 +4,7 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { expect, test, vi, beforeEach, afterEach } from "vitest";
 import { createSharedWebWorker } from "../src/SharedWebWorker.js";
-import { getOrThrow, SimpleName, wait } from "@evolu/common";
+import { SimpleName, wait } from "@evolu/common";
 // Mock BroadcastChannel
 class MockBroadcastChannel {
     name;
@@ -27,12 +27,12 @@ class MockWorker {
 }
 beforeEach(() => {
     // Create a spy for BroadcastChannel constructor
-    global.BroadcastChannel = vi
-        .fn()
-        .mockImplementation((name) => new MockBroadcastChannel(name));
-    global.document = {}; // Simulate browser environment
-    // Mock navigator.locks properly - remove the global.navigator assignment
-    Object.defineProperty(global.navigator, "locks", {
+    globalThis.BroadcastChannel = vi.fn().mockImplementation(function (name) {
+        return new MockBroadcastChannel(name);
+    });
+    globalThis.document = {}; // Simulate browser environment
+    // Mock navigator.locks properly - remove the globalThis.navigator assignment
+    Object.defineProperty(globalThis.navigator, "locks", {
         value: mockLocks,
         writable: true,
         configurable: true,
@@ -44,11 +44,11 @@ afterEach(() => {
 });
 test("createSharedWebWorker creates BroadcastChannel and requests lock", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
-    const sharedWorker = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    const sharedWorker = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Should create BroadcastChannel with namespaced name
-    expect(global.BroadcastChannel).toHaveBeenCalledWith("evolu-sharedwebworker-test-worker");
+    expect(globalThis.BroadcastChannel).toHaveBeenCalledWith("evolu-sharedwebworker-test-worker");
     // Should request owner-ready immediately
-    const channelInstance = vi.mocked(global.BroadcastChannel).mock.results[0]
+    const channelInstance = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
         .value;
     expect(channelInstance.postMessage).toHaveBeenCalledWith({
         type: "request-owner-ready",
@@ -63,22 +63,22 @@ test("createSharedWebWorker creates BroadcastChannel and requests lock", () => {
 });
 test("createSharedWebWorker returns no-op on server", () => {
     // Simulate server environment
-    delete global.document;
+    delete globalThis.document;
     const mockCreateWorker = vi.fn();
-    const sharedWorker = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    const sharedWorker = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Should not create BroadcastChannel or request locks
-    expect(global.BroadcastChannel).not.toHaveBeenCalled();
+    expect(globalThis.BroadcastChannel).not.toHaveBeenCalled();
     expect(mockLocks.request).not.toHaveBeenCalled();
     // Should return no-op worker
     expect(sharedWorker.postMessage).toBeDefined();
     expect(sharedWorker.onMessage).toBeDefined();
     // Restore document for other tests
-    global.document = {};
+    globalThis.document = {};
 });
 test("createSharedWebWorker queues messages when owner not ready", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
-    const sharedWorker = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    const channelInstance = vi.mocked(global.BroadcastChannel).mock.results[0]
+    const sharedWorker = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    const channelInstance = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
         .value;
     // Send message before owner is ready
     sharedWorker.postMessage({ type: "test-message" });
@@ -97,8 +97,8 @@ test("createSharedWebWorker queues messages when owner not ready", () => {
 });
 test("createSharedWebWorker forwards messages when owner ready", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
-    const sharedWorker = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    const channelInstance = vi.mocked(global.BroadcastChannel).mock.results[0]
+    const sharedWorker = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    const channelInstance = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
         .value;
     // Simulate owner-ready message
     const ownerReadyEvent = new MessageEvent("message", {
@@ -116,9 +116,9 @@ test("createSharedWebWorker forwards messages when owner ready", () => {
 test("createSharedWebWorker handles onMessage callback", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
     const onMessageCallback = vi.fn();
-    const sharedWorker = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    const sharedWorker = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     sharedWorker.onMessage(onMessageCallback);
-    const channelInstance = vi.mocked(global.BroadcastChannel).mock.results[0]
+    const channelInstance = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
         .value;
     // Simulate message from worker
     const workerMessage = new MessageEvent("message", {
@@ -143,13 +143,15 @@ test("createSharedWebWorker handles multiple tabs - first tab becomes owner", as
     });
     const mockCreateWorker = vi.fn(() => new MockWorker());
     // Create first tab (will become owner)
-    createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Create second tab
-    createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Both tabs should create BroadcastChannels
-    expect(global.BroadcastChannel).toHaveBeenCalledTimes(2);
-    const tab1Channel = vi.mocked(global.BroadcastChannel).mock.results[0].value;
-    const tab2Channel = vi.mocked(global.BroadcastChannel).mock.results[1].value;
+    expect(globalThis.BroadcastChannel).toHaveBeenCalledTimes(2);
+    const tab1Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
+        .value;
+    const tab2Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[1]
+        .value;
     // Both tabs should request owner-ready
     expect(tab1Channel.postMessage).toHaveBeenCalledWith({
         type: "request-owner-ready",
@@ -158,7 +160,7 @@ test("createSharedWebWorker handles multiple tabs - first tab becomes owner", as
         type: "request-owner-ready",
     });
     // Wait for lock acquisition
-    await wait(10);
+    await wait("10ms")();
     // Only first tab should create worker (it became owner)
     expect(mockCreateWorker).toHaveBeenCalledTimes(1);
     // First tab should announce ownership
@@ -167,10 +169,12 @@ test("createSharedWebWorker handles multiple tabs - first tab becomes owner", as
 test("createSharedWebWorker handles cross-tab message forwarding", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
     // Create two tabs
-    const tab1 = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    const tab2 = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    const tab1Channel = vi.mocked(global.BroadcastChannel).mock.results[0].value;
-    const tab2Channel = vi.mocked(global.BroadcastChannel).mock.results[1].value;
+    const tab1 = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    const tab2 = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    const tab1Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
+        .value;
+    const tab2Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[1]
+        .value;
     // Simulate tab1 receiving owner-ready (tab1 becomes aware of owner)
     const ownerReadyEvent = new MessageEvent("message", {
         data: { type: "owner-ready" },
@@ -196,13 +200,15 @@ test("createSharedWebWorker handles worker responses across tabs", () => {
     const tab1Callback = vi.fn();
     const tab2Callback = vi.fn();
     // Create two tabs
-    const tab1 = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    const tab2 = createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    const tab1 = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    const tab2 = createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Set up message callbacks
     tab1.onMessage(tab1Callback);
     tab2.onMessage(tab2Callback);
-    const tab1Channel = vi.mocked(global.BroadcastChannel).mock.results[0].value;
-    const tab2Channel = vi.mocked(global.BroadcastChannel).mock.results[1].value;
+    const tab1Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[0]
+        .value;
+    const tab2Channel = vi.mocked(globalThis.BroadcastChannel).mock.results[1]
+        .value;
     // Simulate worker response broadcast
     const workerResponse = new MessageEvent("message", {
         data: { type: "from-worker", message: { result: "shared-result" } },
@@ -218,7 +224,7 @@ test("createSharedWebWorker multi-tab scenario", () => {
     const mockCreateWorker = vi.fn(() => new MockWorker());
     const channelInstances = [];
     // Track all BroadcastChannel instances
-    global.BroadcastChannel = vi.fn().mockImplementation((name) => {
+    globalThis.BroadcastChannel = vi.fn().mockImplementation(function (name) {
         const instance = new MockBroadcastChannel(name);
         channelInstances.push(instance);
         // Override postMessage to broadcast to all instances with same name
@@ -239,8 +245,8 @@ test("createSharedWebWorker multi-tab scenario", () => {
         return Promise.resolve();
     });
     // Create two tabs
-    createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
-    createSharedWebWorker(getOrThrow(SimpleName.from("test-worker")), mockCreateWorker);
+    createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
+    createSharedWebWorker(SimpleName.orThrow("test-worker"), mockCreateWorker);
     // Only first tab should create worker (owner)
     expect(mockCreateWorker).toHaveBeenCalledTimes(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolu/web",
-  "version": "1.0.1-preview.5",
+  "version": "1.0.1-preview.7",
   "description": "Evolu for web",
   "keywords": [
     "evolu",
@@ -28,18 +28,20 @@
     "README.md"
   ],
   "dependencies": {
-    "@sqlite.org/sqlite-wasm": "3.50.4-build1"
+    "@evolu/sqlite-wasm": "2.2.4",
+    "idb-keyval": "^6.2.2"
   },
   "devDependencies": {
     "@types/web-locks-api": "^0.0.5",
+    "shx": "^0.4.0",
     "typescript": "^5.9.2",
     "user-agent-data-types": "^0.4.2",
-    "vitest": "^3.2.3",
-    "@evolu/common": "6.0.1-preview.18",
+    "vitest": "^4.0.4",
+    "@evolu/common": "6.0.1-preview.23",
     "@evolu/tsconfig": "0.0.2"
   },
   "peerDependencies": {
-    "@evolu/common": "^6.0.1-preview.18"
+    "@evolu/common": "^6.0.1-preview.23"
   },
   "publishConfig": {
     "access": "public"

package/src/Evolu/Db.worker.ts

@@ -1,27 +1,21 @@
 import {
   createConsole,
-  createEnglishMnemonic,
-  createNanoIdLib,
   createRandom,
   createRandomBytes,
   createTime,
+  createWebSocket,
 } from "@evolu/common";
-import {
-  createDbWorkerForPlatform,
-  createWebSocketSync,
-} from "@evolu/common/evolu";
+import { createDbWorkerForPlatform } from "@evolu/common/evolu";
 import { createWasmSqliteDriver } from "../WasmSqliteDriver.js";
 import { wrapWebWorkerSelf } from "../WebWorker.js";
 
 const dbWorker = createDbWorkerForPlatform({
-  createSqliteDriver: createWasmSqliteDriver,
-  createSync: createWebSocketSync,
   console: createConsole(),
-  time: createTime(),
+  createSqliteDriver: createWasmSqliteDriver,
+  createWebSocket,
   random: createRandom(),
-  nanoIdLib: createNanoIdLib(),
-  createMnemonic: createEnglishMnemonic,
-  createRandomBytes,
+  randomBytes: createRandomBytes(),
+  time: createTime(),
 });
 
 wrapWebWorkerSelf(dbWorker);

package/src/Evolu/LocalAuth.ts

@@ -0,0 +1,329 @@
+import { set, get, del, keys, clear, createStore } from "idb-keyval";
+
+import {
+  createSlip21,
+  utf8ToBytes,
+  bytesToUtf8,
+  base64UrlToUint8Array,
+  uint8ArrayToBase64Url,
+  EncryptionKey,
+  Base64Url,
+} from "@evolu/common";
+
+import type {
+  AuthResult,
+  Entropy32,
+  SensitiveInfoItem,
+  SecureStorage,
+  RandomBytesDep,
+  SymmetricCryptoDep,
+} from "@evolu/common";
+import type { UseStore } from "idb-keyval";
+
+/** @experimental */
+export const createWebAuthnStore = (
+  deps: RandomBytesDep & SymmetricCryptoDep,
+): SecureStorage => ({
+  setItem: async (key, value, options) => {
+    if (options?.accessControl === "none") {
+      const metadata = createMetadata(false);
+      await set(key, { value, metadata }, getStore(options.service));
+      return { metadata };
+    }
+    const seed = generateSeed(deps)();
+    const authResult = JSON.parse(value) as AuthResult;
+    const credential = await createCredential(deps)(
+      options?.webAuthnUsername ?? "Evolu User",
+      seed,
+      options?.relyingPartyID,
+      options?.relyingPartyName,
+      options?.webAuthnUserVerification,
+      options?.webAuthnAuthenticatorAttachment,
+    );
+    const encryptionKey = deriveEncryptionKey(seed);
+    const encryptedData = encryptAuthResult(deps)(authResult, encryptionKey);
+    const credentialId = uint8ArrayToBase64Url(
+      new Uint8Array(credential.rawId),
+    );
+    const metadata = createMetadata();
+    await set(
+      key,
+      { credentialId, ...encryptedData, metadata },
+      getStore(options?.service),
+    );
+    return { metadata };
+  },
+
+  getItem: async (key, options) => {
+    if (options?.accessControl === "none") {
+      const data = await get<{
+        readonly value: string;
+        readonly metadata: SensitiveInfoItem["metadata"];
+      }>(key, getStore(options.service));
+      return data
+        ? {
+            key,
+            value: data.value,
+            service: options.service ?? "default",
+            metadata: data.metadata,
+          }
+        : null;
+    }
+    const data = await get<{
+      readonly nonce: Base64Url;
+      readonly ciphertext: Base64Url;
+      readonly credentialId: string;
+      readonly metadata: SensitiveInfoItem["metadata"];
+    }>(key, getStore(options?.service));
+    if (!data) {
+      return null;
+    }
+    try {
+      const credential = await getCredential(deps)(
+        data.credentialId,
+        options?.relyingPartyID,
+        options?.webAuthnUserVerification,
+      );
+      const credentialSeed = extractSeedFromCredential(credential);
+      const encryptionKey = deriveEncryptionKey(credentialSeed);
+      const authResultVal = decryptAuthResult(deps)(data, encryptionKey);
+      if (!authResultVal) {
+        return null;
+      }
+      return {
+        key,
+        service: options?.service ?? "default",
+        value: authResultVal,
+        metadata: data.metadata,
+      };
+    } catch (_error) {
+      return null;
+    }
+  },
+
+  deleteItem: async (key, options) => {
+    await del(key, getStore(options?.service));
+    return true;
+  },
+
+  getAllItems: async (options) => {
+    const service = options?.service ?? "default";
+    const itemKeys = await keys<string>(getStore(service));
+    const items = await Promise.all(
+      itemKeys.map(async (key) => {
+        const data = await get<{
+          readonly metadata?: SensitiveInfoItem["metadata"];
+          readonly value?: string;
+        }>(key, getStore(service));
+        return {
+          key,
+          service,
+          metadata: data?.metadata ?? createMetadata(),
+          ...(options?.includeValues && data?.value
+            ? { value: data.value }
+            : {}),
+        };
+      }),
+    );
+    return items;
+  },
+
+  clearService: async (options) => {
+    await clear(getStore(options?.service));
+  },
+});
+
+/**
+ * Create default metadata for backwards compatibility with items that don't
+ * have stored metadata.
+ */
+const createMetadata = (isSecure = true): SensitiveInfoItem["metadata"] => {
+  return {
+    backend: "keychain",
+    accessControl: isSecure ? "biometryCurrentSet" : "none",
+    securityLevel: isSecure ? "biometry" : "software",
+    timestamp: Date.now(),
+  };
+};
+
+/** Get storage key for owner ID. (supports namespaces via prefix) */
+const getStore = (prefix = "default"): UseStore => {
+  return createStore(prefix, "evolu-auth");
+};
+
+const createCredential =
+  (deps: RandomBytesDep) =>
+  async (
+    username: string,
+    seed: Uint8Array,
+    relyingPartyID?: string,
+    relyingPartyName?: string,
+    userVerification?: UserVerificationRequirement,
+    authenticatorAttachment?: AuthenticatorAttachment,
+  ): Promise<PublicKeyCredential> => {
+    const options = createCredentialCreationOptions(deps)(
+      username,
+      seed,
+      relyingPartyID,
+      relyingPartyName,
+      userVerification,
+      authenticatorAttachment,
+    );
+    const credential = (await navigator.credentials.create(
+      options,
+    )) as PublicKeyCredential | null;
+    if (!credential) {
+      throw new Error("Failed to create WebAuthn credential");
+    }
+    return credential;
+  };
+
+const getCredential =
+  (deps: RandomBytesDep) =>
+  async (
+    credentialId: string,
+    relyingPartyID?: string,
+    userVerification?: UserVerificationRequirement,
+  ): Promise<PublicKeyCredential> => {
+    const options = createCredentialRequestOptions(deps)(
+      credentialId,
+      relyingPartyID,
+      userVerification,
+    );
+    const credential = (await navigator.credentials.get(
+      options,
+    )) as PublicKeyCredential | null;
+    if (!credential?.response) {
+      throw new Error("Failed to get WebAuthn credential");
+    }
+    return credential;
+  };
+
+const extractSeedFromCredential = (
+  credential: PublicKeyCredential,
+): Uint8Array => {
+  const response = credential.response as AuthenticatorAssertionResponse;
+  if (!response.userHandle) {
+    throw new Error("No userHandle in credential response");
+  }
+  return new Uint8Array(response.userHandle);
+};
+
+const createCredentialCreationOptions =
+  (deps: RandomBytesDep) =>
+  (
+    username: string,
+    seed: Uint8Array,
+    relyingPartyID?: string,
+    relyingPartyName?: string,
+    userVerification?: UserVerificationRequirement,
+    authenticatorAttachment?: AuthenticatorAttachment,
+  ): CredentialCreationOptions => {
+    return {
+      publicKey: {
+        challenge: generateSeed(deps)() as BufferSource,
+        rp: {
+          id: relyingPartyID ?? document.location.hostname,
+          name: relyingPartyName ?? "Evolu",
+        },
+        user: {
+          id: seed as BufferSource,
+          name: username,
+          displayName: username,
+        },
+        pubKeyCredParams: [
+          { type: "public-key", alg: -8 }, // Ed25519
+          { type: "public-key", alg: -7 }, // ES256
+          { type: "public-key", alg: -257 }, // RS256
+        ],
+        attestation: "none",
+        authenticatorSelection: {
+          // - "platform": Uses the platform's built-in authenticator.
+          // - "cross-platform": Uses a device specific authenticator (yubikey, fido2, etc.)
+          authenticatorAttachment: authenticatorAttachment ?? "platform",
+          // - "discouraged": Only User Presence is needed.
+          // - "preferred": User Verification is preferred but not required. Falls back to User Presence.
+          // - "required": User Verification MUST occur (biometrics/PIN). Clients may silently downgrade to User Presence only.
+          userVerification: userVerification ?? "required",
+          // - "discouraged": Server-side credential is preferable, but will accept client-side discoverable credential.
+          // - "preferred": Relying Party strongly prefers client-side discoverable credential but will accept server-side credential.
+          // - "required": Client-side discoverable credential MUST be created, error if it can't be created.
+          residentKey: "required",
+          // Included for backwards compatibility. Deprecated in favor of residentKey (true = "required")
+          requireResidentKey: true,
+        },
+      },
+    };
+  };
+
+const createCredentialRequestOptions =
+  (deps: RandomBytesDep) =>
+  (
+    credentialId: string,
+    relyingPartyID?: string,
+    userVerification?: UserVerificationRequirement,
+  ): CredentialRequestOptions => {
+    return {
+      publicKey: {
+        challenge: generateSeed(deps)() as BufferSource,
+        rpId: relyingPartyID ?? document.location.hostname,
+        userVerification: userVerification ?? "preferred",
+        allowCredentials: [
+          {
+            type: "public-key",
+            id: base64UrlToUint8Array(
+              Base64Url.orThrow(credentialId),
+            ) as BufferSource,
+          },
+        ],
+      },
+    };
+  };
+
+const deriveEncryptionKey = (seed: Uint8Array): EncryptionKey => {
+  const seed32 = seed.length === 32 ? seed : seed.slice(0, 32);
+  return EncryptionKey.orThrow(
+    createSlip21(seed32 as Entropy32, ["evolu", "auth"]),
+  );
+};
+
+const encryptAuthResult =
+  (deps: SymmetricCryptoDep) =>
+  (
+    authResult: AuthResult,
+    encryptionKey: EncryptionKey,
+  ): {
+    nonce: Base64Url;
+    ciphertext: Base64Url;
+  } => {
+    const plaintext = utf8ToBytes(JSON.stringify(authResult));
+    const { nonce, ciphertext } = deps.symmetricCrypto.encrypt(
+      plaintext,
+      encryptionKey,
+    );
+    return {
+      nonce: uint8ArrayToBase64Url(nonce),
+      ciphertext: uint8ArrayToBase64Url(ciphertext),
+    };
+  };
+
+const decryptAuthResult =
+  (deps: SymmetricCryptoDep) =>
+  (
+    encryptedData: { nonce: Base64Url; ciphertext: Base64Url },
+    encryptionKey: EncryptionKey,
+  ): string | null => {
+    const nonce = base64UrlToUint8Array(encryptedData.nonce);
+    const ciphertext = base64UrlToUint8Array(encryptedData.ciphertext);
+    const result = deps.symmetricCrypto.decrypt(
+      ciphertext,
+      encryptionKey,
+      nonce,
+    );
+    if (!result.ok) return null;
+    return bytesToUtf8(result.value);
+  };
+
+const generateSeed = (deps: RandomBytesDep) => () => {
+  return deps.randomBytes.create(32);
+};

package/src/Evolu/Platform.ts

@@ -0,0 +1,9 @@
+import { ReloadApp } from "@evolu/common/evolu";
+
+export const reloadApp: ReloadApp = (url: string) => {
+  if (typeof document === "undefined") {
+    return;
+  }
+
+  location.replace(url);
+};

package/src/Evolu/index.ts

@@ -1,4 +1,10 @@
-import { createConsole, createNanoIdLib, createTime } from "@evolu/common";
+import {
+  createConsole,
+  createLocalAuth,
+  createRandomBytes,
+  createSymmetricCrypto,
+  createTime,
+} from "@evolu/common";
 import {
   CreateDbWorker,
   DbWorkerInput,
@@ -6,7 +12,11 @@ import {
   EvoluDeps,
 } from "@evolu/common/evolu";
 import { createSharedWebWorker } from "../SharedWebWorker.js";
-import { createAppState } from "./AppState.js";
+import { createWebAuthnStore } from "./LocalAuth.js";
+import { reloadApp } from "./Platform.js";
+
+const randomBytes = createRandomBytes();
+const symmetricCrypto = createSymmetricCrypto({ randomBytes });
 
 const createDbWorker: CreateDbWorker = (name) =>
   createSharedWebWorker<DbWorkerInput, DbWorkerOutput>(
@@ -17,10 +27,15 @@ const createDbWorker: CreateDbWorker = (name) =>
       }),
   );
 
+export const localAuth = createLocalAuth({
+  randomBytes,
+  secureStorage: createWebAuthnStore({ randomBytes, symmetricCrypto }),
+});
+
 export const evoluWebDeps: EvoluDeps = {
-  time: createTime(),
   console: createConsole(),
-  nanoIdLib: createNanoIdLib(),
-  createAppState,
   createDbWorker,
+  randomBytes: createRandomBytes(),
+  reloadApp,
+  time: createTime(),
 };

package/src/WasmSqliteDriver.ts

@@ -4,8 +4,12 @@ import {
   CreateSqliteDriver,
   SqliteDriver,
   SqliteRow,
+  bytesToHex,
 } from "@evolu/common";
-import sqlite3InitModule, { PreparedStatement } from "@sqlite.org/sqlite-wasm";
+import sqlite3InitModule, {
+  PreparedStatement,
+  Database,
+} from "@evolu/sqlite-wasm";
 
 // TODO: Do we still need that?
 // https://github.com/sqlite/sqlite-wasm/issues/62
@@ -22,12 +26,29 @@ export const createWasmSqliteDriver: CreateSqliteDriver = async (
   options,
 ) => {
   const sqlite3 = await sqlite3Promise;
+  // This is used to make OPFS default vfs for multipleciphers
+  // @ts-expect-error Missing types (update @evolu/sqlite-wasm types)
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+  sqlite3.capi.sqlite3mc_vfs_create("opfs", 1);
+
+  let db: Database;
+  if (options?.memory) {
+    db = new sqlite3.oo1.DB(":memory:");
+  } else if (options?.encryptionKey) {
+    const pool = await sqlite3.installOpfsSAHPoolVfs({ directory: `.${name}` });
+    db = new pool.OpfsSAHPoolDb(
+      "file:evolu1.db?vfs=multipleciphers-opfs-sahpool",
+    );
+    db.exec(`
+      PRAGMA cipher = 'sqlcipher';
+      PRAGMA legacy = 4;
+      PRAGMA key = "x'${bytesToHex(options.encryptionKey)}'";
+    `);
+  } else {
+    const pool = await sqlite3.installOpfsSAHPoolVfs({ name });
+    db = new pool.OpfsSAHPoolDb("file:evolu1.db");
+  }
 
-  const db = options?.memory
-    ? new sqlite3.oo1.DB(":memory:")
-    : new (await sqlite3.installOpfsSAHPoolVfs({ name })).OpfsSAHPoolDb(
-        "/evolu1.db",
-      );
   let isDisposed = false;
 
   const cache = createPreparedStatementsCache<PreparedStatement>(

package/dist/src/Evolu/AppState.d.ts

@@ -1,3 +0,0 @@
-import { CreateAppState } from "@evolu/common/evolu";
-export declare const createAppState: CreateAppState;
-//# sourceMappingURL=AppState.d.ts.map

package/dist/src/Evolu/AppState.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AppState.d.ts","sourceRoot":"","sources":["../../../src/Evolu/AppState.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE/D,eAAO,MAAM,cAAc,EAAE,cAe5B,CAAC"}

package/dist/src/Evolu/AppState.js

@@ -1,15 +0,0 @@
-import { constVoid } from "@evolu/common";
-export const createAppState = (config) => {
-    if (typeof document === "undefined") {
-        const appState = {
-            reset: constVoid,
-        };
-        return appState;
-    }
-    const appState = {
-        reset: () => {
-            location.replace(config.reloadUrl);
-        },
-    };
-    return appState;
-};

package/src/Evolu/AppState.ts

@@ -1,19 +0,0 @@
-import { constVoid } from "@evolu/common";
-import { AppState, CreateAppState } from "@evolu/common/evolu";
-
-export const createAppState: CreateAppState = (config) => {
-  if (typeof document === "undefined") {
-    const appState: AppState = {
-      reset: constVoid,
-    };
-    return appState;
-  }
-
-  const appState: AppState = {
-    reset: () => {
-      location.replace(config.reloadUrl);
-    },
-  };
-
-  return appState;
-};