@katlux/providers 0.1.1-alpha.105 → 0.1.1-alpha.106

package/dist/index.cjs

@@ -304,6 +304,18 @@ class ADataProvider {
   set sortList(s) {
     this.setSortList(s);
   }
+  get hasMore() {
+    if (this._rowCount <= 0) return false;
+    return this._currentPage * this._pageSize < this._rowCount;
+  }
+  async nextPage() {
+    if (this.hasMore && !this._loading) {
+      await this.setCurrentPage(this._currentPage + 1);
+    }
+  }
+  async loadMore() {
+    await this.nextPage();
+  }
   _listeners = /* @__PURE__ */ new Set();
   _stateListeners = /* @__PURE__ */ new Set();
   _pendingChangedKeys = /* @__PURE__ */ new Set();
@@ -584,11 +596,13 @@ class ADataProvider {
     }
     this.notify();
   }
-  setPageSize(pageSize) {
+  setPageSize(pageSize, resetPage = true) {
     this._pageSize = pageSize;
-    this._currentPage = 1;
+    if (resetPage) {
+      this._currentPage = 1;
+      this._pendingChangedKeys.add("currentPage");
+    }
     this._pendingChangedKeys.add("pageSize");
-    this._pendingChangedKeys.add("currentPage");
     this.loadPageData();
     this.notify();
   }
@@ -2024,9 +2038,6 @@ class RequestQueue {
         Object.assign(headers, existingHeaders);
       }
     }
-    if (typeof document !== "undefined" && document.cookie && !headers["cookie"] && !headers["Cookie"]) {
-      headers["cookie"] = document.cookie;
-    }
     if (this._headerProvider) {
       try {
         const dynamicHeaders = await this._headerProvider();
@@ -2037,6 +2048,9 @@ class RequestQueue {
         console.error("[RequestQueue] Header provider failed:", err);
       }
     }
+    if (typeof document !== "undefined" && document.cookie && !headers["cookie"] && !headers["Cookie"]) {
+      headers["cookie"] = document.cookie;
+    }
     return headers;
   }
   static async executeRequest(item) {
@@ -2060,6 +2074,8 @@ class RequestQueue {
     };
     this.queue = this.queue.filter((i) => i.id !== item.id);
     if (this.deadLetterQueue.length >= this.MAX_DEAD_LETTER_SIZE) {
+      const evicted = this.deadLetterQueue[0];
+      console.warn(`[RequestQueue] Dead-letter queue reached capacity (${this.MAX_DEAD_LETTER_SIZE}). Evicting oldest item: ${evicted?.id}`);
       this.deadLetterQueue = this.deadLetterQueue.slice(1);
     }
     this.deadLetterQueue = [...this.deadLetterQueue, deadItem];
@@ -2143,24 +2159,39 @@ function toBase64(buffer) {
 }
 let objKeyCounter = 0;
 const objKeyMap = /* @__PURE__ */ new WeakMap();
-function getKeyIdentifier(keyProvider, defaultKey) {
-  const target = keyProvider ?? defaultKey;
-  if (typeof target === "string") {
-    return target;
+function fastKeyHash(str) {
+  let h1 = 3735928559 ^ 0;
+  let h2 = 1103547991 ^ 0;
+  for (let i = 0; i < str.length; i++) {
+    const ch = str.charCodeAt(i);
+    h1 = Math.imul(h1 ^ ch, 2654435761);
+    h2 = Math.imul(h2 ^ ch, 1597334677);
+  }
+  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507) ^ Math.imul(h2 ^ h2 >>> 13, 3266489909);
+  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507) ^ Math.imul(h1 ^ h1 >>> 13, 3266489909);
+  return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(16);
+}
+function getSafeKeyIdentifier(rawKey) {
+  if (typeof rawKey === "string") {
+    return `h_${fastKeyHash(rawKey)}`;
   }
-  if (target instanceof Uint8Array || target instanceof ArrayBuffer) {
-    return toBase64(target);
+  if (rawKey instanceof Uint8Array || rawKey instanceof ArrayBuffer) {
+    return `b_${fastKeyHash(toBase64(rawKey))}`;
   }
-  if (typeof target === "function" || typeof target === "object" && target !== null) {
-    let id = objKeyMap.get(target);
+  if ((typeof rawKey === "object" || typeof rawKey === "function") && rawKey !== null) {
+    let id = objKeyMap.get(rawKey);
     if (!id) {
-      id = `__ref_${++objKeyCounter}__`;
-      objKeyMap.set(target, id);
+      id = `__key_${++objKeyCounter}__`;
+      objKeyMap.set(rawKey, id);
     }
     return id;
   }
   return "__default__";
 }
+function getKeyIdentifier(keyProvider, defaultKey) {
+  const target = keyProvider ?? defaultKey;
+  return getSafeKeyIdentifier(target);
+}
 
 class AEncryptionProvider {
   defaultKey;
@@ -2412,6 +2443,11 @@ class CKeyManager {
   // ── Symmetric Key Management ─────────────────────────────────────────────
   /**
    * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
+   *
+   * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
+   * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
+   * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
+   * Client-side malware/trojan protection is out of scope.
    */
   static async generateAESKey(length = 256, algorithm = "AES-GCM", extractable = true) {
     const subtle = getSubtleCrypto();
@@ -2871,6 +2907,8 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
   _cachedKdf;
   _cachedIter;
   _cachedHash;
+  _cachedKeyId;
+  _configuredKid;
   _decryptSaltCache = /* @__PURE__ */ new Map();
   setDefaultKey(key) {
     super.setDefaultKey(key);
@@ -2879,6 +2917,7 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     this._cachedKdf = void 0;
     this._cachedIter = void 0;
     this._cachedHash = void 0;
+    this._cachedKeyId = void 0;
     this._decryptSaltCache.clear();
   }
   clearKeys() {
@@ -2888,11 +2927,15 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     this._cachedKdf = void 0;
     this._cachedIter = void 0;
     this._cachedHash = void 0;
+    this._cachedKeyId = void 0;
     this._decryptSaltCache.clear();
   }
   constructor(key, options) {
     super(key);
     if (options) {
+      if (options.kid || options.keyId) {
+        this._configuredKid = options.kid || options.keyId;
+      }
       this._defaultKdf = options.kdf || "pbkdf2";
       if (options.kdf && options.kdf !== "none") {
         this._kdfOptions = {
@@ -2909,6 +2952,9 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
    * Derives or returns a CryptoKey for encryption/decryption based on KDF settings.
    */
   async resolveCryptoKey(keyProvider, kdfOverride, saltOverride, options, iterationsOverride) {
+    if (options?._warmedKey) {
+      return options._warmedKey;
+    }
     if (saltOverride) {
       const saltKey = typeof saltOverride === "string" ? saltOverride : CKeyManager.toBase64(saltOverride);
       const keyId = getKeyIdentifier(keyProvider, this.defaultKey);
@@ -2972,13 +3018,16 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     const matchesHash = !targetHash || this._cachedHash !== void 0 && targetHash.toLowerCase() === this._cachedHash.toLowerCase();
     const matchesKdf = this._cachedKdf !== void 0 && kdf === this._cachedKdf.toLowerCase();
     const matchesSalt = !saltOverride || this._cachedSalt !== void 0 && saltOverride === this._cachedSalt;
-    if (!keyProvider && this._cachedKey && matchesSalt && !options?.kdfSalt && matchesKdf && matchesIter && matchesHash) {
-      return { cryptoKey: this._cachedKey, salt: this._cachedSalt, kdf: this._cachedKdf, iter: this._cachedIter };
+    const currentKeyId = getKeyIdentifier(keyProvider, this.defaultKey);
+    if (this._cachedKey && matchesSalt && !options?.kdfSalt && matchesKdf && matchesIter && matchesHash) {
+      if (!this._cachedKeyId || this._cachedKeyId === currentKeyId) {
+        return { cryptoKey: this._cachedKey, salt: this._cachedSalt, kdf: this._cachedKdf, iter: this._cachedIter };
+      }
     }
     if (kdf === "pbkdf2") {
       const salt = saltOverride || options?.kdfSalt || this._kdfOptions?.salt;
       const rawIterations = iterationsOverride || options?.kdfIterations || this._kdfOptions?.iterations || 31e4;
-      const iterations = Math.min(Math.max(rawIterations, 1e3), 1e6);
+      const iterations = Math.min(Math.max(rawIterations, 1e3), 6e5);
       const hash = options?.kdfHash || this._kdfOptions?.hash || "SHA-256";
       const derived = await CKeyManager.deriveKey(passphrase, {
         kdf: "pbkdf2",
@@ -2986,16 +3035,22 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
         iterations,
         hash
       });
-      if (!keyProvider && !saltOverride && !options?.kdfSalt) {
+      if (!saltOverride && !options?.kdfSalt) {
         this._cachedKey = derived.key;
         this._cachedSalt = derived.salt;
         this._cachedKdf = "PBKDF2";
         this._cachedIter = iterations;
         this._cachedHash = hash;
+        this._cachedKeyId = currentKeyId;
       }
       return { cryptoKey: derived.key, salt: derived.salt, kdf: "PBKDF2", iter: iterations };
     }
     if (kdf === "hkdf") {
+      if (typeof rawKey === "string") {
+        console.warn(
+          '[CWebCryptoEncryptionProvider] ADVISORY: HKDF is designed for high-entropy input key material (IKM), not low-entropy human passphrases. Use "pbkdf2" for password-derived encryption.'
+        );
+      }
       const salt = saltOverride || options?.kdfSalt || this._kdfOptions?.salt;
       const hash = options?.kdfHash || this._kdfOptions?.hash || "SHA-256";
       const info = options?.info || this._kdfOptions?.info;
@@ -3005,18 +3060,21 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
         hash,
         info
       });
-      if (!keyProvider && !saltOverride && !options?.kdfSalt) {
+      if (!saltOverride && !options?.kdfSalt) {
         this._cachedKey = derived.key;
         this._cachedSalt = derived.salt;
         this._cachedKdf = "HKDF";
         this._cachedHash = hash;
+        this._cachedKeyId = currentKeyId;
       }
       return { cryptoKey: derived.key, salt: derived.salt, kdf: "HKDF" };
     }
     if (kdf === "none") {
-      console.warn(
-        "[CWebCryptoEncryptionProvider] WARNING: Decrypting a legacy envelope with no KDF (raw SHA-256 key derivation). This is cryptographically weak. Migrate to pbkdf2 or hkdf."
-      );
+      if (saltOverride) {
+        console.warn(
+          "[CWebCryptoEncryptionProvider] WARNING: Decrypting a legacy envelope with no KDF (raw SHA-256 key derivation). This is cryptographically weak. Migrate to pbkdf2 or hkdf."
+        );
+      }
     }
     if (!keyProvider && this._cachedKey && this._cachedKdf === "none") {
       return { cryptoKey: this._cachedKey, kdf: "none" };
@@ -3056,12 +3114,14 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
   }
   async warmupKey(options) {
     const res = await this.resolveCryptoKey(options?.key, void 0, void 0, options);
-    if (!options?.key) {
-      this._cachedKey = res.cryptoKey;
-      this._cachedSalt = res.salt;
-      this._cachedKdf = res.kdf;
-      this._cachedIter = res.iter;
-      this._cachedHash = options?.kdfHash || this._kdfOptions?.hash || "SHA-256";
+    this._cachedKey = res.cryptoKey;
+    this._cachedSalt = res.salt;
+    this._cachedKdf = res.kdf;
+    this._cachedIter = res.iter;
+    this._cachedHash = options?.kdfHash || this._kdfOptions?.hash || "SHA-256";
+    this._cachedKeyId = getKeyIdentifier(options?.key, this.defaultKey);
+    if (options) {
+      options._warmedKey = res;
     }
   }
   /**
@@ -3077,11 +3137,25 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     const subtle = getSubtleCrypto();
     const jsonString = JSON.stringify(data);
     const iv = CKeyManager.randomBytes(12);
+    const encryptParams = {
+      name: "AES-GCM",
+      iv
+    };
+    const aad = options?.aad;
+    let hasAad = false;
+    if (aad) {
+      const aadBytes = typeof aad === "string" ? textEncoder.encode(aad) : aad instanceof Uint8Array ? aad : new Uint8Array(aad);
+      if (aadBytes.byteLength > 0) {
+        encryptParams.additionalData = aadBytes;
+        hasAad = true;
+      }
+    }
     const ciphertextBuffer = await subtle.encrypt(
-      { name: "AES-GCM", iv },
+      encryptParams,
       cryptoKey,
       textEncoder.encode(jsonString)
     );
+    const kid = options?.kid || options?.keyId || this._configuredKid;
     return {
       __encrypted: true,
       ciphertext: CKeyManager.toBase64(ciphertextBuffer),
@@ -3089,7 +3163,9 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
       alg: "AES-GCM",
       ...salt ? { salt } : {},
       ...kdf && kdf !== "none" && kdf !== "raw" && kdf !== "direct" ? { kdf } : {},
-      ...iter ? { iter } : {}
+      ...iter ? { iter } : {},
+      ...kid ? { kid } : {},
+      ...hasAad ? { aad: true } : {}
     };
   }
   /**
@@ -3115,13 +3191,31 @@ class CWebCryptoEncryptionProvider extends AEncryptionProvider {
       let ciphertextBytes = CKeyManager.fromBase64(payload.ciphertext);
       if (payload.tag) {
         const tagBytes = CKeyManager.fromBase64(payload.tag);
+        if (tagBytes.length !== 16) {
+          throw new Error("[CWebCryptoEncryptionProvider] Authentication tag must be exactly 16 bytes for AES-256-GCM");
+        }
         const combined = new Uint8Array(ciphertextBytes.length + tagBytes.length);
         combined.set(ciphertextBytes, 0);
         combined.set(tagBytes, ciphertextBytes.length);
         ciphertextBytes = combined;
       }
+      const decryptParams = {
+        name: "AES-GCM",
+        iv
+      };
+      const aad = options?.aad;
+      if (payload.aad || aad) {
+        if (aad) {
+          const aadBytes = typeof aad === "string" ? textEncoder.encode(aad) : aad instanceof Uint8Array ? aad : new Uint8Array(aad);
+          if (aadBytes.byteLength > 0) {
+            decryptParams.additionalData = aadBytes;
+          }
+        } else if (payload.aad) {
+          throw new Error("[CWebCryptoEncryptionProvider] Payload requires Authenticated Additional Data (AAD) for decryption, but none was provided.");
+        }
+      }
       const decryptedBuffer = await subtle.decrypt(
-        { name: "AES-GCM", iv },
+        decryptParams,
         cryptoKey,
         ciphertextBytes
       );
@@ -3146,11 +3240,15 @@ class CWebCryptoAESCBCProvider extends AEncryptionProvider {
   _cachedKdf;
   _cachedIter;
   _cachedHash;
+  _configuredKid;
   _kdfOptions;
   _decryptSaltCache = /* @__PURE__ */ new Map();
   constructor(key, options) {
     super(key);
     if (options) {
+      if (options.kid || options.keyId) {
+        this._configuredKid = options.kid || options.keyId;
+      }
       this._defaultKdf = options.kdf || "pbkdf2";
       if (options.kdf && options.kdf !== "none") {
         this._kdfOptions = {
@@ -3341,6 +3439,11 @@ class CWebCryptoAESCBCProvider extends AEncryptionProvider {
     }
     const passphraseBytes = textEncoder.encode(rawKey);
     const kdf = (kdfOverride || options?.kdf || this._defaultKdf || "none").toLowerCase();
+    if (kdf === "hkdf" && typeof rawKey === "string") {
+      console.warn(
+        '[CWebCryptoAESCBCProvider] ADVISORY: HKDF is designed for high-entropy input key material (IKM), not low-entropy human passphrases. Use "pbkdf2" for password-derived encryption.'
+      );
+    }
     let raw512;
     let saltStr;
     let kdfType;
@@ -3352,7 +3455,7 @@ class CWebCryptoAESCBCProvider extends AEncryptionProvider {
         saltStr = CKeyManager.toBase64(saltBytes);
         kdfType = "PBKDF2";
         const rawIter = iterationsOverride || options?.kdfIterations || this._kdfOptions?.iterations || 31e4;
-        const iterations = Math.min(Math.max(rawIter, 1e3), 1e6);
+        const iterations = Math.min(Math.max(rawIter, 1e3), 6e5);
         iterNum = iterations;
         const baseKey = await subtle.importKey(
           "raw",
@@ -3473,6 +3576,7 @@ class CWebCryptoAESCBCProvider extends AEncryptionProvider {
     macPayload.set(iv, 0);
     macPayload.set(ciphertextBytes, iv.length);
     const tagBuffer = await subtle.sign("HMAC", macKey, macPayload);
+    const kid = options?.kid || options?.keyId || this._configuredKid;
     return {
       __encrypted: true,
       ciphertext: CKeyManager.toBase64(ciphertextBuffer),
@@ -3481,7 +3585,8 @@ class CWebCryptoAESCBCProvider extends AEncryptionProvider {
       alg: "AES-CBC-256+HMAC-SHA-256",
       ...salt ? { salt } : {},
       ...kdf && kdf !== "none" && kdf !== "raw" && kdf !== "hkdf-direct" ? { kdf } : {},
-      ...iter ? { iter } : {}
+      ...iter ? { iter } : {},
+      ...kid ? { kid } : {}
     };
   }
   /**
@@ -3671,12 +3776,14 @@ class CRSAEncryptionProvider extends AEncryptionProvider {
       new Uint8Array(rawKeyBuffer).fill(0);
     }
     const modulusLength = pubKey.algorithm?.modulusLength || 4096;
+    const kid = options?.kid || options?.keyId;
     return {
       __encrypted: true,
       ciphertext: CKeyManager.toBase64(ciphertextBuffer),
       iv: CKeyManager.toBase64(iv),
       wrappedKey: CKeyManager.toBase64(wrappedKeyBuffer),
-      alg: `RSA-OAEP-${modulusLength}+AES-GCM-256`
+      alg: `RSA-OAEP-${modulusLength}+AES-GCM-256`,
+      ...kid ? { kid } : {}
     };
   }
   /**
@@ -3785,13 +3892,15 @@ class CRSAEncryptionProvider extends AEncryptionProvider {
           dataKey,
           textEncoder.encode(jsonString)
         );
+        const kid = options?.kid || options?.keyId;
         const fieldPayload = {
           __encrypted: true,
           ciphertext: CKeyManager.toBase64(ciphertextBuffer),
           iv: CKeyManager.toBase64(iv),
           wrappedKey: wrappedKeyBase64,
           sharedKey: true,
-          alg
+          alg,
+          ...kid ? { kid } : {}
         };
         safeSetProperty(result, field, fieldPayload);
       }
@@ -4067,13 +4176,15 @@ class CECDHEncryptionProvider extends AEncryptionProvider {
       textEncoder.encode(jsonString)
     );
     const epkJwk = await subtle.exportKey("jwk", ephemeralPair.publicKey);
+    const kid = options?.kid || options?.keyId;
     return {
       __encrypted: true,
       ciphertext: CKeyManager.toBase64(ciphertextBuffer),
       iv: CKeyManager.toBase64(iv),
       epk: epkJwk,
       salt: CKeyManager.toBase64(saltBytes),
-      alg: `ECDH-${curve}+AES-GCM-256`
+      alg: `ECDH-${curve}+AES-GCM-256`,
+      ...kid ? { kid } : {}
     };
   }
   /**
@@ -4140,13 +4251,15 @@ class CECDHEncryptionProvider extends AEncryptionProvider {
         dataKey,
         textEncoder.encode(jsonString)
       );
+      const kid = options?.kid || options?.keyId;
       safeSetProperty(result, field, {
         __encrypted: true,
         ciphertext: CKeyManager.toBase64(ciphertextBuffer),
         iv: CKeyManager.toBase64(iv),
         epk: epkJwk,
         salt: saltBase64,
-        alg
+        alg,
+        ...kid ? { kid } : {}
       });
     }
     return result;
@@ -4324,6 +4437,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
   _cachedKdf;
   _cachedIter;
   _cachedHash;
+  _configuredKid;
   setDefaultKey(key) {
     super.setDefaultKey(key);
     if (this._cachedKey) {
@@ -4379,6 +4493,9 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
   constructor(key, options) {
     super(key);
     if (options) {
+      if (options.kid || options.keyId) {
+        this._configuredKid = options.kid || options.keyId;
+      }
       this._defaultKdf = options.kdf || "pbkdf2";
       if (options.kdf && options.kdf !== "none") {
         this._kdfOptions = {
@@ -4481,7 +4598,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       const saltBytes = CKeyManager.resolveSalt(s);
       const saltBuf = Buffer.from(saltBytes.buffer, saltBytes.byteOffset, saltBytes.byteLength);
       const rawIter = iterationsOverride || options?.kdfIterations || this._kdfOptions?.iterations || 31e4;
-      const iterations = Math.min(Math.max(rawIter, 1e3), 1e6);
+      const iterations = Math.min(Math.max(rawIter, 1e3), 6e5);
       const hash = (options?.kdfHash || this._kdfOptions?.hash || "SHA-256").toLowerCase().replace("-", "");
       const key2 = crypto__namespace.pbkdf2Sync(passphrase, saltBuf, iterations, 32, hash);
       if (!keyProvider && !saltOverride && !options?.kdfSalt) {
@@ -4499,6 +4616,11 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       };
     }
     if (kdf === "hkdf") {
+      if (typeof raw === "string") {
+        console.warn(
+          '[CNodeCryptoEncryptionProvider] ADVISORY: HKDF is designed for high-entropy input key material (IKM), not low-entropy human passphrases. Use "pbkdf2" for password-derived encryption.'
+        );
+      }
       const s = saltOverride || options?.kdfSalt || this._kdfOptions?.salt;
       const saltBytes = CKeyManager.resolveSalt(s);
       const saltBuf = Buffer.from(saltBytes.buffer, saltBytes.byteOffset, saltBytes.byteLength);
@@ -4565,7 +4687,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       const saltBytes = CKeyManager.resolveSalt(s);
       const saltBuf = Buffer.from(saltBytes.buffer, saltBytes.byteOffset, saltBytes.byteLength);
       const rawIter = iterationsOverride || options?.kdfIterations || this._kdfOptions?.iterations || 31e4;
-      const iterations = Math.min(Math.max(rawIter, 1e3), 1e6);
+      const iterations = Math.min(Math.max(rawIter, 1e3), 6e5);
       const hash = (options?.kdfHash || this._kdfOptions?.hash || "SHA-256").toLowerCase().replace("-", "");
       const key2 = await new Promise((resolve, reject) => {
         crypto__namespace.pbkdf2(passphrase, saltBuf, iterations, 32, hash, (err, derived) => {
@@ -4588,6 +4710,11 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       };
     }
     if (kdf === "hkdf") {
+      if (typeof raw === "string") {
+        console.warn(
+          '[CNodeCryptoEncryptionProvider] ADVISORY: HKDF is designed for high-entropy input key material (IKM), not low-entropy human passphrases. Use "pbkdf2" for password-derived encryption.'
+        );
+      }
       const s = saltOverride || options?.kdfSalt || this._kdfOptions?.salt;
       const saltBytes = CKeyManager.resolveSalt(s);
       const saltBuf = Buffer.from(saltBytes.buffer, saltBytes.byteOffset, saltBytes.byteLength);
@@ -4649,12 +4776,22 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       const jsonString = JSON.stringify(data);
       const iv = crypto__namespace.randomBytes(12);
       const cipher = crypto__namespace.createCipheriv("aes-256-gcm", key, iv);
+      const aad = options?.aad;
+      let hasAad = false;
+      if (aad) {
+        const aadBuffer = Buffer.isBuffer(aad) ? aad : Buffer.from(typeof aad === "string" ? aad : new Uint8Array(aad));
+        if (aadBuffer.length > 0) {
+          cipher.setAAD(aadBuffer);
+          hasAad = true;
+        }
+      }
       const encryptedBuffer = Buffer.concat([
         cipher.update(jsonString, "utf8"),
         cipher.final()
       ]);
       const authTag = cipher.getAuthTag();
       const combinedCiphertext = Buffer.concat([encryptedBuffer, authTag]);
+      const kid = options?.kid || options?.keyId || this._configuredKid;
       return {
         __encrypted: true,
         ciphertext: combinedCiphertext.toString("base64"),
@@ -4662,7 +4799,9 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
         alg: "AES-GCM",
         ...salt ? { salt } : {},
         ...kdf && kdf !== "none" && kdf !== "raw" ? { kdf } : {},
-        ...iter ? { iter } : {}
+        ...iter ? { iter } : {},
+        ...kid ? { kid } : {},
+        ...hasAad ? { aad: true } : {}
       };
     } finally {
       if (key !== this._cachedKey) {
@@ -4670,7 +4809,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       }
     }
   }
-  decryptCiphertextWithKey(payload, key) {
+  decryptCiphertextWithKey(payload, key, options) {
     const iv = Buffer.from(payload.iv, "base64");
     const fullCiphertext = Buffer.from(payload.ciphertext, "base64");
     let ciphertext;
@@ -4678,6 +4817,9 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
     if (payload.tag) {
       ciphertext = fullCiphertext;
       authTag = Buffer.from(payload.tag, "base64");
+      if (authTag.length !== 16) {
+        throw new Error("[CNodeCryptoEncryptionProvider] Authentication tag must be exactly 16 bytes for AES-256-GCM");
+      }
     } else {
       if (fullCiphertext.length < 16) {
         throw new Error("Ciphertext too short to contain authentication tag");
@@ -4685,8 +4827,19 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       ciphertext = fullCiphertext.subarray(0, fullCiphertext.length - 16);
       authTag = fullCiphertext.subarray(fullCiphertext.length - 16);
     }
-    const decipher = crypto__namespace.createDecipheriv("aes-256-gcm", key, iv);
+    const decipher = crypto__namespace.createDecipheriv("aes-256-gcm", key, iv, { authTagLength: 16 });
     decipher.setAuthTag(authTag);
+    const aad = options?.aad;
+    if (payload.aad || aad) {
+      if (aad) {
+        const aadBuffer = Buffer.isBuffer(aad) ? aad : Buffer.from(typeof aad === "string" ? aad : new Uint8Array(aad));
+        if (aadBuffer.length > 0) {
+          decipher.setAAD(aadBuffer);
+        }
+      } else if (payload.aad) {
+        throw new Error("[CNodeCryptoEncryptionProvider] Payload requires Authenticated Additional Data (AAD) for decryption, but none was provided.");
+      }
+    }
     const decrypted = Buffer.concat([
       decipher.update(ciphertext),
       decipher.final()
@@ -4715,7 +4868,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       payload.iter
     );
     try {
-      return this.decryptCiphertextWithKey(payload, key);
+      return this.decryptCiphertextWithKey(payload, key, options);
     } catch (err) {
       if (err instanceof SyntaxError) throw err;
       throw new Error(`[CNodeCryptoEncryptionProvider] Decryption failed: ${err?.message || "Authentication tag mismatch or corrupted ciphertext"}`);
@@ -4790,7 +4943,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
               derivedKey = derived.key;
               keyCache.set(salt, derivedKey);
             }
-            safeSetProperty(result, key, this.decryptCiphertextWithKey(fieldPayload, derivedKey));
+            safeSetProperty(result, key, this.decryptCiphertextWithKey(fieldPayload, derivedKey, options));
             mutated = true;
           }
         }
@@ -4830,12 +4983,22 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       const jsonString = JSON.stringify(data);
       const iv = crypto__namespace.randomBytes(12);
       const cipher = crypto__namespace.createCipheriv("aes-256-gcm", key, iv);
+      const aad = options?.aad;
+      let hasAad = false;
+      if (aad) {
+        const aadBuffer = Buffer.isBuffer(aad) ? aad : Buffer.from(typeof aad === "string" ? aad : new Uint8Array(aad));
+        if (aadBuffer.length > 0) {
+          cipher.setAAD(aadBuffer);
+          hasAad = true;
+        }
+      }
       const ciphertext = Buffer.concat([
         cipher.update(jsonString, "utf8"),
         cipher.final()
       ]);
       const authTag = cipher.getAuthTag();
       const combined = Buffer.concat([ciphertext, authTag]);
+      const kid = options?.kid || options?.keyId || this._configuredKid;
       return {
         __encrypted: true,
         ciphertext: combined.toString("base64"),
@@ -4843,7 +5006,9 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
         alg: "AES-GCM",
         ...salt ? { salt } : {},
         ...kdf && kdf !== "none" && kdf !== "raw" ? { kdf } : {},
-        ...iter ? { iter } : {}
+        ...iter ? { iter } : {},
+        ...kid ? { kid } : {},
+        ...hasAad ? { aad: true } : {}
       };
     } finally {
       if (key !== this._cachedKey) {
@@ -4865,7 +5030,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
       payload.iter
     );
     try {
-      return this.decryptCiphertextWithKey(payload, key);
+      return this.decryptCiphertextWithKey(payload, key, options);
     } catch (err) {
       if (err instanceof SyntaxError) throw err;
       throw new Error(`[CNodeCryptoEncryptionProvider] Decryption failed: ${err?.message || "Authentication tag mismatch or corrupted ciphertext"}`);
@@ -4906,7 +5071,7 @@ class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
               derivedKey = derived.key;
               keyCache.set(salt, derivedKey);
             }
-            safeSetProperty(result, key, this.decryptCiphertextWithKey(fieldPayload, derivedKey));
+            safeSetProperty(result, key, this.decryptCiphertextWithKey(fieldPayload, derivedKey, options));
             mutated = true;
           }
         }
@@ -5067,40 +5232,66 @@ class RequestProvider {
   setDeduplicate(deduplicate) {
     this.deduplicate = deduplicate;
   }
+  setQueue(queue) {
+    this.queue = queue;
+  }
   encryption;
   _cachedCipherProvider;
   _lastEncryptionConfig;
+  _scopedCipherProviders = /* @__PURE__ */ new WeakMap();
+  /**
+   * Configures E2EE payload encryption for outbound mutations and inbound responses.
+   *
+   * Threat Model: Protects sensitive SaaS tenant data against backend/database breaches.
+   * Multi-user sharing is supported by role-based session keys passed dynamically.
+   * Local client endpoint compromise (malware, trojans, keyloggers) is out of scope.
+   */
+  disposeCipherInstance(provider) {
+    if (!provider) return;
+    if (typeof provider.dispose === "function") {
+      try {
+        provider.dispose();
+      } catch {
+      }
+    } else if (typeof provider.clearKeys === "function") {
+      try {
+        provider.clearKeys();
+      } catch {
+      }
+    }
+  }
   setEncryption(encryption) {
-    if (this._cachedCipherProvider && this._lastEncryptionConfig !== encryption) {
-      if (typeof this._cachedCipherProvider.dispose === "function") {
-        try {
-          this._cachedCipherProvider.dispose();
-        } catch {
-        }
-      } else if (typeof this._cachedCipherProvider.clearKeys === "function") {
-        try {
-          this._cachedCipherProvider.clearKeys();
-        } catch {
-        }
+    if (this._lastEncryptionConfig && this._lastEncryptionConfig !== encryption) {
+      const scopedOld = this._scopedCipherProviders.get(this._lastEncryptionConfig);
+      if (scopedOld && scopedOld !== this._cachedCipherProvider) {
+        this.disposeCipherInstance(scopedOld);
       }
+      this._scopedCipherProviders.delete(this._lastEncryptionConfig);
+    }
+    if (this._cachedCipherProvider && this._lastEncryptionConfig !== encryption) {
+      this.disposeCipherInstance(this._cachedCipherProvider);
     }
     this.encryption = encryption;
     this._cachedCipherProvider = void 0;
     this._lastEncryptionConfig = void 0;
   }
   clearEncryption() {
-    if (this._cachedCipherProvider) {
-      if (typeof this._cachedCipherProvider.dispose === "function") {
-        try {
-          this._cachedCipherProvider.dispose();
-        } catch {
-        }
-      } else if (typeof this._cachedCipherProvider.clearKeys === "function") {
-        try {
-          this._cachedCipherProvider.clearKeys();
-        } catch {
-        }
+    if (this.encryption) {
+      const scoped = this._scopedCipherProviders.get(this.encryption);
+      if (scoped && scoped !== this._cachedCipherProvider) {
+        this.disposeCipherInstance(scoped);
+      }
+      this._scopedCipherProviders.delete(this.encryption);
+    }
+    if (this._lastEncryptionConfig) {
+      const scopedLast = this._scopedCipherProviders.get(this._lastEncryptionConfig);
+      if (scopedLast && scopedLast !== this._cachedCipherProvider) {
+        this.disposeCipherInstance(scopedLast);
       }
+      this._scopedCipherProviders.delete(this._lastEncryptionConfig);
+    }
+    if (this._cachedCipherProvider) {
+      this.disposeCipherInstance(this._cachedCipherProvider);
     }
     this.encryption = void 0;
     this._cachedCipherProvider = void 0;
@@ -5166,6 +5357,7 @@ class RequestProvider {
         }
         return event.context.__katluxRequestsInFlight;
       }
+      return /* @__PURE__ */ new Map();
     }
     return RequestProvider.requestsInFlight;
   }
@@ -5190,11 +5382,6 @@ class RequestProvider {
       }
       serverAuthIdentity = authHeader || authCookies || "";
     }
-    if (options?.key) {
-      const authSuffix = serverAuthIdentity ? `|${hashIdentity(serverAuthIdentity)}` : "";
-      const fullKey = `${options.key}${authSuffix}`;
-      return namespace ? `${namespace}:${fullKey}` : fullKey;
-    }
     let headersForCache = headers || {};
     if (headers) {
       headersForCache = {};
@@ -5205,21 +5392,26 @@ class RequestProvider {
         }
       }
     }
+    const encOptions = options?.encryption || this.encryption;
+    const encSuffix = encOptions?.enabled ? `|enc_${encOptions.keyId || encOptions.kid || (typeof encOptions.key === "string" ? fastKeyHash(encOptions.key) : "1")}` : "";
     if (options?.key) {
       const authSuffix = serverAuthIdentity ? `|${hashIdentity(serverAuthIdentity)}` : "";
-      const fullKey = `${options.key}${authSuffix}`;
+      const fullKey = `${options.key}${encSuffix}${authSuffix}`;
       return namespace ? `${namespace}:${fullKey}` : fullKey;
     }
     const parts = [
       url,
       stableStringify(query || {}),
       stableStringify(body || null),
-      stableStringify(headersForCache)
+      stableStringify(headersForCache),
+      method || "GET"
     ];
     if (serverAuthIdentity) {
       parts.push(hashIdentity(serverAuthIdentity));
     }
-    parts.push(method || "GET");
+    if (encSuffix) {
+      parts.push(encSuffix.slice(1));
+    }
     const baseKey = parts.join("|");
     return namespace ? `${namespace}:${baseKey}` : baseKey;
   }
@@ -5233,13 +5425,31 @@ class RequestProvider {
     const tags = effectiveOptions.tags || this.tags;
     const label = effectiveOptions.label || effectiveOptions.queueLabel;
     if (shouldQueue && method !== "GET") {
-      return RequestQueue.enqueue({
-        url,
-        method,
-        options: options || {},
-        tags,
-        label
-      });
+      const enqueuePromise = (async () => {
+        const encOptions = effectiveOptions.encryption;
+        let effectiveBody = effectiveOptions.body;
+        const isBinaryOrFormBody = effectiveBody !== void 0 && effectiveBody !== null && (typeof FormData !== "undefined" && effectiveBody instanceof FormData || typeof Blob !== "undefined" && effectiveBody instanceof Blob || typeof URLSearchParams !== "undefined" && effectiveBody instanceof URLSearchParams || typeof ArrayBuffer !== "undefined" && (effectiveBody instanceof ArrayBuffer || ArrayBuffer.isView(effectiveBody)));
+        if (encOptions?.enabled && effectiveBody !== void 0 && effectiveBody !== null && !isBinaryOrFormBody) {
+          const cipherProvider = this.getCipherProvider(encOptions);
+          const isServer = typeof window === "undefined";
+          effectiveBody = await cipherProvider.encrypt(
+            effectiveBody,
+            this.buildEncryptionContext(encOptions, url, method, isServer)
+          );
+        }
+        const queuedOptions = {
+          ...effectiveOptions,
+          body: effectiveBody
+        };
+        return RequestQueue.enqueue({
+          url,
+          method,
+          options: queuedOptions,
+          tags,
+          label
+        });
+      })();
+      return enqueuePromise;
     }
     const inFlightMap = this.getInFlightMap(options);
     const uniqueKey = this.getUniqueKey(url, options);
@@ -5320,26 +5530,40 @@ class RequestProvider {
     if (encOptions === this.encryption && this._cachedCipherProvider) {
       return this._cachedCipherProvider;
     }
-    const provider = createEncryptionProvider(encOptions);
+    let provider = this._scopedCipherProviders.get(encOptions);
+    if (!provider) {
+      provider = createEncryptionProvider(encOptions);
+      this._scopedCipherProviders.set(encOptions, provider);
+    }
     if (encOptions === this.encryption) {
       this._cachedCipherProvider = provider;
       this._lastEncryptionConfig = encOptions;
     }
     return provider;
   }
-  isDataEncrypted(provider, data, visited = /* @__PURE__ */ new WeakSet()) {
+  isDataEncrypted(provider, data) {
     if (!data || typeof data !== "object") return false;
-    if (visited.has(data)) return false;
-    visited.add(data);
+    if (data.__encrypted === true) return true;
     if (typeof provider.isEncrypted === "function" && provider.isEncrypted(data)) {
       return true;
     }
     if (Array.isArray(data)) {
-      return data.some((item) => this.isDataEncrypted(provider, item, visited));
+      if (data.length === 0) return false;
+      const first = data[0];
+      return first !== null && typeof first === "object" && (first.__encrypted === true || typeof provider.isEncrypted === "function" && provider.isEncrypted(first) || this.isDataEncrypted(provider, first));
+    }
+    if (data.data && typeof data.data === "object") {
+      return this.isDataEncrypted(provider, data.data);
+    }
+    if (data.items && typeof data.items === "object") {
+      return this.isDataEncrypted(provider, data.items);
+    }
+    if (data.rows && typeof data.rows === "object") {
+      return this.isDataEncrypted(provider, data.rows);
     }
     for (const key of Object.keys(data)) {
       const val = data[key];
-      if (val && typeof val === "object" && (val.__encrypted === true || this.isDataEncrypted(provider, val, visited))) {
+      if (val && typeof val === "object" && val.__encrypted === true) {
         return true;
       }
     }
@@ -5374,13 +5598,20 @@ class RequestProvider {
       return data;
     }
     const cipherProvider = this.getCipherProvider(encOptions);
-    if (this.isDataEncrypted(cipherProvider, data) || encOptions.fields && encOptions.fields.length > 0) {
-      return cipherProvider.decrypt(
-        data,
+    let result = data;
+    if (this.isDataEncrypted(cipherProvider, result) || encOptions.fields && encOptions.fields.length > 0) {
+      result = await cipherProvider.decrypt(
+        result,
         this.buildEncryptionContext(encOptions, url, requestMethod, isServer)
       );
+      if (result && typeof result === "object" && encOptions.fields && encOptions.fields.length > 0 && this.isDataEncrypted(cipherProvider, result)) {
+        result = await cipherProvider.decrypt(
+          result,
+          this.buildEncryptionContext(encOptions, url, requestMethod, isServer)
+        );
+      }
     }
-    return data;
+    return result;
   }
   async request(url, options) {
     const { cacheStrategy, lifetime, query, body, headers, method } = options || {};
@@ -5450,11 +5681,14 @@ class RequestProvider {
       let dataToCache = responseData;
       if (encOptions?.enabled) {
         const cipherProvider = this.getCipherProvider(encOptions);
-        if (!this.isDataEncrypted(cipherProvider, dataToCache)) {
-          dataToCache = await cipherProvider.encrypt(
-            dataToCache,
-            this.buildEncryptionContext(encOptions, url, requestMethod, isServer)
-          );
+        const isFullEnvelope = dataToCache && typeof dataToCache === "object" && dataToCache.__encrypted === true;
+        if (!isFullEnvelope) {
+          const cacheContext = {
+            ...this.buildEncryptionContext(encOptions, url, requestMethod, isServer),
+            fields: void 0,
+            valueEncryption: false
+          };
+          dataToCache = await cipherProvider.encrypt(dataToCache, cacheContext);
         }
       }
       await provider.set(uniqueKey, dataToCache, cacheLifetime, context);
@@ -5505,21 +5739,31 @@ function clearCachedCipherProvider(encryption) {
     providerCache.delete(encryption);
   }
 }
-function isDataEncrypted(provider, data, visited = /* @__PURE__ */ new WeakSet()) {
+function isDataEncrypted(provider, data) {
   if (!data || typeof data !== "object") return false;
-  if (visited.has(data)) return false;
-  visited.add(data);
+  if (data.__encrypted === true) return true;
   if (provider && typeof provider.isEncrypted === "function") {
     if (provider.isEncrypted(data)) return true;
   } else if (CWebCryptoEncryptionProvider.isEncrypted(data)) {
     return true;
   }
   if (Array.isArray(data)) {
-    return data.some((item) => isDataEncrypted(provider, item, visited));
+    if (data.length === 0) return false;
+    const first = data[0];
+    return first !== null && typeof first === "object" && (first.__encrypted === true || (provider?.isEncrypted ? provider.isEncrypted(first) : CWebCryptoEncryptionProvider.isEncrypted(first)));
+  }
+  if (data.data && typeof data.data === "object") {
+    return isDataEncrypted(provider, data.data);
+  }
+  if (data.items && typeof data.items === "object") {
+    return isDataEncrypted(provider, data.items);
+  }
+  if (data.rows && typeof data.rows === "object") {
+    return isDataEncrypted(provider, data.rows);
   }
   for (const key of Object.keys(data)) {
     const val = data[key];
-    if (val && typeof val === "object" && (val.__encrypted === true || isDataEncrypted(provider, val, visited))) {
+    if (val && typeof val === "object" && val.__encrypted === true) {
       return true;
     }
   }
@@ -5551,7 +5795,15 @@ async function decryptPageRows(rows, encryption, apiUrl, idKey) {
   if (!cipherProvider) {
     return { rows, decrypted: false };
   }
-  if (!rows.some((row) => isDataEncrypted(cipherProvider, row))) {
+  const hasEncryptedRows = rows.some((row) => {
+    if (!row || typeof row !== "object") return false;
+    if (row.__encrypted === true) return true;
+    if (encryption?.fields && encryption.fields.length > 0) {
+      return encryption.fields.some((f) => row[f]?.__encrypted === true);
+    }
+    return isDataEncrypted(cipherProvider, row);
+  });
+  if (!hasEncryptedRows) {
     return { rows, decrypted: false };
   }
   const ctx = buildEncryptionContext(encryption, apiUrl);
@@ -5612,8 +5864,12 @@ class CAPIFlatClientDataProvider extends CFlatClientDataProvider {
   cacheLifetime = 0;
   refreshOnMutation = void 0;
   encryption;
+  _isAccumulating = false;
+  _inFlightLoadMore = false;
   constructor(options) {
     super(options);
+    if (options?.apiUrl) this.apiUrl = options.apiUrl;
+    if (options?.url) this.apiUrl = options.url;
     if (options?.cacheStrategy) {
       this.cacheStrategy = options.cacheStrategy;
       this.requestProvider.setCacheProvider(options.cacheStrategy);
@@ -5631,10 +5887,43 @@ class CAPIFlatClientDataProvider extends CFlatClientDataProvider {
     this.requestProvider.onDataReceived((data) => {
       if (data) {
         const normalized = normalizeDataResult(data);
-        this.setData(normalized ? normalized.rows : data.rows || data);
+        const rows = normalized ? normalized.rows : data.rows || data;
+        if (this._isAccumulating) {
+          this.allData = [...this.allData, ...rows];
+          this.loadPageData();
+        } else {
+          this.setData(rows);
+        }
+        if (normalized?.rowCount !== void 0) {
+          this.rowCount = normalized.rowCount;
+        }
       }
     });
   }
+  async loadMore() {
+    if (!this.hasMore || this.loading || this._inFlightLoadMore) return;
+    this._inFlightLoadMore = true;
+    this._isAccumulating = true;
+    try {
+      if (this.apiUrl) {
+        const nextPage = this.currentPage + 1;
+        await this.requestProvider.registerRequest(this.apiUrl, {
+          query: {
+            pageNumber: nextPage,
+            pageSize: this.pageSize
+          },
+          deduplicate: this.deduplicate,
+          context: this.context
+        });
+        this.setCurrentPage(nextPage);
+      } else {
+        await this.setCurrentPage(this.currentPage + 1);
+      }
+    } finally {
+      this._isAccumulating = false;
+      this._inFlightLoadMore = false;
+    }
+  }
   setEncryption(encryption) {
     if (this.encryption && this.encryption !== encryption) {
       clearCachedCipherProvider(this.encryption);
@@ -5707,6 +5996,9 @@ class CAPIFlatClientDataProvider extends CFlatClientDataProvider {
       }
       try {
         const result = await fetchWithSSR(key, fetcher, this.context);
+        if (result && typeof result === "object" && (result.__encrypted === true || result.ciphertext)) {
+          return;
+        }
         const normalized = normalizeDataResult(result);
         if (normalized) {
           this.setData(normalized.rows);
@@ -6133,18 +6425,22 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
   _nodeMapCache = null;
   _sortedNodeIdsCache = null;
   _filteredNodesCache = null;
+  _allVisibleRowsCache = null;
   invalidateStaticCache() {
     this._staticNodesCache = null;
     this._nodeMapCache = null;
     this._sortedNodeIdsCache = null;
     this._filteredNodesCache = null;
+    this._allVisibleRowsCache = null;
   }
   setFilter(filter, immediate = false) {
     this._filteredNodesCache = null;
+    this._allVisibleRowsCache = null;
     super.setFilter(filter, immediate);
   }
   onFilterUpdated() {
     this._filteredNodesCache = null;
+    this._allVisibleRowsCache = null;
   }
   get _staticNodes() {
     if (!this._staticNodesCache) {
@@ -6250,9 +6546,11 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
   }
   onSortUpdated() {
     this._sortedNodeIdsCache = null;
+    this._allVisibleRowsCache = null;
   }
   setSortList(sortList, immediate = false) {
     this._sortedNodeIdsCache = null;
+    this._allVisibleRowsCache = null;
     super.setSortList(sortList, immediate);
   }
   computeSortedIds() {
@@ -6262,16 +6560,29 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     const nodeMap = this._nodeMap;
     const sortNodes = (nodesToSort) => {
       if (!this.sortList || this.sortList.length === 0) return nodesToSort;
+      const nodeById = /* @__PURE__ */ new Map();
+      const nodeByData = /* @__PURE__ */ new Map();
+      for (const n of nodesToSort) {
+        nodeById.set(n.id, n);
+        if (n.data) nodeByData.set(n.data, n);
+      }
       const dataRows = nodesToSort.map((n) => n.data);
       const sortedData = sortData(this.sortList, dataRows);
       const sortedNodes = [];
+      const visited = /* @__PURE__ */ new Set();
       for (const row of sortedData) {
         const id = row?.[this.idKey] ?? row?.id;
-        const found = nodesToSort.find((n) => n.id === id || n.data === row);
-        if (found && !sortedNodes.includes(found)) sortedNodes.push(found);
+        const found = (id !== void 0 && id !== null ? nodeById.get(id) : void 0) ?? nodeByData.get(row);
+        if (found && !visited.has(found)) {
+          sortedNodes.push(found);
+          visited.add(found);
+        }
       }
       for (const n of nodesToSort) {
-        if (!sortedNodes.includes(n)) sortedNodes.push(n);
+        if (!visited.has(n)) {
+          sortedNodes.push(n);
+          visited.add(n);
+        }
       }
       return sortedNodes;
     };
@@ -6483,12 +6794,18 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     }
     return visibleNodes;
   }
+  get rowMap() {
+    return this.allVisibleRows;
+  }
   get allVisibleRows() {
-    return this.allVisibleNodes.map((node) => ({
-      ...node.data,
-      ...node,
-      __treeNode: node
-    }));
+    if (!this._allVisibleRowsCache) {
+      this._allVisibleRowsCache = this.allVisibleNodes.map((node) => ({
+        ...node.data,
+        ...node,
+        __treeNode: node
+      }));
+    }
+    return this._allVisibleRowsCache;
   }
   get visibleRows() {
     return this.paginateNodes(this.allVisibleNodes);
@@ -6503,6 +6820,7 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     if (this.filter && this.filter.active) {
       this._filteredNodesCache = null;
     }
+    this._allVisibleRowsCache = null;
     if (this.expandedNodes.has(nodeId)) {
       this.expandedNodes.delete(nodeId);
     } else {
@@ -6515,6 +6833,7 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     if (this.filter && this.filter.active) {
       this._filteredNodesCache = null;
     }
+    this._allVisibleRowsCache = null;
     this.expandedNodes.add(nodeId);
     this.updatePageData();
     this.notify();
@@ -6523,6 +6842,7 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     if (this.filter && this.filter.active) {
       this._filteredNodesCache = null;
     }
+    this._allVisibleRowsCache = null;
     this.expandedNodes.delete(nodeId);
     this.updatePageData();
     this.notify();
@@ -6537,6 +6857,7 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     if (this.filter && this.filter.active) {
       this._filteredNodesCache = null;
     }
+    this._allVisibleRowsCache = null;
     const allIds = this._staticNodes.filter((n) => n.hasChildren).map((n) => n.id);
     this.expandedNodes = new Set(allIds);
     this.updatePageData();
@@ -6546,6 +6867,7 @@ class CTreeClientDataProvider extends CFlatClientDataProvider {
     if (this.filter && this.filter.active) {
       this._filteredNodesCache = null;
     }
+    this._allVisibleRowsCache = null;
     this.expandedNodes = /* @__PURE__ */ new Set();
     this.updatePageData();
     this.notify();
@@ -6578,8 +6900,14 @@ class CAPITreeClientDataProvider extends CTreeClientDataProvider {
   encryption;
   constructor(options) {
     super(options);
-    if (options?.cacheStrategy) this.cacheStrategy = options.cacheStrategy;
-    if (options?.cacheLifetime) this.cacheLifetime = options.cacheLifetime;
+    if (options?.cacheStrategy) {
+      this.cacheStrategy = options.cacheStrategy;
+      this.requestProvider.setCacheProvider(options.cacheStrategy);
+    }
+    if (options?.cacheLifetime !== void 0) {
+      this.cacheLifetime = options.cacheLifetime;
+      this.requestProvider.setCacheLifetime(options.cacheLifetime);
+    }
     if (options?.refreshOnMutation !== void 0) this.refreshOnMutation = options.refreshOnMutation;
     if (options?.contextKey) this.contextKey = options.contextKey;
     if (options?.encryption) {
@@ -7617,6 +7945,20 @@ class CServerSessionCache extends ACacheProvider {
   async removeByPrefix(prefix, context) {
     const fullPrefix = "cache:" + prefix;
     try {
+      if (!context || context === true || context?.allSessions === true) {
+        for (const sessionData2 of CServerSessionCache.storage.values()) {
+          const keysToDelete = [];
+          for (const key of sessionData2.keys()) {
+            if (key.startsWith(fullPrefix)) {
+              keysToDelete.push(key);
+            }
+          }
+          for (const key of keysToDelete) {
+            sessionData2.delete(key);
+          }
+        }
+        return;
+      }
       const sessionId = await this.getSessionId(context);
       const sessionData = CServerSessionCache.storage.get(sessionId);
       if (sessionData) {
@@ -7815,6 +8157,7 @@ const CBrowserSessionCache$1 = {
 
 class CLocalStorageCache extends ACacheProvider {
   static instance = null;
+  static _writeCount = 0;
   static getInstance() {
     if (!this.instance) {
       this.instance = new CLocalStorageCache();
@@ -8019,12 +8362,17 @@ class CLocalStorageCache extends ACacheProvider {
       accessCount: 1
     };
     if (typeof window !== "undefined" && typeof localStorage !== "undefined") {
-      try {
-        const usage = this.estimateStorageUsage();
-        if (usage.isNearQuota) {
-          this.evictLRU(0.25);
+      const nearEntriesLimit = Boolean(
+        this.quotaOptions.maxEntries && localStorage.length >= this.quotaOptions.maxEntries * this.quotaOptions.quotaThresholdRatio
+      );
+      if (nearEntriesLimit || ++CLocalStorageCache._writeCount % 50 === 0) {
+        try {
+          const usage = this.estimateStorageUsage();
+          if (usage.isNearQuota) {
+            this.evictLRU(0.25);
+          }
+        } catch (e) {
         }
-      } catch (e) {
       }
       const serialized = JSON.stringify(entry);
       try {
@@ -8242,7 +8590,7 @@ class CIndexedDBCache extends ACacheProvider {
           quota = estimate.quota || 0;
           usage = estimate.usage || 0;
           ratio = quota > 0 ? usage / quota : 0;
-          if (ratio >= this.quotaOptions.quotaThresholdRatio) {
+          if (ratio >= this.quotaOptions.quotaThresholdRatio || this.quotaOptions.maxSizeBytes > 0 && usage >= this.quotaOptions.maxSizeBytes * this.quotaOptions.quotaThresholdRatio) {
             isNearQuota = true;
           }
         } catch {
@@ -8588,6 +8936,7 @@ exports.createEncryptionProvider = createEncryptionProvider;
 exports.debounce = debounce;
 exports.decryptPageRows = decryptPageRows;
 exports.evaluateFilter = evaluateFilter;
+exports.fastKeyHash = fastKeyHash;
 exports.fetchWithSSR = fetchWithSSR;
 exports.filterData = filterData;
 exports.filterTreeData = filterTreeData;
@@ -8595,14 +8944,23 @@ exports.getAppRoute = getAppRoute;
 exports.getAppRouter = getAppRouter;
 exports.getCipherProvider = getCipherProvider;
 exports.getHydrationAdapter = getHydrationAdapter;
+exports.getKeyIdentifier = getKeyIdentifier;
 exports.getPlatformApp = getPlatformApp;
+exports.getRandomValues = getRandomValues;
 exports.getSSRData = getSSRData;
 exports.getSSRPayload = getSSRPayload;
+exports.getSafeKeyIdentifier = getSafeKeyIdentifier;
+exports.getSubtleCrypto = getSubtleCrypto;
 exports.isDataEncrypted = isDataEncrypted;
 exports.isEncrypted = isEncrypted;
 exports.onPlatformReady = onPlatformReady;
+exports.resolveInfoBytes = resolveInfoBytes;
+exports.safeSetProperty = safeSetProperty;
 exports.setHydrationAdapter = setHydrationAdapter;
 exports.sortData = sortData;
+exports.textDecoder = textDecoder;
+exports.textEncoder = textEncoder;
+exports.toBase64 = toBase64;
 exports.useDebounce = useDebounce;
 exports.useFilterLogic = useFilterLogic;
 exports.useSortLogic = useSortLogic;