@katlux/providers 0.1.1-alpha.105 → 0.1.1-alpha.106

package/dist/index.d.cts

@@ -10,6 +10,10 @@ interface IEncryptedPayload {
     wrappedKey?: string;
     sharedKey?: boolean;
     epk?: JsonWebKey;
+    /** Optional Key Identifier for role-based key routing and key rotation */
+    kid?: string;
+    /** True if AEAD additionalData was bound during encryption */
+    aad?: boolean;
 }
 type TRawKey = string | CryptoKey | Uint8Array | ArrayBuffer;
 type TKeyProvider = TRawKey | (() => TRawKey | Promise<TRawKey>);
@@ -20,6 +24,13 @@ interface IEncryptionContext {
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
+    /** Internal flag indicating that key derivation has already been warmed for this batch */
+    _warmedKey?: any;
     /** Whether to encrypt/decrypt individual values while preserving JSON keys (default: true) */
     valueEncryption?: boolean;
     publicKey?: CryptoKey;
@@ -49,6 +60,11 @@ interface IProviderEncryptionOptions {
     enabled?: boolean;
     /** Secret key, passphrase, CryptoKey, key pair, or async key provider function */
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and key rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
     /**
      * Whether decryption is permitted during Server-Side Rendering (SSR).
      * In an End-to-End (E2E) zero-trust model, defaults to false to prevent
@@ -63,11 +79,16 @@ interface IProviderEncryptionOptions {
     fields?: string[];
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
+    /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
+    customProvider?: IEncryptionProvider;
     /** Whether to use synchronous Node.js crypto provider (CNodeCryptoEncryptionProvider) */
     sync?: boolean;
-    /** Custom encryption provider instance implementing IEncryptionProvider */
-    customProvider?: IEncryptionProvider;
-    /** Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'. */
+    /**
+     * Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'.
+     * - 'pbkdf2': Recommended for human passphrases/passwords (OWASP recommended with work factor iterations).
+     * - 'hkdf': For deriving subkeys from high-entropy cryptographic keys or secrets (not for low-entropy human passwords).
+     * - 'none': Direct key import for raw high-entropy 256-bit symmetric keys or CryptoKeys.
+     */
     kdf?: 'none' | 'pbkdf2' | 'hkdf';
     /** Number of PBKDF2 iterations (default: 310,000 per OWASP recommendation) */
     kdfIterations?: number;
@@ -275,6 +296,7 @@ type TPageDataHandler<TRow = TDataRow> = (currentPage: number, pageSize: number,
     signal?: AbortSignal;
 }) => IDataResult<TRow> | Promise<IDataResult<TRow>>;
 interface IDataProviderOptions {
+    apiUrl?: string;
     idKey?: string;
     filter?: IDataFilter;
     sortList?: IDataSort[];
@@ -439,6 +461,9 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     set filter(f: IDataFilter | null);
     get sortList(): IDataSort[];
     set sortList(s: IDataSort[]);
+    get hasMore(): boolean;
+    nextPage(): Promise<void>;
+    loadMore(): Promise<void>;
     private _listeners;
     private _stateListeners;
     private _pendingChangedKeys;
@@ -464,7 +489,7 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
     setCurrentPage(currentPage: number): void;
-    setPageSize(pageSize: number): void;
+    setPageSize(pageSize: number, resetPage?: boolean): void;
     setSelectedRows(rows: TRow[]): void;
     setSelectAll(val: boolean): void;
     abstract loadPageData(options?: {
@@ -532,9 +557,19 @@ declare class RequestProvider {
     setCacheProvider(provider?: ACacheProvider | ECacheStrategy): void;
     setCacheLifetime(lifetime: number): void;
     setDeduplicate(deduplicate: boolean): void;
+    setQueue(queue: boolean): void;
     encryption?: IProviderEncryptionOptions;
     private _cachedCipherProvider?;
     private _lastEncryptionConfig?;
+    private _scopedCipherProviders;
+    /**
+     * Configures E2EE payload encryption for outbound mutations and inbound responses.
+     *
+     * Threat Model: Protects sensitive SaaS tenant data against backend/database breaches.
+     * Multi-user sharing is supported by role-based session keys passed dynamically.
+     * Local client endpoint compromise (malware, trojans, keyloggers) is out of scope.
+     */
+    private disposeCipherInstance;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     onDataReceived(callback: (data: any, generation?: number) => void): void;
@@ -543,7 +578,7 @@ declare class RequestProvider {
     refresh(hardRefresh?: boolean): Promise<any>;
     private resolveContext;
     private getInFlightMap;
-    private getUniqueKey;
+    getUniqueKey(url: string, options?: IRequestOptions): string;
     registerRequest<T>(url: string, options?: IRequestOptions): Promise<T>;
     static executeAll(): void;
     private isSameOriginUrl;
@@ -556,7 +591,7 @@ declare class RequestProvider {
 
 declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
 declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any, visited?: WeakSet<object>): boolean;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
 declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
 declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
     rows: T[];
@@ -586,7 +621,10 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
     encryption?: IProviderEncryptionOptions;
+    private _isAccumulating;
+    private _inFlightLoadMore;
     constructor(options?: IDataProviderOptions);
+    loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     setContextKey(key: string): void;
@@ -650,6 +688,7 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private _nodeMapCache;
     private _sortedNodeIdsCache;
     private _filteredNodesCache;
+    private _allVisibleRowsCache;
     invalidateStaticCache(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     protected onFilterUpdated(): void;
@@ -668,6 +707,9 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     loadPageData(): Promise<void>;
     get treeNodes(): ITreeNode<TRow>[];
     get allVisibleNodes(): ITreeNode<TRow>[];
+    get rowMap(): readonly (TRow & ITreeNode<TRow> & {
+        __treeNode: ITreeNode<TRow>;
+    })[];
     get allVisibleRows(): (TRow & ITreeNode<TRow> & {
         __treeNode: ITreeNode<TRow>;
     })[];
@@ -927,6 +969,7 @@ declare class CCookieCache extends ACacheProvider {
 
 declare class CLocalStorageCache extends ACacheProvider {
     private static instance;
+    private static _writeCount;
     static getInstance(): CLocalStorageCache;
     type: string;
     private quotaOptions;
@@ -1440,6 +1483,11 @@ declare class CKeyManager {
     static resolveSalt(salt?: Uint8Array | ArrayBuffer | string): Uint8Array;
     /**
      * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
+     *
+     * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
+     * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
+     * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
+     * Client-side malware/trojan protection is out of scope.
      */
     static generateAESKey(length?: 128 | 256, algorithm?: 'AES-GCM' | 'AES-CBC' | 'AES-KW', extractable?: boolean): Promise<CryptoKey>;
     /**
@@ -1535,7 +1583,20 @@ interface ICWebCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
+/**
+ * Zero-dependency AES-256-GCM cipher provider using native Web Crypto API (crypto.subtle).
+ *
+ * E2EE Threat Model Scope:
+ * - Purpose: Provides client-side End-to-End Encryption (E2EE) to safeguard GDPR and tenant
+ *   records against database and server-side data breaches in multi-tenant SaaS systems.
+ * - Multi-User Key Sharing: Authorized users in the same tenant encrypt/decrypt shared data
+ *   based on database roles that distribute symmetric or wrapped keys.
+ * - Non-Goals: Client-side trojan, keylogger, or DOM-scraping malware defense is out of scope
+ *   and remains the responsibility of the client endpoint device owner.
+ */
 declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _defaultKdf;
     private _cachedKey?;
@@ -1544,6 +1605,8 @@ declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _cachedKeyId?;
+    private _configuredKid?;
     private _decryptSaltCache;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
@@ -1572,6 +1635,8 @@ interface ICWebCryptoAESCBCOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Authenticated AES-CBC-256 provider with Encrypt-then-MAC (HMAC-SHA-256).
@@ -1590,6 +1655,7 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     private _kdfOptions?;
     private _decryptSaltCache;
     constructor(key?: TKeyProvider | IKeyPair, options?: ICWebCryptoAESCBCOptions);
@@ -1625,6 +1691,12 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
  * 3. The AES-GCM data key is wrapped with the recipient's RSA-OAEP public key.
  * 4. The envelope packages ciphertext, IV, and wrappedKey.
  * 5. Only the holder of the matching RSA private key can unwrap the data key and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): Asymmetric hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party in possession
+ * of the recipient's public key can encrypt data. In multi-user / multi-tenant workflows where sender
+ * authenticity is required, sign payloads with a digital signature (e.g. ECDSA/RSA-PSS) or use
+ * authenticated symmetric role keys (AES-GCM) governed by database role permissions.
  */
 declare class CRSAEncryptionProvider extends AEncryptionProvider {
     private publicKey?;
@@ -1676,6 +1748,12 @@ type TECDHCurve = 'P-256' | 'P-384' | 'P-521';
  * 4. Payload is encrypted with AES-GCM.
  * 5. Ephemeral public key (JWK) is attached to the envelope (`epk`).
  * 6. Only the recipient with the matching private key can agree with `epk` and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): ECDH ephemeral-static hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party with the recipient's
+ * public key can generate an ephemeral keypair and send encrypted envelopes. In multi-user / multi-tenant
+ * SaaS environments requiring sender authenticity, sign payloads with a digital signature (ECDSA/Ed25519)
+ * or use authenticated symmetric role keys (AES-GCM) managed via database role permissions.
  */
 declare class CECDHEncryptionProvider extends AEncryptionProvider {
     private recipientPublicKey?;
@@ -1736,6 +1814,8 @@ interface ICNodeCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Server-side synchronous AES-GCM-256 encryption provider using Node.js native `node:crypto`.
@@ -1755,6 +1835,7 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
     warmupKey(options?: IEncryptionContext): Promise<void>;
@@ -1803,10 +1884,58 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
  */
 declare function createEncryptionProvider(options?: IProviderEncryptionOptions): IEncryptionProvider;
 
+/**
+ * Shared cryptographic utilities for Web Crypto API access and random byte generation.
+ * Internal module for Katlux Encryption Providers.
+ */
+/**
+ * Resolves the SubtleCrypto instance from globalThis.
+ * Throws a descriptive error if Web Crypto API is unavailable.
+ */
+declare function getSubtleCrypto(): SubtleCrypto;
+/**
+ * Fills a typed array with cryptographically secure random values using crypto.getRandomValues.
+ */
+declare function getRandomValues(array: Uint8Array): Uint8Array;
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+/**
+ * Resolves an HKDF info / context parameter into a Uint8Array.
+ * Safely preserves raw binary buffers (Uint8Array, ArrayBuffer) without string coercion.
+ */
+declare function resolveInfoBytes(info?: string | Uint8Array | ArrayBuffer, fallback?: string): Uint8Array;
+/**
+ * Safely assigns a property to a target object, preventing prototype pollution attacks
+ * via __proto__, constructor, or prototype manipulation.
+ */
+declare function safeSetProperty(target: Record<string, any>, key: string, value: any): void;
+/**
+ * Converts an ArrayBuffer or Uint8Array into a Base64-encoded string.
+ */
+declare function toBase64(buffer: ArrayBuffer | Uint8Array): string;
+/**
+ * Fast 64-bit FNV-1a hash formatted as a hex string.
+ * Non-cryptographic, zero-allocation, synchronous hash used for safe heap cache indexing
+ * without retaining plaintext secrets in compound Map keys.
+ */
+declare function fastKeyHash(str: string): string;
+/**
+ * Computes a collision-free, safe string identifier for a resolved key.
+ * Hashes raw string passphrases to ensure secrets never reside in compound Map keys (Minor 8)
+ * and resolves function outputs so multi-tenant SSR requests never collide on function references (Major 3).
+ */
+declare function getSafeKeyIdentifier(rawKey: any): string;
+/**
+ * Returns a collision-free string identifier for a key provider or fallback key.
+ * Uses a hashed identifier for strings and WeakMap for objects to prevent
+ * cross-tenant cache collisions and avoid storing secrets in heap Map keys.
+ */
+declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
+
 /**
  * Universal helper that verifies whether an arbitrary object is a Katlux encrypted payload envelope.
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getPlatformApp, getSSRData, getSSRPayload, isDataEncrypted, isEncrypted, onPlatformReady, setHydrationAdapter, sortData, useDebounce, useFilterLogic, useSortLogic };
+export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
 export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };

package/dist/index.d.mts

@@ -10,6 +10,10 @@ interface IEncryptedPayload {
     wrappedKey?: string;
     sharedKey?: boolean;
     epk?: JsonWebKey;
+    /** Optional Key Identifier for role-based key routing and key rotation */
+    kid?: string;
+    /** True if AEAD additionalData was bound during encryption */
+    aad?: boolean;
 }
 type TRawKey = string | CryptoKey | Uint8Array | ArrayBuffer;
 type TKeyProvider = TRawKey | (() => TRawKey | Promise<TRawKey>);
@@ -20,6 +24,13 @@ interface IEncryptionContext {
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
+    /** Internal flag indicating that key derivation has already been warmed for this batch */
+    _warmedKey?: any;
     /** Whether to encrypt/decrypt individual values while preserving JSON keys (default: true) */
     valueEncryption?: boolean;
     publicKey?: CryptoKey;
@@ -49,6 +60,11 @@ interface IProviderEncryptionOptions {
     enabled?: boolean;
     /** Secret key, passphrase, CryptoKey, key pair, or async key provider function */
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and key rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
     /**
      * Whether decryption is permitted during Server-Side Rendering (SSR).
      * In an End-to-End (E2E) zero-trust model, defaults to false to prevent
@@ -63,11 +79,16 @@ interface IProviderEncryptionOptions {
     fields?: string[];
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
+    /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
+    customProvider?: IEncryptionProvider;
     /** Whether to use synchronous Node.js crypto provider (CNodeCryptoEncryptionProvider) */
     sync?: boolean;
-    /** Custom encryption provider instance implementing IEncryptionProvider */
-    customProvider?: IEncryptionProvider;
-    /** Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'. */
+    /**
+     * Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'.
+     * - 'pbkdf2': Recommended for human passphrases/passwords (OWASP recommended with work factor iterations).
+     * - 'hkdf': For deriving subkeys from high-entropy cryptographic keys or secrets (not for low-entropy human passwords).
+     * - 'none': Direct key import for raw high-entropy 256-bit symmetric keys or CryptoKeys.
+     */
     kdf?: 'none' | 'pbkdf2' | 'hkdf';
     /** Number of PBKDF2 iterations (default: 310,000 per OWASP recommendation) */
     kdfIterations?: number;
@@ -275,6 +296,7 @@ type TPageDataHandler<TRow = TDataRow> = (currentPage: number, pageSize: number,
     signal?: AbortSignal;
 }) => IDataResult<TRow> | Promise<IDataResult<TRow>>;
 interface IDataProviderOptions {
+    apiUrl?: string;
     idKey?: string;
     filter?: IDataFilter;
     sortList?: IDataSort[];
@@ -439,6 +461,9 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     set filter(f: IDataFilter | null);
     get sortList(): IDataSort[];
     set sortList(s: IDataSort[]);
+    get hasMore(): boolean;
+    nextPage(): Promise<void>;
+    loadMore(): Promise<void>;
     private _listeners;
     private _stateListeners;
     private _pendingChangedKeys;
@@ -464,7 +489,7 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
     setCurrentPage(currentPage: number): void;
-    setPageSize(pageSize: number): void;
+    setPageSize(pageSize: number, resetPage?: boolean): void;
     setSelectedRows(rows: TRow[]): void;
     setSelectAll(val: boolean): void;
     abstract loadPageData(options?: {
@@ -532,9 +557,19 @@ declare class RequestProvider {
     setCacheProvider(provider?: ACacheProvider | ECacheStrategy): void;
     setCacheLifetime(lifetime: number): void;
     setDeduplicate(deduplicate: boolean): void;
+    setQueue(queue: boolean): void;
     encryption?: IProviderEncryptionOptions;
     private _cachedCipherProvider?;
     private _lastEncryptionConfig?;
+    private _scopedCipherProviders;
+    /**
+     * Configures E2EE payload encryption for outbound mutations and inbound responses.
+     *
+     * Threat Model: Protects sensitive SaaS tenant data against backend/database breaches.
+     * Multi-user sharing is supported by role-based session keys passed dynamically.
+     * Local client endpoint compromise (malware, trojans, keyloggers) is out of scope.
+     */
+    private disposeCipherInstance;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     onDataReceived(callback: (data: any, generation?: number) => void): void;
@@ -543,7 +578,7 @@ declare class RequestProvider {
     refresh(hardRefresh?: boolean): Promise<any>;
     private resolveContext;
     private getInFlightMap;
-    private getUniqueKey;
+    getUniqueKey(url: string, options?: IRequestOptions): string;
     registerRequest<T>(url: string, options?: IRequestOptions): Promise<T>;
     static executeAll(): void;
     private isSameOriginUrl;
@@ -556,7 +591,7 @@ declare class RequestProvider {
 
 declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
 declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any, visited?: WeakSet<object>): boolean;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
 declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
 declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
     rows: T[];
@@ -586,7 +621,10 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
     encryption?: IProviderEncryptionOptions;
+    private _isAccumulating;
+    private _inFlightLoadMore;
     constructor(options?: IDataProviderOptions);
+    loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     setContextKey(key: string): void;
@@ -650,6 +688,7 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private _nodeMapCache;
     private _sortedNodeIdsCache;
     private _filteredNodesCache;
+    private _allVisibleRowsCache;
     invalidateStaticCache(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     protected onFilterUpdated(): void;
@@ -668,6 +707,9 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     loadPageData(): Promise<void>;
     get treeNodes(): ITreeNode<TRow>[];
     get allVisibleNodes(): ITreeNode<TRow>[];
+    get rowMap(): readonly (TRow & ITreeNode<TRow> & {
+        __treeNode: ITreeNode<TRow>;
+    })[];
     get allVisibleRows(): (TRow & ITreeNode<TRow> & {
         __treeNode: ITreeNode<TRow>;
     })[];
@@ -927,6 +969,7 @@ declare class CCookieCache extends ACacheProvider {
 
 declare class CLocalStorageCache extends ACacheProvider {
     private static instance;
+    private static _writeCount;
     static getInstance(): CLocalStorageCache;
     type: string;
     private quotaOptions;
@@ -1440,6 +1483,11 @@ declare class CKeyManager {
     static resolveSalt(salt?: Uint8Array | ArrayBuffer | string): Uint8Array;
     /**
      * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
+     *
+     * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
+     * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
+     * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
+     * Client-side malware/trojan protection is out of scope.
      */
     static generateAESKey(length?: 128 | 256, algorithm?: 'AES-GCM' | 'AES-CBC' | 'AES-KW', extractable?: boolean): Promise<CryptoKey>;
     /**
@@ -1535,7 +1583,20 @@ interface ICWebCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
+/**
+ * Zero-dependency AES-256-GCM cipher provider using native Web Crypto API (crypto.subtle).
+ *
+ * E2EE Threat Model Scope:
+ * - Purpose: Provides client-side End-to-End Encryption (E2EE) to safeguard GDPR and tenant
+ *   records against database and server-side data breaches in multi-tenant SaaS systems.
+ * - Multi-User Key Sharing: Authorized users in the same tenant encrypt/decrypt shared data
+ *   based on database roles that distribute symmetric or wrapped keys.
+ * - Non-Goals: Client-side trojan, keylogger, or DOM-scraping malware defense is out of scope
+ *   and remains the responsibility of the client endpoint device owner.
+ */
 declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _defaultKdf;
     private _cachedKey?;
@@ -1544,6 +1605,8 @@ declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _cachedKeyId?;
+    private _configuredKid?;
     private _decryptSaltCache;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
@@ -1572,6 +1635,8 @@ interface ICWebCryptoAESCBCOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Authenticated AES-CBC-256 provider with Encrypt-then-MAC (HMAC-SHA-256).
@@ -1590,6 +1655,7 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     private _kdfOptions?;
     private _decryptSaltCache;
     constructor(key?: TKeyProvider | IKeyPair, options?: ICWebCryptoAESCBCOptions);
@@ -1625,6 +1691,12 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
  * 3. The AES-GCM data key is wrapped with the recipient's RSA-OAEP public key.
  * 4. The envelope packages ciphertext, IV, and wrappedKey.
  * 5. Only the holder of the matching RSA private key can unwrap the data key and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): Asymmetric hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party in possession
+ * of the recipient's public key can encrypt data. In multi-user / multi-tenant workflows where sender
+ * authenticity is required, sign payloads with a digital signature (e.g. ECDSA/RSA-PSS) or use
+ * authenticated symmetric role keys (AES-GCM) governed by database role permissions.
  */
 declare class CRSAEncryptionProvider extends AEncryptionProvider {
     private publicKey?;
@@ -1676,6 +1748,12 @@ type TECDHCurve = 'P-256' | 'P-384' | 'P-521';
  * 4. Payload is encrypted with AES-GCM.
  * 5. Ephemeral public key (JWK) is attached to the envelope (`epk`).
  * 6. Only the recipient with the matching private key can agree with `epk` and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): ECDH ephemeral-static hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party with the recipient's
+ * public key can generate an ephemeral keypair and send encrypted envelopes. In multi-user / multi-tenant
+ * SaaS environments requiring sender authenticity, sign payloads with a digital signature (ECDSA/Ed25519)
+ * or use authenticated symmetric role keys (AES-GCM) managed via database role permissions.
  */
 declare class CECDHEncryptionProvider extends AEncryptionProvider {
     private recipientPublicKey?;
@@ -1736,6 +1814,8 @@ interface ICNodeCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Server-side synchronous AES-GCM-256 encryption provider using Node.js native `node:crypto`.
@@ -1755,6 +1835,7 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
     warmupKey(options?: IEncryptionContext): Promise<void>;
@@ -1803,10 +1884,58 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
  */
 declare function createEncryptionProvider(options?: IProviderEncryptionOptions): IEncryptionProvider;
 
+/**
+ * Shared cryptographic utilities for Web Crypto API access and random byte generation.
+ * Internal module for Katlux Encryption Providers.
+ */
+/**
+ * Resolves the SubtleCrypto instance from globalThis.
+ * Throws a descriptive error if Web Crypto API is unavailable.
+ */
+declare function getSubtleCrypto(): SubtleCrypto;
+/**
+ * Fills a typed array with cryptographically secure random values using crypto.getRandomValues.
+ */
+declare function getRandomValues(array: Uint8Array): Uint8Array;
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+/**
+ * Resolves an HKDF info / context parameter into a Uint8Array.
+ * Safely preserves raw binary buffers (Uint8Array, ArrayBuffer) without string coercion.
+ */
+declare function resolveInfoBytes(info?: string | Uint8Array | ArrayBuffer, fallback?: string): Uint8Array;
+/**
+ * Safely assigns a property to a target object, preventing prototype pollution attacks
+ * via __proto__, constructor, or prototype manipulation.
+ */
+declare function safeSetProperty(target: Record<string, any>, key: string, value: any): void;
+/**
+ * Converts an ArrayBuffer or Uint8Array into a Base64-encoded string.
+ */
+declare function toBase64(buffer: ArrayBuffer | Uint8Array): string;
+/**
+ * Fast 64-bit FNV-1a hash formatted as a hex string.
+ * Non-cryptographic, zero-allocation, synchronous hash used for safe heap cache indexing
+ * without retaining plaintext secrets in compound Map keys.
+ */
+declare function fastKeyHash(str: string): string;
+/**
+ * Computes a collision-free, safe string identifier for a resolved key.
+ * Hashes raw string passphrases to ensure secrets never reside in compound Map keys (Minor 8)
+ * and resolves function outputs so multi-tenant SSR requests never collide on function references (Major 3).
+ */
+declare function getSafeKeyIdentifier(rawKey: any): string;
+/**
+ * Returns a collision-free string identifier for a key provider or fallback key.
+ * Uses a hashed identifier for strings and WeakMap for objects to prevent
+ * cross-tenant cache collisions and avoid storing secrets in heap Map keys.
+ */
+declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
+
 /**
  * Universal helper that verifies whether an arbitrary object is a Katlux encrypted payload envelope.
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getPlatformApp, getSSRData, getSSRPayload, isDataEncrypted, isEncrypted, onPlatformReady, setHydrationAdapter, sortData, useDebounce, useFilterLogic, useSortLogic };
+export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
 export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };