@katlux/providers 0.1.1-alpha.105 → 0.1.1-alpha.109

package/dist/index.d.cts

@@ -10,6 +10,10 @@ interface IEncryptedPayload {
     wrappedKey?: string;
     sharedKey?: boolean;
     epk?: JsonWebKey;
+    /** Optional Key Identifier for role-based key routing and key rotation */
+    kid?: string;
+    /** True if AEAD additionalData was bound during encryption */
+    aad?: boolean;
 }
 type TRawKey = string | CryptoKey | Uint8Array | ArrayBuffer;
 type TKeyProvider = TRawKey | (() => TRawKey | Promise<TRawKey>);
@@ -20,6 +24,13 @@ interface IEncryptionContext {
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
+    /** Internal flag indicating that key derivation has already been warmed for this batch */
+    _warmedKey?: any;
     /** Whether to encrypt/decrypt individual values while preserving JSON keys (default: true) */
     valueEncryption?: boolean;
     publicKey?: CryptoKey;
@@ -49,6 +60,11 @@ interface IProviderEncryptionOptions {
     enabled?: boolean;
     /** Secret key, passphrase, CryptoKey, key pair, or async key provider function */
     key?: TKeyProvider | IKeyPair;
+    /** Optional Key Identifier for multi-role key routing and key rotation */
+    kid?: string;
+    keyId?: string;
+    /** Authenticated Additional Data (AAD) bound to the ciphertext to prevent field/record swapping */
+    aad?: string | Uint8Array | ArrayBuffer;
     /**
      * Whether decryption is permitted during Server-Side Rendering (SSR).
      * In an End-to-End (E2E) zero-trust model, defaults to false to prevent
@@ -61,13 +77,22 @@ interface IProviderEncryptionOptions {
     lazy?: boolean;
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
+    /** Enable HMAC-SHA256 blind indexing and trigram search index on encrypted fields for local DataProviders */
+    searchIndex?: boolean;
+    /** Optional dedicated HMAC key for search indexing (defaults to encryption key if omitted) */
+    hmacKey?: TKeyProvider;
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
+    /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
+    customProvider?: IEncryptionProvider;
     /** Whether to use synchronous Node.js crypto provider (CNodeCryptoEncryptionProvider) */
     sync?: boolean;
-    /** Custom encryption provider instance implementing IEncryptionProvider */
-    customProvider?: IEncryptionProvider;
-    /** Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'. */
+    /**
+     * Key Derivation Function strategy ('none' | 'pbkdf2' | 'hkdf'). Defaults to 'pbkdf2'.
+     * - 'pbkdf2': Recommended for human passphrases/passwords (OWASP recommended with work factor iterations).
+     * - 'hkdf': For deriving subkeys from high-entropy cryptographic keys or secrets (not for low-entropy human passwords).
+     * - 'none': Direct key import for raw high-entropy 256-bit symmetric keys or CryptoKeys.
+     */
     kdf?: 'none' | 'pbkdf2' | 'hkdf';
     /** Number of PBKDF2 iterations (default: 310,000 per OWASP recommendation) */
     kdfIterations?: number;
@@ -275,6 +300,7 @@ type TPageDataHandler<TRow = TDataRow> = (currentPage: number, pageSize: number,
     signal?: AbortSignal;
 }) => IDataResult<TRow> | Promise<IDataResult<TRow>>;
 interface IDataProviderOptions {
+    apiUrl?: string;
     idKey?: string;
     filter?: IDataFilter;
     sortList?: IDataSort[];
@@ -439,6 +465,9 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     set filter(f: IDataFilter | null);
     get sortList(): IDataSort[];
     set sortList(s: IDataSort[]);
+    get hasMore(): boolean;
+    nextPage(): Promise<void>;
+    loadMore(): Promise<void>;
     private _listeners;
     private _stateListeners;
     private _pendingChangedKeys;
@@ -464,7 +493,7 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
     setCurrentPage(currentPage: number): void;
-    setPageSize(pageSize: number): void;
+    setPageSize(pageSize: number, resetPage?: boolean): void;
     setSelectedRows(rows: TRow[]): void;
     setSelectAll(val: boolean): void;
     abstract loadPageData(options?: {
@@ -475,17 +504,116 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     cancelPending(): void;
 }
 
-declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+interface ISetDataChunkedOptions {
+    chunkSize?: number;
+    onProgress?: (progress: {
+        processed: number;
+        total: number;
+        percent: number;
+    }) => void;
+    yieldStrategy?: 'microtask' | 'timeout';
+}
+declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
+declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
+declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
+declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
+    rows: T[];
+    decrypted: boolean;
+}>;
+declare function encryptRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<T[]>;
+declare function encryptRowsChunked<T = any>(rows: T[], encryption: IProviderEncryptionOptions, options?: ISetDataChunkedOptions, apiUrl?: string, idKey?: string, onChunkEncrypted?: (chunkPlain: T[], chunkEncrypted: T[], chunkStartIndex: number) => Promise<void> | void): Promise<T[]>;
+
+/**
+ * Normalizes text for consistent deterministic blind indexing (lowercased, trimmed, NFKC normalized).
+ */
+declare function normalizeIndexTerm(value: any): string;
+/**
+ * Extracts 3-character trigrams from a string for substring search.
+ */
+declare function extractTrigrams(value: any): string[];
+interface ISearchIndexRowEntry {
+    token: string;
+    trigrams: Set<string>;
+}
+/**
+ * CSearchIndex provides deterministic blind indexing (HMAC-SHA256) and trigram token sets
+ * for client-side privacy-preserving searching and filtering across encrypted fields without decryption.
+ */
+declare class CSearchIndex {
+    private _hmacKey?;
+    private _rawKeyMaterial;
+    private _index;
+    private _indexedFields;
+    constructor(keyMaterial: TKeyProvider, fields?: string[]);
+    get indexedFields(): readonly string[];
+    setFields(fields: string[]): void;
+    private _getHmacKey;
+    /**
+     * Computes a deterministic HMAC-SHA256 token for a term.
+     */
+    computeToken(term: any): Promise<string>;
+    /**
+     * Computes HMAC-SHA256 tokens for all trigrams of a term.
+     */
+    computeTrigramTokens(term: any): Promise<Set<string>>;
+    /**
+     * Indexes a single row before its fields are encrypted.
+     */
+    indexRow(row: any, plaintextFields?: Record<string, any>): Promise<void>;
+    /**
+     * Indexes an array of rows.
+     */
+    indexRows(rows: any[], plaintextMap?: Map<any, Record<string, any>>): Promise<void>;
+    /**
+     * Returns the index entry for a given row and field.
+     */
+    getEntry(row: any, field: string): ISearchIndexRowEntry | undefined;
+    /**
+     * Evaluates whether a row matches an exact or substring query on an indexed encrypted field.
+     */
+    evaluateField(operator: string, row: any, field: string, filterValue: any): Promise<boolean | null>;
+    /**
+     * Pre-computes query tokens for an active filter, returning a high-performance synchronous
+     * evaluator function suitable for row-by-row filtering in memory.
+     */
+    createFilterEvaluator(filter: IDataFilter): Promise<((row: any) => boolean) | null>;
+}
+
+declare abstract class AEncryptedClientProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+    encryption?: IProviderEncryptionOptions;
+    protected _searchIndex?: CSearchIndex;
+    constructor(options?: IDataProviderOptions);
+    get isEncryptionEnabled(): boolean;
+    get searchIndex(): CSearchIndex | undefined;
+    private _warmupKeyAsync;
+    protected _initSearchIndex(): void;
+    setEncryption(encryption?: IProviderEncryptionOptions): void;
+    clearEncryption(): void;
+    protected encryptRows(rows: TRow[]): Promise<TRow[]>;
+    protected encryptRowsChunked(rows: TRow[], options?: ISetDataChunkedOptions): Promise<TRow[]>;
+    protected decryptRows(rows: TRow[]): Promise<{
+        rows: TRow[];
+        decrypted: boolean;
+    }>;
+    abstract setData(data: TRow[]): Promise<void> | void;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
+}
+
+declare class CFlatClientDataProvider<TRow = TDataRow> extends AEncryptedClientProvider<TRow> {
     private _allData;
     filteredData: TRow[];
     private _rowMap;
-    private _filterDirty;
-    private _sortDirty;
+    protected _filterDirty: boolean;
+    protected _sortDirty: boolean;
+    protected _activeFilterEvaluator: ((row: any) => boolean) | null;
     constructor(options?: IDataProviderOptions);
     get allData(): TRow[];
     set allData(data: TRow[]);
     get rowMap(): readonly TRow[];
-    setData(data: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     protected onFilterUpdated(): void;
     protected onSortUpdated(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
@@ -498,6 +626,7 @@ declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRo
         disableCache?: boolean;
     }): Promise<void>;
     refresh(hardRefresh?: boolean): Promise<void>;
+    private _computeFilteredAndSorted;
     loadPageData(): Promise<void>;
 }
 
@@ -532,9 +661,19 @@ declare class RequestProvider {
     setCacheProvider(provider?: ACacheProvider | ECacheStrategy): void;
     setCacheLifetime(lifetime: number): void;
     setDeduplicate(deduplicate: boolean): void;
+    setQueue(queue: boolean): void;
     encryption?: IProviderEncryptionOptions;
     private _cachedCipherProvider?;
     private _lastEncryptionConfig?;
+    private _scopedCipherProviders;
+    /**
+     * Configures E2EE payload encryption for outbound mutations and inbound responses.
+     *
+     * Threat Model: Protects sensitive SaaS tenant data against backend/database breaches.
+     * Multi-user sharing is supported by role-based session keys passed dynamically.
+     * Local client endpoint compromise (malware, trojans, keyloggers) is out of scope.
+     */
+    private disposeCipherInstance;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     onDataReceived(callback: (data: any, generation?: number) => void): void;
@@ -543,7 +682,7 @@ declare class RequestProvider {
     refresh(hardRefresh?: boolean): Promise<any>;
     private resolveContext;
     private getInFlightMap;
-    private getUniqueKey;
+    getUniqueKey(url: string, options?: IRequestOptions): string;
     registerRequest<T>(url: string, options?: IRequestOptions): Promise<T>;
     static executeAll(): void;
     private isSameOriginUrl;
@@ -554,14 +693,6 @@ declare class RequestProvider {
     request<T>(url: string, options?: IRequestOptions): Promise<T>;
 }
 
-declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
-declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any, visited?: WeakSet<object>): boolean;
-declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
-declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
-    rows: T[];
-    decrypted: boolean;
-}>;
 declare abstract class AAPIDataProvider {
     apiUrl: string;
     cacheStrategy: ECacheStrategy | null;
@@ -585,8 +716,11 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
+    private _isAccumulating;
+    private _inFlightLoadMore;
+    private _lastDataReceivedPromise;
     constructor(options?: IDataProviderOptions);
+    loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
     setContextKey(key: string): void;
@@ -650,6 +784,7 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private _nodeMapCache;
     private _sortedNodeIdsCache;
     private _filteredNodesCache;
+    private _allVisibleRowsCache;
     invalidateStaticCache(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
     protected onFilterUpdated(): void;
@@ -657,7 +792,10 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private get _nodeMap();
     private get _sortedNodeIds();
     constructor(options?: ITreeDataProviderOptions);
-    setData(data: TRow[]): void;
+    protected _applyTreeData(rows: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     private buildStaticNodes;
     protected onSortUpdated(): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
@@ -668,6 +806,9 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     loadPageData(): Promise<void>;
     get treeNodes(): ITreeNode<TRow>[];
     get allVisibleNodes(): ITreeNode<TRow>[];
+    get rowMap(): readonly (TRow & ITreeNode<TRow> & {
+        __treeNode: ITreeNode<TRow>;
+    })[];
     get allVisibleRows(): (TRow & ITreeNode<TRow> & {
         __treeNode: ITreeNode<TRow>;
     })[];
@@ -693,7 +834,7 @@ declare class CAPITreeClientDataProvider<TRow extends TDataRow = TDataRow> exten
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
+    private _lastDataReceivedPromise;
     constructor(options?: ITreeDataProviderOptions);
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
@@ -927,6 +1068,7 @@ declare class CCookieCache extends ACacheProvider {
 
 declare class CLocalStorageCache extends ACacheProvider {
     private static instance;
+    private static _writeCount;
     static getInstance(): CLocalStorageCache;
     type: string;
     private quotaOptions;
@@ -1248,6 +1390,7 @@ declare const filterData: (data: any[], filter: IDataFilter, options?: {
         idKey: string;
         parentKey: string;
     };
+    rowEvaluator?: (row: any) => boolean;
 }) => {
     results: any[];
     expandedNodes?: Set<string | number>;
@@ -1266,6 +1409,7 @@ declare const useFilterLogic: () => {
             idKey: string;
             parentKey: string;
         };
+        rowEvaluator?: (row: any) => boolean;
     }) => {
         results: any[];
         expandedNodes?: Set<string | number>;
@@ -1440,6 +1584,11 @@ declare class CKeyManager {
     static resolveSalt(salt?: Uint8Array | ArrayBuffer | string): Uint8Array;
     /**
      * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
+     *
+     * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
+     * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
+     * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
+     * Client-side malware/trojan protection is out of scope.
      */
     static generateAESKey(length?: 128 | 256, algorithm?: 'AES-GCM' | 'AES-CBC' | 'AES-KW', extractable?: boolean): Promise<CryptoKey>;
     /**
@@ -1535,7 +1684,20 @@ interface ICWebCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
+/**
+ * Zero-dependency AES-256-GCM cipher provider using native Web Crypto API (crypto.subtle).
+ *
+ * E2EE Threat Model Scope:
+ * - Purpose: Provides client-side End-to-End Encryption (E2EE) to safeguard GDPR and tenant
+ *   records against database and server-side data breaches in multi-tenant SaaS systems.
+ * - Multi-User Key Sharing: Authorized users in the same tenant encrypt/decrypt shared data
+ *   based on database roles that distribute symmetric or wrapped keys.
+ * - Non-Goals: Client-side trojan, keylogger, or DOM-scraping malware defense is out of scope
+ *   and remains the responsibility of the client endpoint device owner.
+ */
 declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _defaultKdf;
     private _cachedKey?;
@@ -1544,6 +1706,8 @@ declare class CWebCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _cachedKeyId?;
+    private _configuredKid?;
     private _decryptSaltCache;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
@@ -1572,6 +1736,8 @@ interface ICWebCryptoAESCBCOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Authenticated AES-CBC-256 provider with Encrypt-then-MAC (HMAC-SHA-256).
@@ -1590,6 +1756,7 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     private _kdfOptions?;
     private _decryptSaltCache;
     constructor(key?: TKeyProvider | IKeyPair, options?: ICWebCryptoAESCBCOptions);
@@ -1625,6 +1792,12 @@ declare class CWebCryptoAESCBCProvider extends AEncryptionProvider {
  * 3. The AES-GCM data key is wrapped with the recipient's RSA-OAEP public key.
  * 4. The envelope packages ciphertext, IV, and wrappedKey.
  * 5. Only the holder of the matching RSA private key can unwrap the data key and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): Asymmetric hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party in possession
+ * of the recipient's public key can encrypt data. In multi-user / multi-tenant workflows where sender
+ * authenticity is required, sign payloads with a digital signature (e.g. ECDSA/RSA-PSS) or use
+ * authenticated symmetric role keys (AES-GCM) governed by database role permissions.
  */
 declare class CRSAEncryptionProvider extends AEncryptionProvider {
     private publicKey?;
@@ -1676,6 +1849,12 @@ type TECDHCurve = 'P-256' | 'P-384' | 'P-521';
  * 4. Payload is encrypted with AES-GCM.
  * 5. Ephemeral public key (JWK) is attached to the envelope (`epk`).
  * 6. Only the recipient with the matching private key can agree with `epk` and decrypt.
+ *
+ * Security Advisory (Sender Authenticity): ECDH ephemeral-static hybrid encryption guarantees confidentiality
+ * for the recipient, but does NOT authenticate the identity of the sender. Any party with the recipient's
+ * public key can generate an ephemeral keypair and send encrypted envelopes. In multi-user / multi-tenant
+ * SaaS environments requiring sender authenticity, sign payloads with a digital signature (ECDSA/Ed25519)
+ * or use authenticated symmetric role keys (AES-GCM) managed via database role permissions.
  */
 declare class CECDHEncryptionProvider extends AEncryptionProvider {
     private recipientPublicKey?;
@@ -1736,6 +1915,8 @@ interface ICNodeCryptoOptions {
     kdfHash?: 'SHA-256' | 'SHA-512';
     kdfSalt?: string | Uint8Array | ArrayBuffer;
     info?: string | Uint8Array | ArrayBuffer;
+    kid?: string;
+    keyId?: string;
 }
 /**
  * Server-side synchronous AES-GCM-256 encryption provider using Node.js native `node:crypto`.
@@ -1755,6 +1936,7 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
     private _cachedKdf?;
     private _cachedIter?;
     private _cachedHash?;
+    private _configuredKid?;
     setDefaultKey(key: TKeyProvider): void;
     clearKeys(): void;
     warmupKey(options?: IEncryptionContext): Promise<void>;
@@ -1803,10 +1985,58 @@ declare class CNodeCryptoEncryptionProvider extends AEncryptionProvider {
  */
 declare function createEncryptionProvider(options?: IProviderEncryptionOptions): IEncryptionProvider;
 
+/**
+ * Shared cryptographic utilities for Web Crypto API access and random byte generation.
+ * Internal module for Katlux Encryption Providers.
+ */
+/**
+ * Resolves the SubtleCrypto instance from globalThis.
+ * Throws a descriptive error if Web Crypto API is unavailable.
+ */
+declare function getSubtleCrypto(): SubtleCrypto;
+/**
+ * Fills a typed array with cryptographically secure random values using crypto.getRandomValues.
+ */
+declare function getRandomValues(array: Uint8Array): Uint8Array;
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+/**
+ * Resolves an HKDF info / context parameter into a Uint8Array.
+ * Safely preserves raw binary buffers (Uint8Array, ArrayBuffer) without string coercion.
+ */
+declare function resolveInfoBytes(info?: string | Uint8Array | ArrayBuffer, fallback?: string): Uint8Array;
+/**
+ * Safely assigns a property to a target object, preventing prototype pollution attacks
+ * via __proto__, constructor, or prototype manipulation.
+ */
+declare function safeSetProperty(target: Record<string, any>, key: string, value: any): void;
+/**
+ * Converts an ArrayBuffer or Uint8Array into a Base64-encoded string.
+ */
+declare function toBase64(buffer: ArrayBuffer | Uint8Array): string;
+/**
+ * Fast 64-bit FNV-1a hash formatted as a hex string.
+ * Non-cryptographic, zero-allocation, synchronous hash used for safe heap cache indexing
+ * without retaining plaintext secrets in compound Map keys.
+ */
+declare function fastKeyHash(str: string): string;
+/**
+ * Computes a collision-free, safe string identifier for a resolved key.
+ * Hashes raw string passphrases to ensure secrets never reside in compound Map keys (Minor 8)
+ * and resolves function outputs so multi-tenant SSR requests never collide on function references (Major 3).
+ */
+declare function getSafeKeyIdentifier(rawKey: any): string;
+/**
+ * Returns a collision-free string identifier for a key provider or fallback key.
+ * Uses a hashed identifier for strings and WeakMap for objects to prevent
+ * cross-tenant cache collisions and avoid storing secrets in heap Map keys.
+ */
+declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
+
 /**
  * Universal helper that verifies whether an arbitrary object is a Katlux encrypted payload envelope.
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getPlatformApp, getSSRData, getSSRPayload, isDataEncrypted, isEncrypted, onPlatformReady, setHydrationAdapter, sortData, useDebounce, useFilterLogic, useSortLogic };
-export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };
+export { AAPIDataProvider, ADataProvider, AEncryptedClientProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CSearchIndex, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, encryptRows, encryptRowsChunked, evaluateFilter, extractTrigrams, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, normalizeIndexTerm, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
+export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ISearchIndexRowEntry, ISetDataChunkedOptions, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };