@katlux/providers 0.1.1-alpha.106 → 0.1.1-alpha.109

package/dist/index.d.cts

@@ -77,6 +77,10 @@ interface IProviderEncryptionOptions {
     lazy?: boolean;
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
+    /** Enable HMAC-SHA256 blind indexing and trigram search index on encrypted fields for local DataProviders */
+    searchIndex?: boolean;
+    /** Optional dedicated HMAC key for search indexing (defaults to encryption key if omitted) */
+    hmacKey?: TKeyProvider;
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
     /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
@@ -500,17 +504,116 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     cancelPending(): void;
 }
 
-declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+interface ISetDataChunkedOptions {
+    chunkSize?: number;
+    onProgress?: (progress: {
+        processed: number;
+        total: number;
+        percent: number;
+    }) => void;
+    yieldStrategy?: 'microtask' | 'timeout';
+}
+declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
+declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
+declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
+declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
+    rows: T[];
+    decrypted: boolean;
+}>;
+declare function encryptRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<T[]>;
+declare function encryptRowsChunked<T = any>(rows: T[], encryption: IProviderEncryptionOptions, options?: ISetDataChunkedOptions, apiUrl?: string, idKey?: string, onChunkEncrypted?: (chunkPlain: T[], chunkEncrypted: T[], chunkStartIndex: number) => Promise<void> | void): Promise<T[]>;
+
+/**
+ * Normalizes text for consistent deterministic blind indexing (lowercased, trimmed, NFKC normalized).
+ */
+declare function normalizeIndexTerm(value: any): string;
+/**
+ * Extracts 3-character trigrams from a string for substring search.
+ */
+declare function extractTrigrams(value: any): string[];
+interface ISearchIndexRowEntry {
+    token: string;
+    trigrams: Set<string>;
+}
+/**
+ * CSearchIndex provides deterministic blind indexing (HMAC-SHA256) and trigram token sets
+ * for client-side privacy-preserving searching and filtering across encrypted fields without decryption.
+ */
+declare class CSearchIndex {
+    private _hmacKey?;
+    private _rawKeyMaterial;
+    private _index;
+    private _indexedFields;
+    constructor(keyMaterial: TKeyProvider, fields?: string[]);
+    get indexedFields(): readonly string[];
+    setFields(fields: string[]): void;
+    private _getHmacKey;
+    /**
+     * Computes a deterministic HMAC-SHA256 token for a term.
+     */
+    computeToken(term: any): Promise<string>;
+    /**
+     * Computes HMAC-SHA256 tokens for all trigrams of a term.
+     */
+    computeTrigramTokens(term: any): Promise<Set<string>>;
+    /**
+     * Indexes a single row before its fields are encrypted.
+     */
+    indexRow(row: any, plaintextFields?: Record<string, any>): Promise<void>;
+    /**
+     * Indexes an array of rows.
+     */
+    indexRows(rows: any[], plaintextMap?: Map<any, Record<string, any>>): Promise<void>;
+    /**
+     * Returns the index entry for a given row and field.
+     */
+    getEntry(row: any, field: string): ISearchIndexRowEntry | undefined;
+    /**
+     * Evaluates whether a row matches an exact or substring query on an indexed encrypted field.
+     */
+    evaluateField(operator: string, row: any, field: string, filterValue: any): Promise<boolean | null>;
+    /**
+     * Pre-computes query tokens for an active filter, returning a high-performance synchronous
+     * evaluator function suitable for row-by-row filtering in memory.
+     */
+    createFilterEvaluator(filter: IDataFilter): Promise<((row: any) => boolean) | null>;
+}
+
+declare abstract class AEncryptedClientProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+    encryption?: IProviderEncryptionOptions;
+    protected _searchIndex?: CSearchIndex;
+    constructor(options?: IDataProviderOptions);
+    get isEncryptionEnabled(): boolean;
+    get searchIndex(): CSearchIndex | undefined;
+    private _warmupKeyAsync;
+    protected _initSearchIndex(): void;
+    setEncryption(encryption?: IProviderEncryptionOptions): void;
+    clearEncryption(): void;
+    protected encryptRows(rows: TRow[]): Promise<TRow[]>;
+    protected encryptRowsChunked(rows: TRow[], options?: ISetDataChunkedOptions): Promise<TRow[]>;
+    protected decryptRows(rows: TRow[]): Promise<{
+        rows: TRow[];
+        decrypted: boolean;
+    }>;
+    abstract setData(data: TRow[]): Promise<void> | void;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
+}
+
+declare class CFlatClientDataProvider<TRow = TDataRow> extends AEncryptedClientProvider<TRow> {
     private _allData;
     filteredData: TRow[];
     private _rowMap;
-    private _filterDirty;
-    private _sortDirty;
+    protected _filterDirty: boolean;
+    protected _sortDirty: boolean;
+    protected _activeFilterEvaluator: ((row: any) => boolean) | null;
     constructor(options?: IDataProviderOptions);
     get allData(): TRow[];
     set allData(data: TRow[]);
     get rowMap(): readonly TRow[];
-    setData(data: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     protected onFilterUpdated(): void;
     protected onSortUpdated(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
@@ -523,6 +626,7 @@ declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRo
         disableCache?: boolean;
     }): Promise<void>;
     refresh(hardRefresh?: boolean): Promise<void>;
+    private _computeFilteredAndSorted;
     loadPageData(): Promise<void>;
 }
 
@@ -589,14 +693,6 @@ declare class RequestProvider {
     request<T>(url: string, options?: IRequestOptions): Promise<T>;
 }
 
-declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
-declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
-declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
-declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
-    rows: T[];
-    decrypted: boolean;
-}>;
 declare abstract class AAPIDataProvider {
     apiUrl: string;
     cacheStrategy: ECacheStrategy | null;
@@ -620,9 +716,9 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
     private _isAccumulating;
     private _inFlightLoadMore;
+    private _lastDataReceivedPromise;
     constructor(options?: IDataProviderOptions);
     loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
@@ -696,7 +792,10 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private get _nodeMap();
     private get _sortedNodeIds();
     constructor(options?: ITreeDataProviderOptions);
-    setData(data: TRow[]): void;
+    protected _applyTreeData(rows: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     private buildStaticNodes;
     protected onSortUpdated(): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
@@ -735,7 +834,7 @@ declare class CAPITreeClientDataProvider<TRow extends TDataRow = TDataRow> exten
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
+    private _lastDataReceivedPromise;
     constructor(options?: ITreeDataProviderOptions);
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
@@ -1291,6 +1390,7 @@ declare const filterData: (data: any[], filter: IDataFilter, options?: {
         idKey: string;
         parentKey: string;
     };
+    rowEvaluator?: (row: any) => boolean;
 }) => {
     results: any[];
     expandedNodes?: Set<string | number>;
@@ -1309,6 +1409,7 @@ declare const useFilterLogic: () => {
             idKey: string;
             parentKey: string;
         };
+        rowEvaluator?: (row: any) => boolean;
     }) => {
         results: any[];
         expandedNodes?: Set<string | number>;
@@ -1937,5 +2038,5 @@ declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
-export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };
+export { AAPIDataProvider, ADataProvider, AEncryptedClientProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CSearchIndex, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, encryptRows, encryptRowsChunked, evaluateFilter, extractTrigrams, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, normalizeIndexTerm, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
+export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ISearchIndexRowEntry, ISetDataChunkedOptions, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };

package/dist/index.d.mts

@@ -77,6 +77,10 @@ interface IProviderEncryptionOptions {
     lazy?: boolean;
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
+    /** Enable HMAC-SHA256 blind indexing and trigram search index on encrypted fields for local DataProviders */
+    searchIndex?: boolean;
+    /** Optional dedicated HMAC key for search indexing (defaults to encryption key if omitted) */
+    hmacKey?: TKeyProvider;
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
     /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
@@ -500,17 +504,116 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     cancelPending(): void;
 }
 
-declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+interface ISetDataChunkedOptions {
+    chunkSize?: number;
+    onProgress?: (progress: {
+        processed: number;
+        total: number;
+        percent: number;
+    }) => void;
+    yieldStrategy?: 'microtask' | 'timeout';
+}
+declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
+declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
+declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
+declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
+    rows: T[];
+    decrypted: boolean;
+}>;
+declare function encryptRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<T[]>;
+declare function encryptRowsChunked<T = any>(rows: T[], encryption: IProviderEncryptionOptions, options?: ISetDataChunkedOptions, apiUrl?: string, idKey?: string, onChunkEncrypted?: (chunkPlain: T[], chunkEncrypted: T[], chunkStartIndex: number) => Promise<void> | void): Promise<T[]>;
+
+/**
+ * Normalizes text for consistent deterministic blind indexing (lowercased, trimmed, NFKC normalized).
+ */
+declare function normalizeIndexTerm(value: any): string;
+/**
+ * Extracts 3-character trigrams from a string for substring search.
+ */
+declare function extractTrigrams(value: any): string[];
+interface ISearchIndexRowEntry {
+    token: string;
+    trigrams: Set<string>;
+}
+/**
+ * CSearchIndex provides deterministic blind indexing (HMAC-SHA256) and trigram token sets
+ * for client-side privacy-preserving searching and filtering across encrypted fields without decryption.
+ */
+declare class CSearchIndex {
+    private _hmacKey?;
+    private _rawKeyMaterial;
+    private _index;
+    private _indexedFields;
+    constructor(keyMaterial: TKeyProvider, fields?: string[]);
+    get indexedFields(): readonly string[];
+    setFields(fields: string[]): void;
+    private _getHmacKey;
+    /**
+     * Computes a deterministic HMAC-SHA256 token for a term.
+     */
+    computeToken(term: any): Promise<string>;
+    /**
+     * Computes HMAC-SHA256 tokens for all trigrams of a term.
+     */
+    computeTrigramTokens(term: any): Promise<Set<string>>;
+    /**
+     * Indexes a single row before its fields are encrypted.
+     */
+    indexRow(row: any, plaintextFields?: Record<string, any>): Promise<void>;
+    /**
+     * Indexes an array of rows.
+     */
+    indexRows(rows: any[], plaintextMap?: Map<any, Record<string, any>>): Promise<void>;
+    /**
+     * Returns the index entry for a given row and field.
+     */
+    getEntry(row: any, field: string): ISearchIndexRowEntry | undefined;
+    /**
+     * Evaluates whether a row matches an exact or substring query on an indexed encrypted field.
+     */
+    evaluateField(operator: string, row: any, field: string, filterValue: any): Promise<boolean | null>;
+    /**
+     * Pre-computes query tokens for an active filter, returning a high-performance synchronous
+     * evaluator function suitable for row-by-row filtering in memory.
+     */
+    createFilterEvaluator(filter: IDataFilter): Promise<((row: any) => boolean) | null>;
+}
+
+declare abstract class AEncryptedClientProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+    encryption?: IProviderEncryptionOptions;
+    protected _searchIndex?: CSearchIndex;
+    constructor(options?: IDataProviderOptions);
+    get isEncryptionEnabled(): boolean;
+    get searchIndex(): CSearchIndex | undefined;
+    private _warmupKeyAsync;
+    protected _initSearchIndex(): void;
+    setEncryption(encryption?: IProviderEncryptionOptions): void;
+    clearEncryption(): void;
+    protected encryptRows(rows: TRow[]): Promise<TRow[]>;
+    protected encryptRowsChunked(rows: TRow[], options?: ISetDataChunkedOptions): Promise<TRow[]>;
+    protected decryptRows(rows: TRow[]): Promise<{
+        rows: TRow[];
+        decrypted: boolean;
+    }>;
+    abstract setData(data: TRow[]): Promise<void> | void;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
+}
+
+declare class CFlatClientDataProvider<TRow = TDataRow> extends AEncryptedClientProvider<TRow> {
     private _allData;
     filteredData: TRow[];
     private _rowMap;
-    private _filterDirty;
-    private _sortDirty;
+    protected _filterDirty: boolean;
+    protected _sortDirty: boolean;
+    protected _activeFilterEvaluator: ((row: any) => boolean) | null;
     constructor(options?: IDataProviderOptions);
     get allData(): TRow[];
     set allData(data: TRow[]);
     get rowMap(): readonly TRow[];
-    setData(data: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     protected onFilterUpdated(): void;
     protected onSortUpdated(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
@@ -523,6 +626,7 @@ declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRo
         disableCache?: boolean;
     }): Promise<void>;
     refresh(hardRefresh?: boolean): Promise<void>;
+    private _computeFilteredAndSorted;
     loadPageData(): Promise<void>;
 }
 
@@ -589,14 +693,6 @@ declare class RequestProvider {
     request<T>(url: string, options?: IRequestOptions): Promise<T>;
 }
 
-declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
-declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
-declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
-declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
-    rows: T[];
-    decrypted: boolean;
-}>;
 declare abstract class AAPIDataProvider {
     apiUrl: string;
     cacheStrategy: ECacheStrategy | null;
@@ -620,9 +716,9 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
     private _isAccumulating;
     private _inFlightLoadMore;
+    private _lastDataReceivedPromise;
     constructor(options?: IDataProviderOptions);
     loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
@@ -696,7 +792,10 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private get _nodeMap();
     private get _sortedNodeIds();
     constructor(options?: ITreeDataProviderOptions);
-    setData(data: TRow[]): void;
+    protected _applyTreeData(rows: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     private buildStaticNodes;
     protected onSortUpdated(): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
@@ -735,7 +834,7 @@ declare class CAPITreeClientDataProvider<TRow extends TDataRow = TDataRow> exten
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
+    private _lastDataReceivedPromise;
     constructor(options?: ITreeDataProviderOptions);
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
@@ -1291,6 +1390,7 @@ declare const filterData: (data: any[], filter: IDataFilter, options?: {
         idKey: string;
         parentKey: string;
     };
+    rowEvaluator?: (row: any) => boolean;
 }) => {
     results: any[];
     expandedNodes?: Set<string | number>;
@@ -1309,6 +1409,7 @@ declare const useFilterLogic: () => {
             idKey: string;
             parentKey: string;
         };
+        rowEvaluator?: (row: any) => boolean;
     }) => {
         results: any[];
         expandedNodes?: Set<string | number>;
@@ -1937,5 +2038,5 @@ declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
-export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };
+export { AAPIDataProvider, ADataProvider, AEncryptedClientProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CSearchIndex, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, encryptRows, encryptRowsChunked, evaluateFilter, extractTrigrams, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, normalizeIndexTerm, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
+export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ISearchIndexRowEntry, ISetDataChunkedOptions, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };

package/dist/index.d.ts

@@ -77,6 +77,10 @@ interface IProviderEncryptionOptions {
     lazy?: boolean;
     /** Whitelist of specific field names to encrypt/decrypt (e.g. ['name', 'surname']). Any unlisted field remains plaintext. */
     fields?: string[];
+    /** Enable HMAC-SHA256 blind indexing and trigram search index on encrypted fields for local DataProviders */
+    searchIndex?: boolean;
+    /** Optional dedicated HMAC key for search indexing (defaults to encryption key if omitted) */
+    hmacKey?: TKeyProvider;
     /** Cryptographic algorithm identifier (defaults to 'AES-GCM') */
     algorithm?: 'AES-GCM' | string;
     /** Custom cipher adapter implementing IEncryptionProvider (e.g. CRSAEncryptionProvider, CECDHEncryptionProvider, CWebCryptoAESCBCProvider) */
@@ -500,17 +504,116 @@ declare abstract class ADataProvider<TRow = TDataRow> {
     cancelPending(): void;
 }
 
-declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+interface ISetDataChunkedOptions {
+    chunkSize?: number;
+    onProgress?: (progress: {
+        processed: number;
+        total: number;
+        percent: number;
+    }) => void;
+    yieldStrategy?: 'microtask' | 'timeout';
+}
+declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
+declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
+declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
+declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
+declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
+    rows: T[];
+    decrypted: boolean;
+}>;
+declare function encryptRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<T[]>;
+declare function encryptRowsChunked<T = any>(rows: T[], encryption: IProviderEncryptionOptions, options?: ISetDataChunkedOptions, apiUrl?: string, idKey?: string, onChunkEncrypted?: (chunkPlain: T[], chunkEncrypted: T[], chunkStartIndex: number) => Promise<void> | void): Promise<T[]>;
+
+/**
+ * Normalizes text for consistent deterministic blind indexing (lowercased, trimmed, NFKC normalized).
+ */
+declare function normalizeIndexTerm(value: any): string;
+/**
+ * Extracts 3-character trigrams from a string for substring search.
+ */
+declare function extractTrigrams(value: any): string[];
+interface ISearchIndexRowEntry {
+    token: string;
+    trigrams: Set<string>;
+}
+/**
+ * CSearchIndex provides deterministic blind indexing (HMAC-SHA256) and trigram token sets
+ * for client-side privacy-preserving searching and filtering across encrypted fields without decryption.
+ */
+declare class CSearchIndex {
+    private _hmacKey?;
+    private _rawKeyMaterial;
+    private _index;
+    private _indexedFields;
+    constructor(keyMaterial: TKeyProvider, fields?: string[]);
+    get indexedFields(): readonly string[];
+    setFields(fields: string[]): void;
+    private _getHmacKey;
+    /**
+     * Computes a deterministic HMAC-SHA256 token for a term.
+     */
+    computeToken(term: any): Promise<string>;
+    /**
+     * Computes HMAC-SHA256 tokens for all trigrams of a term.
+     */
+    computeTrigramTokens(term: any): Promise<Set<string>>;
+    /**
+     * Indexes a single row before its fields are encrypted.
+     */
+    indexRow(row: any, plaintextFields?: Record<string, any>): Promise<void>;
+    /**
+     * Indexes an array of rows.
+     */
+    indexRows(rows: any[], plaintextMap?: Map<any, Record<string, any>>): Promise<void>;
+    /**
+     * Returns the index entry for a given row and field.
+     */
+    getEntry(row: any, field: string): ISearchIndexRowEntry | undefined;
+    /**
+     * Evaluates whether a row matches an exact or substring query on an indexed encrypted field.
+     */
+    evaluateField(operator: string, row: any, field: string, filterValue: any): Promise<boolean | null>;
+    /**
+     * Pre-computes query tokens for an active filter, returning a high-performance synchronous
+     * evaluator function suitable for row-by-row filtering in memory.
+     */
+    createFilterEvaluator(filter: IDataFilter): Promise<((row: any) => boolean) | null>;
+}
+
+declare abstract class AEncryptedClientProvider<TRow = TDataRow> extends ADataProvider<TRow> {
+    encryption?: IProviderEncryptionOptions;
+    protected _searchIndex?: CSearchIndex;
+    constructor(options?: IDataProviderOptions);
+    get isEncryptionEnabled(): boolean;
+    get searchIndex(): CSearchIndex | undefined;
+    private _warmupKeyAsync;
+    protected _initSearchIndex(): void;
+    setEncryption(encryption?: IProviderEncryptionOptions): void;
+    clearEncryption(): void;
+    protected encryptRows(rows: TRow[]): Promise<TRow[]>;
+    protected encryptRowsChunked(rows: TRow[], options?: ISetDataChunkedOptions): Promise<TRow[]>;
+    protected decryptRows(rows: TRow[]): Promise<{
+        rows: TRow[];
+        decrypted: boolean;
+    }>;
+    abstract setData(data: TRow[]): Promise<void> | void;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
+}
+
+declare class CFlatClientDataProvider<TRow = TDataRow> extends AEncryptedClientProvider<TRow> {
     private _allData;
     filteredData: TRow[];
     private _rowMap;
-    private _filterDirty;
-    private _sortDirty;
+    protected _filterDirty: boolean;
+    protected _sortDirty: boolean;
+    protected _activeFilterEvaluator: ((row: any) => boolean) | null;
     constructor(options?: IDataProviderOptions);
     get allData(): TRow[];
     set allData(data: TRow[]);
     get rowMap(): readonly TRow[];
-    setData(data: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     protected onFilterUpdated(): void;
     protected onSortUpdated(): void;
     setFilter(filter: IDataFilter | null, immediate?: boolean): void;
@@ -523,6 +626,7 @@ declare class CFlatClientDataProvider<TRow = TDataRow> extends ADataProvider<TRo
         disableCache?: boolean;
     }): Promise<void>;
     refresh(hardRefresh?: boolean): Promise<void>;
+    private _computeFilteredAndSorted;
     loadPageData(): Promise<void>;
 }
 
@@ -589,14 +693,6 @@ declare class RequestProvider {
     request<T>(url: string, options?: IRequestOptions): Promise<T>;
 }
 
-declare function getCipherProvider(encryption?: IProviderEncryptionOptions): IEncryptionProvider | undefined;
-declare function clearCachedCipherProvider(encryption?: IProviderEncryptionOptions): void;
-declare function isDataEncrypted(provider?: IEncryptionProvider, data?: any): boolean;
-declare function buildEncryptionContext(encryption?: IProviderEncryptionOptions, url?: string, _defaultIdKey?: string): IEncryptionContext;
-declare function decryptPageRows<T = any>(rows: T[], encryption?: IProviderEncryptionOptions, apiUrl?: string, idKey?: string): Promise<{
-    rows: T[];
-    decrypted: boolean;
-}>;
 declare abstract class AAPIDataProvider {
     apiUrl: string;
     cacheStrategy: ECacheStrategy | null;
@@ -620,9 +716,9 @@ declare class CAPIFlatClientDataProvider<TRow = TDataRow> extends CFlatClientDat
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
     private _isAccumulating;
     private _inFlightLoadMore;
+    private _lastDataReceivedPromise;
     constructor(options?: IDataProviderOptions);
     loadMore(): Promise<void>;
     setEncryption(encryption?: IProviderEncryptionOptions): void;
@@ -696,7 +792,10 @@ declare class CTreeClientDataProvider<TRow extends TDataRow = TDataRow> extends
     private get _nodeMap();
     private get _sortedNodeIds();
     constructor(options?: ITreeDataProviderOptions);
-    setData(data: TRow[]): void;
+    protected _applyTreeData(rows: TRow[]): void;
+    setData(data: TRow[]): Promise<void> | void;
+    protected _setDataEncrypted(data: TRow[]): Promise<void>;
+    setDataChunked(data: TRow[], options?: ISetDataChunkedOptions): Promise<void>;
     private buildStaticNodes;
     protected onSortUpdated(): void;
     setSortList(sortList: IDataSort[], immediate?: boolean): void;
@@ -735,7 +834,7 @@ declare class CAPITreeClientDataProvider<TRow extends TDataRow = TDataRow> exten
     cacheStrategy: ECacheStrategy | null;
     cacheLifetime: number;
     refreshOnMutation: boolean | undefined;
-    encryption?: IProviderEncryptionOptions;
+    private _lastDataReceivedPromise;
     constructor(options?: ITreeDataProviderOptions);
     setEncryption(encryption?: IProviderEncryptionOptions): void;
     clearEncryption(): void;
@@ -1291,6 +1390,7 @@ declare const filterData: (data: any[], filter: IDataFilter, options?: {
         idKey: string;
         parentKey: string;
     };
+    rowEvaluator?: (row: any) => boolean;
 }) => {
     results: any[];
     expandedNodes?: Set<string | number>;
@@ -1309,6 +1409,7 @@ declare const useFilterLogic: () => {
             idKey: string;
             parentKey: string;
         };
+        rowEvaluator?: (row: any) => boolean;
     }) => {
         results: any[];
         expandedNodes?: Set<string | number>;
@@ -1937,5 +2038,5 @@ declare function getKeyIdentifier(keyProvider?: any, defaultKey?: any): string;
  */
 declare function isEncrypted(payload: any): boolean;
 
-export { AAPIDataProvider, ADataProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, evaluateFilter, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
-export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };
+export { AAPIDataProvider, ADataProvider, AEncryptedClientProvider, AEncryptionProvider, CAPIFlatClientDataProvider, CAPIFlatServerDataProvider, CAPITreeClientDataProvider, CAPITreeServerDataProvider, CApplicationCache, CBrowserSessionCache, CCookieCache, CECDHEncryptionProvider, CFlatClientDataProvider, CFlatServerDataProvider, CIndexedDBCache, CKeyManager, CLocalStorageCache, CMemoryCache, CNodeCryptoEncryptionProvider, CRSAEncryptionProvider, CSearchIndex, CServerSessionCache, CTreeClientDataProvider, CTreeServerDataProvider, CWebCryptoAESCBCProvider, CWebCryptoEncryptionProvider, CacheProviderFactory, DefaultHydrationAdapter, ECacheStrategy, EDataFilterOperator, EQueueStorage, KatluxIndexedDB, QueueStorageFactory, RequestProvider, RequestProviderRegistry, RequestQueue, SENSITIVE_HEADER_KEYS, applyOperator, buildEncryptionContext, clearCachedCipherProvider, clearSSRData, compareAnd, compareEqual, compareIn, compareOr, compareValues, createEncryptionProvider, debounce, decryptPageRows, encryptRows, encryptRowsChunked, evaluateFilter, extractTrigrams, fastKeyHash, fetchWithSSR, filterData, filterTreeData, getAppRoute, getAppRouter, getCipherProvider, getHydrationAdapter, getKeyIdentifier, getPlatformApp, getRandomValues, getSSRData, getSSRPayload, getSafeKeyIdentifier, getSubtleCrypto, isDataEncrypted, isEncrypted, normalizeIndexTerm, onPlatformReady, resolveInfoBytes, safeSetProperty, setHydrationAdapter, sortData, textDecoder, textEncoder, toBase64, useDebounce, useFilterLogic, useSortLogic };
+export type { CacheDriverLoader, ICNodeCryptoOptions, ICWebCryptoAESCBCOptions, ICWebCryptoOptions, ICacheEntry, ICacheQuotaOptions, IDataFilter, IDataProviderOptions, IDataProviderSetStateOptions, IDataProviderState, IDataResult, IDataSort, IDeadLetterItem, IDebouncedFunction, IEncryptedPayload, IEncryptionContext, IEncryptionProvider, IFlushOptions, IHKDFFromSecretOptions, IKDFOptions, IKDatatableAction, IKeyPair, IPlatformRouter, IProviderEncryptionOptions, IQueueStorageAdapter, IQueuedOperation, IRequestOptions, ISSRHydrationAdapter, ISearchIndexRowEntry, ISetDataChunkedOptions, ITreeDataProvider, ITreeDataProviderOptions, ITreeNode, ITreeNodeStatic, IVirtualScrollState, IWrappedKey, KProductItemData, KProductRowAction, TDataProviderListener, TDataProviderStateChangeListener, TDataRow, TECDHCurve, TKatluxStore, TKeyProvider, TPageDataHandler, TQueueItemStatus, TRawKey, TTreePageDataHandler, TTreeRow, TUnsubscribe, TreePaginationMode };