@katlux/providers 0.1.1-alpha.127 → 0.1.1-alpha.128

package/dist/index.mjs

@@ -717,742 +717,764 @@ function canonicalizeJson(value, seen = /* @__PURE__ */ new Set()) {
   return JSON.stringify(value);
 }
 
-class AEncryptionProvider {
-  defaultKey;
-  keys;
-  activeKid;
-  allowedKids;
-  constructor(key, options) {
-    if (key !== void 0) {
-      this.defaultKey = key;
-    }
-    if (options?.keys) {
-      this.keys = options.keys;
-    }
-    if (options?.activeKid) {
-      this.activeKid = options.activeKid;
-    }
-    if (options?.allowedKids) {
-      this.allowedKids = options.allowedKids;
-    }
-  }
+class CKeyManager {
+  // ── Binary & Encoding Utilities ──────────────────────────────────────────
   /**
-   * Sets or updates the default secret key, CryptoKey, or async key provider function.
+   * Generates a cryptographically secure random byte buffer of the specified length.
    */
-  setDefaultKey(key) {
-    this.defaultKey = key || void 0;
+  static randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    return getRandomValues(bytes);
   }
   /**
-   * Retrieves the currently configured default key or key provider callback.
+   * Converts an ArrayBuffer or Uint8Array into a Base64-encoded string.
    */
-  getDefaultKey() {
-    return this.defaultKey;
+  static toBase64(buffer) {
+    return toBase64(buffer);
   }
   /**
-   * Configures a keyring dictionary of keys with an optional active key identifier.
+   * Converts a Base64 or Base64URL-encoded string back into a Uint8Array.
+   * Normalizes URL-safe characters and padding, strictly validating against the Base64 alphabet.
    */
-  setKeyring(keys, activeKid) {
-    this.keys = keys;
-    if (activeKid !== void 0) {
-      this.activeKid = activeKid;
+  static fromBase64(base64) {
+    if (typeof base64 !== "string") {
+      throw new Error("[CKeyManager] Invalid base64 input: expected string");
     }
+    const cleaned = base64.replace(/\s+/g, "");
+    if (!cleaned) return new Uint8Array(0);
+    const normalized = cleaned.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(padded)) {
+      throw new Error("[CKeyManager] Invalid base64 string");
+    }
+    if (typeof Buffer !== "undefined") {
+      const buf = Buffer.from(padded, "base64");
+      const arrayBuf = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+      return new Uint8Array(arrayBuf);
+    }
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
   }
   /**
-   * Retrieves the currently configured keyring dictionary.
-   */
-  getKeyring() {
-    return this.keys;
-  }
-  /**
-   * Sets the active Key Identifier (kid) to use for outbound encryption.
+   * Deterministically resolves a salt from Uint8Array, ArrayBuffer, Base64/Base64URL string, or raw text string.
+   * Guarantees 100% identical salt byte resolution between Node.js and Browser environments.
    */
-  setActiveKid(kid) {
-    this.activeKid = kid;
+  static resolveSalt(salt) {
+    if (!salt) return CKeyManager.randomBytes(16);
+    if (ArrayBuffer.isView(salt)) {
+      return salt.byteLength > 0 ? new Uint8Array(salt.buffer.slice(salt.byteOffset, salt.byteOffset + salt.byteLength)) : CKeyManager.randomBytes(16);
+    }
+    if (salt instanceof ArrayBuffer) {
+      return salt.byteLength > 0 ? new Uint8Array(salt.slice(0)) : CKeyManager.randomBytes(16);
+    }
+    if (typeof salt === "string") {
+      const trimmed = salt.trim();
+      if (!trimmed) return CKeyManager.randomBytes(16);
+      if (trimmed.startsWith("base64:")) {
+        return CKeyManager.fromBase64(trimmed.slice(7));
+      }
+      if (trimmed.endsWith("=") && /^[A-Za-z0-9+/]+={1,2}$/.test(trimmed)) {
+        try {
+          const decoded = CKeyManager.fromBase64(trimmed);
+          if (decoded.byteLength > 0) return decoded;
+        } catch {
+        }
+      }
+      const encoded = textEncoder$1.encode(trimmed);
+      return encoded.byteLength > 0 ? encoded : CKeyManager.randomBytes(16);
+    }
+    return CKeyManager.randomBytes(16);
   }
+  // ── Symmetric Key Management ─────────────────────────────────────────────
   /**
-   * Retrieves the active Key Identifier (kid).
+   * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
+   *
+   * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
+   * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
+   * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
+   * Client-side malware/trojan protection is out of scope.
    */
-  getActiveKid() {
-    return this.activeKid;
+  static async generateAESKey(length = 256, algorithm = "AES-GCM", extractable = true) {
+    const subtle = getSubtleCrypto();
+    const usages = algorithm === "AES-KW" ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"];
+    return await subtle.generateKey(
+      { name: algorithm, length },
+      extractable,
+      usages
+    );
   }
   /**
-   * Pre-derives and caches the native CryptoKey for subsequent cryptographic operations.
-   * Subclasses should override this with a dedicated, non-side-effecting implementation.
+   * Exports an AES CryptoKey as a raw base64 string.
    */
-  async warmupKey(_options) {
+  static async exportAESKey(key) {
+    const subtle = getSubtleCrypto();
+    const raw = await subtle.exportKey("raw", key);
+    try {
+      return CKeyManager.toBase64(raw);
+    } finally {
+      new Uint8Array(raw).fill(0);
+    }
   }
   /**
-   * Resolves raw key from keyProvider callback or defaultKey.
+   * Imports an AES CryptoKey from a raw base64 string.
    */
-  async resolveRawKey(keyProvider) {
-    const target = keyProvider || (this.keys && this.activeKid ? this.keys[this.activeKid] : void 0) || this.defaultKey;
-    if (!target) {
-      throw new Error(
-        `[${this.constructor.name}] No encryption key or keyProvider was supplied. Key cannot be empty or undefined. A valid key must be supplied from your authentication or secret management system.`
-      );
+  static async importAESKey(base64, algorithm = "AES-GCM", extractable = false) {
+    const subtle = getSubtleCrypto();
+    const rawBytes = CKeyManager.fromBase64(base64);
+    if (rawBytes.length !== 16 && rawBytes.length !== 24 && rawBytes.length !== 32) {
+      rawBytes.fill(0);
+      throw new Error(`[CKeyManager] Invalid AES key length: expected 16, 24, or 32 bytes (128, 192, or 256 bits), got ${rawBytes.length} bytes.`);
     }
-    const rawKey = typeof target === "function" ? await target() : target;
-    if (!rawKey || typeof rawKey === "string" && rawKey.trim().length === 0 || typeof rawKey === "object" && "byteLength" in rawKey && rawKey.byteLength === 0) {
-      throw new Error(
-        `[${this.constructor.name}] No encryption key or keyProvider was supplied. Key provider resolved to empty or undefined key.`
+    const usages = algorithm === "AES-KW" ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"];
+    try {
+      return await subtle.importKey(
+        "raw",
+        rawBytes,
+        { name: algorithm },
+        extractable,
+        usages
       );
+    } finally {
+      rawBytes.fill(0);
     }
-    return rawKey;
   }
+  // ── Asymmetric Key Pair Management ───────────────────────────────────────
   /**
-   * Checks whether the given payload is an encrypted envelope.
+   * Generates an RSA-OAEP public/private key pair (2048 or 4096 bits).
    */
-  static isEncrypted(payload) {
-    if (!payload || typeof payload !== "object") return false;
-    return payload.__encrypted === true && typeof payload.ciphertext === "string" && typeof payload.iv === "string";
+  static async generateRSAKeyPair(bits = 4096, hash = "SHA-256", extractable = true) {
+    const subtle = getSubtleCrypto();
+    const pair = await subtle.generateKey(
+      {
+        name: "RSA-OAEP",
+        modulusLength: bits,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash
+      },
+      extractable,
+      ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+    );
+    return {
+      publicKey: pair.publicKey,
+      privateKey: pair.privateKey
+    };
   }
   /**
-   * Checks whether the given payload is an encrypted envelope.
+   * Generates an ECDH public/private key pair for elliptic curve Diffie-Hellman.
    */
-  isEncrypted(payload) {
-    return AEncryptionProvider.isEncrypted(payload);
+  static async generateECDHKeyPair(curve = "P-256", extractable = true) {
+    const subtle = getSubtleCrypto();
+    const pair = await subtle.generateKey(
+      {
+        name: "ECDH",
+        namedCurve: curve
+      },
+      extractable,
+      ["deriveKey", "deriveBits"]
+    );
+    return {
+      publicKey: pair.publicKey,
+      privateKey: pair.privateKey
+    };
   }
   /**
-   * Clears configured keys and cached cryptographic material from memory.
+   * Exports a public CryptoKey to a portable JsonWebKey (JWK).
    */
-  clearKeys() {
-    this.defaultKey = void 0;
-    this.keys = void 0;
-    this.activeKid = void 0;
-    this.allowedKids = void 0;
+  static async exportPublicKey(key) {
+    const subtle = getSubtleCrypto();
+    return await subtle.exportKey("jwk", key);
   }
   /**
-   * Alias for clearKeys() to conform with standard disposal patterns.
+   * Exports a private CryptoKey to a portable JsonWebKey (JWK).
    */
-  dispose() {
-    this.clearKeys();
+  static async exportPrivateKey(key) {
+    const subtle = getSubtleCrypto();
+    return await subtle.exportKey("jwk", key);
   }
   /**
-   * ECMAScript Explicit Resource Management protocol (using / await using declarations).
+   * Imports a public key from a JsonWebKey (JWK).
    */
-  [Symbol.dispose]() {
-    this.dispose();
-  }
-  async [Symbol.asyncDispose]() {
-    this.dispose();
+  static async importPublicKey(jwk, algorithm) {
+    const subtle = getSubtleCrypto();
+    let importAlgorithm = algorithm;
+    let usages;
+    const isEC = jwk.kty === "EC" || typeof algorithm === "object" && algorithm?.name === "ECDH" || algorithm === "ECDH";
+    if (isEC) {
+      usages = [];
+      if (!importAlgorithm || importAlgorithm === "ECDH") {
+        importAlgorithm = { name: "ECDH", namedCurve: jwk.crv || "P-256" };
+      }
+    } else {
+      usages = ["encrypt", "wrapKey"];
+      if (!importAlgorithm || importAlgorithm === "RSA-OAEP") {
+        if (jwk.kty === "RSA") {
+          const hash = jwk.alg === "RSA-OAEP-512" ? "SHA-512" : "SHA-256";
+          importAlgorithm = { name: "RSA-OAEP", hash };
+        } else {
+          throw new Error(`[CKeyManager] Unsupported JWK kty: ${jwk.kty}`);
+        }
+      }
+    }
+    return await subtle.importKey("jwk", jwk, importAlgorithm, true, usages);
   }
   /**
-   * Resolves effective Authenticated Additional Data (AAD) for the operation:
-   * 1. If options.bindRequestContextAad is explicitly false, returns options.aad directly without context binding.
-   * 2. When encrypting (isDecrypt=false): binds request context `req:${method}:${url}` only if options.bindRequestContextAad === true.
-   * 3. When decrypting (isDecrypt=true): derives request context `req:${method}:${url}` if url or method is provided.
-   * 4. If explicit options.aad is provided: combines with request context if bound, or returns options.aad directly.
-   * 5. Otherwise returns undefined.
+   * Imports a private key from a JsonWebKey (JWK).
    */
-  _resolveEffectiveAad(options, isDecrypt = false) {
-    if (!options) return void 0;
-    let rawAad = options.aad;
-    if (typeof rawAad === "function") {
-      rawAad = rawAad(void 0, "");
-    }
-    if (rawAad === void 0 && options.baseAad) {
-      rawAad = options.baseAad;
-    }
-    if (options.bindRequestContextAad === false) return rawAad;
-    const hasReqContext = Boolean(options.url || options.method);
-    if (rawAad) {
-      if (options.bindRequestContextAad === true && hasReqContext) {
-        const m = (options.method || "POST").toUpperCase();
-        const u = options.url || "";
-        const baseAad = typeof rawAad === "string" ? rawAad : rawAad instanceof Uint8Array || rawAad instanceof ArrayBuffer ? textDecoder.decode(rawAad) : String(rawAad);
-        if (baseAad.includes(`|req:${m}:${u}`)) {
-          return baseAad;
+  static async importPrivateKey(jwk, algorithm) {
+    const subtle = getSubtleCrypto();
+    let importAlgorithm = algorithm;
+    let usages;
+    const isEC = jwk.kty === "EC" || typeof algorithm === "object" && algorithm?.name === "ECDH" || algorithm === "ECDH";
+    if (isEC) {
+      usages = ["deriveKey", "deriveBits"];
+      if (!importAlgorithm || importAlgorithm === "ECDH") {
+        importAlgorithm = { name: "ECDH", namedCurve: jwk.crv || "P-256" };
+      }
+    } else {
+      usages = ["decrypt", "unwrapKey"];
+      if (!importAlgorithm || importAlgorithm === "RSA-OAEP") {
+        if (jwk.kty === "RSA") {
+          const hash = jwk.alg === "RSA-OAEP-512" ? "SHA-512" : "SHA-256";
+          importAlgorithm = { name: "RSA-OAEP", hash };
+        } else {
+          throw new Error(`[CKeyManager] Unsupported JWK kty: ${jwk.kty}`);
         }
-        return `${baseAad}|req:${m}:${u}`;
       }
-      return rawAad;
     }
-    const shouldBindReq = isDecrypt ? hasReqContext : options.bindRequestContextAad === true && hasReqContext;
-    if (shouldBindReq) {
-      const m = (options.method || "POST").toUpperCase();
-      const u = options.url || "";
-      return `req:${m}:${u}`;
-    }
-    return void 0;
+    return await subtle.importKey("jwk", jwk, importAlgorithm, true, usages);
   }
   /**
-   * Helper to deterministically bind record ID, contextual sibling fields (aadFields),
-   * dynamic AAD callbacks, and field name into the AAD to prevent ciphertext swapping
-   * between fields, records, or parent entities.
+   * Imports a public key from a PEM (SPKI) or base64 SPKI string.
    */
-  _bindFieldAad(data, field, options) {
-    let baseAad = "";
-    if (options?.baseAad) {
-      baseAad = options.baseAad;
-    }
-    if (options?.aad) {
-      if (typeof options.aad === "function") {
-        const dynamicRes = options.aad(data, field);
-        if (typeof dynamicRes === "string") {
-          baseAad = baseAad ? `${baseAad}|${dynamicRes}` : dynamicRes;
-        } else if (dynamicRes instanceof Uint8Array || dynamicRes instanceof ArrayBuffer) {
-          const decoded = textDecoder.decode(dynamicRes);
-          baseAad = baseAad ? `${baseAad}|${decoded}` : decoded;
-        } else if (dynamicRes !== void 0 && dynamicRes !== null) {
-          const str = String(dynamicRes);
-          baseAad = baseAad ? `${baseAad}|${str}` : str;
-        }
-      } else if (typeof options.aad === "string") {
-        baseAad = baseAad ? `${baseAad}|${options.aad}` : options.aad;
-      } else if (options.aad instanceof Uint8Array || options.aad instanceof ArrayBuffer) {
-        const decoded = textDecoder.decode(options.aad);
-        baseAad = baseAad ? `${baseAad}|${decoded}` : decoded;
-      } else {
-        const str = String(options.aad);
-        baseAad = baseAad ? `${baseAad}|${str}` : str;
-      }
+  static async importPublicKeyFromPEM(pem, algorithm = "RSA-OAEP", curve = "P-256", hash = "SHA-256") {
+    const subtle = getSubtleCrypto();
+    const cleaned = pem.replace(/-----BEGIN[ A-Z0-9_-]+-----/g, "").replace(/-----END[ A-Z0-9_-]+-----/g, "").replace(/\s+/g, "");
+    const spkiBytes = CKeyManager.fromBase64(cleaned);
+    let importAlgorithm;
+    let usages;
+    if (algorithm === "ECDH") {
+      importAlgorithm = { name: "ECDH", namedCurve: curve };
+      usages = [];
+    } else if (algorithm === "ECDSA") {
+      importAlgorithm = { name: "ECDSA", namedCurve: curve };
+      usages = ["verify"];
+    } else {
+      importAlgorithm = { name: "RSA-OAEP", hash };
+      usages = ["encrypt", "wrapKey"];
     }
-    const recordId = data && typeof data === "object" && (data.id !== void 0 || data._id !== void 0) ? String(data.id ?? data._id) : "";
-    const recordPart = recordId ? `|record:${recordId}` : "";
-    let contextPart = "";
-    if (options?.aadFields && options.aadFields.length > 0 && data && typeof data === "object") {
-      const sortedFields = [...options.aadFields].sort();
-      const parts = [];
-      for (const f of sortedFields) {
-        const val = data[f];
-        let serializedVal = "";
-        if (val === null) {
-          serializedVal = "null";
-        } else if (val !== void 0) {
-          serializedVal = typeof val === "object" ? JSON.stringify(val) : String(val);
-        }
-        parts.push(`${f}=${serializedVal}`);
-      }
-      contextPart = `|ctx:${parts.join(",")}`;
+    try {
+      return await subtle.importKey("spki", spkiBytes, importAlgorithm, true, usages);
+    } finally {
+      spkiBytes.fill(0);
     }
-    const reqPart = options?.bindRequestContextAad === true && (options?.url || options?.method) ? `|req:${(options.method || "POST").toUpperCase()}:${options.url || ""}` : "";
-    return {
-      ...options,
-      bindRequestContextAad: false,
-      aad: `aad:${baseAad}${recordPart}${contextPart}${reqPart}|field:${field}`
-    };
   }
   /**
-   * Validates envelope metadata against algorithm whitelists and key identifiers (kid).
-   * In strict mode, allowedAlgorithms defaults to ['AES-GCM'].
+   * Imports an ECDSA public key from PEM (SPKI) or base64 SPKI string for signature verification.
    */
-  _validateEnvelopeMetadata(payload, options) {
-    if (!payload || typeof payload !== "object") return void 0;
-    const allowedAlgorithms = options?.allowedAlgorithms ?? (options?.strict ? ["AES-GCM"] : void 0);
-    if (allowedAlgorithms && allowedAlgorithms.length > 0) {
-      const alg = payload.alg;
-      if (!alg || !allowedAlgorithms.includes(alg)) {
-        return new Error(`[AEncryptionProvider] Algorithm mismatch: algorithm '${alg || "unknown"}' is not in allowedAlgorithms.`);
-      }
-    }
-    const effectiveKeys = options?.keys || this.keys;
-    const effectiveAllowedKids = options?.allowedKids || this.allowedKids;
-    const allowedKids = effectiveAllowedKids ?? (effectiveKeys ? Object.keys(effectiveKeys) : void 0);
-    if (allowedKids && allowedKids.length > 0) {
-      if (payload.kid && !allowedKids.includes(payload.kid)) {
-        return new Error(`[AEncryptionProvider] Unauthorized key: kid '${payload.kid}' is not in allowedKids.`);
-      }
-    }
-    return void 0;
+  static async importECDSAPublicKeyFromPEM(pem, curve = "P-256") {
+    return CKeyManager.importPublicKeyFromPEM(pem, "ECDSA", curve);
   }
   /**
-   * Normalizes encryption options with active keyring parameters:
-   * If `keys` and `activeKid` are configured, selects `key = keys[activeKid]` and sets `kid = activeKid`.
+   * Imports a private key from a PEM (PKCS#8) or base64 PKCS#8 string.
    */
-  _resolveOutboundKeyringOptions(options) {
-    const effectiveKeys = options?.keys || this.keys;
-    const effectiveActiveKid = options?.activeKid || (options?.kid ? options.kid : this.activeKid);
-    let effectiveKey = options?.key;
-    let effectiveKid = options?.kid || effectiveActiveKid;
-    if (effectiveKeys && effectiveActiveKid) {
-      if (effectiveKeys[effectiveActiveKid]) {
-        effectiveKey = options?.key || effectiveKeys[effectiveActiveKid];
-        effectiveKid = effectiveActiveKid;
-      } else if (!options?.key) {
-        throw new Error(`[${this.constructor.name}] Active kid '${effectiveActiveKid}' not found in keyring keys.`);
-      }
-    } else if (effectiveKeys && !effectiveKey) {
-      const kids = Object.keys(effectiveKeys);
-      if (kids.length > 0) {
-        effectiveKid = kids[0];
-        effectiveKey = effectiveKeys[kids[0]];
-      }
+  static async importPrivateKeyFromPEM(pem, algorithm = "RSA-OAEP", curve = "P-256", hash = "SHA-256") {
+    if (/BEGIN\s+(RSA|EC)\s+PRIVATE\s+KEY/i.test(pem)) {
+      throw new Error(
+        `[CKeyManager] Failed to import private key. The provided PEM appears to be in PKCS#1 or SEC1 format. Web Crypto requires PKCS#8 format. Convert your key using: openssl pkcs8 -topk8 -nocrypt -in private.pem -out private_pkcs8.pem.`
+      );
     }
-    if (effectiveKeys || effectiveActiveKid || effectiveKey !== options?.key || effectiveKid !== options?.kid) {
-      return {
-        ...options,
-        ...effectiveKeys ? { keys: effectiveKeys } : {},
-        ...effectiveActiveKid ? { activeKid: effectiveActiveKid } : {},
-        ...effectiveKey !== void 0 ? { key: effectiveKey } : {},
-        ...effectiveKid !== void 0 ? { kid: effectiveKid } : {}
-      };
+    const subtle = getSubtleCrypto();
+    const cleaned = pem.replace(/-----BEGIN[ A-Z0-9_-]+-----/g, "").replace(/-----END[ A-Z0-9_-]+-----/g, "").replace(/\s+/g, "");
+    const pkcs8Bytes = CKeyManager.fromBase64(cleaned);
+    let importAlgorithm;
+    let usages;
+    if (algorithm === "ECDH") {
+      importAlgorithm = { name: "ECDH", namedCurve: curve };
+      usages = ["deriveKey", "deriveBits"];
+    } else if (algorithm === "ECDSA") {
+      importAlgorithm = { name: "ECDSA", namedCurve: curve };
+      usages = ["sign"];
+    } else {
+      importAlgorithm = { name: "RSA-OAEP", hash };
+      usages = ["decrypt", "unwrapKey"];
+    }
+    try {
+      return await subtle.importKey("pkcs8", pkcs8Bytes, importAlgorithm, true, usages);
+    } finally {
+      pkcs8Bytes.fill(0);
     }
-    return options || {};
   }
   /**
-   * Resolves the appropriate decryption key for a specific payload envelope based on its `kid`
-   * and the configured keyring (`keys`, `activeKid`, or fallback `key`).
+   * Imports an ECDSA private key from PEM (PKCS#8) or base64 PKCS#8 string for signing.
    */
-  _resolveDecryptionKeyForEnvelope(payload, options) {
-    const effectiveKeys = options?.keys || this.keys;
-    const effectiveActiveKid = options?.activeKid || this.activeKid;
-    if (payload && typeof payload === "object" && payload.kid && effectiveKeys) {
-      if (effectiveKeys[payload.kid]) {
-        return effectiveKeys[payload.kid];
-      }
-    }
-    if (effectiveKeys && effectiveActiveKid && effectiveKeys[effectiveActiveKid]) {
-      return effectiveKeys[effectiveActiveKid];
-    }
-    return options?.key || this.defaultKey;
+  static async importECDSAPrivateKeyFromPEM(pem, curve = "P-256") {
+    return CKeyManager.importPrivateKeyFromPEM(pem, "ECDSA", curve);
   }
   /**
-   * Handles a per-field or per-payload decryption error according to configured options:
-   * - Invokes onDecryptError callback if provided
-   * - Attaches error metadata (__decryptErrors) to the record object
-   * - Returns fallback cell placeholder ('[⚠ Decryption Error]') or rethrows
+   * Exports a public CryptoKey to a standard PEM (SPKI) string.
    */
-  _handleDecryptError(err, record, field, value, index, options) {
-    if (record && typeof record === "object" && record !== value) {
-      record.__decryptErrors = {
-        ...record.__decryptErrors || {},
-        [field || "__payload"]: err
-      };
-    }
-    if (options?.onDecryptError === false || options?.onDecryptError === void 0) {
-      throw err;
-    }
-    if (typeof options.onDecryptError === "function") {
-      return options.onDecryptError({
-        record,
-        field,
-        value,
-        error: err,
-        index
-      });
-    }
-    if (typeof options.onDecryptError === "string") {
-      return options.onDecryptError;
-    }
-    if (options.onDecryptError === true) {
-      return "[\u26A0 Decryption Error]";
+  static async exportPublicKeyToPEM(key) {
+    const subtle = getSubtleCrypto();
+    const spki = await subtle.exportKey("spki", key);
+    let b64;
+    try {
+      b64 = CKeyManager.toBase64(spki);
+    } finally {
+      new Uint8Array(spki).fill(0);
     }
-    throw err;
+    const lines = b64.match(/.{1,64}/g) || [b64];
+    return `-----BEGIN PUBLIC KEY-----
+${lines.join("\n")}
+-----END PUBLIC KEY-----`;
   }
   /**
-   * Top-level polymorphic encryption method.
-   * Automatically performs value-level encryption:
-   * - If data is an array of objects: recursively encrypts each row.
-   * - If data is an object: encrypts specified fields (or all values if valueEncryption is true),
-   *   preserving JSON object keys so backend APIs and ORMs can parse keys and perform upserts.
-   * - If data is a primitive or whole-payload envelope: encrypts as a single value.
+   * Exports a private CryptoKey to a standard PEM (PKCS#8) string.
    */
-  async encrypt(data, options) {
-    if (data === void 0 || data === null) return data;
-    if (this.isEncrypted(data)) return data;
-    options = this._resolveOutboundKeyringOptions(options);
-    if (options?.valueEncryption === false && (!options.fields || options.fields.length === 0)) {
-      return this.encryptValue(data, options);
-    }
-    if (Array.isArray(data)) {
-      if (data.length === 0) return data;
-      if (options?.fields && options.fields.length > 0) {
-        const fields = options.fields;
-        let hasUnencrypted = false;
-        for (let i = 0; i < data.length; i++) {
-          const item = data[i];
-          if (item && typeof item === "object") {
-            for (let f = 0; f < fields.length; f++) {
-              const val = item[fields[f]];
-              if (val !== void 0 && val !== null && !this.isEncrypted(val)) {
-                hasUnencrypted = true;
-                break;
-              }
-            }
-            if (hasUnencrypted) break;
-          }
-        }
-        if (!hasUnencrypted) {
-          return data;
-        }
-        await this.warmupKey(options);
-        const itemOptions = { ...options, _warmed: true };
-        return Promise.all(data.map((item) => this.encrypt(item, itemOptions)));
-      }
-      if (options?.valueEncryption === true) {
-        await this.warmupKey(options);
-        const itemOptions = { ...options, _warmed: true };
-        return Promise.all(data.map((item) => this.encrypt(item, itemOptions)));
-      }
-      return this.encryptValue(data, options);
+  static async exportPrivateKeyToPEM(key) {
+    const subtle = getSubtleCrypto();
+    const pkcs8 = await subtle.exportKey("pkcs8", key);
+    let b64;
+    try {
+      b64 = CKeyManager.toBase64(pkcs8);
+    } finally {
+      new Uint8Array(pkcs8).fill(0);
     }
-    if (typeof data === "object" && !ArrayBuffer.isView(data) && !(data instanceof ArrayBuffer)) {
-      if (options?.fields && options.fields.length > 0) {
-        const fieldsToEncrypt = options.fields.filter(
-          (field) => Object.prototype.hasOwnProperty.call(data, field) && data[field] !== void 0 && data[field] !== null && !this.isEncrypted(data[field])
+    const lines = b64.match(/.{1,64}/g) || [b64];
+    return `-----BEGIN PRIVATE KEY-----
+${lines.join("\n")}
+-----END PRIVATE KEY-----`;
+  }
+  // ── Key Wrapping & Unwrapping ────────────────────────────────────────────
+  /**
+   * Wraps a target CryptoKey (e.g. an Account Symmetric Key) using a wrapping key
+   * (AES-KW or RSA-OAEP).
+   */
+  static async wrapKey(keyToWrap, wrappingKey, format = "raw") {
+    const subtle = getSubtleCrypto();
+    let wrapAlgorithm;
+    if (wrappingKey.algorithm.name === "RSA-OAEP") {
+      wrapAlgorithm = { name: "RSA-OAEP" };
+    } else if (wrappingKey.algorithm.name === "AES-KW") {
+      wrapAlgorithm = "AES-KW";
+    } else {
+      wrapAlgorithm = "AES-KW";
+    }
+    const wrappedBuffer = await subtle.wrapKey(format, keyToWrap, wrappingKey, wrapAlgorithm);
+    return CKeyManager.toBase64(wrappedBuffer);
+  }
+  /**
+   * Unwraps a base64-encoded wrapped key using an unwrapping key (AES-KW or RSA-OAEP).
+   */
+  static async unwrapKey(wrappedBase64, unwrappingKey, unwrappedKeyAlgorithm = { name: "AES-GCM", length: 256 }, extractable = true, keyUsages = ["encrypt", "decrypt"], format = "raw") {
+    const subtle = getSubtleCrypto();
+    const wrappedBytes = CKeyManager.fromBase64(wrappedBase64);
+    let unwrapAlgorithm;
+    if (unwrappingKey.algorithm.name === "RSA-OAEP") {
+      unwrapAlgorithm = { name: "RSA-OAEP" };
+    } else {
+      unwrapAlgorithm = "AES-KW";
+    }
+    try {
+      return await subtle.unwrapKey(
+        format,
+        wrappedBytes,
+        unwrappingKey,
+        unwrapAlgorithm,
+        unwrappedKeyAlgorithm,
+        extractable,
+        keyUsages
+      );
+    } finally {
+      wrappedBytes.fill(0);
+    }
+  }
+  /**
+   * Generates a high-entropy symmetric AES-GCM Account Data Encryption Key (ADEK).
+   * Designed for multi-user table and field-level encryption.
+   */
+  static async generateAccountDataKey(length = 256, extractable = false) {
+    const subtle = getSubtleCrypto();
+    return await subtle.generateKey(
+      { name: "AES-GCM", length },
+      extractable,
+      ["encrypt", "decrypt"]
+    );
+  }
+  /**
+   * Wraps an Account Data Encryption Key (ADEK) for a specific user using the user's public key (RSA-OAEP).
+   * Returns a Base64-encoded wrapped key string suitable for storage in role-map / access tables.
+   */
+  static async wrapAccountKeyForUser(adek, userPublicKey) {
+    const subtle = getSubtleCrypto();
+    if (userPublicKey.algorithm.name === "RSA-OAEP") {
+      const rawKey = await subtle.exportKey("raw", adek);
+      try {
+        const wrappedBuffer = await subtle.encrypt(
+          { name: "RSA-OAEP" },
+          userPublicKey,
+          rawKey
         );
-        if (fieldsToEncrypt.length === 0) {
-          return data;
-        }
-        if (!options?._warmed) {
-          await this.warmupKey(options);
-        }
-        const result = { ...data };
-        const entries = await Promise.all(
-          fieldsToEncrypt.map(async (field) => {
-            const fieldOptions = this._bindFieldAad(data, field, options);
-            return [field, await this.encryptValue(result[field], fieldOptions)];
-          })
+        return CKeyManager.toBase64(wrappedBuffer);
+      } finally {
+        new Uint8Array(rawKey).fill(0);
+      }
+    }
+    throw new Error(
+      `[CKeyManager] Unsupported user key algorithm for wrapAccountKeyForUser: '${userPublicKey.algorithm.name}'. Expected 'RSA-OAEP'.`
+    );
+  }
+  /**
+   * Unwraps a Base64-encoded Account Data Encryption Key (ADEK) using the user's private key (RSA-OAEP).
+   * Returns the restored AES-GCM CryptoKey ready for use in CWebCryptoEncryptionProvider.
+   */
+  static async unwrapAccountKeyForUser(wrappedKeyBase64, userPrivateKey, unwrappedKeyAlgorithm = { name: "AES-GCM", length: 256 }, extractable = false) {
+    const subtle = getSubtleCrypto();
+    if (userPrivateKey.algorithm.name === "RSA-OAEP") {
+      const wrappedBytes = CKeyManager.fromBase64(wrappedKeyBase64);
+      let unwrappedRawKey;
+      try {
+        unwrappedRawKey = await subtle.decrypt(
+          { name: "RSA-OAEP" },
+          userPrivateKey,
+          wrappedBytes
         );
-        for (const [field, encryptedVal] of entries) {
-          safeSetProperty(result, field, encryptedVal);
-        }
-        return result;
+      } finally {
+        wrappedBytes.fill(0);
       }
-      if (options?.valueEncryption === true) {
-        const result = { ...data };
-        const keysToEncrypt = Object.keys(result).filter(
-          (key) => result[key] !== void 0 && result[key] !== null && !this.isEncrypted(result[key])
+      try {
+        return await subtle.importKey(
+          "raw",
+          unwrappedRawKey,
+          unwrappedKeyAlgorithm,
+          extractable,
+          ["encrypt", "decrypt"]
         );
-        if (keysToEncrypt.length === 0) {
-          return result;
-        }
-        if (!options?._warmed) {
-          await this.warmupKey(options);
-        }
-        const entries = await Promise.all(
-          keysToEncrypt.map(async (key) => {
-            const fieldOptions = this._bindFieldAad(data, key, options);
-            return [key, await this.encryptValue(result[key], fieldOptions)];
-          })
+      } finally {
+        new Uint8Array(unwrappedRawKey).fill(0);
+      }
+    }
+    throw new Error(
+      `[CKeyManager] Unsupported user key algorithm for unwrapAccountKeyForUser: '${userPrivateKey.algorithm.name}'. Expected 'RSA-OAEP'.`
+    );
+  }
+  /**
+   * Wraps an HMAC blind indexing key for a specific recipient user using their RSA-OAEP public key.
+   * Returns a Base64-encoded wrapped key string suitable for storage in role-map / access tables.
+   */
+  static async wrapHMACKeyForUser(hmacKey, userPublicKey) {
+    const subtle = getSubtleCrypto();
+    if (userPublicKey.algorithm.name === "RSA-OAEP") {
+      const rawKey = await subtle.exportKey("raw", hmacKey);
+      try {
+        const wrappedBuffer = await subtle.encrypt(
+          { name: "RSA-OAEP" },
+          userPublicKey,
+          rawKey
         );
-        for (const [key, encryptedVal] of entries) {
-          safeSetProperty(result, key, encryptedVal);
-        }
-        return result;
+        return CKeyManager.toBase64(wrappedBuffer);
+      } finally {
+        new Uint8Array(rawKey).fill(0);
       }
     }
-    return this.encryptValue(data, options);
+    throw new Error(
+      `[CKeyManager] Unsupported user key algorithm for wrapHMACKeyForUser: '${userPublicKey.algorithm.name}'. Expected 'RSA-OAEP'.`
+    );
   }
   /**
-   * Top-level polymorphic decryption method.
-   * Automatically performs value-level decryption:
-   * - If payload is an encrypted envelope: validates metadata and decrypts directly via decryptValue.
-   * - If payload is an array of objects: decrypts each row (batched with local memoization).
-   * - If payload is an object: decrypts any encrypted value cells across fields.
-   * In strict mode:
-   * - Unencrypted plaintext in configured `fields` triggers a decryption error.
-   * - Envelopes are validated against `allowedAlgorithms` and `allowedKids`.
-   * - Errors are routed through `onDecryptError` or populated into `__decryptErrors`.
+   * Unwraps a Base64-encoded HMAC key using a recipient's RSA-OAEP private key.
+   * Restores the CryptoKey configured for HMAC signing and verification in search indexing.
    */
-  async decrypt(payload, options) {
-    if (payload === void 0 || payload === null) return payload;
-    if (this.isEncrypted(payload)) {
-      const envelopeKey = this._resolveDecryptionKeyForEnvelope(payload, options);
-      const envelopeOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
-      const metaErr = this._validateEnvelopeMetadata(payload, envelopeOptions);
-      if (metaErr) {
-        return this._handleDecryptError(metaErr, payload, "", payload, void 0, envelopeOptions);
+  static async unwrapHMACKeyForUser(wrappedKeyBase64, userPrivateKey, hash = "SHA-256", extractable = false) {
+    const subtle = getSubtleCrypto();
+    if (userPrivateKey.algorithm.name === "RSA-OAEP") {
+      const wrappedBytes = CKeyManager.fromBase64(wrappedKeyBase64);
+      let unwrappedRawKey;
+      try {
+        unwrappedRawKey = await subtle.decrypt(
+          { name: "RSA-OAEP" },
+          userPrivateKey,
+          wrappedBytes
+        );
+      } finally {
+        wrappedBytes.fill(0);
       }
       try {
-        return await this.decryptValue(payload, envelopeOptions);
-      } catch (err) {
-        return this._handleDecryptError(err, payload, "", payload, void 0, envelopeOptions);
+        return await subtle.importKey(
+          "raw",
+          unwrappedRawKey,
+          { name: "HMAC", hash: { name: hash } },
+          extractable,
+          ["sign", "verify"]
+        );
+      } finally {
+        new Uint8Array(unwrappedRawKey).fill(0);
       }
     }
-    if (Array.isArray(payload)) {
-      if (payload.length === 0) return payload;
-      const localMemo = /* @__PURE__ */ new Map();
-      const decryptRow = async (item, rowIndex) => {
-        if (!item) return item;
-        if (this.isEncrypted(item)) {
-          const envelopeKey = this._resolveDecryptionKeyForEnvelope(item, options);
-          const envelopeOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
-          const metaErr = this._validateEnvelopeMetadata(item, envelopeOptions);
-          if (metaErr) {
-            return this._handleDecryptError(metaErr, item, "", item, rowIndex, envelopeOptions);
-          }
-          const ct = item.ciphertext;
-          const iv = item.iv || "";
-          const aadPart = options?.aad ? typeof options.aad === "string" ? options.aad : "" : "";
-          const memoKey = `${ct}:${iv}:${aadPart}:${item.kid || ""}`;
-          try {
-            if (!localMemo.has(memoKey)) {
-              localMemo.set(memoKey, this.decryptValue(item, envelopeOptions));
-            }
-            return await localMemo.get(memoKey);
-          } catch (err) {
-            return this._handleDecryptError(err, item, "", item, rowIndex, envelopeOptions);
-          }
-        }
-        if (typeof item === "object" && !ArrayBuffer.isView(item) && !(item instanceof ArrayBuffer)) {
-          const targetKeys = options?.fields && options.fields.length > 0 ? options.fields.filter((f) => Object.prototype.hasOwnProperty.call(item, f)) : Object.keys(item);
-          const keysToDecrypt = targetKeys.filter((key) => this.isEncrypted(item[key]));
-          const strictViolationKeys = options?.strict === true && options?.fields && options.fields.length > 0 ? targetKeys.filter((key) => item[key] !== void 0 && item[key] !== null && !this.isEncrypted(item[key])) : [];
-          if (keysToDecrypt.length === 0 && strictViolationKeys.length === 0) {
-            return item;
-          }
-          const proto = Object.getPrototypeOf(item);
-          const result = proto && proto !== Object.prototype ? Object.assign(Object.create(proto), item) : { ...item };
-          for (const key of strictViolationKeys) {
-            const err = new Error(`[AEncryptionProvider] Strict decryption violation: field '${key}' contains unencrypted plaintext.`);
-            const fallbackVal = this._handleDecryptError(err, result, key, item[key], rowIndex, options);
-            safeSetProperty(result, key, fallbackVal);
-          }
-          await Promise.all(
-            keysToDecrypt.map(async (key) => {
-              const env = item[key];
-              const envelopeKey = this._resolveDecryptionKeyForEnvelope(env, options);
-              const baseOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
-              const boundOptions = this._bindFieldAad(item, key, baseOptions);
-              const hasBoundAad = boundOptions.aad !== baseOptions?.aad;
-              const metaErr = this._validateEnvelopeMetadata(env, boundOptions);
-              if (metaErr) {
-                const fallbackVal = this._handleDecryptError(metaErr, result, key, env, rowIndex, boundOptions);
-                safeSetProperty(result, key, fallbackVal);
-                return;
-              }
-              const ct = env.ciphertext;
-              const iv = env.iv || "";
-              const aadPart = boundOptions.aad ? typeof boundOptions.aad === "string" ? boundOptions.aad : "" : "";
-              const memoKey = `${ct}:${iv}:${aadPart}:${env.kid || ""}`;
-              try {
-                if (!localMemo.has(memoKey)) {
-                  const decryptPromise = (async () => {
-                    try {
-                      return await this.decryptValue(env, boundOptions);
-                    } catch (err) {
-                      const canFallback = hasBoundAad && (!options?.aadFields || options.aadFields.length === 0) && typeof options?.aad !== "function";
-                      if (canFallback && isAuthOrDecryptionError(err)) {
-                        return await this.decryptValue(env, baseOptions);
-                      }
-                      throw err;
-                    }
-                  })();
-                  localMemo.set(memoKey, decryptPromise);
-                }
-                const decryptedVal = await localMemo.get(memoKey);
-                safeSetProperty(result, key, decryptedVal);
-              } catch (err) {
-                const fallbackVal = this._handleDecryptError(err, result, key, env, rowIndex, boundOptions);
-                safeSetProperty(result, key, fallbackVal);
-              }
-            })
-          );
-          return result;
-        }
-        return item;
-      };
-      if (payload.length <= 100) {
-        return Promise.all(payload.map((item, index) => decryptRow(item, index)));
-      }
-      const batchSize = 1e3;
-      const results = new Array(payload.length);
-      for (let i = 0; i < payload.length; i += batchSize) {
-        const end = Math.min(i + batchSize, payload.length);
-        const chunk = payload.slice(i, end);
-        const chunkRes = await Promise.all(chunk.map((item, localIdx) => decryptRow(item, i + localIdx)));
-        for (let j = 0; j < chunkRes.length; j++) {
-          results[i + j] = chunkRes[j];
-        }
-        if (end < payload.length && (i > 0 && i % 5e3 === 0)) {
-          await new Promise((r) => setTimeout(r, 0));
-        }
-      }
-      return results;
-    }
-    if (typeof payload === "object" && !ArrayBuffer.isView(payload) && !(payload instanceof ArrayBuffer)) {
-      const targetKeys = options?.fields && options.fields.length > 0 ? options.fields.filter((f) => Object.prototype.hasOwnProperty.call(payload, f)) : Object.keys(payload);
-      const keysToDecrypt = targetKeys.filter((key) => this.isEncrypted(payload[key]));
-      const strictViolationKeys = options?.strict === true && options?.fields && options.fields.length > 0 ? targetKeys.filter((key) => payload[key] !== void 0 && payload[key] !== null && !this.isEncrypted(payload[key])) : [];
-      if (keysToDecrypt.length === 0 && strictViolationKeys.length === 0) {
-        return payload;
-      }
-      const proto = Object.getPrototypeOf(payload);
-      const result = proto && proto !== Object.prototype ? Object.assign(Object.create(proto), payload) : { ...payload };
-      for (const key of strictViolationKeys) {
-        const err = new Error(`[AEncryptionProvider] Strict decryption violation: field '${key}' contains unencrypted plaintext.`);
-        const fallbackVal = this._handleDecryptError(err, result, key, payload[key], void 0, options);
-        safeSetProperty(result, key, fallbackVal);
-      }
-      await Promise.all(
-        keysToDecrypt.map(async (key) => {
-          const env = payload[key];
-          const envelopeKey = this._resolveDecryptionKeyForEnvelope(env, options);
-          const baseOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
-          const boundOptions = this._bindFieldAad(payload, key, baseOptions);
-          const hasBoundAad = boundOptions.aad !== baseOptions?.aad;
-          const metaErr = this._validateEnvelopeMetadata(env, boundOptions);
-          if (metaErr) {
-            const fallbackVal = this._handleDecryptError(metaErr, result, key, env, void 0, boundOptions);
-            safeSetProperty(result, key, fallbackVal);
-            return;
-          }
-          try {
-            let decryptedVal;
-            try {
-              decryptedVal = await this.decryptValue(env, boundOptions);
-            } catch (err) {
-              const canFallback = hasBoundAad && (!options?.aadFields || options.aadFields.length === 0) && typeof options?.aad !== "function";
-              if (canFallback && isAuthOrDecryptionError(err)) {
-                decryptedVal = await this.decryptValue(env, baseOptions);
-              } else {
-                throw err;
-              }
-            }
-            safeSetProperty(result, key, decryptedVal);
-          } catch (err) {
-            const fallbackVal = this._handleDecryptError(err, result, key, env, void 0, boundOptions);
-            safeSetProperty(result, key, fallbackVal);
-          }
-        })
-      );
-      return result;
-    }
-    return payload;
-  }
-}
-
-class CKeyManager {
-  // ── Binary & Encoding Utilities ──────────────────────────────────────────
-  /**
-   * Generates a cryptographically secure random byte buffer of the specified length.
-   */
-  static randomBytes(length) {
-    const bytes = new Uint8Array(length);
-    return getRandomValues(bytes);
-  }
-  /**
-   * Converts an ArrayBuffer or Uint8Array into a Base64-encoded string.
-   */
-  static toBase64(buffer) {
-    return toBase64(buffer);
+    throw new Error(
+      `[CKeyManager] Unsupported user key algorithm for unwrapHMACKeyForUser: '${userPrivateKey.algorithm.name}'. Expected 'RSA-OAEP'.`
+    );
   }
   /**
-   * Converts a Base64 or Base64URL-encoded string back into a Uint8Array.
-   * Normalizes URL-safe characters and padding, strictly validating against the Base64 alphabet.
+   * Atomically re-wraps an Account Data Encryption Key (ADEK) for a new recipient
+   * without exposing the raw extractable symmetric key to caller application code.
+   *
+   * @param wrappedKeyBase64 - The existing ADEK envelope wrapped with current user's public key
+   * @param myPrivateKey - Current user's RSA-OAEP private key
+   * @param recipientPublicKey - New recipient's RSA-OAEP public key
+   * @returns Base64-encoded wrapped key envelope for the recipient
    */
-  static fromBase64(base64) {
-    if (typeof base64 !== "string") {
-      throw new Error("[CKeyManager] Invalid base64 input: expected string");
-    }
-    const cleaned = base64.replace(/\s+/g, "");
-    if (!cleaned) return new Uint8Array(0);
-    const normalized = cleaned.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
-    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(padded)) {
-      throw new Error("[CKeyManager] Invalid base64 string");
+  static async rewrapAccountKeyForUser(wrappedKeyBase64, myPrivateKey, recipientPublicKey) {
+    const subtle = getSubtleCrypto();
+    if (!myPrivateKey || !myPrivateKey.algorithm || myPrivateKey.algorithm.name !== "RSA-OAEP" || !recipientPublicKey || !recipientPublicKey.algorithm || recipientPublicKey.algorithm.name !== "RSA-OAEP") {
+      throw new Error(`[CKeyManager] rewrapAccountKeyForUser requires RSA-OAEP keys.`);
     }
-    if (typeof Buffer !== "undefined") {
-      const buf = Buffer.from(padded, "base64");
-      const arrayBuf = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
-      return new Uint8Array(arrayBuf);
+    if (myPrivateKey.type === "public" || recipientPublicKey.type === "private") {
+      throw new Error(
+        `[CKeyManager] rewrapAccountKeyForUser requires an RSA-OAEP private key for decryption and an RSA-OAEP public key for encryption.`
+      );
     }
-    const binary = atob(padded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i);
+    const wrappedBytes = CKeyManager.fromBase64(wrappedKeyBase64);
+    let rawKeyBuffer;
+    try {
+      rawKeyBuffer = await subtle.decrypt(
+        { name: "RSA-OAEP" },
+        myPrivateKey,
+        wrappedBytes
+      );
+      const rewrappedBuffer = await subtle.encrypt(
+        { name: "RSA-OAEP" },
+        recipientPublicKey,
+        rawKeyBuffer
+      );
+      return CKeyManager.toBase64(rewrappedBuffer);
+    } finally {
+      wrappedBytes.fill(0);
+      if (rawKeyBuffer) {
+        new Uint8Array(rawKeyBuffer).fill(0);
+      }
     }
-    return bytes;
   }
+  // ── Key Derivation Functions (PBKDF2 & HKDF) ──────────────────────────────
   /**
-   * Deterministically resolves a salt from Uint8Array, ArrayBuffer, Base64/Base64URL string, or raw text string.
-   * Guarantees 100% identical salt byte resolution between Node.js and Browser environments.
+   * Derives a symmetric AES-GCM CryptoKey from a passphrase using PBKDF2 or HKDF.
+   * Returns the derived CryptoKey and the base64-encoded salt.
    */
-  static resolveSalt(salt) {
-    if (!salt) return CKeyManager.randomBytes(16);
-    if (ArrayBuffer.isView(salt)) {
-      return salt.byteLength > 0 ? new Uint8Array(salt.buffer.slice(salt.byteOffset, salt.byteOffset + salt.byteLength)) : CKeyManager.randomBytes(16);
-    }
-    if (salt instanceof ArrayBuffer) {
-      return salt.byteLength > 0 ? new Uint8Array(salt.slice(0)) : CKeyManager.randomBytes(16);
+  static async deriveKey(passphrase, options) {
+    if (!passphrase || typeof passphrase === "string" && passphrase.trim().length === 0 || typeof passphrase === "object" && "byteLength" in passphrase && passphrase.byteLength === 0) {
+      throw new Error("[CKeyManager] Passphrase cannot be empty or undefined for key derivation.");
     }
-    if (typeof salt === "string") {
-      const trimmed = salt.trim();
-      if (!trimmed) return CKeyManager.randomBytes(16);
-      if (trimmed.startsWith("base64:")) {
-        return CKeyManager.fromBase64(trimmed.slice(7));
+    const subtle = getSubtleCrypto();
+    const saltBytes = CKeyManager.resolveSalt(options.salt);
+    const keyLength = options.keyLength || 256;
+    const hash = options.hash || "SHA-256";
+    const extractable = options.extractable === true;
+    const rawKeyBytes = typeof passphrase === "string" ? textEncoder$1.encode(passphrase) : passphrase instanceof Uint8Array ? passphrase : new Uint8Array(passphrase);
+    try {
+      if (options.kdf === "pbkdf2") {
+        const baseKey = await subtle.importKey(
+          "raw",
+          rawKeyBytes,
+          "PBKDF2",
+          false,
+          ["deriveKey"]
+        );
+        const derivedKey = await subtle.deriveKey(
+          {
+            name: "PBKDF2",
+            salt: saltBytes,
+            iterations: options.iterations || 31e4,
+            hash
+          },
+          baseKey,
+          { name: "AES-GCM", length: keyLength },
+          extractable,
+          ["encrypt", "decrypt"]
+        );
+        return {
+          key: derivedKey,
+          salt: CKeyManager.toBase64(saltBytes)
+        };
+      }
+      if (options.kdf === "hkdf") {
+        const baseKey = await subtle.importKey(
+          "raw",
+          rawKeyBytes,
+          "HKDF",
+          false,
+          ["deriveKey"]
+        );
+        const infoBytes = resolveInfoBytes(options.info, "katlux-derived-aes-key");
+        const derivedKey = await subtle.deriveKey(
+          {
+            name: "HKDF",
+            salt: saltBytes,
+            info: infoBytes,
+            hash
+          },
+          baseKey,
+          { name: "AES-GCM", length: keyLength },
+          extractable,
+          ["encrypt", "decrypt"]
+        );
+        return {
+          key: derivedKey,
+          salt: CKeyManager.toBase64(saltBytes)
+        };
       }
-      if (trimmed.endsWith("=") && /^[A-Za-z0-9+/]+={1,2}$/.test(trimmed)) {
-        try {
-          const decoded = CKeyManager.fromBase64(trimmed);
-          if (decoded.byteLength > 0) return decoded;
-        } catch {
-        }
+      throw new Error(`[CKeyManager] Unsupported KDF strategy: ${options.kdf}`);
+    } finally {
+      if (typeof passphrase === "string") {
+        rawKeyBytes.fill(0);
       }
-      const encoded = textEncoder$1.encode(trimmed);
-      return encoded.byteLength > 0 ? encoded : CKeyManager.randomBytes(16);
     }
-    return CKeyManager.randomBytes(16);
   }
-  // ── Symmetric Key Management ─────────────────────────────────────────────
   /**
-   * Generates a random AES CryptoKey suitable for AES-GCM or AES-CBC.
-   *
-   * E2EE Threat Model Note: Focuses on protecting GDPR/tenant data against database and
-   * server-side leaks. Keys remain extractable by default to enable role-based key sharing,
-   * wrapping, and transfer between authorized client sessions in multi-user SaaS apps.
-   * Client-side malware/trojan protection is out of scope.
+   * Derives an AES-GCM CryptoKey from a high-entropy secret (e.g. an ECDH shared secret key)
+   * using HKDF.
    */
-  static async generateAESKey(length = 256, algorithm = "AES-GCM", extractable = true) {
+  static async deriveKeyFromSecret(secretKey, options = {}) {
     const subtle = getSubtleCrypto();
-    const usages = algorithm === "AES-KW" ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"];
-    return await subtle.generateKey(
-      { name: algorithm, length },
+    let saltBytes;
+    if (options.salt !== void 0) {
+      saltBytes = CKeyManager.resolveSalt(options.salt);
+    } else {
+      saltBytes = new Uint8Array(16);
+    }
+    const infoBytes = resolveInfoBytes(options.info, "katlux-ecdh-aes-gcm");
+    const hash = options.hash || "SHA-256";
+    const keyLength = options.keyLength || 256;
+    const extractable = options.extractable === true;
+    return await subtle.deriveKey(
+      {
+        name: "HKDF",
+        salt: saltBytes,
+        info: infoBytes,
+        hash
+      },
+      secretKey,
+      { name: "AES-GCM", length: keyLength },
       extractable,
-      usages
+      ["encrypt", "decrypt"]
     );
   }
   /**
-   * Exports an AES CryptoKey as a raw base64 string.
+   * Derives two domain-separated, cryptographically isolated keys from a user password and salt:
+   * 1. `authKey`: For client authentication, SRP, or server challenge proofs.
+   * 2. `encryptionKey`: For AES-GCM local and field-level data encryption.
+   *
+   * Stage 1 (Password Stretching): PBKDF2-HMAC-SHA256 stretches low-entropy password into master secret.
+   * Stage 2 (Domain Expansion): HKDF-Expand derives subkeys using domain-separated context info tags.
+   * Immediate memory zeroization of intermediate master secret buffer is guaranteed.
+   *
+   * @param password - Master user password or passphrase
+   * @param salt - Salt (or omitted to generate a secure random 16-byte salt)
+   * @param options - PBKDF2 and HKDF configuration options
    */
-  static async exportAESKey(key) {
-    const subtle = getSubtleCrypto();
-    const raw = await subtle.exportKey("raw", key);
-    try {
-      return CKeyManager.toBase64(raw);
-    } finally {
-      new Uint8Array(raw).fill(0);
+  static async deriveAuthAndEncryptionKeys(password, salt, options = {}) {
+    if (!password || typeof password === "string" && password.trim().length === 0 || typeof password === "object" && "byteLength" in password && password.byteLength === 0) {
+      throw new Error("[CKeyManager] Password cannot be empty or undefined for key derivation.");
     }
-  }
-  /**
-   * Imports an AES CryptoKey from a raw base64 string.
-   */
-  static async importAESKey(base64, algorithm = "AES-GCM", extractable = false) {
     const subtle = getSubtleCrypto();
-    const rawBytes = CKeyManager.fromBase64(base64);
-    if (rawBytes.length !== 16 && rawBytes.length !== 24 && rawBytes.length !== 32) {
-      rawBytes.fill(0);
-      throw new Error(`[CKeyManager] Invalid AES key length: expected 16, 24, or 32 bytes (128, 192, or 256 bits), got ${rawBytes.length} bytes.`);
+    let saltBytes;
+    if (salt !== void 0) {
+      saltBytes = CKeyManager.resolveSalt(salt);
+    } else {
+      saltBytes = CKeyManager.randomBytes(16);
     }
-    const usages = algorithm === "AES-KW" ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"];
+    const saltBase64 = CKeyManager.toBase64(saltBytes);
+    const iterations = options.iterations || 31e4;
+    const hash = options.hash || "SHA-256";
+    const authKeyLength = options.authKeyLength || 256;
+    const encryptionKeyLength = options.encryptionKeyLength || 256;
+    const authAlgorithm = options.authAlgorithm || "HMAC";
+    const authInfo = resolveInfoBytes(options.authInfo, "katlux-auth-key-v1");
+    const encryptionInfo = resolveInfoBytes(options.encryptionInfo, "katlux-encryption-key-v1");
+    const extractable = options.extractable === true;
+    const rawPasswordBytes = typeof password === "string" ? textEncoder$1.encode(password) : password instanceof Uint8Array ? new Uint8Array(password.buffer, password.byteOffset, password.byteLength) : new Uint8Array(password);
+    let masterBits;
     try {
-      return await subtle.importKey(
+      const baseKey = await subtle.importKey(
         "raw",
-        rawBytes,
-        { name: algorithm },
+        rawPasswordBytes,
+        "PBKDF2",
+        false,
+        ["deriveBits"]
+      );
+      const bitsLength = hash === "SHA-512" ? 512 : 256;
+      masterBits = await subtle.deriveBits(
+        {
+          name: "PBKDF2",
+          salt: saltBytes,
+          iterations,
+          hash
+        },
+        baseKey,
+        bitsLength
+      );
+      const hkdfKey = await subtle.importKey(
+        "raw",
+        masterBits,
+        "HKDF",
+        false,
+        ["deriveKey"]
+      );
+      const authDerivedAlgorithm = authAlgorithm === "AES-GCM" ? { name: "AES-GCM", length: authKeyLength } : { name: "HMAC", hash: { name: hash }, length: authKeyLength };
+      const authUsages = authAlgorithm === "AES-GCM" ? ["encrypt", "decrypt"] : ["sign", "verify"];
+      const authKey = await subtle.deriveKey(
+        {
+          name: "HKDF",
+          hash,
+          salt: new Uint8Array(0),
+          info: authInfo
+        },
+        hkdfKey,
+        authDerivedAlgorithm,
         extractable,
-        usages
+        authUsages
+      );
+      const encryptionKey = await subtle.deriveKey(
+        {
+          name: "HKDF",
+          hash,
+          salt: new Uint8Array(0),
+          info: encryptionInfo
+        },
+        hkdfKey,
+        { name: "AES-GCM", length: encryptionKeyLength },
+        extractable,
+        ["encrypt", "decrypt"]
       );
+      return {
+        authKey,
+        encryptionKey,
+        salt: saltBase64
+      };
     } finally {
-      rawBytes.fill(0);
+      if (typeof password === "string") {
+        rawPasswordBytes.fill(0);
+      }
+      if (masterBits) {
+        new Uint8Array(masterBits).fill(0);
+      }
     }
   }
-  // ── Asymmetric Key Pair Management ───────────────────────────────────────
+  // ── Digital Signatures, Fingerprints & Access Grants ─────────────────────
   /**
-   * Generates an RSA-OAEP public/private key pair (2048 or 4096 bits).
+   * Generates an ECDSA P-256 signing key pair.
    */
-  static async generateRSAKeyPair(bits = 4096, hash = "SHA-256", extractable = true) {
+  static async generateSigningKeyPair(curve = "P-256", extractable = true) {
     const subtle = getSubtleCrypto();
     const pair = await subtle.generateKey(
       {
-        name: "RSA-OAEP",
-        modulusLength: bits,
-        publicExponent: new Uint8Array([1, 0, 1]),
-        hash
+        name: "ECDSA",
+        namedCurve: curve
       },
       extractable,
-      ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+      ["sign", "verify"]
     );
     return {
       publicKey: pair.publicKey,
@@ -1460,720 +1482,900 @@ class CKeyManager {
     };
   }
   /**
-   * Generates an ECDH public/private key pair for elliptic curve Diffie-Hellman.
+   * Generates an ECDSA signing key pair. Alias for generateSigningKeyPair.
    */
-  static async generateECDHKeyPair(curve = "P-256", extractable = true) {
+  static async generateECDSAKeyPair(curve = "P-256", extractable = true) {
+    return CKeyManager.generateSigningKeyPair(curve, extractable);
+  }
+  /**
+   * Generates a deterministic SHA-256 fingerprint for a public key (SPKI or raw).
+   * Formatted as `SHA256:<base64url>`.
+   */
+  static async getKeyFingerprint(publicKey) {
     const subtle = getSubtleCrypto();
-    const pair = await subtle.generateKey(
+    let rawBytes;
+    if (typeof publicKey === "object" && publicKey !== null && "algorithm" in publicKey) {
+      const cryptoKey = publicKey;
+      rawBytes = await subtle.exportKey("spki", cryptoKey);
+    } else if (publicKey instanceof Uint8Array) {
+      rawBytes = publicKey;
+    } else if (publicKey instanceof ArrayBuffer) {
+      rawBytes = publicKey;
+    } else if (typeof publicKey === "string") {
+      const trimmed = publicKey.trim();
+      if (trimmed.startsWith("-----BEGIN")) {
+        const b642 = trimmed.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
+        rawBytes = CKeyManager.fromBase64(b642);
+      } else {
+        try {
+          rawBytes = CKeyManager.fromBase64(trimmed);
+        } catch {
+          rawBytes = textEncoder$1.encode(trimmed);
+        }
+      }
+    } else {
+      throw new Error(
+        "[CKeyManager] Invalid key input for getKeyFingerprint: expected CryptoKey, Uint8Array, ArrayBuffer, or string."
+      );
+    }
+    const hashBuffer = await subtle.digest("SHA-256", rawBytes);
+    const b64 = CKeyManager.toBase64(hashBuffer);
+    const b64url = b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return `SHA256:${b64url}`;
+  }
+  /**
+   * Signs arbitrary data or JSON objects using an ECDSA P-256 private key.
+   * Objects are automatically serialized via canonicalizeJson() before hashing.
+   */
+  static async sign(data, privateKey) {
+    const subtle = getSubtleCrypto();
+    if (!privateKey || !privateKey.algorithm || privateKey.algorithm.name !== "ECDSA") {
+      throw new Error("[CKeyManager] sign requires an ECDSA private key.");
+    }
+    let dataBytes;
+    if (data instanceof Uint8Array) {
+      dataBytes = data;
+    } else if (ArrayBuffer.isView(data)) {
+      dataBytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+    } else if (data instanceof ArrayBuffer) {
+      dataBytes = new Uint8Array(data);
+    } else if (typeof data === "string") {
+      dataBytes = textEncoder$1.encode(data);
+    } else {
+      const canonical = canonicalizeJson(data);
+      dataBytes = textEncoder$1.encode(canonical);
+    }
+    const namedCurve = privateKey.algorithm.namedCurve || "P-256";
+    const hashName = namedCurve === "P-384" ? "SHA-384" : namedCurve === "P-521" ? "SHA-512" : "SHA-256";
+    const signatureBuffer = await subtle.sign(
       {
-        name: "ECDH",
-        namedCurve: curve
+        name: "ECDSA",
+        hash: { name: hashName }
       },
-      extractable,
-      ["deriveKey", "deriveBits"]
+      privateKey,
+      dataBytes
     );
-    return {
-      publicKey: pair.publicKey,
-      privateKey: pair.privateKey
-    };
+    return CKeyManager.toBase64(signatureBuffer);
   }
   /**
-   * Exports a public CryptoKey to a portable JsonWebKey (JWK).
+   * Verifies an ECDSA P-256 signature against original data or JSON object.
    */
-  static async exportPublicKey(key) {
+  static async verify(data, signature, publicKey) {
     const subtle = getSubtleCrypto();
-    return await subtle.exportKey("jwk", key);
+    if (!publicKey || !publicKey.algorithm || publicKey.algorithm.name !== "ECDSA") {
+      throw new Error("[CKeyManager] verify requires an ECDSA public key.");
+    }
+    if (typeof signature !== "string" || !signature.trim()) {
+      return false;
+    }
+    try {
+      const signatureBytes = CKeyManager.fromBase64(signature);
+      let dataBytes;
+      if (data instanceof Uint8Array) {
+        dataBytes = data;
+      } else if (ArrayBuffer.isView(data)) {
+        dataBytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+      } else if (data instanceof ArrayBuffer) {
+        dataBytes = new Uint8Array(data);
+      } else if (typeof data === "string") {
+        dataBytes = textEncoder$1.encode(data);
+      } else {
+        const canonical = canonicalizeJson(data);
+        dataBytes = textEncoder$1.encode(canonical);
+      }
+      const namedCurve = publicKey.algorithm.namedCurve || "P-256";
+      const hashName = namedCurve === "P-384" ? "SHA-384" : namedCurve === "P-521" ? "SHA-512" : "SHA-256";
+      return await subtle.verify(
+        {
+          name: "ECDSA",
+          hash: { name: hashName }
+        },
+        publicKey,
+        signatureBytes,
+        dataBytes
+      );
+    } catch {
+      return false;
+    }
   }
   /**
-   * Exports a private CryptoKey to a portable JsonWebKey (JWK).
+   * Computes a deterministic HMAC-SHA256 blind index hash for an arbitrary term using the supplied CryptoKey.
+   * Performs Unicode NFKC normalization, trimming, and lowercasing before computing the signature.
+   *
+   * @param value - The input string, number, or object to compute the blind index for.
+   * @param hmacKey - CryptoKey configured for HMAC signing.
+   * @returns Lowercase hexadecimal HMAC-SHA256 blind index hash.
    */
-  static async exportPrivateKey(key) {
+  static async computeBlindIndex(value, hmacKey) {
+    if (value === null || value === void 0) return "";
+    const normalized = String(value).normalize("NFKC").trim().toLowerCase();
+    if (!normalized) return "";
+    if (!hmacKey || !hmacKey.algorithm || hmacKey.algorithm.name !== "HMAC") {
+      throw new Error("[CKeyManager] computeBlindIndex requires an HMAC CryptoKey.");
+    }
     const subtle = getSubtleCrypto();
-    return await subtle.exportKey("jwk", key);
+    const signature = await subtle.sign("HMAC", hmacKey, textEncoder$1.encode(normalized));
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
   /**
-   * Imports a public key from a JsonWebKey (JWK).
+   * Signs a structured access grant, embedding signature and granter key fingerprint.
    */
-  static async importPublicKey(jwk, algorithm) {
-    const subtle = getSubtleCrypto();
-    let importAlgorithm = algorithm;
-    let usages;
-    const isEC = jwk.kty === "EC" || typeof algorithm === "object" && algorithm?.name === "ECDH" || algorithm === "ECDH";
-    if (isEC) {
-      usages = [];
-      if (!importAlgorithm || importAlgorithm === "ECDH") {
-        importAlgorithm = { name: "ECDH", namedCurve: jwk.crv || "P-256" };
-      }
+  static async signGrant(grant, granterPrivateKey, granterPublicKey) {
+    if (!grant || typeof grant !== "object") {
+      throw new Error("[CKeyManager] signGrant requires a valid grant object.");
+    }
+    let fingerprint;
+    if (granterPublicKey) {
+      fingerprint = await CKeyManager.getKeyFingerprint(granterPublicKey);
     } else {
-      usages = ["encrypt", "wrapKey"];
-      if (!importAlgorithm || importAlgorithm === "RSA-OAEP") {
-        if (jwk.kty === "RSA") {
-          const hash = jwk.alg === "RSA-OAEP-512" ? "SHA-512" : "SHA-256";
-          importAlgorithm = { name: "RSA-OAEP", hash };
-        } else {
-          throw new Error(`[CKeyManager] Unsupported JWK kty: ${jwk.kty}`);
-        }
+      const subtle = getSubtleCrypto();
+      try {
+        const jwk = await subtle.exportKey("jwk", granterPrivateKey);
+        const pubJwk = {
+          kty: jwk.kty,
+          crv: jwk.crv,
+          x: jwk.x,
+          y: jwk.y,
+          ext: true,
+          key_ops: ["verify"]
+        };
+        const pubKey = await subtle.importKey(
+          "jwk",
+          pubJwk,
+          { name: "ECDSA", namedCurve: jwk.crv || "P-256" },
+          true,
+          ["verify"]
+        );
+        fingerprint = await CKeyManager.getKeyFingerprint(pubKey);
+      } catch {
+        throw new Error(
+          "[CKeyManager] signGrant requires granterPublicKey when granterPrivateKey is non-extractable."
+        );
       }
     }
-    return await subtle.importKey("jwk", jwk, importAlgorithm, true, usages);
+    const signature = await CKeyManager.sign(grant, granterPrivateKey);
+    return {
+      grant: { ...grant },
+      signature,
+      fingerprint
+    };
   }
   /**
-   * Imports a private key from a JsonWebKey (JWK).
+   * Verifies the authenticity and integrity of a signed access grant against granter public key.
    */
-  static async importPrivateKey(jwk, algorithm) {
-    const subtle = getSubtleCrypto();
-    let importAlgorithm = algorithm;
-    let usages;
-    const isEC = jwk.kty === "EC" || typeof algorithm === "object" && algorithm?.name === "ECDH" || algorithm === "ECDH";
-    if (isEC) {
-      usages = ["deriveKey", "deriveBits"];
-      if (!importAlgorithm || importAlgorithm === "ECDH") {
-        importAlgorithm = { name: "ECDH", namedCurve: jwk.crv || "P-256" };
-      }
-    } else {
-      usages = ["decrypt", "unwrapKey"];
-      if (!importAlgorithm || importAlgorithm === "RSA-OAEP") {
-        if (jwk.kty === "RSA") {
-          const hash = jwk.alg === "RSA-OAEP-512" ? "SHA-512" : "SHA-256";
-          importAlgorithm = { name: "RSA-OAEP", hash };
-        } else {
-          throw new Error(`[CKeyManager] Unsupported JWK kty: ${jwk.kty}`);
-        }
+  static async verifyGrant(signedGrant, granterPublicKey, options) {
+    if (!signedGrant || !signedGrant.grant || !signedGrant.signature || !signedGrant.fingerprint || !granterPublicKey) {
+      return false;
+    }
+    const expectedFingerprint = await CKeyManager.getKeyFingerprint(granterPublicKey);
+    if (signedGrant.fingerprint !== expectedFingerprint) {
+      return false;
+    }
+    if (options?.checkExpiry && signedGrant.grant.expiresAt !== void 0) {
+      const now = options.now ?? Date.now();
+      if (now > signedGrant.grant.expiresAt) {
+        return false;
       }
     }
-    return await subtle.importKey("jwk", jwk, importAlgorithm, true, usages);
+    return await CKeyManager.verify(signedGrant.grant, signedGrant.signature, granterPublicKey);
   }
-  /**
-   * Imports a public key from a PEM (SPKI) or base64 SPKI string.
-   */
-  static async importPublicKeyFromPEM(pem, algorithm = "RSA-OAEP", curve = "P-256", hash = "SHA-256") {
-    const subtle = getSubtleCrypto();
-    const cleaned = pem.replace(/-----BEGIN[ A-Z0-9_-]+-----/g, "").replace(/-----END[ A-Z0-9_-]+-----/g, "").replace(/\s+/g, "");
-    const spkiBytes = CKeyManager.fromBase64(cleaned);
-    let importAlgorithm;
-    let usages;
-    if (algorithm === "ECDH") {
-      importAlgorithm = { name: "ECDH", namedCurve: curve };
-      usages = [];
-    } else {
-      importAlgorithm = { name: "RSA-OAEP", hash };
-      usages = ["encrypt", "wrapKey"];
+}
+
+class AEncryptionProvider {
+  defaultKey;
+  _hmacKey;
+  keys;
+  activeKid;
+  allowedKids;
+  constructor(key, options) {
+    if (key !== void 0) {
+      this.defaultKey = key;
     }
-    try {
-      return await subtle.importKey("spki", spkiBytes, importAlgorithm, true, usages);
-    } finally {
-      spkiBytes.fill(0);
+    if (options?.keys) {
+      this.keys = options.keys;
     }
-  }
-  /**
-   * Imports a private key from a PEM (PKCS#8) or base64 PKCS#8 string.
-   */
-  static async importPrivateKeyFromPEM(pem, algorithm = "RSA-OAEP", curve = "P-256", hash = "SHA-256") {
-    if (/BEGIN\s+(RSA|EC)\s+PRIVATE\s+KEY/i.test(pem)) {
-      throw new Error(
-        `[CKeyManager] Failed to import private key. The provided PEM appears to be in PKCS#1 or SEC1 format. Web Crypto requires PKCS#8 format. Convert your key using: openssl pkcs8 -topk8 -nocrypt -in private.pem -out private_pkcs8.pem.`
-      );
+    if (options?.activeKid) {
+      this.activeKid = options.activeKid;
     }
-    const subtle = getSubtleCrypto();
-    const cleaned = pem.replace(/-----BEGIN[ A-Z0-9_-]+-----/g, "").replace(/-----END[ A-Z0-9_-]+-----/g, "").replace(/\s+/g, "");
-    const pkcs8Bytes = CKeyManager.fromBase64(cleaned);
-    let importAlgorithm;
-    let usages;
-    if (algorithm === "ECDH") {
-      importAlgorithm = { name: "ECDH", namedCurve: curve };
-      usages = ["deriveKey", "deriveBits"];
-    } else {
-      importAlgorithm = { name: "RSA-OAEP", hash };
-      usages = ["decrypt", "unwrapKey"];
+    if (options?.allowedKids) {
+      this.allowedKids = options.allowedKids;
     }
-    try {
-      return await subtle.importKey("pkcs8", pkcs8Bytes, importAlgorithm, true, usages);
-    } finally {
-      pkcs8Bytes.fill(0);
+    if (options?.hmacKey) {
+      this._hmacKey = options.hmacKey;
     }
   }
   /**
-   * Exports a public CryptoKey to a standard PEM (SPKI) string.
+   * Sets or updates the default secret key, CryptoKey, or async key provider function.
    */
-  static async exportPublicKeyToPEM(key) {
-    const subtle = getSubtleCrypto();
-    const spki = await subtle.exportKey("spki", key);
-    let b64;
-    try {
-      b64 = CKeyManager.toBase64(spki);
-    } finally {
-      new Uint8Array(spki).fill(0);
-    }
-    const lines = b64.match(/.{1,64}/g) || [b64];
-    return `-----BEGIN PUBLIC KEY-----
-${lines.join("\n")}
------END PUBLIC KEY-----`;
+  setDefaultKey(key) {
+    this.defaultKey = key || void 0;
   }
   /**
-   * Exports a private CryptoKey to a standard PEM (PKCS#8) string.
+   * Retrieves the currently configured default key or key provider callback.
    */
-  static async exportPrivateKeyToPEM(key) {
-    const subtle = getSubtleCrypto();
-    const pkcs8 = await subtle.exportKey("pkcs8", key);
-    let b64;
-    try {
-      b64 = CKeyManager.toBase64(pkcs8);
-    } finally {
-      new Uint8Array(pkcs8).fill(0);
-    }
-    const lines = b64.match(/.{1,64}/g) || [b64];
-    return `-----BEGIN PRIVATE KEY-----
-${lines.join("\n")}
------END PRIVATE KEY-----`;
+  getDefaultKey() {
+    return this.defaultKey;
+  }
+  /**
+   * Configures a keyring dictionary of keys with an optional active key identifier.
+   */
+  setKeyring(keys, activeKid) {
+    this.keys = keys;
+    if (activeKid !== void 0) {
+      this.activeKid = activeKid;
+    }
   }
-  // ── Key Wrapping & Unwrapping ────────────────────────────────────────────
   /**
-   * Wraps a target CryptoKey (e.g. an Account Symmetric Key) using a wrapping key
-   * (AES-KW or RSA-OAEP).
+   * Retrieves the currently configured keyring dictionary.
    */
-  static async wrapKey(keyToWrap, wrappingKey, format = "raw") {
-    const subtle = getSubtleCrypto();
-    let wrapAlgorithm;
-    if (wrappingKey.algorithm.name === "RSA-OAEP") {
-      wrapAlgorithm = { name: "RSA-OAEP" };
-    } else if (wrappingKey.algorithm.name === "AES-KW") {
-      wrapAlgorithm = "AES-KW";
-    } else {
-      wrapAlgorithm = "AES-KW";
-    }
-    const wrappedBuffer = await subtle.wrapKey(format, keyToWrap, wrappingKey, wrapAlgorithm);
-    return CKeyManager.toBase64(wrappedBuffer);
+  getKeyring() {
+    return this.keys;
   }
   /**
-   * Unwraps a base64-encoded wrapped key using an unwrapping key (AES-KW or RSA-OAEP).
+   * Sets the active Key Identifier (kid) to use for outbound encryption.
    */
-  static async unwrapKey(wrappedBase64, unwrappingKey, unwrappedKeyAlgorithm = { name: "AES-GCM", length: 256 }, extractable = true, keyUsages = ["encrypt", "decrypt"], format = "raw") {
-    const subtle = getSubtleCrypto();
-    const wrappedBytes = CKeyManager.fromBase64(wrappedBase64);
-    let unwrapAlgorithm;
-    if (unwrappingKey.algorithm.name === "RSA-OAEP") {
-      unwrapAlgorithm = { name: "RSA-OAEP" };
-    } else {
-      unwrapAlgorithm = "AES-KW";
-    }
-    try {
-      return await subtle.unwrapKey(
-        format,
-        wrappedBytes,
-        unwrappingKey,
-        unwrapAlgorithm,
-        unwrappedKeyAlgorithm,
-        extractable,
-        keyUsages
-      );
-    } finally {
-      wrappedBytes.fill(0);
-    }
+  setActiveKid(kid) {
+    this.activeKid = kid;
   }
   /**
-   * Generates a high-entropy symmetric AES-GCM Account Data Encryption Key (ADEK).
-   * Designed for multi-user table and field-level encryption.
+   * Retrieves the active Key Identifier (kid).
    */
-  static async generateAccountDataKey(length = 256, extractable = false) {
-    const subtle = getSubtleCrypto();
-    return await subtle.generateKey(
-      { name: "AES-GCM", length },
-      extractable,
-      ["encrypt", "decrypt"]
-    );
+  getActiveKid() {
+    return this.activeKid;
   }
   /**
-   * Wraps an Account Data Encryption Key (ADEK) for a specific user using the user's public key (RSA-OAEP).
-   * Returns a Base64-encoded wrapped key string suitable for storage in role-map / access tables.
+   * Sets or updates the dedicated HMAC key or key provider callback for blind indexing.
    */
-  static async wrapAccountKeyForUser(adek, userPublicKey) {
-    const subtle = getSubtleCrypto();
-    if (userPublicKey.algorithm.name === "RSA-OAEP") {
-      const rawKey = await subtle.exportKey("raw", adek);
-      try {
-        const wrappedBuffer = await subtle.encrypt(
-          { name: "RSA-OAEP" },
-          userPublicKey,
-          rawKey
-        );
-        return CKeyManager.toBase64(wrappedBuffer);
-      } finally {
-        new Uint8Array(rawKey).fill(0);
-      }
-    }
-    throw new Error(
-      `[CKeyManager] Unsupported user key algorithm for wrapAccountKeyForUser: '${userPublicKey.algorithm.name}'. Expected 'RSA-OAEP'.`
-    );
+  setHmacKey(key) {
+    this._hmacKey = key || void 0;
   }
   /**
-   * Unwraps a Base64-encoded Account Data Encryption Key (ADEK) using the user's private key (RSA-OAEP).
-   * Returns the restored AES-GCM CryptoKey ready for use in CWebCryptoEncryptionProvider.
+   * Retrieves the currently configured HMAC key or key provider callback.
    */
-  static async unwrapAccountKeyForUser(wrappedKeyBase64, userPrivateKey, unwrappedKeyAlgorithm = { name: "AES-GCM", length: 256 }, extractable = false) {
-    const subtle = getSubtleCrypto();
-    if (userPrivateKey.algorithm.name === "RSA-OAEP") {
-      const wrappedBytes = CKeyManager.fromBase64(wrappedKeyBase64);
-      let unwrappedRawKey;
-      try {
-        unwrappedRawKey = await subtle.decrypt(
-          { name: "RSA-OAEP" },
-          userPrivateKey,
-          wrappedBytes
-        );
-      } finally {
-        wrappedBytes.fill(0);
-      }
-      try {
-        return await subtle.importKey(
-          "raw",
-          unwrappedRawKey,
-          unwrappedKeyAlgorithm,
-          extractable,
-          ["encrypt", "decrypt"]
-        );
-      } finally {
-        new Uint8Array(unwrappedRawKey).fill(0);
-      }
+  getHmacKey() {
+    return this._hmacKey;
+  }
+  /**
+   * Computes a deterministic HMAC-SHA256 blind index hash for an arbitrary term.
+   * If no hmacKey is explicitly provided, uses the provider's configured hmacKey or default key.
+   */
+  async computeBlindIndex(value, hmacKey) {
+    if (value === null || value === void 0) return "";
+    const keyMaterial = hmacKey || this._hmacKey || this.defaultKey;
+    if (!keyMaterial) {
+      throw new Error("[AEncryptionProvider] computeBlindIndex requires an HMAC key. Configure hmacKey or pass a key directly.");
     }
-    throw new Error(
-      `[CKeyManager] Unsupported user key algorithm for unwrapAccountKeyForUser: '${userPrivateKey.algorithm.name}'. Expected 'RSA-OAEP'.`
+    const resolvedKey = typeof keyMaterial === "function" ? await keyMaterial() : keyMaterial;
+    if (resolvedKey && typeof resolvedKey !== "string" && resolvedKey.algorithm) {
+      return CKeyManager.computeBlindIndex(value, resolvedKey);
+    }
+    const subtle = getSubtleCrypto();
+    const keyBytes = typeof resolvedKey === "string" ? new TextEncoder().encode(resolvedKey) : resolvedKey instanceof Uint8Array ? resolvedKey : new Uint8Array(resolvedKey);
+    const importedHmacKey = await subtle.importKey(
+      "raw",
+      keyBytes,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
     );
+    return CKeyManager.computeBlindIndex(value, importedHmacKey);
   }
   /**
-   * Atomically re-wraps an Account Data Encryption Key (ADEK) for a new recipient
-   * without exposing the raw extractable symmetric key to caller application code.
-   *
-   * @param wrappedKeyBase64 - The existing ADEK envelope wrapped with current user's public key
-   * @param myPrivateKey - Current user's RSA-OAEP private key
-   * @param recipientPublicKey - New recipient's RSA-OAEP public key
-   * @returns Base64-encoded wrapped key envelope for the recipient
+   * Pre-derives and caches the native CryptoKey for subsequent cryptographic operations.
+   * Subclasses should override this with a dedicated, non-side-effecting implementation.
    */
-  static async rewrapAccountKeyForUser(wrappedKeyBase64, myPrivateKey, recipientPublicKey) {
-    const subtle = getSubtleCrypto();
-    if (!myPrivateKey || !myPrivateKey.algorithm || myPrivateKey.algorithm.name !== "RSA-OAEP" || !recipientPublicKey || !recipientPublicKey.algorithm || recipientPublicKey.algorithm.name !== "RSA-OAEP") {
-      throw new Error(`[CKeyManager] rewrapAccountKeyForUser requires RSA-OAEP keys.`);
-    }
-    if (myPrivateKey.type === "public" || recipientPublicKey.type === "private") {
+  async warmupKey(_options) {
+  }
+  /**
+   * Resolves raw key from keyProvider callback or defaultKey.
+   */
+  async resolveRawKey(keyProvider) {
+    const target = keyProvider || (this.keys && this.activeKid ? this.keys[this.activeKid] : void 0) || this.defaultKey;
+    if (!target) {
       throw new Error(
-        `[CKeyManager] rewrapAccountKeyForUser requires an RSA-OAEP private key for decryption and an RSA-OAEP public key for encryption.`
+        `[${this.constructor.name}] No encryption key or keyProvider was supplied. Key cannot be empty or undefined. A valid key must be supplied from your authentication or secret management system.`
       );
     }
-    const wrappedBytes = CKeyManager.fromBase64(wrappedKeyBase64);
-    let rawKeyBuffer;
-    try {
-      rawKeyBuffer = await subtle.decrypt(
-        { name: "RSA-OAEP" },
-        myPrivateKey,
-        wrappedBytes
-      );
-      const rewrappedBuffer = await subtle.encrypt(
-        { name: "RSA-OAEP" },
-        recipientPublicKey,
-        rawKeyBuffer
+    const rawKey = typeof target === "function" ? await target() : target;
+    if (!rawKey || typeof rawKey === "string" && rawKey.trim().length === 0 || typeof rawKey === "object" && "byteLength" in rawKey && rawKey.byteLength === 0) {
+      throw new Error(
+        `[${this.constructor.name}] No encryption key or keyProvider was supplied. Key provider resolved to empty or undefined key.`
       );
-      return CKeyManager.toBase64(rewrappedBuffer);
-    } finally {
-      wrappedBytes.fill(0);
-      if (rawKeyBuffer) {
-        new Uint8Array(rawKeyBuffer).fill(0);
-      }
     }
+    return rawKey;
   }
-  // ── Key Derivation Functions (PBKDF2 & HKDF) ──────────────────────────────
   /**
-   * Derives a symmetric AES-GCM CryptoKey from a passphrase using PBKDF2 or HKDF.
-   * Returns the derived CryptoKey and the base64-encoded salt.
+   * Checks whether the given payload is an encrypted envelope.
    */
-  static async deriveKey(passphrase, options) {
-    if (!passphrase || typeof passphrase === "string" && passphrase.trim().length === 0 || typeof passphrase === "object" && "byteLength" in passphrase && passphrase.byteLength === 0) {
-      throw new Error("[CKeyManager] Passphrase cannot be empty or undefined for key derivation.");
-    }
-    const subtle = getSubtleCrypto();
-    const saltBytes = CKeyManager.resolveSalt(options.salt);
-    const keyLength = options.keyLength || 256;
-    const hash = options.hash || "SHA-256";
-    const extractable = options.extractable === true;
-    const rawKeyBytes = typeof passphrase === "string" ? textEncoder$1.encode(passphrase) : passphrase instanceof Uint8Array ? passphrase : new Uint8Array(passphrase);
-    try {
-      if (options.kdf === "pbkdf2") {
-        const baseKey = await subtle.importKey(
-          "raw",
-          rawKeyBytes,
-          "PBKDF2",
-          false,
-          ["deriveKey"]
-        );
-        const derivedKey = await subtle.deriveKey(
-          {
-            name: "PBKDF2",
-            salt: saltBytes,
-            iterations: options.iterations || 31e4,
-            hash
-          },
-          baseKey,
-          { name: "AES-GCM", length: keyLength },
-          extractable,
-          ["encrypt", "decrypt"]
-        );
-        return {
-          key: derivedKey,
-          salt: CKeyManager.toBase64(saltBytes)
-        };
-      }
-      if (options.kdf === "hkdf") {
-        const baseKey = await subtle.importKey(
-          "raw",
-          rawKeyBytes,
-          "HKDF",
-          false,
-          ["deriveKey"]
-        );
-        const infoBytes = resolveInfoBytes(options.info, "katlux-derived-aes-key");
-        const derivedKey = await subtle.deriveKey(
-          {
-            name: "HKDF",
-            salt: saltBytes,
-            info: infoBytes,
-            hash
-          },
-          baseKey,
-          { name: "AES-GCM", length: keyLength },
-          extractable,
-          ["encrypt", "decrypt"]
-        );
-        return {
-          key: derivedKey,
-          salt: CKeyManager.toBase64(saltBytes)
-        };
-      }
-      throw new Error(`[CKeyManager] Unsupported KDF strategy: ${options.kdf}`);
-    } finally {
-      if (typeof passphrase === "string") {
-        rawKeyBytes.fill(0);
+  static isEncrypted(payload) {
+    if (!payload || typeof payload !== "object") return false;
+    return payload.__encrypted === true && typeof payload.ciphertext === "string" && typeof payload.iv === "string";
+  }
+  /**
+   * Checks whether the given payload is an encrypted envelope.
+   */
+  isEncrypted(payload) {
+    return AEncryptionProvider.isEncrypted(payload);
+  }
+  /**
+   * Clears configured keys and cached cryptographic material from memory.
+   */
+  clearKeys() {
+    this.defaultKey = void 0;
+    this.keys = void 0;
+    this.activeKid = void 0;
+    this.allowedKids = void 0;
+  }
+  /**
+   * Alias for clearKeys() to conform with standard disposal patterns.
+   */
+  dispose() {
+    this.clearKeys();
+  }
+  /**
+   * ECMAScript Explicit Resource Management protocol (using / await using declarations).
+   */
+  [Symbol.dispose]() {
+    this.dispose();
+  }
+  async [Symbol.asyncDispose]() {
+    this.dispose();
+  }
+  /**
+   * Resolves effective Authenticated Additional Data (AAD) for the operation:
+   * 1. If options.bindRequestContextAad is explicitly false, returns options.aad directly without context binding.
+   * 2. When encrypting (isDecrypt=false): binds request context `req:${method}:${url}` only if options.bindRequestContextAad === true.
+   * 3. When decrypting (isDecrypt=true): derives request context `req:${method}:${url}` if url or method is provided.
+   * 4. If explicit options.aad is provided: combines with request context if bound, or returns options.aad directly.
+   * 5. Otherwise returns undefined.
+   */
+  _resolveEffectiveAad(options, isDecrypt = false) {
+    if (!options) return void 0;
+    let rawAad = options.aad;
+    if (typeof rawAad === "function") {
+      rawAad = rawAad(void 0, "");
+    }
+    if (rawAad === void 0 && options.baseAad) {
+      rawAad = options.baseAad;
+    }
+    if (options.bindRequestContextAad === false) return rawAad;
+    const hasReqContext = Boolean(options.url || options.method);
+    if (rawAad) {
+      if (options.bindRequestContextAad === true && hasReqContext) {
+        const m = (options.method || "POST").toUpperCase();
+        const u = options.url || "";
+        const baseAad = typeof rawAad === "string" ? rawAad : rawAad instanceof Uint8Array || rawAad instanceof ArrayBuffer ? textDecoder.decode(rawAad) : String(rawAad);
+        if (baseAad.includes(`|req:${m}:${u}`)) {
+          return baseAad;
+        }
+        return `${baseAad}|req:${m}:${u}`;
       }
+      return rawAad;
+    }
+    const shouldBindReq = isDecrypt ? hasReqContext : options.bindRequestContextAad === true && hasReqContext;
+    if (shouldBindReq) {
+      const m = (options.method || "POST").toUpperCase();
+      const u = options.url || "";
+      return `req:${m}:${u}`;
     }
+    return void 0;
   }
   /**
-   * Derives an AES-GCM CryptoKey from a high-entropy secret (e.g. an ECDH shared secret key)
-   * using HKDF.
+   * Helper to deterministically bind record ID, contextual sibling fields (aadFields),
+   * dynamic AAD callbacks, and field name into the AAD to prevent ciphertext swapping
+   * between fields, records, or parent entities.
    */
-  static async deriveKeyFromSecret(secretKey, options = {}) {
-    const subtle = getSubtleCrypto();
-    let saltBytes;
-    if (options.salt !== void 0) {
-      saltBytes = CKeyManager.resolveSalt(options.salt);
-    } else {
-      saltBytes = new Uint8Array(16);
+  _bindFieldAad(data, field, options) {
+    let baseAad = "";
+    if (options?.baseAad) {
+      baseAad = options.baseAad;
     }
-    const infoBytes = resolveInfoBytes(options.info, "katlux-ecdh-aes-gcm");
-    const hash = options.hash || "SHA-256";
-    const keyLength = options.keyLength || 256;
-    const extractable = options.extractable === true;
-    return await subtle.deriveKey(
-      {
-        name: "HKDF",
-        salt: saltBytes,
-        info: infoBytes,
-        hash
-      },
-      secretKey,
-      { name: "AES-GCM", length: keyLength },
-      extractable,
-      ["encrypt", "decrypt"]
-    );
+    if (options?.aad) {
+      if (typeof options.aad === "function") {
+        const dynamicRes = options.aad(data, field);
+        if (typeof dynamicRes === "string") {
+          baseAad = baseAad ? `${baseAad}|${dynamicRes}` : dynamicRes;
+        } else if (dynamicRes instanceof Uint8Array || dynamicRes instanceof ArrayBuffer) {
+          const decoded = textDecoder.decode(dynamicRes);
+          baseAad = baseAad ? `${baseAad}|${decoded}` : decoded;
+        } else if (dynamicRes !== void 0 && dynamicRes !== null) {
+          const str = String(dynamicRes);
+          baseAad = baseAad ? `${baseAad}|${str}` : str;
+        }
+      } else if (typeof options.aad === "string") {
+        baseAad = baseAad ? `${baseAad}|${options.aad}` : options.aad;
+      } else if (options.aad instanceof Uint8Array || options.aad instanceof ArrayBuffer) {
+        const decoded = textDecoder.decode(options.aad);
+        baseAad = baseAad ? `${baseAad}|${decoded}` : decoded;
+      } else {
+        const str = String(options.aad);
+        baseAad = baseAad ? `${baseAad}|${str}` : str;
+      }
+    }
+    const recordId = data && typeof data === "object" && (data.id !== void 0 || data._id !== void 0) ? String(data.id ?? data._id) : "";
+    const recordPart = recordId ? `|record:${recordId}` : "";
+    let contextPart = "";
+    if (options?.aadFields && options.aadFields.length > 0 && data && typeof data === "object") {
+      const sortedFields = [...options.aadFields].sort();
+      const parts = [];
+      for (const f of sortedFields) {
+        const val = data[f];
+        let serializedVal = "";
+        if (val === null) {
+          serializedVal = "null";
+        } else if (val !== void 0) {
+          serializedVal = typeof val === "object" ? JSON.stringify(val) : String(val);
+        }
+        parts.push(`${f}=${serializedVal}`);
+      }
+      contextPart = `|ctx:${parts.join(",")}`;
+    }
+    const reqPart = options?.bindRequestContextAad === true && (options?.url || options?.method) ? `|req:${(options.method || "POST").toUpperCase()}:${options.url || ""}` : "";
+    return {
+      ...options,
+      bindRequestContextAad: false,
+      aad: `aad:${baseAad}${recordPart}${contextPart}${reqPart}|field:${field}`
+    };
   }
   /**
-   * Derives two domain-separated, cryptographically isolated keys from a user password and salt:
-   * 1. `authKey`: For client authentication, SRP, or server challenge proofs.
-   * 2. `encryptionKey`: For AES-GCM local and field-level data encryption.
-   *
-   * Stage 1 (Password Stretching): PBKDF2-HMAC-SHA256 stretches low-entropy password into master secret.
-   * Stage 2 (Domain Expansion): HKDF-Expand derives subkeys using domain-separated context info tags.
-   * Immediate memory zeroization of intermediate master secret buffer is guaranteed.
-   *
-   * @param password - Master user password or passphrase
-   * @param salt - Salt (or omitted to generate a secure random 16-byte salt)
-   * @param options - PBKDF2 and HKDF configuration options
+   * Validates envelope metadata against algorithm whitelists and key identifiers (kid).
+   * In strict mode, allowedAlgorithms defaults to ['AES-GCM'].
    */
-  static async deriveAuthAndEncryptionKeys(password, salt, options = {}) {
-    if (!password || typeof password === "string" && password.trim().length === 0 || typeof password === "object" && "byteLength" in password && password.byteLength === 0) {
-      throw new Error("[CKeyManager] Password cannot be empty or undefined for key derivation.");
+  _validateEnvelopeMetadata(payload, options) {
+    if (!payload || typeof payload !== "object") return void 0;
+    const allowedAlgorithms = options?.allowedAlgorithms ?? (options?.strict ? ["AES-GCM"] : void 0);
+    if (allowedAlgorithms && allowedAlgorithms.length > 0) {
+      const alg = payload.alg;
+      if (!alg || !allowedAlgorithms.includes(alg)) {
+        return new Error(`[AEncryptionProvider] Algorithm mismatch: algorithm '${alg || "unknown"}' is not in allowedAlgorithms.`);
+      }
     }
-    const subtle = getSubtleCrypto();
-    let saltBytes;
-    if (salt !== void 0) {
-      saltBytes = CKeyManager.resolveSalt(salt);
-    } else {
-      saltBytes = CKeyManager.randomBytes(16);
+    const effectiveKeys = options?.keys || this.keys;
+    const effectiveAllowedKids = options?.allowedKids || this.allowedKids;
+    const allowedKids = effectiveAllowedKids ?? (effectiveKeys ? Object.keys(effectiveKeys) : void 0);
+    if (allowedKids && allowedKids.length > 0) {
+      if (payload.kid && !allowedKids.includes(payload.kid)) {
+        return new Error(`[AEncryptionProvider] Unauthorized key: kid '${payload.kid}' is not in allowedKids.`);
+      }
     }
-    const saltBase64 = CKeyManager.toBase64(saltBytes);
-    const iterations = options.iterations || 31e4;
-    const hash = options.hash || "SHA-256";
-    const authKeyLength = options.authKeyLength || 256;
-    const encryptionKeyLength = options.encryptionKeyLength || 256;
-    const authAlgorithm = options.authAlgorithm || "HMAC";
-    const authInfo = resolveInfoBytes(options.authInfo, "katlux-auth-key-v1");
-    const encryptionInfo = resolveInfoBytes(options.encryptionInfo, "katlux-encryption-key-v1");
-    const extractable = options.extractable === true;
-    const rawPasswordBytes = typeof password === "string" ? textEncoder$1.encode(password) : password instanceof Uint8Array ? new Uint8Array(password.buffer, password.byteOffset, password.byteLength) : new Uint8Array(password);
-    let masterBits;
-    try {
-      const baseKey = await subtle.importKey(
-        "raw",
-        rawPasswordBytes,
-        "PBKDF2",
-        false,
-        ["deriveBits"]
-      );
-      const bitsLength = hash === "SHA-512" ? 512 : 256;
-      masterBits = await subtle.deriveBits(
-        {
-          name: "PBKDF2",
-          salt: saltBytes,
-          iterations,
-          hash
-        },
-        baseKey,
-        bitsLength
-      );
-      const hkdfKey = await subtle.importKey(
-        "raw",
-        masterBits,
-        "HKDF",
-        false,
-        ["deriveKey"]
-      );
-      const authDerivedAlgorithm = authAlgorithm === "AES-GCM" ? { name: "AES-GCM", length: authKeyLength } : { name: "HMAC", hash: { name: hash }, length: authKeyLength };
-      const authUsages = authAlgorithm === "AES-GCM" ? ["encrypt", "decrypt"] : ["sign", "verify"];
-      const authKey = await subtle.deriveKey(
-        {
-          name: "HKDF",
-          hash,
-          salt: new Uint8Array(0),
-          info: authInfo
-        },
-        hkdfKey,
-        authDerivedAlgorithm,
-        extractable,
-        authUsages
-      );
-      const encryptionKey = await subtle.deriveKey(
-        {
-          name: "HKDF",
-          hash,
-          salt: new Uint8Array(0),
-          info: encryptionInfo
-        },
-        hkdfKey,
-        { name: "AES-GCM", length: encryptionKeyLength },
-        extractable,
-        ["encrypt", "decrypt"]
-      );
-      return {
-        authKey,
-        encryptionKey,
-        salt: saltBase64
-      };
-    } finally {
-      if (typeof password === "string") {
-        rawPasswordBytes.fill(0);
+    return void 0;
+  }
+  /**
+   * Normalizes encryption options with active keyring parameters:
+   * If `keys` and `activeKid` are configured, selects `key = keys[activeKid]` and sets `kid = activeKid`.
+   */
+  _resolveOutboundKeyringOptions(options) {
+    const effectiveKeys = options?.keys || this.keys;
+    const effectiveActiveKid = options?.activeKid || (options?.kid ? options.kid : this.activeKid);
+    let effectiveKey = options?.key;
+    let effectiveKid = options?.kid || effectiveActiveKid;
+    if (effectiveKeys && effectiveActiveKid) {
+      if (effectiveKeys[effectiveActiveKid]) {
+        effectiveKey = options?.key || effectiveKeys[effectiveActiveKid];
+        effectiveKid = effectiveActiveKid;
+      } else if (!options?.key) {
+        throw new Error(`[${this.constructor.name}] Active kid '${effectiveActiveKid}' not found in keyring keys.`);
       }
-      if (masterBits) {
-        new Uint8Array(masterBits).fill(0);
+    } else if (effectiveKeys && !effectiveKey) {
+      const kids = Object.keys(effectiveKeys);
+      if (kids.length > 0) {
+        effectiveKid = kids[0];
+        effectiveKey = effectiveKeys[kids[0]];
       }
     }
-  }
-  // ── Digital Signatures, Fingerprints & Access Grants ─────────────────────
-  /**
-   * Generates an ECDSA P-256 signing key pair.
-   */
-  static async generateSigningKeyPair(curve = "P-256", extractable = true) {
-    const subtle = getSubtleCrypto();
-    const pair = await subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: curve
-      },
-      extractable,
-      ["sign", "verify"]
-    );
-    return {
-      publicKey: pair.publicKey,
-      privateKey: pair.privateKey
-    };
+    if (effectiveKeys || effectiveActiveKid || effectiveKey !== options?.key || effectiveKid !== options?.kid) {
+      return {
+        ...options,
+        ...effectiveKeys ? { keys: effectiveKeys } : {},
+        ...effectiveActiveKid ? { activeKid: effectiveActiveKid } : {},
+        ...effectiveKey !== void 0 ? { key: effectiveKey } : {},
+        ...effectiveKid !== void 0 ? { kid: effectiveKid } : {}
+      };
+    }
+    return options || {};
   }
   /**
-   * Generates a deterministic SHA-256 fingerprint for a public key (SPKI or raw).
-   * Formatted as `SHA256:<base64url>`.
+   * Resolves the appropriate decryption key for a specific payload envelope based on its `kid`
+   * and the configured keyring (`keys`, `activeKid`, or fallback `key`).
    */
-  static async getKeyFingerprint(publicKey) {
-    const subtle = getSubtleCrypto();
-    let rawBytes;
-    if (typeof publicKey === "object" && publicKey !== null && "algorithm" in publicKey) {
-      const cryptoKey = publicKey;
-      rawBytes = await subtle.exportKey("spki", cryptoKey);
-    } else if (publicKey instanceof Uint8Array) {
-      rawBytes = publicKey;
-    } else if (publicKey instanceof ArrayBuffer) {
-      rawBytes = publicKey;
-    } else if (typeof publicKey === "string") {
-      const trimmed = publicKey.trim();
-      if (trimmed.startsWith("-----BEGIN")) {
-        const b642 = trimmed.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
-        rawBytes = CKeyManager.fromBase64(b642);
-      } else {
-        try {
-          rawBytes = CKeyManager.fromBase64(trimmed);
-        } catch {
-          rawBytes = textEncoder$1.encode(trimmed);
-        }
+  _resolveDecryptionKeyForEnvelope(payload, options) {
+    const effectiveKeys = options?.keys || this.keys;
+    const effectiveActiveKid = options?.activeKid || this.activeKid;
+    if (payload && typeof payload === "object" && payload.kid && effectiveKeys) {
+      if (effectiveKeys[payload.kid]) {
+        return effectiveKeys[payload.kid];
       }
-    } else {
-      throw new Error(
-        "[CKeyManager] Invalid key input for getKeyFingerprint: expected CryptoKey, Uint8Array, ArrayBuffer, or string."
-      );
     }
-    const hashBuffer = await subtle.digest("SHA-256", rawBytes);
-    const b64 = CKeyManager.toBase64(hashBuffer);
-    const b64url = b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    return `SHA256:${b64url}`;
+    if (effectiveKeys && effectiveActiveKid && effectiveKeys[effectiveActiveKid]) {
+      return effectiveKeys[effectiveActiveKid];
+    }
+    return options?.key || this.defaultKey;
   }
   /**
-   * Signs arbitrary data or JSON objects using an ECDSA P-256 private key.
-   * Objects are automatically serialized via canonicalizeJson() before hashing.
+   * Handles a per-field or per-payload decryption error according to configured options:
+   * - Invokes onDecryptError callback if provided
+   * - Attaches error metadata (__decryptErrors) to the record object
+   * - Returns fallback cell placeholder ('[⚠ Decryption Error]') or rethrows
    */
-  static async sign(data, privateKey) {
-    const subtle = getSubtleCrypto();
-    if (!privateKey || !privateKey.algorithm || privateKey.algorithm.name !== "ECDSA") {
-      throw new Error("[CKeyManager] sign requires an ECDSA private key.");
+  _handleDecryptError(err, record, field, value, index, options) {
+    if (record && typeof record === "object" && record !== value) {
+      record.__decryptErrors = {
+        ...record.__decryptErrors || {},
+        [field || "__payload"]: err
+      };
     }
-    let dataBytes;
-    if (data instanceof Uint8Array) {
-      dataBytes = data;
-    } else if (ArrayBuffer.isView(data)) {
-      dataBytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-    } else if (data instanceof ArrayBuffer) {
-      dataBytes = new Uint8Array(data);
-    } else if (typeof data === "string") {
-      dataBytes = textEncoder$1.encode(data);
-    } else {
-      const canonical = canonicalizeJson(data);
-      dataBytes = textEncoder$1.encode(canonical);
+    if (options?.onDecryptError === false || options?.onDecryptError === void 0) {
+      throw err;
     }
-    const namedCurve = privateKey.algorithm.namedCurve || "P-256";
-    const hashName = namedCurve === "P-384" ? "SHA-384" : namedCurve === "P-521" ? "SHA-512" : "SHA-256";
-    const signatureBuffer = await subtle.sign(
-      {
-        name: "ECDSA",
-        hash: { name: hashName }
-      },
-      privateKey,
-      dataBytes
-    );
-    return CKeyManager.toBase64(signatureBuffer);
+    if (typeof options.onDecryptError === "function") {
+      return options.onDecryptError({
+        record,
+        field,
+        value,
+        error: err,
+        index
+      });
+    }
+    if (typeof options.onDecryptError === "string") {
+      return options.onDecryptError;
+    }
+    if (options.onDecryptError === true) {
+      return "[\u26A0 Decryption Error]";
+    }
+    throw err;
   }
   /**
-   * Verifies an ECDSA P-256 signature against original data or JSON object.
+   * Encrypts a single scalar value with contextual AAD binding into an IEncryptedPayload envelope.
+   * Binds recordId, fieldName, and sibling aadFields deterministically to protect against ciphertext swapping.
+   *
+   * @param value - Scalar value (string, number, boolean, object) to encrypt.
+   * @param context - Field encryption context with recordId, fieldName, and optional sibling aadFields.
    */
-  static async verify(data, signature, publicKey) {
-    const subtle = getSubtleCrypto();
-    if (!publicKey || !publicKey.algorithm || publicKey.algorithm.name !== "ECDSA") {
-      throw new Error("[CKeyManager] verify requires an ECDSA public key.");
-    }
-    if (typeof signature !== "string" || !signature.trim()) {
-      return false;
+  async encryptField(value, context) {
+    if (value === void 0 || value === null) return value;
+    if (this.isEncrypted(value)) return value;
+    const field = context?.fieldName || "field";
+    const dummyData = {};
+    if (context?.recordId !== void 0) {
+      dummyData.id = context.recordId;
+    }
+    const { aadFields, ...restContext } = context || {};
+    let boundOptions = { ...restContext };
+    if (aadFields) {
+      if (!Array.isArray(aadFields) && typeof aadFields === "object") {
+        Object.assign(dummyData, aadFields);
+        boundOptions.aadFields = Object.keys(aadFields);
+      } else if (Array.isArray(aadFields)) {
+        boundOptions.aadFields = aadFields;
+        if (context?.record) {
+          Object.assign(dummyData, context.record);
+        }
+      }
+    }
+    const resolvedOptions = this._bindFieldAad(dummyData, field, boundOptions);
+    return this.encryptValue(value, resolvedOptions);
+  }
+  /**
+   * Decrypts a single IEncryptedPayload envelope back into its scalar plaintext value using contextual AAD.
+   * Validates recordId, fieldName, and sibling aadFields integrity.
+   *
+   * @param envelope - The IEncryptedPayload envelope to decrypt.
+   * @param context - Field encryption context matching the encryption parameters.
+   */
+  async decryptField(envelope, context) {
+    if (!this.isEncrypted(envelope)) return envelope;
+    const field = context?.fieldName || "field";
+    const dummyData = {};
+    if (context?.recordId !== void 0) {
+      dummyData.id = context.recordId;
     }
-    try {
-      const signatureBytes = CKeyManager.fromBase64(signature);
-      let dataBytes;
-      if (data instanceof Uint8Array) {
-        dataBytes = data;
-      } else if (ArrayBuffer.isView(data)) {
-        dataBytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-      } else if (data instanceof ArrayBuffer) {
-        dataBytes = new Uint8Array(data);
-      } else if (typeof data === "string") {
-        dataBytes = textEncoder$1.encode(data);
-      } else {
-        const canonical = canonicalizeJson(data);
-        dataBytes = textEncoder$1.encode(canonical);
+    const { aadFields, ...restContext } = context || {};
+    let boundOptions = { ...restContext };
+    if (aadFields) {
+      if (!Array.isArray(aadFields) && typeof aadFields === "object") {
+        Object.assign(dummyData, aadFields);
+        boundOptions.aadFields = Object.keys(aadFields);
+      } else if (Array.isArray(aadFields)) {
+        boundOptions.aadFields = aadFields;
+        if (context?.record) {
+          Object.assign(dummyData, context.record);
+        }
       }
-      const namedCurve = publicKey.algorithm.namedCurve || "P-256";
-      const hashName = namedCurve === "P-384" ? "SHA-384" : namedCurve === "P-521" ? "SHA-512" : "SHA-256";
-      return await subtle.verify(
-        {
-          name: "ECDSA",
-          hash: { name: hashName }
-        },
-        publicKey,
-        signatureBytes,
-        dataBytes
-      );
-    } catch {
-      return false;
     }
+    const resolvedOptions = this._bindFieldAad(dummyData, field, boundOptions);
+    return this.decryptValue(envelope, resolvedOptions);
   }
   /**
-   * Signs a structured access grant, embedding signature and granter key fingerprint.
+   * Top-level polymorphic encryption method.
+   * Automatically performs value-level encryption:
+   * - If data is an array of objects: recursively encrypts each row.
+   * - If data is an object: encrypts specified fields (or all values if valueEncryption is true),
+   *   preserving JSON object keys so backend APIs and ORMs can parse keys and perform upserts.
+   * - If data is a primitive or whole-payload envelope: encrypts as a single value.
    */
-  static async signGrant(grant, granterPrivateKey, granterPublicKey) {
-    if (!grant || typeof grant !== "object") {
-      throw new Error("[CKeyManager] signGrant requires a valid grant object.");
+  async encrypt(data, options) {
+    if (data === void 0 || data === null) return data;
+    if (this.isEncrypted(data)) return data;
+    options = this._resolveOutboundKeyringOptions(options);
+    if (options?.valueEncryption === false && (!options.fields || options.fields.length === 0)) {
+      return this.encryptValue(data, options);
     }
-    let fingerprint;
-    if (granterPublicKey) {
-      fingerprint = await CKeyManager.getKeyFingerprint(granterPublicKey);
-    } else {
-      const subtle = getSubtleCrypto();
-      try {
-        const jwk = await subtle.exportKey("jwk", granterPrivateKey);
-        const pubJwk = {
-          kty: jwk.kty,
-          crv: jwk.crv,
-          x: jwk.x,
-          y: jwk.y,
-          ext: true,
-          key_ops: ["verify"]
-        };
-        const pubKey = await subtle.importKey(
-          "jwk",
-          pubJwk,
-          { name: "ECDSA", namedCurve: jwk.crv || "P-256" },
-          true,
-          ["verify"]
+    if (Array.isArray(data)) {
+      if (data.length === 0) return data;
+      if (options?.fields && options.fields.length > 0) {
+        const fields = options.fields;
+        let hasUnencrypted = false;
+        for (let i = 0; i < data.length; i++) {
+          const item = data[i];
+          if (item && typeof item === "object") {
+            for (let f = 0; f < fields.length; f++) {
+              const val = item[fields[f]];
+              if (val !== void 0 && val !== null && !this.isEncrypted(val)) {
+                hasUnencrypted = true;
+                break;
+              }
+            }
+            if (hasUnencrypted) break;
+          }
+        }
+        if (!hasUnencrypted) {
+          return data;
+        }
+        await this.warmupKey(options);
+        const itemOptions = { ...options, _warmed: true };
+        return Promise.all(data.map((item) => this.encrypt(item, itemOptions)));
+      }
+      if (options?.valueEncryption === true) {
+        await this.warmupKey(options);
+        const itemOptions = { ...options, _warmed: true };
+        return Promise.all(data.map((item) => this.encrypt(item, itemOptions)));
+      }
+      return this.encryptValue(data, options);
+    }
+    if (typeof data === "object" && !ArrayBuffer.isView(data) && !(data instanceof ArrayBuffer)) {
+      if (options?.fields && options.fields.length > 0) {
+        const fieldsToEncrypt = options.fields.filter(
+          (field) => Object.prototype.hasOwnProperty.call(data, field) && data[field] !== void 0 && data[field] !== null && !this.isEncrypted(data[field])
+        );
+        if (fieldsToEncrypt.length === 0) {
+          return data;
+        }
+        if (!options?._warmed) {
+          await this.warmupKey(options);
+        }
+        const result = { ...data };
+        const entries = await Promise.all(
+          fieldsToEncrypt.map(async (field) => {
+            const fieldOptions = this._bindFieldAad(data, field, options);
+            return [field, await this.encryptValue(result[field], fieldOptions)];
+          })
         );
-        fingerprint = await CKeyManager.getKeyFingerprint(pubKey);
-      } catch {
-        throw new Error(
-          "[CKeyManager] signGrant requires granterPublicKey when granterPrivateKey is non-extractable."
+        for (const [field, encryptedVal] of entries) {
+          safeSetProperty(result, field, encryptedVal);
+        }
+        return result;
+      }
+      if (options?.valueEncryption === true) {
+        const result = { ...data };
+        const keysToEncrypt = Object.keys(result).filter(
+          (key) => result[key] !== void 0 && result[key] !== null && !this.isEncrypted(result[key])
+        );
+        if (keysToEncrypt.length === 0) {
+          return result;
+        }
+        if (!options?._warmed) {
+          await this.warmupKey(options);
+        }
+        const entries = await Promise.all(
+          keysToEncrypt.map(async (key) => {
+            const fieldOptions = this._bindFieldAad(data, key, options);
+            return [key, await this.encryptValue(result[key], fieldOptions)];
+          })
         );
+        for (const [key, encryptedVal] of entries) {
+          safeSetProperty(result, key, encryptedVal);
+        }
+        return result;
       }
     }
-    const signature = await CKeyManager.sign(grant, granterPrivateKey);
-    return {
-      grant: { ...grant },
-      signature,
-      fingerprint
-    };
+    return this.encryptValue(data, options);
   }
   /**
-   * Verifies the authenticity and integrity of a signed access grant against granter public key.
+   * Top-level polymorphic decryption method.
+   * Automatically performs value-level decryption:
+   * - If payload is an encrypted envelope: validates metadata and decrypts directly via decryptValue.
+   * - If payload is an array of objects: decrypts each row (batched with local memoization).
+   * - If payload is an object: decrypts any encrypted value cells across fields.
+   * In strict mode:
+   * - Unencrypted plaintext in configured `fields` triggers a decryption error.
+   * - Envelopes are validated against `allowedAlgorithms` and `allowedKids`.
+   * - Errors are routed through `onDecryptError` or populated into `__decryptErrors`.
    */
-  static async verifyGrant(signedGrant, granterPublicKey, options) {
-    if (!signedGrant || !signedGrant.grant || !signedGrant.signature || !signedGrant.fingerprint || !granterPublicKey) {
-      return false;
+  async decrypt(payload, options) {
+    if (payload === void 0 || payload === null) return payload;
+    if (this.isEncrypted(payload)) {
+      const envelopeKey = this._resolveDecryptionKeyForEnvelope(payload, options);
+      const envelopeOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
+      const metaErr = this._validateEnvelopeMetadata(payload, envelopeOptions);
+      if (metaErr) {
+        return this._handleDecryptError(metaErr, payload, "", payload, void 0, envelopeOptions);
+      }
+      try {
+        return await this.decryptValue(payload, envelopeOptions);
+      } catch (err) {
+        return this._handleDecryptError(err, payload, "", payload, void 0, envelopeOptions);
+      }
     }
-    const expectedFingerprint = await CKeyManager.getKeyFingerprint(granterPublicKey);
-    if (signedGrant.fingerprint !== expectedFingerprint) {
-      return false;
+    if (Array.isArray(payload)) {
+      if (payload.length === 0) return payload;
+      const localMemo = /* @__PURE__ */ new Map();
+      const decryptRow = async (item, rowIndex) => {
+        if (!item) return item;
+        if (this.isEncrypted(item)) {
+          const envelopeKey = this._resolveDecryptionKeyForEnvelope(item, options);
+          const envelopeOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
+          const metaErr = this._validateEnvelopeMetadata(item, envelopeOptions);
+          if (metaErr) {
+            return this._handleDecryptError(metaErr, item, "", item, rowIndex, envelopeOptions);
+          }
+          const ct = item.ciphertext;
+          const iv = item.iv || "";
+          const aadPart = options?.aad ? typeof options.aad === "string" ? options.aad : "" : "";
+          const memoKey = `${ct}:${iv}:${aadPart}:${item.kid || ""}`;
+          try {
+            if (!localMemo.has(memoKey)) {
+              localMemo.set(memoKey, this.decryptValue(item, envelopeOptions));
+            }
+            return await localMemo.get(memoKey);
+          } catch (err) {
+            return this._handleDecryptError(err, item, "", item, rowIndex, envelopeOptions);
+          }
+        }
+        if (typeof item === "object" && !ArrayBuffer.isView(item) && !(item instanceof ArrayBuffer)) {
+          const targetKeys = options?.fields && options.fields.length > 0 ? options.fields.filter((f) => Object.prototype.hasOwnProperty.call(item, f)) : Object.keys(item);
+          const keysToDecrypt = targetKeys.filter((key) => this.isEncrypted(item[key]));
+          const strictViolationKeys = options?.strict === true && options?.fields && options.fields.length > 0 ? targetKeys.filter((key) => item[key] !== void 0 && item[key] !== null && !this.isEncrypted(item[key])) : [];
+          if (keysToDecrypt.length === 0 && strictViolationKeys.length === 0) {
+            return item;
+          }
+          const proto = Object.getPrototypeOf(item);
+          const result = proto && proto !== Object.prototype ? Object.assign(Object.create(proto), item) : { ...item };
+          for (const key of strictViolationKeys) {
+            const err = new Error(`[AEncryptionProvider] Strict decryption violation: field '${key}' contains unencrypted plaintext.`);
+            const fallbackVal = this._handleDecryptError(err, result, key, item[key], rowIndex, options);
+            safeSetProperty(result, key, fallbackVal);
+          }
+          await Promise.all(
+            keysToDecrypt.map(async (key) => {
+              const env = item[key];
+              const envelopeKey = this._resolveDecryptionKeyForEnvelope(env, options);
+              const baseOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
+              const boundOptions = this._bindFieldAad(item, key, baseOptions);
+              const hasBoundAad = boundOptions.aad !== baseOptions?.aad;
+              const metaErr = this._validateEnvelopeMetadata(env, boundOptions);
+              if (metaErr) {
+                const fallbackVal = this._handleDecryptError(metaErr, result, key, env, rowIndex, boundOptions);
+                safeSetProperty(result, key, fallbackVal);
+                return;
+              }
+              const ct = env.ciphertext;
+              const iv = env.iv || "";
+              const aadPart = boundOptions.aad ? typeof boundOptions.aad === "string" ? boundOptions.aad : "" : "";
+              const memoKey = `${ct}:${iv}:${aadPart}:${env.kid || ""}`;
+              try {
+                if (!localMemo.has(memoKey)) {
+                  const decryptPromise = (async () => {
+                    try {
+                      return await this.decryptValue(env, boundOptions);
+                    } catch (err) {
+                      const canFallback = hasBoundAad && (!options?.aadFields || options.aadFields.length === 0) && typeof options?.aad !== "function";
+                      if (canFallback && isAuthOrDecryptionError(err)) {
+                        return await this.decryptValue(env, baseOptions);
+                      }
+                      throw err;
+                    }
+                  })();
+                  localMemo.set(memoKey, decryptPromise);
+                }
+                const decryptedVal = await localMemo.get(memoKey);
+                safeSetProperty(result, key, decryptedVal);
+              } catch (err) {
+                const fallbackVal = this._handleDecryptError(err, result, key, env, rowIndex, boundOptions);
+                safeSetProperty(result, key, fallbackVal);
+              }
+            })
+          );
+          return result;
+        }
+        return item;
+      };
+      if (payload.length <= 100) {
+        return Promise.all(payload.map((item, index) => decryptRow(item, index)));
+      }
+      const batchSize = 1e3;
+      const results = new Array(payload.length);
+      for (let i = 0; i < payload.length; i += batchSize) {
+        const end = Math.min(i + batchSize, payload.length);
+        const chunk = payload.slice(i, end);
+        const chunkRes = await Promise.all(chunk.map((item, localIdx) => decryptRow(item, i + localIdx)));
+        for (let j = 0; j < chunkRes.length; j++) {
+          results[i + j] = chunkRes[j];
+        }
+        if (end < payload.length && (i > 0 && i % 5e3 === 0)) {
+          await new Promise((r) => setTimeout(r, 0));
+        }
+      }
+      return results;
     }
-    if (options?.checkExpiry && signedGrant.grant.expiresAt !== void 0) {
-      const now = options.now ?? Date.now();
-      if (now > signedGrant.grant.expiresAt) {
-        return false;
+    if (typeof payload === "object" && !ArrayBuffer.isView(payload) && !(payload instanceof ArrayBuffer)) {
+      const targetKeys = options?.fields && options.fields.length > 0 ? options.fields.filter((f) => Object.prototype.hasOwnProperty.call(payload, f)) : Object.keys(payload);
+      const keysToDecrypt = targetKeys.filter((key) => this.isEncrypted(payload[key]));
+      const strictViolationKeys = options?.strict === true && options?.fields && options.fields.length > 0 ? targetKeys.filter((key) => payload[key] !== void 0 && payload[key] !== null && !this.isEncrypted(payload[key])) : [];
+      if (keysToDecrypt.length === 0 && strictViolationKeys.length === 0) {
+        return payload;
+      }
+      const proto = Object.getPrototypeOf(payload);
+      const result = proto && proto !== Object.prototype ? Object.assign(Object.create(proto), payload) : { ...payload };
+      for (const key of strictViolationKeys) {
+        const err = new Error(`[AEncryptionProvider] Strict decryption violation: field '${key}' contains unencrypted plaintext.`);
+        const fallbackVal = this._handleDecryptError(err, result, key, payload[key], void 0, options);
+        safeSetProperty(result, key, fallbackVal);
       }
+      await Promise.all(
+        keysToDecrypt.map(async (key) => {
+          const env = payload[key];
+          const envelopeKey = this._resolveDecryptionKeyForEnvelope(env, options);
+          const baseOptions = envelopeKey !== options?.key ? { ...options, key: envelopeKey } : options;
+          const boundOptions = this._bindFieldAad(payload, key, baseOptions);
+          const hasBoundAad = boundOptions.aad !== baseOptions?.aad;
+          const metaErr = this._validateEnvelopeMetadata(env, boundOptions);
+          if (metaErr) {
+            const fallbackVal = this._handleDecryptError(metaErr, result, key, env, void 0, boundOptions);
+            safeSetProperty(result, key, fallbackVal);
+            return;
+          }
+          try {
+            let decryptedVal;
+            try {
+              decryptedVal = await this.decryptValue(env, boundOptions);
+            } catch (err) {
+              const canFallback = hasBoundAad && (!options?.aadFields || options.aadFields.length === 0) && typeof options?.aad !== "function";
+              if (canFallback && isAuthOrDecryptionError(err)) {
+                decryptedVal = await this.decryptValue(env, baseOptions);
+              } else {
+                throw err;
+              }
+            }
+            safeSetProperty(result, key, decryptedVal);
+          } catch (err) {
+            const fallbackVal = this._handleDecryptError(err, result, key, env, void 0, boundOptions);
+            safeSetProperty(result, key, fallbackVal);
+          }
+        })
+      );
+      return result;
     }
-    return await CKeyManager.verify(signedGrant.grant, signedGrant.signature, granterPublicKey);
+    return payload;
   }
 }
 
@@ -4998,6 +5200,13 @@ class CSearchIndex {
     const signature = await subtle.sign("HMAC", key, textEncoder.encode(normalized));
     return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
+  /**
+   * Computes a deterministic HMAC-SHA256 blind index hash for a term using the configured HMAC key.
+   * Performs Unicode NFKC normalization, trimming, and lowercasing.
+   */
+  async computeBlindIndex(term) {
+    return this.computeToken(term);
+  }
   /**
    * Computes HMAC-SHA256 tokens for all trigrams of a term.
    */
@@ -5027,9 +5236,21 @@ class CSearchIndex {
         const token = await this.computeToken(rawVal);
         const trigrams = await this.computeTrigramTokens(rawVal);
         fieldMap.set(field, { token, trigrams });
+      } else if (rawVal && typeof rawVal === "object" && rawVal.__encrypted === true) {
+        const precomputedToken = row[`${field}_bidx`] || row[`${field}_token`];
+        if (typeof precomputedToken === "string" && precomputedToken) {
+          fieldMap.set(field, { token: precomputedToken, trigrams: /* @__PURE__ */ new Set() });
+        }
       }
     }
   }
+  /**
+   * Indexes a row using pre-decrypted plaintext field values.
+   * Allows indexing rows that contain pre-encrypted ciphertext envelopes in allData.
+   */
+  async indexRowDecrypted(row, decryptedPlaintext) {
+    return this.indexRow(row, decryptedPlaintext);
+  }
   /**
    * Indexes an array of rows.
    */
@@ -5078,7 +5299,7 @@ class CSearchIndex {
       }
       return true;
     }
-    if (operator === EDataFilterOperator.NotIn || operator === "notIn") {
+    if (operator === EDataFilterOperator.NotIn || operator === "notIn" || operator === "nin") {
       const queryTrigramTokens = await this.computeTrigramTokens(filterValue);
       if (queryTrigramTokens.size === 0) return false;
       for (const tok of queryTrigramTokens) {
@@ -5149,7 +5370,7 @@ class CSearchIndex {
             }
             return true;
           });
-        } else if (op === EDataFilterOperator.NotIn || op === "notIn") {
+        } else if (op === EDataFilterOperator.NotIn || op === "notIn" || op === "nin") {
           const queryTrigrams = await this.computeTrigramTokens(filterValue);
           checks.push((row) => {
             const entry = this.getEntry(row, key);
@@ -5268,6 +5489,36 @@ class AEncryptedClientProvider extends ADataProvider {
     } : void 0;
     return await encryptRowsChunked(rows, this.encryption, options, void 0, this.idKey, indexChunk);
   }
+  /**
+   * Indexes pre-encrypted rows by performing a transient in-memory decryption pass
+   * on search fields to populate CSearchIndex without mutating underlying encrypted records in allData.
+   */
+  async indexPreEncryptedRows(rows) {
+    if (!this.isEncryptionEnabled || !this._searchIndex || !rows || rows.length === 0) {
+      return;
+    }
+    const cipher = getCipherProvider(this.encryption);
+    if (!cipher) return;
+    const ctx = buildEncryptionContext(this.encryption, this.apiUrl, this.idKey);
+    let decryptedRows = [];
+    try {
+      const decResult = await cipher.decrypt(rows, ctx);
+      decryptedRows = Array.isArray(decResult) ? decResult : [decResult];
+    } catch (err) {
+      console.warn("[Katlux Providers] indexPreEncryptedRows: Decryption failed during search index build", err);
+      return;
+    }
+    await Promise.all(rows.map((row, idx) => {
+      const decRow = decryptedRows[idx];
+      const plainFields = {};
+      for (const f of this.encryption?.fields || Object.keys(decRow || {})) {
+        if (decRow && decRow[f] !== void 0) {
+          plainFields[f] = decRow[f];
+        }
+      }
+      return this._searchIndex.indexRow(row, plainFields);
+    }));
+  }
   async decryptRows(rows) {
     if (!this.isEncryptionEnabled || !rows || rows.length === 0) {
       return { rows, decrypted: false };
@@ -5576,6 +5827,15 @@ class CFlatClientDataProvider extends AEncryptedClientProvider {
     this.loading = true;
     try {
       const rows = Array.isArray(data) ? data : [];
+      const isPreEnc = this.encryption?.preEncrypted ?? isDataEncrypted(void 0, rows);
+      if (isPreEnc) {
+        this.allData = rows;
+        if (this.searchIndex) {
+          await this.indexPreEncryptedRows(rows);
+        }
+        await this.loadPageData();
+        return;
+      }
       const encryptedRows = await this.encryptRows(rows);
       this.allData = encryptedRows;
       await this.loadPageData();
@@ -5596,6 +5856,16 @@ class CFlatClientDataProvider extends AEncryptedClientProvider {
     this.loading = true;
     try {
       const rows = Array.isArray(data) ? data : [];
+      const isPreEnc = this.encryption?.preEncrypted ?? isDataEncrypted(void 0, rows);
+      if (isPreEnc) {
+        this.allData = rows;
+        if (this.searchIndex) {
+          await this.indexPreEncryptedRows(rows);
+        }
+        options?.onProgress?.({ processed: rows.length, total: rows.length, percent: 100 });
+        await this.loadPageData();
+        return;
+      }
       const encryptedRows = await this.encryptRowsChunked(rows, options);
       this.allData = encryptedRows;
       await this.loadPageData();
@@ -7742,17 +8012,26 @@ class CAPIFlatClientDataProvider extends CFlatClientDataProvider {
       if (data) {
         const normalized = normalizeDataResult(data);
         const rows = normalized ? normalized.rows : data.rows || data;
+        const incomingRows = Array.isArray(rows) ? rows : [];
         if (this._isAccumulating) {
-          this.allData = [...this.allData, ...rows];
+          this.allData = [...this.allData, ...incomingRows];
         } else {
-          this.allData = Array.isArray(rows) ? rows : [];
+          this.allData = incomingRows;
         }
         this._filterDirty = true;
         this._sortDirty = true;
         if (normalized?.rowCount !== void 0) {
           this.rowCount = normalized.rowCount;
         }
-        this._lastDataReceivedPromise = this.loadPageData();
+        this._lastDataReceivedPromise = (async () => {
+          if (this.isEncryptionEnabled && this.searchIndex && incomingRows.length > 0) {
+            const isPreEnc = this.encryption?.preEncrypted ?? isDataEncrypted(void 0, incomingRows);
+            if (isPreEnc) {
+              await this.indexPreEncryptedRows(incomingRows);
+            }
+          }
+          await this.loadPageData();
+        })();
       }
     });
   }
@@ -7838,6 +8117,12 @@ class CAPIFlatClientDataProvider extends CFlatClientDataProvider {
           this.allData = normalized.rows;
           this._filterDirty = true;
           this._sortDirty = true;
+          if (this.isEncryptionEnabled && this.searchIndex && this.allData.length > 0) {
+            const isPreEnc = this.encryption?.preEncrypted ?? isDataEncrypted(void 0, this.allData);
+            if (isPreEnc) {
+              await this.indexPreEncryptedRows(this.allData);
+            }
+          }
           await this.loadPageData();
           this.initialLoad = false;
           this.loading = false;