@rapidmx/web-client 0.4.0 → 0.5.0

package/dist/apps/shared/search/localIndexRpcClient.js

@@ -1,12 +1,21 @@
+import { removeLocalIndexDirectories, removeLocalIndexDirectory } from "./localIndexStorage.js";
 let worker;
 let nextRequestId = 1;
 const pending = new Map();
-/** Every mailboxUid `initLocalIndex()` has opened this session, not yet `destroyLocalIndex()`-ed - lets
- * `destroyAllLocalIndexes()` (called from `AppShell.tsx`'s sign-out, which has no mailboxUid of its own
- * to pass - see that call site's own comment) destroy every open index without needing one threaded
- * through. Mirrors `keySession.ts`'s own module-level `sessions` map in spirit - session-scoped,
- * intentionally never persisted. */
+/** Every mailboxUid `initLocalIndex()` has opened this session, not yet `destroyLocalIndex()`-ed. Gates
+ * the in-session mutation helpers (`removeLocalEntity()`/`moveLocalEntity()`) so a delete/move in a
+ * mailbox this tab never indexed doesn't spin up the Worker just to no-op. */
 const initializedMailboxes = new Set();
+let generationCounter = 0;
+/** A fresh generation - see this module's doc comment. */
+export function nextLocalIndexGeneration() {
+    generationCounter += 1;
+    return generationCounter;
+}
+/** Set once this tab (or another one) signed out - no index may be opened again in this page load. */
+let signedOut = false;
+export const SIGN_OUT_CHANNEL = "rapidmx-localsearch";
+let channel;
 function getWorker() {
     if (!worker) {
         worker = new Worker(new URL("./localIndexWorker.ts", import.meta.url), { type: "module" });
@@ -23,25 +32,131 @@ function getWorker() {
                 entry.reject(new Error(event.data.error));
             }
         });
+        // Only a tab with a Worker has connections to close when another tab signs out.
+        listenForSignOut();
     }
     return worker;
 }
+function getChannel() {
+    if (!channel && typeof BroadcastChannel !== "undefined") {
+        channel = new BroadcastChannel(SIGN_OUT_CHANNEL);
+    }
+    return channel;
+}
+function listenForSignOut() {
+    getChannel()?.addEventListener("message", (event) => {
+        if (event.data?.type === "sign-out") {
+            void closeEverythingInThisTab();
+        }
+    });
+}
+/** Another tab signed out: stop every build here and close this tab's connections (which also removes their
+ * directories, now that nothing holds them open). Never rejects. */
+async function closeEverythingInThisTab() {
+    signedOut = true;
+    initializedMailboxes.clear();
+    await call("destroyAll", { generation: nextLocalIndexGeneration() }).catch(() => undefined);
+}
 function call(method, params) {
     const id = nextRequestId++;
     return new Promise((resolve, reject) => {
         pending.set(id, { resolve: resolve, reject });
-        getWorker().postMessage({ id, method, params });
+        try {
+            getWorker().postMessage({ id, method, params });
+        }
+        catch (err) {
+            pending.delete(id);
+            reject(err instanceof Error ? err : new Error(String(err)));
+        }
     });
 }
+export const PENDING_DELETIONS_KEY = "rapidmx-localsearch-pending-deletions";
+/** Stands for "every index on this device" in the pending-deletions list - recorded before a sign-out starts,
+ * so a navigation that kills it midway still gets finished on the next load. */
+const ALL_INDEXES = "*";
+function readPendingDeletions() {
+    try {
+        const parsed = JSON.parse(localStorage.getItem(PENDING_DELETIONS_KEY) ?? "[]");
+        return Array.isArray(parsed) ? parsed.filter((uid) => typeof uid === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writePendingDeletions(uids) {
+    try {
+        const list = [...new Set(uids)];
+        if (list.length === 0) {
+            localStorage.removeItem(PENDING_DELETIONS_KEY);
+        }
+        else {
+            localStorage.setItem(PENDING_DELETIONS_KEY, JSON.stringify(list));
+        }
+    }
+    catch {
+        // Storage blocked - nothing to retry from, the same as before this existed.
+    }
+}
+function updatePendingDeletions(update) {
+    const current = new Set(readPendingDeletions());
+    update(current);
+    writePendingDeletions(current);
+}
+let pendingRetry;
+/** Retries every deletion an earlier page load couldn't finish. Runs once per page load (memoized), before
+ * this tab's first `init` - so it never races an index this tab itself opens. Never rejects. */
+export function retryPendingLocalIndexDeletions() {
+    pendingRetry ?? (pendingRetry = (async () => {
+        const uids = readPendingDeletions();
+        if (uids.length === 0) {
+            return;
+        }
+        const failed = [];
+        if (uids.includes(ALL_INDEXES)) {
+            const result = await removeLocalIndexDirectories().catch(() => ({ failed: [ALL_INDEXES] }));
+            failed.push(...result.failed);
+        }
+        else {
+            for (const uid of uids) {
+                await removeLocalIndexDirectory(uid).catch(() => failed.push(uid));
+            }
+        }
+        writePendingDeletions(failed);
+    })());
+    return pendingRetry;
+}
 export async function initLocalIndex(params) {
+    await retryPendingLocalIndexDeletions();
+    if (signedOut) {
+        throw new Error("Signed out - the local search index is unavailable in this tab.");
+    }
     await call("init", params);
     initializedMailboxes.add(params.mailboxUid);
 }
-export function indexLocalEntities(mailboxUid, entities) {
-    return call("indexEntities", { mailboxUid, entities });
+export function indexLocalEntities(mailboxUid, entities, generation) {
+    return call("indexEntities", { mailboxUid, entities, generation });
+}
+/** Drops one message from this session's local index (a delete). A no-op for a mailbox not indexed in
+ * this tab - a later build pass prunes it instead. Never rejects: best-effort housekeeping. */
+export async function removeLocalEntity(mailboxUid, entityUid) {
+    if (!initializedMailboxes.has(mailboxUid)) {
+        return;
+    }
+    await call("removeEntity", { mailboxUid, entityUid }).catch(() => undefined);
+}
+/** Re-points one indexed message at its new folder (archive, cancel-scheduled-send) so `folder:`-scoped
+ * local searches stay correct. Same no-op/never-rejects rules as `removeLocalEntity()`. */
+export async function moveLocalEntity(mailboxUid, entityUid, folderUid) {
+    if (!initializedMailboxes.has(mailboxUid)) {
+        return;
+    }
+    await call("moveEntity", { mailboxUid, entityUid, folderUid }).catch(() => undefined);
+}
+export function getIndexedVersions(mailboxUid, entityUids) {
+    return call("indexedVersions", { mailboxUid, entityUids });
 }
-export function removeLocalEntity(mailboxUid, entityUid) {
-    return call("removeEntity", { mailboxUid, entityUid });
+export function pruneLocalEntities(mailboxUid, keepEntityUids, since, options = {}) {
+    return call("pruneEntities", { mailboxUid, keepEntityUids, since, ...options });
 }
 export function searchLocal(mailboxUid, parsed, limit, offset = 0) {
     return call("search", { mailboxUid, parsed, limit, offset });
@@ -49,30 +164,78 @@ export function searchLocal(mailboxUid, parsed, limit, offset = 0) {
 export function getLocalCoverage(mailboxUid) {
     return call("coverage", mailboxUid);
 }
-export function setLocalIndexWindow(mailboxUid, timeFloorMonths, byteBudgetBytes) {
-    return call("setWindow", { mailboxUid, timeFloorMonths, byteBudgetBytes });
+export function setLocalIndexWindow(mailboxUid, timeFloorMonths, byteBudgetBytes, generation) {
+    return call("setWindow", { mailboxUid, timeFloorMonths, byteBudgetBytes, generation });
 }
-export function setLocalIndexBuilding(mailboxUid, building) {
-    return call("setBuilding", { mailboxUid, building });
+export function setLocalIndexBuilding(mailboxUid, building, completion = { complete: false }) {
+    return call("setBuilding", { mailboxUid, building, ...completion });
 }
 /** Destroys one mailbox's local index (both the SQLite connection and its on-disk OPFS storage) - spec
- * §11 "MUST be destroyed on the same events that destroy private keys." Never throws: called from
- * lifecycle hooks (idle timeout, logout, the manual "destroy keys now" button) where a destroy failure
- * shouldn't block the key-destruction it's piggybacking on. */
+ * §11 "MUST be destroyed on the same events that destroy private keys." Never rejects (it's called from
+ * lifecycle hooks where a failure mustn't block key destruction) but resolves `false` - and logs why -
+ * when the index could not be removed, e.g. because another tab still has it open; the deletion is then
+ * retried on the next page load. */
 export async function destroyLocalIndex(mailboxUid) {
+    updatePendingDeletions((current) => current.add(mailboxUid));
     try {
-        await call("destroy", mailboxUid);
+        await call("destroy", { mailboxUid, generation: nextLocalIndexGeneration() });
+        updatePendingDeletions((current) => current.delete(mailboxUid));
+        return true;
     }
-    catch {
-        // Best-effort - see this function's own doc comment.
+    catch (err) {
+        // `call()` only ever rejects with an Error.
+        console.warn(`Could not destroy the local search index for mailbox ${mailboxUid}: ${err.message}`);
+        return false;
     }
     finally {
         initializedMailboxes.delete(mailboxUid);
     }
 }
-/** Destroys every mailbox's local index this session has opened - for a caller (`AppShell.tsx`'s
- * sign-out) that has no specific mailboxUid of its own, the same "clear everything" shape
- * `destroyUnlockedKeys()` itself offers when called with no argument. */
-export async function destroyAllLocalIndexes() {
-    await Promise.all([...initializedMailboxes].map((mailboxUid) => destroyLocalIndex(mailboxUid)));
+/** How long sign-out waits for local index destruction before navigating anyway. */
+export const DESTROY_ALL_TIMEOUT_MS = 3000;
+/**
+ * Destroys **every** local index on this device - not just the mailboxes this page load opened (sign-out
+ * from Calendar, say, never opened any), by enumerating OPFS for the index directory prefix - and tells every
+ * other tab to close its own connections. Closes this tab's own open connections through the Worker first
+ * (only if one was ever spawned - there's nothing to close otherwise, and booting one just to delete files
+ * would be waste), then removes the directories. Anything left behind is retried on the next load. Resolves
+ * `true` when everything was removed within `timeoutMs`; never rejects.
+ */
+export async function destroyAllLocalIndexes(timeoutMs = DESTROY_ALL_TIMEOUT_MS) {
+    signedOut = true;
+    writePendingDeletions([ALL_INDEXES]);
+    try {
+        getChannel()?.postMessage({ type: "sign-out" });
+    }
+    catch {
+        // A closed/unsupported channel only loses the cross-tab notification.
+    }
+    const work = (async () => {
+        let ok = true;
+        if (worker) {
+            const { failed } = await call("destroyAll", { generation: nextLocalIndexGeneration() }).catch(() => ({
+                failed: ["(worker)"],
+            }));
+            ok = failed.length === 0;
+        }
+        initializedMailboxes.clear();
+        const { failed } = await removeLocalIndexDirectories();
+        writePendingDeletions(failed);
+        return ok && failed.length === 0;
+    })().catch(() => false);
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(false), timeoutMs);
+    });
+    const result = await Promise.race([work, timeout]);
+    clearTimeout(timer);
+    if (!result) {
+        console.warn("Could not destroy every local search index before signing out.");
+    }
+    return result;
+}
+/** Removes local indexes for mailboxes outside `accessibleMailboxUids` - e.g. left behind by a different
+ * user who signed in on this device without signing out. Never rejects. */
+export async function pruneInaccessibleLocalIndexes(accessibleMailboxUids) {
+    await removeLocalIndexDirectories(new Set(accessibleMailboxUids)).catch(() => undefined);
 }

package/dist/apps/shared/search/localIndexSchema.js

@@ -14,8 +14,11 @@
  * takes.
  */
 /** Bump whenever `CREATE_SCHEMA_SQL` changes in a way existing on-disk databases can't be reconciled
- * with in place. */
-export const SCHEMA_VERSION = 1;
+ * with in place. A mismatch deletes and recreates the whole database file (not just its rows), so
+ * creation-time-only settings like `auto_vacuum` also apply to upgraded indexes.
+ *
+ * 2 - added `entities.entity_version` (incremental rebuild skip) and `auto_vacuum=INCREMENTAL`. */
+export const SCHEMA_VERSION = 2;
 /**
  * `entities` is the real row store (metadata + the plaintext content fields), `entities_fts` is an FTS5
  * *external content* table over it (`content='entities'`) - the standard SQLite pattern for keeping one
@@ -49,7 +52,8 @@ CREATE TABLE IF NOT EXISTS entities (
     subject TEXT,
     body TEXT,
     attachment_text TEXT,
-    byte_size INTEGER NOT NULL DEFAULT 0
+    byte_size INTEGER NOT NULL DEFAULT 0,
+    entity_version TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_entities_date ON entities(date_for_sort);
 CREATE INDEX IF NOT EXISTS idx_entities_mailbox ON entities(mailbox_uid);
@@ -84,12 +88,13 @@ export const BM25_WEIGHTS_SQL = "3.0, 2.0, 1.0, 1.0";
  * so re-indexing an already-present message (a flag changed, a folder move) updates it in place and the
  * `entities_au` trigger keeps `entities_fts` in sync automatically. */
 export const UPSERT_ENTITY_SQL = `
-INSERT INTO entities (entity_type, entity_uid, mailbox_uid, folder_uid, date_for_sort, participants, flags, has_attachments, subject, body, attachment_text, byte_size)
-VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+INSERT INTO entities (entity_type, entity_uid, mailbox_uid, folder_uid, date_for_sort, participants, flags, has_attachments, subject, body, attachment_text, byte_size, entity_version)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 ON CONFLICT(entity_uid) DO UPDATE SET
     folder_uid = excluded.folder_uid, date_for_sort = excluded.date_for_sort, participants = excluded.participants,
     flags = excluded.flags, has_attachments = excluded.has_attachments, subject = excluded.subject,
-    body = excluded.body, attachment_text = excluded.attachment_text, byte_size = excluded.byte_size
+    body = excluded.body, attachment_text = excluded.attachment_text, byte_size = excluded.byte_size,
+    entity_version = excluded.entity_version
 `;
 /** Bind values for `UPSERT_ENTITY_SQL`, in column order - kept alongside it so the two can never drift
  * out of sync with each other. */
@@ -107,6 +112,7 @@ export function entityBindValues(entity) {
         entity.body ?? null,
         entity.attachmentText ?? null,
         entity.byteSize,
+        entity.entityVersion ?? null,
     ];
 }
 /**

package/dist/apps/shared/search/localIndexStorage.js

@@ -0,0 +1,86 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * The Tier 2 local index's on-disk naming and bulk-removal helpers, shared by the Worker
+ * (`localIndexWorker.ts`) and the main thread (`localIndexRpcClient.ts`). Deliberately free of any
+ * wa-sqlite import so the main thread can use it without pulling the WASM build into its own bundle.
+ *
+ * Every mailbox's index lives in its own top-level OPFS directory named `rapidmx-localsearch-<mailboxUid>`
+ * (`AccessHandlePoolVFS` creates it from the VFS name). Enumerating that prefix is how sign-out destroys
+ * *every* index on this device - including ones for mailboxes this page load never opened, which the
+ * RPC client's own session-scoped bookkeeping can't know about - and how a sign-in prunes indexes left
+ * behind for mailboxes the current user can no longer access.
+ */
+export const LOCAL_INDEX_POOL_PREFIX = "rapidmx-localsearch-";
+/** The OPFS directory name (and `EncryptingVFS` name) a mailbox's index lives under. */
+export function poolNameFor(mailboxUid) {
+    return `${LOCAL_INDEX_POOL_PREFIX}${mailboxUid}`;
+}
+/** Inverse of `poolNameFor()`; `undefined` for any OPFS entry that isn't a local index directory. */
+export function mailboxUidFromPoolName(name) {
+    return name.startsWith(LOCAL_INDEX_POOL_PREFIX) && name.length > LOCAL_INDEX_POOL_PREFIX.length
+        ? name.slice(LOCAL_INDEX_POOL_PREFIX.length)
+        : undefined;
+}
+/** `navigator.storage.getDirectory()`, or `undefined` where OPFS isn't available at all (older browsers,
+ * jsdom/node) - there is nothing on disk to remove in that case. */
+async function getOpfsRoot() {
+    const storage = typeof navigator === "undefined" ? undefined : navigator.storage;
+    if (!storage?.getDirectory) {
+        return undefined;
+    }
+    return storage.getDirectory();
+}
+function isNotFound(err) {
+    return err?.name === "NotFoundError";
+}
+/** Removes one mailbox's index directory. Resolves quietly when it doesn't exist; rejects for any other
+ * failure (most commonly `NoModificationAllowedError` - another tab still holds its access handles). */
+export async function removeLocalIndexDirectory(mailboxUid) {
+    const root = await getOpfsRoot();
+    if (!root) {
+        return;
+    }
+    try {
+        await root.removeEntry(poolNameFor(mailboxUid), { recursive: true });
+    }
+    catch (err) {
+        if (!isNotFound(err)) {
+            throw err;
+        }
+    }
+}
+/** Every mailbox uid that has a local index directory on this origin. */
+export async function listLocalIndexMailboxUids() {
+    const root = await getOpfsRoot();
+    if (!root) {
+        return [];
+    }
+    const mailboxUids = [];
+    // `keys()` is part of the OPFS spec and every browser that has `getDirectory()` at all, but isn't in
+    // this TypeScript version's DOM lib yet.
+    for await (const name of root.keys()) {
+        const mailboxUid = mailboxUidFromPoolName(name);
+        if (mailboxUid) {
+            mailboxUids.push(mailboxUid);
+        }
+    }
+    return mailboxUids;
+}
+/** Removes every local index directory on this origin except those whose mailbox uid is in `keep`. */
+export async function removeLocalIndexDirectories(keep = new Set()) {
+    const result = { removed: [], failed: [] };
+    const mailboxUids = (await listLocalIndexMailboxUids()).filter((mailboxUid) => !keep.has(mailboxUid));
+    for (const mailboxUid of mailboxUids) {
+        try {
+            await removeLocalIndexDirectory(mailboxUid);
+            result.removed.push(mailboxUid);
+        }
+        catch {
+            result.failed.push(mailboxUid);
+        }
+    }
+    return result;
+}

package/dist/apps/shared/search/localIndexVFS.js

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _EncryptingVFS_instances, _EncryptingVFS_inner, _EncryptingVFS_key, _EncryptingVFS_filenamesByFileId, _EncryptingVFS_readBlock, _EncryptingVFS_writeBlock;
+var _EncryptingVFS_instances, _EncryptingVFS_inner, _EncryptingVFS_key, _EncryptingVFS_filenamesByFileId, _EncryptingVFS_readBlock, _EncryptingVFS_writeBlock, _EncryptingVFS_jReadBlocks, _EncryptingVFS_jWriteBlocks;
 ///////////////////////////////////////////////////////////////////////////////
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
@@ -80,6 +80,10 @@ export class EncryptingVFS extends FacadeVFS {
          * open handle, never persisted - this map lets `jRead`/`jWrite` recover the stable filename an AAD
          * needs to bind to, from the ephemeral fileId SQLite actually passes them. */
         _EncryptingVFS_filenamesByFileId.set(this, new Map());
+        /** Set once any block has failed to decrypt/authenticate (or the inner VFS failed a read/write outright)
+         * - `localIndexWorker.ts` checks this after a failed SQLite call to tell real corruption (discard and
+         * rebuild, spec §11 "Invalidation") apart from an ordinary error such as a malformed FTS5 query. */
+        this.corruptionDetected = false;
         __classPrivateFieldSet(this, _EncryptingVFS_inner, inner, "f");
     }
     /** `rawKey` MUST be exactly 32 bytes (AES-256) - see `localIndexKey.ts`'s `deriveLocalIndexKey()`,
@@ -152,50 +156,31 @@ export class EncryptingVFS extends FacadeVFS {
         const blocks = Math.ceil(iSize / LOGICAL_BLOCK_SIZE);
         return __classPrivateFieldGet(this, _EncryptingVFS_inner, "f").jTruncate(pFile, blocks * PHYSICAL_BLOCK_SIZE);
     }
+    /**
+     * `jRead`/`jWrite` MUST NOT throw: with the Asyncify build, an exception escaping an async VFS method
+     * never reaches the awaiting `sqlite3.*` call - it surfaces only as an unhandled rejection and the
+     * SQLite call hangs forever (confirmed by direct reproduction in node against the real wa-sqlite build).
+     * A thrown `PageCorruptedError` therefore used to wedge the whole connection instead of triggering a
+     * rebuild. Errors are converted to an I/O error return code here, which SQLite does propagate as a
+     * normal `SQLiteError`, and recorded on `corruptionDetected`.
+     */
     async jRead(pFile, pData, iOffset) {
-        const filename = __classPrivateFieldGet(this, _EncryptingVFS_filenamesByFileId, "f").get(pFile) ?? `(unknown:${pFile})`;
-        const startBlock = Math.floor(iOffset / LOGICAL_BLOCK_SIZE);
-        const endBlock = Math.floor((iOffset + pData.length - 1) / LOGICAL_BLOCK_SIZE);
-        let anyAbsent = false;
-        for (let block = startBlock; block <= endBlock; block++) {
-            const { plaintext, absent } = await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_readBlock).call(this, pFile, filename, block);
-            const blockStart = block * LOGICAL_BLOCK_SIZE;
-            const copyStart = Math.max(iOffset, blockStart);
-            const copyEnd = Math.min(iOffset + pData.length, blockStart + LOGICAL_BLOCK_SIZE);
-            pData.set(plaintext.subarray(copyStart - blockStart, copyEnd - blockStart), copyStart - iOffset);
-            // SQLITE_IOERR_SHORT_READ is how SQLite distinguishes "nothing here yet" from "here is real
-            // (possibly zero-filled) data," e.g. when probing whether a file exists at all - see
-            // #readBlock's own doc comment on why this is tracked explicitly, not inferred from content.
-            if (absent) {
-                anyAbsent = true;
-            }
+        try {
+            return await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_jReadBlocks).call(this, pFile, pData, iOffset);
+        }
+        catch {
+            this.corruptionDetected = true;
+            return VFS.SQLITE_IOERR_READ;
         }
-        return anyAbsent ? VFS.SQLITE_IOERR_SHORT_READ : VFS.SQLITE_OK;
     }
     async jWrite(pFile, pData, iOffset) {
-        const filename = __classPrivateFieldGet(this, _EncryptingVFS_filenamesByFileId, "f").get(pFile) ?? `(unknown:${pFile})`;
-        const startBlock = Math.floor(iOffset / LOGICAL_BLOCK_SIZE);
-        const endBlock = Math.floor((iOffset + pData.length - 1) / LOGICAL_BLOCK_SIZE);
-        for (let block = startBlock; block <= endBlock; block++) {
-            const blockStart = block * LOGICAL_BLOCK_SIZE;
-            const writeStart = Math.max(iOffset, blockStart);
-            const writeEnd = Math.min(iOffset + pData.length, blockStart + LOGICAL_BLOCK_SIZE);
-            // Whole-block write (the common case once SQLite's page size is fixed): no need to read the
-            // old block first. Anything narrower (a sub-page write, or this block only partially
-            // overlaps the requested range) needs the existing content as a base - a real
-            // read-modify-write - since the physical block is re-encrypted as a single AEAD unit.
-            const plaintext = writeStart === blockStart && writeEnd === blockStart + LOGICAL_BLOCK_SIZE
-                ? pData.subarray(writeStart - iOffset, writeEnd - iOffset)
-                : await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_readBlock).call(this, pFile, filename, block).then(({ plaintext: existing }) => {
-                    const merged = existing.slice();
-                    merged.set(pData.subarray(writeStart - iOffset, writeEnd - iOffset), writeStart - blockStart);
-                    return merged;
-                });
-            const rc = await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_writeBlock).call(this, pFile, filename, block, plaintext);
-            if (rc !== VFS.SQLITE_OK)
-                return rc;
+        try {
+            return await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_jWriteBlocks).call(this, pFile, pData, iOffset);
+        }
+        catch {
+            this.corruptionDetected = true;
+            return VFS.SQLITE_IOERR_WRITE;
         }
-        return VFS.SQLITE_OK;
     }
 }
 _EncryptingVFS_inner = new WeakMap(), _EncryptingVFS_key = new WeakMap(), _EncryptingVFS_filenamesByFileId = new WeakMap(), _EncryptingVFS_instances = new WeakSet(), _EncryptingVFS_readBlock = 
@@ -227,4 +212,47 @@ async function _EncryptingVFS_readBlock(pFile, filename, blockIndex) {
 }, _EncryptingVFS_writeBlock = async function _EncryptingVFS_writeBlock(pFile, filename, blockIndex, plaintext) {
     const physical = await encryptBlock(__classPrivateFieldGet(this, _EncryptingVFS_key, "f"), filename, blockIndex, plaintext);
     return __classPrivateFieldGet(this, _EncryptingVFS_inner, "f").jWrite(pFile, physical, blockIndex * PHYSICAL_BLOCK_SIZE);
+}, _EncryptingVFS_jReadBlocks = async function _EncryptingVFS_jReadBlocks(pFile, pData, iOffset) {
+    const filename = __classPrivateFieldGet(this, _EncryptingVFS_filenamesByFileId, "f").get(pFile) ?? `(unknown:${pFile})`;
+    const startBlock = Math.floor(iOffset / LOGICAL_BLOCK_SIZE);
+    const endBlock = Math.floor((iOffset + pData.length - 1) / LOGICAL_BLOCK_SIZE);
+    let anyAbsent = false;
+    for (let block = startBlock; block <= endBlock; block++) {
+        const { plaintext, absent } = await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_readBlock).call(this, pFile, filename, block);
+        const blockStart = block * LOGICAL_BLOCK_SIZE;
+        const copyStart = Math.max(iOffset, blockStart);
+        const copyEnd = Math.min(iOffset + pData.length, blockStart + LOGICAL_BLOCK_SIZE);
+        pData.set(plaintext.subarray(copyStart - blockStart, copyEnd - blockStart), copyStart - iOffset);
+        // SQLITE_IOERR_SHORT_READ is how SQLite distinguishes "nothing here yet" from "here is real
+        // (possibly zero-filled) data," e.g. when probing whether a file exists at all - see
+        // #readBlock's own doc comment on why this is tracked explicitly, not inferred from content.
+        if (absent) {
+            anyAbsent = true;
+        }
+    }
+    return anyAbsent ? VFS.SQLITE_IOERR_SHORT_READ : VFS.SQLITE_OK;
+}, _EncryptingVFS_jWriteBlocks = async function _EncryptingVFS_jWriteBlocks(pFile, pData, iOffset) {
+    const filename = __classPrivateFieldGet(this, _EncryptingVFS_filenamesByFileId, "f").get(pFile) ?? `(unknown:${pFile})`;
+    const startBlock = Math.floor(iOffset / LOGICAL_BLOCK_SIZE);
+    const endBlock = Math.floor((iOffset + pData.length - 1) / LOGICAL_BLOCK_SIZE);
+    for (let block = startBlock; block <= endBlock; block++) {
+        const blockStart = block * LOGICAL_BLOCK_SIZE;
+        const writeStart = Math.max(iOffset, blockStart);
+        const writeEnd = Math.min(iOffset + pData.length, blockStart + LOGICAL_BLOCK_SIZE);
+        // Whole-block write (the common case once SQLite's page size is fixed): no need to read the
+        // old block first. Anything narrower (a sub-page write, or this block only partially
+        // overlaps the requested range) needs the existing content as a base - a real
+        // read-modify-write - since the physical block is re-encrypted as a single AEAD unit.
+        const plaintext = writeStart === blockStart && writeEnd === blockStart + LOGICAL_BLOCK_SIZE
+            ? pData.subarray(writeStart - iOffset, writeEnd - iOffset)
+            : await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_readBlock).call(this, pFile, filename, block).then(({ plaintext: existing }) => {
+                const merged = existing.slice();
+                merged.set(pData.subarray(writeStart - iOffset, writeEnd - iOffset), writeStart - blockStart);
+                return merged;
+            });
+        const rc = await __classPrivateFieldGet(this, _EncryptingVFS_instances, "m", _EncryptingVFS_writeBlock).call(this, pFile, filename, block, plaintext);
+        if (rc !== VFS.SQLITE_OK)
+            return rc;
+    }
+    return VFS.SQLITE_OK;
 };